02D | Custom PR tool

Read-only historical evidence. Original commands are never executed by the archive. Original published teaching history, with additional privacy-only redactions of ambient context and device metadata. No new run.

Tool result: get_pull_request_evidence_bundle

[Tool 'get_pull_request_evidence_bundle' executed.]
{"pull_request":{"number":16860,"title":"feat(skills): replace the all-on skill catalog with an explicit allow-list","summary":"HUMAN:\r\n\r\nEnable a set of reccomanded skills as default and not the whole package. \r\n\r\nAGENT:\r\n\r\nPhases 1 and 2 of the plan in #16302. Phase 0 (the `defaultEnabled` catalog flag and `DEFAULT_ENABLED_SKILL_NAMES`) shipped in OpenHands/extensions#485 and is already on `@openhands/extensions@0.18.0`, which this repo pins.\r\n\r\nEvidence below is a real run of the Customize page against the change, not just unit tests: 59 catalog skills render, 11 on, 48 off, and `add-javadoc` — the skill from the issue report — is among the 48.\r\n\r\n---\r\n\r\n## Why\r\n\r\nNothing is installed today. The whole `@openhands/extensions` catalog is baked into the bundle at build time and merged into `agent_context.skills` for every conversation, with `disabled_skills` as the only escape hatch. All-on-with-a-deny-list means every catalog addition is on by default for everyone, which is how @rbren ended up opted into javadoc and bitbucket skills. The cost isn't disk — it's ~60 skill bodies and 60 trigger sets competing in every system prompt.\r\n\r\n## Summary\r\n\r\n- `enabled_skills`: an allow-list **over the bundled catalog only**, defaulting to the 11 entries the catalog flags `defaultEnabled`. `disabled_skills` keeps its job for user- and project-authored skills, which are discovered at runtime from `.agents/skills/` and should be on the moment they appear. `src/utils/skill-enablement.ts` is the single place that decides which list a skill belongs to.\r\n- A one-shot migration at the app root (`useMigrateEnabledSkills`): a workspace whose deny-list names a catalog skill keeps everything else on (behaviour preserved); a fresh one gets the curated default; one that already has `enabled_skills` is untouched. Both branches persist an **explicit** list, which is what stops a later `defaultEnabled` addition from switching itself on. `undefined` is the \"never migrated\" sentinel, so it is deliberately kept out of `DEFAULT_SETTINGS` and out of the `use-settings` coercions.\r\n- A skill the opening message invokes by name (`/standup-digest:setup`, or `/<skill-name>` from the \"Use skill\" button) is loaded for that conversation whatever the lists say. Automation preset cards fill the input with exactly that command, and 18 of the catalog's 24 slash commands belong to skills that are off by default — without this the card would silently do nothing. Only the leading token counts.\r\n- Customize gets a \"Recommended\" badge and a matching facet; the Customize page and the conversation drawer, which each carried their own copy of the hydrate/auto-save/toggle logic, now share `useSkillEnablement` so one surface can't write a preference the other can't see.\r\n\r\n## Issue Number\r\n\r\nFixes #16302\r\n\r\n## How to Test\r\n\r\n```\r\nnpm ci\r\nVITE_FRONTEND_PORT=5199 npm run dev:mock\r\n# open http://localhost:5199/skills\r\n```\r\n\r\nExpect 59 skill cards with 11 enabled and 48 disabled, a `RECOMMENDATION` facet next to `STATE`, \"Recommended\" pills on the 11, and the notice under the page description. `add-javadoc` and the `bitbucket*` skills — the ones reported in #16302 — start off; toggling one on writes `enabled_skills`, not `disabled_skills` (visible in the PATCH `misc_settings_diff.app_preferences`).\r\n\r\nFor the migration: seed `disabled_skills` with a catalog name before first load and confirm the persisted `enabled_skills` is the whole catalog minus that name, not the curated default.\r\n\r\nAutomated:\r\n\r\n- `npx vitest run` → 5064 passed. One unrelated pre-existing failure, `dev-with-automation` SIGHUP cleanup, which fails the same way on an untouched `main`.\r\n- `npm run lint` and `npm run check-translation-completeness` clean; the 4 new keys are translated for all 15 locales.\r\n- New: `__tests__/utils/skill-enablement.test.ts` (resolve / deny-veto / every migration branch), `__tests__/hooks/use-migrate-enabled-skills.test.tsx` (one-shot, cloud skip, no write over a failed settings load), plus route and facet cases.\r\n- The two adapter tests that asserted `add-javadoc` reaches the agent context now assert the opposite — that flip **is** the fix.\r\n\r\n## Video/Screenshots\r\n\r\nCustomize → Skills, default state after the change. `STATE` reads Enabled 11 / Disabled 48; `add-javadoc` and `agent-creator` are off, `add-skill` / `agent-canvas-environment` / `agent-memory` are on and badged:\r\n\r\n![Skills page, 11 of 59 enabled by default](https://raw.githubusercontent.com/OpenHands/OpenHands/e5c848586bed65324d126314691f661e185b5139/.github/pr-assets/pr-16860-01-skills-default.png)\r\n\r\nThe new `RECOMMENDATION` facet, narrowed to Recommended — 11 results, all enabled:\r\n\r\n![Recommendation facet filtered to Recommended](https://raw.githubusercontent.com/OpenHands/OpenHands/e5c848586bed65324d126314691f661e185b5139/.github/pr-assets/pr-16860-02-recommended-facet.png)\r\n\r\n## Type\r\n\r\n- [ ] Bug fix\r\n- [x] Feature\r\n- [ ] Refactor\r\n- [ ] Breaking change\r\n- [ ] Docs / chore\r\n\r\n## Notes\r\n\r\nDeviations from the plan in the issue, worth a look at review:\r\n\r\n- **No `Core` tier.** The shaped spec asked for mutually exclusive `Core` / `Recommended` tags, which forces `core` to secretly mean \"core **and** default-on\". Grepping every catalog name against `src/` (minus i18n), exactly one skill is referenced by Canvas code — `add-skill`, via `/add-skill` and the restart banner — and disabling it degrades that flow rather than breaking Canvas. So: one flag, no locked toggles. If something genuinely unremovable appears later, the lock is a Canvas-side const and a union in one resolver.\r\n- **The deny-list still wins over the a","state":"closed","merged_at":"2026-08-24T18:53:41Z","html_url":"https://github.com/OpenHands/OpenHands/pull/16860","changed_files":21,"commits":6,"additions":1128,"deletions":156},"validation_evidence":"Automated:\r\n\r\n- `npx vitest run` → 5064 passed. One unrelated pre-existing failure, `dev-with-automation` SIGHUP cleanup, which fails the same way on an untouched `main`.\r\n- `npm run lint` and `npm run check-translation-completeness` clean; the 4 new keys are translated for all 15 locales.\r\n- New: `__tests__/utils/skill-enablement.test.ts` (resolve / deny-veto / every migration branch), `__tests__/hooks/use-migrate-enabled-skills.test.tsx` (one-shot, cloud skip, no write over a failed settings load), plus route and facet cases.\r\n- The two adapter tests that asserted `add-javadoc` reaches the agent context now assert the opposite — that flip **is** the fix.\r\n\r\n","files":[{"filename":".github/pr-assets/pr-16860-01-skills-default.png","status":"added","changes":0,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/.github%2Fpr-assets%2Fpr-16860-01-skills-default.png"},{"filename":".github/pr-assets/pr-16860-02-recommended-facet.png","status":"added","changes":0,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/.github%2Fpr-assets%2Fpr-16860-02-recommended-facet.png"},{"filename":"__tests__/components/features/skills/skill-filter.test.ts","status":"modified","changes":84,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Fcomponents%2Ffeatures%2Fskills%2Fskill-filter.test.ts"},{"filename":"__tests__/components/modals/skills/skill-modal.test.tsx","status":"modified","changes":39,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Fcomponents%2Fmodals%2Fskills%2Fskill-modal.test.tsx"},{"filename":"__tests__/hooks/use-migrate-enabled-skills.test.tsx","status":"added","changes":102,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Fhooks%2Fuse-migrate-enabled-skills.test.tsx"},{"filename":"__tests__/routes/skills-settings.test.tsx","status":"modified","changes":133,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Froutes%2Fskills-settings.test.tsx"},{"filename":"__tests__/utils/skill-enablement.test.ts","status":"added","changes":161,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Futils%2Fskill-enablement.test.ts"},{"filename":"src/api/agent-server-adapter.test.ts","status":"modified","changes":77,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fapi%2Fagent-server-adapter.test.ts"},{"filename":"src/api/agent-server-adapter.ts","status":"modified","changes":52,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fapi%2Fagent-server-adapter.ts"},{"filename":"src/api/settings-service/settings-service.api.ts","status":"modified","changes":4,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fapi%2Fsettings-service%2Fsettings-service.api.ts"},{"filename":"src/components/features/conversation-panel/skills-modal.tsx","status":"modified","changes":15,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fconversation-panel%2Fskills-modal.tsx"},{"filename":"src/components/features/conversation/conversation-overview-skills-panel.tsx","status":"modified","changes":61,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fconversation%2Fconversation-overview-skills-panel.tsx"},{"filename":"src/components/features/skills/build-skill-pills.tsx","status":"modified","changes":18,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fskills%2Fbuild-skill-pills.tsx"},{"filename":"src/components/features/skills/skill-filter.ts","status":"modified","changes":69,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fskills%2Fskill-filter.ts"},{"filename":"src/hooks/use-migrate-enabled-skills.ts","status":"added","changes":43,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fhooks%2Fuse-migrate-enabled-skills.ts"},{"filename":"src/hooks/use-skill-enablement.ts","status":"added","changes":160,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fhooks%2Fuse-skill-enablement.ts"},{"filename":"src/i18n/translation.json","status":"modified","changes":68,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fi18n%2Ftranslation.json"},{"filename":"src/routes/root-layout.tsx","status":"modified","changes":3,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Froutes%2Froot-layout.tsx"},{"filename":"src/routes/skills-settings.tsx","status":"modified","changes":64,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Froutes%2Fskills-settings.tsx"},{"filename":"src/types/settings.ts","status":"modified","changes":7,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Ftypes%2Fsettings.ts"},{"filename":"src/utils/skill-enablement.ts","status":"added","changes":124,"blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Futils%2Fskill-enablement.ts"}],"important_file_patches":[{"filename":"src/hooks/use-skill-enablement.ts","patch":"@@ -0,0 +1,160 @@\n+import React from \"react\";\n+import { useTranslation } from \"react-i18next\";\n+import { useActiveBackend } from \"#/contexts/active-backend-context\";\n+import { useSaveSettings } from \"#/hooks/mutation/use-save-settings\";\n+import { useSettings } from \"#/hooks/query/use-settings\";\n+import { I18nKey } from \"#/i18n/declaration\";\n+import type { Settings, SkillInfo } from \"#/types/settings\";\n+import { displayErrorToast } from \"#/utils/custom-toast-handlers\";\n+import { retrieveAxiosErrorMessage } from \"#/utils/retrieve-axios-error-message\";\n+import {\n+  buildSkillEnablementFilter,\n+  CATALOG_SKILL_NAMES,\n+  isCatalogSkill,\n+  resolveEnabledCatalogSkills,\n+  type SkillEnablement,\n+} from \"#/utils/skill-enablement\";\n+\n+/**\n+ * Settings → the two lists. Cloud creates conversations from its own\n+ * server-side catalog and never reads `enabled_skills`, so the catalog stays\n+ * deny-list governed there.\n+ */\n+function readSkillEnablement(\n+  settings: Settings | undefined,\n+  usesCatalogAllowList: boolean,\n+): SkillEnablement {\n+  return {\n+    enabledSkills: usesCatalogAllowList\n+      ? settings?.enabled_skills\n+      : [...CATALOG_SKILL_NAMES],\n+    disabledSkills: settings?.disabled_skills ?? [],\n+  };\n+}\n+\n+/** Read-only view of the rule, for surfaces that list skills without toggling. */\n+export function useSkillEnabledFilter(): (skill: SkillInfo) => boolean {\n+  const { backend } = useActiveBackend();\n+  const { data: settings } = useSettings();\n+  const usesCatalogAllowList = backend.kind !== \"cloud\";\n+\n+  return React.useMemo(() => {\n+    const isEnabled = buildSkillEnablementFilter(\n+      readSkillEnablement(settings, usesCatalogAllowList),\n+    );\n+    return (skill: SkillInfo) => isEnabled(skill.name);\n+  }, [\n+    settings?.enabled_skills,\n+    settings?.disabled_skills,\n+    usesCatalogAllowList,\n+  ]);\n+}\n+\n+export interface SkillEnablementController {\n+  isEnabled: (skill: SkillInfo) => boolean;\n+  setEnabled: (skillName: string, enabled: boolean) => void;\n+}\n+\n+/** Stable form of both lists, so an unchanged set can skip the save. */\n+function snapshot(enablement: SkillEnablement): string {\n+  return JSON.stringify([\n+    [...resolveEnabledCatalogSkills(enablement)].sort(),\n+    [...(enablement.disabledSkills ?? [])].sort(),\n+  ]);\n+}\n+\n+/** Same array reference when the membership already matches, to skip a save. */\n+function withMembership(\n+  list: string[],\n+  name: string,\n+  present: boolean,\n+): string[] {\n+  if (list.includes(na","blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fhooks%2Fuse-skill-enablement.ts"},{"filename":"src/utils/skill-enablement.ts","patch":"@@ -0,0 +1,124 @@\n+import {\n+  DEFAULT_ENABLED_SKILL_NAMES,\n+  SKILLS_CATALOG,\n+} from \"@openhands/extensions/skills\";\n+\n+/** Every skill bundled from `@openhands/extensions`, in catalog order. */\n+export const CATALOG_SKILL_NAMES: readonly string[] = SKILLS_CATALOG.map(\n+  (entry) => entry.name,\n+);\n+\n+const CATALOG_SKILL_NAME_SET = new Set(CATALOG_SKILL_NAMES);\n+const RECOMMENDED_SKILL_NAME_SET = new Set(DEFAULT_ENABLED_SKILL_NAMES);\n+\n+export function isCatalogSkill(name: string): boolean {\n+  return CATALOG_SKILL_NAME_SET.has(name);\n+}\n+\n+export function isRecommendedSkill(name: string): boolean {\n+  return RECOMMENDED_SKILL_NAME_SET.has(name);\n+}\n+\n+/**\n+ * The two persisted lists. They cover different populations: `enabledSkills`\n+ * allow-lists the bundled catalog, whose every future addition would otherwise\n+ * be on for everyone (#16302), while `disabledSkills` keeps denying user- and\n+ * project-authored skills, which should be on the moment they appear.\n+ *\n+ * `undefined` means \"never migrated\" and must survive settings hydration.\n+ */\n+export interface SkillEnablement {\n+  enabledSkills?: string[];\n+  disabledSkills?: string[];\n+}\n+\n+export function resolveEnabledCatalogSkills(\n+  enablement: SkillEnablement,\n+): string[] {\n+  return enablement.enabledSkills ?? [...DEFAULT_ENABLED_SKILL_NAMES];\n+}\n+\n+/**\n+ * The one rule for \"will this skill be loaded\", resolved once per caller so\n+ * per-skill checks stay cheap.\n+ *\n+ * The deny-list still wins over the allow-list, which only matters before the\n+ * migration runs: until then a pre-existing \"I turned this off\" lives in the\n+ * deny-list alone.\n+ */\n+export function buildSkillEnablementFilter(\n+  enablement: SkillEnablement,\n+): (skillName: string) => boolean {\n+  const enabled = new Set(resolveEnabledCatalogSkills(enablement));\n+  const disabled = new Set(enablement.disabledSkills ?? []);\n+\n+  return (skillName) => {\n+    if (disabled.has(skillName)) return false;\n+    return !isCatalogSkill(skillName) || enabled.has(skillName);\n+  };\n+}\n+\n+/**\n+ * One-shot conversion from \"all catalog skills on, minus a deny-list\" to an\n+ * explicit allow-list; `undefined` once already migrated.\n+ *\n+ * A fresh workspace is migrated too, even though the resolver's fallback would\n+ * give it the same set: persisting an explicit list is what stops a later\n+ * `defaultEnabled` catalog addition from switching itself on.\n+ */\n+export function migrateSkillEnablement(\n+  enablement: SkillEnablement,\n+): { enabled_sk","blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Futils%2Fskill-enablement.ts"},{"filename":"src/components/features/skills/skill-filter.ts","patch":"@@ -11,21 +11,33 @@ import {\n   SKILL_SCOPE_ORDER,\n   type SkillScope,\n } from \"#/utils/skill-scope\";\n+import { isRecommendedSkill } from \"#/utils/skill-enablement\";\n import { getSkillCardDescription } from \"./get-skill-card-description\";\n \n export const SKILL_FILTER_QUERY_PARAM = \"q\";\n const SOURCE_PARAM = \"source\";\n const CATEGORY_PARAM = \"category\";\n const TYPE_PARAM = \"type\";\n const STATE_PARAM = \"state\";\n+const RECOMMENDATION_PARAM = \"recommendation\";\n \n export type SkillEnabledState = \"enabled\" | \"disabled\";\n-export type SkillFacetGroupId = \"state\" | \"source\" | \"category\" | \"type\";\n+export type SkillRecommendation = \"recommended\" | \"other\";\n+export type SkillFacetGroupId =\n+  | \"state\"\n+  | \"recommendation\"\n+  | \"source\"\n+  | \"category\"\n+  | \"type\";\n \n const SKILL_ENABLED_STATE_ORDER: readonly SkillEnabledState[] = [\n   \"enabled\",\n   \"disabled\",\n ];\n+const SKILL_RECOMMENDATION_ORDER: readonly SkillRecommendation[] = [\n+  \"recommended\",\n+  \"other\",\n+];\n const SKILL_TYPE_ORDER: readonly SkillType[] = [\n   \"agentskills\",\n   \"knowledge\",\n@@ -38,6 +50,7 @@ export interface SkillFilterState {\n   categories: Set<SkillCategoryId>;\n   types: Set<SkillType>;\n   states: Set<SkillEnabledState>;\n+  recommendations: Set<SkillRecommendation>;\n }\n \n export interface SkillFacetRowModel {\n@@ -60,6 +73,7 @@ export const EMPTY_SKILL_FILTER_STATE: SkillFilterState = {\n   categories: new Set(),\n   types: new Set(),\n   states: new Set(),\n+  recommendations: new Set(),\n };\n \n /** Carrying `labelKey`s rather than translated strings keeps this module pure, so its tests need no i18n. */\n@@ -75,13 +89,16 @@ function labelledValues<TValue extends string>(\n   return order.map((value) => ({ value, labelKey: labelKeys[value] }));\n }\n \n+/** Resolving the two lists behind enablement is the caller's job, not this module's. */\n+type SkillEnabledPredicate = (skill: SkillInfo) => boolean;\n+\n /** A new facet group is declared here and nowhere else: `selected` / `withSelected` are what keep every operation below driven by this table alone. */\n interface GroupDef {\n   id: SkillFacetGroupId;\n   labelKey: I18nKey;\n   param: string;\n   values: readonly GroupValue[];\n-  valueOf: (skill: SkillInfo, disabledSet: Set<string>) => string;\n+  valueOf: (skill: SkillInfo, isEnabled: SkillEnabledPredicate) => string;\n   selected: (state: SkillFilterState) => Set<string>;\n   withSelected: (\n     state: SkillFilterState,\n@@ -114,20 +131,40 @@ const STATE_LABEL_KEYS: Record<SkillEnabledState, I18nKey> = {\n","blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fskills%2Fskill-filter.ts"},{"filename":"__tests__/utils/skill-enablement.test.ts","patch":"@@ -0,0 +1,161 @@\n+import { describe, expect, it } from \"vitest\";\n+import {\n+  DEFAULT_ENABLED_SKILL_NAMES,\n+  SKILLS_CATALOG,\n+} from \"@openhands/extensions/skills\";\n+import {\n+  buildSkillEnablementFilter,\n+  findInvokedCatalogSkill,\n+  isCatalogSkill,\n+  isRecommendedSkill,\n+  migrateSkillEnablement,\n+  resolveEnabledCatalogSkills,\n+  toSkillEnablement,\n+} from \"#/utils/skill-enablement\";\n+\n+// Two anchors from the bundled catalog: `add-skill` carries `defaultEnabled`,\n+// `add-javadoc` is the language-specific kind of skill OpenHands#16302 asked\n+// not to be opted into.\n+const RECOMMENDED = \"add-skill\";\n+const OPTIONAL = \"add-javadoc\";\n+const LOCAL = \"house-rules\";\n+\n+describe(\"catalog membership\", () => {\n+  it(\"recognises bundled skills and ignores locally authored ones\", () => {\n+    expect(isCatalogSkill(RECOMMENDED)).toBe(true);\n+    expect(isCatalogSkill(OPTIONAL)).toBe(true);\n+    expect(isCatalogSkill(LOCAL)).toBe(false);\n+  });\n+\n+  it(\"marks only the catalog's default-enabled entries as recommended\", () => {\n+    expect(isRecommendedSkill(RECOMMENDED)).toBe(true);\n+    expect(isRecommendedSkill(OPTIONAL)).toBe(false);\n+    expect(DEFAULT_ENABLED_SKILL_NAMES.length).toBeLessThan(\n+      SKILLS_CATALOG.length,\n+    );\n+  });\n+});\n+\n+describe(\"resolveEnabledCatalogSkills\", () => {\n+  it(\"falls back to the curated default when nothing is persisted\", () => {\n+    expect(resolveEnabledCatalogSkills({})).toEqual([\n+      ...DEFAULT_ENABLED_SKILL_NAMES,\n+    ]);\n+  });\n+\n+  it(\"uses the persisted allow-list verbatim, empty list included\", () => {\n+    expect(resolveEnabledCatalogSkills({ enabledSkills: [OPTIONAL] })).toEqual([\n+      OPTIONAL,\n+    ]);\n+    expect(resolveEnabledCatalogSkills({ enabledSkills: [] })).toEqual([]);\n+  });\n+});\n+\n+describe(\"buildSkillEnablementFilter\", () => {\n+  it(\"keeps user- and project-authored skills on unless denied\", () => {\n+    expect(buildSkillEnablementFilter({ enabledSkills: [] })(LOCAL)).toBe(true);\n+    expect(buildSkillEnablementFilter({ disabledSkills: [LOCAL] })(LOCAL)).toBe(\n+      false,\n+    );\n+  });\n+\n+  it(\"requires a catalog skill to be on the allow-list\", () => {\n+    expect(buildSkillEnablementFilter({})(OPTIONAL)).toBe(false);\n+    expect(buildSkillEnablementFilter({})(RECOMMENDED)).toBe(true);\n+    expect(\n+      buildSkillEnablementFilter({ enabledSkills: [OPTIONAL] })(OPTIONAL),\n+    ).toBe(true);\n+  });\n+\n+  it(\"lets an unmigrated deny-list veto a default-enabled skill\", () => {\n+    // Un","blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Futils%2Fskill-enablement.test.ts"},{"filename":"__tests__/routes/skills-settings.test.tsx","patch":"@@ -493,4 +493,137 @@ Full skill body.`,\n \n     expect(writeText).toHaveBeenCalledWith(ADD_SKILL_EXAMPLE_COMMAND);\n   });\n+  // A skill from the bundled `@openhands/extensions` catalog: those are\n+  // governed by the `enabled_skills` allow-list, not the deny-list.\n+  const CATALOG_RECOMMENDED = \"add-skill\";\n+  const CATALOG_OPTIONAL = \"add-javadoc\";\n+\n+  it(\"shows the notice that skill changes only reach new conversations\", async () => {\n+    vi.spyOn(SkillsService, \"getSkills\").mockResolvedValue([]);\n+\n+    renderSkillsSettingsScreen();\n+\n+    expect(\n+      await screen.findByTestId(\"skills-new-conversation-notice\"),\n+    ).toHaveTextContent(\"SETTINGS$SKILLS_NEW_CONVERSATION_NOTICE\");\n+  });\n+\n+  it(\"badges a catalog skill the catalog recommends\", async () => {\n+    vi.spyOn(SkillsService, \"getSkills\").mockResolvedValue([\n+      buildSkill({ name: CATALOG_RECOMMENDED }),\n+      buildSkill({ name: CATALOG_OPTIONAL }),\n+    ]);\n+\n+    renderSkillsSettingsScreen();\n+    await screen.findByTestId(`skill-card-${CATALOG_RECOMMENDED}`);\n+\n+    expect(\n+      screen.getByTestId(`skill-recommended-${CATALOG_RECOMMENDED}`),\n+    ).toHaveTextContent(\"SETTINGS$SKILLS_RECOMMENDED\");\n+    expect(\n+      screen.queryByTestId(`skill-recommended-${CATALOG_OPTIONAL}`),\n+    ).not.toBeInTheDocument();\n+  });\n+\n+  it(\"renders an unlisted catalog skill as off without it being denied\", async () => {\n+    // The reported bug: everything in the catalog arrived switched on.\n+    vi.spyOn(SkillsService, \"getSkills\").mockResolvedValue([\n+      buildSkill({ name: CATALOG_OPTIONAL }),\n+    ]);\n+    vi.spyOn(SettingsService, \"getSettings\").mockResolvedValue(\n+      buildSettings({ enabled_skills: undefined, disabled_skills: [] }),\n+    );\n+\n+    renderSkillsSettingsScreen();\n+    const card = await screen.findByTestId(`skill-card-${CATALOG_OPTIONAL}`);\n+\n+    expect(\n+      within(card).getByTestId(`skill-toggle-${CATALOG_OPTIONAL}`),\n+    ).toHaveAttribute(\"aria-checked\", \"false\");\n+  });\n+\n+  it(\"writes nothing back when the user toggles nothing\", async () => {\n+    // Persisting the hydrated state on mount would race the one-shot migration\n+    // and could narrow a workspace it had just preserved.\n+    vi.spyOn(SkillsService, \"getSkills\").mockResolvedValue([\n+      buildSkill({ name: CATALOG_OPTIONAL }),\n+    ]);\n+    vi.spyOn(SettingsService, \"getSettings\").mockResolvedValue(\n+      buildSettings({ enabled_skills: undefined, disabled_skills: [] }),\n+    );\n+    const saveSpy = ","blob_url":"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Froutes%2Fskills-settings.test.tsx"}],"commits":[{"sha":"b28af79ef06f6aedb449b56888ebe9b727c48939","message":"feat(skills): allow-list bundled catalog skills instead of shipping all of them","html_url":"https://github.com/OpenHands/OpenHands/commit/b28af79ef06f6aedb449b56888ebe9b727c48939"},{"sha":"0a76cb9b97e45f3abfbaa6c5b893e7baac89f250","message":"feat(skills): surface the allow-list in Customize","html_url":"https://github.com/OpenHands/OpenHands/commit/0a76cb9b97e45f3abfbaa6c5b893e7baac89f250"},{"sha":"e5c848586bed65324d126314691f661e185b5139","message":"docs(skills): add PR screenshots for the skill allow-list","html_url":"https://github.com/OpenHands/OpenHands/commit/e5c848586bed65324d126314691f661e185b5139"},{"sha":"8b8b31b8b7465b4a790f487d2bf956f259db8c37","message":"fix(skills): load a catalog skill the opening slash command invokes","html_url":"https://github.com/OpenHands/OpenHands/commit/8b8b31b8b7465b4a790f487d2bf956f259db8c37"},{"sha":"304d02c5d4a6a808296cb974bb99f2fe23bc8b7d","message":"refactor(skills): share one enablement rule and trim the commentary","html_url":"https://github.com/OpenHands/OpenHands/commit/304d02c5d4a6a808296cb974bb99f2fe23bc8b7d"},{"sha":"fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c","message":"fix(skills): list only enabled skills in the conversation Skills modal","html_url":"https://github.com/OpenHands/OpenHands/commit/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c"}]}

Full event evidence

{
  "id": "a3911435-0da9-4aa9-9cf1-e9f491482254",
  "timestamp": "2026-10-17T16:33:19.636022",
  "source": "environment",
  "parent_id": "b2f62066-244d-4eac-a0dd-23a4422dfcd1",
  "tool_name": "get_pull_request_evidence_bundle",
  "tool_call_id": "call_347775fdd68f4c3086b4ba70",
  "observation": {
    "content": [
      {
        "cache_prompt": false,
        "type": "text",
        "text": "[Tool 'get_pull_request_evidence_bundle' executed.]"
      },
      {
        "cache_prompt": false,
        "type": "text",
        "text": "{\"pull_request\":{\"number\":16860,\"title\":\"feat(skills): replace the all-on skill catalog with an explicit allow-list\",\"summary\":\"HUMAN:\\r\\n\\r\\nEnable a set of reccomanded skills as default and not the whole package. \\r\\n\\r\\nAGENT:\\r\\n\\r\\nPhases 1 and 2 of the plan in #16302. Phase 0 (the `defaultEnabled` catalog flag and `DEFAULT_ENABLED_SKILL_NAMES`) shipped in OpenHands/extensions#485 and is already on `@openhands/extensions@0.18.0`, which this repo pins.\\r\\n\\r\\nEvidence below is a real run of the Customize page against the change, not just unit tests: 59 catalog skills render, 11 on, 48 off, and `add-javadoc` — the skill from the issue report — is among the 48.\\r\\n\\r\\n---\\r\\n\\r\\n## Why\\r\\n\\r\\nNothing is installed today. The whole `@openhands/extensions` catalog is baked into the bundle at build time and merged into `agent_context.skills` for every conversation, with `disabled_skills` as the only escape hatch. All-on-with-a-deny-list means every catalog addition is on by default for everyone, which is how @rbren ended up opted into javadoc and bitbucket skills. The cost isn't disk — it's ~60 skill bodies and 60 trigger sets competing in every system prompt.\\r\\n\\r\\n## Summary\\r\\n\\r\\n- `enabled_skills`: an allow-list **over the bundled catalog only**, defaulting to the 11 entries the catalog flags `defaultEnabled`. `disabled_skills` keeps its job for user- and project-authored skills, which are discovered at runtime from `.agents/skills/` and should be on the moment they appear. `src/utils/skill-enablement.ts` is the single place that decides which list a skill belongs to.\\r\\n- A one-shot migration at the app root (`useMigrateEnabledSkills`): a workspace whose deny-list names a catalog skill keeps everything else on (behaviour preserved); a fresh one gets the curated default; one that already has `enabled_skills` is untouched. Both branches persist an **explicit** list, which is what stops a later `defaultEnabled` addition from switching itself on. `undefined` is the \\\"never migrated\\\" sentinel, so it is deliberately kept out of `DEFAULT_SETTINGS` and out of the `use-settings` coercions.\\r\\n- A skill the opening message invokes by name (`/standup-digest:setup`, or `/<skill-name>` from the \\\"Use skill\\\" button) is loaded for that conversation whatever the lists say. Automation preset cards fill the input with exactly that command, and 18 of the catalog's 24 slash commands belong to skills that are off by default — without this the card would silently do nothing. Only the leading token counts.\\r\\n- Customize gets a \\\"Recommended\\\" badge and a matching facet; the Customize page and the conversation drawer, which each carried their own copy of the hydrate/auto-save/toggle logic, now share `useSkillEnablement` so one surface can't write a preference the other can't see.\\r\\n\\r\\n## Issue Number\\r\\n\\r\\nFixes #16302\\r\\n\\r\\n## How to Test\\r\\n\\r\\n```\\r\\nnpm ci\\r\\nVITE_FRONTEND_PORT=5199 npm run dev:mock\\r\\n# open http://localhost:5199/skills\\r\\n```\\r\\n\\r\\nExpect 59 skill cards with 11 enabled and 48 disabled, a `RECOMMENDATION` facet next to `STATE`, \\\"Recommended\\\" pills on the 11, and the notice under the page description. `add-javadoc` and the `bitbucket*` skills — the ones reported in #16302 — start off; toggling one on writes `enabled_skills`, not `disabled_skills` (visible in the PATCH `misc_settings_diff.app_preferences`).\\r\\n\\r\\nFor the migration: seed `disabled_skills` with a catalog name before first load and confirm the persisted `enabled_skills` is the whole catalog minus that name, not the curated default.\\r\\n\\r\\nAutomated:\\r\\n\\r\\n- `npx vitest run` → 5064 passed. One unrelated pre-existing failure, `dev-with-automation` SIGHUP cleanup, which fails the same way on an untouched `main`.\\r\\n- `npm run lint` and `npm run check-translation-completeness` clean; the 4 new keys are translated for all 15 locales.\\r\\n- New: `__tests__/utils/skill-enablement.test.ts` (resolve / deny-veto / every migration branch), `__tests__/hooks/use-migrate-enabled-skills.test.tsx` (one-shot, cloud skip, no write over a failed settings load), plus route and facet cases.\\r\\n- The two adapter tests that asserted `add-javadoc` reaches the agent context now assert the opposite — that flip **is** the fix.\\r\\n\\r\\n## Video/Screenshots\\r\\n\\r\\nCustomize → Skills, default state after the change. `STATE` reads Enabled 11 / Disabled 48; `add-javadoc` and `agent-creator` are off, `add-skill` / `agent-canvas-environment` / `agent-memory` are on and badged:\\r\\n\\r\\n![Skills page, 11 of 59 enabled by default](https://raw.githubusercontent.com/OpenHands/OpenHands/e5c848586bed65324d126314691f661e185b5139/.github/pr-assets/pr-16860-01-skills-default.png)\\r\\n\\r\\nThe new `RECOMMENDATION` facet, narrowed to Recommended — 11 results, all enabled:\\r\\n\\r\\n![Recommendation facet filtered to Recommended](https://raw.githubusercontent.com/OpenHands/OpenHands/e5c848586bed65324d126314691f661e185b5139/.github/pr-assets/pr-16860-02-recommended-facet.png)\\r\\n\\r\\n## Type\\r\\n\\r\\n- [ ] Bug fix\\r\\n- [x] Feature\\r\\n- [ ] Refactor\\r\\n- [ ] Breaking change\\r\\n- [ ] Docs / chore\\r\\n\\r\\n## Notes\\r\\n\\r\\nDeviations from the plan in the issue, worth a look at review:\\r\\n\\r\\n- **No `Core` tier.** The shaped spec asked for mutually exclusive `Core` / `Recommended` tags, which forces `core` to secretly mean \\\"core **and** default-on\\\". Grepping every catalog name against `src/` (minus i18n), exactly one skill is referenced by Canvas code — `add-skill`, via `/add-skill` and the restart banner — and disabling it degrades that flow rather than breaking Canvas. So: one flag, no locked toggles. If something genuinely unremovable appears later, the lock is a Canvas-side const and a union in one resolver.\\r\\n- **The deny-list still wins over the a\",\"state\":\"closed\",\"merged_at\":\"2026-08-24T18:53:41Z\",\"html_url\":\"https://github.com/OpenHands/OpenHands/pull/16860\",\"changed_files\":21,\"commits\":6,\"additions\":1128,\"deletions\":156},\"validation_evidence\":\"Automated:\\r\\n\\r\\n- `npx vitest run` → 5064 passed. One unrelated pre-existing failure, `dev-with-automation` SIGHUP cleanup, which fails the same way on an untouched `main`.\\r\\n- `npm run lint` and `npm run check-translation-completeness` clean; the 4 new keys are translated for all 15 locales.\\r\\n- New: `__tests__/utils/skill-enablement.test.ts` (resolve / deny-veto / every migration branch), `__tests__/hooks/use-migrate-enabled-skills.test.tsx` (one-shot, cloud skip, no write over a failed settings load), plus route and facet cases.\\r\\n- The two adapter tests that asserted `add-javadoc` reaches the agent context now assert the opposite — that flip **is** the fix.\\r\\n\\r\\n\",\"files\":[{\"filename\":\".github/pr-assets/pr-16860-01-skills-default.png\",\"status\":\"added\",\"changes\":0,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/.github%2Fpr-assets%2Fpr-16860-01-skills-default.png\"},{\"filename\":\".github/pr-assets/pr-16860-02-recommended-facet.png\",\"status\":\"added\",\"changes\":0,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/.github%2Fpr-assets%2Fpr-16860-02-recommended-facet.png\"},{\"filename\":\"__tests__/components/features/skills/skill-filter.test.ts\",\"status\":\"modified\",\"changes\":84,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Fcomponents%2Ffeatures%2Fskills%2Fskill-filter.test.ts\"},{\"filename\":\"__tests__/components/modals/skills/skill-modal.test.tsx\",\"status\":\"modified\",\"changes\":39,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Fcomponents%2Fmodals%2Fskills%2Fskill-modal.test.tsx\"},{\"filename\":\"__tests__/hooks/use-migrate-enabled-skills.test.tsx\",\"status\":\"added\",\"changes\":102,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Fhooks%2Fuse-migrate-enabled-skills.test.tsx\"},{\"filename\":\"__tests__/routes/skills-settings.test.tsx\",\"status\":\"modified\",\"changes\":133,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Froutes%2Fskills-settings.test.tsx\"},{\"filename\":\"__tests__/utils/skill-enablement.test.ts\",\"status\":\"added\",\"changes\":161,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Futils%2Fskill-enablement.test.ts\"},{\"filename\":\"src/api/agent-server-adapter.test.ts\",\"status\":\"modified\",\"changes\":77,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fapi%2Fagent-server-adapter.test.ts\"},{\"filename\":\"src/api/agent-server-adapter.ts\",\"status\":\"modified\",\"changes\":52,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fapi%2Fagent-server-adapter.ts\"},{\"filename\":\"src/api/settings-service/settings-service.api.ts\",\"status\":\"modified\",\"changes\":4,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fapi%2Fsettings-service%2Fsettings-service.api.ts\"},{\"filename\":\"src/components/features/conversation-panel/skills-modal.tsx\",\"status\":\"modified\",\"changes\":15,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fconversation-panel%2Fskills-modal.tsx\"},{\"filename\":\"src/components/features/conversation/conversation-overview-skills-panel.tsx\",\"status\":\"modified\",\"changes\":61,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fconversation%2Fconversation-overview-skills-panel.tsx\"},{\"filename\":\"src/components/features/skills/build-skill-pills.tsx\",\"status\":\"modified\",\"changes\":18,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fskills%2Fbuild-skill-pills.tsx\"},{\"filename\":\"src/components/features/skills/skill-filter.ts\",\"status\":\"modified\",\"changes\":69,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fskills%2Fskill-filter.ts\"},{\"filename\":\"src/hooks/use-migrate-enabled-skills.ts\",\"status\":\"added\",\"changes\":43,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fhooks%2Fuse-migrate-enabled-skills.ts\"},{\"filename\":\"src/hooks/use-skill-enablement.ts\",\"status\":\"added\",\"changes\":160,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fhooks%2Fuse-skill-enablement.ts\"},{\"filename\":\"src/i18n/translation.json\",\"status\":\"modified\",\"changes\":68,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fi18n%2Ftranslation.json\"},{\"filename\":\"src/routes/root-layout.tsx\",\"status\":\"modified\",\"changes\":3,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Froutes%2Froot-layout.tsx\"},{\"filename\":\"src/routes/skills-settings.tsx\",\"status\":\"modified\",\"changes\":64,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Froutes%2Fskills-settings.tsx\"},{\"filename\":\"src/types/settings.ts\",\"status\":\"modified\",\"changes\":7,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Ftypes%2Fsettings.ts\"},{\"filename\":\"src/utils/skill-enablement.ts\",\"status\":\"added\",\"changes\":124,\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Futils%2Fskill-enablement.ts\"}],\"important_file_patches\":[{\"filename\":\"src/hooks/use-skill-enablement.ts\",\"patch\":\"@@ -0,0 +1,160 @@\\n+import React from \\\"react\\\";\\n+import { useTranslation } from \\\"react-i18next\\\";\\n+import { useActiveBackend } from \\\"#/contexts/active-backend-context\\\";\\n+import { useSaveSettings } from \\\"#/hooks/mutation/use-save-settings\\\";\\n+import { useSettings } from \\\"#/hooks/query/use-settings\\\";\\n+import { I18nKey } from \\\"#/i18n/declaration\\\";\\n+import type { Settings, SkillInfo } from \\\"#/types/settings\\\";\\n+import { displayErrorToast } from \\\"#/utils/custom-toast-handlers\\\";\\n+import { retrieveAxiosErrorMessage } from \\\"#/utils/retrieve-axios-error-message\\\";\\n+import {\\n+  buildSkillEnablementFilter,\\n+  CATALOG_SKILL_NAMES,\\n+  isCatalogSkill,\\n+  resolveEnabledCatalogSkills,\\n+  type SkillEnablement,\\n+} from \\\"#/utils/skill-enablement\\\";\\n+\\n+/**\\n+ * Settings → the two lists. Cloud creates conversations from its own\\n+ * server-side catalog and never reads `enabled_skills`, so the catalog stays\\n+ * deny-list governed there.\\n+ */\\n+function readSkillEnablement(\\n+  settings: Settings | undefined,\\n+  usesCatalogAllowList: boolean,\\n+): SkillEnablement {\\n+  return {\\n+    enabledSkills: usesCatalogAllowList\\n+      ? settings?.enabled_skills\\n+      : [...CATALOG_SKILL_NAMES],\\n+    disabledSkills: settings?.disabled_skills ?? [],\\n+  };\\n+}\\n+\\n+/** Read-only view of the rule, for surfaces that list skills without toggling. */\\n+export function useSkillEnabledFilter(): (skill: SkillInfo) => boolean {\\n+  const { backend } = useActiveBackend();\\n+  const { data: settings } = useSettings();\\n+  const usesCatalogAllowList = backend.kind !== \\\"cloud\\\";\\n+\\n+  return React.useMemo(() => {\\n+    const isEnabled = buildSkillEnablementFilter(\\n+      readSkillEnablement(settings, usesCatalogAllowList),\\n+    );\\n+    return (skill: SkillInfo) => isEnabled(skill.name);\\n+  }, [\\n+    settings?.enabled_skills,\\n+    settings?.disabled_skills,\\n+    usesCatalogAllowList,\\n+  ]);\\n+}\\n+\\n+export interface SkillEnablementController {\\n+  isEnabled: (skill: SkillInfo) => boolean;\\n+  setEnabled: (skillName: string, enabled: boolean) => void;\\n+}\\n+\\n+/** Stable form of both lists, so an unchanged set can skip the save. */\\n+function snapshot(enablement: SkillEnablement): string {\\n+  return JSON.stringify([\\n+    [...resolveEnabledCatalogSkills(enablement)].sort(),\\n+    [...(enablement.disabledSkills ?? [])].sort(),\\n+  ]);\\n+}\\n+\\n+/** Same array reference when the membership already matches, to skip a save. */\\n+function withMembership(\\n+  list: string[],\\n+  name: string,\\n+  present: boolean,\\n+): string[] {\\n+  if (list.includes(na\",\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fhooks%2Fuse-skill-enablement.ts\"},{\"filename\":\"src/utils/skill-enablement.ts\",\"patch\":\"@@ -0,0 +1,124 @@\\n+import {\\n+  DEFAULT_ENABLED_SKILL_NAMES,\\n+  SKILLS_CATALOG,\\n+} from \\\"@openhands/extensions/skills\\\";\\n+\\n+/** Every skill bundled from `@openhands/extensions`, in catalog order. */\\n+export const CATALOG_SKILL_NAMES: readonly string[] = SKILLS_CATALOG.map(\\n+  (entry) => entry.name,\\n+);\\n+\\n+const CATALOG_SKILL_NAME_SET = new Set(CATALOG_SKILL_NAMES);\\n+const RECOMMENDED_SKILL_NAME_SET = new Set(DEFAULT_ENABLED_SKILL_NAMES);\\n+\\n+export function isCatalogSkill(name: string): boolean {\\n+  return CATALOG_SKILL_NAME_SET.has(name);\\n+}\\n+\\n+export function isRecommendedSkill(name: string): boolean {\\n+  return RECOMMENDED_SKILL_NAME_SET.has(name);\\n+}\\n+\\n+/**\\n+ * The two persisted lists. They cover different populations: `enabledSkills`\\n+ * allow-lists the bundled catalog, whose every future addition would otherwise\\n+ * be on for everyone (#16302), while `disabledSkills` keeps denying user- and\\n+ * project-authored skills, which should be on the moment they appear.\\n+ *\\n+ * `undefined` means \\\"never migrated\\\" and must survive settings hydration.\\n+ */\\n+export interface SkillEnablement {\\n+  enabledSkills?: string[];\\n+  disabledSkills?: string[];\\n+}\\n+\\n+export function resolveEnabledCatalogSkills(\\n+  enablement: SkillEnablement,\\n+): string[] {\\n+  return enablement.enabledSkills ?? [...DEFAULT_ENABLED_SKILL_NAMES];\\n+}\\n+\\n+/**\\n+ * The one rule for \\\"will this skill be loaded\\\", resolved once per caller so\\n+ * per-skill checks stay cheap.\\n+ *\\n+ * The deny-list still wins over the allow-list, which only matters before the\\n+ * migration runs: until then a pre-existing \\\"I turned this off\\\" lives in the\\n+ * deny-list alone.\\n+ */\\n+export function buildSkillEnablementFilter(\\n+  enablement: SkillEnablement,\\n+): (skillName: string) => boolean {\\n+  const enabled = new Set(resolveEnabledCatalogSkills(enablement));\\n+  const disabled = new Set(enablement.disabledSkills ?? []);\\n+\\n+  return (skillName) => {\\n+    if (disabled.has(skillName)) return false;\\n+    return !isCatalogSkill(skillName) || enabled.has(skillName);\\n+  };\\n+}\\n+\\n+/**\\n+ * One-shot conversion from \\\"all catalog skills on, minus a deny-list\\\" to an\\n+ * explicit allow-list; `undefined` once already migrated.\\n+ *\\n+ * A fresh workspace is migrated too, even though the resolver's fallback would\\n+ * give it the same set: persisting an explicit list is what stops a later\\n+ * `defaultEnabled` catalog addition from switching itself on.\\n+ */\\n+export function migrateSkillEnablement(\\n+  enablement: SkillEnablement,\\n+): { enabled_sk\",\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Futils%2Fskill-enablement.ts\"},{\"filename\":\"src/components/features/skills/skill-filter.ts\",\"patch\":\"@@ -11,21 +11,33 @@ import {\\n   SKILL_SCOPE_ORDER,\\n   type SkillScope,\\n } from \\\"#/utils/skill-scope\\\";\\n+import { isRecommendedSkill } from \\\"#/utils/skill-enablement\\\";\\n import { getSkillCardDescription } from \\\"./get-skill-card-description\\\";\\n \\n export const SKILL_FILTER_QUERY_PARAM = \\\"q\\\";\\n const SOURCE_PARAM = \\\"source\\\";\\n const CATEGORY_PARAM = \\\"category\\\";\\n const TYPE_PARAM = \\\"type\\\";\\n const STATE_PARAM = \\\"state\\\";\\n+const RECOMMENDATION_PARAM = \\\"recommendation\\\";\\n \\n export type SkillEnabledState = \\\"enabled\\\" | \\\"disabled\\\";\\n-export type SkillFacetGroupId = \\\"state\\\" | \\\"source\\\" | \\\"category\\\" | \\\"type\\\";\\n+export type SkillRecommendation = \\\"recommended\\\" | \\\"other\\\";\\n+export type SkillFacetGroupId =\\n+  | \\\"state\\\"\\n+  | \\\"recommendation\\\"\\n+  | \\\"source\\\"\\n+  | \\\"category\\\"\\n+  | \\\"type\\\";\\n \\n const SKILL_ENABLED_STATE_ORDER: readonly SkillEnabledState[] = [\\n   \\\"enabled\\\",\\n   \\\"disabled\\\",\\n ];\\n+const SKILL_RECOMMENDATION_ORDER: readonly SkillRecommendation[] = [\\n+  \\\"recommended\\\",\\n+  \\\"other\\\",\\n+];\\n const SKILL_TYPE_ORDER: readonly SkillType[] = [\\n   \\\"agentskills\\\",\\n   \\\"knowledge\\\",\\n@@ -38,6 +50,7 @@ export interface SkillFilterState {\\n   categories: Set<SkillCategoryId>;\\n   types: Set<SkillType>;\\n   states: Set<SkillEnabledState>;\\n+  recommendations: Set<SkillRecommendation>;\\n }\\n \\n export interface SkillFacetRowModel {\\n@@ -60,6 +73,7 @@ export const EMPTY_SKILL_FILTER_STATE: SkillFilterState = {\\n   categories: new Set(),\\n   types: new Set(),\\n   states: new Set(),\\n+  recommendations: new Set(),\\n };\\n \\n /** Carrying `labelKey`s rather than translated strings keeps this module pure, so its tests need no i18n. */\\n@@ -75,13 +89,16 @@ function labelledValues<TValue extends string>(\\n   return order.map((value) => ({ value, labelKey: labelKeys[value] }));\\n }\\n \\n+/** Resolving the two lists behind enablement is the caller's job, not this module's. */\\n+type SkillEnabledPredicate = (skill: SkillInfo) => boolean;\\n+\\n /** A new facet group is declared here and nowhere else: `selected` / `withSelected` are what keep every operation below driven by this table alone. */\\n interface GroupDef {\\n   id: SkillFacetGroupId;\\n   labelKey: I18nKey;\\n   param: string;\\n   values: readonly GroupValue[];\\n-  valueOf: (skill: SkillInfo, disabledSet: Set<string>) => string;\\n+  valueOf: (skill: SkillInfo, isEnabled: SkillEnabledPredicate) => string;\\n   selected: (state: SkillFilterState) => Set<string>;\\n   withSelected: (\\n     state: SkillFilterState,\\n@@ -114,20 +131,40 @@ const STATE_LABEL_KEYS: Record<SkillEnabledState, I18nKey> = {\\n\",\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src%2Fcomponents%2Ffeatures%2Fskills%2Fskill-filter.ts\"},{\"filename\":\"__tests__/utils/skill-enablement.test.ts\",\"patch\":\"@@ -0,0 +1,161 @@\\n+import { describe, expect, it } from \\\"vitest\\\";\\n+import {\\n+  DEFAULT_ENABLED_SKILL_NAMES,\\n+  SKILLS_CATALOG,\\n+} from \\\"@openhands/extensions/skills\\\";\\n+import {\\n+  buildSkillEnablementFilter,\\n+  findInvokedCatalogSkill,\\n+  isCatalogSkill,\\n+  isRecommendedSkill,\\n+  migrateSkillEnablement,\\n+  resolveEnabledCatalogSkills,\\n+  toSkillEnablement,\\n+} from \\\"#/utils/skill-enablement\\\";\\n+\\n+// Two anchors from the bundled catalog: `add-skill` carries `defaultEnabled`,\\n+// `add-javadoc` is the language-specific kind of skill OpenHands#16302 asked\\n+// not to be opted into.\\n+const RECOMMENDED = \\\"add-skill\\\";\\n+const OPTIONAL = \\\"add-javadoc\\\";\\n+const LOCAL = \\\"house-rules\\\";\\n+\\n+describe(\\\"catalog membership\\\", () => {\\n+  it(\\\"recognises bundled skills and ignores locally authored ones\\\", () => {\\n+    expect(isCatalogSkill(RECOMMENDED)).toBe(true);\\n+    expect(isCatalogSkill(OPTIONAL)).toBe(true);\\n+    expect(isCatalogSkill(LOCAL)).toBe(false);\\n+  });\\n+\\n+  it(\\\"marks only the catalog's default-enabled entries as recommended\\\", () => {\\n+    expect(isRecommendedSkill(RECOMMENDED)).toBe(true);\\n+    expect(isRecommendedSkill(OPTIONAL)).toBe(false);\\n+    expect(DEFAULT_ENABLED_SKILL_NAMES.length).toBeLessThan(\\n+      SKILLS_CATALOG.length,\\n+    );\\n+  });\\n+});\\n+\\n+describe(\\\"resolveEnabledCatalogSkills\\\", () => {\\n+  it(\\\"falls back to the curated default when nothing is persisted\\\", () => {\\n+    expect(resolveEnabledCatalogSkills({})).toEqual([\\n+      ...DEFAULT_ENABLED_SKILL_NAMES,\\n+    ]);\\n+  });\\n+\\n+  it(\\\"uses the persisted allow-list verbatim, empty list included\\\", () => {\\n+    expect(resolveEnabledCatalogSkills({ enabledSkills: [OPTIONAL] })).toEqual([\\n+      OPTIONAL,\\n+    ]);\\n+    expect(resolveEnabledCatalogSkills({ enabledSkills: [] })).toEqual([]);\\n+  });\\n+});\\n+\\n+describe(\\\"buildSkillEnablementFilter\\\", () => {\\n+  it(\\\"keeps user- and project-authored skills on unless denied\\\", () => {\\n+    expect(buildSkillEnablementFilter({ enabledSkills: [] })(LOCAL)).toBe(true);\\n+    expect(buildSkillEnablementFilter({ disabledSkills: [LOCAL] })(LOCAL)).toBe(\\n+      false,\\n+    );\\n+  });\\n+\\n+  it(\\\"requires a catalog skill to be on the allow-list\\\", () => {\\n+    expect(buildSkillEnablementFilter({})(OPTIONAL)).toBe(false);\\n+    expect(buildSkillEnablementFilter({})(RECOMMENDED)).toBe(true);\\n+    expect(\\n+      buildSkillEnablementFilter({ enabledSkills: [OPTIONAL] })(OPTIONAL),\\n+    ).toBe(true);\\n+  });\\n+\\n+  it(\\\"lets an unmigrated deny-list veto a default-enabled skill\\\", () => {\\n+    // Un\",\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Futils%2Fskill-enablement.test.ts\"},{\"filename\":\"__tests__/routes/skills-settings.test.tsx\",\"patch\":\"@@ -493,4 +493,137 @@ Full skill body.`,\\n \\n     expect(writeText).toHaveBeenCalledWith(ADD_SKILL_EXAMPLE_COMMAND);\\n   });\\n+  // A skill from the bundled `@openhands/extensions` catalog: those are\\n+  // governed by the `enabled_skills` allow-list, not the deny-list.\\n+  const CATALOG_RECOMMENDED = \\\"add-skill\\\";\\n+  const CATALOG_OPTIONAL = \\\"add-javadoc\\\";\\n+\\n+  it(\\\"shows the notice that skill changes only reach new conversations\\\", async () => {\\n+    vi.spyOn(SkillsService, \\\"getSkills\\\").mockResolvedValue([]);\\n+\\n+    renderSkillsSettingsScreen();\\n+\\n+    expect(\\n+      await screen.findByTestId(\\\"skills-new-conversation-notice\\\"),\\n+    ).toHaveTextContent(\\\"SETTINGS$SKILLS_NEW_CONVERSATION_NOTICE\\\");\\n+  });\\n+\\n+  it(\\\"badges a catalog skill the catalog recommends\\\", async () => {\\n+    vi.spyOn(SkillsService, \\\"getSkills\\\").mockResolvedValue([\\n+      buildSkill({ name: CATALOG_RECOMMENDED }),\\n+      buildSkill({ name: CATALOG_OPTIONAL }),\\n+    ]);\\n+\\n+    renderSkillsSettingsScreen();\\n+    await screen.findByTestId(`skill-card-${CATALOG_RECOMMENDED}`);\\n+\\n+    expect(\\n+      screen.getByTestId(`skill-recommended-${CATALOG_RECOMMENDED}`),\\n+    ).toHaveTextContent(\\\"SETTINGS$SKILLS_RECOMMENDED\\\");\\n+    expect(\\n+      screen.queryByTestId(`skill-recommended-${CATALOG_OPTIONAL}`),\\n+    ).not.toBeInTheDocument();\\n+  });\\n+\\n+  it(\\\"renders an unlisted catalog skill as off without it being denied\\\", async () => {\\n+    // The reported bug: everything in the catalog arrived switched on.\\n+    vi.spyOn(SkillsService, \\\"getSkills\\\").mockResolvedValue([\\n+      buildSkill({ name: CATALOG_OPTIONAL }),\\n+    ]);\\n+    vi.spyOn(SettingsService, \\\"getSettings\\\").mockResolvedValue(\\n+      buildSettings({ enabled_skills: undefined, disabled_skills: [] }),\\n+    );\\n+\\n+    renderSkillsSettingsScreen();\\n+    const card = await screen.findByTestId(`skill-card-${CATALOG_OPTIONAL}`);\\n+\\n+    expect(\\n+      within(card).getByTestId(`skill-toggle-${CATALOG_OPTIONAL}`),\\n+    ).toHaveAttribute(\\\"aria-checked\\\", \\\"false\\\");\\n+  });\\n+\\n+  it(\\\"writes nothing back when the user toggles nothing\\\", async () => {\\n+    // Persisting the hydrated state on mount would race the one-shot migration\\n+    // and could narrow a workspace it had just preserved.\\n+    vi.spyOn(SkillsService, \\\"getSkills\\\").mockResolvedValue([\\n+      buildSkill({ name: CATALOG_OPTIONAL }),\\n+    ]);\\n+    vi.spyOn(SettingsService, \\\"getSettings\\\").mockResolvedValue(\\n+      buildSettings({ enabled_skills: undefined, disabled_skills: [] }),\\n+    );\\n+    const saveSpy = \",\"blob_url\":\"https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__%2Froutes%2Fskills-settings.test.tsx\"}],\"commits\":[{\"sha\":\"b28af79ef06f6aedb449b56888ebe9b727c48939\",\"message\":\"feat(skills): allow-list bundled catalog skills instead of shipping all of them\",\"html_url\":\"https://github.com/OpenHands/OpenHands/commit/b28af79ef06f6aedb449b56888ebe9b727c48939\"},{\"sha\":\"0a76cb9b97e45f3abfbaa6c5b893e7baac89f250\",\"message\":\"feat(skills): surface the allow-list in Customize\",\"html_url\":\"https://github.com/OpenHands/OpenHands/commit/0a76cb9b97e45f3abfbaa6c5b893e7baac89f250\"},{\"sha\":\"e5c848586bed65324d126314691f661e185b5139\",\"message\":\"docs(skills): add PR screenshots for the skill allow-list\",\"html_url\":\"https://github.com/OpenHands/OpenHands/commit/e5c848586bed65324d126314691f661e185b5139\"},{\"sha\":\"8b8b31b8b7465b4a790f487d2bf956f259db8c37\",\"message\":\"fix(skills): load a catalog skill the opening slash command invokes\",\"html_url\":\"https://github.com/OpenHands/OpenHands/commit/8b8b31b8b7465b4a790f487d2bf956f259db8c37\"},{\"sha\":\"304d02c5d4a6a808296cb974bb99f2fe23bc8b7d\",\"message\":\"refactor(skills): share one enablement rule and trim the commentary\",\"html_url\":\"https://github.com/OpenHands/OpenHands/commit/304d02c5d4a6a808296cb974bb99f2fe23bc8b7d\"},{\"sha\":\"fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c\",\"message\":\"fix(skills): list only enabled skills in the conversation Skills modal\",\"html_url\":\"https://github.com/OpenHands/OpenHands/commit/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c\"}]}"
      }
    ],
    "is_error": false,
    "tool_name": "get_pull_request_evidence_bundle",
    "kind": "MCPToolObservation"
  },
  "action_id": "b2f62066-244d-4eac-a0dd-23a4422dfcd1",
  "extended_content": [],
  "kind": "ObservationEvent"
}

Tool request: terminal

{
  "command": "cat <<'EOF' | wc -w\nPR: OpenHands/OpenHands #16860 https://github.com/OpenHands/OpenHands/pull/16860 (merged, fixes #16302).\n1. Allow-list change. Replaces build-time all-catalog-on behavior with an explicit enabled_skills allow-list over the bundled @openhands/extensions catalog, defaulting to the 11 defaultEnabled entries; disabled_skills still governs user- and project-authored skills, and src/utils/skill-enablement.ts is the single rule source (deny-list wins; non-catalog skills stay on unless denied).\n2. Implementation files. src/utils/skill-enablement.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src/utils/skill-enablement.ts supplies CATALOG_SKILL_NAMES, buildSkillEnablementFilter, and one-shot migrateSkillEnablement. src/hooks/use-skill-enablement.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src/hooks/use-skill-enablement.ts shares hydrate/auto-save/toggle logic between the Customize page and the conversation drawer; cloud backends keep deny-list governance.\n3. Test runner. Per the upstream PR report: npx vitest run gives 5064 passed, one unrelated pre-existing dev-with-automation SIGHUP failure; npm run lint and npm run check-translation-completeness are clean; the 4 new keys are translated across all 15 locales.\n4. New tests. __tests__/utils/skill-enablement.test.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__/utils/skill-enablement.test.ts covers resolution, deny-veto, and every migration branch; __tests__/hooks/use-migrate-enabled-skills.test.tsx covers one-shot migration, cloud skip, and no write after a failed settings load; adapter assertions now exclude add-javadoc.\n5. Uncertainty. I personally ran no tests or live verification, relying only on the PR report. Cloud-side behavior (the server catalog never reads enabled_skills), slash-command loading, and the no-Core-tier deviation remain unverified.\nEOF",
  "is_input": false,
  "reset": false,
  "kind": "TerminalAction"
}

Full event evidence

{
  "id": "a5bce6f7-3b4e-49c7-bdc0-7041a4bd6681",
  "timestamp": "2026-10-17T16:33:55.504662",
  "source": "agent",
  "parent_id": "a3911435-0da9-4aa9-9cf1-e9f491482254",
  "thought": [],
  "reasoning_content": null,
  "thinking_blocks": [],
  "action": {
    "command": "cat <<'EOF' | wc -w\nPR: OpenHands/OpenHands #16860 https://github.com/OpenHands/OpenHands/pull/16860 (merged, fixes #16302).\n1. Allow-list change. Replaces build-time all-catalog-on behavior with an explicit enabled_skills allow-list over the bundled @openhands/extensions catalog, defaulting to the 11 defaultEnabled entries; disabled_skills still governs user- and project-authored skills, and src/utils/skill-enablement.ts is the single rule source (deny-list wins; non-catalog skills stay on unless denied).\n2. Implementation files. src/utils/skill-enablement.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src/utils/skill-enablement.ts supplies CATALOG_SKILL_NAMES, buildSkillEnablementFilter, and one-shot migrateSkillEnablement. src/hooks/use-skill-enablement.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src/hooks/use-skill-enablement.ts shares hydrate/auto-save/toggle logic between the Customize page and the conversation drawer; cloud backends keep deny-list governance.\n3. Test runner. Per the upstream PR report: npx vitest run gives 5064 passed, one unrelated pre-existing dev-with-automation SIGHUP failure; npm run lint and npm run check-translation-completeness are clean; the 4 new keys are translated across all 15 locales.\n4. New tests. __tests__/utils/skill-enablement.test.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__/utils/skill-enablement.test.ts covers resolution, deny-veto, and every migration branch; __tests__/hooks/use-migrate-enabled-skills.test.tsx covers one-shot migration, cloud skip, and no write after a failed settings load; adapter assertions now exclude add-javadoc.\n5. Uncertainty. I personally ran no tests or live verification, relying only on the PR report. Cloud-side behavior (the server catalog never reads enabled_skills), slash-command loading, and the no-Core-tier deviation remain unverified.\nEOF",
    "is_input": false,
    "reset": false,
    "kind": "TerminalAction"
  },
  "tool_name": "terminal",
  "tool_call_id": "call_83ff999f931b4bf7b0ff24d1",
  "tool_call": {
    "id": "call_83ff999f931b4bf7b0ff24d1",
    "name": "terminal",
    "arguments": "{\"command\": \"cat <<'EOF' | wc -w\\nPR: OpenHands/OpenHands #16860 https://github.com/OpenHands/OpenHands/pull/16860 (merged, fixes #16302).\\n1. Allow-list change. Replaces build-time all-catalog-on behavior with an explicit enabled_skills allow-list over the bundled @openhands/extensions catalog, defaulting to the 11 defaultEnabled entries; disabled_skills still governs user- and project-authored skills, and src/utils/skill-enablement.ts is the single rule source (deny-list wins; non-catalog skills stay on unless denied).\\n2. Implementation files. src/utils/skill-enablement.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src/utils/skill-enablement.ts supplies CATALOG_SKILL_NAMES, buildSkillEnablementFilter, and one-shot migrateSkillEnablement. src/hooks/use-skill-enablement.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/src/hooks/use-skill-enablement.ts shares hydrate/auto-save/toggle logic between the Customize page and the conversation drawer; cloud backends keep deny-list governance.\\n3. Test runner. Per the upstream PR report: npx vitest run gives 5064 passed, one unrelated pre-existing dev-with-automation SIGHUP failure; npm run lint and npm run check-translation-completeness are clean; the 4 new keys are translated across all 15 locales.\\n4. New tests. __tests__/utils/skill-enablement.test.ts https://github.com/OpenHands/OpenHands/blob/fae6ad8a0ccaaa5ec8f87aac36abe321e72fbb2c/__tests__/utils/skill-enablement.test.ts covers resolution, deny-veto, and every migration branch; __tests__/hooks/use-migrate-enabled-skills.test.tsx covers one-shot migration, cloud skip, and no write after a failed settings load; adapter assertions now exclude add-javadoc.\\n5. Uncertainty. I personally ran no tests or live verification, relying only on the PR report. Cloud-side behavior (the server catalog never reads enabled_skills), slash-command loading, and the no-Core-tier deviation remain unverified.\\nEOF\", \"summary\": \"Count words in draft answer with wc\"}",
    "origin": "completion"
  },
  "llm_response_id": "gen-1792272799-Dc5awszYen2Fp5AF42mL",
  "security_risk": "UNKNOWN",
  "summary": "Count words in draft answer with wc",
  "kind": "ActionEvent"
}

02D | Custom PR tool

You

Tool request: get_pull_request_evidence_bundle

Tool result: get_pull_request_evidence_bundle

Tool request: terminal

Tool result: terminal

Agent