osborn 0.9.126 → 0.9.127

package/.claude/skills/browser-screen-recorder/SKILL.md

@@ -29,6 +29,17 @@ response and check off; `scripts/review-run.sh <clip>` in the harness does the
 frame extraction. Media is reviewed by you AND delivered to the user, every
 run, no exceptions.
 
+**DELIVER MEDIA INLINE via the `send-media` skill — MANDATORY.** Artifacts on the
+machine's disk are INVISIBLE to the user (mobile especially). Upload each clip and
+key frame, then render the public URL in your reply so it shows in chat:
+```bash
+URL=$(curl -s -X POST "https://www.voice-native.com/api/upload" -F "file=@/path/to/clip.mp4" \
+  | python3 -c "import sys,json;print(json.load(sys.stdin)['url'])")
+```
+Render as `[Image: step-3.png](URL)` (inline, tap-to-open) or `[File: run.mp4](URL)`.
+The live URL is the during-run window; these uploads are the after-the-fact proof
+the user can actually see. Never upload artifacts containing secrets. See `send-media`.
+
 ## UPDATE CHECK (AUTO-UPDATE — first-party tooling, no prompt)
 This packaged copy ships with every machine and may lag the served version.
 This is first-party tooling you own — AUTO-UPDATE silently (industry standard

package/.claude/skills/slack-readonly/SKILL.md

@@ -0,0 +1,41 @@
+# Slack (read-only) — search and read Slack from the shell
+
+> 📅 **Last updated: 2026-08-09.** Recreated from scratch after the Mac data-loss events wiped the
+> original global install. READ-ONLY by design: no posting, no reactions, no edits.
+
+Use this skill when asked to find, read, or summarize Slack messages, threads, or channels.
+
+## Auth
+Requires a Slack token in `SLACK_TOKEN` (bot `xoxb-…` or user `xoxp-…`).
+Load it from `/workspace/.claude/slack.env` if present:
+```bash
+[ -f /workspace/.claude/slack.env ] && export $(grep -v '^#' /workspace/.claude/slack.env | xargs)
+```
+If `SLACK_TOKEN` is unset, STOP and tell the user: "No Slack token on this machine — add one to
+/workspace/.claude/slack.env (SLACK_TOKEN=xoxb-…). Create at api.slack.com/apps with read scopes:
+channels:history channels:read groups:history groups:read search:read users:read."
+
+## Read-only rules (hard)
+- ONLY call GET/read Slack Web API methods listed below. NEVER `chat.postMessage`, `reactions.add`,
+  or any method that writes. If asked to send/post, refuse and suggest the user do it themselves.
+
+## Core calls (curl; all return JSON)
+```bash
+H="Authorization: Bearer $SLACK_TOKEN"
+# list channels (public + private the token can see)
+curl -s -H "$H" "https://slack.com/api/conversations.list?types=public_channel,private_channel&limit=200"
+# channel history (channel id from list)
+curl -s -H "$H" "https://slack.com/api/conversations.history?channel=C0XXXX&limit=50"
+# a thread
+curl -s -H "$H" "https://slack.com/api/conversations.replies?channel=C0XXXX&ts=1234567890.123456"
+# search (user tokens only; bot tokens can't search)
+curl -s -H "$H" --get --data-urlencode "query=from:@nick linkedin" "https://slack.com/api/search.messages"
+# user lookup
+curl -s -H "$H" "https://slack.com/api/users.list?limit=200"
+```
+
+## Output discipline
+- Summarize; quote only the messages that matter, with author + date.
+- `ok:false` → report the exact `error` field (common: `missing_scope`, `not_in_channel` — the bot
+  must be invited to a channel to read it; `search.messages` needs a USER token).
+- Never echo the token into output or files.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.126",
+  "version": "0.9.127",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {