docs: upgrade Dailybot skill to 3.4.0 and expand addon documentation

.agents/hooks.json

@@ -0,0 +1,8 @@
+{
+  "version": 1,
+  "hooks": {
+    "sessionStart": [{"command": "dailybot hook session-start --format cursor"}],
+    "afterFileEdit": [{"command": "dailybot hook activity"}],
+    "stop": [{"command": "dailybot hook stop --format cursor"}]
+  }
+}

.agents/skills/dailybot/TRUST.md

@@ -0,0 +1,118 @@
+# Trust & guarantees — Dailybot agent skill
+
+This file ships **inside** the skill so you can read exactly what the Dailybot
+skill will and will not do on your machine before you let it run. It restates,
+in one place, the guarantees enforced by the skill's design and its consent
+flows. The authoritative security policy lives in the repo's
+[`SECURITY.md`](https://github.com/DailybotHQ/agent-skill/blob/main/SECURITY.md);
+this is the install-time companion to it.
+
+Source of truth: <https://github.com/DailybotHQ/agent-skill>. License: MIT.
+
+## What this skill is
+
+A **Markdown-first** agent skill: the "code" is the `SKILL.md` prompt files an
+agent reads at runtime, plus one small Bash helper (`shared/context.sh`, which
+detects repo/branch/agent metadata locally). Unlike a pure methodology skill,
+Dailybot is an **integration** — its whole purpose is to connect your agent to
+your team through Dailybot's first-party API. So it is honest and up-front:
+running its capabilities **does** invoke the `dailybot` CLI and **does** make
+authenticated HTTPS calls to Dailybot's own API. It never talks to any other
+third party, and it emits **no hidden telemetry** — every call is one you asked
+for (send a report, poll messages, complete a check-in, …).
+
+## Permissions it requests (`allowed-tools`)
+
+`Bash, Read, Grep, Glob` — and why each is needed:
+
+- **Read, Grep, Glob** — read this skill's own files, detect the installed CLI
+  version, and inspect an optional committed `.dailybot/profile.json` to honor
+  the team's report identity and policy.
+- **Bash** — run the `dailybot` CLI (the actual integration surface) and
+  `shared/context.sh` (reads local git + environment metadata only).
+
+It does **not** request `Edit` or `Write`. The only files it changes are written
+through the `dailybot` CLI or through the **consent-gated** setup flows below.
+
+## What it does to your machine
+
+Every action that touches your machine is **opt-in and shown to you first**:
+
+- **CLI install (with consent).** If the `dailybot` CLI is missing, the skill
+  proposes the official installer and installs **only after you confirm**. The
+  primary install path is **defense-in-depth verified** — it downloads
+  `install.sh` from the CDN *and* from the GitHub source, refuses to run if they
+  differ, and checks the published `SHA256` before executing. See
+  [`shared/auth.md`](shared/auth.md).
+- **Credentials at rest.** Login (email OTP → Bearer) or an org `DAILYBOT_API_KEY`
+  is stored by the CLI under `~/.config/dailybot/` with `0600` permissions
+  (owner-only). Secrets are masked in all output — never printed or logged in
+  full.
+- **Auto-activation & hooks (both opt-in, both reversible).** If you accept, the
+  skill writes a marked trigger block to your agent config and/or wires the
+  `dailybot hook` lifecycle commands. Both are shown to you verbatim before any
+  write, both carry an uninstall marker (`dailybot-auto-activation` for triggers,
+  the `dailybot hook` command string for hooks), and neither is ever written
+  silently. See [`report/SKILL.md`](report/SKILL.md) Step 0 and
+  [`report/hooks.md`](report/hooks.md).
+
+## What it does NOT do
+
+- **No silent installs or writes** — CLI install, auto-activation, and hooks are
+  each gated on your explicit confirmation. Nothing anywhere in this skill says
+  "install without asking."
+- **No hidden telemetry, no analytics, no "phone home."** At runtime the only
+  network calls are the CLI actions you invoke, against Dailybot's first-party
+  API. The one-time CLI installer additionally fetches from the Dailybot CDN and
+  cross-checks the GitHub source for verification (see Provenance below) — always
+  behind your consent.
+- **Never exfiltrates repo config.** The CLI carries `.dailybot/profile.json`'s
+  `vars` block for local use but **never sends it** in any report, message, or
+  payload.
+- **Never sends secrets to a third party**, never emails without a confirmed
+  recipient + body summary and a pre-send credential scan (see
+  [`email/SKILL.md`](email/SKILL.md)), and never posts chat/report content you
+  did not author.
+- **No background daemon, no persistent external state** beyond the credential/
+  config files under `~/.config/dailybot/`.
+
+## Provenance — verify before you run
+
+Two independent things to verify:
+
+1. **The CLI installer** is checksummed. The primary install path in
+   [`shared/auth.md`](shared/auth.md) downloads `install.sh` from both the CDN and
+   the GitHub source, diffs them, and verifies the published `install.sh.sha256`
+   before running — so a tampered CDN copy is refused.
+2. **The skill itself** is fully open source. Every shipped file lives under
+   `skills/dailybot/` at a tagged release; diff your installed copy against the
+   repository at its tag to confirm it is unmodified. (Releases are currently
+   checksummed at the installer level, not signed at the skill level — signing is
+   a documented next step, not a current claim.)
+
+## Self-audit (don't take our word for it)
+
+Run these from the repo root (or your installed skill directory) to confirm the
+claims above:
+
+```bash
+# 1. The skill ships exactly ONE runtime script — context.sh — and it makes no
+#    network call. All Dailybot API access is delegated to the separately
+#    installed `dailybot` CLI, never to ad-hoc HTTP embedded in the skill:
+find skills/dailybot -name '*.sh'          # -> only shared/context.sh
+grep -nE 'curl|wget|http' skills/dailybot/shared/context.sh \
+  || echo 'OK: context.sh reads local git + env only'
+
+# 2. No hardcoded credentials or tokens anywhere in the shipped skill:
+grep -RInE '(api[_-]?key|token|secret|bearer)[[:space:]]*[:=][[:space:]]*["'"'"'][A-Za-z0-9._-]{16,}' \
+  skills/dailybot || echo 'OK: no embedded secrets'
+
+# 3. The one place the skill triggers a download — the CLI installer — is
+#    checksum-verified before it runs (defense-in-depth guard):
+grep -nE 'sha256|shasum|diff -q' skills/dailybot/shared/auth.md
+```
+
+## Reporting a vulnerability
+
+Privately, to **security@dailybot.com** — never a public issue. See
+[`SECURITY.md`](https://github.com/DailybotHQ/agent-skill/blob/main/SECURITY.md).

.agents/skills/dailybot/ask/SKILL.md

@@ -0,0 +1,145 @@
+---
+name: dailybot-ask
+description: Ask the Dailybot AI a question from the terminal and read the answer, non-interactively. Runs headless — a single `dailybot ask "<question>"` prints the assistant's reply to stdout (or structured JSON with `--json`), so an autonomous agent (Claude Code, CI, a bot) can query the Dailybot AI with only an API key. Use when the developer or agent says "ask Dailybot ...", "query the Dailybot AI", "what does Dailybot say about ...", or wants a one-shot answer from Dailybot's assistant. Distinct from dailybot-chat (bot messages to Slack/Teams) and dailybot-report (progress to the dashboard).
+version: "3.4.0"
+documentation_url: https://www.dailybot.com/skill.md
+user-invocable: true
+metadata: {"openclaw":{"emoji":"🤖","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}
+allowed-tools: Bash, Read, Grep, Glob
+---
+
+# Dailybot Ask
+
+> **Requires `dailybot-cli >= 3.1.2`** (the skill-pack baseline) — the `dailybot ask`
+> command and full API-key parity on the AI chat. On much older CLIs the AI chat only
+> exists as the interactive TUI (`dailybot interactive`) and requires a login
+> session. If `dailybot ask --help` is not recognized, ask the developer to run
+> `dailybot upgrade`. See [`../SKILL.md` § Required Dailybot CLI version](../SKILL.md#required-dailybot-cli-version).
+
+You ask the **Dailybot AI assistant** a question and read its answer — **without
+opening an interactive UI**. This is the headless counterpart of the full-screen
+chat (`dailybot ask` with no message, or the deprecated `dailybot interactive`):
+
+```bash
+dailybot ask "What are my pending check-ins?"
+```
+
+prints the assistant's answer to **stdout** and exits. That makes it the primary
+way an **autonomous agent** talks to the Dailybot AI: it needs no TTY, no menu,
+and works with only `DAILYBOT_API_KEY` (the server resolves the acting user from
+the key's owner).
+
+It is **not**:
+
+- `dailybot-chat` — that sends bot **messages** to Slack / Teams / Discord /
+  Google Chat. `ask` talks to the **AI**, it does not post to a channel.
+- `dailybot-report` — that posts a progress update to the Dailybot dashboard.
+- `dailybot-messages` — that polls the agent-to-agent inbox.
+
+---
+
+## When to Use
+
+Trigger phrases the agent should recognize:
+
+- "ask Dailybot …", "ask the Dailybot AI …", "query Dailybot"
+- "what does Dailybot say about …", "get an answer from Dailybot"
+- "have Dailybot summarize my check-ins / forms / standup"
+- Any time an agent wants a one-shot, machine-readable answer from the Dailybot
+  assistant to feed back into its own reasoning.
+
+Do **not** use `dailybot ask` to *post* something to the team — that's
+`dailybot-chat` (chat platform) or `dailybot-report` (dashboard).
+
+---
+
+## Step 1 — Verify Setup
+
+Read and follow the authentication steps in [`../shared/auth.md`](../shared/auth.md).
+The AI chat accepts **either** a login session **or** an org API key — an agent
+with only `DAILYBOT_API_KEY` set can use `dailybot ask` directly.
+
+Confirm the command exists (`dailybot-cli >= 3.1.2`):
+
+```bash
+dailybot ask --help 2>&1 | head -1
+```
+
+If the command is unknown, the CLI is too old — ask the developer to
+`dailybot upgrade`, then continue with the primary task (never block on it).
+
+---
+
+## Step 2 — Ask (one-shot, headless)
+
+```bash
+# Plain text answer to stdout:
+dailybot ask "In one sentence, what did my team ship this week?"
+
+# Structured JSON (recommended for agents — easy to parse):
+dailybot ask "What forms do I have?" --json
+
+# Piped question (equivalent to passing it as an argument):
+echo "draft my standup update" | dailybot ask
+
+# Continue a prior turn by reusing its session id:
+dailybot ask "tell me more" --session-id <previous-session-id>
+```
+
+- **Text mode** prints the assistant's reply verbatim to stdout (markup off, no
+  reflow — safe to capture).
+- **`--json`** emits a single object:
+  ```json
+  {"message": "<assistant reply>", "actions": [...], "classification": "direct_response|full_agent", "session_id": "<id or null>"}
+  ```
+  Read `message` for the answer; `actions` lists any suggested follow-up actions;
+  `session_id` (when present) can be passed to the next `--session-id` call to
+  keep context.
+- Errors surface via standard exit codes (see [`../shared/auth.md`](../shared/auth.md)
+  for the shared table); `--json` prints `{"error": ..., "status": ...}`.
+
+### Interactive mode (humans)
+
+If a human wants a back-and-forth conversation instead of one-shot answers, run
+`dailybot ask` **with no message** — it opens the full-screen Textual chat
+session. (`dailybot interactive` is a deprecated alias for the same thing.)
+Agents should stick to the headless one-shot form above.
+
+---
+
+## Step 3 — Rate limits
+
+The AI chat endpoint is throttled to **30 requests/minute per API key**. Normal
+agent usage (a few questions per minute) is well within that. On a `429`,
+`dailybot ask` exits with the rate-limit code and a "Rate limit exceeded. Try
+again in Ns." message; in `--json` mode the payload carries
+`retry_after_seconds`. Back off for that many seconds — do not hammer the
+endpoint in a loop.
+
+---
+
+## Step 4 — HTTP Fallback (when the CLI is unavailable)
+
+See [`../shared/http-fallback.md`](../shared/http-fallback.md) for base patterns.
+
+**Endpoint:** `POST /v1/cli/chat/completions/` — accepts **either** `X-API-KEY`
+or a Bearer login token.
+
+```bash
+curl -s -X POST "https://api.dailybot.com/v1/cli/chat/completions/" \
+  -H "X-API-KEY: $DAILYBOT_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"message": "What are my pending check-ins?"}'
+```
+
+Optional body fields: `session_id` (continue a session), `history` /
+`messages` (prior turns as `{role, content}`), `reset_thread`. The response is
+`{ status, async, correlation_id, classification, message: {role, content}, actions }`
+— read `message.content` for the answer. A `429` sets the `Retry-After` header.
+
+---
+
+## Non-Blocking Rule
+
+If the CLI is missing, too old, auth fails, or the endpoint errors: warn the
+developer briefly, continue the primary task, do not retry in a loop.

.agents/skills/dailybot/channels/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: dailybot-channels
+description: Discover the report channels (Slack/Teams/Discord/Google Chat) available to you via Dailybot, so their UUIDs can be attached to forms and check-ins with --report-channel. Use when the developer needs a channel UUID for form/check-in authoring.
+version: "3.4.0"
+documentation_url: https://www.dailybot.com/skill.md
+user-invocable: true
+metadata: {"openclaw":{"emoji":"📣","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}
+allowed-tools: Bash, Read, Grep, Glob
+---
+
+# Dailybot Report Channels
+
+> **Requires `dailybot-cli >= 3.1.2`** (the skill-pack baseline). The `dailybot channels list`
+> command is available at this floor. If `dailybot --version` reports below
+> 3.1.2, ask the developer to run `dailybot upgrade`. See
+> [`../SKILL.md` § Required Dailybot CLI version](../SKILL.md#required-dailybot-cli-version).
+
+Report channels are the Slack / Microsoft Teams / Discord / Google Chat
+destinations where Dailybot posts form and check-in reports. This sub-skill lists
+the channels available to you so their UUIDs can be attached to a form or check-in
+with `--report-channel` during authoring.
+
+## Auth model — API key or login
+
+Works under a login session (Bearer) **or** an org API key (`DAILYBOT_API_KEY`).
+Visibility is role-scoped server-side; the CLI never client-filters.
+
+## When to Use
+
+- The developer is **authoring** a form or check-in (see
+  [`../forms/SKILL.md`](../forms/SKILL.md) § Authoring and
+  [`../checkin/SKILL.md`](../checkin/SKILL.md) § Authoring) and needs a channel
+  UUID for `--report-channel`.
+- The developer asks "which channels can Dailybot post to?".
+
+Do **not** use this to *send* a message to a channel — that's `dailybot-chat`.
+
+## Step 1 — List channels
+
+```bash
+# Human-readable table
+dailybot channels list
+
+# Machine-readable (recommended for agents)
+dailybot channels list --json
+```
+
+JSON shape:
+
+```json
+[
+  {"uuid": "abc123-def456", "name": "#engineering", "platform": "slack", "channel_id": "C0123ABCDEF"}
+]
+```
+
+## Step 2 — Use a channel UUID in authoring
+
+```bash
+dailybot form create -n "Sprint Retro" --report-channel abc123-def456
+dailybot checkin config <followup_uuid> --report-channel abc123-def456
+```
+
+`--report-channel` is repeatable to attach multiple channels.
+
+## Non-Blocking Rule
+
+If the CLI is unavailable or unauthenticated, surface the issue once and continue;
+never block work on channel discovery. The HTTP fallback is
+`GET /v1/report-channels/` (see [`../shared/http-fallback.md`](../shared/http-fallback.md)).
+
+## Additional Resources
+
+- [`../forms/SKILL.md`](../forms/SKILL.md) — forms authoring
+- [`../checkin/SKILL.md`](../checkin/SKILL.md) — check-in authoring
+- [`../SKILL.md`](../SKILL.md) — router + version floors