feat: add experimental support for remote skills and commands via wellknown

[elithrar]

Adds support for centralized skill and command directories served via .well-known/opencode endpoints. Enterprises can host shared skills and commands that are automatically discovered when users authenticate to a wellknown endpoint.

Changes

• Add WellKnown utility module (src/util/wellknown.ts) for fetching and caching remote resources
• Extend skill loading (src/skill/skill.ts) to discover and lazily fetch remote skills
• Extend command loading (src/command/index.ts) to discover and lazily fetch remote commands
• Add experimental.remote_skills and experimental.remote_commands config flags
• Add opencode auth refresh [url] command to refresh cached wellknown data

new .well-known Response

{
  "auth": {
    "command": ["company-auth", "token"],
    "env": "COMPANY_TOKEN"
  },
  "config": {
    "enterprise": { "url": "https://enterprise.example.com" }
  },
  "skills": {
    "web-perf": {
      "description": "Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals, identifies render-blocking resources, and accessibility gaps.",
      "url": "https://enterprise.example.com/.well-known/opencode/skills/web-perf/SKILL.md"
    },
    "gitlab": {
      "description": "Use for GitLab repos. Provides glab CLI commands for MRs, CI/CD, and issues.",
      "url": "https://enterprise.example.com/.well-known/opencode/skills/gitlab/SKILL.md"
    },
    "gh": {
      "description": "GitHub CLI workflows. Use for creating PRs, managing issues, and working with GitHub Actions.",
      "url": "https://enterprise.example.com/.well-known/opencode/skills/gh/SKILL.md"
    }
  },
  "commands": {
    "deploy": {
      "description": "Deploy to production via internal CI",
      "url": "https://enterprise.example.com/.well-known/opencode/commands/deploy.md"
    }
  }
}

Server Directory Structure

/.well-known/
└── opencode/
    ├── opencode.json              # or served dynamically at /.well-known/opencode
    ├── skills/
    │   ├── web-perf/
    │   │   └── SKILL.md
    │   ├── gitlab/
    │   │   └── SKILL.md
    │   └── gh/
    │       └── SKILL.md
    └── commands/
        └── deploy.md

Usage

# Authenticate
opencode auth login https://enterprise.example.com

# Refresh remote skills/commands cache
opencode auth refresh

# Use skills/commands by their plain name
/deploy

# If there's a local collision, remote is namespaced
/enterprise.example.com:deploy

Disable via Config

{
  "experimental": {
    "remote_skills": false,
    "remote_commands": false
  }
}

Out of Scope

Progressive disclosure for remote skills:

• for local skills, the agent can use the Read tool to access supporting files (reference.md, scripts/, etc.) relative to the skill's base directory.
• this doesn't work for remote skills since the agent can't fetch arbitrary URLs.
• could potentially add a files: [] array or support for fetching related files? or use WebFetch?

[rekram1-node]

Dax will review this one