blamcode 0.4.0__py3-none-any.whl

blamcode/layer/scripts/patch-brand.py

@@ -0,0 +1,267 @@
+#!/usr/bin/env python3
+"""BLAMCODE brand patcher for the opencode binary.
+
+Replaces user-visible "OpenCode" strings with "BLAMCODE" using exact byte
+matches (same length, auto-padded with trailing spaces), so no offsets
+are needed and missing strings are skipped per version. Functional
+bytes (API keys, header names, protocol fields, system prompts) are
+never touched.
+
+Pixel-art rows use fit(): the replacement decodes to the same character
+count (row width used by the layout code) and occupies the same byte
+count (binary layout stays intact).
+
+Usage:
+  patch-brand.py <input.bin> <output.bin>          -- brand (OpenCode -> BLAMCODE)
+  patch-brand.py <input.bin> <output.bin> --blank-logo  -- erase pixel-art
+    logo rows (all-space rows, same width/bytes, layout unchanged)
+  patch-brand.py <input.bin> <any> --verify   -- exit 0 when a known logo
+    state (raw art / current design / any previously-shipped design) is
+    in the binary
+"""
+
+import sys
+
+# pixel-art wordmark rows (escaped JS strings from the home screen art)
+# -> design rows (decoded unicode). fit() re-encodes to exact length.
+# Each entry: (raw "OPENCODE" bytes, [every previously-shipped BLAMCODE design
+# for this row, oldest first], current design). Any legacy state found in
+# the binary upgrades straight to the current design in one pass, so cores
+# branded by ANY older BLAMCODE release converge — no more half-patched mixes.
+LOGO = [
+    (b"\\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2584 \\u2580\\u2580\\u2580 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588",
+     ['█▀▀█ █  █ █  █ █▀▀█',
+     '█▀▀▀▀▀▀▀ █      █ █      █ █▀▀▀▀▀▀█',
+     '█▀▀▀▀▀▀█ █      █ █      █ █▀▀▀▀▀▀█',
+     '▀▀▀▀▀██▀ ▀█▄  ▄█▀ ██    ██ ▄█▀▀▀▀█▄'],
+     '█▀▀▄ █    ▄▀▀▄ █▄▄█ ▄███ ▄██▄ █▀▀▄ █▀▀'),
+    (b"\\u2588  \\u2588 \\u2588  \\u2588 \\u2588\\u2580\\u2580\\u2580 \\u2588  \\u2588 \\u2588    \\u2588  \\u2588 \\u2588  \\u2588 \\u2588\\u2580\\u2580\\u2580",
+     ['  ▄▀ █▀▀█  ▀▀  █  █',
+     '    ▀▀▀▀ █▀▀▀▀▀▀█  ▀    ▀  █      █',
+     '  ▀▀▀▀    ▀▄  ▄▀   ▀▄  ▄▀  █      █',
+     '   ▄█▀     ▀██▀    ▀▄  ▄▀  ██    ██'],
+     '█▄▄▀ █    █__█ █  █ █    █  █ █  █ █▄▄ '),
+    (b"\\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580  \\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580",
+     ['▀▀▀▀   █    ▀  ▀▀▀▀',
+     '▀▀▀▀▀▀▀▀    █       ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀',
+     '▀▀▀▀▀▀▀▀    ██      ▀▀▀▀   ▀▀▀▀▀▀▀▀',
+     '▄▄██▄▄▄▄    ██       ▀▀    ▀█▄▄▄▄█▀'],
+     '█▄▄▀ █▄▄▄ █  █ █  █ █▄▄▄ █▄▄█ █▄▄▀ █▄▄▄'),
+]
+
+# two-tone home-screen logo: left half (dim) "OPEN" -> "ZY",
+# right half (bright) "CODE" -> "VO" (double-wide, fills the halves).
+# Same legacy-list structure as LOGO: any shipped generation upgrades.
+LOGO_TN = [
+    (b"\\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2584",
+     ['█▀▀█ █  █ █  █',
+     '█▀▀▀▀▀▀▀ █      █',
+     '█▀▀▀▀▀▀█ █      █',
+     '▀▀▀▀▀██▀ ▀█▄  ▄█▀'],
+     '█▀▀▄ █    ▄▀▀▄ █▄▄█'),
+    (b"\\u2588__\\u2588 \\u2588__\\u2588 \\u2588^^^ \\u2588__\\u2588",
+     ['  ^▀ █^^█  ^▀ ',
+     '    ▀▀▀▀ █^    ^█',
+     '  ▀▀▀▀    ▀    ▀ ',
+     '   ▄█▀    ▀██▀  '],
+     '█__ █    █__█ █  █'),
+    (b"\\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580~~\\u2580",
+     ['▀▀▀▀   █    ▀ ',
+     '▀▀▀▀▀▀▀▀    █    ',
+     '▀▀▀▀▀▀▀▀    ██   ',
+     '▄▄██▄▄▄▄    ██   '],
+     '█▄▄▀ █▄▄▄ █  █ █  '),
+    (b"\\u2588\\u2580\\u2580\\u2580 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588 \\u2588\\u2580\\u2580\\u2588",
+     ['█▀▀█',
+     '█      █ █▀▀▀▀▀▀█',
+     '██    ██ ▄█▀▀▀▀█▄'],
+     '▄███ ▄██▄ █▀▀▄ █▀▀▀'),
+    (b"\\u2588___ \\u2588__\\u2588 \\u2588__\\u2588 \\u2588^^^",
+     ['█  █',
+     ' ▀    ▀  █      █',
+     ' ▀▄  ▄▀  █      █',
+     ' ▀▄  ▄▀  █      █'],
+     '█    █  █ █  █ █__'),
+    (b"\\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580 \\u2580\\u2580\\u2580\\u2580",
+     ['▀▀▀▀',
+     '  ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀',
+     '  ▀▀▀▀  ▀▀▀▀▀▀▀▀',
+     '   ▀▀    ▀█▄▄▄▄█▀'],
+     '█▄▄▄ █▄▄█ █▄▄▀ █▄▄▄'),
+]
+
+# (exact bytes to find, replacement "BLAMCODE" text) — replace ALL occurrences.
+# New text is auto-padded with spaces to the old length (ASCII only).
+PATCHES = [
+    # core screens
+    (b'setTerminalTitle("OpenCode")',     b'setTerminalTitle("BLAMCODE")'),
+    (b'A(n,p,1,"OpenCode",a,void 0,O.BOLD)', b'A(n,p,1,"BLAMCODE",a,void 0,O.BOLD)'),
+    (b'agentInfo:{name:"OpenCode"',        b'agentInfo:{name:"BLAMCODE"'),
+    (b'<title>OpenCode</title>',           b'<title>BLAMCODE</title>'),
+    # ask / permission texts
+    (b'Tell OpenCode what to do differently',
+     b'Tell BLAMCODE what to do differently'),
+    (b'until OpenCode is restarted.',      b'until BLAMCODE is restarted.'),
+    (b'will allow the following patterns until OpenCode is restarted',
+     b'will allow the following patterns until BLAMCODE is restarted'),
+    (b'This will allow the following patterns until OpenCode is restarted',
+     b'This will allow the following patterns until BLAMCODE is restarted'),
+    (b'OpenCode service failure',          b'BLAMCODE service failure'),
+    (b'Request is not supported by this version of OpenCode Server (Server responded with text/html)',
+     b'Request is not supported by this version of BLAMCODE Server (Server responded with text/html)'),
+    # provider / model labels
+    (b'name:"OpenCode Zen"',               b'name:"BLAMCODE Zen"'),
+    (b'name:"OpenCode Go"',                b'name:"BLAMCODE Go"'),
+    (b'name:"OpenCode Default"',           b'name:"BLAMCODE Default"'),
+    (b'label:"OpenCode Login"',            b'label:"BLAMCODE Login"'),
+    # upgrade / connect dialogs
+    (b' and enable OpenCode Go',           b' and enable BLAMCODE Go'),
+    (b'OpenCode Zen gives you access to all the best coding models at the cheapest prices with a single API key.',
+     b'BLAMCODE Zen gives you access to all the best coding models at the cheapest prices with a single API key.'),
+    (b'OpenCode Go is a $10 per month subscription that provides reliable access to popular open coding models with generous usage limits.',
+     b'BLAMCODE Go is a $10 per month subscription that provides reliable access to popular open coding models with generous usage limits.'),
+    (b'Subscribe to OpenCode Go for reliable access to the best open-source models, starting at $5/month.',
+     b'Subscribe to BLAMCODE Go for reliable access to the best open-source models, starting at $5/month.'),
+    # tips / menus
+    (b'Use {highlight}/connect{/highlight} with OpenCode Zen for curated, tested models',
+     b'Use {highlight}/connect{/highlight} with BLAMCODE Zen for curated, tested models'),
+    (b'Run {highlight}opencode serve{/highlight} for headless API access to OpenCode',
+     b'Run {highlight}opencode serve{/highlight} for headless API access to BLAMCODE'),
+    (b'Create a plugin to prevent OpenCode from reading sensitive files',
+     b'Create a plugin to prevent BLAMCODE from reading sensitive files'),
+    (b'Uninstall OpenCode',                b'Uninstall BLAMCODE'),
+    (b'description:"close OpenCode"',      b'description:"close BLAMCODE"'),
+    (b'Thank you for using OpenCode!',     b'Thank you for using BLAMCODE!'),
+    (b'Successfully updated to OpenCode v',
+     b'Successfully updated to BLAMCODE v'),
+    # TUI session list "Continue" hint:  opencode -s <id> -> blamcode -s <id>
+    (b'opencode -s ${U.sessionID}',        b'blamcode -s ${U.sessionID}'),
+]
+
+
+def fit(old: bytes, design: str) -> bytes:
+    """Length-safe replacement for an escaped pixel-art row.
+
+    Old bytes are an escaped JS string. Returns a replacement that
+    (a) decodes to the same number of characters (row width used by the
+    layout code) and (b) occupies the same number of bytes (the rest of
+    the binary stays byte-aligned). Non-ASCII glyphs must be escaped;
+    extra escape slots are filled with escaped spaces.
+    """
+    esc = old.count(b"\\u")
+    dec = esc + (len(old) - esc * 6)
+    g = (len(old) - dec) // 5  # #escapes if the tail is all 1-byte chars
+    l = dec - g
+    assert g * 6 + l == len(old), (len(old), dec, g, l)
+    assert len(design) <= dec, (design, dec)
+    chars = list(design) + [" "] * (dec - len(design))
+    need = [i for i, c in enumerate(chars) if ord(c) > 0x7F]
+    assert len(need) <= g, (design, g, need)
+    esc_idx = set(need)
+    for i, c in enumerate(chars):
+        if len(esc_idx) >= g:
+            break
+        if c == " " and i not in esc_idx:
+            esc_idx.add(i)
+    assert len(esc_idx) == g, (design, g, esc_idx)
+    out = "".join("\\u%04x" % ord(chars[i]) if i in esc_idx else chars[i]
+                  for i in range(len(chars)))
+    out = out.encode()
+    assert len(out) == len(old), (design, len(out), len(old))
+    return out
+
+
+def load(path):
+    with open(path, "rb") as f:
+        return bytearray(f.read())
+
+
+def main():
+    if len(sys.argv) not in (3, 4) or (len(sys.argv) == 4 and sys.argv[3] not in ("--blank-logo", "--verify")):
+        print(__doc__)
+        sys.exit(1)
+    buf = load(sys.argv[1])
+    total = 0
+    if len(sys.argv) == 4 and sys.argv[3] == "--verify":
+        # exit 0 = a known logo state is present (raw OPENCODE art, the
+        # current design or ANY previously-shipped design); exit 3 = none
+        # of them (e.g. an old release blanked the art beyond repair —
+        # the caller should re-download a fresh core and re-brand).
+        for old, legacy, new in LOGO + LOGO_TN:
+            if (old in buf or fit(old, new) in buf
+                    or any(fit(old, d) in buf for d in legacy)):
+                print("logo state: ok")
+                return
+        print("logo state: missing (blanked or unknown core build)")
+        sys.exit(3)
+    if len(sys.argv) == 4 and sys.argv[3] == "--blank-logo":
+        # Erase the pixel-art logo: replace every art row (as currently
+        # patched, any legacy form, or the raw unpatched form) with an
+        # all-space row of the same decoded width and byte length.
+        # Layout stays intact.
+        for old, legacy, new in LOGO + LOGO_TN:
+            for src in [old, fit(old, new)] + [fit(old, d) for d in legacy]:
+                if src not in buf:
+                    continue
+                n = buf.count(src)
+                buf = buf.replace(src, fit(src, ""))
+                total += n
+                print(f"BLANK x{n}  {src[:44]!r}")
+        # accent/top strips of the home + help logo (p.right / O arrays)
+        for row in (b"             \\u2584     ",
+                    b"\\u2800                                \\u2584     "):
+            if row not in buf:
+                print(f"SKIP row {row[:30]!r}")
+                continue
+            n = buf.count(row)
+            buf = buf.replace(row, fit(row, ""))
+            total += n
+            print(f"BLANK x{n}  {row[:30]!r}")
+        # 4-glyph-shape sequences (p/t left/right arrays, bright "O" etc).
+        # NOTE: do NOT touch the "_"/"^" rows of the logo font
+        # ("\\u2588__\\u2588" / "\\u2588_^\\u2588"): editing those two
+        # strings makes the standalone binary fall back to plain Bun CLI.
+        sp = b"\\u0020"
+        for g in (b"\\u2800",
+                  b"\\u2588\\u2580\\u2580\\u2580",
+                  b"\\u2588\\u2580\\u2580\\u2588",
+                  b"\\u2580\\u2580\\u2580\\u2580"):
+            if g not in buf:
+                print(f"SKIP glyph {g!r}")
+                continue
+            n = buf.count(g)
+            buf = buf.replace(g, sp * (len(g) // 6))
+            total += n
+            print(f"BLANK-G x{n} {g!r}")
+        with open(sys.argv[2], "wb") as f:
+            f.write(buf)
+        print(f"blanked {total} logo rows -> {sys.argv[2]}")
+        return
+    for old, legacy, new in LOGO + LOGO_TN:
+        new = fit(old, new)
+        for src in [old] + [fit(old, d) for d in legacy]:
+            if src not in buf:
+                print(f"SKIP {src[:52]!r}")
+                continue
+            n = buf.count(src)
+            buf = buf.replace(src, new)
+            total += n
+            print(f"OK x{n}  {src[:52]!r}")
+    for old, new in PATCHES:
+        if len(new) < len(old):
+            new = new + b" " * (len(old) - len(new))
+        assert len(old) == len(new), (old, len(old), len(new))
+        if old not in buf:
+            print(f"SKIP {old[:52]!r}")
+            continue
+        n = buf.count(old)
+        buf = buf.replace(old, new)
+        total += n
+        print(f"OK x{n}  {old[:52]!r}")
+    with open(sys.argv[2], "wb") as f:
+        f.write(buf)
+    print(f"patched {total} occurrences -> {sys.argv[2]}")
+
+
+if __name__ == "__main__":
+    main()

blamcode/layer/skills/android-app/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: android-app
+description: Basic Android app development from Termux — HTML/JS hybrid apps, webviews, APK building. Use when user wants to make an Android app or turn a website into an app.
+---
+
+# Android App Skill (Termux-friendly)
+
+## Honest path first (choose the right level)
+- **Fastest / best on phone:** an HTML/JS "hybrid" app packaged as APK — uses the device
+  browser engine, works offline, installs like a normal app
+- **Real native (Kotlin):** needs Android Studio — too heavy for a phone; recommend a PC
+- **Full-power web app:** a mobile-first PWA — installable from the browser, no APK at all
+
+## Path A — Website → APK (best for Termux users)
+Tools that work from the phone: **PWA Builder / PWABuilder** (website) or
+**Bubblewrap CLI** (needs Node). Simplest reliable flow:
+1. Build the site (mobile-first, offline-friendly — see website-builder skill)
+2. Add a web manifest (`manifest.json`: name, icons, `display: standalone`)
+3. Add a service worker so it works offline
+4. Package with PWABuilder (web) or `npm i -g @bubblewrap/cli` on a PC
+5. Install the APK/AAB on the phone
+
+PWA alone (no APK) already gives: home-screen icon, fullscreen, offline — good enough for most.
+
+## Path B — Fully offline single-file APK (simple kiosk app)
+```html
+<!-- app.html — everything in one file: CSS + JS inline -->
+<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>My App</title>
+<style>body{font-family:sans-serif;max-width:600px;margin:auto;padding:16px}</style>
+</head>
+<body>
+  <h1>Hello from my phone-built app!</h1>
+  <button onclick="alert('Works offline!')">Tap me</button>
+</body>
+</html>
+```
+Serve it locally for testing: `blamcode preview` (starts a server and opens the browser).
+
+## Rules
+- **Test on the real phone** — emulator is not available on Termux; use `blamcode preview`
+- Keep it **offline-first** — phone users have flaky networks
+- **Touch targets 44px+**, font 16px+ (see ui-ux-responsive skill)
+- Icons: provide 192px + 512px PNGs (required for manifest)
+- Don't promise Google Play publishing — it needs a $25 account + review; side-loading (APK) is fine for personal use
+- Never embed real API keys in the app if it will be shared — the APK can be unpacked
+
+## Deliver
+- The project folder + how to open/test it (`blamcode preview`)
+- If an APK was produced: the file path + “Install from unknown sources is needed” note
+- One line on how to publish later if the user insists (Play Console = PC + $25)

blamcode/layer/skills/api-integration/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: api-integration
+description: Work with APIs — fetch data, connect third-party services, live data for weather/payment/news sites. Use when user wants live data, API calls, or information from the internet.
+---
+
+# API Integration Skill
+
+## Rules (strict)
+- **Never hardcode API keys in code** — keep them in a `.env` file,
+  provide an `.env.example` template, and gitignore `.env`
+- A sensitive key in frontend code is PUBLIC — everyone can see it.
+  For paid/secret keys, say it: a backend/serverless layer is needed
+- Check free APIs first (websearch) — current status, rate limits
+
+## Fetch pattern (vanilla JS — modern)
+```js
+async function loadData() {
+  try {
+    const res = await fetch('https://api.example.com/data');
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const data = await res.json();
+    render(data);
+  } catch (err) {
+    showMsg('There was a problem loading the data — check your internet'); // user-facing
+    console.error(err); // for debugging
+  }
+}
+```
+- Loading state is MANDATORY (spinner/skeleton) — a blank screen stops beginner users
+- Human error messages — not "404" for a beginner, but "Data could not be loaded"
+
+## CORS (common blocker)
+- Direct browser call fails + CORS error in console → the API does not allow
+  the browser. Solutions: (1) the API's official CORS-enabled endpoint,
+  (2) your own server proxy, (3) a different API
+- Public sites with API keys: use AllOrigins/corsproxy-type public proxies
+  (free, but NEVER with sensitive keys)
+
+## Useful free APIs
+- Weather: Open-Meteo (no key needed, uses lat/lon)
+- Prayer times: Aladhan API (by city)
+- Currency rates: exchangerate / frankfurter
+- News/search: whatever service the user has — read its docs first
+
+## Workflow
+1. Read the API docs (webfetch) — endpoint, params, auth, rate limit
+2. Small test: one call, look at the response structure
+3. Bind data in the UI + loading + error + empty states
+4. Respect rate limits — cache every call (localStorage with expiry)

blamcode/layer/skills/bash-cli-expert/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: bash-cli-expert
+description: Safe, clean, efficient bash/CLI — Termux/Linux commands, pipes, quoting, one-liners. Use whenever running or writing any shell command or script.
+---
+
+# Bash / CLI Expert Skill (Full-Power)
+
+## Termux reality (it runs on the user's phone)
+- Paths: `/storage/emulated/0/` = shared storage (FUSE — slow, case-sensitivity
+  depends on the backend), `$HOME` = fast private storage
+- Heavy IO on shared storage is bad — copy to $HOME, work, copy back when done
+- `pkg install <x>` = apt wrapper; `termux-open <file>` opens a file in its default app
+- On Android 11+ the `/sdcard` symlink also works; otherwise use `/storage/emulated/0`
+
+## Safety gates (always — the AI guards itself because of auto-approve)
+- Read-only first: `ls`, `file`, `grep -n`, `find ... -maxdepth 2`
+- `rm -rf` — exact absolute path, stop on empty variables (`set -u`); never target
+  `/` or `$HOME`
+- `curl | sh` — only if the user explicitly asked
+- `mv` will overwrite — check `[ -f dest ]` first
+- If destructive, say what you will do first, then do it
+
+## Command hygiene
+- One command does one thing; chain with `&&` only when the next step depends on the previous
+- In scripts: `set -eu` + `trap 'rm -f "$TMP"' EXIT` for temp files
+- After `curl`/`git`/`pkg install`: check exit — `cmd || { echo fail; exit 1; }`
+- Long tasks: `timeout 60 cmd` — hang protection
+- JSON edits: `python3 - <<'PY'` heredoc — no fragile sed/awk regex
+- Search: `rg` (fast, git-aware) — better than recursive grep
+
+## Patterns (power one-liners)
+```sh
+# folder size ranking
+du -sh */ | sort -h
+# batch rename (safe preview first)
+for f in *.JPG; do mv "$f" "${f%.JPG}.jpg"; done
+# find + action, space-safe
+find . -name "*.log" -print0 | xargs -0 rm
+# quick server
+python3 -m http.server 8080
+# extract any format
+tar -xf x.tar.gz / unzip -q x.zip
+```
+
+## Verification
+- After changes: run again or check `$?`
+- Config edits: `cp x x.bak` first, then `diff x.bak x`
+- When delivering a script: test-run it once, then give the user the usage line

blamcode/layer/skills/bot-development/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: bot-development
+description: Build bots — Telegram, WhatsApp, Discord — messaging, commands, automation, buttons. Use when user wants to create a bot or automate something via chat.
+---
+
+# Bot Development Skill
+
+## Telegram bot (easiest — free, works great on Termux)
+1. Talk to [@BotFather](https://t.me/BotFather) → `/newbot` → get the token
+2. Store the token in `.env` — NEVER commit it
+3. Python with `python-telegram-bot` (modern version 20+/21+):
+
+```python
+import os
+from dotenv import load_dotenv
+from telegram import Update
+from telegram.ext import Application, CommandHandler, ContextTypes
+
+load_dotenv()
+TOKEN = os.getenv("BOT_TOKEN")
+
+async def start(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    await update.message.reply_text("Hello! I am your bot. /help for commands.")
+
+app = Application.builder().token(TOKEN).build()
+app.add_handler(CommandHandler("start", start))
+app.run_polling()  # stays running — keep the phone awake
+```
+
+## WhatsApp (two paths)
+- **Beginner path:** no code — use a service (WhatsApp Business API via Meta Cloud API, or a provider like Twilio) — costs/setup involved
+- **Automation path (advanced):** a headless browser driver (e.g. playwright) is fragile and against WhatsApp ToS — advise against it; prefer official APIs
+- For chat widgets on websites: wa.me links work everywhere — `https://wa.me/<number>?text=...`
+
+## Bot design rules
+- **Start with 3 commands**: `/start`, `/help`, one real feature. That's enough
+- Async/event-driven — never blocking loops in webhook mode
+- **Rate limits**: Telegram allows ~30 msg/sec; add small sleeps for long broadcasts
+- Inline keyboards (`InlineKeyboardButton`) beat typing for choices — mobile-friendly
+- Long tasks: reply "processing…" first, then edit the message when done
+- Log errors to a file; add a `/admin` (owner-only) status command
+
+## Running 24/7 on Termux
+- `termux-wake-lock` prevents the CPU from sleeping
+- `pkg install termux-services` + `sv-enable` keeps it alive across app restarts
+- For real 24/7: a free bot host (Railway/Render free tiers) or user's own VPS
+- Simple alternative: a `while True` + `time.sleep` loop with `python3 bot.py` in tmux
+
+## Security
+- Token in `.env`, gitignored
+- Never log incoming messages that contain secrets
+- Validate/escape user input before storing or echoing
+- Webhook URL: use a secret path (`/webhook/<token>`) — public bots get scanned instantly

blamcode/layer/skills/clean-code-performance/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: clean-code-performance
+description: Make code clean, readable, maintainable + fast. Use when writing or refactoring any code in any language.
+---
+
+# Clean Code + Performance Skill (Full-Power)
+
+## Clean code — non-negotiable
+- Names say what they do: `fetchUserData()` good, `proc2()` bad
+- One function does one thing; split it when it passes 30-40 lines
+- DRY — if you copy-paste a third time, make a function
+- Nesting beyond 3 levels = add early returns
+- Comments: write WHY, not WHAT (the code already shows what)
+- Before delivering: remove unused code, console.log/debug prints, dead flags
+- Consistent style: follow the existing code — not your own preference
+
+## Error handling — critical for beginner users
+- Every external operation (fetch, file, db) = try/catch + user-facing message
+- Not just "Something went wrong" — what broke + what to do about it
+- Handle empty states: no crash when data is missing, friendly message instead
+- Technical errors in console (debug), human messages on screen
+
+## Performance — for phone users (in real impact order)
+1. **Network**: loading state on every request; debounce search input (300ms);
+   cache (memory/localStorage + expiry); parallel where possible (`Promise.all`)
+2. **Bundle**: no framework for small sites (vanilla is enough); code-split big apps;
+   remove unused dependencies
+3. **Render**: `key` on list items; memo only on measured slow components; event
+   delegation on dynamic lists
+4. **Media**: `loading="lazy"`, set width/height, webp; hero image eager instead of lazy
+5. **Compute**: no DOM read/write mix inside loops (batch it);
+   for large data use a map instead of O(n²) nested loops
+
+## Refactor method
+1. Test/run first and note the current behavior
+2. Refactor in small steps (rename → extract function → move) — one at a time
+3. Run again after every step — breaks get caught immediately
+4. Never combine behavior changes with refactoring
+
+## Checklist (before delivering)
+- [ ] All function names self-explanatory
+- [ ] Error + empty + loading states present
+- [ ] Unused code/prints removed
+- [ ] No obvious perf issues (N+1, heavy work on every render)
+- [ ] Ran/tested at least once

blamcode/layer/skills/database/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: database
+description: Work with databases — SQLite, MySQL, PostgreSQL — design, query, connect from apps, CRUD. Use when user wants to store data, build a database, or connect an app to a database.
+---
+
+# Database Skill
+
+## Choose the right one (based on the user's scenario)
+- **SQLite** — best for Termux/phone apps and small projects (single file, zero setup)
+- **MySQL** — classic web backend (shared hosting, PHP, Laravel)
+- **PostgreSQL** — modern, powerful, best for real production apps
+- No database server needed for simple scripts? Use JSON files or SQLite — keep it light
+
+## SQLite (Termux-friendly — recommended for phone projects)
+```sh
+pkg install sqlite
+sqlite3 app.db          # open the database interactively
+```
+```sql
+-- create + insert + query
+CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, email TEXT UNIQUE);
+INSERT INTO users (name, email) VALUES ('Rahim', 'rahim@example.com');
+SELECT * FROM users WHERE name LIKE 'Ra%';
+```
+
+## Connecting from Python (stdlib — no pip needed for SQLite)
+```python
+import sqlite3
+conn = sqlite3.connect("app.db")          # file is created if missing
+conn.execute("CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, name TEXT)")
+conn.execute("INSERT INTO users (name) VALUES (?)", ("Karim",))   # NEVER f-strings
+conn.commit()
+for row in conn.execute("SELECT * FROM users"):
+    print(row)
+```
+
+## Rules (strict)
+- **Parameterized queries ALWAYS** — `?` placeholders (SQLite) or `%s` (MySQL/PG).
+  Never build SQL by string concatenation — that is SQL injection
+- **Backup before destructive changes**: `sqlite3 app.db ".backup app.db.bak"` or `mysqldump`
+- **Indexes** on columns used in WHERE/JOIN once data grows
+- **Transactions** for multi-step writes: `BEGIN` ... `COMMIT` / `ROLLBACK`
+- Keep the DB file OUT of git — `.gitignore` it; seed data via a `schema.sql` + `seed.py`
+- MySQL/PG passwords: `.env` file, never hardcoded
+
+## Schema design (quick path)
+1. Start with a simple table + the ONE main query you need
+2. Normalize only when you see real duplication (don't over-engineer)
+3. Add `created_at` timestamps — always useful later
+4. Foreign keys ON — prevents orphan rows
+
+## Common Termux scene
+- User wants a data-collection app (inventory, attendance, notes) → SQLite + Python
+- Web app needs storage → MySQL (shared hosting) or SQLite (small/single-user)
+- User has an "app.db" that won't open → check it is a real SQLite file:
+  `file app.db` and `sqlite3 app.db ".tables"`

blamcode/layer/skills/debugging-fixes/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: debugging-fixes
+description: Systematic debugging — fix errors, solve crashes, find why something is not working. Use when user reports any problem, error, crash, or unexpected behavior.
+---
+
+# Debugging Skill (Full-Power)
+
+## Golden rule
+Read the ENTIRE error message. The real cause is usually in the last 3-5 lines of the error.
+Reading it for 10 seconds beats guessing a fix.
+
+## Systematic method (in order — no skipping)
+1. **REPRODUCE** — check whether the error happens again (run it)
+2. **READ** — read the whole error + stack trace. Which file, which line? Mark `file:line`
+3. **ISOLATE** — make a small test case or read the related file (read tool).
+   Do not touch anything until you have narrowed down the problem zone
+4. **ROOT CAUSE** — fix the cause, not the symptom. "Deleting this makes the error go
+   away" means the deletion is hiding the problem, not fixing it
+5. **FIX** — small, targeted change. No full-file rewrites. Surgical edit,
+   `cp x x.bak` backup first if it feels risky
+6. **VERIFY** — run again. If it works, regression check: make sure previously
+   working features did not break
+7. **EXPLAIN** — tell the user in 2-3 lines: what was broken, what was fixed,
+   and the exact command if a restart/reinstall is needed
+
+## Tool tricks
+- `sh -n script.sh` — shell syntax check, `node --check f.js`, `python3 -m py_compile f.py`
+- No logs? Add `console.log` / `print` to isolate — remove them after the fix
+- Web: ask the user to copy the browser console errors
+- Dependency errors: version mismatch is common — check `npm ls`, the lock file, changelogs
+
+## Common quick wins
+- `command not found` → package missing / not on PATH
+- Node `ERR_MODULE_NOT_FOUND` → missing `.js` extension on relative import / wrong path
+- Python `ModuleNotFoundError` → `pip install <mod>`
+- Blank/not working website → file paths are **case-sensitive** (Linux!), hard-refresh the cache
+- Port in use → different port or `kill $(lsof -t -i:PORT)`
+- CORS error → the API side needs CORS, or use a same-origin proxy
+- Termux build tool fails → glibc dependency — use proot Ubuntu or an alternative package
+
+## If stuck (after 2 attempts)
+- Websearch the exact error string
+- Check version migration notes — APIs change between upgrades
+- Step back: make it smaller — start from a minimum working example and add features gradually
+- Ask the user 3 things: what they were trying to do / what they expected / what actually happens

blamcode/layer/skills/deploy-hosting/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: deploy-hosting
+description: Put a website live — free hosting (GitHub Pages, Netlify, Vercel), domains, deploys. Use when user says "make it live", "deploy", "go online", "upload the website", or wants a public link.
+---
+
+# Deploy & Hosting Skill
+
+## Choose a path (based on the user's scenario)
+
+### 1. Netlify Drop (EASIEST — for static sites, no account needed)
+- Drag-and-drop the site folder at https://app.netlify.com/drop
+- Instant live link (.netlify.app)
+- Works on a phone too — straight from the browser
+- Tell the user: zip the folder and drop it, or select the files
+
+### 2. GitHub Pages (free, permanent, if you know git)
+- Create a repo → push the site files → Settings → Pages → select branch
+- Link: `username.github.io/repo-name`
+- On Termux: `git init`, push — see the git-workflow skill in blamcode
+- If 404: use relative paths (`./style.css`, `/repo-name/` base tag)
+
+### 3. Vercel (best for React/Next.js apps)
+- `npm i -g vercel` → run `vercel` → link account → deploy
+- Preview + production automatic — every push updates it
+
+### 4. Direct from Termux (local test)
+- `python3 -m http.server 8080` → open `localhost:8080` in the phone's browser
+
+## Rules
+- Verify BEFORE deploying: index.html at the root, relative paths, all assets local
+- Never push the user's personal keys/tokens to a repo or public site
+- On a free subdomain, say: a custom domain costs money but is not required
+- Custom domain wanted: .com ~BDT 1,000-1,500/year (Namecheap/Cloudflare), help with DNS setup
+
+## Deliver format
+- Give the live link
+- Say it can be shared — it works for everyone
+- One line on how to update (drop again / git push / vercel)