chore(skills): sync vendored dailybot skill pack to v3.10.3

.agents/docs/skills_agents_catalog.md

@@ -18,7 +18,7 @@ Slash commands. Invoked as `/<name>` (Claude Code) or `#<name>` (Codex/Cursor/Ge
 
 ### Dailybot agent skill pack (vendored from [`DailybotHQ/agent-skill`](https://github.com/DailybotHQ/agent-skill))
 
-The full pack lives under [`.agents/skills/dailybot/`](../skills/dailybot/) (router + fourteen sub-skills; vendored at **v3.10.2**). Every sub-skill requires `dailybot-cli >= 3.7.0` — the pack baseline. The router auto-routes by intent — read [`skills/dailybot/SKILL.md`](../skills/dailybot/SKILL.md) and let it pick the right sub-skill. Direct sub-skill entry points:
+The full pack lives under [`.agents/skills/dailybot/`](../skills/dailybot/) (router + fourteen sub-skills; vendored at **v3.10.3**). Every sub-skill requires `dailybot-cli >= 3.7.0` — the pack baseline. The router auto-routes by intent — read [`skills/dailybot/SKILL.md`](../skills/dailybot/SKILL.md) and let it pick the right sub-skill. Direct sub-skill entry points:
 
 | Slug | Procedure | Use when |
 |------|-----------|----------|

.agents/skills/dailybot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot
 description: Official Dailybot agent skill pack — report progress, check messages, send emails, announce agent status, complete check-ins, give kudos (to users or teams), resolve teams, run the full forms lifecycle (list, submit, update, transition between workflow states), **author check-ins and forms from scratch** (create/configure questions, workflow states, permissions, reminders, scheduling, AI settings, sharing), send/edit chat messages on the team's Slack/Teams/Discord/Google Chat (including report-style threads and sending as a user's identity), open (or reuse) a Slack group DM with the bot and post a report to it, ask the Dailybot AI a question headlessly, **and browse/read the workspace** — who am I / my org / a user's profile (`me` / `org` / `user get`), browse the kudos feed + the org-wide feed + wall of fame, and list/read workflows — all with shared pagination / search / date-range filters. Also **manages per-repo API keys** through the opt-in `.dailybot/env.json` file (dailybot env add/use/show/list/remove/off/on — CLI 3.7.0+) so a developer can be "logged into different orgs in different repos" simultaneously. Routes to the right sub-skill based on intent. Use when the developer mentions Dailybot or wants to interact with their team.
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"📡","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/ask/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-ask
 description: Ask the Dailybot AI a question from the terminal and read the answer, non-interactively. Runs headless — a single `dailybot ask "<question>"` prints the assistant's reply to stdout (or structured JSON with `--json`), so an autonomous agent (Claude Code, CI, a bot) can query the Dailybot AI with only an API key. Use when the developer or agent says "ask Dailybot ...", "query the Dailybot AI", "what does Dailybot say about ...", or wants a one-shot answer from Dailybot's assistant. Distinct from dailybot-chat (bot messages to Slack/Teams) and dailybot-report (progress to the dashboard).
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"🤖","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/channels/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-channels
 description: Discover the report channels (Slack/Teams/Discord/Google Chat) available to you via Dailybot, so their UUIDs can be attached to forms and check-ins with --report-channel. Use when the developer needs a channel UUID for form/check-in authoring.
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"📣","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/chat/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-chat
 description: Send and edit Dailybot bot messages on the team's connected chat platform (Slack, Microsoft Teams, Discord, Google Chat) — to user DMs, channels, or whole teams. Supports report-style threads (one headline + replies, in one call) and editing the parent or any reply afterward. Use when the developer says "send a message to my Slack channel", "ping the team in chat", "post the deploy report to #releases", or wants to update a previously sent bot message. Works headless for agents.
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"💬","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/checkin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-checkin
 description: Drive the full check-in lifecycle via Dailybot — list and complete pending check-ins, see pending/completed status for a day, inspect a check-in's questions and schedule, browse response history, edit or reset a submitted response, and backfill or future-date responses. Also authors check-ins — create and configure a check-in (schedule, participants, reminders, privacy, smart/AI) and manage its questions (types, report titles, variations, conditional logic). Works headless with an API key. Use when the developer asks to fill in their standup, answer daily questions, check what check-ins they have, edit or reset a check-in, review past responses, or create/configure a check-in. Do not use for free-text progress reports — those go through dailybot-report.
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"✅","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/conversation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-conversation
 description: Open (or idempotently reuse) a private Slack group DM (MPIM) that includes the Dailybot bot, then optionally post a message or report to it. Use when the developer wants to start a Slack group with specific teammates plus the bot — e.g. "open a group DM with Jane and Bob and send them the analysis report". Slack only, org-admin only. Distinct from dailybot-chat (which posts to existing channels/DMs) and dailybot-channels (which discovers report-channel UUIDs).
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"👥","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/email/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-email
 description: Send emails to a confirmed recipient via Dailybot on behalf of the agent. Use for notifications, summaries, follow-ups, or any communication the developer asks you to send. Always confirm recipients with the developer before sending — never guess addresses.
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: false
 metadata: {"openclaw":{"emoji":"📧","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}

.agents/skills/dailybot/env/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: dailybot-env
+description: Manage per-repo API key overrides in `.dailybot/env.json` — an opt-in, gitignored file that carries API keys + optional URLs for one or more environments (live, local, staging). One profile is active at a time; when set, it overrides `DAILYBOT_API_KEY`, `config.json`, and the login Bearer session for the enclosing repo. Use when the developer wants to be "logged into different orgs in different repos" simultaneously, needs a local dev key just for this project, or wants to toggle between staging and prod without touching global config or env vars. Requires CLI >= 3.7.0.
+version: "3.10.3"
+documentation_url: https://www.dailybot.com/skill.md
+user-invocable: true
+metadata: {"openclaw":{"emoji":"🔑","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}
+allowed-tools: Bash, Read, Grep, Glob
+---
+
+# Dailybot per-repo API key override (`env.json`)
+
+> **Requires `dailybot-cli >= 3.7.0`** — the `dailybot env` command group and the `.dailybot/env.json` loader are new in that release. If `dailybot --version` reports below 3.7.0, ask the developer to run `dailybot upgrade` before continuing. See [`../SKILL.md` § Required Dailybot CLI version](../SKILL.md#required-dailybot-cli-version).
+
+This sub-skill lets an agent configure and manage `<repo>/.dailybot/env.json` — an **opt-in, gitignored** file that pins API keys + URL overrides per environment (live, local, staging) for the enclosing repo. When a profile is *active*, it overrides `DAILYBOT_API_KEY`, `config.json`, and the login Bearer session **only for that repo**.
+
+> **The full workflow, schema, security rules, and worked examples live in [`../shared/env-json.md`](../shared/env-json.md).** Read it first — it is the single source of truth. This file is the routing entry-point and quick-reference.
+
+## When to use
+
+Route here when the developer says any of:
+
+- *"I want a local API key just for this project."*
+- *"How do I test against staging without breaking my prod login?"*
+- *"Can I be in org A in this repo and org B in another repo?"*
+- *"Set up per-project Dailybot credentials for me."*
+- *"Switch this repo to my localhost Dailybot instance."*
+
+**Do not** route here when:
+
+- The developer is in CI. Use `DAILYBOT_API_KEY` as an env var — leaves no on-disk secret.
+- The developer wants team-shared *identity* (agent name, default metadata). That's `.dailybot/profile.json` — see [`../shared/repo-profile.md`](../shared/repo-profile.md).
+- The developer has one Dailybot org and a working login session. `dailybot login` + global config is simpler.
+
+## Pre-flight — before writing anything
+
+1. **Confirm the CLI supports `env`** (>= 3.7.0):
+
+    ```bash
+    dailybot env --help >/dev/null 2>&1 || {
+      echo "This feature requires dailybot-cli >= 3.7.0. Run: dailybot upgrade" >&2
+      exit 1
+    }
+    ```
+
+2. **Ensure the repo's `.gitignore` covers `.dailybot/*`.** The Dailybot skill pack expects this pattern:
+
+    ```gitignore
+    .dailybot/*
+    !.dailybot/profile.json
+    ```
+
+    If missing, add it (creating `.gitignore` if needed):
+
+    ```bash
+    grep -q '^\.dailybot/\*' .gitignore 2>/dev/null || cat >> .gitignore <<'EOF'
+
+    # Dailybot per-repo state (env.json contains API keys — never commit it)
+    .dailybot/*
+    !.dailybot/profile.json
+    EOF
+    ```
+
+    If the developer skips this step and later commits `env.json`, the CLI will refuse to load it and print an actionable error. `dailybot env add` also fires a soft warning when the file isn't gitignored yet.
+
+## The commands (quick reference)
+
+```bash
+# CREATE a profile (creates the file if needed; first profile auto-becomes active)
+dailybot env add --name NAME --key KEY [--api-url URL] [--app-url URL]
+
+# SWITCH active profile
+dailybot env use NAME       # switch active
+dailybot env use ""         # clear active (fall through to global auth)
+
+# INSPECT
+dailybot env show           # resolved profile (API key masked)
+dailybot env list           # all profiles, active marked
+
+# DELETE
+dailybot env remove NAME [--yes]
+
+# KILL SWITCH (preserves active)
+dailybot env off            # disable the file
+dailybot env on             # re-enable
+```
+
+All API keys are masked in output (`sk_l****`). The CLI never echoes the full key back.
+
+## Common recipes
+
+### First-time setup for a local dev org
+
+```bash
+dailybot env add \
+  --name local \
+  --key sk_local_xxxxxxxx \
+  --api-url http://localhost:8000 \
+  --app-url http://localhost:8090
+
+dailybot env show   # verify
+```
+
+Because this is the first profile, it becomes active automatically. Every subsequent `dailybot` command in this repo now talks to `http://localhost:8000`. Other repos are unaffected.
+
+### Toggle between staging and prod
+
+```bash
+dailybot env add --name prod    --key sk_prod_xxxx           # first → auto-active
+dailybot env add --name staging --key sk_staging_yyyy \
+                                --api-url https://staging-api.example.com
+
+dailybot env use staging   # switch to staging for bug repro
+# ... work in staging ...
+dailybot env use prod      # switch back
+```
+
+### Temporarily disable env.json without losing setup
+
+```bash
+dailybot env off   # env.json ignored; CLI falls through to global auth
+# ... test something with your global login ...
+dailybot env on    # restores the previously active profile
+```
+
+`env off` sets `disabled: true` at the top level; `active` is preserved so `env on` instantly restores the previous selection.
+
+### Delete a profile
+
+```bash
+dailybot env remove staging --yes
+# If 'staging' was active, active is cleared and the CLI falls back to
+# global auth until you run `dailybot env use <name>` again.
+```
+
+## Security — what an agent must never do
+
+1. **Never `cat` or otherwise print raw `env.json`.** It contains API keys. Use `dailybot env show` / `dailybot env list` — they mask.
+2. **Never suggest committing `env.json`.** The CLI has a fatal `RepoEnvError` guard that fires on load if the file is tracked.
+3. **Never write API keys into `.dailybot/profile.json`.** That is a hard error in the CLI. `env.json` is the ONLY sanctioned place inside `.dailybot/` for credentials.
+4. **If the developer accidentally committed `env.json`**: tell them to rotate every key immediately (assume compromise), then `git rm --cached` + fix `.gitignore` + rewrite `env.json` with newly generated keys. Do NOT try to `git filter-repo` the leak away — assume the world has seen the keys.
+
+Full four-layer protection story (gitignore, `0o600`, fatal refuse-if-tracked, write-time gitignore warning): see [`../shared/env-json.md` § Security](../shared/env-json.md#security--non-negotiable-rules).
+
+## Interaction with existing auth (short version)
+
+| Existing flow | Effect when env.json is active in this repo |
+|---|---|
+| `dailybot login` | Still writes Bearer to `credentials.json`. env.json wins **inside this repo**. Other repos use the Bearer normally. |
+| `dailybot logout` | Unaffected — only clears Bearer. env.json remains intact. |
+| `dailybot config key=...` | Still works globally. env.json sits above it in precedence. |
+| `DAILYBOT_API_KEY` env var | Still works. env.json beats it inside a repo. |
+| `.dailybot/profile.json` | Orthogonal — still signs reports (identity). env.json provides credentials + URLs. Both can be present. |
+
+Precedence order (full table in [`../shared/env-json.md` § Auth resolution order](../shared/env-json.md#auth-resolution-order-updated-in-cli-370)).
+
+## Troubleshooting (quick reference)
+
+- **"The CLI is not using my env.json."** → `dailybot env show`; check `disabled`, `active`, and the walk-up path. Are you overriding with `--profile` / `--api-url` / `--app-url` flags?
+- **"The CLI refuses to run and complains about tracked env.json."** → run the exact fix printed in the error message. Staged-but-uncommitted counts as tracked. (`dailybot hook *` commands print the error but still run and exit 0 — by design, per their harness contract.)
+- **"I edited env.json by hand and now nothing works."** → `dailybot env show` surfaces schema warnings; if unrecoverable, delete the file and re-add profiles via `dailybot env add`.
+- **"I set `disabled: "true"` and it's still active."** → `disabled` must be a JSON boolean; the CLI warns and treats a string as `false`. Use `dailybot env off`.
+
+## See also
+
+- [`../shared/env-json.md`](../shared/env-json.md) — full schema, precedence, security posture, worked examples.
+- [`../shared/repo-profile.md`](../shared/repo-profile.md) — the sibling `profile.json` file (agent identity, tracked in git).
+- [`../shared/auth.md`](../shared/auth.md) — general authentication flow (OTP login, API key alternatives, CLI installation).

.agents/skills/dailybot/forms/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dailybot-forms
 description: List, inspect, submit, update, and transition form responses via Dailybot — including forms with workflow states and audience-scoped permissions. Also authors forms — create and configure a form (workflow states, permissions, anonymous/public/approval, ChatOps command) and manage its questions (types, report titles, variations, conditional logic). Use when the developer wants to see available forms, fill out a survey, continue an in-progress response, move a response between states, read prior responses, or create/configure a form. Do not use for daily check-ins — those go through dailybot-checkin.
-version: "3.10.2"
+version: "3.10.3"
 documentation_url: https://www.dailybot.com/skill.md
 user-invocable: true
 metadata: {"openclaw":{"emoji":"📋","homepage":"https://dailybot.com","requires":{"anyBins":["dailybot","curl"]},"primaryEnv":"DAILYBOT_API_KEY","install":[{"id":"cli-install-script","kind":"download","url":"https://cli.dailybot.com/install.sh","label":"Install Dailybot CLI (official script — preferred on Linux/macOS)"},{"id":"pip","kind":"pip","package":"dailybot-cli","bins":["dailybot"],"label":"Install Dailybot CLI via pip (fallback if binary fails)"}]}}