crewly 1.20.105 → 1.20.107

package/config/skills/agent/core/list-my-followups/execute.sh

@@ -21,7 +21,10 @@ Options:
   --json   -j     Raw JSON payload (legacy)
   --help   -h     Show this help
 
-Output: JSON object { success, count, data: [Trigger, ...] }
+Output: JSON object { success, examined, count, data: [Trigger, ...] }
+  examined = triggers received from the backend BEFORE the team filter;
+  count    = triggers left after the team/status/prefix filters.
+  A truncated or malformed response is an error (exit 1), never count 0.
 EOF_USAGE
 }
 
@@ -60,7 +63,25 @@ fi
 TEAM_ID=$(resolve_team_id || true)
 [ -z "$TEAM_ID" ] && { echo '{"error":"Cannot resolve owning team from CREWLY_SESSION_NAME"}' >&2; exit 1; }
 
-LIST_RESP=$(api_call GET "/triggers" "")
+# GET /triggers is the whole trigger table (335 rows / 233 KB on 2026-09-21),
+# well over the skill-output cap. Plain api_call would hand back a
+# {"truncated":true} envelope and `.data // []` would turn that into an empty
+# list with success:true. api_call_full returns the real body or fails.
+if ! LIST_RESP=$(api_call_full GET "/triggers" ""); then
+  jq -n '{success:false, examined:0, error:"GET /triggers failed or came back as a truncated envelope; refusing to report an empty follow-up list"}'
+  exit 1
+fi
+
+# A guard must report what it examined, not just its verdict. `.data` has to be
+# an array; an envelope, an error object or anything else is an UNKNOWN result,
+# not "no triggers" — refuse rather than print success with count 0.
+EXAMINED=$(printf '%s' "$LIST_RESP" | jq -r 'if type == "object" then (if (.data | type) == "array" then (.data | length) else "not-an-array" end) else "not-an-object" end' 2>/dev/null || echo "unparseable")
+if ! [ "$EXAMINED" -ge 0 ] 2>/dev/null; then
+  jq -n --arg why "$EXAMINED" --arg head "${LIST_RESP:0:200}" \
+    '{success:false, examined:0, error:("GET /triggers returned a body whose .data is " + $why + "; refusing to report an empty follow-up list"), head:$head}'
+  exit 1
+fi
+
 FILTERED=$(printf '%s' "$LIST_RESP" | jq \
   --arg team "$TEAM_ID" \
   --arg status "$STATUS_FILTER" \
@@ -71,4 +92,5 @@ FILTERED=$(printf '%s' "$LIST_RESP" | jq \
     | (if $prefix != "" then map(select(.name != null and (.name | startswith($prefix)))) else . end)')
 
 COUNT=$(printf '%s' "$FILTERED" | jq 'length')
-printf '%s' "$FILTERED" | jq --arg c "$COUNT" '{success:true, count:($c|tonumber), data:.}'
+printf '%s' "$FILTERED" | jq --arg c "$COUNT" --arg e "$EXAMINED" \
+  '{success:true, examined:($e|tonumber), count:($c|tonumber), data:.}'

package/config/skills/agent/core/list-my-followups/execute.test.sh

@@ -36,6 +36,78 @@ echo "--- Team resolution ---"
 OUTPUT=$(env -u CREWLY_SESSION_NAME bash "$SCRIPT_DIR/execute.sh" 2>&1) || true
 assert_contains "No session → team-resolve error" "Cannot resolve owning team" "$OUTPUT"
 
+assert_eq() {
+  local test_name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    PASS=$((PASS + 1))
+    echo "  ✓ ${test_name}"
+  else
+    FAIL=$((FAIL + 1))
+    echo "  ✗ ${test_name}"
+    echo "    expected: ${expected}"
+    echo "    got:      ${actual}"
+  fi
+}
+
+echo ""
+echo "--- Response shape: a guard must report what it examined ---"
+
+# Run the real skill against a lib.sh double: the REAL library plus an
+# api_call override, so the real api_call_full is what the skill exercises.
+# The double returns whatever $MOCK_RESPONSE holds, for any request.
+REAL_LIB="$(cd "$SCRIPT_DIR/../../../_common" && pwd)/lib.sh"
+TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
+mkdir -p "$TMP/skills/agent/core/list-my-followups" "$TMP/skills/agent/_common"
+cp "$SCRIPT_DIR/execute.sh" "$TMP/skills/agent/core/list-my-followups/execute.sh"
+cat > "$TMP/skills/agent/_common/lib.sh" <<'STUB_EOF'
+source "$REAL_LIB"
+resolve_team_id() { echo "team-a"; }
+api_call() { printf '%s' "$MOCK_RESPONSE"; }
+STUB_EOF
+
+# run <mock-response> [skill args...] -> sets CODE and OUTPUT (stdout only)
+run() {
+  local mock="$1"; shift
+  CODE=0
+  OUTPUT=$(env -u CREWLY_SESSION_NAME REAL_LIB="$REAL_LIB" MOCK_RESPONSE="$mock" \
+    bash "$TMP/skills/agent/core/list-my-followups/execute.sh" "$@" 2>/dev/null) || CODE=$?
+}
+
+# What api_call hands back when GET /triggers is over the output cap (233 KB /
+# 335 rows on 2026-09-21). The parked file deliberately does not exist.
+ENVELOPE='{"truncated":true,"bytes":233481,"file":"'"$TMP"'/nonexistent.json","head":"{\"success\":true,\"data\":[{\"id\":\"4bc7","hint":"pass --full or read the file"}'
+ROWS='{"success":true,"data":[
+  {"id":"t-1","teamId":"team-a","name":"followup:abc","status":"paused"},
+  {"id":"t-2","teamId":"team-b","name":"followup:abc","status":"active"},
+  {"id":"t-3","teamId":"team-b","name":"watch:x","status":"active"}]}'
+
+run "$ENVELOPE"
+assert_eq "Envelope -> non-zero exit" "1" "$CODE"
+assert_contains "Envelope -> success:false" '"success":false' "$(printf '%s' "$OUTPUT" | jq -c .)"
+assert_contains "Envelope -> explicit error field" 'truncated envelope' "$OUTPUT"
+assert_eq "Envelope -> never count 0" "" "$(printf '%s' "$OUTPUT" | jq -r '.count // empty')"
+
+run "$ROWS"
+assert_eq "Rows -> exit 0" "0" "$CODE"
+assert_eq "Rows -> examined counts every row before the team filter" "3" "$(printf '%s' "$OUTPUT" | jq -r '.examined')"
+assert_eq "Rows -> count is the team's rows" "1" "$(printf '%s' "$OUTPUT" | jq -r '.count')"
+assert_eq "Rows -> the team's trigger is returned" "t-1" "$(printf '%s' "$OUTPUT" | jq -r '.data[0].id')"
+
+run "$ROWS" --status active
+assert_eq "--status active with none active -> legitimate count 0" "0" "$(printf '%s' "$OUTPUT" | jq -r '.count')"
+assert_eq "--status active -> examined still 3" "3" "$(printf '%s' "$OUTPUT" | jq -r '.examined')"
+assert_eq "--status active -> success:true (this zero is real)" "true" "$(printf '%s' "$OUTPUT" | jq -r '.success')"
+
+run "$ROWS" --name-prefix watch:
+assert_eq "--name-prefix scoped to team -> count 0, examined 3" "0/3" "$(printf '%s' "$OUTPUT" | jq -r '"\(.count)/\(.examined)"')"
+
+run '{"success":true,"data":{"oops":1}}'
+assert_eq "Non-array .data -> non-zero exit" "1" "$CODE"
+assert_contains "Non-array .data -> error says why" 'not-an-array' "$OUTPUT"
+
+run '{"error":true,"status":500}'
+assert_eq "Error object without .data -> non-zero exit" "1" "$CODE"
+
 echo ""
 echo "=== Results: ${PASS} passed, ${FAIL} failed ==="
 [ $FAIL -eq 0 ]

package/config/skills/agent/core/poll-tasks/execute.sh

@@ -77,9 +77,9 @@ fi
 
 QUERY_PARAMS="?types=${TYPES}&owner=agent"
 
-AVAILABLE_RESPONSE=$(api_call GET "/task-pool${QUERY_PARAMS}" 2>&1) || {
+AVAILABLE_RESPONSE=$(api_call_full GET "/task-pool${QUERY_PARAMS}" 2>&1) || {
   # Also try without owner filter — some items may target specific agents
-  AVAILABLE_RESPONSE=$(api_call GET "/task-pool?types=${TYPES}&target=${SESSION_NAME}" 2>&1) || {
+  AVAILABLE_RESPONSE=$(api_call_full GET "/task-pool?types=${TYPES}&target=${SESSION_NAME}" 2>&1) || {
     error_exit "Failed to query Task Pool: ${AVAILABLE_RESPONSE}"
   }
 }
@@ -93,7 +93,7 @@ AVAILABLE_COUNT=$(printf '%s' "$AVAILABLE_RESPONSE" | jq -r '.count // 0')
 # picker filters owner=agent and would otherwise ignore these items).
 TARGET_PINNED_ID=""
 if [ "$AVAILABLE_COUNT" -eq 0 ]; then
-  TARGET_RESPONSE=$(api_call GET "/task-pool?types=${TYPES}&target=${SESSION_NAME}" 2>&1) || TARGET_RESPONSE=""
+  TARGET_RESPONSE=$(api_call_full GET "/task-pool?types=${TYPES}&target=${SESSION_NAME}" 2>&1) || TARGET_RESPONSE=""
   TARGET_COUNT=$(printf '%s' "$TARGET_RESPONSE" | jq -r '.count // 0' 2>/dev/null || echo 0)
   if [ "$TARGET_COUNT" -gt 0 ]; then
     AVAILABLE_RESPONSE="$TARGET_RESPONSE"

package/config/skills/agent/core/reply-channel/SKILL.md

@@ -106,7 +106,7 @@ An unknown name returns `404` with the names that were found.
 - `CREWLY_SESSION_NAME` — your agent session id. Auto-set in agent sessions.
   The skill attaches it as `X-Agent-Session` so the backend routes the
   reply as `senderType:"agent"`.
-- `CREWLY_API_URL` — defaults to `http://localhost:8787`.
+- `CREWLY_API_URL` — set by Crewly to the running instance (e.g. `http://localhost:8797` when started with `-p 8797`); falls back to `http://localhost:${WEB_PORT:-8787}`.
 
 ## Success / failure
 

package/config/skills/agent/core/report-progress/execute.sh

@@ -30,7 +30,7 @@ require_param "current" "$CURRENT"
 
 # Resolve target WI: explicit > running claim for this agent
 if [ -z "$WORK_ITEM_ID" ]; then
-  POOL_RESP=$(api_call GET "/task-pool/items?status=running&target=${SESSION_NAME}" 2>/dev/null || echo '{}')
+  POOL_RESP=$(api_call_full GET "/task-pool/items?status=running&target=${SESSION_NAME}" 2>/dev/null || echo '{}')
   WORK_ITEM_ID=$(echo "$POOL_RESP" | jq -r '.workItems[0].id // .data[0].id // empty' 2>/dev/null || true)
 fi
 

package/config/skills/agent/core/report-status/execute.sh

@@ -259,7 +259,7 @@ if [ "$STATUS" = "done" ]; then
   WI_RESOLUTION="explicit"
 
   if [ -z "$TARGET_WI_ID" ]; then
-    POOL_RESP=$(api_call GET "/task-pool/items?status=running&target=${SESSION_NAME}" 2>/dev/null || echo '{}')
+    POOL_RESP=$(api_call_full GET "/task-pool/items?status=running&target=${SESSION_NAME}" 2>/dev/null || echo '{}')
     RUNNING_IDS=$(printf '%s' "$POOL_RESP" | jq -r '((.workItems // .data // []) | map(.id)) | .[]' 2>/dev/null || true)
     RUNNING_COUNT=$(printf '%s' "$RUNNING_IDS" | grep -c . || true)
 

package/config/skills/agent/core/slack-post/SKILL.md

@@ -117,7 +117,7 @@ two are told apart. Write ids exactly as Slack shows them.
 
 - `CREWLY_SESSION_NAME` — your agent session, attached automatically. The post
   is sent under that agent's identity, so this must be set.
-- `CREWLY_API_URL` — defaults to `http://localhost:8787`.
+- `CREWLY_API_URL` — set by Crewly to the running instance (e.g. `http://localhost:8797` when started with `-p 8797`); falls back to `http://localhost:${WEB_PORT:-8787}`.
 
 ## Output
 

package/config/skills/agent/core/todo-add/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: To Do Add
+description: Add a task to one of the owner's Microsoft To Do lists — title, optional due date, note and importance (via the Microsoft grant held by Crewly Cloud).
+version: 1.0.0
+category: productivity
+skillType: claude-skill
+assignableRoles:
+  - orchestrator
+  - team-leader
+  - developer
+  - operations
+  - ops
+  - sales
+  - support
+  - generalist
+triggers:
+  - add to my to do list
+  - add a microsoft to do task
+  - remind me in to do
+  - create an outlook task
+tags:
+  - microsoft
+  - todo
+  - tasks
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 60000
+---
+
+# To Do Add
+
+```bash
+bash execute.sh --title "Buy milk"                     # default list ("Tasks")
+bash execute.sh --list Work --title "Send deck to Ann" --due 2026-10-01 --importance high --note "v3 is in Drive"
+```
+
+| Flag | Meaning |
+|---|---|
+| `--title` | Task title (required) |
+| `--list` | List name (case-insensitive) or id; default list when omitted |
+| `--due` | Due date `YYYY-MM-DD` |
+| `--note` | Note shown under the task |
+| `--importance` | `low` \| `normal` \| `high` |
+
+## Output
+
+```json
+{"success":true,"list":"Work","task":{"id":"AAMk…","title":"Send deck to Ann","status":"notStarted","importance":"high","due":"2026-10-01","note":"v3 is in Drive"}}
+```
+
+A list that does not exist is not created — make it with todo-lists
+`--create` first.
+
+## Failures
+
+`{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
+when the owner has not connected Microsoft To Do (Connections → Microsoft To Do).
+Other reasons: `not_found` (unknown list / task — the message lists the
+available lists), `forbidden` (the account has no Exchange Online mailbox, or
+the organisation blocks the app), `rate_limited` (with `retryAfter` seconds),
+`validation`, `connector_forbidden` (the owner has not allowed your role).

package/config/skills/agent/core/todo-add/execute.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# =============================================================================
+# todo-add — Add a task to a Microsoft To Do list
+#
+# Backed by POST /api/microsoft-todo/tasks.
+#
+# Usage:
+#   bash execute.sh --title "Buy milk"                                  # default list
+#   bash execute.sh --list Work --title "Send deck to Ann" --due 2026-10-01 --importance high --note "v3 in Drive"
+#   bash execute.sh '{"list":"Groceries","title":"Eggs"}'
+# =============================================================================
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../../_common/lib.sh"
+
+print_usage() {
+  cat <<'EOF_USAGE'
+Usage:
+  bash execute.sh --title "Buy milk"                                  # default list
+  bash execute.sh --list Work --title "Send deck to Ann" --due 2026-10-01 --importance high --note "v3 in Drive"
+  bash execute.sh '{"list":"Groceries","title":"Eggs"}'
+
+Options:
+  --title, -t    Task title (required)
+  --list, -l     List name (case-insensitive) or id; default: the owner's default list
+  --due          Due date, YYYY-MM-DD
+  --note         Note text shown under the task
+  --importance   low | normal | high
+  --help | -h    Show this help
+EOF_USAGE
+}
+
+fail_from() {
+  printf '%s' "$1" | jq -c '{success: false, reason: (.details.error // .details // .error // "unknown"), hint: (.details.hint // ""), message: (.details.message // "")} + (if (.details | type) == "object" and .details.retryAfter then {retryAfter: .details.retryAfter} else {} end)' 2>/dev/null \
+    || jq -n --arg r "$1" '{success: false, reason: $r}'
+  exit 1
+}
+
+uri() { jq -rn --arg v "$1" '$v|@uri'; }
+
+# api_call may print a one-line warning to stderr (no CREWLY_SESSION_NAME);
+# the backend answer is always the last line. On failure print the mapped
+# failure JSON (fail_from) and return 1.
+call() {
+  local out
+  out=$(api_call "$@" 2>&1) || { fail_from "$(printf '%s\n' "$out" | tail -n 1)"; }
+  printf '%s\n' "$out" | tail -n 1
+}
+
+INPUT_JSON=""
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  INPUT_JSON="$1"
+  shift || true
+fi
+TITLE=""; LIST=""; DUE=""; NOTE=""; IMPORTANCE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --title|-t)   [ $# -ge 2 ] || error_exit "--title requires a value";      TITLE="$2";      shift 2 ;;
+    --list|-l)    [ $# -ge 2 ] || error_exit "--list requires a value";       LIST="$2";       shift 2 ;;
+    --due)        [ $# -ge 2 ] || error_exit "--due requires a value";        DUE="$2";        shift 2 ;;
+    --note)       [ $# -ge 2 ] || error_exit "--note requires a value";       NOTE="$2";       shift 2 ;;
+    --importance) [ $# -ge 2 ] || error_exit "--importance requires a value"; IMPORTANCE="$2"; shift 2 ;;
+    --help|-h)    print_usage; exit 0 ;;
+    *) error_exit "Unknown option: $1" ;;
+  esac
+done
+if [ -n "$INPUT_JSON" ]; then
+  INPUT=$(read_json_input "$INPUT_JSON")
+  [ -z "$TITLE" ]      && TITLE=$(printf '%s' "$INPUT" | jq -r '.title // empty')
+  [ -z "$LIST" ]       && LIST=$(printf '%s' "$INPUT" | jq -r '.list // empty')
+  [ -z "$DUE" ]        && DUE=$(printf '%s' "$INPUT" | jq -r '.due // empty')
+  [ -z "$NOTE" ]       && NOTE=$(printf '%s' "$INPUT" | jq -r '.note // empty')
+  [ -z "$IMPORTANCE" ] && IMPORTANCE=$(printf '%s' "$INPUT" | jq -r '.importance // empty')
+fi
+[ -n "$TITLE" ] || error_exit "--title is required"
+if [ -n "$DUE" ] && ! [[ "$DUE" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then error_exit "--due must look like 2026-10-01"; fi
+BODY=$(jq -cn --arg title "$TITLE" --arg list "$LIST" --arg due "$DUE" --arg note "$NOTE" --arg imp "$IMPORTANCE" \
+  '{title: $title}
+      + (if $list != "" then {list: $list} else {} end)
+      + (if $due != "" then {due: $due} else {} end)
+      + (if $note != "" then {note: $note} else {} end)
+      + (if $imp != "" then {importance: $imp} else {} end)')
+RESPONSE=$(call POST "/microsoft-todo/tasks" "$BODY") || { printf '%s\n' "$RESPONSE"; exit 1; }
+printf '%s' "$RESPONSE" | jq -c '{success: true, list: .data.list.name, task: .data.task}'

package/config/skills/agent/core/todo-add/execute.test.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+# Tests for todo-add — run with: bash execute.test.sh
+# Python HTTP stub as the backend; asserts the request the skill sends and
+# the JSON it prints. Exit 0 on pass.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+
+PORT=18832
+STUB_LOG="$(mktemp)"; export STUB_LOG; export STUB_PORT="$PORT"
+python3 -u <<'PY' >/dev/null 2>&1 &
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import json, os
+LOG = os.environ['STUB_LOG']; PORT = int(os.environ['STUB_PORT'])
+LIST = {'id': 'L1', 'name': 'Groceries'}
+class H(BaseHTTPRequestHandler):
+    def _reply(self, method, data=None):
+        open(LOG, 'w').write(json.dumps({'method': method, 'path': self.path, 'body': data}))
+        if 'no-grant' in self.path or 'no-grant' in json.dumps(data or {}):
+            self.send_response(409); self.send_header('Content-Type', 'application/json'); self.end_headers()
+            self.wfile.write(json.dumps({'success': False, 'error': 'not_connected', 'message': 'no grant', 'hint': 'https://cloud/start?token=j'}).encode()); return
+        path = self.path.split('?')[0]
+        if path == '/api/microsoft-todo/lists' and method == 'GET':
+            out = {'count': 2, 'lists': [{'id': 'L0', 'name': 'Tasks', 'isDefault': True}, LIST]}
+        elif path == '/api/microsoft-todo/lists':
+            out = {'id': 'L9', 'name': (data or {}).get('name')}
+        elif path == '/api/microsoft-todo/tasks' and method == 'GET':
+            out = {'list': LIST, 'count': 1, 'tasks': [{'id': 'T1', 'title': 'Milk', 'status': 'notStarted', 'due': '2026-10-01'}]}
+        elif path == '/api/microsoft-todo/tasks':
+            out = {'list': LIST, 'task': {'id': 'T2', 'title': (data or {}).get('title'), 'status': 'notStarted'}}
+        elif method == 'PATCH':
+            out = {'list': LIST, 'task': {'id': path.rsplit('/', 1)[1], 'title': 'Milk', 'status': 'completed'}}
+        elif method == 'DELETE':
+            out = {'list': LIST, 'taskId': path.rsplit('/', 1)[1], 'deleted': True}
+        else:
+            out = {}
+        self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers()
+        self.wfile.write(json.dumps({'success': True, 'data': out}).encode())
+    def _body(self):
+        n = int(self.headers.get('content-length', '0')); body = self.rfile.read(n).decode() if n else ''
+        return json.loads(body or '{}')
+    def do_GET(self): self._reply('GET')
+    def do_DELETE(self): self._reply('DELETE')
+    def do_POST(self): self._reply('POST', self._body())
+    def do_PATCH(self): self._reply('PATCH', self._body())
+    def log_message(self, *a, **k): pass
+HTTPServer(('127.0.0.1', PORT), H).serve_forever()
+PY
+STUB_PID=$!
+disown "$STUB_PID" 2>/dev/null || true
+trap 'kill "$STUB_PID" >/dev/null 2>&1; rm -f "$STUB_LOG"' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null -m 0.2 "http://127.0.0.1:${PORT}/" 2>/dev/null && break; sleep 0.1; done
+
+run() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>/dev/null; }
+run_err() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>&1 >/dev/null; }
+last() { jq -c "$1" "$STUB_LOG"; }
+
+OUT=$(run --list Work --title "Send deck" --due 2026-10-01 --importance high --note "v3 in Drive")
+check "add: output" "$OUT" '{"success":true,"list":"Groceries","task":{"id":"T2","title":"Send deck","status":"notStarted"}}'
+check "add: request" "$(last '[.method,.path,.body]')" '["POST","/api/microsoft-todo/tasks",{"title":"Send deck","list":"Work","due":"2026-10-01","note":"v3 in Drive","importance":"high"}]'
+run --title "Buy milk" >/dev/null
+check "add: default list omits list" "$(last '.body')" '{"title":"Buy milk"}'
+run '{"list":"Groceries","title":"Eggs"}' >/dev/null
+check "json input" "$(last '.body')" '{"title":"Eggs","list":"Groceries"}'
+check "title required" "$(run_err --list Work | jq -r .error)" "--title is required"
+check "bad due" "$(run_err --title x --due tomorrow | jq -r .error)" "--due must look like 2026-10-01"
+OUT=$(run --title no-grant || true)
+check "not connected" "$(printf '%s' "$OUT" | jq -r .reason)" "not_connected"
+
+echo "todo-add: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/config/skills/agent/core/todo-lists/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: To Do Lists
+description: List the owner's Microsoft To Do task lists, or create a new list (via the Microsoft grant held by Crewly Cloud).
+version: 1.0.0
+category: productivity
+skillType: claude-skill
+assignableRoles:
+  - orchestrator
+  - team-leader
+  - developer
+  - operations
+  - ops
+  - sales
+  - support
+  - generalist
+triggers:
+  - microsoft to do lists
+  - which to do lists
+  - create a to do list
+  - outlook tasks lists
+tags:
+  - microsoft
+  - todo
+  - tasks
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 60000
+---
+
+# To Do Lists
+
+```bash
+bash execute.sh
+bash execute.sh --create "Trip to Lisbon"
+```
+
+## Output
+
+```json
+{"count":2,"lists":[{"id":"AAMk…","name":"Tasks","isDefault":true},{"id":"AAMk…","name":"Groceries","isShared":true}]}
+{"success":true,"list":{"id":"AAMk…","name":"Trip to Lisbon"}}
+```
+
+The other todo-* skills take a list **name** (case-insensitive) or id, so
+you rarely need the id. `isDefault` marks the list that answers when no
+list is named.
+
+## Failures
+
+`{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
+when the owner has not connected Microsoft To Do (Connections → Microsoft To Do).
+Other reasons: `not_found` (unknown list / task — the message lists the
+available lists), `forbidden` (the account has no Exchange Online mailbox, or
+the organisation blocks the app), `rate_limited` (with `retryAfter` seconds),
+`validation`, `connector_forbidden` (the owner has not allowed your role).

package/config/skills/agent/core/todo-lists/execute.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# =============================================================================
+# todo-lists — List the owner's Microsoft To Do lists, or create one
+#
+# Backed by GET / POST /api/microsoft-todo/lists.
+#
+# Usage:
+#   bash execute.sh
+#   bash execute.sh --create "Trip to Lisbon"
+#   bash execute.sh '{"create":"Trip to Lisbon"}'
+# =============================================================================
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../../_common/lib.sh"
+
+print_usage() {
+  cat <<'EOF_USAGE'
+Usage:
+  bash execute.sh
+  bash execute.sh --create "Trip to Lisbon"
+  bash execute.sh '{"create":"Trip to Lisbon"}'
+
+Options:
+  --create      Create a list with this name instead of listing
+  --help | -h   Show this help
+EOF_USAGE
+}
+
+fail_from() {
+  printf '%s' "$1" | jq -c '{success: false, reason: (.details.error // .details // .error // "unknown"), hint: (.details.hint // ""), message: (.details.message // "")} + (if (.details | type) == "object" and .details.retryAfter then {retryAfter: .details.retryAfter} else {} end)' 2>/dev/null \
+    || jq -n --arg r "$1" '{success: false, reason: $r}'
+  exit 1
+}
+
+uri() { jq -rn --arg v "$1" '$v|@uri'; }
+
+# api_call may print a one-line warning to stderr (no CREWLY_SESSION_NAME);
+# the backend answer is always the last line. On failure print the mapped
+# failure JSON (fail_from) and return 1.
+call() {
+  local out
+  out=$(api_call "$@" 2>&1) || { fail_from "$(printf '%s\n' "$out" | tail -n 1)"; }
+  printf '%s\n' "$out" | tail -n 1
+}
+
+INPUT_JSON=""
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  INPUT_JSON="$1"
+  shift || true
+fi
+CREATE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --create)  [ $# -ge 2 ] || error_exit "--create requires a value"; CREATE="$2"; shift 2 ;;
+    --help|-h) print_usage; exit 0 ;;
+    *) error_exit "Unknown option: $1" ;;
+  esac
+done
+if [ -n "$INPUT_JSON" ]; then
+  INPUT=$(read_json_input "$INPUT_JSON")
+  [ -z "$CREATE" ] && CREATE=$(printf '%s' "$INPUT" | jq -r '.create // .name // empty')
+fi
+if [ -n "$CREATE" ]; then
+  BODY=$(jq -cn --arg name "$CREATE" '{name: $name}')
+  RESPONSE=$(call POST "/microsoft-todo/lists" "$BODY") || { printf '%s\n' "$RESPONSE"; exit 1; }
+  printf '%s' "$RESPONSE" | jq -c '{success: true, list: .data}'
+  exit 0
+fi
+RESPONSE=$(call GET "/microsoft-todo/lists") || { printf '%s\n' "$RESPONSE"; exit 1; }
+printf '%s' "$RESPONSE" | jq -c '{count: .data.count, lists: .data.lists}'

package/config/skills/agent/core/todo-lists/execute.test.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# Tests for todo-lists — run with: bash execute.test.sh
+# Python HTTP stub as the backend; asserts the request the skill sends and
+# the JSON it prints. Exit 0 on pass.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+
+PORT=18830
+STUB_LOG="$(mktemp)"; export STUB_LOG; export STUB_PORT="$PORT"
+python3 -u <<'PY' >/dev/null 2>&1 &
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import json, os
+LOG = os.environ['STUB_LOG']; PORT = int(os.environ['STUB_PORT'])
+LIST = {'id': 'L1', 'name': 'Groceries'}
+class H(BaseHTTPRequestHandler):
+    def _reply(self, method, data=None):
+        open(LOG, 'w').write(json.dumps({'method': method, 'path': self.path, 'body': data}))
+        if 'no-grant' in self.path or 'no-grant' in json.dumps(data or {}):
+            self.send_response(409); self.send_header('Content-Type', 'application/json'); self.end_headers()
+            self.wfile.write(json.dumps({'success': False, 'error': 'not_connected', 'message': 'no grant', 'hint': 'https://cloud/start?token=j'}).encode()); return
+        path = self.path.split('?')[0]
+        if path == '/api/microsoft-todo/lists' and method == 'GET':
+            out = {'count': 2, 'lists': [{'id': 'L0', 'name': 'Tasks', 'isDefault': True}, LIST]}
+        elif path == '/api/microsoft-todo/lists':
+            out = {'id': 'L9', 'name': (data or {}).get('name')}
+        elif path == '/api/microsoft-todo/tasks' and method == 'GET':
+            out = {'list': LIST, 'count': 1, 'tasks': [{'id': 'T1', 'title': 'Milk', 'status': 'notStarted', 'due': '2026-10-01'}]}
+        elif path == '/api/microsoft-todo/tasks':
+            out = {'list': LIST, 'task': {'id': 'T2', 'title': (data or {}).get('title'), 'status': 'notStarted'}}
+        elif method == 'PATCH':
+            out = {'list': LIST, 'task': {'id': path.rsplit('/', 1)[1], 'title': 'Milk', 'status': 'completed'}}
+        elif method == 'DELETE':
+            out = {'list': LIST, 'taskId': path.rsplit('/', 1)[1], 'deleted': True}
+        else:
+            out = {}
+        self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers()
+        self.wfile.write(json.dumps({'success': True, 'data': out}).encode())
+    def _body(self):
+        n = int(self.headers.get('content-length', '0')); body = self.rfile.read(n).decode() if n else ''
+        return json.loads(body or '{}')
+    def do_GET(self): self._reply('GET')
+    def do_DELETE(self): self._reply('DELETE')
+    def do_POST(self): self._reply('POST', self._body())
+    def do_PATCH(self): self._reply('PATCH', self._body())
+    def log_message(self, *a, **k): pass
+HTTPServer(('127.0.0.1', PORT), H).serve_forever()
+PY
+STUB_PID=$!
+disown "$STUB_PID" 2>/dev/null || true
+trap 'kill "$STUB_PID" >/dev/null 2>&1; rm -f "$STUB_LOG"' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null -m 0.2 "http://127.0.0.1:${PORT}/" 2>/dev/null && break; sleep 0.1; done
+
+run() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>/dev/null; }
+run_err() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>&1 >/dev/null; }
+last() { jq -c "$1" "$STUB_LOG"; }
+
+OUT=$(run)
+check "list: output" "$OUT" '{"count":2,"lists":[{"id":"L0","name":"Tasks","isDefault":true},{"id":"L1","name":"Groceries"}]}'
+check "list: request" "$(last '[.method,.path]')" '["GET","/api/microsoft-todo/lists"]'
+OUT=$(run --create "Trip to Lisbon")
+check "create: output" "$OUT" '{"success":true,"list":{"id":"L9","name":"Trip to Lisbon"}}'
+check "create: request" "$(last '[.method,.path,.body]')" '["POST","/api/microsoft-todo/lists",{"name":"Trip to Lisbon"}]'
+run '{"create":"Holiday"}' >/dev/null
+check "json create" "$(last '.body.name')" '"Holiday"'
+OUT=$(run --create no-grant || true)
+check "not connected: reason" "$(printf '%s' "$OUT" | jq -r .reason)" "not_connected"
+check "not connected: hint" "$(printf '%s' "$OUT" | jq -r .hint)" "https://cloud/start?token=j"
+check "unknown flag" "$(run_err --bogus | jq -r .error)" "Unknown option: --bogus"
+
+echo "todo-lists: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]