Add /skills panel: browse, invoke, open, and delete loaded skills - #1289

What

A /skills slash command (alias /skill) that opens an interactive panel for
managing loaded skills — the management surface skills currently lack. Follows
the issue discussion on skill discoverability: project skills silently shadow
global ones, and there is no in-CLI answer to "what do I have?" short of
reading directories.

Closes none — related to the /skills feature proposal. (Also includes
test/setup-scm-loader.ts, cherry-picked from my earlier PR, because tests
touching the SDK barrel cannot run without it.)

UX

┌─ ▾ Skills — 2 loaded (1 project, 1 global) ─┐
│ ❯ release-notes project Draft release n... │
│ git-helper global Helpful git wor... │
│ Enter run · o open · d delete · esc close │
└─────────────────────────────────────────────┘

• Enter: invoke the skill through the existing skill input mode (the exact
  path /skill: takes — shared via enterSkillMode so the two entries
  can't drift)
• o: open the SKILL.md in $EDITOR (VISUAL/EDITOR, notepad/vi fallback)
• d: delete with an explicit confirmation prompt showing the file path
• With no skills loaded, /skills prints install guidance (where skills live,
  npx skills add <owner/repo>) instead of an empty panel

Implementation

Clones the queue-panel architecture end to end:

• state/skills-panel-store.ts — zustand store, mirrors queue-panel-store
• utils/skills-panel-actions.ts — keymap resolver, renderer-free testable
  like queue-panel-actions
• components/skills-panel.tsx — panel UI on ClickableTitleBox
• registration in command-registry.ts + slash-commands.ts + chat.tsx wiring
  (render branch, keyboard-disable, dock takeover, unmount cleanup)

Panel participates in the same keyboard arbitration as queue (review,
ask-user, sponsored menu). One deliberate deviation from queue-panel: while a
delete is pending confirmation, all other keys are swallowed so a held d
cannot chain-delete rows — a risk the queue editor doesn't have.

Verification

• 9 new tests (keymap + command behavior), all pass
• CLI suite: 1,586 pass / 12 fail — all 12 are pre-existing Windows
  path-separator and file-locking failures present on main. Happy to file
  separate issues for those.

Tested on Windows 11 / bun 1.3.14.

Update: live reload + Claude Code parity

After studying Claude Code's skills implementation, this PR now also:

• Reloads skills live (their "live change detection"): skill directories
  are watched, so skills installed, edited, or deleted mid-session appear
  without a restart. This also fixes a bug the original PR had: the skills
  list was a frozen startup snapshot, so deleting from the panel never
  removed the row. The registry now refreshes with content diffing and a
  version that React subscribes to; the panel refreshes on open and after a
  delete. Agent runs already re-read skills from disk per run, so the model
  sees new skills immediately too.
• Accepts Claude Code frontmatter fields — user-invocable: false
  (model-only skills are hidden from the / menu, as in Claude Code) and
  when_to_use (appended as trigger context in the agent's skill listing).
  argument-hint is tolerated. One real-world catch: Claude Code's docs
  write argument-hint: [issue-number] unquoted, which YAML parses as a
  list — we coerce it back to the display string rather than rejecting the
  whole skill.
• Delete removes the skill's directory, matching Claude Code's "Remove a
  skill" semantics, so skills with supporting files (reference docs,
  scripts/) are not half-deleted.
• Fixes the project/global badge to derive from the actual skill search
  paths (resolveSkillsDirs, now exported from the SDK) instead of a HOME
  string check that misclassified on Windows.

Verification: +11 tests (frontmatter parsing incl. the YAML coercion, XML
formatting, registry refresh/diff/version/watcher), all pass on Windows /
bun 1.3.14. CLI suite unchanged vs. baseline (only the pre-existing Windows
path-separator and file-locking failures).

Real-world compatibility check: installed the ponytail skill package
(github.com/DietrichGebert/ponytail — built for Claude Code / Codex /
Copilot) via npx skills add DietrichGebert/ponytail -g -a claude-code and
loaded all 6 of its skills through Freebuff's SDK loader
(ponytail-compat.test.ts): every skill parses with name/description/content
intact from ~/.claude/skills, no modification needed.

Update: panel v2 — token estimates + search filter

Two additions to the /skills panel, borrowed from Claude Code's panel where
they fit our complementary scope (theirs toggles enable/disable; ours
invokes, opens, and deletes — see thread below):

• Token estimates per row. Each row now ends with a right-aligned
  ~token readout (~524 tok style, chars/4, k notation past 999) so you
  can see what each skill costs your context window before invoking.
  Deliberately an estimate — the point is relative weight, not an exact
  count. Helpers are renderer-free (skills-panel-format.ts) and
  unit-tested alongside the keymap, following the same pattern as
  skills-panel-actions.ts.

• / search filter. Pressing / opens an inline query that filters
  the list by name/description as you type. While searching, letters edit
  the query — d, o, q fire no shortcuts underneath your typing —
  while arrows/enter still navigate and invoke. Escape unwinds one layer
  at a time: search mode → active filter → close the panel. A muted
  "N hidden by filter" line shows what the query excludes, and the footer
  hint switches to "esc clears filter · esc again closes" while filtered.

Live run on Windows 11 with the six ponytail skills installed via
npx skills add DietrichGebert/ponytail -g -a claude-code (the same ones
from the compat test in the previous update):

┌──── ▾ Skills — 6 loaded (0 project, 6 global) ────┐
│ ❯ global Forces the laziest solution t... 1.9k tok │
│ global Whole-repo audit for over-engi... 524 tok │
│ global Harvest every `ponytail:` comm... 534 tok │
│ global Show ponytail's measured impa... 545 tok │
│ global Quick-reference card for all p... 765 tok │
│ global Code review focused exclusiv... 721 tok │
│ / filter · Enter run · o open · d delete · esc close │
└───────────────────────────────────────────────────┘
typing: / + audit → one row, "5 hidden by filter"

• Test hygiene fix: the two skill-registry live-reload tests from the
  previous update failed on any machine with Claude Code skills installed —
  includeHomeSkills loaded the real ~/.claude/skills into the expected
  counts (7 != 1 with ponytail present). They now redirect HOME/USERPROFILE
  into the temp dir, making them hermetic for any developer's machine and
  CI.

Verification: +12 tests (search keymap incl. the escape-unwind chain,
token formatting, filter matcher, hermetic registry watcher), 25/25 across
the skills test files, typecheck clean, full CLI suite unchanged from the
documented pre-existing Windows baseline.