feat(skills): default skills, installed CRUD, marketplace install, and conversation wiring

[malhotra5]

Summary

Closes agent-canvas issue #2276. Integrates typescript-client PR #166 (SkillsClient CRUD methods) and establishes a clean end-to-end skills flow: from what appears on the Settings page, through user configuration, to what the agent receives when a conversation starts.

---

Design: Default Skills vs. Full Marketplace

Default skills are a system concern, not a user preference.

Concept	Owner	Mechanism
Default skills	System-curated static list	public/default-skills-marketplace.json + marketplace_path on every getSkills call
Installed skills	User — explicit install	POST /api/skills/install → stored in ~/.openhands/skills/installed/
Project skills	Repo — committed files	.agents/skills/ in working directory
Full marketplace	User-opt-in only	Browse via GET /api/skills/marketplace; install individually

The full 44+ OpenHands/extensions marketplace cache on the server is never loaded by default. All getSkills calls pair load_public: true with marketplace_path pointing at the curated manifest — the server uses this as a scoping filter, returning only those 4 skills from its public cache.

---

New / Changed Files

New

File	Purpose
public/default-skills-marketplace.json	System-curated manifest: github, code-review, docker, openhands-automation — served as a static asset
src/services/default-skills.ts	DEFAULT_SKILL_NAMES (badge driver) and DEFAULT_MARKETPLACE_PATH constant

Removed

• src/api/skills-preferences-store.ts — deleted
• default_skills field removed from Settings type, DEFAULT_SETTINGS, use-settings normalizer, both settings-service API files
• Default Skills chips section in skills-settings.tsx — the user-editable panel, Reset to Recommended button, and associated state/handlers
• Stale i18n keys: SETTINGS$SKILLS_DEFAULT_TITLE, SETTINGS$SKILLS_DEFAULT_DESCRIPTION, SETTINGS$SKILLS_RESET_TO_RECOMMENDED
• VITE_LOAD_PUBLIC_SKILLS env-var gate (replaced by always-on marketplace-scoped loading)

Updated

src/api/skills-service.ts

• getSkills() always passes load_public: true + marketplace_path — settings page shows only curated defaults + user-installed + project skills, never the full 44+ cache
• Added CRUD methods via SkillsClient: listInstalledSkills(), installSkill(source), uninstallSkill(name), toggleInstalledSkill(name, enabled), getMarketplace()

src/api/agent-server-adapter.ts

• createAgentFromSettings — removed untyped load_public_skills / load_user_skills / marketplace_path from agent_context (not in the AgentContext SDK type; server ignores them via open index signature); replaced with agent_context.skills: SkillInfo[] — the only typed skill-injection field
• buildStartConversationRequestWithEncryptedSettings — fetches skills in parallel with encrypted settings and secrets using the same load_public: true + marketplace_path flags as the settings page, filters out settings.disabled_skills, embeds result as agent_context.skills. What you see in Settings is exactly what the agent gets.
• loadSkillsForConversation — uses the same flags for consistency with the settings page
• Added defaultMarketplaceUrl() helper — single construction point for the absolute manifest URL
• Added skills?: SdkSkillInfo[] to StartConversationOptions

src/routes/skills-settings.tsx

• DEFAULT badge driven by DEFAULT_SKILL_NAMES.includes(skill.name) (static, not user-controlled)
• Added installed skills CRUD UI and marketplace install UI wired to the new service methods

agent_context.skills rationale: The AgentContext SDK type exposes skills?: unknown[] as the only typed field for passing skill content to a conversation. Pre-fetching skills client-side, applying disabled_skills filtering, and embedding the full SkillInfo[] (with content) is the only spec-compliant approach that also honours user preferences.

---

End-to-End Skills Flow

1. Settings page loads — GET /api/skills with load_public: true + marketplace_path + load_user: true + load_project: true → returns curated 4 + user-installed + project skills; DEFAULT badge shown for names in DEFAULT_SKILL_NAMES
2. User enables / disables a skill — stored in settings.disabled_skills[]; no server call
3. User installs a skill — POST /api/skills/install { source } → server clones to ~/.openhands/skills/installed/; appears on next page load via load_user: true
4. User uninstalls / refreshes — DELETE /api/skills/installed/{name} / POST /api/skills/installed/{name}/refresh
5. New conversation starts — buildStartConversationRequestWithEncryptedSettings fetches skills (same flags), filters disabled_skills, sets agent_context.skills in CreateConversationRequest
6. Active conversation skills panel — loadSkillsForConversation uses same flags → consistent with settings page
7. Full marketplace browsing — GET /api/skills/marketplace (separate TTL-cached endpoint); user installs skills individually from there

---

Tests

• 2,305+ tests passing (319/321 test files; 2 skipped)
• agent-server-adapter.test.ts — agent_context assertion updated: sync builder produces {}; stale shouldLoadPublicSkills mock removed
• skills-service.test.ts — asserts marketplace_path is always included in getSkills requests
• skills-settings.test.tsx — chip/default_skills tests replaced with static DEFAULT-badge tests

---

This PR was created and updated by an AI agent (OpenHands) on behalf of the team.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-canvas	Ready	Preview, Comment	May 15, 2026 7:33pm