Only hf-cli on by default; the user's skill choices kept across machines

Dockerfile

@@ -23,6 +23,10 @@ RUN UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin uv tool install --p
  && for skill in $(hf skills list -q 2>/dev/null | grep -vx 'hf-cli' | grep -Ev "${HF_SKILLS_EXCLUDE}"); do hf skills add "$skill" --global --force; done \
  && rm -rf /root/.claude /root/.cache/huggingface \
  && ls /root/.agents/skills
+# Only hf-cli is on by default; the other skills stay installed but off (sandbox/skill-defaults.py).
+ARG HF_SKILLS_ENABLED="hf-cli"
+COPY sandbox/skill-defaults.py /tmp/skill-defaults.py
+RUN python3 /tmp/skill-defaults.py /root/.agents/skills ${HF_SKILLS_ENABLED} && rm /tmp/skill-defaults.py
 
 # A real Chromium for Pi Web's Browser pane and the agent's browser_* tools (lib/browser): the
 # revision playwright-core 1.63.0 drives (Pi Web's own dependency), with the system libraries

piweb/hf-design.patch

@@ -468,6 +468,27 @@ index 0000000..0e30af4
 +export const PATCH = handle;
 +export const DELETE = handle;
 +export const OPTIONS = handle;
+diff --git a/app/api/skills/route.ts b/app/api/skills/route.ts
+index a503398..2feacc5 100644
+--- a/app/api/skills/route.ts
++++ b/app/api/skills/route.ts
+@@ -6,6 +6,7 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
+ import type { SkillToggleResult } from "@/lib/api-types";
+ import { loadSkillsWithInstallInfo } from "@/lib/skills-service";
+ import { setDisableModelInvocation } from "@/lib/skill-frontmatter";
++import { recordSkillChoice } from "@/lib/skill-choices";
+ import { getAllowedFileRoots, isExistingFilePathAllowed } from "@/lib/file-access";
+ 
+ export const dynamic = "force-dynamic";
+@@ -58,6 +59,8 @@ function toggleSkillFile(
+   const updated = setDisableModelInvocation(content, disableModelInvocation);
+   // A skill already in the requested state keeps its file and mtime.
+   if (updated !== content) writeFileSync(filePath, updated, "utf8");
++  // An image's skill comes back with the image's default on a new machine: keep the choice.
++  recordSkillChoice(filePath, !disableModelInvocation);
+   return null;
+ }
+ 
 diff --git a/app/api/terminal/[id]/events/route.ts b/app/api/terminal/[id]/events/route.ts
 index 92511c1..baeec2f 100644
 --- a/app/api/terminal/[id]/events/route.ts
@@ -32411,6 +32432,25 @@ index 38b6356..0000000
 -  }, [enabled, ready]);
 -  return ready;
 -}
+diff --git a/instrumentation-node.ts b/instrumentation-node.ts
+index cb2f025..2abf76e 100644
+--- a/instrumentation-node.ts
++++ b/instrumentation-node.ts
+@@ -21,4 +21,14 @@ export function registerNodeInstrumentation(): void {
+   // it overlaps the browser opening, and the routes reuse Node's cached module.
+   // A failure is left for the routes' own import to report.
+   import("@earendil-works/pi-coding-agent").catch(() => {});
++
++  // The skills a machine image installs come back with the image's defaults on a
++  // new machine: put the user's own choices back before any session loads them.
++  import("@/lib/skill-choices")
++    .then(({ applySkillChoices }) => {
++      const { applied, failed } = applySkillChoices();
++      if (applied.length) console.log(`[skills] kept choices applied: ${applied.join(", ")}`);
++      if (failed.length) console.warn(`[skills] could not apply the kept choice for: ${failed.join(", ")}`);
++    })
++    .catch(() => {});
+ }
 diff --git a/lib/browser/event-channel.test.mjs b/lib/browser/event-channel.test.mjs
 new file mode 100644
 index 0000000..90b7506
@@ -39559,6 +39599,190 @@ index 0000000..2f7cd39
 +  const ids: ShortcutId[] = ["terminal", "changes", "browser", "files", "expandPane", ...(mac ? ["closePane" as const] : [])];
 +  return ids.some((id) => isShortcut(event, id, mac));
 +}
+diff --git a/lib/skill-choices.test.mjs b/lib/skill-choices.test.mjs
+new file mode 100644
+index 0000000..fa03ef3
+--- /dev/null
++++ b/lib/skill-choices.test.mjs
+@@ -0,0 +1,74 @@
++import assert from "node:assert/strict";
++import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
++import { tmpdir } from "node:os";
++import path from "node:path";
++import test from "node:test";
++import { createJiti } from "jiti";
++
++const jiti = createJiti(import.meta.url, { alias: { "@": process.cwd() }, interopDefault: true });
++const { applySkillChoices, globalSkillNameOf, readSkillChoices, recordSkillChoice } = await jiti.import("./skill-choices.ts");
++
++function setup(t) {
++  const dir = mkdtempSync(path.join(tmpdir(), "pi-web-skill-choices-"));
++  t.after(() => rmSync(dir, { recursive: true, force: true }));
++  const root = path.join(dir, "home", ".agents", "skills");
++  const file = path.join(dir, "agent", "pi-web", "skill-choices.json");
++  const skill = (name, disabled) => {
++    mkdirSync(path.join(root, name), { recursive: true });
++    const p = path.join(root, name, "SKILL.md");
++    writeFileSync(p, `---\nname: ${name}\n${disabled ? "disable-model-invocation: true\n" : ""}description: ${name} skill\n---\n\n# ${name}\n`);
++    return p;
++  };
++  return { dir, root, file, skill };
++}
++
++const disabled = (p) => /disable-model-invocation: true/.test(readFileSync(p, "utf8"));
++
++test("only a skill under the global root gets a kept choice, symlinked or not", (t) => {
++  const { dir, root, file, skill } = setup(t);
++  const cli = skill("hf-cli", false);
++  assert.equal(globalSkillNameOf(cli, root), "hf-cli");
++  const link = path.join(dir, "agent", "skills", "hf-cli");
++  mkdirSync(path.dirname(link), { recursive: true });
++  symlinkSync(path.join(root, "hf-cli"), link);
++  assert.equal(globalSkillNameOf(path.join(link, "SKILL.md"), root), "hf-cli");
++  const own = path.join(dir, "agent", "skills", "mine", "SKILL.md");
++  mkdirSync(path.dirname(own), { recursive: true });
++  writeFileSync(own, "---\nname: mine\n---\n");
++  assert.equal(globalSkillNameOf(own, root), null);
++  recordSkillChoice(own, false, { root, file });
++  assert.deepEqual(readSkillChoices(file).skills, {});
++  assert.equal(globalSkillNameOf(path.join(root, "..", "elsewhere.md"), root), null);
++});
++
++test("choices are kept and applied over the image's defaults on a new machine", (t) => {
++  const { root, file, skill } = setup(t);
++  skill("hf-cli", false);
++  const datasets = skill("huggingface-datasets", true);
++  recordSkillChoice(path.join(root, "hf-cli", "SKILL.md"), false, { root, file });
++  recordSkillChoice(datasets, true, { root, file });
++  assert.deepEqual(readSkillChoices(file).skills, { "hf-cli": false, "huggingface-datasets": true });
++
++  // A new machine: the image's files again (hf-cli on, the rest off), a skill the user never touched, and one gone.
++  const cli = skill("hf-cli", false);
++  skill("huggingface-datasets", true);
++  const gradio = skill("huggingface-gradio", true);
++  recordSkillChoice(path.join(root, "huggingface-datasets", "SKILL.md"), true, { root, file });
++  writeFileSync(file, JSON.stringify({ version: 1, skills: { ...readSkillChoices(file).skills, removed: true, "../x": true } }));
++  const result = applySkillChoices({ root, file });
++  assert.deepEqual(result.applied.sort(), ["hf-cli", "huggingface-datasets"]);
++  assert.deepEqual(result.failed, []);
++  assert.equal(disabled(cli), true);
++  assert.equal(disabled(path.join(root, "huggingface-datasets", "SKILL.md")), false);
++  assert.equal(disabled(gradio), true, "an untouched skill keeps the image's default");
++  // Applying again changes nothing.
++  assert.deepEqual(applySkillChoices({ root, file }).applied, []);
++});
++
++test("a missing or broken choices file means no choices", (t) => {
++  const { file } = setup(t);
++  assert.deepEqual(readSkillChoices(file).skills, {});
++  mkdirSync(path.dirname(file), { recursive: true });
++  writeFileSync(file, "{not json");
++  assert.deepEqual(readSkillChoices(file).skills, {});
++});
+diff --git a/lib/skill-choices.ts b/lib/skill-choices.ts
+new file mode 100644
+index 0000000..51e8cd0
+--- /dev/null
++++ b/lib/skill-choices.ts
+@@ -0,0 +1,98 @@
++import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "fs";
++import { homedir } from "os";
++import path from "path";
++import { getAgentDir } from "@earendil-works/pi-coding-agent";
++import { setDisableModelInvocation } from "./skill-frontmatter";
++
++// A skill's on/off state is `disable-model-invocation` in its own SKILL.md. The
++// skills a machine image installs in ~/.agents/skills come back from the image
++// on every new machine, with the image's defaults, so an edit there alone is
++// lost. The user's explicit choices for them are also kept in the agent dir,
++// which a workspace keeps, and applied again when Pi Web starts.
++
++interface SkillChoices {
++  version: 1;
++  /** Skill directory name under ~/.agents/skills -> enabled. */
++  skills: Record<string, boolean>;
++}
++
++export function globalSkillsRoot(home = homedir()): string {
++  return path.join(home, ".agents", "skills");
++}
++
++export function skillChoicesFile(agentDir = getAgentDir()): string {
++  return path.join(agentDir, "pi-web", "skill-choices.json");
++}
++
++function real(target: string): string | null {
++  try {
++    return realpathSync(target);
++  } catch {
++    return null;
++  }
++}
++
++/** The skill's directory name when `filePath` is a skill under the global root (a symlink to one too). */
++export function globalSkillNameOf(filePath: string, root = globalSkillsRoot()): string | null {
++  const file = real(filePath);
++  const base = real(root);
++  if (!file || !base) return null;
++  const relative = path.relative(base, file);
++  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return null;
++  const [name, ...rest] = relative.split(path.sep);
++  return rest.length ? name : null;
++}
++
++export function readSkillChoices(file = skillChoicesFile()): SkillChoices {
++  try {
++    const parsed = JSON.parse(readFileSync(file, "utf8")) as Partial<SkillChoices>;
++    const skills: Record<string, boolean> = {};
++    for (const [name, enabled] of Object.entries(parsed.skills ?? {})) {
++      if (typeof enabled === "boolean" && /^[\w.-]+$/.test(name)) skills[name] = enabled;
++    }
++    return { version: 1, skills };
++  } catch {
++    return { version: 1, skills: {} };
++  }
++}
++
++/** Keeps the user's choice for a global skill they just toggled; other skills keep theirs in their own files. */
++export function recordSkillChoice(
++  filePath: string,
++  enabled: boolean,
++  options: { root?: string; file?: string } = {},
++): void {
++  const name = globalSkillNameOf(filePath, options.root);
++  if (!name) return;
++  const file = options.file ?? skillChoicesFile();
++  const choices = readSkillChoices(file);
++  if (choices.skills[name] === enabled) return;
++  choices.skills[name] = enabled;
++  mkdirSync(path.dirname(file), { recursive: true });
++  const tmp = `${file}.${process.pid}.tmp`;
++  writeFileSync(tmp, `${JSON.stringify(choices, null, 2)}\n`, "utf8");
++  renameSync(tmp, file);
++}
++
++/** Applies the kept choices to the global skills present; a skill no longer installed is left in the file. */
++export function applySkillChoices(options: { root?: string; file?: string } = {}): { applied: string[]; failed: string[] } {
++  const root = options.root ?? globalSkillsRoot();
++  const { skills } = readSkillChoices(options.file);
++  const applied: string[] = [];
++  const failed: string[] = [];
++  for (const [name, enabled] of Object.entries(skills)) {
++    const skillFile = path.join(root, name, "SKILL.md");
++    if (!existsSync(skillFile)) continue;
++    try {
++      const content = readFileSync(skillFile, "utf8");
++      const updated = setDisableModelInvocation(content, !enabled);
++      if (updated !== content) {
++        writeFileSync(skillFile, updated, "utf8");
++        applied.push(name);
++      }
++    } catch {
++      failed.push(name);
++    }
++  }
++  return { applied, failed };
++}
 diff --git a/lib/step-summary.test.mjs b/lib/step-summary.test.mjs
 new file mode 100644
 index 0000000..6cbe005

sandbox/AGENTS.md

@@ -11,7 +11,7 @@ You run inside a disposable Hugging Face Sandbox (a container on HF Jobs, in the
 
 ## Hugging Face
 
-- The Hugging Face CLI `hf` is installed, and Hugging Face skills are in `~/.agents/skills` (`hf-cli`, `huggingface-spaces`, `huggingface-datasets`, `huggingface-llm-trainer`, `huggingface-gradio`, ...). Use them for anything on the Hub.
+- The Hugging Face CLI `hf` is installed, with its skill `hf-cli`: use it for anything on the Hub. More Hugging Face skills (Spaces, datasets, training, Gradio, ...) are installed but off unless the user turned them on in Settings > Skills; the ones that are on are among your skills.
 - The Space lends the token of the user's sign-in to this machine: `~/.cache/huggingface/token` holds their scoped, expiring token, so `hf`, `huggingface_hub` and `git` (clone and push on huggingface.co) act as that user, within the permissions they granted. Check with `hf auth whoami`. The token is renewed in place; read the file when you need it rather than copying it.
 - If there is no token, the user has taken it back or their sign-in lapsed: do the rest of the work, then tell them to choose *Sign in again* or *Lend my token* in the Workspace menu (bottom of the sidebar), after which the token appears within seconds. Do not run `hf auth login` and never ask for a token in the chat.
 - Never print, log, copy or commit the token. For tools that only read `HF_TOKEN`, pass it for that command: `HF_TOKEN=$(cat ~/.cache/huggingface/token) node script.mjs`.

sandbox/skill-defaults.py

@@ -0,0 +1,18 @@
+"""skill-defaults.py <skills dir> <enabled skill>...: the image's skill defaults. The listed skills are on,
+every other one is off (`disable-model-invocation: true`: not offered to the model, still usable as
+/skill:<name>, and turned on in Pi Web's Settings > Skills). Pi Web keeps a user's own choices in the agent
+dir and puts them back on every new machine (lib/skill-choices.ts)."""
+import pathlib, re, sys
+
+root, enabled = pathlib.Path(sys.argv[1]), set(sys.argv[2:])
+skills = sorted(root.glob("*/SKILL.md"))
+assert any(p.parent.name in enabled for p in skills), f"none of {sorted(enabled)} in {root}"
+for skill in skills:
+    name, text = skill.parent.name, skill.read_text()
+    head = re.match(r"\A---[ \t]*\n(.*?\n)---", text, re.S)
+    assert head, f"{name}: no frontmatter"
+    body = re.sub(r"(?m)^disable-model-invocation:.*\n", "", head.group(1))
+    if name not in enabled:
+        body += "disable-model-invocation: true\n"
+    skill.write_text(text[: head.start(1)] + body + text[head.end(1):])
+    print("on " if name in enabled else "off", name)