steipete/agent-scripts

# Agent Transcript

Use only when the user explicitly requests a transcript or preview. Omit by
default; never offer one or ask whether to include one during ordinary PR work.
A preview request alone does not authorize publication.

## Prepare Locally

The helper reads local Codex, Claude, Pi, and OpenClaw logs; no network is used
for discovery/rendering. Never upload raw logs.

```bash
skills/agent-transcript/scripts/agent-transcript find \
  --query "$PR_TITLE $BRANCH_OR_PR_URL" --cwd "$PWD" --since-days 14

# Beeper

Use this for local Beeper history questions, especially vague contact hints across iMessage/WhatsApp bridges.

## Source

- DB: `~/Library/Application Support/BeeperTexts/index.db`
- FTS: `mx_room_messages_fts`

Start by inspecting accounts/rooms before broad searching.

## Workflow

1. Identify likely account/bridge/room from `accounts`, `participants`, and room tables.

# Browser Use

Control the user's existing real Chrome profile, especially for login-dependent work and live UI verification.

## Route

1. Use the Codex `Chrome` or `Chrome [Internal]` plugin when it is callable in
   the active session. Installed on disk is not enough.
2. Otherwise prefer the OpenClaw extension-backed mcporter route.
3. Use legacy direct DevTools attachment only as the explicit last fallback.

For mcporter, the MCP call remains the agent-facing control interface. The
OpenClaw extension is the transport underneath it, not a separate tool. Set
`chromeDevtoolsRelay: "require"` on the canonical global Chrome server definition

# ClawSweeper Status

## Quick Start

Run the bundled status script first:

```bash
/Users/steipete/Projects/agent-scripts/skills/clawsweeper-status/scripts/clawsweeper-status.sh
```

Useful options:

```bash
# Last 10 hours for the default target repo, openclaw/openclaw

# ClickClack

Use this for ClickClack product/runtime ops, deploys, hosted app checks, and domain questions.

## What

- Repo: `~/Projects/clickclack` / `https://github.com/openclaw/clickclack`
- Product: self-hostable Slack-style chat for OpenClaw/community/agent workflows.
- Surfaces:
  - `https://clickclack.chat` product site (Cloudflare Worker custom domain)
  - `https://www.clickclack.chat` (Worker custom domain, same worker)
  - `https://app.clickclack.chat` hosted app (Worker custom domain)
  - `https://docs.clickclack.chat` GitHub Pages docs from `docs/`

# Cloudflare Registrar

Use for Cloudflare Registrar domain availability, pricing, listing, and registration.

## Defaults

- MCP: `cloudflare-openclaw`
- Account: `OPENCLAW_CLOUDFLARE_ACCOUNT_ID`
[Credential-related source omitted]
- Secrets: follow the root secret rule; export only needed Cloudflare vars for one command.

## Guardrails

- Always run `domain-check` immediately before registration.

# Codex Debugging

Use when investigating Codex CLI/app behavior, config parsing, tool behavior, prompts, MCP/app wiring, or runtime bugs.

## Source First

Prefer local source before web/docs:

```bash
cd ~/Projects/codex
sed -n '1,220p' codex-rs/AGENTS.md
```

Then search targeted areas:

# Codex First

## Launch flags — read first, copy verbatim

Default every Codex worker, **fresh or resumed**, to **GPT-6.1 Sol, high
reasoning, Fast service tier** (`service_tier="fast"`, sent as API `priority`;
Peter, 2026-10-30). Pass all three settings unless the user requests an override.

```bash
# fresh
codex exec --yolo -C "$WT" \
  -m gpt-6.1-sol -c 'model_reasoning_effort="high"' \
  --enable fast_mode -c 'service_tier="fast"' \
  -o "$OUT" - < "$ORDER"

# Codex Huge Context

Use this skill when configuring, repairing, or auditing Codex's one-million-token context setup. The intended topology is a direct API inference route that preserves the normal ChatGPT login for Gmail, Calendar, and other connector OAuth:

```text
Codex inference -> Keychain auth helper -> https://api.openai.com/v1/responses
Codex connectors -> normal ChatGPT login in auth.json
```

This is not an HTTP proxy. The API remains authoritative for access, actual model limits, and billing.

## Atomic provider and context invariant

Treat the provider selector, context window, compaction threshold, and custom model catalogue as one atomic configuration. In Peter's normal ChatGPT-authenticated setup, `model_provider = "openai"` selects the ChatGPT-backed route; never attach this skill's direct-API `922000` context window and `700000` compaction threshold to that route. The provider identifier alone does not determine transport: built-in `openai` with API-key authentication can also use the API. This skill and its preflight require the named `openai_api_direct` provider below so inference uses its dedicated Keychain helper while connector login stays separate.

# CodexBar

Use this when asked about AI subscription usage, rate limits, remaining credits, or "how much Codex/Claude/Kimi do I have left".

## CLI

- Binary: `codexbar` (Homebrew)
- Default invocation honors the in-app provider toggles:

```bash
codexbar usage
codexbar usage --format json
```

# Create CLI

Design CLI surface area (syntax + behavior), human-first, script-friendly.

## Do This First

- Read `agent-scripts/skills/create-cli/references/cli-guidelines.md` and apply it as the default rubric.
- Upstream/full guidelines: https://clig.dev/ (propose changes: https://github.com/cli-guidelines/cli-guidelines)
- Ask only the minimum clarifying questions needed to lock the interface.

## Clarify (fast)

Ask, then proceed with best-guess defaults if user is unsure:

# Discord Clawd

Use this when the task is to talk with the Discord-backed agent/session, ask it a question, or post through that route.

For Discord archive/history/search, use `$discrawl` instead.

## Transport

Use the OpenClaw relay helper:

```bash
cd ~/Projects/agent-scripts
python3 skills/openclaw-relay/scripts/openclaw_relay.py targets
python3 skills/openclaw-relay/scripts/openclaw_relay.py resolve --target maintainers

# Domain/DNS Ops (Peter)

This skill is a thin router: use `~/Projects/manager` as truth, run the repo scripts, follow the checklists.

## Source of truth (read first)

- `~/Projects/manager/DOMAINS.md` (domain -> target map; registrar hints; exclusions)
- `~/Projects/manager/DNS.md` (Cloudflare onboarding + DNS/redirect checklist)
- `~/Projects/manager/redirect-worker.ts` + `~/Projects/manager/redirect-worker-mapping.md` (worker redirects)

## Golden path (new vanity domain -> Cloudflare -> redirect)

1. **Decide routing model**
   - Page Rule redirect (small scale, per-zone).

# Fleet Maintenance

Maintain Peter's Macs while protecting ambiguous local work. Package updates are explicitly allowed during active sessions and may disrupt the software being upgraded. Use `$remote-mac` for inventory/SSH and `$xcode-sync` for all Xcode work.

## Desired state

- Read `~/Projects/manager/fleet/inventory.json` for desired software and local-account escrow references. Read `references/fleet-schema.md` before changing its schema or adopting packages.
- Keep exactly two profiles unless Peter explicitly changes the model:
  - `full`: daily-driver Macs with the complete development, communication, media, and agentic toolset.
  - `worker`: lean remote Macs that mainly run Codex, Claude, OpenClaw nodes, and supporting agent infrastructure.
- Treat profile policy as `minimum`: install required entries and report extras without removing them. Never silently turn observed software into desired state.
- Keep topology, SSH routing, and handed-off status in `~/Projects/manager/computers.yaml`. Do not duplicate live topology in this skill.
- Keep passwords, recovery keys, and private keys in 1Password. The inventory stores opaque item IDs only. Invoke `$one-password` before any `op` command; a `pending` reference is not an error during package maintenance.
- Require the classic OpenSSH mesh named by `ssh_mesh` on both profiles. The manager fleet setup document owns the canonical peer list and live proof. Use the symmetric Tailscale TCP 22 grant plus per-host `authorized_keys`; macOS GUI Tailscale clients cannot act as Tailscale SSH servers. Distribute public keys only, keep private keys host-local, verify both directions with `BatchMode=yes` and a finite timeout, and leave offline or provider-blocked directions pending.

This skill guides creation of distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics. Implement real working code with exceptional attention to aesthetic details and creative choices.

The user provides frontend requirements: a component, page, application, or interface to build. They may include context about the purpose, audience, or technical constraints.

## Design Thinking

Before coding, understand the context and commit to a BOLD aesthetic direction:
- **Purpose**: What problem does this interface solve? Who uses it?
- **Tone**: Pick an extreme: brutally minimal, maximalist chaos, retro-futuristic, organic/natural, luxury/refined, playful/toy-like, editorial/magazine, brutalist/raw, art deco/geometric, soft/pastel, industrial/utilitarian, etc. There are so many flavors to choose from. Use these for inspiration but design one that is true to the aesthetic direction.
- **Constraints**: Technical requirements (framework, performance, accessibility).
- **Differentiation**: What makes this UNFORGETTABLE? What's the one thing someone will remember?

**CRITICAL**: Choose a clear conceptual direction and execute it with precision. Bold maximalism and refined minimalism both work - the key is intentionality, not intensity.

# GitHub Author Context

Build a compact maintainer-facing profile for a PR author or GitHub user. Use this by default during PR review unless the author is Peter (`steipete`, `Peter Steinberger`, or an obvious Peter-owned bot/account).

## Inputs

Prefer a GitHub login. From a PR:

```bash
gh pr view <n> --json author,url,headRepository,baseRepository -q '{author:.author.login,url:.url,repo:.baseRepository.nameWithOwner}'
```

Skip the profile pass for `steipete` unless the user explicitly asks.

# GitHub Cache Hygiene

Goal: discover in the local Gitcrawl archive first, then use the existing Octopool-backed `gh` shim for current GitHub metadata and authorized writes.

## Default Path

Start with local archive reads:

```bash
gitcrawl search prs "<terms>" -R owner/repo --state open --json number,title,url
```

```bash
gitcrawl threads owner/repo --numbers 123 --include-closed --json

# GitHub Deep Review

Review like Peter: high-confidence, evidence-first, code-aware, and willing to say "not proven" when the trail is weak. The goal is not a generic summary. The goal is to understand the bug class, find the real cause if possible, decide the best fix after reading enough code, and call out whether a larger refactor would improve the design.

## Start

Use `gh`, not web browsing, for GitHub refs:

```bash
gh issue view <n> --json number,title,state,author,body,comments,labels,updatedAt,url
gh pr view <n> --json number,title,state,author,body,comments,reviews,files,commits,statusCheckRollup,mergeStateStatus,headRefName,headRepositoryOwner,url
gh pr diff <n> --patch
```

# GitHub Project Triage

Always use this skill when the user types `triage`, unless the request explicitly targets a non-GitHub domain. From inside a repo, use the current GitHub project by default. Triage means maintainer-facing item cards: URL, what each issue/PR is about, why it matters, author trust, fit, risk, proof/test state, blockers, and next action. Never return only queue numbers or opaque refs.

Output is URL-first: every surfaced issue/PR/repo item must include its GitHub URL in the first line or first sentence for that item. If giving a shortlist, print one URL per item.

Use RepoBar as the first pass only for broad queue discovery across relevant owners/orgs. RepoBar is faster and more profile-aware than hand-rolling `gh repo list` loops, and it already understands repo activity, issue counts, PR counts, local projects, auth, cache, and filters.

## Setup

Prefer a real `repobar` binary when installed. In this workspace it may only exist as a SwiftPM product in `~/Projects/RepoBar`.

```bash
repobar_cmd() {

# Hopper Debugger

Use Hopper through `mcporter` as a queryable disassembler, then combine the result with local source, LLDB, logs, and focused repros.

## Setup (one time)

Hopper 6.0+ **ships its own MCP server**. Do not install a third-party one.

```bash
mcporter config add hopper --scope home \
  --command "/Applications/Hopper Disassembler.app/Contents/MacOS/HopperMCPServer" \
  --description "Hopper Disassembler built-in MCP server (stdio)"
```

# Instruments Profiling (macOS/iOS)

Use this skill when the user wants performance profiling or stack analysis for native apps.
Focus: Time Profiler, `xctrace` CLI, and picking the correct binary/app instance.

## Quick Start (CLI)

- List templates: `xcrun xctrace list templates`
- Record Time Profiler (launch):
  - `xcrun xctrace record --template 'Time Profiler' --time-limit 60s --output /tmp/App.trace --launch -- /path/To/App.app`
- Record Time Profiler (attach):
  - Launch app yourself, get PID, then:
  - `xcrun xctrace record --template 'Time Profiler' --time-limit 60s --output /tmp/App.trace --attach <pid>`
- Open trace in Instruments:

# Mac Maintenance

Use when Peter asks for Mac cleanup, maintenance, or package/repo refresh.

## Run

1. Homebrew:

```bash
brew update && brew upgrade
```

2. Repos under `~/Projects`:

# Maintainer Orchestrator

Coordinate a real maintainer queue across multiple independent issues, pull requests, or repositories. This is a control-plane skill, not the default way to handle ordinary repository work.

## Activation Gate — Hard Rule

Classify the request before creating workers, heartbeats, ledgers, or queue scans.

### Direct single-item work

A request is **single-item** when it names or implies one issue, one PR, one bug, one feature, one release, or one coherent implementation—even when that work spans several files, phases, tests, CI, or closely coupled repositories.

For single-item work:

# Markdown Converter

Convert files to Markdown using `uvx --from "markitdown[all]" markitdown` — no installation required.

## Basic Usage

```bash
# Convert to stdout
uvx --from "markitdown[all]" markitdown input.pdf

# Save to file
uvx --from "markitdown[all]" markitdown input.pdf -o output.md
uvx --from "markitdown[all]" markitdown input.docx > output.md

# Nano Banana 2 Image Generation & Editing

Generate new images or edit existing ones using Google's Nano Banana 2 API (Gemini 3.1 Flash Image).

## Usage

Run the script using absolute path (do NOT cd to skill directory first):

**Generate new image:**
```bash
uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 512|1K|2K|4K] [--api-key KEY]
```

**Edit existing image:**

# Native App Performance (CLI-only)

Goal: record Time Profiler via `xctrace`, extract samples, symbolicate, and propose hotspots without opening Instruments.

## Quick start (CLI)

1) Record Time Profiler (attach):

```bash
# Start app yourself, then attach
xcrun xctrace record --template 'Time Profiler' --time-limit 90s --output /tmp/App.trace --attach <pid>
```

2) Record Time Profiler (launch):

# notcrawl

Use this for local Notion archive questions. Desktop reads local cache; API sync needs `NOTION_TOKEN` and page access.

## Sources

- DB: `~/.notcrawl/notcrawl.db`
- Pages: `~/.notcrawl/pages`
- CLI: `notcrawl`

## Refresh

```bash
notcrawl doctor

# npm

Use for npm registry/account tasks: `npm whoami`, package availability, package reservation, publish, org checks, and auth debugging.

## Auth

- Use `one-password` first for secret rules.
- Never run `op` directly in the shell tool.
- Primary item: `npm Registry - steipete - Release Automation` in `Molty`.
- Default to `OP_SERVICE_ACCOUNT_TOKEN`; no desktop unlock. The item carries the working registry session (`registry_token`) plus username/password/TOTP fallback.
- Desktop `npmjs` fallback is explicit only: pass `--account my.1password.com` when Molty is unavailable and the user wants the fallback. Explicit `release`/`publish` requests are consent for its unlock prompt.
- Stop and ask if the item is missing, the account/vault is ambiguous, credentials are malformed, npm denies package access, or the requested package/version does not match the repo release target.
- Run npm auth work inside one task window of the shared `op-work` tmux session (`clawdbot-op.sock`; see `one-password`). Reuse the window on failure; kill it when the npm task is done. Never mint an npm-specific socket or session.
- Keep npm auth in a temp npmrc; delete it after the command.

# Obsidian

Use this for local Obsidian vault work. An Obsidian vault is a normal folder of Markdown files plus `.obsidian/` config.

## Sources

- App config: `~/Library/Application Support/obsidian/obsidian.json`
- Default vault name: `obsidian`
- Usual local vault path: `~/obsidian`
- Official CLI: `obsidian`
- Vault commands resolve the vault from cwd; run them from `~/obsidian`.

## First Checks

# OpenAI Image Gen

Generate a handful of “random but structured” prompts and render them via OpenAI Images API.

## Setup

- Needs env: `OPENAI_API_KEY`

## Run

From any directory (outputs to `~/Projects/tmp/...` when present; else `./tmp/...`):

```bash
python3 ~/Projects/agent-scripts/skills/openai-image-gen/scripts/gen.py

# OpenClaw Relay

Use this when the job is:

- "talk to Molty"
- "relay this into an OpenClaw channel session"
- "use acpx"
- "send this through the gateway via acp"
- "work through a remote OpenClaw bridge over SSH"

Not for team.openclaw.ai: starting or inspecting Roboclaw sessions on the Team server is
`$team-handoff` from openclaw/agent-skills (one Gateway request as Peter through Cloudflare Access; operator values live in `~/.config/openclaw/team-handoff.env`).

One skill. Two transports:

# Oracle (CLI) — best use

Oracle bundles your prompt + selected files into one “one-shot” request so another model can answer with real repo context (API or browser automation). Treat outputs as advisory: verify against the codebase + tests.

## Main use case (browser, GPT‑5.5 Pro)

Default workflow here: `--engine browser` with GPT‑5.5 Pro in ChatGPT. This is the “human in the loop” path: it can take ~10 minutes to ~1 hour; expect a stored session you can reattach to.

Recommended defaults:
- Engine: browser (`--engine browser`)
- Model: GPT‑5.5 Pro (either `--model gpt-5.5-pro` or a ChatGPT picker label like `--model "5.5 Pro"`)
- Attachments: directories/globs + excludes; avoid secrets.

## Golden path (fast + reliable)

# Project Structure

Compress a TS or Swift repo into one map file an agent can load whole. Backed by `map.ts` next to this file. TS: parse-only TS compiler, no type-check; ~8k files in ~5s; resolves the `typescript` package from the target repo, falling back to this skill dir. Swift: zero-dependency regex/brace-depth scanner built into `map.ts` (no `typescript` needed for pure-Swift repos). Requires Node >= 23.6 (native type stripping) or `npx tsx`. `.ts`/`.tsx` and `.swift` files are detected by extension; a repo may mix both.

## Run

```bash
node <this-skill-dir>/map.ts <repoRoot> [flags]
```

`<this-skill-dir>` is the base directory of this skill as announced when the skill loads (canonical: `~/Projects/agent-scripts/skills/project-structure`).

Output: one map file (default `project-structure-map.txt` in cwd) plus a JSON stats line (files, symbols, bytes, approxTokens) on stdout.

# Mac App Release

Use for BlackBar, RepoBar, CodexBar, Trimmy, and similar Sparkle-updated macOS apps.

## Rules

- Work from the app repo.
- Read `.mac-release.env`; it is the repo-owned release manifest.
- Use `scripts/mac-release` from this skill for shared release/appcast/verify work.
- Execute `mac-release` directly so its privileged Bash shebang ignores startup hooks; if an explicit interpreter is
  unavoidable, use `/bin/bash -p`, never plain `bash mac-release`.
- Keep app-specific build/package/sign behavior in repo scripts unless it is already manifest-driven.
- Never print private key material.
- Upload app/dSYM assets to a draft before publication. After a failure, preserve the release, tags, appcast commit, and local edits; inspect existing state and resume the failed step instead of deleting or retagging a possibly published release.

# Release Tweets

Use when the user asks for a release tweet, launch tweet, X announcement, release thread, changelog-to-tweet rewrite, or social copy for a shipped version. This skill is about release copy, not cutting the release.

## Ground The Copy

- Verify the release target before writing confident copy:
  - read the relevant `CHANGELOG.md` section or GitHub release notes
  - check the tag/release/npm/appcast/artifact state that applies to the project
  - distinguish `Unreleased`, beta/prerelease, stable, hotfix, and correction releases
- Do not say a feature shipped only because it is in the top changelog block. Confirm the tag/release/package evidence when available.
- Lead with user-visible wins: features, integrations, workflow improvements, install/update reliability, security fixes.
- Avoid leading with CI, coverage, validation, refactors, internal migrations, or release mechanics unless that is the actual story.
- If evidence is incomplete, say what is unverified and draft with softer wording.

# Reminders

Use this for Apple Reminders tasks. Prefer `rem` over Things/AppleScript when
the user wants an AI-friendly personal todo backend on macOS.

## Tool

- CLI: `rem`
- Repo: `https://github.com/BRO3886/rem`
- Install:

```bash
GOBIN=/opt/homebrew/bin go install github.com/BRO3886/rem/cmd/rem@latest
```

# Remote Mac

Use when the user says `MacBook`, `Mac Studio`, `clawmac`, `foundationclaw`, `foundationmac`, `megaclaw`, `miniclaw`, `Molty`, Tailscale, or asks to run/check something on one of Peter's Macs.

## Peter's Topology

- Primary workstation for interactive approvals and day-to-day work: Peter's SF Mac Studio, local/Tailscale name `steipete-studio-sf`. Peter's MacBook Pro (`steipete-mbp`) is the portable/fallback workstation; do not route prompts there merely because it is online.
- London workhorse: Mac Studio, Tailscale `peters-mac-studio-1`, usually best reached as `steipete@steipete-macstudio.local` when on its LAN.
- SF primary workstation: `steipete-studio-sf`. Its current Tailscale target and retired-node state live in private manager `computers.yaml`; do not choose a peer merely because it appears online.
- `clawstudio` is the separate SF data server and personal OpenClaw Gateway host, formerly `mac-studio-sf2`. Its exact current peer IDs, addresses, hardware identity, and reconciliation state live only in private manager inventory and `docs/tailnet-portal.md`. If multiple peers appear, pin each backend command, verify the physical host locally, preserve a rollback path, and follow the private reconciliation gate. Do not publish or copy the private topology into public runbooks.
- SF Mini: local/Tailscale name `steipete-mini-sf`. Its current kernel and retired GUI targets live in private manager inventory. The Mini uses classic key-only OpenSSH over the tailnet TCP 22 grant because GUI Tailscale builds cannot host Tailscale SSH. Its own key is installed on both SF Studios, MegaClaw, and MiniClaw; see private manager `docs/fleet-setup.md` for live proof and offline/provider-blocked directions. Do not confuse it with FoundationClaw.
- Personal cloud OpenClaw: `clawmac` (Peter may typo/say `crabmac`), MacStadium service `100121942`, Tailscale/SSH `steipete@clawmac`, gateway via LaunchAgent `ai.openclaw.gateway`, loopback `127.0.0.1:18789`, Telegram connected. The current 2026-08-01 provider network outage is tracked by Atlanta remote hands on tickets #11481/#11484; one hard reboot restored SSH only briefly, so do not repeat power cycles.
- Network split:
  - `corporate`: Peter's work-managed environment. Treat Mac Studio as the main remote Mac to configure and inspect there.

# Skill Cleaner

Use this when trimming skill prompt budget, finding duplicate skills, auditing enabled/disabled skill roots, or deciding which skills/plugins to remove.

## Workflow

1. Run the analyzer from this skill directory or repo root:

```bash
node --experimental-strip-types skills/skill-cleaner/scripts/skill-cleaner.ts --months 3
```

Useful variants:

# Sonos

Use for Sonos music, playback, queue, room/group, and YouTube workflows.

## Rules

- Prefer existing local Sonos tooling in the current repo before inventing shell/API calls.
- Do not change speaker groups, queues, or playback unless the user asks for it.
- Confirm target room/group when ambiguous.
- For YouTube, prefer a playable audio URL or local extraction workflow already present in the repo; avoid downloading unless requested.
- Keep network/debug work out of scope unless the user explicitly asks for diagnostics.
- Secrets, service tokens, and account auth: check env/profile first; use `op` only via the repo/AGENTS rules.

## Workflow

# Speaking

Use this for Peter's speaking-opportunity workflow.

## Sources

- **Strategy (read first, always): `/Users/steipete/Projects/manager/CONFERENCES.md`** — standing decisions (e.g. no TED, no paid talks), 2027 budget, anchor plan, triage tiers.
- Repo: `/Users/steipete/Projects/conferences`
- Sheet: `Peter Steinberger Inbounds`
- Sheet URL: https://docs.google.com/spreadsheets/d/1dNt5EjgfgvPoAx5fa-igk681gniCkzL-IZ2FmjFl8fs/edit?gid=0#gid=0
- Main tab: `Invitations`
- Main brief: `/Users/steipete/Projects/conferences/conference-opportunities.md`
- One note per opportunity: `/Users/steipete/Projects/conferences/opportunities/NNN-slug.md`

# SSH Doctor

Use when SSH connects then closes before auth, Remote Login seems advertised but unusable, or local/remote Mac SSH needs diagnosis.

## Rules

- Do not print secrets, tokens, full env, or broad secret grep output.
- Validate locally first: loopback failure means server-side sshd/launchd/config; loopback success plus remote failure means network/firewall/filter/listen path.
- Report suspicious config lines before changing `/etc/ssh/sshd_config`.
- Prefer non-interactive SSH:

```bash
ssh -o RequestTTY=no -o RemoteCommand=none HOST 'hostname; id -un'
```

# Swift Concurrency Expert

_Attribution: copied from @Dimillian’s `Dimillian/Skills` (2025-12-31)._

## Overview

Review and fix Swift Concurrency issues in Swift 6.2+ codebases by applying actor isolation, Sendable safety, and modern concurrency patterns with minimal behavior changes.

## Workflow

### 1. Triage the issue

- Capture the exact compiler diagnostics and the offending symbol(s).
- Identify the current actor context (`@MainActor`, `actor`, `nonisolated`) and whether a default actor isolation mode is enabled.

# SwiftUI Liquid Glass

_Attribution: copied from @Dimillian’s `Dimillian/Skills` (2025-12-31)._

## Overview
Use this skill to build or review SwiftUI features that fully align with the iOS 26+ Liquid Glass API. Prioritize native APIs (`glassEffect`, `GlassEffectContainer`, glass button styles) and Apple design guidance. Keep usage consistent, interactive where needed, and performance aware.

## Workflow Decision Tree
Choose the path that matches the request:

### 1) Review an existing feature
- Inspect where Liquid Glass should be used and where it should not.
- Verify correct modifier order, shape usage, and container placement.
- Check for iOS 26+ availability handling and sensible fallbacks.

# SwiftUI Performance Audit

_Attribution: copied from @Dimillian’s `Dimillian/Skills` (2025-12-31)._

## Overview

Audit SwiftUI view performance end-to-end, from instrumentation and baselining to root-cause analysis and concrete remediation steps.

## Workflow Decision Tree

- If the user provides code, start with "Code-First Review."
- If the user only describes symptoms, ask for minimal code/context, then do "Code-First Review."
- If code review is inconclusive, go to "Guide the User to Profile" and ask for a trace or screenshots.

# SwiftUI View Refactor

_Attribution: copied from @Dimillian’s `Dimillian/Skills` (2025-12-31)._

## Overview
Apply a consistent structure and dependency pattern to SwiftUI views, with a focus on ordering, Model-View (MV) patterns, careful view model handling, and correct Observation usage.

## Core Guidelines

### 1) View ordering (top → bottom)
- Environment
- `private`/`public` `let`
- `@State` / other stored properties
- computed `var` (non-view)

# Telecrawl

Use this for Telegram history questions. Local archive first; the Telegram apps only for live/current state.

## Sources

- DB: `~/.telecrawl/telecrawl.db`
- Import source: Telegram Desktop `tdata` or native macOS Telegram Postbox (auto-detected)
- CLI: `telecrawl`
- Archive host: the populated archive currently lives on `clawmac` (~200 chats). Local DBs on other Macs may be empty — check `status` first and prefer SSH to the archive host over answering from an empty DB:

```bash
ssh -o RequestTTY=no -o RemoteCommand=none steipete@clawmac 'zsh -lc "telecrawl --json status"'
```

# Things Todo

Use this for Things 3 tasks on Peter's Macs. Prefer `things` for Things-backed
todos; use `$reminders` only when the user asks for Apple Reminders.

## Tool

- CLI: `things`
- Repo: `https://github.com/ossianhempel/things3-cli`
- Install:

```bash
GOBIN=/opt/homebrew/bin go install github.com/ossianhempel/things3-cli/cmd/things@latest
```

# Twilio SMS

Use for Twilio phone-number and SMS work: create/buy numbers, list owned numbers, keep/label numbers, send texts, and check inbound/outbound messages.

## Safety

- Never print Account SIDs, auth tokens, API secrets, TOTP codes, or full 1Password item JSON.
- Do not store real phone numbers, SIDs, names, or account-specific item IDs in this skill.
- Use `$one-password` for secret reads. `op` stays tmux-only.
- If desktop 1Password access is needed, unset service-account auth for those commands: `env -u OP_SERVICE_ACCOUNT_TOKEN op ...`.
- Print credential shape only: field present, length, prefix class if useful.
- Public writes or logs: avoid leaking message bodies unless the user asked to read/check SMS.

## Credential Route

# Video Transcript Downloader

`./scripts/vtd.js` can:
- Print a transcript as a clean paragraph (timestamps optional).
- Download video/audio/subtitles.

Transcript behavior:
- YouTube: fetch via `youtube-transcript-plus` when possible.
- Otherwise: pull subtitles via `yt-dlp`, then clean into a paragraph.

## Setup

```bash
cd ~/Projects/agent-scripts/skills/video-transcript-downloader && npm ci

# VM Lab

Use this when the task needs a clean macOS VM to test GUI automation, TCC prompts, screenshot capture, clicking, typing, performance, or "two-way validation" of Peekaboo-like tools.

Core idea: run the tool under test inside the guest, but verify it from outside the guest with Parallels screenshots and host-side observations. Do not close apps you do not own.

## Safety Rules

- Only task-owned clones are disposable. Preserve source/golden snapshots, recovery VMs, and other tasks' VMs; never reset, revert, or delete their snapshots.
- Never access inherited guest credentials or bypass login/startup security to bootstrap a clone.
- Never print secrets. If `op` is needed, follow the 1Password skill and run it only inside `tmux`.
- Prefer fresh app windows you create yourself: TextEdit, a local HTML test page, or a small test app.
- Limit host writes to task-owned temporary diagnostics and explicitly authorized clone recovery. Never change global Bash/Codex settings for a lab workaround.
- For git repos inside the VM, use HTTPS remotes and normal branch discipline.

# WhatsApp

Use this as the first stop for WhatsApp work. Keep the source boundary sharp:

- `wacrawl`: primary WhatsApp Desktop archive. Read-only, best local history, no network, no sending.
- `wacli`: linked-device accounts. Use for alt accounts, live sync, auth, sending, chat/group mutation, and WhatsApp Web protocol questions.

If the user names `wacrawl` or `wacli` repo work specifically, read that tool's own skill too.

## Routing

- Primary WhatsApp reads/search/history: use `wacrawl`.
- Read/unread counts from WhatsApp Desktop: use `wacrawl`; it has chat-level unread counts, not per-message read state.
- Freshness-sensitive primary reads: check `wacrawl status`; run `wacrawl sync` when asked or when current data matters.

# Wrangler

Use for Cloudflare Wrangler CLI work: deploys, tails, KV/R2/D1/Queues/Workers, secrets, bindings, and account routing.

## Defaults

- Retrieval first for flags/config: `wrangler --help`, subcommand `--help`, local `node_modules/wrangler/config-schema.json`, then Cloudflare docs.
- Prefer repo wrapper: `npm exec --yes --package wrangler -- wrangler ...` unless repo has its own script.
- `wrangler whoami` before account-sensitive work.
- ReleaseBar prod account: `Steipete@gmail.com's Account` / `de09342a728de2c25c85cc6b34d68739`.
- OpenClaw projects: use OpenClaw account / `91b59577e757131d68d55a471fe32aca`. Ask if unsure.

## Pitfalls

# Xcode Sync

Synchronize exact Xcode builds across Peter's supported Macs. Use `$remote-mac` for fleet topology and SSH rules.

## Inventory

1. Read `~/Projects/manager/computers.yaml`; use live `tailscale status --json` for reachability/IPs.
2. Exclude handed-off and unknown hosts. Verify `hostname`, user, macOS, architecture, and hardware UUID before writes.
3. Deduplicate Tailscale nodes by hardware UUID; one Mac may have multiple live node records.
4. Run `scripts/xcode-host-inventory.sh` locally or remotely:

```bash
skills/xcode-sync/scripts/xcode-host-inventory.sh
ssh -o RequestTTY=no -o RemoteCommand=none HOST 'bash -s' \

# xurl

Official CLI for the X API.

Primary upstream: <https://github.com/xdevplatform/xurl>

## Install

Homebrew:

```bash
brew install --cask xdevplatform/tap/xurl
```