feat(tui): Add /skill lifecycle commands for installed AgentSkills

[sjathin]

• A human has tested these changes.

---

Why

The CLI exposes /skills for viewing loaded resources but has no command surface for managing installed AgentSkills. The SDK now has a public lifecycle API (install_skill, list_installed_skills, enable_skill, disable_skill, uninstall_skill, update_skill)
that the CLI should expose.

Summary

• Add /skill command family with install, list, enable, disable, uninstall, and update subcommands wrapping the SDK's openhands.sdk.skills API
• Add prefix-matching in command validation so /skill install foo is recognized as a valid command, and argument parsing in InputField._parse_command()
• Bump openhands-sdk and openhands-tools from 1.17.0 to 1.18.1 to fix the end-to-end path where installed skills were not loaded by load_user_skills() (fixes software-agent-sdk#2882 ([Bug]: install_skill() installed skills not loaded by load_user_skills() — directory depth mismatch software-agent-sdk#2882))
• Add 40 tests: unit tests (mocked success/error/not-found for all subcommands), command validation, argument parsing, a full lifecycle integration test, and a regression test verifying load_user_skills() sees installed skills

Issue Number

Closes #582 (#582)

How to Test

1. Launch the TUI: uv run openhands
2. Type /skill and press Enter → should show help with all subcommands
3. Create a test skill:

 mkdir -p /tmp/pirate-mode
 cat > /tmp/pirate-mode/SKILL.md << 'EOF'
 ---
 name: pirate-mode
 description: Forces the agent to respond like a pirate
 ---
 # Pirate Mode Skill
 You MUST respond in pirate speak. Start every response with "Ahoy, matey!" and end with "Arrr!".
 EOF

4. In the TUI:
   - /skill install /tmp/pirate-mode → "Installed skill 'pirate-mode'"
   - /skill list → shows "✓ enabled pirate-mode"
   - /skill disable pirate-mode → "Disabled skill 'pirate-mode'"
   - /skill list → shows "✗ disabled pirate-mode"
   - /skill enable pirate-mode → "Enabled skill 'pirate-mode'"
   - /skill uninstall pirate-mode → "Uninstalled skill 'pirate-mode'"
   - /skill list → "No installed skills"

Video/Screenshots

Manual TUI testing performed with a local pirate-mode test skill:

Verification

make lint # passes
make test # 1068 passed (1 pre-existing failure unrelated to this PR)
uv run pytest tests/tui/core/test_skill_commands.py -v # 40/40 passed

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

• The /skill commands use lazy imports (from openhands.sdk.skills import ... inside each handler) so the CLI doesn't break if the SDK version doesn't have the skills API yet.
• SDK bumped to v1.18.1 which includes the fix for load_user_skills() not scanning the installed/ subdirectory (software-agent-sdk#2882 ([Bug]: install_skill() installed skills not loaded by load_user_skills() — directory depth mismatch software-agent-sdk#2882)). The "Restart your session to load the new skill" message is now
  accurate.

[enyst]

Thank you! Lets see what my agent thinks too

@OpenHands Do a /codereview /codereview-roasted on this PR. Post your feedback as a review with gh api and event.

[openhands-ai]

I'm on it! enyst can track my progress at all-hands.dev

[enyst]

🔴 Needs improvement

[CRITICAL ISSUES]

• [openhands_cli/tui/core/skill_commands.py] Breaking user expectation: with the SDK version currently locked in this repo, install_skill() writes to ~/.openhands/skills/installed/<name> but load_user_skills() still does not load from there. I reproduced this in a temp HOME: after install, list_installed_skills() returned [("pirate-mode", True)] while load_user_skills() returned []. That means /skill install succeeds on paper but the installed skill never becomes active, and the new success text (Restart your session to load/apply) is false today.

[TESTING GAPS]

• [tests/tui/core/test_skill_commands.py] Real code path not covered: the integration test only checks the installed-skill metadata APIs with a custom installed_dir; it never exercises load_user_skills() or the CLI's actual loaded-resource path, so it misses the regression above.

[RISK ASSESSMENT]

• [Overall PR] ⚠️ Risk Assessment: 🟡 MEDIUM
  This is a small, localized TUI change, but it exposes a new user-facing command family whose success path currently does not produce a usable installed skill with the SDK version under test. That is a behavior-risk issue, not just a test gap.

VERDICT:
❌ Needs rework: either pair this with the SDK loader fix / version bump, or make the CLI explicitly detect and warn about the current incompatibility instead of claiming restart will apply the skill.

KEY INSIGHT:
The command surface is fine; the broken piece is the end-to-end data path — installed skills are written to one place and loaded from another.

This review was generated by an AI assistant (OpenHands) on behalf of the user.

[openhands-ai]

Done — I completed the requested PR review workflow.

• Retrieved PR feat(tui): Add /skill lifecycle commands for installed AgentSkills #680 context, linked issue [CLI] Feature Request: Support /skill lifecycle commands for installed AgentSkills #582, and the code diff.
• Reviewed the implementation and tests for the new /skill lifecycle commands.
• Reproduced a blocking end-to-end issue with the current SDK in this repo:
  • install_skill() installs into ~/.openhands/skills/installed/...
  • load_user_skills() still does not load from that location
  • result: installed skills are listed but not actually loaded after restart
• Posted a GitHub review via gh api with REQUEST_CHANGES.
• Added inline review comments on:
  • openhands_cli/tui/core/skill_commands.py
  • tests/tui/core/test_skill_commands.py

Conciseness check:

• No code changes were made.
• No extraneous repository modifications were introduced.
• The work was limited to analysis, local reproduction, and posting the requested review.

Net result:

• The user’s request was fully addressed.
• The review was submitted as CHANGES_REQUESTED because the feature currently has a real user-visible gap with the SDK version under test, and the existing integration test does not catch it.

[sjathin]

@enyst

Thanks for the comments. I have addressed the following:

1. Bumped openhands-sdk and openhands-tools to v1.18.1 which includes the loader fix (software-agent-sdk#2884). load_user_skills() now calls load_installed_skills() internally, so the end-to-end path works.
2. Added a regression test (test_load_user_skills_sees_installed_skill) that installs a skill to a temp dir, mocks USER_SKILLS_DIRS and DEFAULT_INSTALLED_SKILLS_DIR, then asserts load_user_skills() returns the installed skill.

[cbagwell]

If you merge in main/rebase on top of main, it will now get even newer SDK v1.19.0.

[sjathin]

@cbagwell @enyst - Thanks for letting me know. Updated the PR.