Fix extension activation, live model list, and ship bundled skills

extensions/spockify/bundled-skills/commit/SKILL.md

@@ -0,0 +1,15 @@
+---
+title: Commit messages
+category: git
+tags: [git, commit]
+---
+# Commit messages
+
+Write a commit message for the current changes.
+
+1. Run `git status` and `git diff` (or use the git tools) to see exactly what changed.
+2. Subject line: imperative mood, ≤72 chars, no trailing period. Example: `Fix model list falling back to catalog`.
+3. Body (if needed): what changed and why, not a file list. Wrap at ~72.
+4. Mention breaking changes or follow-ups explicitly.
+
+Do not invent changes that are not in the diff. Do not include secrets.

extensions/spockify/bundled-skills/debug/SKILL.md

@@ -0,0 +1,17 @@
+---
+title: Systematic debugging
+category: engineering
+tags: [debug, bugs, errors]
+---
+# Systematic debugging
+
+When the user reports a bug or unexpected behavior:
+
+1. **Reproduce** — confirm the exact steps, input, and expected vs actual result. Ask if unclear.
+2. **Locate** — use `grep`, `glob_file_search`, and `read_file` to find the relevant code. Do not guess.
+3. **Hypothesize** — state one concrete hypothesis and the evidence for it.
+4. **Verify** — read the surrounding code, check diagnostics (`read_diagnostics`), and run a focused test or command if it will confirm the hypothesis.
+5. **Fix the cause** — change the smallest amount of code that fixes the root cause. Avoid drive-by refactors.
+6. **Prove it** — re-run the failing case or the relevant test. Summarize what was wrong and why the fix works.
+
+Never claim a fix works without checking. If you cannot reproduce, say so and ask for a minimal example.

extensions/spockify/bundled-skills/docs/SKILL.md

@@ -0,0 +1,16 @@
+---
+title: Write documentation
+category: docs
+tags: [docs, readme]
+---
+# Write documentation
+
+Write docs that a new teammate can use.
+
+1. Start with what it is and when to use it.
+2. Show the shortest working example.
+3. Document options, defaults, and failure modes that actually matter.
+4. Keep it accurate to the current code. Read the implementation; do not invent flags.
+5. Prefer updating existing docs over creating parallel ones.
+
+Use plain language. Short paragraphs. Code samples that can be copied.

extensions/spockify/bundled-skills/explain/SKILL.md

@@ -0,0 +1,16 @@
+---
+title: Explain code
+category: learning
+tags: [explain, docs]
+---
+# Explain code
+
+Explain so a competent teammate can follow.
+
+1. One-sentence summary of what this does.
+2. How it fits in (who calls it, what it returns, what it depends on).
+3. Walk through the important path with the actual names from the code.
+4. Call out non-obvious decisions, invariants, and failure modes.
+5. If helpful, a tiny example of input → output.
+
+Do not restate every line. Skip boilerplate. If something is unclear in the code, say so.

extensions/spockify/bundled-skills/refactor/SKILL.md

@@ -0,0 +1,17 @@
+---
+title: Safe refactor
+category: engineering
+tags: [refactor, cleanup]
+---
+# Safe refactor
+
+Refactor without changing behavior.
+
+1. State the goal (simpler, smaller, clearer, faster) in one sentence.
+2. Identify the exact scope. Do not expand it.
+3. Make sure there is a way to verify behavior (existing tests, or a small characterization check).
+4. Change in small steps. Prefer renaming and extracting over rewriting.
+5. After each meaningful step, re-check that behavior is unchanged.
+6. Summarize what moved and what stayed the same.
+
+Do not mix feature work into a refactor. If you spot a bug, call it out separately.

extensions/spockify/bundled-skills/review/SKILL.md

@@ -0,0 +1,23 @@
+---
+title: Code review
+category: engineering
+tags: [review, quality]
+---
+# Code review
+
+Review the requested code (or the current diff) with this checklist. Lead with the most important findings.
+
+- **Correctness** — logic errors, off-by-one, unhandled cases, race conditions
+- **Security** — injection, authz gaps, secret leakage, unsafe deserialization
+- **Error handling** — swallowed errors, missing fallbacks, bad error messages
+- **API / contracts** — breaking changes, unclear types, missing validation
+- **Tests** — missing coverage for the changed behavior
+- **Clarity** — names, structure, comments that explain why (not what)
+
+Format findings as:
+- **Severity** (blocker / should-fix / nit)
+- **Where** (file:line)
+- **What** and **why**
+- **Suggested fix** (short)
+
+End with a one-line verdict: approve, approve with nits, or request changes.

extensions/spockify/bundled-skills/security/SKILL.md

@@ -0,0 +1,19 @@
+---
+title: Security review
+category: security
+tags: [security, review]
+---
+# Security review
+
+Review the relevant code for security issues. Prioritize real risks over style.
+
+Check for:
+- Injection (SQL, command, template, path traversal)
+- Authn/authz gaps and insecure direct object references
+- Secret handling (hard-coded keys, logging tokens, insecure storage)
+- Unsafe deserialization and prototype pollution
+- XSS / CSRF where web-facing
+- Dependency and supply-chain red flags in the changed files
+- Overly broad permissions or missing input validation
+
+Report each finding with severity, location, impact, and a concrete remediation. If nothing notable, say so clearly.

extensions/spockify/bundled-skills/test/SKILL.md

@@ -0,0 +1,15 @@
+---
+title: Write and run tests
+category: engineering
+tags: [test, tdd]
+---
+# Write and run tests
+
+1. Identify the behavior to lock in (happy path + one or two important edge cases).
+2. Match the project's existing test style and runner. Look for `package.json` scripts, `pytest.ini`, `go.mod`, etc.
+3. Write the failing test first when practical.
+4. Implement the minimum code to make it pass.
+5. Run the specific test (not the whole suite unless asked).
+6. Report the command you ran and the result.
+
+Prefer focused unit tests. Add an integration test only when the behavior crosses a real boundary.

extensions/spockify/package.json

@@ -1,8 +1,8 @@
 {
   "name": "spockify",
   "displayName": "Spockify",
-  "description": "Self-hosted coding assistant for open-weight models — chat, Tab, Ctrl+K, Composer, and Agents on your stack.",
-  "version": "1.0.7",
+  "description": "Self-hosted coding assistant for open-weight models \u2014 chat, Tab, Ctrl+K, Composer, and Agents on your stack.",
+  "version": "1.0.11",
   "publisher": "spockify",
   "license": "MIT",
   "icon": "media/spockify-icon.png",
@@ -508,12 +508,12 @@
       },
       {
         "command": "spockify.labAgents.run",
-        "title": "Spockify: Lab Agents (orch → exec)",
+        "title": "Spockify: Lab Agents (orch \u2192 exec)",
         "category": "Spockify"
       },
       {
         "command": "spockify.labAgents.models",
-        "title": "Spockify: Lab Agents — Show Models",
+        "title": "Spockify: Lab Agents \u2014 Show Models",
         "category": "Spockify"
       },
       {
@@ -650,7 +650,7 @@
       },
       {
         "command": "spockify.agent.resume",
-        "title": "Spockify: Resume removed — send again",
+        "title": "Spockify: Resume removed \u2014 send again",
         "category": "Spockify"
       },
       {
@@ -1026,7 +1026,7 @@
         "spockify.baseUrl": {
           "type": "string",
           "default": "http://127.0.0.1:3080",
-          "markdownDescription": "Spockify **product root** (not `/v1` — the IDE appends `/v1`). Default local compose Open WebUI: `http://127.0.0.1:3080`. Point this at any Spockify or OpenAI-compatible root. Tab/FIM needs Open WebUI on this URL, not router `:4100`. User keys: chat **Settings → Account → API key** (not LiteLLM `/ui/`)."
+          "markdownDescription": "Spockify **product root** (not `/v1` \u2014 the IDE appends `/v1`). Default local compose Open WebUI: `http://127.0.0.1:3080`. Point this at any Spockify or OpenAI-compatible root. Tab/FIM needs Open WebUI on this URL, not router `:4100`. User keys: chat **Settings \u2192 Account \u2192 API key** (not LiteLLM `/ui/`)."
         },
         "spockify.provider": {
           "type": "string",
@@ -1037,7 +1037,7 @@
           ],
           "enumDescriptions": [
             "HTTP to the base URL you configure (self-hosted Spockify or OpenAI-compatible)",
-            "Local-only stub — not for production yet"
+            "Local-only stub \u2014 not for production yet"
           ]
         },
         "spockify.defaultModel": {
@@ -1060,14 +1060,14 @@
           "default": 4,
           "minimum": 1,
           "maximum": 16,
-          "markdownDescription": "Max parallel executor workers per round for **Spockify: Lab Agents (orch → exec)** (CLI: `--workers`)."
+          "markdownDescription": "Max parallel executor workers per round for **Spockify: Lab Agents (orch \u2192 exec)** (CLI: `--workers`)."
         },
         "spockify.lab.maxRounds": {
           "type": "number",
           "default": 5,
           "minimum": 1,
           "maximum": 20,
-          "markdownDescription": "Max plan→exec→review rounds for **Lab Agents** (CLI: `--max-rounds`)."
+          "markdownDescription": "Max plan\u2192exec\u2192review rounds for **Lab Agents** (CLI: `--max-rounds`)."
         },
         "spockify.lab.harnessRoot": {
           "type": "string",
@@ -1113,7 +1113,7 @@
             "strict"
           ],
           "enumDescriptions": [
-            "Read-only — mutating tools (apply/terminal/write) blocked",
+            "Read-only \u2014 mutating tools (apply/terminal/write) blocked",
             "Full tools; terminal still uses terminalAgent.policy",
             "Only tools listed in spockify.agent.strictAllowlist"
           ],
@@ -1124,7 +1124,7 @@
           "default": 48,
           "minimum": 2,
           "maximum": 80,
-          "markdownDescription": "Max model↔tool iterations for **Agent** / Composer / Chat Agent (SWE-style long horizon). Ask mode stays short (~12). Raise toward 80 for hard multi-file fixes. CLI: `--max-turns` / `SPOCKIFY_MAX_TURNS`; `--yolo` defaults higher."
+          "markdownDescription": "Max model\u2194tool iterations for **Agent** / Composer / Chat Agent (SWE-style long horizon). Ask mode stays short (~12). Raise toward 80 for hard multi-file fixes. CLI: `--max-turns` / `SPOCKIFY_MAX_TURNS`; `--yolo` defaults higher."
         },
         "spockify.agentPermissionMode": {
           "type": "string",
@@ -1135,9 +1135,9 @@
             "autoRunReviewFiles"
           ],
           "enumDescriptions": [
-            "Allow all (unsandboxed) — auto-approve shell and file edits (YOLO)",
-            "Ask every time — confirm shell commands and review file edits",
-            "Auto-run tools, review file edits — shell auto-runs; Accept / Reject patches in the editor (default)"
+            "Allow all (unsandboxed) \u2014 auto-approve shell and file edits (YOLO)",
+            "Ask every time \u2014 confirm shell commands and review file edits",
+            "Auto-run tools, review file edits \u2014 shell auto-runs; Accept / Reject patches in the editor (default)"
           ],
           "markdownDescription": "Composer tool/file permission mode (Cursor-like). Default **autoRunReviewFiles** (fewer mid-loop Approves). **Ask** agent mode stays read-only. **Plan** still gates mutators until approved. **YOLO:** set `allowAll` (+ optionally raise `spockify.agent.maxTurns`). Legacy `spockify.runAllUnsandboxed` maps to `allowAll` when true."
         },
@@ -1175,13 +1175,13 @@
             "heavy"
           ],
           "enumDescriptions": [
-            "Never send think= — any model is OK",
+            "Never send think= \u2014 any model is OK",
             "Low effort, fast/cheap single worker",
             "Balanced auto route (single worker)",
             "High effort, best single thinking model (default for Agent / gpt-oss-120b)",
-            "High effort + 4-agent ensemble (Explorer/Analyst/Builder → Skeptic)"
+            "High effort + 4-agent ensemble (Explorer/Analyst/Builder \u2192 Skeptic)"
           ],
-          "markdownDescription": "Thinking cycle (Off → Low → Medium → High → Heavy). Off omits think=. Heavy is high effort plus the parallel ensemble. Default High for IDE Agent."
+          "markdownDescription": "Thinking cycle (Off \u2192 Low \u2192 Medium \u2192 High \u2192 Heavy). Off omits think=. Heavy is high effort plus the parallel ensemble. Default High for IDE Agent."
         },
         "spockify.chat.pipeline.enabled": {
           "type": "boolean",
@@ -1265,7 +1265,7 @@
           "type": "number",
           "default": 30,
           "minimum": 0,
-          "description": "Base debounce before Ghost Tab LLM complete (adaptive ~15–80ms; local heuristics skip debounce)."
+          "description": "Base debounce before Ghost Tab LLM complete (adaptive ~15\u201380ms; local heuristics skip debounce)."
         },
         "spockify.completions.adaptiveDebounce": {
           "type": "boolean",
@@ -1281,7 +1281,7 @@
         "spockify.completions.logLatency": {
           "type": "boolean",
           "default": true,
-          "description": "Log Tab complete latency to Output → Spockify."
+          "description": "Log Tab complete latency to Output \u2192 Spockify."
         },
         "spockify.completions.warmOnStartup": {
           "type": "boolean",
@@ -1480,12 +1480,12 @@
             "custom"
           ],
           "enumDescriptions": [
-            "Read-only: ls/git status/rg/cat — no writes or installs.",
+            "Read-only: ls/git status/rg/cat \u2014 no writes or installs.",
             "Read + test/typecheck/build scripts (npm test, pytest, cargo check).",
             "Dev + install/build pipelines (npm ci, make, docker build).",
             "Use only the custom allowlist array (no seeded tier)."
           ],
-          "markdownDescription": "Seeded allowlist **tier** for Claude Code–class autonomy. Unioned with `spockify.terminalAgent.allowlist` unless tier is `custom`. Dangerous patterns are never allowed."
+          "markdownDescription": "Seeded allowlist **tier** for Claude Code\u2013class autonomy. Unioned with `spockify.terminalAgent.allowlist` unless tier is `custom`. Dangerous patterns are never allowed."
         },
         "spockify.terminalAgent.allowlist": {
           "type": "array",
@@ -1507,14 +1507,14 @@
           "type": "number",
           "default": 300000,
           "minimum": 1000,
-          "description": "Timeout for captured shell commands (milliseconds). Default 300s — raise for long builds. Chat terminal_run uses the same default unless timeoutMs is passed in the tool call."
+          "description": "Timeout for captured shell commands (milliseconds). Default 300s \u2014 raise for long builds. Chat terminal_run uses the same default unless timeoutMs is passed in the tool call."
         },
         "spockify.terminalAgent.maxTurns": {
           "type": "number",
           "default": 48,
           "minimum": 2,
           "maximum": 80,
-          "description": "Max agent loop turns for Terminal Agent (plan → execute → adapt). Higher for Claude Code–class long-horizon runs."
+          "description": "Max agent loop turns for Terminal Agent (plan \u2192 execute \u2192 adapt). Higher for Claude Code\u2013class long-horizon runs."
         },
         "spockify.terminalAgent.openTranscript": {
           "type": "boolean",
@@ -1524,7 +1524,7 @@
         "spockify.terminalAgent.planApproval": {
           "type": "boolean",
           "default": true,
-          "markdownDescription": "Claude Code–class **plan gate**: model drafts a numbered plan first; you Approve / Edit / Skip before tools run. Ask policy still applies to each command."
+          "markdownDescription": "Claude Code\u2013class **plan gate**: model drafts a numbered plan first; you Approve / Edit / Skip before tools run. Ask policy still applies to each command."
         },
         "spockify.terminalAgent.showPolicyBadge": {
           "type": "boolean",
@@ -1544,7 +1544,7 @@
             "Linux: bubblewrap --unshare-net on captured terminal_run. Full filesystem; no outbound network. Needs host or AppImage-bundled bwrap.",
             "Linux: workspace-only writable bind (system paths read-only). **Network allowed** (curl, pip, health checks). Needs bwrap. Does not use --unshare-net."
           ],
-          "markdownDescription": "Optional **OS sandbox** for captured agent shell (not integrated-terminal sendText, not Remote SSH). Uses host `bwrap` when present, else AppImage `resources/helpers/bwrap` when bundled. Default **off** — ask policy unchanged. Prefer **workspace** when opting in. Run **Spockify: Check OS Sandbox**."
+          "markdownDescription": "Optional **OS sandbox** for captured agent shell (not integrated-terminal sendText, not Remote SSH). Uses host `bwrap` when present, else AppImage `resources/helpers/bwrap` when bundled. Default **off** \u2014 ask policy unchanged. Prefer **workspace** when opting in. Run **Spockify: Check OS Sandbox**."
         },
         "spockify.terminalAgent.osSandboxFailClosed": {
           "type": "boolean",
@@ -1564,14 +1564,15 @@
   "dependencies": {
     "@spockify/codebase": "file:../../packages/spockify-codebase",
     "@spockify/harness": "file:../../packages/spockify-harness",
+    "@spockify/harness-host": "file:../../packages/spockify-harness-host",
     "@spockify/ide-client": "file:../../packages/spockify-ide-client",
     "@spockify/mcp": "file:../../packages/spockify-mcp",
-    "@spockify/shadow-workspace": "file:../../packages/spockify-shadow-workspace",
-    "@spockify/harness-host": "file:../../packages/spockify-harness-host"
+    "@spockify/shadow-workspace": "file:../../packages/spockify-shadow-workspace"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",
     "@types/vscode": "^1.85.0",
+    "esbuild": "^0.28.2",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0"
   }

extensions/spockify/src/account/register.ts

@@ -66,13 +66,25 @@ export function registerAccountCommands(
     vscode.commands.registerCommand('spockify.listModels', async () => {
       const transport = await getTransport();
       if (!transport) {
+        void vscode.window.showErrorMessage(
+          'Not connected. Use Spockify: Sign In or set base URL + API key, then try again.',
+        );
         return;
       }
-      const models = await transport.listModels({ ossOnly: true });
+      let models = await transport.listModels({ ossOnly: true });
+      if (!models.length) {
+        models = await transport.listModels({ ossOnly: false });
+      }
       const ids = models.map((m) => m.id);
       output.appendLine(`models (${ids.length}): ${ids.join(', ')}`);
+      if (!ids.length) {
+        void vscode.window.showWarningMessage(
+          'Connected, but the server returned no models. Check your base URL and that models are loaded on the stack.',
+        );
+        return;
+      }
       void vscode.window.showInformationMessage(
-        `Spockify: ${ids.length} OSS models (Output → Spockify)`,
+        `Spockify: ${ids.length} models — ${ids.slice(0, 8).join(', ')}${ids.length > 8 ? '…' : ''} (full list in Output → Spockify)`,
       );
     }),
   );