[anhtahaylove]

Summary

Two borrow outcomes leave agents without a next step in the skill references:

• confirmation_ui_unavailable: the CLI hint says to report it, but the agent cannot tell the user what to change. listConfirmationCandidates in apps/extension/src/tools/borrow-confirmation.ts only accepts the active tab of a normal, non-Agent window whose URL passes isInjectableContentScriptUrl (http/https, not an extension store). The new text says exactly that: ask the user to bring an ordinary http(s) page to the front of a user window, then retry once. It also notes that opening a tab does not help, since task tabs live in the Agent Window, which is excluded.
• not_found on tab borrow: the tab is gone. Agents tended to open a replacement tab and lose the logged-in state the task depended on. The new text asks them to have the user reopen it instead.

Both the CLI skill and the DSH plugin skill get the same guidance, in each file's existing style. Docs only; no behavior change.

Context

We hit both outcomes running an agent on Windows: once no user window could host the prompt, and once a borrowed tab had been closed between steps. Without guidance the agent kept trying workarounds (new tabs, blank pages) instead of asking the user. These notes in our local copy of the skill fixed that.

Checks

• node scripts/check-skill-bundles.mjs: both bundles valid
• node --test scripts/check-skill-bundles.test.mjs: 6/6 pass
• node scripts/check-crate-skill.mjs: pass
• cargo test -p bsk --lib --test skill_install_legacy --locked skill_install: 51 + 5 pass

Note: on Windows those skill_install tests read the real Hermes install when HERMES_HOME or %LOCALAPPDATA%\hermes exists, and fail if that copy has local edits. They pass once both are pointed at an empty directory. I left that alone here; happy to open a separate issue if useful.