[harlan-zw]

🔗 Linked issue

None

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Harlan asked for header menus like the ones on nuxtseo.com. The first is a Developers menu with CLI, MCP, SDK, Make a skill and Skillgen as cards, each with an icon and atmosphere. Until now the header listed CLI and Make a skill as plain links. Nothing in it led to the MCP server, the SDK, or the skilld-skillgen GitHub App, and the App had no page. Harlan also opened Skillgen to every public npm package, with an explicit opt-in for each repository.

• Menu. Trending Skills and Find Skills stay links. Developers is a button that opens a panel: CLI, MCP server and SDK in the top row, Make a skill and Skillgen below, then "All setup guides" to /developers. The mobile menu lists the same five items as a group.
• Cards. Each card has a lucide icon tile and one .editorial-atmosphere layer. CLI takes rose because it is the recommended path. In dark mode the cards double the ambient opacity, because 0.28 disappears on a card this small.
• Dependency. The menu uses the reka-ui NavigationMenu primitives, as nuxtseo.com does, so reka-ui is now a direct dependency. It is pinned to 2.10.4, the exact version @nuxt/ui pins, so the client keeps one copy.
• Trigger id. The reka-ui trigger sets its id only after mount, so the server rendered id with no value and html-validate failed. A fixed header-developers-trigger id replaces it, and the panel names that id as its label.
• Skillgen opt-in. Installing the App alone runs nothing. A signed-in maintainer turns Skillgen on per repository in a new account view, /me?view=skillgen. The switch needs admin or maintain access, a public repository, a root package.json (npm only), and the Skill where the Worker reads it. Migration 0140 stores the switches in skillgen_repositories, and account deletion removes them.
• Worker. The GITHUB_PILOT_REPOSITORIES allowlist is gone. Before it queues a job, the Worker posts the event's repositories to /api/internal/skillgen/opt-ins and keeps the opted-in ones. If skilld.dev does not answer, the webhook returns 503 and queues nothing.
• /skillgen. Four steps: check the repository, turn it on, install the App, review the draft. The requirements mirror the Worker's checks. The path is in FREEZE_AUDIT_PATHS, so it renders noindex,follow and stays out of the sitemap.

COPY.md gains the menu and Skillgen strings. GLOSSARY.md defines Skillgen. DESIGN.md records the cards as the one atmosphere in UI chrome. The runbook moves to docs/runbooks/skillgen.md and covers the opt-in, the shared secret and the queue limits.

📝 Migration

1. Before merging, generate one random token. Set it as NUXT_SKILLGEN_TOKEN on the site Worker and as SKILLGEN_SITE_TOKEN on skilld-harness-proof. Without it, the opt-in endpoint refuses the Worker and the webhook answers APP_UNCONFIGURED.
2. Merge. The site deploy applies migration 0140.
3. Run the "Deploy to Cloudflare" workflow with target=harness-proof. The live Worker keeps the old allowlist until then.
4. Turn Skillgen on for harlan-zw/nuxt-skew-protection at /me?view=skillgen. The new Worker skips every repository that is not opted in, including the pilot one.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

An agent wrote this comment. Checked by hand in a headless browser against nuxi dev, since CI cannot cover it:

• Hover opens the panel, and moving the pointer across the gap to a card keeps it open. A card click navigates and closes it. Outside click closes it.
• Keyboard: Enter on Developers opens the panel without navigating. Tab walks the six links in order. Shift+Tab from the first card returns to the trigger. Escape closes it and returns focus. Tabbing past the last link closes it.
• Focus never rests on reka-ui's aria-hidden focus proxy, which is why the new axe test excludes only that span.
• At 1024px the 704px panel spans x 136 to 840 with no horizontal scroll. Below lg the desktop nav hides, and the mobile menu lists the five items at 44px.
• With reduced motion, the cards drop their animation and the panel duration is 0.01ms.
• The dev server's html-validate reports no errors for / and /skillgen. /skillgen renders noindex,follow with its canonical.

Menu, dark	Menu, light

/skillgen, light	Mobile menu, dark

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-06 04:07 UTC.

GitHub merged this pull request.

• Logged (25/100): The PR's visual evidence could not be inspected, so the UI claims are unverified by this review. View code
  • Ask an agent to verify and fix this finding
• Logged (10/100): A stale skillgen opt-in row cannot be removed by any maintainer other than the account that created it, leaving a switch stuck on when repository access is gone. View code
  • Ask an agent to verify and fix this finding

49017288-f14d-4625-8933-22b0c8425567

Selected findings run after merge and open separate pull requests.

[harlan-zw]

🤖 Harlan Agent Kit Agent assessment of head 7e390a1.

The Service Review for this head was stopped before it started. At 01:31 UTC six Review Tasks were queued against four free host slots, and this pull request sat at Queue position 17. A read-only subagent reviewed the full diff instead.

No finding scored above 80. Fixed anyway in fda6067:

• 45: /skillgen told maintainers to install before joining the pilot. The Worker drops installs from repositories outside GITHUB_PILOT_REPOSITORIES, so the first run was lost. The page now says to join first.
• 20: the panel renders through reka-ui's Teleport and carried no scope attribute, so its open and close animations never ran. Those two rules are now global.
• 15: the page said "Up to 8 files". The Worker accepts 9.
• 10: the hover bridge covered the bottom 6px of the other header buttons. It now starts below the trigger.
• 5: COPY.md said four cards where the menu has five.

Logged, not changed:

• 10: only a comment keeps the reka-ui pin equal to the version @nuxt/ui pins. A future @nuxt/ui upgrade could bring back a second copy.

This assessment does not replace a Service READY. Review is requested again for fda6067.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results