Add managed Agent Skills

[KoenLemmen]

Add managed Agent Skills

Summary

This PR is a successor to Rhys Sullivan's Agent Skills work in #1986. It keeps the owner-scoped skill model, GitHub import, console management, MCP delivery, and native agent sync. It adds immutable package revisions, source update review, toolkit membership, dependency reporting, and code-execution delivery.

• Import one skill, selected skills, or every skill in a GitHub repository. Executor keeps the source reference and shows a diff when an upstream revision is available. A bounded archive fallback keeps public imports working when GitHub's unauthenticated API quota is exhausted.
• Store complete packages and every saved revision. Users can edit package files, inspect declared requirements, and choose whether agents can retrieve each skill.
• Use disable-model-invocation as the initial delivery preference. true keeps a skill out of automatic discovery. false or an omitted field allows model selection. The Executor switch can override either value.
• Extend the existing MCP skills tool instead of renaming the built-in guide tool. Existing calls such as skills({ name: "execute" }) keep working. Model-enabled managed skills appear in discovery, while manual skills remain available by exact name or reference.
• Preserve the useful agent-facing behavior from Add Agent Skills #1986: the tool description carries a bounded catalog, SKILL.md loads without frontmatter and points to bundled files, file remains an alias for path, and skill://<owner>/<name>/<path> remains available beside Executor's stable ID-based resources.
• Limit a toolkit to selected managed skills. CLI sync writes enabled packages to supported native agent directories. Package scripts and assets remain inert, and Executor reports missing dependencies without installing or connecting them.

Compared with #1986, this change uses immutable revisions, staged multi-skill imports, source update review, toolkit membership, dependency diagnostics, explicit delivery state, code-execution delivery, and the existing skills MCP contract.

Linked issue

Successor to #1986.

Verification

• bun run format:check
• bun run lint
• bun run typecheck -- --concurrency=1 (45 packages)
• bun run check:routes (5 generated trees)
• TURBO_TEST_CONCURRENCY=1 bun run test (39 tasks)
• cd e2e && ../node_modules/.bin/vitest run --project selfhost scenarios/managed-skills.test.ts (2 scenarios)

The focused self-host run records the disable-model-invocation preference, the model-selection override, dependency display, immediate list refresh, the toolkit empty state, and immediate toolkit availability. It also verifies MCP discovery, frontmatter-free instruction loading, bundled-file indexing, and the file alias. Each scenario includes screenshots, a video, and a Playwright trace.

Screenshots

GitHub import finds 38 skills in mattpocock/skills. Users can install selected skills or the complete repository.

The Skills page shows installed packages, ownership, and invocation state.

Users can edit the files in an imported package. Saving creates a new revision.

Workspace toolkits can limit which managed skills their agents discover.

A source preference can disable automatic model selection. The Executor switch can override that preference after confirmation.

Watch the GitHub import recording (trimmed and slowed for review).

Checklist

• Added a changeset.
• Added or updated tests for the new behavior.
• No secrets, credentials, private data, local development plans, or AI attribution in the proposed diff.

[KoenLemmen]

CI note: Cloud shards 10of16 and 14of16 hit known main flakes addressed by #2060. The SDK failure was an unchanged test exceeding its 5-second timeout. None of these code paths changed in this PR. Could someone with access rerun CI / Test?