feat(skills): scheduled dashboard + run/new pages + [github] preflight gate + composio-only GitHub I/O

.claude/memory.md

@@ -208,7 +208,11 @@ Quick reference for anyone starting with Claude on this project. Updated by the
 - **Core port** — `7788` (default; in-process inside Tauri host). Check with `lsof -i :7788`.
 - **`pnpm core:stage`** — no-op (sidecar removed in PR #1061). Use `pnpm dev:app` for full Tauri+core dev.
 - **Kill stuck processes** — `lsof -i :7788` then `kill <PID>`. Useful when `dev:app` reports a stale listener and you want to force a fresh boot rather than relying on the handle's auto-recovery.
-- **Skills runtime removed** — the QuickJS / `rquickjs` runtime is gone; `src/openhuman/skills/` is metadata-only ("Legacy skill metadata helpers retained after QuickJS runtime removal"). Skill execution surfaces are being rebuilt; don't assume a `.skill` can run end-to-end without checking the current code.
+- **Skills runtime rebuilt (PR #2707)** — QuickJS is gone, but skills now run as orchestrator-focused agents via `skills_run` RPC. Default skills live in `src/openhuman/skills/defaults/<id>/` with `skill.toml` + `SKILL.md`, registered in `registry.rs` `DEFAULT_SKILLS` const. Seeded into `<workspace>/skills/` on boot (idempotent, non-destructive). Bundled defaults: `github-issue-crusher`, `dev-workflow`. Skills run with 200 iteration cap and full web access.
+- **Codegraph tools (PR #2707)** — `codegraph_index` and `codegraph_search` registered in `src/openhuman/tools/ops.rs`. Implementation in `src/openhuman/codegraph/` — tree-sitter extraction, SQLite FTS5, dense embeddings, RRF fusion. Auto-indexes on first search.
+- **Tool names are exact** — Always check `src/openhuman/tools/ops.rs` for authoritative names. Key ones: `edit` (not `edit_file`), `composio` (not `composio_execute`), `codegraph_index`, `codegraph_search`.
+- **`cron_add` RPC** — Was missing from `schemas.rs` (only existed as agent tool). Now exposed as `openhuman.cron_add`. Frontend wrapper: `openhumanCronAdd()` in `app/src/utils/tauriCommands/cron.ts`.
+- **Worktree `pnpm build` rolldown fix** — Worktrees can miss `@rolldown/binding-darwin-arm64`. Fix: `pnpm install --force`.
 
 ## Artifacts Domain (Issue #2776)
 

app/src-tauri/src/lib.rs

@@ -2023,10 +2023,15 @@ fn append_platform_cef_gpu_workarounds(args: &mut Vec<CefCommandLineArg>, os: &s
     #[cfg(target_os = "linux")]
     {
         let uid = nix::unistd::getuid().as_raw();
-        if os == "linux" && linux_is_root_uid(uid) {
+        // Dev-only: also honor OPENHUMAN_CEF_NO_SANDBOX=1 so a non-root headless
+        // box (no sudo to chown chrome-sandbox root:4755) can launch over RDP.
+        let forced = std::env::var("OPENHUMAN_CEF_NO_SANDBOX")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(false);
+        if os == "linux" && (linux_is_root_uid(uid) || forced) {
             args.push(("--no-sandbox", None));
             log::info!(
-                "[cef-startup] running as root (uid=0) on Linux: adding --no-sandbox \
+                "[cef-startup] Linux: adding --no-sandbox (root uid or OPENHUMAN_CEF_NO_SANDBOX) \
                  (OPENHUMAN-TAURI-K1)"
             );
         }

app/src/AppRoutes.tsx

@@ -16,7 +16,9 @@ import Onboarding from './pages/onboarding/Onboarding';
 import Rewards from './pages/Rewards';
 import Routines from './pages/Routines';
 import Settings from './pages/Settings';
+import SkillNew from './pages/SkillNew';
 import Skills from './pages/Skills';
+import SkillsRun from './pages/SkillsRun';
 import WebCallbackPage from './pages/WebCallbackPage';
 import Welcome from './pages/Welcome';
 
@@ -80,6 +82,33 @@ const AppRoutes = () => {
         }
       />
 
+      {/* Skills lives at /skills with its 4 sub-tabs (Composio / Channels /
+          MCP Servers / Runners). The scheduled-skills dashboard concept
+          composes INSIDE the Runners sub-tab, not as a separate top-level
+          page — the bottom-bar "Connections" entry has always pointed at
+          /skills to surface Composio integrations + MCP, and that muscle
+          memory is restored here.
+          `/skills/new` is the create-a-skill authoring page.
+          Order matters: keep `/skills/new` before `/skills` so it wins the
+          prefix match. */}
+      <Route
+        path="/skills/new"
+        element={
+          <ProtectedRoute requireAuth={true}>
+            <SkillNew />
+          </ProtectedRoute>
+        }
+      />
+
+      <Route
+        path="/skills/run"
+        element={
+          <ProtectedRoute requireAuth={true}>
+            <SkillsRun />
+          </ProtectedRoute>
+        }
+      />
+
       <Route
         path="/skills"
         element={