refactor: move Lobu to file-first config and embedded runtime

.env.example

@@ -67,8 +67,8 @@ WORKER_DISALLOWED_DOMAINS=
 # Public gateway URL (required for OAuth callbacks)
 PUBLIC_GATEWAY_URL=https://community.lobu.ai
 
-# Owletto MCP URL (enables OAuth login, memory, and integrations)
-AUTH_MCP_URL=https://owletto.com/mcp
+# Owletto MCP URL (enables memory and integrations)
+MEMORY_URL=https://owletto.com/mcp
 
 # System skills registry URL (points to config/system-skills.json)
 # LOBU_SYSTEM_SKILLS_URL=file:///app/config/system-skills.json

.github/workflows/ci.yml

@@ -73,8 +73,5 @@ jobs:
       - name: Build core package first
         run: cd packages/core && bun run build
 
-      - name: Generate gateway CSS
-        run: cd packages/gateway && bun run generate:css
-
       - name: Run TypeScript type check
         run: bun run typecheck

README.md

@@ -82,14 +82,14 @@ Every Lobu agent comes equipped with a suite of tools for autonomous execution a
 | Feature | Description | Built-in Tools |
 | :--- | :--- | :--- |
 | **Autonomous Scheduling** | Schedule one-time or recurring execution via cron. | `ScheduleReminder`, `ListReminders`, `CancelReminder` |
-| **Human-in-the-Loop** | Pause for user input via buttons and resume when answered. | `AskUserQuestion`, `Configure` |
+| **Human-in-the-Loop** | Pause for user input via buttons and resume when answered. | `AskUserQuestion` |
 | **Full Linux Toolbox** | Sandboxed shell access, file editing, and advanced search. | `bash`, `read`, `write`, `edit`, `grep`, `find`, `ls` |
 | **Conversation Context** | Pull earlier thread messages when the user references prior work. | `GetChannelHistory` |
 | **File & Media Delivery** | Share reports, charts, or generated voice messages. | `UploadUserFile`, `GenerateAudio` |
-| **Self-Expansion** | Search and dynamically install new skills or MCP servers. | `SearchSkills`, `InstallSkill` |
+| **Skills** | Extend agent capabilities via skills configured in lobu.toml or the admin settings page. | `lobu.toml`, Settings UI |
 | **Connected APIs** | Access third-party APIs (GitHub, Google, etc.) through Owletto MCP tools with managed OAuth. | MCP tools via Owletto |
 | **Managed MCP Proxy** | Securely connect to any MCP server with secret injection. | [MCP Proxy](docs/SECURITY.md#credentials) |
-| **Advanced Capabilities** | Extend agent abilities with web browsing, headless UI interaction, and specialized utilities via Nix packages or external MCP servers. | `bash` (Nix), `SearchSkills`, `InstallSkill` (MCP) |
+| **Advanced Capabilities** | Extend agent abilities with web browsing, headless UI interaction, and specialized utilities via Nix packages or external MCP servers. | `bash` (Nix), MCP servers |
 
 ### Popular MCP Integrations
 Workers access third-party APIs through MCP servers. OAuth and credential management is handled by Owletto:

charts/lobu/templates/gateway-deployment.yaml

@@ -219,10 +219,10 @@ spec:
               value: "{{ .Values.gateway.anthropicProxy.baseUrl }}"
             {{- end }}
 
-            # External auth (Owletto OIDC)
-            {{- if .Values.gateway.config.authMcpUrl }}
-            - name: AUTH_MCP_URL
-              value: "{{ .Values.gateway.config.authMcpUrl }}"
+            # Owletto memory URL
+            {{- if .Values.gateway.config.memoryUrl }}
+            - name: MEMORY_URL
+              value: "{{ .Values.gateway.config.memoryUrl }}"
             {{- end }}
 
             # Admin password (direct value override, not in sealed secrets)

charts/lobu/values-community.yaml

@@ -130,7 +130,7 @@ gateway:
   config:
     nodeEnv: "production"
     logLevel: "INFO"
-    authMcpUrl: "https://owletto.com/mcp"
+    memoryUrl: "https://owletto.com/mcp"
   anthropicProxy:
     enabled: true
     baseUrl: ""

charts/lobu/values.yaml

@@ -17,7 +17,6 @@ secrets:
   encryptionKey: ""  # Optional: 32-char key for AES-GCM at-rest encryption
   anthropicApiKey: ""  # Optional: Anthropic API key (recommended for prod runtime)
   claudeCodeOAuthToken: ""  # Required: Claude Code OAuth token
-  whatsappCredentials: ""  # Optional: Base64-encoded WhatsApp credentials JSON
   telegramBotToken: ""  # Optional: Telegram bot token (enables Telegram when set)
 
 # Bitnami Sealed Secrets - for production use with Git-stored encrypted secrets
@@ -176,7 +175,7 @@ gateway:
   config:
     nodeEnv: "development"
     logLevel: "DEBUG"
-    authMcpUrl: "" # Optional: Owletto MCP URL for OAuth login, memory, and integrations (e.g., https://owletto.com/mcp)
+    memoryUrl: "" # Optional: Owletto MCP URL for memory and integrations (e.g., https://owletto.com/mcp)
   # Anthropic API proxy configuration
   anthropicProxy:
     enabled: true # Set to true to enable the proxy

config/system-skills.json

@@ -10,7 +10,7 @@
         {
           "id": "owletto",
           "name": "Owletto",
-          "url": "${env:AUTH_MCP_URL}",
+          "url": "${env:MEMORY_URL}",
           "type": "sse"
         }
       ]

docker/Dockerfile.gateway

@@ -5,7 +5,7 @@ FROM node:20-alpine
 RUN apk add --no-cache curl bash docker-cli xz shadow gcompat coreutils && \
     curl -fsSL https://bun.sh/install | BUN_INSTALL=/usr/local bash && \
     chmod +x /usr/local/bin/bun
-ENV PATH="/usr/local/bin:${PATH}"
+ENV PATH="/app/node_modules/.bin:/app/packages/worker/node_modules/.bin:/usr/local/bin:${PATH}"
 
 # Install Nix (single-user mode) for embedded deployment mode nix-shell support
 RUN adduser -D -u 1001 nixuser && mkdir -p /nix && chown nixuser:nixuser /nix
@@ -43,20 +43,14 @@ COPY packages/gateway/ ./packages/gateway/
 COPY packages/worker/ ./packages/worker/
 # Copy CLI's mcp-servers.json (referenced by gateway's mcp-registry)
 COPY packages/cli/src/mcp-servers.json ./packages/cli/src/mcp-servers.json
-# Copy system skills registry (provider catalog, integrations, MCP configs)
+# Copy system skills config (provider catalog, integrations, MCP configs)
 COPY config/system-skills.json ./config/system-skills.json
-COPY config/skill-registries.json ./config/skill-registries.json
 
 # Build core package dist (used by Node.js in production, Bun uses src/ via conditional exports)
 WORKDIR /app/packages/core
 RUN bunx tsc
 
-# Generate Tailwind CSS and page bundles
 WORKDIR /app/packages/gateway
-RUN bun run generate:css && \
-    bun run scripts/build-history.ts && \
-    bun run scripts/build-agent.ts && \
-    bun run scripts/build-agents.ts
 
 WORKDIR /app
 
@@ -69,4 +63,4 @@ RUN chmod -R a+rX /app
 
 # Run with bun for TypeScript support and hot reload in dev
 ENTRYPOINT []
-CMD ["sh", "-lc", "cd /app/packages/gateway && bun run generate:css >/dev/null 2>&1 && bun run scripts/build-history.ts >/dev/null 2>&1 && bun run scripts/build-agent.ts >/dev/null 2>&1 && bun run scripts/build-agents.ts >/dev/null 2>&1 && cd /app && exec bun --watch packages/gateway/src/index.ts"]
+CMD ["sh", "-lc", "exec bun --watch /app/packages/gateway/src/index.ts"]

docker/Dockerfile.worker

@@ -3,6 +3,8 @@ FROM oven/bun:1.2.9
 # Build argument to control dev/prod behavior
 ARG NODE_ENV=production
 
+ENV PATH="/app/node_modules/.bin:/app/packages/worker/node_modules/.bin:/home/bun/.bun/bin:/root/.cargo/bin:${PATH}"
+
 WORKDIR /app
 
 # Install runtime dependencies including Node.js, Python, uv, Docker, and GitHub CLI

docker/docker-compose.yml

@@ -41,15 +41,17 @@ services:
       QUEUE_URL: redis://redis:6379
       # Host project path for worker bind mounts (Docker-in-Docker)
       LOBU_DEV_PROJECT_PATH: ${PWD}
+      # Read-only workspace mount used for file-first agent config loading
+      LOBU_WORKSPACE_ROOT: /workspace/project
     env_file:
       - ../.env
     volumes:
       # Mount Docker socket
       - /var/run/docker.sock:/var/run/docker.sock
       # Mount .env so gateway can load it via dotenv (avoids ARG_MAX with large vars)
       - ../.env:/app/.env:ro
-      # Mount .lobu/ for agents manifest and config
-      - ../.lobu:/app/.lobu:ro
+      # Mount workspace root so the gateway can read lobu.toml directly
+      - ..:/workspace/project:ro
       # Mount integrations config for live editing
       - ../config:/app/config:ro
       # Mount source for hot reload (bun --watch detects changes)

examples/hr-assistant/README.md

@@ -8,7 +8,7 @@ Make sure you have Docker CLI installed.
 
 ```bash
 # Start the services
-lobu dev -d
+lobu run -d
 
 # View logs
 docker compose logs -f

examples/hr-assistant/TESTING.md

@@ -8,7 +8,7 @@ Send messages to your bot with optional file uploads.
 
 ### Endpoint
 ```
-POST http://localhost:8081/api/messaging/send
+POST http://localhost:8081/api/v1/agents/{agentId}/messages
 ```
 
 ### Authentication
@@ -24,7 +24,7 @@ The bot token must be provided in the `Authorization` header, not in the request
 
 #### JSON Request (Simple Message)
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -H "Content-Type: application/json" \
   -d '{
@@ -36,7 +36,7 @@ curl -X POST http://localhost:8081/api/messaging/send \
 
 #### Multipart Request (With File Upload)
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -F "platform=slack" \
   -F "channel=C12345678" \
@@ -90,7 +90,7 @@ If you don't want to mention the bot, simply omit `@me` from your message.
 ### Example: Simple Text Message (with @me)
 
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -H "Content-Type: application/json" \
   -d '{
@@ -103,7 +103,7 @@ curl -X POST http://localhost:8081/api/messaging/send \
 ### Example: Without Bot Mention
 
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -H "Content-Type: application/json" \
   -d '{
@@ -116,7 +116,7 @@ curl -X POST http://localhost:8081/api/messaging/send \
 ### Example: Thread Reply
 
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -H "Content-Type: application/json" \
   -d '{
@@ -130,7 +130,7 @@ curl -X POST http://localhost:8081/api/messaging/send \
 ### Example: Single File Upload
 
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -F "platform=slack" \
   -F "channel=dev-channel" \
@@ -141,7 +141,7 @@ curl -X POST http://localhost:8081/api/messaging/send \
 ### Example: Multiple File Upload
 
 ```bash
-curl -X POST http://localhost:8081/api/messaging/send \
+curl -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer xoxb-your-bot-token" \
   -F "platform=slack" \
   -F "channel=dev-channel" \
@@ -187,7 +187,7 @@ Testing a full conversation:
 
 ```bash
 # Step 1: Send initial message
-RESPONSE=$(curl -s -X POST http://localhost:8081/api/messaging/send \
+RESPONSE=$(curl -s -X POST http://localhost:8081/api/v1/agents/{agentId}/messages \
   -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
   -H "Content-Type: application/json" \
   -d '{

examples/hr-assistant/docker-compose.yml

@@ -35,10 +35,10 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY}
       WORKER_ALLOWED_DOMAINS: ${WORKER_ALLOWED_DOMAINS:-}
       WORKER_DISALLOWED_DOMAINS: ${WORKER_DISALLOWED_DOMAINS:-}
-      AUTH_MCP_URL: ${AUTH_MCP_URL:-}
-      MEMORY_PLUGIN: ${MEMORY_PLUGIN:-owletto}
+      MEMORY_URL: ${MEMORY_URL:-}
+      LOBU_WORKSPACE_ROOT: /workspace/project
     volumes:
-      - ./.lobu:/app/.lobu
+      - .:/workspace/project:ro
     networks:
       - lobu-public
       - lobu-internal
@@ -53,4 +53,3 @@ networks:
   lobu-internal:
     internal: true
     driver: bridge
-