skimpyclaw 0.3.10 → 0.3.14

package/dist/setup-templates.js

@@ -0,0 +1,214 @@
+// Template and skill content for onboarding (extracted from setup.ts)
+import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const CONFIG_DIR = join(homedir(), '.skimpyclaw');
+export const REQUIRED_TEMPLATE_DEFAULTS = {
+    'SOUL.md': '# SOUL\n\nBe direct, resourceful, and helpful. Keep it concise.\n',
+    'IDENTITY.md': '# IDENTITY\n\nName: Claw\nEmoji: 👙🦞\n',
+    'USER.md': '# USER\n\nName: User\n',
+    'HEARTBEAT.md': '# HEARTBEAT\n\nIf nothing needs attention, reply HEARTBEAT_OK.\n',
+};
+export const STARTER_SKILL_TEMPLATES = {
+    'daily-notes': `---
+name: daily-notes
+description: Keep daily notes organized under the configured daily notes directory.
+triggers: ["daily note", "standup", "plan day", "journal"]
+priority: 90
+---
+
+When writing daily notes:
+1. Use today's date in the file name if missing.
+2. Include sections: Priorities, Schedule, Notes, Follow-ups.
+3. Keep entries concise and actionable.
+4. Avoid creating files outside the configured daily notes directory.
+`,
+    'weather': `---
+name: weather
+description: Fetch and format weather data for daily briefings and quick checks.
+triggers: ["weather", "forecast", "temperature", "rain"]
+priority: 45
+---
+
+When asked about weather or generating a daily briefing:
+1. Use web search to find current weather for the user's location.
+2. Format as: conditions, high/low temps, precipitation chance.
+3. Keep it to 2-3 sentences max.
+4. Include any weather alerts if present.
+5. For daily briefings: mention if rain is expected (affects outdoor plans).
+`,
+    'web-search': `---
+name: web-search
+description: Search the web using the Browser tool. Opens DuckDuckGo, reads results, and returns findings.
+triggers: ["search", "look up", "google", "find online", "web search"]
+priority: 50
+---
+
+When asked to search the web:
+1. Use the Browser tool to open https://html.duckduckgo.com/html/?q=<URL-encoded query>
+2. Use getText to read the search results page.
+3. If a specific result looks promising, open that URL and extract the relevant content.
+4. Summarize findings concisely — include source URLs.
+5. Close the browser when done.
+
+Do NOT fabricate results. If the search returns nothing useful, say so.
+`,
+    'duckduckgo-html-search': `---
+name: duckduckgo-html-search
+description: Search the web via DuckDuckGo HTML results using the Browser tool
+emoji: 🦆
+tags: [search, web, browser]
+priority: 45
+enabled: true
+---
+
+# DuckDuckGo HTML Search Skill
+
+Use this skill when the user asks for web search, source gathering, or lightweight browsing.
+
+## Priority rule
+DuckDuckGo HTML via Browser is the default search path.
+- Prefer DuckDuckGo first, even if \\\`$web_search\\\` is available.
+- Use \\\`$web_search\\\` only when the user explicitly asks for it, DuckDuckGo is blocked, or Browser is unavailable.
+
+## Default workflow
+1. Build query URL: \\\`https://duckduckgo.com/html/?q=<urlencoded query>\\\`
+2. Open the URL with Browser.
+3. Wait for result anchors (\\\`a.result__a\\\`) or fallback body text.
+4. Extract results using one Browser \\\`evaluate\\\` call when possible.
+5. Return only actually extracted items (never pad count).
+
+## Extraction requirements
+For each result, capture when available:
+- title
+- url
+- snippet
+
+If a field is missing, set it to \\\`UNAVAILABLE\\\`.
+
+## Integrity rules
+- Never fabricate results.
+- If the page blocks, fails, or no results render, return \\\`UNAVAILABLE\\\` and state why.
+- Never mix real and invented entries.
+- Include source URLs in output.
+
+## Browser strategy
+- Prefer one-page extraction via \\\`evaluate\\\`:
+  - Collect \\\`a.result__a\\\` for title + href
+  - Collect nearby snippet nodes (\\\`.result__snippet\\\`) when present
+- Use minimal actions: open → waitFor → evaluate → optional screenshot.
+- If selectors change, fallback to visible text extraction and clearly mark reduced confidence.
+
+## Output format (concise)
+- Query used
+- Result count actually extracted
+- Bulleted results with title + URL + snippet
+- Notes section for failures/limits
+
+## Safe defaults
+- Default top results target: 5 (or user-specified)
+- If user asks for deep research, gather multiple queries but keep each query's extraction explicit and separated.
+`,
+};
+export function ensureCoreTemplates(agentDir) {
+    const created = [];
+    for (const [file, content] of Object.entries(REQUIRED_TEMPLATE_DEFAULTS)) {
+        const dst = join(agentDir, file);
+        if (!existsSync(dst)) {
+            writeFileSync(dst, content, 'utf-8');
+            created.push(file);
+        }
+    }
+    return created;
+}
+export function ensureStarterSkills(starters) {
+    const created = [];
+    const skillsDir = join(CONFIG_DIR, 'skills');
+    mkdirSync(skillsDir, { recursive: true });
+    const requested = [];
+    if (starters.skillDailyNotes)
+        requested.push('daily-notes');
+    if (starters.skillWeather)
+        requested.push('weather');
+    if (starters.skillWebSearch)
+        requested.push('web-search');
+    for (const skillName of requested) {
+        const dir = join(skillsDir, skillName);
+        const skillPath = join(dir, 'SKILL.md');
+        if (!existsSync(skillPath)) {
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(skillPath, STARTER_SKILL_TEMPLATES[skillName], 'utf-8');
+            created.push(skillName);
+        }
+    }
+    return created;
+}
+export function buildStarterCronJobs(starters) {
+    const jobs = [];
+    jobs.push({
+        id: 'memory-trim',
+        name: 'Memory Trim',
+        model: 'claude-fast',
+        schedule: {
+            kind: 'cron',
+            expr: '0 0,12 * * *',
+            tz: starters.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone,
+        },
+        payload: {
+            kind: 'agentTurn',
+            message: '~/.skimpyclaw/prompts/memory-trim.md',
+            tools: {
+                enabled: true,
+                allowedPaths: [`${homedir()}/.skimpyclaw`],
+                maxIterations: 30,
+                bashTimeout: 10000,
+                toolProfile: 'minimal',
+            },
+        },
+    });
+    if (starters.cronTechNews) {
+        jobs.push({
+            id: 'tech-digest',
+            name: 'Tech News',
+            schedule: {
+                kind: 'cron',
+                expr: '0 8 * * *',
+                tz: starters.timezone,
+            },
+            payload: {
+                kind: 'agentTurn',
+                message: 'Use the Browser tool to visit https://news.ycombinator.com and fetch today\'s top 10 stories. Reply with title, URL, and 1-line summary for each item.',
+                tools: {
+                    enabled: true,
+                    allowedPaths: [`${homedir()}/.skimpyclaw`],
+                    maxIterations: 30,
+                    bashTimeout: 30000,
+                    browser: { enabled: true, headless: true },
+                },
+            },
+        });
+    }
+    if (starters.cronWeather) {
+        jobs.push({
+            id: 'weather',
+            name: 'Weather',
+            schedule: {
+                kind: 'cron',
+                expr: '0 7 * * *',
+                tz: starters.timezone,
+            },
+            payload: {
+                kind: 'agentTurn',
+                message: `Use the Browser tool to check current weather and today's forecast for ${starters.weatherLocation}. Keep it concise: current temp/conditions, highs/lows, precipitation chance, and 1 recommendation.`,
+                tools: {
+                    enabled: true,
+                    allowedPaths: [`${homedir()}/.skimpyclaw`],
+                    maxIterations: 30,
+                    bashTimeout: 30000,
+                    browser: { enabled: true, headless: true },
+                },
+            },
+        });
+    }
+    return jobs;
+}

package/dist/setup.d.ts

@@ -1,3 +1,4 @@
+import { type SetupStarters } from './setup-templates.js';
 interface SetupOptions {
     dryRun?: boolean;
 }
@@ -16,15 +17,6 @@ interface SetupFeatures {
     mcp: boolean;
     sandbox: boolean;
 }
-interface SetupStarters {
-    cronTechNews: boolean;
-    cronWeather: boolean;
-    timezone: string;
-    weatherLocation: string;
-    skillDailyNotes: boolean;
-    skillWeather: boolean;
-    skillWebSearch: boolean;
-}
 interface SetupBuildInput {
     workspaceDir: string;
     extraAllowedPaths?: string[];

package/dist/setup.js

@@ -8,6 +8,8 @@ import { spawnSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { runDoctor as runDoctorChecks } from './doctor/runner.js';
 import { toErrorMessage } from './utils.js';
+import { detectSandboxRuntime, isSandboxRuntimeRunning, sandboxNetworkExists, defaultSandboxNetwork, } from './sandbox-utils.js';
+import { ensureCoreTemplates, ensureStarterSkills, buildStarterCronJobs, } from './setup-templates.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // ANSI color helpers (no chalk dependency)
@@ -57,46 +59,13 @@ function loadExistingSetup() {
     }
     return { config, env };
 }
-function detectSandboxRuntime(preferred) {
-    if (preferred) {
-        const check = spawnSync(preferred, ['--version'], { encoding: 'utf-8' });
-        return check.status === 0 ? preferred : null;
-    }
-    const containerCheck = spawnSync('container', ['--version'], { encoding: 'utf-8' });
-    if (containerCheck.status === 0)
-        return 'container';
-    const dockerCheck = spawnSync('docker', ['--version'], { encoding: 'utf-8' });
-    if (dockerCheck.status === 0)
-        return 'docker';
-    return null;
-}
-function sandboxRuntimeRunning(runtime) {
-    if (runtime === 'container') {
-        return spawnSync('container', ['system', 'status'], { encoding: 'utf-8' }).status === 0;
-    }
-    return spawnSync('docker', ['info'], { encoding: 'utf-8' }).status === 0;
-}
-function sandboxNetworkExists(runtime, network) {
-    if (runtime === 'container') {
-        const result = spawnSync('container', ['network', 'ls'], { encoding: 'utf-8' });
-        if (result.status !== 0)
-            return false;
-        return result.stdout
-            .split('\n')
-            .some((line) => line.trim().split(/\s+/)[0] === network);
-    }
-    return spawnSync('docker', ['network', 'inspect', network], { encoding: 'utf-8' }).status === 0;
-}
-function defaultSandboxNetwork(runtime) {
-    return runtime === 'container' ? 'default' : 'bridge';
-}
 function bootstrapSandbox(runtime, image, network) {
     const sandboxDir = join(__dirname, '..', 'sandbox');
     const dockerfile = join(sandboxDir, 'Dockerfile');
     if (!existsSync(dockerfile)) {
         return { ok: false, message: `Sandbox Dockerfile not found: ${dockerfile}` };
     }
-    if (!sandboxRuntimeRunning(runtime)) {
+    if (!isSandboxRuntimeRunning(runtime)) {
         const hint = runtime === 'container'
             ? 'Run `container system start` and rerun onboarding.'
             : 'Start Docker Desktop and rerun onboarding.';
@@ -223,76 +192,6 @@ async function askProviders(rl, existingProviders) {
         return choices;
     }
 }
-function buildStarterCronJobs(starters) {
-    const jobs = [];
-    // Memory trim is always included — runs 2x/day on a cheap model
-    jobs.push({
-        id: 'memory-trim',
-        name: 'Memory Trim',
-        model: 'claude-haiku',
-        schedule: {
-            kind: 'cron',
-            expr: '0 0,12 * * *',
-            tz: starters.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone,
-        },
-        payload: {
-            kind: 'agentTurn',
-            message: '~/.skimpyclaw/prompts/memory-trim.md',
-            tools: {
-                enabled: true,
-                allowedPaths: [`${homedir()}/.skimpyclaw`],
-                maxIterations: 30,
-                bashTimeout: 10000,
-                toolProfile: 'minimal',
-            },
-        },
-    });
-    if (starters.cronTechNews) {
-        jobs.push({
-            id: 'tech-digest',
-            name: 'Tech News',
-            schedule: {
-                kind: 'cron',
-                expr: '0 8 * * *',
-                tz: starters.timezone,
-            },
-            payload: {
-                kind: 'agentTurn',
-                message: 'Use the Browser tool to visit https://news.ycombinator.com and fetch today\'s top 10 stories. Reply with title, URL, and 1-line summary for each item.',
-                tools: {
-                    enabled: true,
-                    allowedPaths: [`${homedir()}/.skimpyclaw`],
-                    maxIterations: 30,
-                    bashTimeout: 30000,
-                    browser: { enabled: true, headless: true },
-                },
-            },
-        });
-    }
-    if (starters.cronWeather) {
-        jobs.push({
-            id: 'weather',
-            name: 'Weather',
-            schedule: {
-                kind: 'cron',
-                expr: '0 7 * * *',
-                tz: starters.timezone,
-            },
-            payload: {
-                kind: 'agentTurn',
-                message: `Use the Browser tool to check current weather and today's forecast for ${starters.weatherLocation}. Keep it concise: current temp/conditions, highs/lows, precipitation chance, and 1 recommendation.`,
-                tools: {
-                    enabled: true,
-                    allowedPaths: [`${homedir()}/.skimpyclaw`],
-                    maxIterations: 30,
-                    bashTimeout: 30000,
-                    browser: { enabled: true, headless: true },
-                },
-            },
-        });
-    }
-    return jobs;
-}
 async function collectProviderSecrets(rl, providers, existingEnv) {
     const secrets = {};
     const env = existingEnv || {};
@@ -614,146 +513,6 @@ export function buildSetupArtifacts(input) {
         config,
     };
 }
-const REQUIRED_TEMPLATE_DEFAULTS = {
-    'SOUL.md': '# SOUL\n\nBe direct, resourceful, and helpful. Keep it concise.\n',
-    'IDENTITY.md': '# IDENTITY\n\nName: Claw\nEmoji: 👙🦞\n',
-    'USER.md': '# USER\n\nName: User\n',
-    'HEARTBEAT.md': '# HEARTBEAT\n\nIf nothing needs attention, reply HEARTBEAT_OK.\n',
-};
-const STARTER_SKILL_TEMPLATES = {
-    'daily-notes': `---
-name: daily-notes
-description: Keep daily notes organized under the configured daily notes directory.
-triggers: ["daily note", "standup", "plan day", "journal"]
-priority: 90
----
-
-When writing daily notes:
-1. Use today's date in the file name if missing.
-2. Include sections: Priorities, Schedule, Notes, Follow-ups.
-3. Keep entries concise and actionable.
-4. Avoid creating files outside the configured daily notes directory.
-`,
-    'weather': `---
-name: weather
-description: Fetch and format weather data for daily briefings and quick checks.
-triggers: ["weather", "forecast", "temperature", "rain"]
-priority: 45
----
-
-When asked about weather or generating a daily briefing:
-1. Use web search to find current weather for the user's location.
-2. Format as: conditions, high/low temps, precipitation chance.
-3. Keep it to 2-3 sentences max.
-4. Include any weather alerts if present.
-5. For daily briefings: mention if rain is expected (affects outdoor plans).
-`,
-    'web-search': `---
-name: web-search
-description: Search the web using the Browser tool. Opens DuckDuckGo, reads results, and returns findings.
-triggers: ["search", "look up", "google", "find online", "web search"]
-priority: 50
----
-
-When asked to search the web:
-1. Use the Browser tool to open https://html.duckduckgo.com/html/?q=<URL-encoded query>
-2. Use getText to read the search results page.
-3. If a specific result looks promising, open that URL and extract the relevant content.
-4. Summarize findings concisely — include source URLs.
-5. Close the browser when done.
-
-Do NOT fabricate results. If the search returns nothing useful, say so.
-`,
-    'duckduckgo-html-search': `---
-name: duckduckgo-html-search
-description: Search the web via DuckDuckGo HTML results using the Browser tool
-emoji: 🦆
-tags: [search, web, browser]
-priority: 45
-enabled: true
----
-
-# DuckDuckGo HTML Search Skill
-
-Use this skill when the user asks for web search, source gathering, or lightweight browsing.
-
-## Priority rule
-DuckDuckGo HTML via Browser is the default search path.
-- Prefer DuckDuckGo first, even if \\\`$web_search\\\` is available.
-- Use \\\`$web_search\\\` only when the user explicitly asks for it, DuckDuckGo is blocked, or Browser is unavailable.
-
-## Default workflow
-1. Build query URL: \\\`https://duckduckgo.com/html/?q=<urlencoded query>\\\`
-2. Open the URL with Browser.
-3. Wait for result anchors (\\\`a.result__a\\\`) or fallback body text.
-4. Extract results using one Browser \\\`evaluate\\\` call when possible.
-5. Return only actually extracted items (never pad count).
-
-## Extraction requirements
-For each result, capture when available:
-- title
-- url
-- snippet
-
-If a field is missing, set it to \\\`UNAVAILABLE\\\`.
-
-## Integrity rules
-- Never fabricate results.
-- If the page blocks, fails, or no results render, return \\\`UNAVAILABLE\\\` and state why.
-- Never mix real and invented entries.
-- Include source URLs in output.
-
-## Browser strategy
-- Prefer one-page extraction via \\\`evaluate\\\`:
-  - Collect \\\`a.result__a\\\` for title + href
-  - Collect nearby snippet nodes (\\\`.result__snippet\\\`) when present
-- Use minimal actions: open → waitFor → evaluate → optional screenshot.
-- If selectors change, fallback to visible text extraction and clearly mark reduced confidence.
-
-## Output format (concise)
-- Query used
-- Result count actually extracted
-- Bulleted results with title + URL + snippet
-- Notes section for failures/limits
-
-## Safe defaults
-- Default top results target: 5 (or user-specified)
-- If user asks for deep research, gather multiple queries but keep each query's extraction explicit and separated.
-`,
-};
-function ensureCoreTemplates(agentDir) {
-    const created = [];
-    for (const [file, content] of Object.entries(REQUIRED_TEMPLATE_DEFAULTS)) {
-        const dst = join(agentDir, file);
-        if (!existsSync(dst)) {
-            writeFileSync(dst, content, 'utf-8');
-            created.push(file);
-        }
-    }
-    return created;
-}
-function ensureStarterSkills(starters) {
-    const created = [];
-    const skillsDir = join(CONFIG_DIR, 'skills');
-    mkdirSync(skillsDir, { recursive: true });
-    const requested = ['duckduckgo-html-search']; // always installed
-    if (starters.skillDailyNotes)
-        requested.push('daily-notes');
-    if (starters.skillWeather)
-        requested.push('weather');
-    if (starters.skillWebSearch)
-        requested.push('web-search');
-    for (const skillName of requested) {
-        const dir = join(skillsDir, skillName);
-        const skillPath = join(dir, 'SKILL.md');
-        if (!existsSync(skillPath)) {
-            mkdirSync(dir, { recursive: true });
-            writeFileSync(skillPath, STARTER_SKILL_TEMPLATES[skillName], 'utf-8');
-            created.push(skillName);
-        }
-    }
-    return created;
-}
 async function quickFetch(url, init) {
     return await fetch(url, { ...init, signal: AbortSignal.timeout(12000) });
 }

package/dist/tools/bash-tool.js

@@ -9,14 +9,24 @@ const SENSITIVE_ENV_PATTERNS = [
     /^ANTHROPIC_/i, /^OPENAI_/i, /^CLAUDE/i, /^CODEX_/i, /^MINIMAX_/i,
     /^KIMI_/i, /^TOGETHER_/i, /^GROQ_/i, /^OPENROUTER_/i,
 ];
+/** Env vars that match SENSITIVE_ENV_PATTERNS but should be kept (e.g. tool auth). */
+const SENSITIVE_ENV_ALLOWLIST = new Set(['GH_TOKEN']);
+/** Common tool paths that may be missing when launched as a service/daemon. */
+const EXTRA_PATH_DIRS = ['/opt/homebrew/bin', '/opt/homebrew/sbin', '/usr/local/bin'];
 /** Create a sanitized copy of process.env with secrets stripped. */
 function sanitizeEnv() {
     const env = { ...process.env };
     for (const key of Object.keys(env)) {
-        if (SENSITIVE_ENV_PATTERNS.some(p => p.test(key))) {
+        if (!SENSITIVE_ENV_ALLOWLIST.has(key) && SENSITIVE_ENV_PATTERNS.some(p => p.test(key))) {
             delete env[key];
         }
     }
+    // Ensure common tool directories are in PATH (daemon/service launches often have a minimal PATH)
+    const currentPath = env.PATH || '';
+    const missing = EXTRA_PATH_DIRS.filter(d => !currentPath.includes(d));
+    if (missing.length > 0) {
+        env.PATH = `${currentPath}:${missing.join(':')}`;
+    }
     return env;
 }
 export async function executeBash(command, cwd, config, context) {

package/dist/tools/definitions.d.ts

@@ -154,6 +154,35 @@ export declare const BROWSER_TOOL_DEFINITION: {
         required: string[];
     };
 };
+export declare const FETCH_TOOL_DEFINITION: {
+    name: string;
+    description: string;
+    input_schema: {
+        type: "object";
+        properties: {
+            url: {
+                type: string;
+                description: string;
+            };
+            method: {
+                type: string;
+                description: string;
+            };
+            headers: {
+                type: "object";
+                description: string;
+                additionalProperties: {
+                    type: string;
+                };
+            };
+            body: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
 export declare const TOOL_DEFINITIONS: ({
     name: string;
     description: string;
@@ -304,6 +333,34 @@ export declare const TOOL_DEFINITIONS: ({
         };
         required: string[];
     };
+} | {
+    name: string;
+    description: string;
+    input_schema: {
+        type: "object";
+        properties: {
+            url: {
+                type: string;
+                description: string;
+            };
+            method: {
+                type: string;
+                description: string;
+            };
+            headers: {
+                type: "object";
+                description: string;
+                additionalProperties: {
+                    type: string;
+                };
+            };
+            body: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
 })[];
 export declare const CODE_WITH_AGENT_TOOL: {
     name: string;

package/dist/tools/definitions.js

@@ -110,8 +110,26 @@ export const BROWSER_TOOL_DEFINITION = {
         required: ['action'],
     },
 };
+export const FETCH_TOOL_DEFINITION = {
+    name: 'Fetch',
+    description: 'Make an HTTP request and return the response. HTML is auto-converted to plain text. Use for APIs, web search (e.g. https://duckduckgo.com/html/?q=your+query), or fetching page content. Prefer over Browser for simple requests.',
+    input_schema: {
+        type: 'object',
+        properties: {
+            url: { type: 'string', description: 'URL to fetch' },
+            method: { type: 'string', description: 'HTTP method (GET, POST, PUT, DELETE, PATCH). Default: GET' },
+            headers: {
+                type: 'object',
+                description: 'Request headers (e.g. {"Authorization": "Bearer ..."})',
+                additionalProperties: { type: 'string' },
+            },
+            body: { type: 'string', description: 'Request body (for POST/PUT/PATCH)' },
+        },
+        required: ['url'],
+    },
+};
 // Legacy export for backward compat — static list (built-ins + browser + no MCP)
-export const TOOL_DEFINITIONS = [...BUILTIN_TOOL_DEFINITIONS, BROWSER_TOOL_DEFINITION];
+export const TOOL_DEFINITIONS = [...BUILTIN_TOOL_DEFINITIONS, BROWSER_TOOL_DEFINITION, FETCH_TOOL_DEFINITION];
 export const CODE_WITH_AGENT_TOOL = {
     name: 'code_with_agent',
     description: 'Delegate a coding task to a coding agent CLI (Claude Code or Codex). The agent will edit files, run commands, and return results. Always use this for code changes instead of writing code directly.',

package/dist/tools/fetch-tool.d.ts

@@ -0,0 +1,8 @@
+import type { ToolConfig } from '../types.js';
+export interface FetchInput {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}
+export declare function executeFetch(input: FetchInput, _config: ToolConfig): Promise<string>;