v1.3.0 — Cursor support, and customizations that survive upgrades

The release where Bobby stopped being Claude-Code-only, and where your own edits stopped being casualties of bobby upgrade.

Editors — Cursor and Cline

• target: cursor. Bobby scaffolds to the locations Cursor already understands, so the whole loop works with no glue: skills invocable as /bobby-build, commands as /bobby-plan, and AGENTS.md picked up automatically at the repo root. Agent definitions land in .cursor/agents/, which Cursor 3.13+ reads as real dispatchable subagents.
• The dashboard can drive cursor-agent. It defaults to claude, or cursor-agent when target: cursor. Override with dashboard.executor, and pass a model with dashboard.model.

Your customizations now survive every upgrade

• The .local overlay. One rule everywhere: X.md is shipped and replaced on upgrade, X.local.md is yours and never overwritten. Agents read both, and yours wins.
• bobby init --refresh regenerates shipped skills, agents and commands non-interactively, leaving .local files untouched.
• bobby upgrade --to <version> pins or rolls back to an exact version.
• Custom agents run by name. bobby run <name> dispatches any agent you define — no registration step.
• bobby skill create <name> [description] [--agent] scaffolds one for you.

Bobby Pro, without a paywall in the free core

• A dashboard extension seam. Separately distributed add-ons can mount routes and UI, so paid features render as visible-but-locked rather than invisible — and a missing, unlicensed or broken add-on degrades to the free dashboard with a reason in the banner. It can never take the free dashboard down with it.
• Bobby Pro — one subscription for every paid pack, now and every one released later. The line does not move: anything shipped in the MIT package is free forever.

Also added

• blog starter. bobby new "..." --stack blog scaffolds a static blog — markdown in posts/, a static site out in public/, an RSS feed, and no dependencies at all.
• Design skill: a structure gate and shape-first research, plus silent-failure greps (check 6c) that catch CSS which dies quietly rather than visibly.

Fixed

• Out of the box, the app's agents could not write anything. No permission mode was passed to the agent CLI, so a headless agent had no terminal to answer a prompt and retried until it exited successfully having written nothing. Both permission keys now have sane defaults, and a run that does nothing is recorded as no_op rather than completed — a clean exit is not evidence of work.
• dashboard.executor was dead config. It had a default but was never read.
• Scaffolded agents and skills referenced CLAUDE.md literally, so they broke on any non-Claude target.
• Dashboard static serving now percent-decodes request paths, so assets with encoded characters resolve.
• The rules-file backup notice named the wrong file.

Full changelog: v1.2.0...v1.3.0