mcp-config: sync shared opencode skills from the repo

Models and MCP servers are discovered from the LiteLLM gateway at sync time
(/v1/models, and the aggregate /mcp/ endpoint). Skills have no gateway side to
query: LiteLLM's /v1/skills is a passthrough to Anthropic's Skills API, which
lists skills on an Anthropic account rather than serving skill files, and
/public/skill_hub is a marketplace catalog. So the repo is the source of truth
and the tree is fetched whole, from the repo tarball.

Deploy to ~/.config/mcp-sync/skills rather than ~/.config/opencode/skills so
the atomic replace can never delete a skill the user wrote by hand; opencode
picks the tree up via skills.paths, which expands {env:HOME} — verified — so
the shared config stays identical for every user.

Same throttle and non-fatal discipline as the config sync: a fetch that yields
no skills/ leaves the last-good tree in place instead of emptying it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mcp-config/sync.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env sh
 # mcp-sync — refresh the shared LiteLLM-gateway opencode config on the laptop,
-# auto-discover the gateway's models, and export the user's LiteLLM key.
+# auto-discover the gateway's models, deploy the shared skills, and export the
+# user's LiteLLM key.
 #
 # Sourced from the user's shell rc (installed by install.sh) so it runs at the
 # start of every interactive shell ("session start"). It is intentionally:
@@ -19,12 +20,18 @@
 #      (opencode cannot list models from a custom provider itself; the map
 #      must be materialized client-side.) MCP servers need no discovery step:
 #      the single /mcp/ endpoint aggregates every server the key can access.
-#   3. Drop the result at ~/.config/opencode/opencode.gateway.json and export
+#   3. Deploy the repo's skills/ tree to ~/.config/mcp-sync/skills. Skills are
+#      plain files, so there is nothing on the gateway to discover — the repo
+#      IS the source of truth, and the tree is fetched whole (repo tarball).
+#      They land in mcp-sync's OWN directory, not ~/.config/opencode/skills,
+#      so the atomic replace below can never eat a skill the user wrote by
+#      hand; opencode picks them up via skills.paths in the shared config.
+#   4. Drop the result at ~/.config/opencode/opencode.gateway.json and export
 #      OPENCODE_CONFIG pointing at it. opencode does NOT auto-load extra files
 #      in its config dir — it only merges known locations, and OPENCODE_CONFIG
 #      is merged between the global opencode.json and any project config. The
 #      user's own opencode.json and local-only MCP servers are never touched.
-#   4. Export LITELLM_KEY from ~/.config/mcp-sync/key so {env:LITELLM_KEY}
+#   5. Export LITELLM_KEY from ~/.config/mcp-sync/key so {env:LITELLM_KEY}
 #      resolves.
 
 # --- config (overridable via env before sourcing) -------------------------
@@ -35,6 +42,13 @@ MCP_SYNC_KEYFILE="${MCP_SYNC_KEYFILE:-$MCP_SYNC_HOME/key}"
 # Provider whose models are auto-discovered, and the gateway base URL.
 MCP_SYNC_PROVIDER="${MCP_SYNC_PROVIDER:-covert-gpt}"
 MCP_SYNC_GATEWAY="${MCP_SYNC_GATEWAY:-https://llm.covert-gpt.com}"
+# Skills. A skill is a folder of files, so unlike the config there is no single
+# raw URL to pull — we take the repo tarball and lift out its skills/ subtree.
+# Set MCP_SYNC_SKILLS_SRC to a local directory (or file://) to sync from a
+# working checkout instead; see zsh/zshrc.local.example.
+MCP_SYNC_SKILLS_SRC="${MCP_SYNC_SKILLS_SRC:-https://git.nic-oconnor.com/public/dotfiles/archive/main.tar.gz}"
+MCP_SYNC_SKILLS_SUBDIR="${MCP_SYNC_SKILLS_SUBDIR:-skills}"
+MCP_SYNC_SKILLS_DEST="${MCP_SYNC_SKILLS_DEST:-$MCP_SYNC_HOME/skills}"
 # Throttle: only re-sync if the deployed copy is older than this many seconds
 # (default 1h). Keeps every new shell from hammering Gitea/the gateway.
 MCP_SYNC_TTL="${MCP_SYNC_TTL:-3600}"
@@ -130,11 +144,63 @@ PYEOF
   [ -n "$_base" ] && rm -f "$_base"
 }
 
+# --- deploy the shared skills tree (throttled, non-fatal) ------------------
+_mcp_sync_skills() {
+  # Same TTL as the config, tracked on the deployed directory's own mtime.
+  if [ -d "$MCP_SYNC_SKILLS_DEST" ] && command -v find >/dev/null 2>&1; then
+    if find "$MCP_SYNC_SKILLS_DEST" -maxdepth 0 -mmin -"$(( MCP_SYNC_TTL / 60 ))" 2>/dev/null | grep -q .; then
+      return 0
+    fi
+  fi
+
+  mkdir -p "$MCP_SYNC_HOME" 2>/dev/null || return 0
+  # Stage inside MCP_SYNC_HOME (not /tmp) so the publish below is a same-
+  # filesystem rename rather than a copy that can be seen half-finished.
+  _work="$(mktemp -d "$MCP_SYNC_HOME/.skills.XXXXXX" 2>/dev/null)" || return 0
+
+  _tree=""
+  case "$MCP_SYNC_SKILLS_SRC" in
+    /*|file://*)
+      # Working checkout: the source is the skills/ dir itself.
+      _tree="${MCP_SYNC_SKILLS_SRC#file://}"
+      ;;
+    *)
+      if command -v curl >/dev/null 2>&1 && command -v tar >/dev/null 2>&1 &&
+         curl -fsS -m 15 "$MCP_SYNC_SKILLS_SRC" -o "$_work/repo.tgz" 2>/dev/null &&
+         [ -s "$_work/repo.tgz" ] &&
+         mkdir -p "$_work/x" && tar -xzf "$_work/repo.tgz" -C "$_work/x" 2>/dev/null
+      then
+        # Gitea wraps the archive in a single top-level dir whose name we don't
+        # want to hardcode; find the skills/ subtree instead of assuming depth.
+        _tree="$(find "$_work/x" -maxdepth 2 -type d -name "$MCP_SYNC_SKILLS_SUBDIR" 2>/dev/null | head -1)"
+      fi
+      ;;
+  esac
+  if [ -z "$_tree" ] || [ ! -d "$_tree" ]; then rm -rf "$_work"; return 0; fi
+
+  mkdir -p "$_work/stage" 2>/dev/null || { rm -rf "$_work"; return 0; }
+  cp -R "$_tree/." "$_work/stage/" 2>/dev/null || { rm -rf "$_work"; return 0; }
+  # Never replace a good tree with an empty one (truncated fetch, empty subdir).
+  if [ -z "$(ls -A "$_work/stage" 2>/dev/null)" ]; then rm -rf "$_work"; return 0; fi
+
+  # Publish: swap the new tree in, keeping the old one until the move lands so a
+  # failure leaves the previous skills intact rather than no skills at all.
+  rm -rf "$MCP_SYNC_SKILLS_DEST.old" 2>/dev/null
+  if [ -d "$MCP_SYNC_SKILLS_DEST" ]; then
+    mv "$MCP_SYNC_SKILLS_DEST" "$MCP_SYNC_SKILLS_DEST.old" 2>/dev/null || { rm -rf "$_work"; return 0; }
+  fi
+  if ! mv "$_work/stage" "$MCP_SYNC_SKILLS_DEST" 2>/dev/null; then
+    mv "$MCP_SYNC_SKILLS_DEST.old" "$MCP_SYNC_SKILLS_DEST" 2>/dev/null
+  fi
+  rm -rf "$MCP_SYNC_SKILLS_DEST.old" "$_work" 2>/dev/null
+}
+
 _mcp_sync_export_key
 _mcp_sync_refresh
+_mcp_sync_skills
 
 # opencode only merges config from known locations; point OPENCODE_CONFIG at
 # the synced file so it is layered on top of the user's global opencode.json.
 [ -f "$MCP_SYNC_DEST" ] && export OPENCODE_CONFIG="$MCP_SYNC_DEST"
 
-unset -f _mcp_sync_export_key _mcp_sync_refresh 2>/dev/null || true
+unset -f _mcp_sync_export_key _mcp_sync_refresh _mcp_sync_skills 2>/dev/null || true