Manage Skills Hub

Translate the user's requested Skill operation into the trusted skillshub-cli commands below. By default, an AI installation includes syncing to detected, enabled tools in Skills Hub; explicit user scope takes precedence. Keep device sync, automation, credentials, and application settings in the desktop app.

Resolve a trusted CLI before every workflow

1. Inspect ~/.skills-hub/bin without executing a binary. Only when that directory is completely absent, inspect ~/.skills-hub-dev/bin as the desktop development bridge. These desktop profiles share the Skill library, but keep credentials separate. On Windows expand the user's home directory and use skillshub-cli.exe; otherwise use skillshub-cli. Never switch to another bridge when the selected directory exists but fails validation.
2. If that bridge directory exists (including a broken link or inaccessible path), require a regular executable binary and both regular stamp files skillshub-cli.version and skillshub-cli.sha256 in that directory. Read only these public stamps. Validate a nonempty version and a 64-digit hexadecimal SHA-256 value, then compute the binary's SHA-256 with the platform's hashing utility and require an exact match. Reject symlinked stamps/binaries and unresolvable paths. Do not execute an unverified binary.
3. After hash validation, bind $CLI to that absolute binary path and run $CLI --json version. Require exit 0, ok: true, and data.version equal to the version stamp. Missing files, invalid stamps, mismatched hash/version, execution failure, and malformed output mean bridge damaged: fail closed, stop, and ask the user to open Settings → AI management in the desktop app and click Enable in one click to install or repair the CLI bridge. First-time installation or repair requires this explicit click; update the CLI and official Skill explicitly in Settings → AI management. Startup only checks status and does not update them. Never fall back to PATH when the bridge location exists but fails validation. Do not repair or edit stamps yourself.
4. Only when the desktop bridge directory is completely absent, resolve skillshub-cli from PATH for a CLI-only environment. Bind $CLI to the resolved absolute path and run $CLI --json version. If unavailable, explain installing Skills Hub and enabling AI management in Settings. Do not silently install software.

$CLI below denotes that verified executable, not a literal command or shell fragment. Pass arguments as distinct values; quote paths correctly and never evaluate user input as shell code. Read-only bridge inspection and hashing are the only filesystem work this workflow needs.

Interpret machine results

Use --json for every CLI invocation. Read successful JSON from stdout and failed JSON from stderr; inspect the exit status, ok, stable code, and structured details. Treat message as localized explanatory text, never as a parsing contract. Do not report success without a successful result and a CLI readback.

Exit codes: 0 success (including previews); 2 invalid arguments; 3 missing or ambiguous item; 4 safety/path/content conflict; 5 operation busy; 6 incompatible database; 7 network/authentication/source failure; 10 internal failure. Preserve unknown error codes and details rather than guessing. --json never implies confirmation.