[quickbeard]

Summary

Adds a Skill Hub entry to the desktop sidebar, directly above Settings, opening a native SkillHub browser: search/sort/domain-filtered browsing of the registry, skill detail with rendered SKILL.md and read-only stars/downloads, and one-click install into the current project or globally — with the same agent semantics as codev skill pull (CoDev Code locked and always included, one real copy plus links). Publishing/ratings/comments stay on the web hub, reachable via "Open in SkillHub".

Why native (not an embed)

SkillHub sends X-Frame-Options: SAMEORIGIN + frame-ancestors 'self' (iframes blocked), its web UI is login-walled and Vietnamese-only, and its API serves no Access-Control-Allow-Origin on /api/v1 plus a 403 on cross-origin writes — so the renderer can never call it directly. All hub HTTP originates in the Electron main process, bridged over IPC with the fork's established gateway-SSO wiring template. Auth rides the same shared session file as codev skill and codevhub; browsing and installs work anonymously.

What's here

• @codev/skillhub extensions (fork-only package): src/hub.ts — browseHubSkills (page/limit/sort/domain + the full card shape: stars, downloads, author, runtimes) and getSkillDetail (SKILL.md text inlined by the API); a new {kind:"agents-at", root} install target so a host whose cwd isn't the project (Electron main) can install into an explicit project root — scope-based skill-dirs functions became thin wrappers over root-based cores, safeSegment/safeSkillDir guards untouched. CLI surface byte-stable.
• Desktop bridge (fork-only src/main/skillhub/{controller,ipc}.ts + tracked one-line wirings in main/preload/renderer): three channels (skillhub-browse|detail|install), input validation, discriminated SkillHubResult unions with machine-readable error codes (already-installed drives the overwrite offer, network the unreachable card), and the CoDev-Code agent lock enforced main-side. @codev/skillhub under desktop devDependencies (electron-vite bundling rule).
• App UI (fork-only src/skillhub/**, pages/skill-hub*.tsx, components/skill-hub-nav.tsx): browse page (debounced search, sort select, domain segmented control, card grid, pagination), detail page (session-ui Markdown pipeline — hub text never reaches innerHTML), install dialog (project/global scope with project picker preselected to the sidebar selection; agent checkboxes with CoDev Code checked+disabled; overwrite prompt showing the existing path; placements listed on success). Sidebar row sits above Settings via a wrapper in fork-only app-sidebar.tsx — upstream HomeUtilityNav untouched. Web builds hide the entry and show a desktop-only card.
• Wire types owned by the app (src/skillhub/types.ts, exported as @opencode-ai/app/skillhub/types) — the renderer never imports the node package; skillhub? capability on PlatformBase.
• i18n keys in en/es/vi; DIVERGENCES.md rows extended (platform.tsx, app package.json) + a new "Desktop Skill Hub wiring" row; CHANGELOG entry.

Verification

• Unit: 194 tests in codev-skillhub (new: hub API mapping/params/auth-header matrix, agents-at placement/guards), 5 controller tests in packages/desktop, 716 in packages/app (test:unit, incl. browse-model debounce/page-reset). All typechecks clean.
• Live main-process probe against the real hub: browse (13 results), detail (SKILL.md found among 11,910 inlined files), install into a scratch project root → .agents/skills/<name> store + .claude/skills/<name> relative symlink, re-install → already-installed.
• Live UI via CDP on bun dev:desktop: sidebar row labeled "Skill Hub" rendered directly above Settings; click navigates and marks the row selected; browse page shows search box, domain tabs, and 24 live cards; card → detail renders the markdown with Install + Open-in-SkillHub; install dialog shows "This project"/"Global (all projects)" and the CoDev Code checkbox {disabled: true, checked: true} with its "Always included" hint; Escape closes; back returns to the preserved list.

🤖 Generated with Claude Code