bloby-bot 0.69.6 → 0.70.0

package/README.md

@@ -133,7 +133,7 @@ workspace/
   PULSE.json           Periodic wake-up config (interval, quiet hours)
   CRONS.json           Scheduled tasks with cron expressions
   memory/              Daily notes (YYYY-MM-DD.md files, append-only)
-  skills/              Plugin directories with .claude-plugin/plugin.json
+  skills/              Skill folders (SKILL.md with name+description frontmatter)
   MCP.json             MCP server configuration (optional)
   files/               Attachment storage (audio, images, documents)
 ```
@@ -193,9 +193,9 @@ When a cron or pulse fires:
 
 ---
 
-## Skills & Plugins
+## Skills
 
-The agent auto-discovers skills in `workspace/skills/`. Each skill is a folder containing `.claude-plugin/plugin.json`. These are loaded as tool plugins when the agent starts a query.
+The agent auto-discovers skills in `workspace/skills/`. Each skill is a folder containing a `SKILL.md` whose YAML frontmatter carries `name` (= folder name) and `description`. All three harnesses surface that metadata in context and load the body on demand: the Claude harness mirrors skills into `workspace/.claude/skills` and enables them via the Agent SDK's `skills` option, the Codex harness mirrors them into `workspace/.codex/skills` and primes them via `skills/list`, and the Pi harness injects a name+description index into the system prompt (see `supervisor/harnesses/skills.ts`).
 
 MCP servers can be configured in `workspace/MCP.json`. The agent loads them at query time and logs which servers are active.
 
@@ -568,7 +568,7 @@ workspace/
   PULSE.json                        Periodic wake-up configuration
   CRONS.json                        Scheduled task definitions
   memory/                           Daily notes (YYYY-MM-DD.md)
-  skills/                           Plugin directories (.claude-plugin/plugin.json)
+  skills/                           Skill folders (SKILL.md with frontmatter)
   MCP.json                          MCP server configuration (optional)
   files/                            Uploaded file storage (audio/, images/, documents/)
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bloby-bot",
-  "version": "0.69.6",
+  "version": "0.70.0",
   "releaseNotes": [
     "1. Fix: agent self-update ",
     "1",

package/supervisor/chat/bloby-main.tsx

@@ -631,7 +631,7 @@ function BlobyApp() {
           <div className="absolute inset-0 z-10 flex items-center justify-center bg-background/70 backdrop-blur-[2px]">
             <span className="flex items-center gap-2 text-[12px] text-muted-foreground bg-white/[0.05] border border-white/[0.08] rounded-full px-3.5 py-1.5 shadow-lg">
               <span className={`h-1.5 w-1.5 rounded-full animate-pulse ${updating ? 'bg-amber-400' : 'bg-red-500'}`} />
-              {updating ? 'Updating — back in a moment…' : 'Offline — waiting for connection…'}
+              {updating ? 'Morphy is Updating…' : 'Morphy is Offline'}
             </span>
           </div>
         )}

package/supervisor/harnesses/claude.ts

@@ -20,6 +20,7 @@ import { getClaudeAccessToken } from '../../worker/claude-auth.js';
 import { assembleSystemPrompt } from '../../worker/prompts/prompt-assembler.js';
 import { buildAgents } from '../agents/index.js';
 import { preWarm, claimWarmup, discardWarmup } from '../cli-warmup.js';
+import { mirrorSkillsInto } from './skills.js';
 
 // ── Types ──────────────────────────────────────────────────────────────────
 
@@ -128,6 +129,20 @@ function formatConversationHistory(messages: RecentMessage[]): string {
   return messages.map((m) => `${m.role}: ${m.content}`).join('\n\n');
 }
 
+// The Agent SDK discovers project-scope skills under `<cwd>/.claude/skills`
+// (name+description listed in context, body lazy-loaded via the Skill tool).
+// Bloby keeps the canonical skills in `workspace/skills/<name>`, so we mirror
+// each one into `.claude/skills/<name>` as a symlink — same single-source
+// pattern as the codex harness's `.codex/skills` mirror. The returned names
+// feed the `skills` option as an explicit allowlist: only Bloby's workspace
+// skills are enabled, so the human's personal `~/.claude/skills` never leak
+// into the agent and the option hash stays deterministic for the pre-warmer.
+const CLAUDE_SKILLS_ROOT = path.join(WORKSPACE_DIR, '.claude', 'skills');
+
+function syncClaudeSkills(): string[] {
+  return mirrorSkillsInto(CLAUDE_SKILLS_ROOT, 'claude');
+}
+
 /** Load MCP server config from workspace/MCP.json */
 function loadMcpServers(): Record<string, any> | undefined {
   try {
@@ -210,6 +225,7 @@ async function buildConversationOptions(
 
   const agents = buildAgents();
   const mcpServers = loadMcpServers();
+  const skills = syncClaudeSkills();
 
   return {
     model,
@@ -224,6 +240,7 @@ async function buildConversationOptions(
     systemPrompt,
     mcpServers,
     agents,
+    skills,
     agentProgressSummaries: true,
     // Auto-compaction: the live conversation is a single long-lived query() whose
     // context grows every turn (messages + tool results + sub-agent transcripts).
@@ -294,6 +311,8 @@ export async function startConversation(
   if (baseOptions.mcpServers) {
     log.info(`[conversation] MCP servers: ${Object.keys(baseOptions.mcpServers).join(', ')}`);
   }
+  const skillNames = Array.isArray(baseOptions.skills) ? baseOptions.skills : [];
+  log.info(`[conversation] Skills: ${skillNames.length ? skillNames.join(', ') : 'none'}`);
 
   // Try to claim a pre-warmed subprocess — its abortController is the one
   // baked into the warm query and must be reused for end/abort to reach it.
@@ -667,6 +686,10 @@ export async function startBlobyAgentQuery(
         maxTurns: effectiveMaxTurns,
         abortController,
         systemPrompt: enrichedPrompt,
+        // Customer-facing runs (supportPrompt) get no skills — SCRIPT.md alone
+        // governs that persona and the listing would just leak ops docs into
+        // customer context. Owner runs (pulse/cron) get the full workspace set.
+        skills: supportPrompt ? [] : syncClaudeSkills(),
         mcpServers,
         stderr: (chunk: string) => { stderrBuf += chunk; },
         env: {
@@ -781,6 +804,7 @@ export async function runAgentQuery(req: AgentQueryRequest): Promise<AgentQueryR
         maxTurns,
         abortController,
         systemPrompt: systemPrompt as any,
+        skills: syncClaudeSkills(),
         ...(req.sessionId ? { resume: req.sessionId } : {}),
         stderr: (chunk: string) => { stderrBuf += chunk; },
         env: {

package/supervisor/harnesses/codex.ts

@@ -35,6 +35,7 @@ import { WORKSPACE_DIR } from '../../shared/paths.js';
 import type { SavedFile } from '../file-saver.js';
 import { getCodexAccessToken } from '../../worker/codex-auth.js';
 import { assembleSystemPrompt } from '../../worker/prompts/prompt-assembler.js';
+import { mirrorSkillsInto } from './skills.js';
 import type { OnAgentMessage, RecentMessage, AgentAttachment, AgentQueryRequest, AgentQueryResult } from './types.js';
 export type { RecentMessage, AgentAttachment };
 
@@ -771,7 +772,6 @@ async function spawnAndInitialize(
   }
 }
 
-const SKILLS_DIR = path.join(WORKSPACE_DIR, 'skills');
 // Codex discovers "repo"-scope skills under `<cwd>/.codex/skills` (verified
 // against 0.135.0 — a bare `<cwd>/skills` is NOT scanned, and `skills/list`
 // has no extra-root param). Bloby keeps the canonical skills in
@@ -780,33 +780,8 @@ const SKILLS_DIR = path.join(WORKSPACE_DIR, 'skills');
 // (Each SKILL.md needs YAML frontmatter or codex rejects it — see SKILL_FORMAT_MIGRATION.md.)
 const CODEX_SKILLS_ROOT = path.join(WORKSPACE_DIR, '.codex', 'skills');
 
-/** Mirror workspace/skills/<name> → workspace/.codex/skills/<name> as symlinks (idempotent). */
-function syncCodexSkillRoot(): void {
-  let names: string[] = [];
-  try {
-    names = fs.readdirSync(SKILLS_DIR, { withFileTypes: true })
-      .filter((e) => e.isDirectory() || e.isSymbolicLink())
-      .map((e) => e.name);
-  } catch {
-    return; // no skills dir — nothing to mirror
-  }
-  try { fs.mkdirSync(CODEX_SKILLS_ROOT, { recursive: true }); } catch {}
-  for (const name of names) {
-    const target = path.join(SKILLS_DIR, name);
-    const link = path.join(CODEX_SKILLS_ROOT, name);
-    try {
-      const cur = fs.existsSync(link) ? fs.realpathSync(link) : null;
-      if (cur === fs.realpathSync(target)) continue; // already correct
-      try { fs.rmSync(link, { recursive: true, force: true }); } catch {}
-      fs.symlinkSync(target, link, 'dir');
-    } catch (err: any) {
-      log.warn(`[codex] could not mirror skill "${name}" into .codex/skills: ${err.message}`);
-    }
-  }
-}
-
 function primeWorkspaceSkills(rpc: CodexRpc): void {
-  syncCodexSkillRoot();
+  mirrorSkillsInto(CODEX_SKILLS_ROOT, 'codex');
   rpc.request('skills/list', {
     cwds: [WORKSPACE_DIR],
     forceReload: true,

package/supervisor/harnesses/pi/index.ts

@@ -24,6 +24,7 @@ import type {
 } from '../types.js';
 export type { RecentMessage, AgentAttachment };
 
+import { buildSkillsIndex } from '../skills.js';
 import { createAsyncQueue, type AsyncQueue } from './async-queue.js';
 import { createPiSession, type PiSessionEvent } from './session.js';
 import { getPiSubProvider } from './sub-providers.js';
@@ -110,6 +111,11 @@ async function buildSystemPrompt(
   const basePrompt = await assembleSystemPrompt(names?.botName, names?.humanName, 'pi');
   let systemPrompt = basePrompt;
   systemPrompt += LIVE_CONVERSATION_HINT;
+  // Pi has no native skill machinery (Claude's SDK and Codex discover skills
+  // themselves), so inject the name+description index here — the agent reads
+  // skills/<name>/SKILL.md on demand. Customer-facing supportPrompt runs skip
+  // this builder entirely, so they never see the index.
+  systemPrompt += buildSkillsIndex();
   systemPrompt += `\n\n---\n# Your Memory Files\n\n## MYSELF.md\n${memoryFiles.myself}\n\n## MYHUMAN.md\n${memoryFiles.myhuman}\n\n## MEMORY.md\n${memoryFiles.memory}\n\n---\n# Your Config Files\n\n## PULSE.json\n${memoryFiles.pulse}\n\n## CRONS.json\n${memoryFiles.crons}`;
 
   try {

package/supervisor/harnesses/skills.ts

@@ -0,0 +1,133 @@
+/**
+ * Shared skill plumbing for all three harnesses.
+ *
+ * Canonical on-disk layout (single source of truth):
+ *   workspace/skills/<name>/SKILL.md — YAML frontmatter with `name` (= folder
+ *   name) and `description`. See SKILL_FORMAT_MIGRATION.md.
+ *
+ * Each harness consumes that one layout its own way:
+ *   - claude: mirrored into `workspace/.claude/skills` (the Agent SDK's
+ *     project-skill discovery root) and enabled via the `skills` option —
+ *     the SDK then lists name+description in context and lazy-loads bodies
+ *     through its native Skill tool.
+ *   - codex:  mirrored into `workspace/.codex/skills` (codex's repo-scope
+ *     root) and primed via `skills/list` — codex's own router takes over.
+ *   - pi:     no native skill machinery, so `buildSkillsIndex()` appends a
+ *     name+description index to the system prompt and the agent reads
+ *     `skills/<name>/SKILL.md` on demand (hermes-style progressive
+ *     disclosure: metadata always in context, body only when used).
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { log } from '../../shared/logger.js';
+import { WORKSPACE_DIR } from '../../shared/paths.js';
+
+export const SKILLS_DIR = path.join(WORKSPACE_DIR, 'skills');
+
+/** Sorted names of installed skill folders (dirs or symlinks under skills/). */
+export function listSkillNames(): string[] {
+  try {
+    return fs.readdirSync(SKILLS_DIR, { withFileTypes: true })
+      .filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith('.'))
+      .map((e) => e.name)
+      .sort();
+  } catch {
+    return []; // no skills dir — nothing installed
+  }
+}
+
+/**
+ * Mirror workspace/skills/<name> → <mirrorRoot>/<name> as symlinks
+ * (idempotent), and prune symlinks for skills that were uninstalled.
+ * Returns the sorted list of mirrored skill names.
+ *
+ * Only symlinks are ever pruned — a real directory someone dropped into the
+ * mirror root is left alone.
+ */
+export function mirrorSkillsInto(mirrorRoot: string, label: string): string[] {
+  const names = listSkillNames();
+  if (names.length) {
+    try { fs.mkdirSync(mirrorRoot, { recursive: true }); } catch {}
+  }
+
+  const mirrored: string[] = [];
+  for (const name of names) {
+    const target = path.join(SKILLS_DIR, name);
+    const link = path.join(mirrorRoot, name);
+    try {
+      const cur = fs.existsSync(link) ? fs.realpathSync(link) : null;
+      if (cur !== fs.realpathSync(target)) {
+        try { fs.rmSync(link, { recursive: true, force: true }); } catch {}
+        fs.symlinkSync(target, link, 'dir');
+      }
+      mirrored.push(name);
+    } catch (err: any) {
+      log.warn(`[${label}] could not mirror skill "${name}" into ${path.basename(path.dirname(mirrorRoot))}/skills: ${err.message}`);
+    }
+  }
+
+  // Prune stale symlinks (skill uninstalled) so dead links never reach the harness.
+  try {
+    for (const entry of fs.readdirSync(mirrorRoot, { withFileTypes: true })) {
+      if (!entry.isSymbolicLink() || names.includes(entry.name)) continue;
+      try { fs.unlinkSync(path.join(mirrorRoot, entry.name)); } catch {}
+    }
+  } catch {}
+
+  return mirrored;
+}
+
+/**
+ * Parse `name` and `description` from a SKILL.md YAML frontmatter block.
+ * Handles plain, quoted, and folded/literal (`>-`, `|`) scalar styles —
+ * enough for the two mandated keys without pulling in a YAML dependency.
+ */
+export function parseSkillFrontmatter(skillMdPath: string): { name?: string; description?: string } {
+  let raw: string;
+  try {
+    raw = fs.readFileSync(skillMdPath, 'utf-8');
+  } catch {
+    return {};
+  }
+  if (!raw.startsWith('---')) return {};
+  const end = raw.indexOf('\n---', 3);
+  if (end === -1) return {};
+  const lines = raw.slice(raw.indexOf('\n') + 1, end).split('\n');
+
+  const out: Record<string, string> = {};
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^(name|description):\s*(.*)$/);
+    if (!m) continue;
+    let value = m[2].trim();
+    if (/^[>|][+-]?$/.test(value)) {
+      // Block scalar — collect indented continuation lines, fold with spaces.
+      const parts: string[] = [];
+      while (i + 1 < lines.length && (/^\s+\S/.test(lines[i + 1]) || lines[i + 1].trim() === '')) {
+        i++;
+        if (lines[i].trim()) parts.push(lines[i].trim());
+      }
+      value = parts.join(' ');
+    } else if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1).replace(/\\"/g, '"');
+    }
+    out[m[1]] = value;
+  }
+  return out;
+}
+
+/**
+ * Compact installed-skills index for system-prompt injection (pi harness).
+ * One name+description line per skill — the body stays on disk until the
+ * agent actually opens it. Returns '' when no skills are installed.
+ */
+export function buildSkillsIndex(): string {
+  const entries: string[] = [];
+  for (const name of listSkillNames()) {
+    const fm = parseSkillFrontmatter(path.join(SKILLS_DIR, name, 'SKILL.md'));
+    const description = fm.description || '(no description — open the SKILL.md)';
+    entries.push(`- **${fm.name || name}** — ${description}`);
+  }
+  if (!entries.length) return '';
+  return `\n\n---\n# Installed Skills\n\nScan this list on every request. When a request matches a skill — even partially — read \`skills/<name>/SKILL.md\` before acting and follow it.\n\n${entries.join('\n')}`;
+}

package/supervisor/index.ts

@@ -724,6 +724,12 @@ export async function startSupervisor() {
 
   // HTTP request handler — proxies to Vite dev servers + worker API
   server.on('request', async (req, res) => {
+    // Every response carries the agent-origin stamp. The relay treats it as authoritative
+    // proof the bytes came from the agent (never substitutes a branded page) AND skips its
+    // 4 KB/1.5 s error-body sniff buffer on 4xx/5xx — without this, every legit 404/500
+    // through the tunnel paid the sniff. Proxied responses keep it unless upstream overrides.
+    res.setHeader('X-Bloby-Origin', 'supervisor');
+
     // Request timing sample — attached before any routing so every branch is covered.
     {
       const t0 = Date.now();

package/supervisor/vite-dev.ts

@@ -77,18 +77,19 @@ export async function startViteDevServers(supervisorPort: number, hmrServer: htt
 
   log.ok(`Vite HMR active — dashboard :${ports.dashboard}`);
 
-  // Warm up: fetch the dashboard entry to pre-transform modules
-  fetch(`http://127.0.0.1:${ports.dashboard}/`).then(r => r.text()).then(async (html) => {
-    const scriptRe = /src="([^"]+\.tsx)"/g;
-    let m;
-    while ((m = scriptRe.exec(html)) !== null) {
-      const url = `http://127.0.0.1:${ports.dashboard}${m[1].startsWith('/') ? '' : '/'}${m[1]}`;
-      await fetch(url).then(r => r.text()).catch(() => {});
-    }
-    console.log('__VITE_WARM__');
-  }).catch(() => {
-    console.log('__VITE_WARM__');
-  });
+  // Warm up: one fetch of the entry HTML (html transform isn't covered by server.warmup),
+  // then wait for the warmup graph (vite.config.ts now lists the whole src tree) to finish
+  // transforming. __VITE_WARM__ (consumed by the CLI spinner) used to print after only
+  // main.tsx — "warm" now actually means warm. Timeout guard so a huge graph or a wedged
+  // transform can never hang the boot signal.
+  const warm = dashboardVite;
+  Promise.resolve()
+    .then(() => fetch(`http://127.0.0.1:${ports.dashboard}/`).then((r) => r.text()).catch(() => {}))
+    .then(() => Promise.race([
+      warm ? warm.waitForRequestsIdle() : Promise.resolve(),
+      new Promise((resolve) => setTimeout(resolve, 20_000)),
+    ]))
+    .finally(() => console.log('__VITE_WARM__'));
 
   return ports;
 }

package/vite.config.ts

@@ -75,7 +75,10 @@ export default defineConfig({
       '/api': 'http://localhost:7400',
     },
     warmup: {
-      clientFiles: ['./src/main.tsx'],
+      // The whole client graph, not just the entry — the old single-file warmup only
+      // pre-transformed main.tsx, so the first browser hit still paid transform time for
+      // every other module (felt hardest on Pi-class hardware after a restart).
+      clientFiles: ['./src/main.tsx', './src/**/*.tsx', './src/**/*.ts', './src/**/*.css'],
     },
     watch: {
       ignored: [

package/workspace/client/index.html

@@ -11,7 +11,12 @@
     <link rel="icon" type="image/png" href="/morphy-favicon.png" />
     <link rel="apple-touch-icon" href="/morphy-icon-192.png" />
     <link rel="manifest" href="/manifest.json" />
-    <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet">
+    <!-- Fonts load without blocking first paint: the stylesheet applies onload (the
+         media="print" trick), display=swap keeps text visible meanwhile. -->
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet" media="print" onload="this.media='all'">
+    <noscript><link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet"></noscript>
     <title>Bloby - AI agent with its own workspace</title>
   </head>
   <body class="bg-background text-foreground" style="background-color:#0A0A0A">

package/workspace/skills/mac/skill.json

@@ -5,11 +5,24 @@
   "bloby_human": "Bruno Bertapeli",
   "bloby": "bloby-bruno",
   "author": "newbot-official",
-  "description": "Morphy native macOS companion. Activates on the [Mac] tag. You reply with a concise spoken line (TTS) and optionally drive the Mac's action registry — one <mac_actions> JSON array that can show a notch card (preset), point the mascot at the screen, or spotlight a control. Custom cards use raw <notch_html>. The same registry works proactively (PULSE/cron) wrapped in <mac_push>. Card presets + schemas: presets/PRESETS.md. Reusable custom cards: frequentSnippets/.",
+  "description": "Morphy native macOS companion. Activates on the [Mac] tag. You reply with a concise spoken line (TTS) and optionally drive the Mac's action registry — one <mac_actions> JSON array that can show a notch card, point the mascot at the screen, or spotlight a control. Custom cards use <notch_html>. The same registry works proactively (PULSE/cron) wrapped in <mac_push>. Card presets + schemas: presets/PRESETS.md. Reusable custom cards: frequentSnippets/.",
   "depends": [],
   "env_keys": [],
   "has_telemetry": false,
   "size": "12KB",
   "contains_binaries": false,
-  "tags": ["mac", "morphy", "notch", "macos", "voice", "tts", "visual", "html", "registry", "actions", "spotlight", "point"]
+  "tags": [
+    "mac",
+    "morphy",
+    "notch",
+    "macos",
+    "voice",
+    "tts",
+    "visual",
+    "html",
+    "registry",
+    "actions",
+    "spotlight",
+    "point"
+  ]
 }

package/workspace/skills/telegram/.claude-plugin/plugin.json

@@ -1,6 +0,0 @@
-{
-  "name": "telegram",
-  "version": "1.0.0",
-  "description": "Telegram channel via your own @BotFather bot token. Paste-token connect, direct long-poll, voice/photo, channel/business/assistant modes.",
-  "skills": "./"
-}

package/workspace/skills/whatsapp/.claude-plugin/plugin.json

@@ -1,6 +0,0 @@
-{
-  "name": "whatsapp",
-  "version": "2.0.0",
-  "description": "WhatsApp channel via Baileys. QR auth, messaging, voice transcription, channel and business modes.",
-  "skills": "./"
-}