@hncode/hncode 0.6.5 → 0.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hncode/hncode",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "hncode — A cyan-blue TUI AI coding agent with zero runtime dependencies.",
   "type": "module",
   "main": "src/index.js",

package/src/registry-browser.js

@@ -171,6 +171,23 @@ function statusColor(tone) {
   return C.blue;
 }
 
+/**
+ * The rows a tab SHOWS, after the search filter.
+ *
+ * The renderer and the action handler must agree on this or the list lies: with a query typed,
+ * `selectedIndex` counts entries in the FILTERED list, so looking it up in the unfiltered one acts on whatever
+ * happened to sit at that position instead of the row under the cursor.
+ *
+ * The tab COUNTS stay on the unfiltered list — a filter must never make a tab look empty.
+ */
+export function visibleRowsForTab(state, tabId) {
+  const rows = rowsForTab(state, tabId);
+  const query = String(state && state.filter || '').trim().toLowerCase();
+  if (!query) return rows;
+  return rows.filter((r) => [r.label, r.description, r.name]
+    .map((v) => String(v == null ? '' : v)).join(' ').toLowerCase().includes(query));
+}
+
 export function renderRegistryBrowser(state, cols, rows) {
   if (cols < MIN_WIDTH || rows < MIN_HEIGHT) {
     const lines = [fitExactly(C.red + 'Terminal too small (need >= ' + MIN_WIDTH + ' x ' + MIN_HEIGHT + ')' + C.reset, cols)];
@@ -181,7 +198,9 @@ export function renderRegistryBrowser(state, cols, rows) {
   const tabs = state.kind === 'skills' ? SKILL_TABS : PLUGIN_TABS;
   const tabIdx = Math.max(0, tabs.findIndex((t) => t.id === state.tab));
   const tab = tabs[tabIdx] || tabs[0];
-  const all = rowsForTab(state, tab.id);
+  // The header row and the empty-state message both need to know whether a filter is on.
+  const query = String(state.filter || '').trim().toLowerCase();
+  const all = visibleRowsForTab(state, tab.id);
   const sel = Math.max(0, Math.min(all.length - 1, state.selectedIndex || 0));
 
   const out = [];
@@ -197,9 +216,16 @@ export function renderRegistryBrowser(state, cols, rows) {
   // The key hints stay visible while the fetch runs: the panel is usable during it
   // (the local tabs are already loaded), so replacing the hints with a status message
   // would hide the keys exactly when the user is most likely to press them.
-  const hint = ' Tab switch \u00b7 \u2191\u2193 select \u00b7 Enter install/remove \u00b7 Esc close';
+  const hint = ' / search \u00b7 Tab switch \u00b7 \u2191\u2193 select \u00b7 Enter install/remove \u00b7 Esc close';
   out.push(fitExactly(C.gray + hint + (state.busy ? C.gray + `  ${state.busy}` : '') + C.reset, cols));
   out.push('');
+  // The search field, drawn whenever it is open or has text, so a filtered list always explains itself.
+  if (state.filtering || query) {
+    const shown = String(state.filter || '');
+    const caret = state.filtering ? '\u2588' : '';
+    out.push(C.gray + ' / ' + C.reset + C.white + shown + C.reset + C.cyan + caret + C.reset
+      + C.gray + (query ? `   ${all.length} match${all.length === 1 ? '' : 'es'}` : '   type to filter') + C.reset);
+  }
 
   // Tab strip, with the count of each tab's rows.
   {
@@ -240,22 +266,52 @@ export function renderRegistryBrowser(state, cols, rows) {
           : '  Nothing here.';
     out.push(C.gray + msg + C.reset);
   }
-  for (let i = 0; i < all.length; i++) {
+  // How many LINES each row occupies: its label plus its wrapped description.
+  const descW = Math.max(8, cols - 6);
+  const rowH = all.map((r) => 1 + wrapText(r.description, descW).length);
+  const visibleLines = Math.max(1, bodyRows);
+
+  // The first row to draw. `state.listTop` persists across frames — recomputing it from scratch each time would
+  // snap the window back to the top on every key, and the cursor would appear to leave the list.
+  let first = Math.max(0, Math.min(state.listTop || 0, Math.max(0, all.length - 1)));
+  // Scroll down while the selection does not fit; scroll up if it sits above the window.
+  if (sel < first) first = sel;
+  for (;;) {
+    let used = 0;
+    for (let i = first; i <= sel && i < all.length; i++) used += rowH[i];
+    if (used <= visibleLines || first >= sel) break;
+    first++;
+  }
+  state.listTop = first;
+
+  // Draw from `first`, stopping when the window is full. A row is never split: a label whose description fell
+  // off the bottom reads as a row that has none.
+  let drawn = 0;
+  for (let i = first; i < all.length; i++) {
+    if (drawn > 0 && drawn + rowH[i] > visibleLines) break;
+    drawn += rowH[i];
     const r = all[i];
     const isSel = i === sel;
     const ptr = isSel ? C.cyan + '\u276f ' + C.reset : '  ';
     const nameStyle = isSel ? (C.cyan + C.bold) : C.white;
     const badge = r.status ? '  ' + statusColor(r.statusTone) + r.status + C.reset : '';
     const dis = r.disabled ? C.gray : '';
-    const labelRow = out.length;   // the clickable row for this item
+    const labelRow = out.length;
     out.push(fitExactly(ptr + nameStyle + dis + r.label + C.reset + badge, cols));
-    // The whole label row is a click target: clicking selects the item (and a
-    // second click / the footer activates it), mirroring the tasks browser.
+    // The whole label row is a click target: clicking selects the item (and a second click / the footer
+    // activates it), mirroring the tasks browser.
     hits.push({ row: labelRow, col0: 0, col1: cols - 1, kind: 'regRow', index: i });
-    for (const line of wrapText(r.description, Math.max(8, cols - 6))) {
+    for (const line of wrapText(r.description, descW)) {
       out.push(C.gray + '    ' + line + C.reset);
     }
   }
+  // Say when the list continues: a clipped list that looks complete is how a skill goes missing.
+  let after = first;
+  let acc = 0;
+  while (after < all.length && acc < drawn) { acc += rowH[after]; after++; }
+  const hiddenBelow = all.length - after;
+  if (first > 0) out.push(C.gray + `  \u2191 \u2191 \u2191 ${first} above` + C.reset);
+  if (hiddenBelow > 0) out.push(C.gray + `  \u2193 \u2193 \u2193 ${hiddenBelow} below` + C.reset);
   // A fetch failure has to show even when the LOCAL half has rows, or the Available
   // tab silently looks empty and the user cannot tell why.
   if (all.length && state.data && state.data.remoteError && tab.id === 'available') {
@@ -291,9 +347,36 @@ export function renderRegistryBrowser(state, cols, rows) {
  * 'close' | 'switchTab' | 'select' | 'install' | 'remove' | 'reload' | null
  */
 export function handleRegistryBrowserKey(state, t) {
+
   const tabs = state.kind === 'skills' ? SKILL_TABS : PLUGIN_TABS;
   const all = rowsForTab(state, state.tab);
   const ch = t.ch;
+  // ---- filter input -------------------------------------------------------------------------
+  //
+  // While `state.filtering` is on, every printable key goes into the query instead of acting on the list. Esc
+  // leaves the field without clearing the filter, so a half-typed word is not lost by a stray key; a second Esc
+  // clears it. Enter accepts the filter and returns the keyboard to the list.
+  if (state.filtering) {
+    if (t.key === 'escape') { state.filtering = false; return 'select'; }
+    if (t.key === 'enter') { state.filtering = false; return 'select'; }
+    if (t.key === 'backspace') {
+      state.filter = String(state.filter || '').slice(0, -1);
+      state.selectedIndex = 0;
+      state.listTop = 0;
+      return 'select';
+    }
+    if (t.key === 'up' || t.key === 'down') { state.filtering = false; }   // hand the arrows back to the list
+    else if (ch && ch.length === 1 && ch >= ' ') {
+      state.filter = String(state.filter || '') + ch;
+      state.selectedIndex = 0;
+      state.listTop = 0;
+      return 'select';
+    } else { return null; }
+  }
+
+  // `/` opens the field; a set filter stays visible in the header and Esc clears it from the list too.
+  if (ch === '/') { state.filtering = true; return 'select'; }
+  if (t.key === 'escape' && state.filter) { state.filter = ''; state.selectedIndex = 0; state.listTop = 0; return 'select'; }
 
   if (t.key === 'escape' || ch === 'q' || ch === 'Q') return 'close';
   if (t.key === 'tab') {

package/src/skills.js

@@ -21,7 +21,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-
+import { httpsRequest } from './tools/fetch-url.js';
 export const SKILL_PREFIX = 'skill:';
 
 // The skills directory. Kept next to the other hncode state (~/.hncode/…), and
@@ -45,7 +45,16 @@ export function normalizeSkillName(name) {
 // or malformed block (then body === text and meta is empty).
 export function parseFrontMatter(text) {
   const src = String(text == null ? '' : text);
-  const m = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/.exec(src);
+  // A DELIMITER THAT WAS ESCAPED IS STILL A DELIMITER.
+  //
+  // `---\nname: x` is what a skill looks like when something wrote the block with the newlines escaped: the
+  // first and last delimiters carry a literal backslash-n while the fields between them use real newlines. The
+  // block then matched nothing and the skill listed as "(no description)" — the file reads correctly in an
+  // editor, so there was nothing to see. Only the two delimiters are unescaped; a body that contains `\n` on
+  // purpose is untouched, because the replacement stops at the first field.
+  const norm = src.replace(/^\uFEFF?---\\n(?=[A-Za-z0-9_-])/, '---\n')
+    .replace(/\\n---(\\n|$)/, '\n---$1');
+  const m = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?/.exec(norm);
   if (!m) return { meta: {}, body: src };
   const meta = {};
   for (const line of m[1].split(/\r?\n/)) {
@@ -171,6 +180,105 @@ export function skillCompletions(prefix = '') {
 
 // Build the text a skill contributes to the conversation. A short header keeps
 // the model from treating the body as the user's own words.
+// ---- installing from a GitHub repository ------------------------------------------------
+
+// A registry entry is `owner/repo`, optionally with a subdirectory: `owner/repo/skills`, or
+// `owner/repo@ref`. Skills are FOUND, not assumed: every `SKILL.md` below the given path is one,
+// because that is the layout the ecosystem uses — a folder per skill, each with its own file.
+//
+// The listing comes from the GitHub API, which needs no authentication for a public repository and
+// is rate limited per IP without a token. Fetching goes through the same transport as FetchURL so a
+// broken certificate chain on this network does not make the feature useless.
+const GH_API = 'https://api.github.com';
+
+/** Split `owner/repo[/sub][@ref]` into its parts, or null when the shape is wrong. */
+export function parseRepoSpec(spec) {
+  const text = String(spec == null ? '' : spec).trim().replace(/^https?:\/\/github\.com\//i, '');
+  if (!text) return null;
+  const at = text.lastIndexOf('@');
+  const ref = at > 0 ? text.slice(at + 1) : '';
+  const rest = at > 0 ? text.slice(0, at) : text;
+  const parts = rest.split('/').filter(Boolean);
+  if (parts.length < 2) return null;
+  const [owner, repo, ...sub] = parts;
+  return { owner, repo: repo.replace(/\.git$/i, ''), sub: sub.join('/'), ref: ref || '' };
+}
+
+async function ghJson(apiPath, insecure) {
+  const res = await httpsRequest(`${GH_API}${apiPath}`, undefined, insecure);
+  if (!res.ok) {
+    if (res.status === 404) return { error: `not found: ${apiPath}` };
+    if (res.status === 403) return { error: 'GitHub refused the request (rate limit without a token, or a private repository)' };
+    return { error: `GitHub returned ${res.status}` };
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  try { return { data: JSON.parse(buf.toString('utf8')) }; } catch { return { error: 'GitHub returned something that is not JSON' }; }
+}
+
+/** Every `SKILL.md` at or below `path`, as { name, path }. */
+async function findSkillFiles(owner, repo, dirPath, ref, insecure, depth = 0) {
+  if (depth > 4) return [];
+  const q = ref ? `?ref=${encodeURIComponent(ref)}` : '';
+  const r = await ghJson(`/repos/${owner}/${repo}/contents/${dirPath}${q}`, insecure);
+  if (r.error) return { error: r.error };
+  const entries = Array.isArray(r.data) ? r.data : [];
+  const found = [];
+  for (const e of entries) {
+    if (e.type === 'file' && /^skill\.md$/i.test(e.name)) found.push({ name: e.name, path: e.path, url: e.download_url });
+  }
+  // A directory that holds a SKILL.md is a skill; do not descend into it looking for more, or a bundle of
+  // reference files beside one would be walked for nothing.
+  if (found.length) return found;
+  for (const e of entries) {
+    if (e.type !== 'dir') continue;
+    const sub = await findSkillFiles(owner, repo, e.path, ref, insecure, depth + 1);
+    if (sub && sub.error) continue;
+    found.push(...sub);
+  }
+  return found;
+}
+
+/**
+ * Install every skill in a GitHub repository (or a subdirectory of one).
+ *
+ * Returns { ok: true, installed: [{ name, path, replaced }], skipped: [name] } or { ok: false, error }.
+ * A name that is already present is REPLACED — the same rule `/import-skill` uses.
+ */
+export async function installSkillFromGitHub(specText, { insecure = true } = {}) {
+  const spec = parseRepoSpec(specText);
+  if (!spec) return { ok: false, error: `Expected owner/repo[/subdir], got "${specText}"` };
+  const { owner, repo, sub, ref } = spec;
+
+  const files = await findSkillFiles(owner, repo, sub, ref, insecure);
+  if (files && files.error) return { ok: false, error: files.error };
+  if (!files.length) {
+    return { ok: false, error: `no SKILL.md found in ${owner}/${repo}${sub ? '/' + sub : ''}` };
+  }
+
+  const dir = skillsDir();
+  const installed = [];
+  const skipped = [];
+  for (const f of files) {
+    // The DIRECTORY name is the skill name — `skills/ds-explain/SKILL.md` is `ds-explain`. The front matter
+    // may say something else, but the folder is what the repository is organised by and what the user expects
+    // to type after `/skill:`.
+    const folder = f.path.split('/').slice(-2)[0] || repo;
+    const res = await httpsRequest(f.url, undefined, insecure);
+    if (!res.ok) { skipped.push(folder); continue; }
+    const text = Buffer.from(await res.arrayBuffer()).toString('utf8');
+    const name = normalizeSkillName(folder);
+    if (!name || /[\\/]/.test(name)) { skipped.push(folder); continue; }
+    const dest = path.join(dir, `${name}.md`);
+    const replaced = fs.existsSync(dest);
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(dest, text, 'utf8');
+      installed.push({ name, path: dest, replaced });
+    } catch { skipped.push(folder); }
+  }
+  return { ok: installed.length > 0, installed, skipped, error: installed.length ? '' : 'nothing could be downloaded' };
+}
+
 export function skillPrompt(skill) {
   if (!skill || !skill.body) return '';
   return `[skill: ${skill.name}]\n\n${skill.body}`;

package/src/tools/activate-skill.js

@@ -0,0 +1,76 @@
+/**
+ * The ActivateSkill tool: the model loads a skill by name.
+ *
+ * A skill is a stored procedure — a body of instructions for one kind of job (review a diff, debug a failure,
+ * design a UI). Until now the only way to run one was for the USER to type `/skill:<name>`, which means the model
+ * could not use a skill at all: it had no idea the directory existed.
+ *
+ * The system prompt now lists the names and descriptions, and this tool is the other half — the way to act on
+ * that list. It returns the BODY, which the model then follows in its own turn.
+ *
+ * WHY A TOOL AND NOT A SLASH COMMAND: a slash command is handled by the TUI before the model sees anything. This
+ * has to be callable mid-turn, in the middle of a multi-step job, when the model realises the remaining work is
+ * "review this" and a skill was written for exactly that.
+ */
+import { listSkills, readSkill, normalizeSkillName } from '../skills.js';
+
+export const spec = {
+  name: 'ActivateSkill',
+  description: [
+    'Load a skill — a stored procedure for a particular kind of work — and return its instructions.',
+    '',
+    'The available skills are listed in the system prompt under "# Skills", with a one-line description each.',
+    'Call this when one of them fits the job in front of you, then follow the returned instructions.',
+    '',
+    'The body is the skill\'s full text. It is NOT a summary: read it and do what it says.',
+    'Use `list` to see everything installed, including anything added since the prompt was built.',
+  ].join('\n'),
+  parameters: {
+    type: 'object',
+    properties: {
+      names: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'One or more skill names to load, as listed under "# Skills".',
+      },
+      list: {
+        type: 'boolean',
+        description: 'Return the installed skills with their descriptions instead of loading one.',
+      },
+    },
+  },
+  async execute(args) {
+    if (args && args.list) {
+      const all = listSkills();
+      if (!all.length) return 'No skills are installed. The user can add one with /import-skill.';
+      return all.map((s) => `- ${s.name}${s.description ? `: ${s.description}` : ''}`).join('\n');
+    }
+
+    const raw = args && args.names;
+    const wanted = (Array.isArray(raw) ? raw : (raw ? [raw] : []))
+      .map((n) => normalizeSkillName(n))
+      .filter(Boolean);
+    if (!wanted.length) {
+      const all = listSkills();
+      const names = all.map((s) => s.name).join(', ');
+      return `Error: name a skill to activate. Installed: ${names || '(none)'}`;
+    }
+
+    const out = [];
+    const missing = [];
+    for (const name of wanted) {
+      const skill = readSkill(name);
+      if (!skill) { missing.push(name); continue; }
+      // The header names the skill so a transcript with two of them stays readable; the body is verbatim.
+      out.push(`[skill: ${skill.name}]\n\n${skill.body}`);
+    }
+
+    if (!out.length) {
+      const all = listSkills();
+      return `Error: no skill named ${missing.join(', ')}. Installed: ${all.map((s) => s.name).join(', ') || '(none)'}`;
+    }
+    // A partial miss is worth saying: silently loading one of two would leave the job half-instructed.
+    if (missing.length) out.push(`(not installed: ${missing.join(', ')})`);
+    return out.join('\n\n---\n\n');
+  },
+};

package/src/tools/fetch-url.js

@@ -76,7 +76,7 @@ const RETRY_AFTER_MS = 1500;
  * `node:https` instead. It is the SAME request — same headers, same redirects, same body cap — just built
  * by hand so `rejectUnauthorized: false` can be passed.
  */
-async function fetchWithRetry(url, signal, insecure = false) {
+export async function fetchWithRetry(url, signal, insecure = false) {
   if (insecure) return httpsRequest(url, signal, true);
   const first = await fetch(url, { signal, redirect: 'follow', headers: HEADERS });
   if (first.status !== 429) return first;
@@ -93,7 +93,7 @@ async function fetchWithRetry(url, signal, insecure = false) {
  * buffered up to MAX_BYTES and handed back as an object with `.ok`, `.status`, `.headers.get()` and
  * `.arrayBuffer()`, so the rest of `execute` does not know which transport ran.
  */
-function httpsRequest(url, signal, insecure) {
+export function httpsRequest(url, signal, insecure) {
   return new Promise((resolve, reject) => {
     let u;
     try { u = new URL(url); } catch (e) { reject(e); return; }

package/src/tools/index.js

@@ -23,6 +23,7 @@ import { spec as notebookSpec } from './notebook.js';
 import { spec as diagnosticsSpec } from './diagnostics.js';
 import * as memoryMod from './memory.js';
 import * as goalMod from './goal.js';
+import * as activateSkillMod from './activate-skill.js';
 import { pluginTools, pluginToolGeneration } from '../plugin.js';
 
 
@@ -57,6 +58,7 @@ const builtinTools = [
   diagnosticsSpec,
   memoryMod.spec,
   goalMod.spec,
+  activateSkillMod.spec,
   ...TEAM_TOOL_SPECS,
 ];
 

package/src/tui.js

@@ -103,7 +103,7 @@ import { renderTaskOutputViewer, handleViewerKey, makeViewerState } from './task
 import { renderSwarmProgress } from './swarm-progress.js';
 import { sortedTasks, getTask, settleTask, STATUS_LABEL, backgroundTaskCard } from './agent-task.js';
 import { localVersion } from './version.js';
-import { listSkills, readSkill, importSkill, deleteSkill, skillPrompt, skillCompletions, normalizeSkillName, SKILL_PREFIX, skillsDir } from './skills.js';
+import { listSkills, readSkill, importSkill, installSkillFromGitHub, deleteSkill, skillPrompt, skillCompletions, normalizeSkillName, SKILL_PREFIX, skillsDir } from './skills.js';
 import { loadHooks, describeHooks, runShellHooks, HOOK_EVENTS } from './hooks.js';
 import { beginTurn, rewind as rewindFiles, describeRewind, listCheckpoints, restoreCheckpoint, describeCheckpoints, checkpointDelta } from './file-history.js';
 import { trimToolResults } from './tool-result.js';
@@ -258,7 +258,7 @@ export const COMMANDS = [
   { name: 'reload-config', desc: 'Reload config.toml settings only', priority: 60 },
   { name: 'plugins', desc: 'Open the plugin manager (installed + available in the repo)', priority: 60, argumentHint: '[install <name> | remove <name> | reload]' },
   { name: 'skills', desc: 'Open the skill manager (installed + available in the repo)', priority: 60, argumentHint: '[install <name> | remove <name>]' },
-  { name: 'import-skill', desc: 'Import a Markdown file as a skill (a duplicate name is overwritten)', priority: 60, argumentHint: '<file.md> [name]' },
+  { name: 'import-skill', desc: 'Add a skill from a Markdown file, or install every skill in a GitHub repository (owner/repo)', cooldown: false },
   { name: 'hooks', desc: 'Show configured shell hooks, or test one', priority: 60, argumentHint: '[list | test <event>]' },
   { name: 'git', desc: 'Show repository status (branch, changes, remote)', priority: 62 },
   { name: 'commit', desc: 'Stage and commit with a message (or let the agent draft one)', priority: 62, argumentHint: '[message]' },
@@ -7125,7 +7125,8 @@ const queueH = takeover ? 0 : queuePanelHeight(state);
       const nameField = col(label, selected ? (C.cyan + C.bold) : C.gray);
       const hint = cmd.argumentHint ? col(' ' + cmd.argumentHint, C.gray) : '';
       const pad = Math.max(2, 18 - visualCol(label) - visualCol(hint));
-      const desc = col(cmd.desc, C.gray);
+      // `description` for a skill completion, `desc` for a command: both spellings exist, so accept either.
+      const desc = col(cmd.desc || cmd.description || '', C.gray);
       addHit(lines.length, 2, mInner, { kind: 'menuItem', index: off + j });
       lines.push(menuRow(mark + nameField + hint + ' '.repeat(pad) + desc));
     });
@@ -10545,7 +10546,7 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
         ...panel,
         'Skills',
         `  /${SKILL_PREFIX}<name>     run an installed skill (Tab completes the name)`,
-        '  /import-skill <file.md>  add or overwrite a skill from a Markdown file',
+    '  /import-skill <file.md | owner/repo>  add a skill from a file, or install a repository of them',
         '  /skills                  open the skill manager (Tab switches tabs)',
         '  /skills install <name>   download one from the repo, without the panel',
         '  /skills remove <name>    delete the local copy',
@@ -12519,12 +12520,30 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
       return;
     }
     case 'import-skill': {
-      // Usage: /import-skill <file.md> [name]
+      // Usage: /import-skill <file.md | owner/repo[/sub]> [name]
       const parts = raw.split(/\s+/).filter(Boolean);
-      const file = parts[0];
+      const source = parts[0];
       const nameArg = parts[1];
-      if (!file) { appErr('Usage: /import-skill <file.md> [name]'); return; }
-      const res = importSkill(file, nameArg);
+      if (!source) { appErr('Usage: /import-skill <file.md | owner/repo[/subdir]> [name]'); return; }
+    
+      // A repository spec has no extension and carries a slash — a local Markdown path always ends in .md, and a
+      // path that does not is not something this command ever accepted.
+      const looksLikeRepo = !/\.md$/i.test(source) && /^[\w.-]+\/[\w.-]+/.test(source);
+      if (looksLikeRepo) {
+        say(`Installing skills from ${source}…`);
+        renderFrame();
+        void installSkillFromGitHub(source).then((res) => {
+          if (!res.ok) { appErr(`Install failed: ${res.error}`); renderFrame(); return; }
+          const names = res.installed.map((s) => s.name);
+          app(`Installed ${names.length} skill(s): ${names.join(', ')}`);
+          if (res.skipped.length) notice(`Skipped: ${res.skipped.join(', ')}`, 'error');
+          say(`Activate one with /skill:<name>, or type /skills to list them.`);
+          renderFrame();
+        }).catch((e) => { appErr(`Install failed: ${(e && e.message) || e}`); renderFrame(); });
+        return;
+      }
+    
+      const res = importSkill(source, nameArg);
       if (!res.ok) { appErr(res.error); return; }
       app(`${res.replaced ? 'Skill overwritten' : 'Skill imported'}: ${res.name} → ${res.path}`);
       say(`Activate it with /${SKILL_PREFIX}${res.name}`);
@@ -12761,7 +12780,15 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
       if (!url) { appErr('No git remote named "origin" — cannot build a PR URL.'); return; }
       const branch = gitmod.currentBranch(cwd);
       sayPanel(`Open a pull request for ${branch} → ${base}:\n  ${url}`);
-      app('PR link copied to the transcript (Ctrl+Shift+C to copy).');
+      // ACTUALLY COPY IT, and report what happened.
+      //
+      // The notice used to claim the link was copied while the clipboard was left alone, so the paste that followed
+      // produced whatever was copied last. `copyText` also signals failure by RETURNING false rather than throwing,
+      // so its result is what decides the message — a try/catch around it announced success either way.
+      let copied = false;
+      try { copied = copyText(url); } catch { copied = false; }
+      if (copied) app('PR link copied to your clipboard');
+      else app('Could not reach the clipboard \u2014 the link is on screen above.');
       return;
     }
     case 'cache': {
@@ -12938,12 +12965,15 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
         // and the model saw it as a detached system note rather than as their words.
         const extra = String(raw || '').trim();
         const prompt = skillPrompt(sk) + (extra ? `\n\n${extra}` : '');
-        // The row is a SKILL ACTIVATION card, not a user bubble and not the literal
-        // `/skill:foo` text (which read as the user having typed a command). The body
-        // rides a system message so it never renders as the user's own speech — the
-        // distinction kimi draws, and the reason this row exists at all.
+        // THE CARD says which skill ran; the USER MESSAGE is what the person typed, if anything.
+        //
+        // The args used to travel twice: once as `bubbleText`, which drew a bubble identical to the composer below the
+        // card, and once appended to the hidden body. Passing them as the prompt is what makes them the user's words —
+        // and when there are none, nothing is drawn but the card.
         addChat({ role: 'skill', text: name, args: extra, _conv: true });
-        await sendPrompt('/' + SKILL_PREFIX + name, { skillBody: prompt, bubbleText: extra });
+        // `submit` drops an empty prompt, so an activation with no args needs something to send. The body itself
+        // is what does the work; this line is only what makes the turn happen.
+        await sendPrompt(extra || `Run the ${name} skill.`, { skillBody: prompt });
         return;
       }
       // Check if this is a plugin-registered command.
@@ -13857,6 +13887,29 @@ async function runTurn(deps, text, opts = {}, viewArg) {
     if (memory) {
       sysText += '\n\n' + memory;
     }
+
+    // THE SKILLS ON DISK, BY NAME AND DESCRIPTION.
+    //
+    // Without this the model has no way to know a skill exists: the directory is invisible to it, so a skill that
+    // fits the task went unused unless the user remembered the name. Names and descriptions only — the bodies are
+    // read from disk when activated, and putting every body in every request would defeat the point of a skill.
+    //
+    // Read per turn, like the memory notes above, so installing one takes effect on the next message.
+    const availableSkills = listSkills().filter((s) => s.name);
+    if (availableSkills.length) {
+      const listed = availableSkills
+        .map((s) => `- ${s.name}${s.description ? `: ${s.description}` : ''}`)
+        .join('\n');
+      sysText += '\n\n' + [
+        '# Skills',
+        '',
+        'Reusable procedures installed for this machine. Each is invoked by name and then supplies its own',
+        'instructions. Use the ActivateSkill tool when one fits the work in front of you; the user can also call',
+        'them directly with /skill:<name>.',
+        '',
+        listed,
+      ].join('\n');
+    }
     // OUTPUT STYLE (/output-style): a form-of-reply instruction read from a file,
     // re-read per turn like the notes above so editing the file takes effect on the
     // next request. Placed AFTER the preferences and memory but BEFORE AGENTS.md:
@@ -14087,7 +14140,7 @@ const agents = readAgentsMd(state.cwd || state.workspace || cfg.workspace, state
       // Tools that act ONLY inside the session: the roster, the mailbox, the task list, the memories.
       // `isInsideWorkspace` answers `false` for any tool it does not know, so without this they all asked for
       // approval in yolo — the one mode whose point is not asking.
-      const safeTools = ['Read', 'Grep', 'Glob', 'FetchURL', 'WebSearch', 'TaskOutput', 'TaskList', 'TaskStop', 'TaskWait', 'TodoList', 'Goal', 'FileLines', 'AgentList', 'AgentMessage', 'AgentInterrupt', 'AgentClose', 'TaskInput', 'SendMessage', 'TeamTaskCreate', 'TeamTaskUpdate', 'TeamTaskList', 'ListTeammates', 'Memory', 'AskUserQuestion'];
+      const safeTools = ['Read', 'Grep', 'Glob', 'FetchURL', 'WebSearch', 'TaskOutput', 'TaskList', 'TaskStop', 'TaskWait', 'TodoList', 'Goal', 'ActivateSkill', 'FileLines', 'AgentList', 'AgentMessage', 'AgentInterrupt', 'AgentClose', 'TaskInput', 'SendMessage', 'TeamTaskCreate', 'TeamTaskUpdate', 'TeamTaskList', 'ListTeammates', 'Memory', 'AskUserQuestion'];
       if (rule !== 'ask' && safeTools.includes(toolName)) return true;
       // A read-only SHELL COMMAND (ls/git status/rg/cat …) is as safe as a
       // read-only TOOL, so it runs without a prompt in Ask mode too — the user
@@ -16510,9 +16563,9 @@ export async function startTUI(opts) {
   async function registryAct() {
     const b = state.registryBrowser;
     if (!b || !b.data) return;
-    const { rowsForTab } = await import('./registry-browser.js');
+    const { visibleRowsForTab } = await import('./registry-browser.js');
     const remote = await import('./remote.js');
-    const rows = rowsForTab(b, b.tab);
+    const rows = visibleRowsForTab(b, b.tab);
     const row = rows[Math.min(b.selectedIndex || 0, Math.max(0, rows.length - 1))];
     if (!row || row.disabled || row.action === 'none') return;
     const name = row.name;