Skip to content

feat(skill): add dailybot-env sub-skill for .dailybot/env.json per-repo auth - #37

Merged
xergioalex merged 4 commits into
mainfrom
docs/cli-env-json-per-repo-auth
Jul 14, 2026
Merged

feat(skill): add dailybot-env sub-skill for .dailybot/env.json per-repo auth#37
xergioalex merged 4 commits into
mainfrom
docs/cli-env-json-per-repo-auth

Conversation

@xergioalex

@xergioalex xergioalex commented Jul 14, 2026

Copy link
Copy Markdown
Member

Summary

Document the new per-repo API key override that ships in dailybot-cli >= 3.7.0. .dailybot/env.json is an opt-in, gitignored file that carries API keys + optional URL overrides for one or more environments (live, local, staging). One profile is active at a time; when set, it overrides DAILYBOT_API_KEY, config.json, and the login Bearer session for the enclosing repo only.

This is the "logged into different orgs in different repos" workflow.

Companion CLI PR: DailybotHQ/cli#69.

Motivating scenarios

Route developers to this sub-skill when they say:

  • "I want a local API key just for this project."
  • "How do I test against staging without breaking my prod login?"
  • "Can I be in org A in this repo and org B in another repo?"
  • "Switch this repo to my localhost Dailybot instance."

What ships in this PR

New files

  • skills/dailybot/env/SKILL.md — the new dailybot-env sub-skill. Same layout as the other sub-skills (channels, teams, ...): pre-flight (CLI version + gitignore check), quick command reference, four common recipes, security rules, interaction table, troubleshooting.
  • skills/dailybot/shared/env-json.md — the shared canonical reference. Full schema (snake_case), precedence table (env.json sits at feat(ci): auto-release on merge to main + minimal CI hardening #2, just below CLI flags), three-layer security posture (gitignore + fatal refuse-if-tracked guard + 0o600), worked examples, migration notes.

Updated files

  • skills/dailybot/SKILL.md — added dailybot-env to the capability routing table, rewrote the required-CLI section to explain the two-tier floor (3.1.2 for pre-existing sub-skills, 3.7.0 for env), refreshed the top-level description.
  • skills/dailybot/shared/repo-profile.md — rewrote the "What about .dailybot/ files other than profile.json?" section to route developers to env-json.md; added an identity-vs-auth-context table clarifying the split; added a rule against cat-ing env.json directly.
  • skills/dailybot/shared/auth.md — added a "Per-repo API key override (.dailybot/env.json)" section inside the "Auth model" section.
  • .gitignore — added !skills/dailybot/env/ exception because the existing Python virtualenv rule (env/) was matching the new sub-skill directory.

Not touched (owned by auto-release)

  • skills/dailybot/*/SKILL.md::version: — the python-semantic-release bot bumps these on merge based on the feat: commit prefix.
  • CHANGELOG.md — auto-release prepends.

Precedence order (as documented)

The full auth-resolution order with env.json inserted at #2:

# Layer Notes
1 --profile / --api-url / --app-url CLI flags Per-invocation escape hatch
2 .dailybot/env.json active profile New in CLI 3.7.0
3 .dailybot/profile.json::profile → agents.json Existing repo profile chain
4 agents.json default profile
5 DAILYBOT_API_KEY env var
6 config.json::api_key
7 Login session Bearer

Security posture (documented for agents)

Every agent that follows this sub-skill will:

  1. Refuse to cat env.json. Uses dailybot env show / dailybot env list (both mask API keys).
  2. Never suggest committing env.json. The CLI's fatal refuse-if-tracked guard is documented as the safety net.
  3. Never write API keys into .dailybot/profile.json. That's a hard error at the CLI level.
  4. On accidental commit: tell the developer to rotate keys immediately. Document the assume-compromise + rotate + untrack playbook.

Validation

  • python3 scripts/validate-frontmatter.py — all 16 SKILL.md files pass.
  • Manually walked the routing story: SKILL.md → env row → env/SKILL.md → shared/env-json.md. Links resolve.
  • No changes to any existing sub-skill's behavior.

Merge timing

This docs PR should merge AFTER the CLI PR (DailybotHQ/cli#69) releases to PyPI, so the 3.7.0 floor is actually reachable via dailybot upgrade. Order:

  1. CLI PR merges → auto-release cuts dailybot-cli 3.7.0 (MINOR bump) to PyPI.
  2. This docs PR merges → auto-release cuts the skill pack MINOR bump.

If merged in the opposite order, developers who trigger the skill immediately after would see dailybot: 'env' is not a dailybot command until they upgrade — a soft failure the sub-skill's pre-flight already handles gracefully.

Test plan

  • python3 scripts/validate-frontmatter.py — 16/16 pass
  • Manual routing walkthrough (SKILL.md → env → shared/env-json.md)
  • Merge CLI PR first, then this PR

Made with Cursor

xergioalex and others added 4 commits July 14, 2026 00:08
@xergioalex @cursoragent
feat(skill): add dailybot-env sub-skill for .dailybot/env.json per-re…
d63a512 
…po auth

## Summary
Document the new per-repo API key override that ships in dailybot-cli 3.7.0.
`.dailybot/env.json` is an opt-in, gitignored file that carries API keys +
optional URLs for one or more environments (live, local, staging). One
profile is active at a time; when set, it overrides `DAILYBOT_API_KEY`,
`config.json`, and the login Bearer session for the enclosing repo only.
This is the "logged into different orgs in different repos" workflow.

## Change Log

### New files
- `skills/dailybot/env/SKILL.md` — the new `dailybot-env` sub-skill,
  matching the layout of the other sub-skills. Pre-flight (CLI version +
  gitignore check), quick command reference, four common recipes,
  security rules, interaction table, troubleshooting.
- `skills/dailybot/shared/env-json.md` — the shared canonical reference:
  full schema, snake_case conventions, precedence table, three-layer
  security posture (gitignore + refuse-if-tracked fatal guard + 0o600),
  worked examples, troubleshooting, migration notes.

### Updated files
- `skills/dailybot/SKILL.md`:
    - Added `dailybot-env` row to the capability routing table.
    - Bumped the required-CLI narrative to explain the two-tier floor
      (3.1.2 for pre-existing sub-skills, 3.7.0 for env).
    - Refreshed the top-level description to mention the new capability.
- `skills/dailybot/shared/repo-profile.md`:
    - Rewrote the "What about `.dailybot/` files other than profile.json?"
      section to route developers to env-json.md.
    - Added an identity-vs-auth-context table clarifying the split.
    - Added a rule about not `cat`ing env.json directly (it has API keys).
- `skills/dailybot/shared/auth.md`:
    - Added a "Per-repo API key override" section inside the "Auth model"
      section, pointing to the new sub-skill.
- `.gitignore`:
    - Added an exception `!skills/dailybot/env/` because the existing
      Python virtualenv rule (`env/`) was matching the new sub-skill dir.

### Not touched (owned by auto-release)
- `skills/dailybot/SKILL.md::version:` (currently 3.9.0 — the bot bumps).
- Every other sub-skill's `version:` field.
- `CHANGELOG.md` (auto-release prepends).

## Risks
- Zero for backward compat: every existing sub-skill still works at CLI
  3.1.2. Only the new env sub-skill requires 3.7.0, and it says so up
  front. All 16 SKILL.md files pass `scripts/validate-frontmatter.py`.

## Related
- Companion CLI PR: DailybotHQ/cli#69 (feat(env): add .dailybot/env.json
  per-repo API key override). This docs PR should merge AFTER the CLI PR
  releases to PyPI, so the 3.7.0 floor is actually reachable via
  `dailybot upgrade`.

Co-authored-by: Cursor <cursoragent@cursor.com>
@xergioalex @cursoragent
docs(env-json,auth): document transparent Bearer→API-key retry on 401…
8801dd6 
…/403

## Summary
Two shared docs are updated to reflect the CLI's new transparent
alt-credential retry, which is what makes .dailybot/env.json usable
alongside a stale global Bearer session:

- shared/auth.md: expanded the "Automatic fallback" section — retry
  now fires on 403 (in addition to 401), covers user-scoped endpoints
  via the new _request() helper (not just agent endpoints), and
  explicitly enumerates the three real-world cases it fixes. Includes a
  reference to DRF's 403-for-rejected-credentials behavior.
- shared/env-json.md: added an "Interaction with existing auth flows →
  Transparent Bearer → API-key fallback (auto)" subsection with a
  step-by-step diagram of the prod-Bearer + local-env.json case, plus
  the guarantees agents can rely on (single retry, login endpoints
  never retry, status --auth reports the credential that actually
  succeeded).

## Change Log
- shared/auth.md: rewrote "Automatic fallback on 401" → "Automatic
  fallback on 401 or 403", added coverage list, DRF citation.
- shared/env-json.md: added "Transparent Bearer → API-key fallback
  (auto)" section under "Interaction with existing auth flows".

## Risks
- Docs-only. The behavior change is in the CLI itself (see
  DailybotHQ/cli PR #69).

Co-authored-by: Cursor <cursoragent@cursor.com>
@xergioalex @cursoragent
docs(env-json): strict never-commit rule + agent-visible full audit
e8a5e0e 
## Summary
Elevate the "env.json must never be committed" rule from a footnote
into an unmissable STOP block at the top of the shared skill doc,
and align the "Security" section with the CLI's actual three-layer
enforcement (guard now fires at the root CLI callback for every
command, not only for env subcommands).

## Change Log
- Prepended a STOP block right after the intro that spells out, in
  imperative form, the agent's obligations: never `git add`, never
  `cat` the raw file, never copy it into `tmp/` or a doc example,
  never bypass the fatal guard, always verify .gitignore before the
  first `env add`, always treat a past commit as a compromise.
- Rewrote § "Security — non-negotiable rules" from 3 to 4 numbered
  layers (added file permissions as its own layer) and clarified
  that the fatal refuse-if-tracked guard is triggered at the ROOT
  of every CLI invocation — every command is blocked, not just env
  subcommands. Added the recovery recipe with the explicit
  "rotate first, rewrite history second" ordering.
- Added a "Quick full audit an agent can run on demand" recipe:
  a 5-step bash block covering existence, gitignore coverage, git
  tracked check, file permissions, and CLI resolution.
- Beefed up Example 3 (env off / env on) with a verification
  sequence proving `disabled: true` truly makes the file inert
  (falls back to Bearer OTP) and `env on` restores the API-key
  path — the exact toggle the developer might want to test.

## Risks
None (doc-only; no CLI behavior changes here — this doc reflects
the corresponding CLI-side security fix that widens the guard).

Co-authored-by: Cursor <cursoragent@cursor.com>
@xergioalex @claude
docs(env-json,auth): align with CLI wire-preference fix + guard carve…
1ee5110 
…-outs

## Summary
The CLI now sends an env.json-sourced API key on the FIRST attempt (the
Bearer never reaches the env.json server) and the refuse-if-tracked guard
gained precise carve-outs. Update the skill docs to the now-true contract.

## Change Log
- env-json.md: fallback section rewritten (env.json key first, retry covers
  both directions, double-rejection semantics, login redirect warning);
  precedence table gains the wire-preference note and the explicit
  --profile carve-out for agent commands; unified "four protections"
  wording (was contradictory three vs four)
- auth.md: documented the single deliberate exception to Bearer-first
  (env.json-sourced keys, CLI >= 3.7.0)
- SKILL.md: removed the self-contradictory "added in v3.10.0" reference
  (version floor stays durable: CLI >= 3.7.0 for the env sub-skill)
- env/SKILL.md: three-layer -> four-layer protection reference

## Risks
- Docs-only; frontmatter validation passes for all 16 SKILL.md files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@xergioalex
xergioalex merged commit 4aa2e3e into main Jul 14, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@xergioalex