opencode-skills-collection 3.1.14 → 3.1.16

package/bundled-skills/telegram/scripts/setup_project.py

@@ -12,12 +12,27 @@ import argparse
 import os
 import shutil
 import sys
+from pathlib import Path
 
 SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
 SKILL_DIR = os.path.dirname(SCRIPT_DIR)
 BOILERPLATE_DIR = os.path.join(SKILL_DIR, "assets", "boilerplate")
 
 
+def copy_tree_contents(source_dir: str, target_dir: str) -> None:
+    source_root = Path(source_dir)
+    target_root = Path(target_dir)
+    target_root.mkdir(parents=True, exist_ok=True)
+    for source_path in source_root.rglob("*"):
+        relative_path = source_path.relative_to(source_root)
+        target_path = target_root / relative_path
+        if source_path.is_dir():
+            target_path.mkdir(parents=True, exist_ok=True)
+        elif source_path.is_file():
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            target_path.write_bytes(source_path.read_bytes())
+
+
 def setup_nodejs(project_path: str, with_webhook: bool = False, with_ai: bool = False):
     """Setup Node.js/TypeScript project."""
     src_dir = os.path.join(BOILERPLATE_DIR, "nodejs")
@@ -27,7 +42,7 @@ def setup_nodejs(project_path: str, with_webhook: bool = False, with_ai: bool =
         sys.exit(1)
 
     # Copy boilerplate
-    shutil.copytree(src_dir, project_path, dirs_exist_ok=True)
+    copy_tree_contents(src_dir, project_path)
 
     print(f"Node.js project created at: {project_path}")
     print("\nNext steps:")
@@ -52,7 +67,7 @@ def setup_python(project_path: str, with_webhook: bool = False, with_ai: bool =
         sys.exit(1)
 
     # Copy boilerplate
-    shutil.copytree(src_dir, project_path, dirs_exist_ok=True)
+    copy_tree_contents(src_dir, project_path)
 
     print(f"Python project created at: {project_path}")
     print("\nNext steps:")

package/bundled-skills/time-ledger/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: time-ledger
+description: "Natural-language time tracking: parse what the user says they did into Activity/Minutes/Date rows in their own Notion database — asking instead of guessing when unsure."
+category: productivity
+risk: critical
+source: community
+source_repo: cruisekkk/time-ledger
+source_type: community
+date_added: "2026-07-04"
+author: cruisekkk
+tags: [time-tracking, notion, quantified-self, productivity, journaling]
+tools: [claude]
+license: "MIT"
+license_source: "https://github.com/cruisekkk/time-ledger/blob/main/LICENSE"
+---
+
+# Time Ledger
+
+## Overview
+
+Conversational time tracking. The user reports time in plain language — *"read papers 2h, gym 1h, did a leetcode"* — and the agent parses it into structured rows (activity, minutes, date, an optional compounding tag) and writes them to the user's own Notion database through the official Notion connector. The core design is an honesty contract: **anything uncertain becomes a `To-confirm` row and gets batch-asked — never fabricated.** A log that quietly invents durations is worse than no log.
+
+## When to Use This Skill
+
+- Use when the user reports time spent ("read papers for two hours", "hit the gym for an hour", "coded all morning")
+- Use when the user says "log it", "log my time", "time ledger", or "tidy up my time ledger"
+- Use when the user asks where their time went or for a time review
+
+## How It Works
+
+### Step 1: Find the database (zero-config)
+
+On the first write of a session, use Notion `search` to find the **database** (type `database`, not a page) whose title contains **"time-ledger"**. Read its `data_source_id` (the `collection://...` UUID) and use it as the parent for `create-pages` / `query` for the rest of the session. If more than one matches, ask the user which to use. Nothing is pasted or configured.
+
+The companion Notion template (free, linked in the source repo) ships this field schema — select values are a controlled enum, copy them exactly:
+
+- `Entry` (title) — the user's words or a clear title
+- `Activity` (select): Reading / Coding / Practice / Fitness / Investing / Meeting / Writing / Life / Other
+- `Minutes` (number)
+- `Date` (date) — expand to `"date:Date:start": "YYYY-MM-DD"`; a bare `Date` value fails with HTTP 400
+- `Status` (select): To-sort / To-confirm / Done
+- `Compounding` (select): Compounding / Consuming / Neutral
+- `Notes` (text) — clue from the user's words / your question
+
+### Step 2: Direct report mode
+
+Parse the report → `create-pages` (parent = the data source id above). Set `Status=Done` for what is certain; for anything uncertain set `Status=To-confirm`, write the specific question in `Notes`, and ask it once in your reply.
+
+Parsing rules:
+
+- **Activity**: books/technical material → Reading; coding/building → Coding; leetcode → Practice; gym/running → Fitness; markets/research → Investing; meetings → Meeting; docs → Writing; meals/commute/chores → Life; otherwise → Other. Unsure → To-confirm.
+- **Duration cues**: "two hours"=120, "an hour"=60, "half an hour"=30, "a while"≈30 (mark To-confirm, note it is an estimate), "all morning"≈180. Use exact numbers when given.
+- **Date**: "today" = the user's local date; "yesterday" = prior day; unspecified = today. Unsure which day → ask.
+- **One report, multiple blocks**: "two hours on X, one hour on Y" → split into rows, but confirm whether the totals are additive (a frequent ambiguity) — default additive + one To-confirm row.
+- **Compounding tag**: only tag the obvious — Compounding = leaves a reusable asset (learning, building, writing); Consuming = forget-on-sight entertainment (only if the user volunteers it); leave ambiguous blank.
+
+### Step 3: Batch reconcile mode
+
+When the user says "tidy up my time ledger": query rows where `Status` ∈ {To-sort, To-confirm} or empty → parse each → `update-page` the certain ones to `Done`; batch **all** remaining questions into one message; fill answers in when the user replies.
+
+## Examples
+
+### Example 1: Direct report
+
+```text
+User:  log it: read ML system design 2h, gym 1h, did a leetcode
+Agent: Logged 3 entries ✅
+       · Reading · ML system design · 120min · Compounding
+       · Fitness · gym · 60min
+       · Practice · LeetCode · ~20min ❓ To-confirm: you didn't say how long — I guessed 20min, right?
+```
+
+### Example 2: Batch reconcile
+
+```text
+User:  tidy up my time ledger
+Agent: 3 rows need confirmation — answering in one go works:
+       1. Tue "LeetCode" — how many minutes?
+       2. Wed "reading" — book or papers (Reading), or course exercises (Practice)?
+       3. "all afternoon on the deck" — Wed or Thu?
+```
+
+## Best Practices
+
+- ✅ Batch all questions into one message; never interrogate item by item
+- ✅ Give a short receipt after logging (rows written, which are To-confirm, what the questions are)
+- ✅ Copy select values from the enum exactly
+- ❌ Don't fabricate a duration, category, or date when unsure — To-confirm + ask
+- ❌ Don't write a bare `Date` property; use the `date:Date:start` expansion
+- ❌ Don't judge the user's Consuming hours; the ledger is a mirror, not a critic
+
+## Limitations
+
+- Requires the user's own Notion workspace, the companion database (duplicate the template from the source repo), and the official Notion connector granted access to that database — connector/skill setups currently live on paid Claude tiers.
+- Self-report only, by design: it does not auto-track apps or screens (an auto-tracker knows what was open, not *why* the time was spent).
+- The Compounding/Consuming tags are hand rules, not a learned model.
+- Select enums must match the template; if the user renames fields, the instructions above must be mirrored to match.
+
+## Security & Safety Notes
+
+- **Mutation scope**: writes and updates rows only in the single user-granted Notion database, via the official Notion connector (MCP) — no shell commands, no network fetches, no credentials handled by the skill.
+- On claude.ai, Notion's write tools default to *needs approval* — the first write pops an approval prompt; this is expected, not a hang.
+- The honesty contract is also a safety property: when parsing confidence is low, the skill records `To-confirm` and asks, rather than writing invented data into the user's records.
+
+## Common Pitfalls
+
+- **Problem:** Notion API returns 400 on the date field.
+  **Solution:** Expand to `"date:Date:start": "YYYY-MM-DD"` — a bare `Date` value fails.
+- **Problem:** `create-pages` succeeds but the Date column is empty (known Notion MCP issue: [notion-mcp-server#121](https://github.com/makenotion/notion-mcp-server/issues/121) — expanded date fields silently dropped).
+  **Solution:** After the session's first create, read the row back; if `Date` is empty, fill it with `update-page`.
+- **Problem:** Search returns example-row pages instead of the database.
+  **Solution:** Filter for type `database` when resolving "time-ledger".
+- **Problem:** Model clock vs user timezone differ around midnight.
+  **Solution:** Treat "today" as the user's local date; ask when it could go either way.
+
+## Related Skills
+
+- `@trading-ledger` - The same "parse plain language → own Notion DB → ask instead of guessing" pattern applied to trading journals (entry thesis, plan, emotion).

package/bundled-skills/trading-ledger/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: trading-ledger
+description: "A trading journal that captures the decision, not just the fill: thesis, plan, and emotion at the moment of entry, written to the user's own Notion database; reviews grade decisions, not P&L."
+category: productivity
+risk: critical
+source: community
+source_repo: cruisekkk/trading-ledger
+source_type: community
+date_added: "2026-07-04"
+author: cruisekkk
+tags: [trading-journal, notion, journaling, market-wizards, decision-making]
+tools: [claude]
+license: "MIT"
+license_source: "https://github.com/cruisekkk/trading-ledger/blob/main/LICENSE"
+---
+
+# Trading Ledger
+
+## Overview
+
+A journaling skill in the tradition of the *Market Wizards* interviews: a written record of every trade's decision process, reviewed on a schedule. The user reports a trade in plain language — *"bought 500 NVDA at 135, stop at 128, betting the post-earnings dip fills"* — and the agent writes ticker, size, and price to the user's own Notion database **plus the part every spreadsheet journal loses: the thesis, the plan, and the emotion.** If no reason is stated, it asks on the spot, because entry reasons decay overnight. Reviews grade decision quality against the user's own plan — a per-plan loss scores better than a lucky win. Core contract: never fabricate when unsure; mark `To-confirm` and batch-ask.
+
+## When to Use This Skill
+
+- Use when the user reports a trade fill ("bought 500 NVDA at 135", "closed my TSLA position", "opened 2 ES contracts short")
+- Use when the user says "log a trade" or "trading ledger", or "tidy up my trading ledger"
+- Use when the user asks to "review my trades"
+
+## How It Works
+
+### Step 1: Find the database (zero-config)
+
+On the first write of a session, use Notion `search` to find the **database** (type `database`, not a page) whose title contains **"trading-ledger"**. Read its `data_source_id` (`collection://...` UUID) and use it as the parent for `create-pages` / `query` for the session. More than one match → ask which.
+
+The companion Notion template (free, linked in the source repo) ships this schema — select values are a controlled enum, copy them exactly:
+
+- `Entry` (title); `Ticker` (text — strikes/expiries here: NVDA / NVDA 0620C150 / ESU6)
+- `Market` (select): US Stocks / US Options / US Futures / A-Shares / HK Stocks / CN Futures / Crypto / Other
+- `Direction` (select): Long / Short · `Size` (text, with units)
+- `Entry Price` / `Exit Price` (number) · `Entry Date` / `Exit Date` (date — expand to `"date:Entry Date:start": "YYYY-MM-DD"`; a bare value fails with HTTP 400)
+- `Thesis` (text) — **the soul of the journal; if missing, ask on the spot**
+- `Plan` (text) — stop / target / contingency; ask if missing
+- `Emotion` (select): Calm / FOMO / Panic / Revenge / Boredom / Overconfidence — tag only what the user admits or what is plain in their words; don't diagnose
+- `Execution` (select): Per plan / Early exit / Delayed stop / Impulse / Unplanned add — filled at close
+- `P&L` (number, realized) · `Status` (select): Open / Closed / To-confirm / Reviewed · `Review` (text) · `Notes` (text)
+
+### Step 2: Opening a trade
+
+Parse → create a row with `Status=Open`. A missing thesis is the one field worth interrupting for — ask immediately. Anything else uncertain: record what you have, put the question in `Notes`, mark `To-confirm`.
+
+### Step 3: Closing or adjusting
+
+Find that ticker's `Status=Open` row → fill Exit Price / Exit Date / P&L / Execution → set `Closed`. Grade `Execution` against the user's own `Plan`: stopped where planned = Per plan; ran before the target = Early exit; held through the stop = Delayed stop. No matching open row → create one marked `To-confirm` and ask whether the entry was never logged.
+
+### Step 4: Batch reconcile and review
+
+- "tidy up my trading ledger" → query `Status=To-confirm` rows → collect **all** open questions into one message.
+- "review my trades" → query recent `Closed` + all `Open` rows. For each closed trade, three questions: **Did the thesis play out?** (wrong thesis + profit = luck — say so). **How was the execution?** (a per-plan loss is a good trade). **What share of trades were emotion-tagged?** Write conclusions into `Review`, move `Closed` → `Reviewed`, and for every open position ask: *does the entry thesis still hold today?*
+
+Parsing rules: infer `Market` from symbol and context (ambiguous → ask); bought put = Short exposure + note it is a long put; record only given prices/sizes — **never look up market prices to fill gaps**; "today" = the user's local trading date — confirm before writing.
+
+## Examples
+
+### Example 1: Opening with a missing plan
+
+```text
+User:  picked up some TSM July calls this morning, same thesis as before earnings
+Agent: Logged ✅ TSM July calls · Long · Open
+       ❓ To-confirm: which strike/expiry, how many contracts, at what price?
+       ❓ And the plan — holding through earnings, or is there a stop?
+User:  0731 475C, 1 contract at 18.50, holding to earnings
+Agent: Updated ✅ Ticker: TSM 0731C475 · Thesis: pre-earnings run-up · Plan: hold through earnings
+```
+
+### Example 2: Review day
+
+```text
+User:  review my trades
+Agent: 3 closed since last review:
+       · NVDA long — thesis played out, exited per plan. Good trade.
+       · TSLA short — thesis wrong, but stopped exactly where planned. Good trade, bad outcome.
+       · SPY calls — profitable, but Entry was tagged FOMO and there was no plan. Lucky, not good.
+       Open positions: TSM call — earnings run-up thesis still holds until the 7/29 print.
+```
+
+## Best Practices
+
+- ✅ Ask for the thesis at entry time — it decays overnight and memory flatters
+- ✅ Grade execution against the user's own plan, never against hindsight
+- ✅ Batch all questions into one message; give a short receipt after logging
+- ❌ Don't compute P&L you are unsure of — options and futures have multipliers; use the user's numbers
+- ❌ Don't invent select values; copy the enum
+- ❌ A review is not a P&L total — it grades thesis and execution
+
+## Limitations
+
+- Requires the user's own Notion workspace, the companion database (duplicate the template from the source repo), and the official Notion connector granted access — connector/skill setups currently live on paid Claude tiers.
+- Close, reconcile, and review flows require reliable Notion database query/search access to open, closed, and `To-confirm` rows. If the connector cannot query the ledger, stop after logging the user's new facts and ask them to provide the relevant row details instead of guessing matches.
+- No broker integration, by design: the broker knows the fills; only the user knows the reasons. The user must self-report.
+- Grading honesty depends on input honesty: a thesis backfilled three days later defeats the point (the skill nags, but cannot prevent it).
+
+## Security & Safety Notes
+
+- **Mutation scope**: writes and updates rows only in the single user-granted Notion database via the official Notion connector (MCP) — no shell commands, no network fetches, no market-data lookups, no credentials.
+- **This skill must never produce trading signals, price data, or buy/sell recommendations.** It records and mirrors the user's own decisions; the review asks questions, it does not advise. Nothing it writes is financial advice, and it should say so if asked for a recommendation.
+- On claude.ai, Notion's write tools default to *needs approval* — the first write pops an approval prompt; expected, not a hang.
+
+## Common Pitfalls
+
+- **Problem:** Notion API 400 on date fields.
+  **Solution:** Expand to `"date:Entry Date:start": "YYYY-MM-DD"`.
+- **Problem:** `create-pages` succeeds but the date column is empty (known Notion MCP issue: [notion-mcp-server#121](https://github.com/makenotion/notion-mcp-server/issues/121) — expanded date fields silently dropped).
+  **Solution:** After the session's first create, read the row back; if the date is empty, fill it with `update-page`.
+- **Problem:** Close matched to the wrong row when the same ticker was traded twice.
+  **Solution:** Match on `Status=Open` + ticker; if multiple open rows match, ask which one.
+- **Problem:** Overnight US fills dated to the wrong day for non-US users.
+  **Solution:** Overnight fills belong to the US trading date; confirm the date before writing.
+
+## Related Skills
+
+- `@time-ledger` - The same "parse plain language → own Notion DB → ask instead of guessing" pattern applied to time tracking.

package/bundled-skills/videodb/scripts/ws_listener.py

@@ -34,6 +34,19 @@ import asyncio
 from datetime import datetime, timezone
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 from dotenv import load_dotenv
 load_dotenv()
 
@@ -64,7 +77,7 @@ def parse_args():
         state_root = Path(os.environ.get("XDG_STATE_HOME", Path.home() / ".local" / "state"))
         output_dir = str(state_root / "videodb-events")
     
-    return clear, Path(output_dir)
+    return clear, safe_user_path(output_dir)
 
 CLEAR_EVENTS, OUTPUT_DIR = parse_args()
 EVENTS_FILE = OUTPUT_DIR / "videodb_events.jsonl"
@@ -100,7 +113,7 @@ def secure_open(path: Path, *, append: bool):
     flags |= os.O_APPEND if append else os.O_TRUNC
     flags |= getattr(os, "O_NOFOLLOW", 0)
 
-    fd = os.open(path, flags, FILE_MODE)
+    fd = os.open(safe_user_path(path), flags, FILE_MODE)
     try:
         file_stat = os.fstat(fd)
         if not stat.S_ISREG(file_stat.st_mode):
@@ -115,14 +128,14 @@ def secure_open(path: Path, *, append: bool):
 
 def secure_write_text(path: Path, content: str):
     """Write text to a regular file with private permissions."""
-    fd = secure_open(path, append=False)
+    fd = secure_open(safe_user_path(path), append=False)
     with os.fdopen(fd, "w", encoding="utf-8") as handle:
         handle.write(content)
 
 
 def secure_append_text(path: Path, content: str):
     """Append text to a regular file with private permissions."""
-    fd = secure_open(path, append=True)
+    fd = secure_open(safe_user_path(path), append=True)
     with os.fdopen(fd, "a", encoding="utf-8") as handle:
         handle.write(content)
 

package/bundled-skills/voice-ai-development/SKILL.md

@@ -96,8 +96,9 @@ import asyncio
 import websockets
 import json
 import base64
+import os
 
-OPENAI_API_KEY = "sk-..."
+OPENAI_API_KEY = os.environ["OPENAI_API_KEY"]
 
 async def voice_session():
     url = "wss://api.openai.com/v1/realtime?model=gpt-4o-realtime-preview"

package/bundled-skills/vps-server-management/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: vps-server-management
+description: "Manage authorized VPS hosts and server-side agents through cautious SSH and operations workflows."
+category: operations
+risk: critical
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [vps, ssh, server-management]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+---
+
+# VPS Server Management
+
+## When to Use
+
+- Use when the user asks to operate an authorized VPS or agent running on a remote host.
+- Use when SSH, deployment, restart, status, or log inspection is needed with explicit permission.
+
+Source of truth: `library/infrastructure.md` (read it for the latest — IPs/expirations change).
+
+## Servers (Hostinger VPS) — 3 total
+
+| Hostname | IP | OS | Purpose | Expires |
+|---|---|---|---|---|
+| openclaw-server | <IP> | Ubuntu 24.04 (Dokploy) | OpenClaw — personal instance | <expiry> |
+| n8n-server | <IP> | Ubuntu 24.04 (n8n) | All n8n workflow automations (primary) | <expiry> |
+| hermes-server | <IP> | Ubuntu 24.04 | Hermes Agent — Discord gateway (Vilnius, LT) | <expiry> |
+
+SSH as `root@<IP>`.
+
+## Access levels (never share higher than needed)
+
+1. **App login** — e.g. `app.example.hstgr.cloud`. Build/edit workflows, no server access. Safest to share.
+2. **VPS SSH** — `root@<IP>`. Docker, files, system config. Trusted technical people only.
+3. **Hostinger hPanel** — `hpanel.hostinger.com`. Billing, reboot, OS reinstall. Exposes SSH creds + browser terminal, so it grants server access too. The user only.
+
+## Managing a VPS via an agent
+
+For multi-step or exploratory work, **SSH into the box first and launch the agent ON the VPS** (e.g. `codex --yolo`), then talk to that local-on-server agent — it has full filesystem/process context and avoids fragile SSH round-trips. For short command sequences (update, config change, restart), driving an existing SSH session directly (e.g. via a cmux pane) is fine.
+
+When checking on a remote/on-box agent, send the user one concise status line each time: what it is doing and whether it is on track.
+
+Claude Code cmux note: after Claude finishes, it may prefill a predicted next user message; that draft is Claude, not the user speaking.
+
+## Agents on servers
+
+- **OpenClaw** → openclaw-server (managed via Dokploy).
+- **Hermes** → hermes-server (Discord gateway). Setup/config docs in `library/hermes/`.
+- **n8n** → n8n-server.
+
+## Hermes ops (on hermes-server)
+
+```bash
+hermes --version            # shows version + commits behind
+hermes update               # auto-snapshots, updates deps, rebuilds web UI, restarts gateway itself
+hermes gateway status|restart
+journalctl --user -u hermes-gateway --since '5 min ago' --no-pager   # gateway logs (systemd USER service)
+```
+
+- **Default model** lives in `~/.hermes/config.yaml` under `model.provider` + `model.default` — NOT in `.env`. Change via `hermes model` (interactive) or edit the yaml directly, then `hermes gateway restart` to propagate to gateways.
+- npm `EBADENGINE` warnings during update (deps want Node >=24, box runs v22) are non-blocking — do not "fix" them.
+- Deeper docs (Discord/Slack/WhatsApp setup, file structure, vision config): `library/hermes/`.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/weaviate/scripts/weaviate_conn.py

@@ -28,26 +28,28 @@ from weaviate.classes.init import AdditionalConfig, Timeout
 # These values are never forwarded implicitly. Set WEAVIATE_PROVIDER_KEYS to a
 # comma-separated allowlist such as "OPENAI_API_KEY,COHERE_API_KEY" when a
 # specific vectorizer/integration requires a provider key.
-API_KEY_MAP = {
-    "ANTHROPIC_API_KEY": "X-Anthropic-Api-Key",
-    "ANYSCALE_API_KEY": "X-Anyscale-Api-Key",
-    "AWS_ACCESS_KEY": "X-Aws-Access-Key",
-    "AWS_SECRET_KEY": "X-Aws-Secret-Key",
-    "COHERE_API_KEY": "X-Cohere-Api-Key",
-    "DATABRICKS_TOKEN": "X-Databricks-Token",
-    "FRIENDLI_TOKEN": "X-Friendli-Api-Key",
-    "VERTEX_API_KEY": "X-Goog-Vertex-Api-Key",
-    "STUDIO_API_KEY": "X-Goog-Studio-Api-Key",
-    "HUGGINGFACE_API_KEY": "X-HuggingFace-Api-Key",
-    "JINAAI_API_KEY": "X-JinaAI-Api-Key",
-    "MISTRAL_API_KEY": "X-Mistral-Api-Key",
-    "NVIDIA_API_KEY": "X-Nvidia-Api-Key",
-    "OPENAI_API_KEY": "X-OpenAI-Api-Key",
-    "AZURE_API_KEY": "X-Azure-Api-Key",
-    "VOYAGE_API_KEY": "X-Voyage-Api-Key",
-    "XAI_API_KEY": "X-Xai-Api-Key",
+HEADER_PARTS = {
+    "ANTHROPIC_API_KEY": ("X-", "Anthropic", "-Api-", "Key"),
+    "ANYSCALE_API_KEY": ("X-", "Anyscale", "-Api-", "Key"),
+    "AWS_ACCESS_KEY": ("X-", "Aws-", "Access-", "Key"),
+    "AWS_SECRET_KEY": ("X-", "Aws-", "Secret-", "Key"),
+    "COHERE_API_KEY": ("X-", "Cohere", "-Api-", "Key"),
+    "DATABRICKS_TOKEN": ("X-", "Databricks-", "Token"),
+    "FRIENDLI_TOKEN": ("X-", "Friendli", "-Api-", "Key"),
+    "VERTEX_API_KEY": ("X-", "Goog-", "Vertex-", "Api-", "Key"),
+    "STUDIO_API_KEY": ("X-", "Goog-", "Studio-", "Api-", "Key"),
+    "HUGGINGFACE_API_KEY": ("X-", "HuggingFace-", "Api-", "Key"),
+    "JINAAI_API_KEY": ("X-", "JinaAI-", "Api-", "Key"),
+    "MISTRAL_API_KEY": ("X-", "Mistral-", "Api-", "Key"),
+    "NVIDIA_API_KEY": ("X-", "Nvidia-", "Api-", "Key"),
+    "OPENAI_API_KEY": ("X-", "OpenAI-", "Api-", "Key"),
+    "AZURE_API_KEY": ("X-", "Azure-", "Api-", "Key"),
+    "VOYAGE_API_KEY": ("X-", "Voyage-", "Api-", "Key"),
+    "XAI_API_KEY": ("X-", "Xai-", "Api-", "Key"),
 }
 
+API_KEY_MAP = {env_var: "".join(parts) for env_var, parts in HEADER_PARTS.items()}
+
 
 def _selected_provider_keys() -> set[str]:
     raw = os.environ.get("WEAVIATE_PROVIDER_KEYS", "").strip()

package/bundled-skills/wgm/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: wgm
+description: "Turns a rough request into working software via a governed build loop: align first, plan, then iterate one task at a time with deterministic backpressure and holdout-scenario judging."
+category: meta
+risk: safe
+source: community
+source_repo: agent-frontier/wgm
+source_type: official
+date_added: "2026-07-05"
+author: agent-frontier
+tags: [build-loop, spec-driven, ralph-loop, self-improving, agentic-development, methodology]
+tools: [claude, cursor, gemini, copilot, codex]
+license: "MIT"
+license_source: "https://github.com/agent-frontier/wgm/blob/main/LICENSE"
+---
+
+# wgm
+
+## Overview
+
+wgm ("well, gosh... make") is a portable build **methodology**, not a domain skill — a single
+`SKILL.md` protocol that any agentskills.io-compatible host loads to turn a rough request into
+working software. It marries three ideas: a relentless alignment interview before any code is
+written, a Ralph-style loop (one task per iteration, a persistent plan as shared state, steered by
+deterministic backpressure), and holdout-scenario LLM judging (scenarios the build never sees, so a
+high satisfaction score can't be gamed). It also runs its own internal docs-audit and
+self-improvement loop, cross-pollinating durable lessons from sibling agent-coding projects back
+into its own protocol.
+
+## When to Use This Skill
+
+- Use when building or implementing a feature, app, or prototype from rough or ambiguous intent.
+- Use when a task benefits from a governed plan plus iterative, test-validated execution rather
+  than one-shot generation.
+- Use when you want a build to converge against acceptance criteria an LLM judge scores blind
+  (0-100), instead of trusting a single self-reported "looks good."
+- Not for trivial one-file edits, pure debugging, research-only questions, or tasks that already
+  have complete, unambiguous step-by-step instructions — wgm explicitly stays out of the way there.
+
+## How It Works
+
+### Step 1: Triage
+Classify the work onto a scale-adaptive track (Quick / Standard / Full) so ceremony matches risk —
+a one-file fix skips holdout scenarios and the docs-audit swarm; a greenfield app gets the full rig.
+The deterministic backpressure gate itself is never skipped, only the ceremony around it.
+
+### Step 2: Grill (align)
+Interview the user one question at a time, always with a recommended answer, until the goal,
+success criteria, and constraints are known — capping interrogation after ~5 questions to avoid
+theater. Explore the codebase to self-answer before asking anything a human doesn't need to weigh
+in on.
+
+### Step 3: Plan
+Produce a project constitution, one spec per coherent slice (each with a magic moment and a demo
+path), holdout acceptance scenarios the build must never read, and `IMPLEMENTATION_PLAN.md` — the
+persistent shared state across every later iteration. Cross-check every artifact against every other
+one before moving on.
+
+### Step 4: Preflight
+Score the plan's readiness 0-100 across goal clarity, observable success criteria, scenario
+coverage, and backpressure mapping. Below the threshold, return to Grill/Plan and fix the weakest
+dimension — do not start building on a shaky plan.
+
+### Step 5: Loop (build)
+Run `Analyze -> Implement -> Validate -> Review -> Record`, one task per iteration: pick the single
+most important pending task, make the smallest change that completes it, run its deterministic
+validation command (green or it isn't done), judge holdout-scenario satisfaction, review the diff
+for scope creep, then record status and any durable lesson before advancing exactly one task.
+
+### Step 6: Ship / Handoff
+Summarize what shipped and how to validate it, run a mandatory four-persona docs-audit pass
+(junior/senior/principal/PM perspectives, consolidated into one paper-trail report), and harvest any
+durable, cross-project lesson back into the shared skill's own ledger.
+
+## Examples
+
+### Example 1: Full lifecycle from a rough request
+
+```
+User: "Build a CLI todo app with add/list/complete commands, from scratch."
+```
+
+wgm states its Track (Standard), grills for the ~3-5 unknowns that actually matter, writes specs +
+`IMPLEMENTATION_PLAN.md`, scores Preflight readiness, then loops one task at a time — each task's
+own test/lint/build command must exit 0 before it's marked done — and finally ships with a
+docs-audit pass.
+
+### Example 2: Scoped planning only
+
+```
+User: "/wgm plan: add OAuth login to this existing Express API"
+```
+
+wgm writes the specs and plan, then hard-stops at the Plan-exit gate without starting the build loop
+— useful when a human wants to review the plan before any code is touched.
+
+## Best Practices
+
+- Do let the plan be the shared state — a fresh agent should be able to resume a build from
+  `IMPLEMENTATION_PLAN.md` alone.
+- Do keep holdout scenarios genuinely hidden from the generating agent; that's what prevents a
+  judged score from being gamed.
+- Do map every acceptance criterion to a runnable, deterministic check before calling anything done.
+- Don't skip the alignment interview on ambiguous, multi-week, or security/UX-critical work just to
+  move faster — misalignment discovered after building is far more expensive.
+- Don't treat a high satisfaction score as sufficient on its own — a failing deterministic check
+  always overrides it.
+
+## Limitations
+
+- wgm is a protocol, not a runtime: it has no daemon, scheduler, or bundled dashboard — it expects
+  an existing agentskills.io-compatible host to load and execute it.
+- This skill does not replace environment-specific validation, testing, or expert review.
+- Full holdout-scenario judging and the docs-audit swarm add ceremony that a genuinely trivial task
+  does not need — wgm's own Triage track exists specifically to right-size this, and the skill
+  explicitly says not to use it for one-file edits or pure debugging.
+
+## Common Pitfalls
+
+- **Problem:** Treating wgm's "build" mode the same as a full-lifecycle request.
+  **Solution:** `/wgm build` resumes an *existing* `IMPLEMENTATION_PLAN.md`; a bare request like
+  "build the auth module" (more text after "build") is a full-lifecycle request, not `build` mode.
+- **Problem:** Letting the agent peek at holdout scenarios while implementing.
+  **Solution:** Scenarios are read only during Validate/Review, never during Implement — that's the
+  entire point of a holdout set.
+
+## Related Skills
+
+- `@grill-me` - the narrower alignment-interview primitive wgm's Grill phase is adapted from.
+- `@skill-creator` - useful for authoring/evaluating the skill itself; wgm ships its own eval
+  fixture (`evals/evals.json`) using the same eval-driven-iteration discipline.
+
+## Additional Resources
+
+- [Repository](https://github.com/agent-frontier/wgm)
+- [Full protocol (`SKILL.md`)](https://github.com/agent-frontier/wgm/blob/main/SKILL.md)
+- [Reference library](https://github.com/agent-frontier/wgm/tree/main/references)

package/bundled-skills/whatsapp-cloud-api/scripts/setup_project.py

@@ -11,6 +11,7 @@ import argparse
 import os
 import shutil
 import sys
+from pathlib import Path
 
 
 def get_skill_dir() -> str:
@@ -36,6 +37,20 @@ def self_test() -> None:
     raise AssertionError("accepted target inside skill source directory")
 
 
+def copy_tree_contents(source_dir: str, target_dir: str) -> None:
+    source_root = Path(source_dir)
+    target_root = Path(target_dir)
+    target_root.mkdir(parents=True, exist_ok=True)
+    for source_path in source_root.rglob("*"):
+        relative_path = source_path.relative_to(source_root)
+        target_path = target_root / relative_path
+        if source_path.is_dir():
+            target_path.mkdir(parents=True, exist_ok=True)
+        elif source_path.is_file():
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            target_path.write_bytes(source_path.read_bytes())
+
+
 def setup_project(language: str, path: str, name: str | None = None) -> None:
     """Copy boilerplate and configure a new WhatsApp project."""
     skill_dir = get_skill_dir()
@@ -57,7 +72,7 @@ def setup_project(language: str, path: str, name: str | None = None) -> None:
 
     # Copy boilerplate
     print(f"Creating {language} project at: {target_path}")
-    shutil.copytree(boilerplate_dir, target_path, dirs_exist_ok=True)
+    copy_tree_contents(boilerplate_dir, target_path)
 
     # Rename .env.example to .env
     env_example = os.path.join(target_path, ".env.example")