lidge-jun · paopaonyapi-creator · Sep 15, 2026 · Sep 15, 2026
@@ -11,6 +11,9 @@ import CodexSet from "./pages/CodexSet";
 import Integrations from "./pages/Integrations";
 import Startup from "./pages/Startup";
 import RemoteWorkspace from "./pages/RemoteWorkspace";
+import { Skills } from "./pages/Skills";
+import { Security } from "./pages/Security";
+import { Credentials } from "./pages/Credentials";
 import ErrorBoundary from "./components/ErrorBoundary";
 import { SidebarGithubRow } from "./components/sidebar-github-row";
 import { IconGrid, IconServer, IconBoxes, IconBot, IconList, IconActivity, IconHardDrive, IconCodex, IconMenu, IconSun, IconMoon, IconMonitor, IconGlobe, IconPower, IconX, IconRefresh} from "./icons";
@@ -33,6 +36,9 @@ const PAGE_TKEY: Record<Page, TKey> = {
   providers: "nav.providers",
   models: "nav.models",
   subagents: "nav.subagents",
+  skills: "nav.skills",
+  security: "nav.security",
+  credentials: "nav.credentials",
   logs: "nav.logs",
   usage: "nav.usage",
   storage: "nav.storage",
@@ -447,6 +453,9 @@ export default function App() {
                 {page === "providers" && <Providers apiBase={sharedBase} />}
                 {page === "models" && <Models key={sharedBase} apiBase={sharedBase} restartEpoch={codexRestartEpoch} />}
                 {page === "subagents" && <Subagents key={sharedBase} apiBase={sharedBase} />}
+                {page === "skills" && <Skills apiBase={sharedBase} />}
+                {page === "security" && <Security apiBase={sharedBase} />}
+                {page === "credentials" && <Credentials apiBase={sharedBase} />}
                 {page === "logs" && <Logs apiBase={sharedBase} />}
                 {page === "usage" && <Usage apiBase={sharedBase} connected={targets.connected} apiKeyId={targets.apiKeyId} />}
                 {page === "storage" && <Storage apiBase={sharedBase} />}

@@ -8,6 +8,9 @@ export type Page =
   | "providers"
   | "models"
   | "subagents"
+  | "skills"
+  | "security"
+  | "credentials"
   | "logs"
   | "usage"
   | "storage"
@@ -21,6 +24,9 @@ export const VALID_PAGES = new Set<Page>([
   "providers",
   "models",
   "subagents",
+  "skills",
+  "security",
+  "credentials",
   "logs",
   "usage",
   "storage",
@@ -107,11 +113,52 @@ export const INTEGRATION_TAB_HASHES = [
   "integrations/cline",
 ] as const;
 
+export const SKILLS_TAB_HASHES = [
+  "skills/marketplace",
+  "skills/registry",
+  "skills/editor",
+  "skills/matrix",
+  "skills/agents",
+  "skills/nodes",
+  "skills/drift",
+  "skills/reviews",
+  "skills/audit",
+] as const;
+
+export const SECURITY_TAB_HASHES = [
+  "security/authorizations",
+  "security/scopes",
+  "security/campaigns",
+  "security/approvals",
+  "security/findings",
+  "security/evidence",
+  "security/skills",
+  "security/tools",
+  "security/mcp",
+  "security/policies",
+  "security/audit",
+] as const;
+
+export const CREDENTIALS_TAB_HASHES = [
+  "credentials/list",
+  "credentials/providers",
+  "credentials/oauth",
+  "credentials/pool",
+  "credentials/health",
+  "credentials/quota",
+  "credentials/policies",
+  "credentials/approvals",
+  "credentials/audit",
+] as const;
+
 export function hashBelongsToPage(rawHash: string, page: Page): boolean {
   return rawHash === page
     || (page === "logs" && rawHash === "logs/debug")
     || (page === "codex-set" && rawHash === "codex-set/prompt")
     || (page === "models" && (MODELS_TAB_HASHES as readonly string[]).includes(rawHash))
+    || (page === "skills" && (SKILLS_TAB_HASHES as readonly string[]).includes(rawHash))
+    || (page === "security" && (SECURITY_TAB_HASHES as readonly string[]).includes(rawHash))
+    || (page === "credentials" && (CREDENTIALS_TAB_HASHES as readonly string[]).includes(rawHash))
     || (page === "dashboard"
       && (rawHash === DASHBOARD_UPDATE_HASH || (DASHBOARD_TAB_HASHES as readonly string[]).includes(rawHash)))
     || (page === "integrations"

@@ -66,6 +66,9 @@ export const de: Record<TKey, string> = {
   "nav.models": "Modelle",
   "nav.combos": "Combos",
   "nav.subagents": "Sub-Agenten",
+  "nav.skills": "Skills",
+  "nav.security": "Sicherheit",
+  "nav.credentials": "Anmeldedaten",
 
   // routing intelligence
   "routing.title": "Routing-Intelligenz (beta)",
@@ -2840,4 +2843,221 @@ export const de: Record<TKey, string> = {
   "remote.event.status": "Status",
   "remote.event.tool": "Remote-Werkzeug",
   "remote.event.error": "Fehler",
+  "skills.title": "Skill-Steuerungsebene",
+  "skills.subtitle": "Universelles Agent-Skill-Register, visueller Marktplatz und richtliniengesteuerte Bereitstellung.",
+  "skills.refresh": "Aktualisieren",
+  "skills.refreshing": "Aktualisiere…",
+  "skills.tab.overview": "Übersicht",
+  "skills.tab.marketplace": "Marktplatz",
+  "skills.tab.registry": "Register ({count})",
+  "skills.tab.editor": "Skill-Editor",
+  "skills.tab.matrix": "Bereitstellungsmatrix",
+  "skills.tab.agents": "Agenten",
+  "skills.tab.nodes": "Remote-Knoten",
+  "skills.tab.drift": "Drift und Rollback",
+  "skills.tab.reviews": "Prüfwarteschlange",
+  "skills.tab.audit": "Prüfprotokoll",
+  "skills.card.registered": "Registrierte Skills",
+  "skills.card.deployments": "Aktive Bereitstellungen",
+  "skills.card.marketplace": "Marktplatz-Einträge",
+  "skills.card.audit": "Prüfereignisse",
+  "skills.recentActivity": "Aktuelle Steuerungsebenen-Aktivität",
+  "skills.noEvents": "Keine aktuellen Ereignisse aufgezeichnet.",
+  "skills.col.timestamp": "Zeitstempel",
+  "skills.col.event": "Ereignis",
+  "skills.col.actor": "Akteur",
+  "skills.col.target": "Ziel",
+  "skills.searchPlaceholder": "Öffentlichen skills.sh-Katalog durchsuchen…",
+  "skills.byAuthor": "v{version} von {author}",
+  "skills.verified": "Verifiziert",
+  "skills.importToRegistry": "Ins Register importieren",
+  "skills.emptyRegistry": "Noch keine Skills registriert. Importieren Sie einen vom Marktplatz oder aus einem lokalen Ordner.",
+  "skills.col.skill": "Skill",
+  "skills.col.version": "Version",
+  "skills.col.status": "Status",
+  "skills.col.risk": "Risiko",
+  "skills.col.tags": "Tags",
+  "skills.col.actions": "Aktionen",
+  "skills.publish": "Veröffentlichen",
+  "skills.deployCodex": "Nach Codex bereitstellen",
+  "skills.editorTitle": "SKILL.md-Editor",
+  "skills.editorNamePlaceholder": "Skill-Name",
+  "skills.editorVersionPlaceholder": "Version",
+  "skills.editorDefaultName": "Benutzerdefinierter Assistent",
+  "skills.editorDefaultMarkdown": "---\nname: custom-assistant\ndisplayName: Custom Assistant\nversion: 1.0.0\ndescription: Custom guidance procedure.\ntags: custom, utility\n---\n\n# Custom Assistant\n\nInstructions for the agent.\n",
+  "skills.saveDraft": "Entwurf speichern",
+  "skills.previewTitle": "Live-Vorschau",
+  "skills.matrixTitle": "Flotten-Bereitstellungsmatrix",
+  "skills.agent.codex": "Codex",
+  "skills.agent.claudeCode": "Claude Code",
+  "skills.agent.opencode": "OpenCode",
+  "skills.agent.universal": "Universal",
+  "skills.notInstalled": "Nicht installiert",
+  "skills.inSync": "v{version} synchron",
+  "skills.blocked": "Blockiert",
+  "skills.agentsTitle": "Ziel-Agentenflotte",
+  "skills.col.agent": "Agent",
+  "skills.col.userRoot": "Zielwurzel (Benutzerbereich)",
+  "skills.col.projectRoot": "Zielwurzel (Projektbereich)",
+  "skills.col.adapterVersion": "Adapterversion",
+  "skills.agent.openaiCodex": "OpenAI Codex",
+  "skills.agent.universalAgent": "Universeller Agent",
+  "skills.statusReady": "Bereit",
+  "skills.nodesTitle": "Remote-Ausführungsknoten (SSH)",
+  "skills.nodesHelp": "Verwalten Sie Remote-VPS, GPU-Worker und Entwicklungshosts mit strikter Host-Key-Pinning.",
+  "skills.col.node": "Knoten",
+  "skills.col.type": "Typ",
+  "skills.col.host": "Host",
+  "skills.col.environment": "Umgebung",
+  "skills.localMachine": "Lokaler Rechner",
+  "skills.self": "Selbst",
+  "skills.vpsMain": "VPS Main",
+  "skills.testConnection": "Verbindung testen",
+  "skills.driftTitle": "Konfigurationsdrift und Rollback",
+  "skills.driftHelp": "Die kontinuierliche Überwachung vergleicht Live-Dateien mit unveränderlichen Registry-Hashes.",
+  "skills.col.deployment": "Bereitstellung",
+  "skills.col.targetPath": "Zielpfad",
+  "skills.col.driftState": "Drift-Status",
+  "skills.checkHash": "Hash prüfen",
+  "skills.reviewsTitle": "Richtlinien- und Freigabewarteschlange",
+  "skills.reviewsEmpty": "Keine ausstehenden erhöhten Prüfungen erfordern eine Operatorentscheidung.",
+  "skills.auditTitle": "Prüfprotokoll",
+  "skills.col.eventType": "Ereignistyp",
+  "skills.col.targetId": "Ziel-ID",
+  "skills.system": "system",
+  "skills.status.importing": "Importiere {id}…",
+  "skills.status.imported": "{id} importiert.",
+  "skills.status.importFailed": "Import fehlgeschlagen: {error}",
+  "skills.status.publishing": "Veröffentliche {id}…",
+  "skills.status.published": "{id} veröffentlicht.",
+  "skills.status.publishFailed": "Veröffentlichung fehlgeschlagen: {error}",
+  "skills.status.planning": "Plane Bereitstellung von {id} nach {agent}…",
+  "skills.status.deployed": "{id} nach {agent} bereitgestellt.",
+  "skills.status.deployFailed": "Bereitstellung fehlgeschlagen: {error}",
+  "skills.status.saved": "Skill-Entwurf im Register gespeichert.",
+  "skills.status.saveFailed": "Speichern fehlgeschlagen: {error}",
+  "skills.loadFailed": "Skill-Steuerungsebene konnte nicht geladen werden.",
+  "security.title": "Sicherheits-Steuerungsebene",
+  "security.subtitle": "Autorisierungsfirste Erkundung und Validierung. Zielgerichtete Arbeit ist standardmäßig verweigert. R3 ist blockiert. Hash-routbar; keine Sidebar-NAV-Zeile.",
+  "security.refresh": "Aktualisieren",
+  "security.refreshing": "Aktualisiere…",
+  "security.banner": "Nur autorisierte Ziele. Unbekannte Assets, abgelaufene Autorisierungen und ausgeschlossene Hosts werden verweigert. Live-Drittanbieter-Tools werden nicht aufgerufen; die Erkundung nutzt lokale Fixtures.",
+  "security.flagOff": "Feature-Flag PAO_SECURITY_CONTROL_PLANE ist aus — Änderungen werden abgelehnt.",
+  "security.status.posting": "POST {path}",
+  "security.status.ok": "OK {path}",
+  "security.status.failed": "Fehlgeschlagen: {error}",
+  "security.tab.overview": "Übersicht",
+  "security.tab.authorizations": "Autorisierungen",
+  "security.tab.scopes": "Bereiche",
+  "security.tab.campaigns": "Kampagnen",
+  "security.tab.approvals": "Freigaben",
+  "security.tab.findings": "Findings",
+  "security.tab.evidence": "Nachweise",
+  "security.tab.skills": "Pakete",
+  "security.tab.tools": "Werkzeuge",
+  "security.tab.mcp": "MCP",
+  "security.tab.policies": "Richtlinien",
+  "security.tab.audit": "Protokoll",
+  "security.card.enabled": "Aktiviert",
+  "security.card.campaigns": "Kampagnen",
+  "security.card.approvals": "Freigaben",
+  "security.card.leads": "Leads",
+  "security.card.validated": "Validiert",
+  "security.card.blocked": "Blockiert",
+  "security.card.authExpiring": "Autorisierung läuft ab",
+  "security.card.breakers": "Schutzschalter",
+  "security.yes": "ja",
+  "security.no": "nein",
+  "security.col.id": "ID",
+  "security.col.type": "Typ",
+  "security.col.status": "Status",
+  "security.col.validUntil": "Gültig bis",
+  "security.col.name": "Name",
+  "security.col.actions": "Aktionen",
+  "security.col.target": "Ziel",
+  "security.col.title": "Titel",
+  "security.col.severity": "Schwere",
+  "security.col.sha256": "SHA-256",
+  "security.col.preview": "Vorschau",
+  "security.col.compatibility": "Kompatibilität",
+  "security.col.kind": "Art",
+  "security.col.allowlisted": "Auf der Allowlist",
+  "security.col.health": "Zustand",
+  "security.col.credential": "Anmeldedaten",
+  "security.col.ceiling": "Obergrenze",
+  "security.col.blockR3": "R3 blockieren",
+  "security.col.when": "Wann",
+  "security.col.event": "Ereignis",
+  "security.col.actor": "Akteur",
+  "security.start": "Starten",
+  "security.pause": "Pausieren",
+  "security.reconLab": "Recon lab.local",
+  "security.approveOnce": "Einmal freigeben",
+  "security.deny": "Ablehnen",
+  "security.reasonBounded": "einmalig begrenzt",
+  "security.reasonDenied": "abgelehnt",
+  "security.hashes": "Lesezeichen-Hashes: {hashes}",
+  "security.loadFailed": "Sicherheits-Steuerungsebene konnte nicht geladen werden.",
+  "credentials.title": "Provider-Zugriffssteuerung",
+  "credentials.subtitle": "Verschlüsselte Anmeldedaten, gesundheitsgeprüfter Token-Pool, OAuth-Gateway und richtliniengesteuerte Leases. Hash-routbar; keine Sidebar-NAV-Zeile.",
+  "credentials.refresh": "Aktualisieren",
+  "credentials.refreshing": "Aktualisiere…",
+  "credentials.banner": "Geheimnisse werden niemals im Klartext aufgelistet. Gesundheitsprüfungen in dieser Phase sind Fixture/In-Process. Diese Ebene registriert keine Anbieterkonten.",
+  "credentials.flagOff": "Feature-Flag CREDENTIAL_RUNTIME_ENABLED ist aus — Mutationen werden abgelehnt.",
+  "credentials.status.posting": "POST {path}",
+  "credentials.status.ok": "OK {path}",
+  "credentials.status.failed": "Fehlgeschlagen: {error}",
+  "credentials.tab.overview": "Übersicht",
+  "credentials.tab.list": "Anmeldedaten",
+  "credentials.tab.providers": "Anbieter",
+  "credentials.tab.oauth": "OAuth",
+  "credentials.tab.pool": "Pool",
+  "credentials.tab.health": "Gesundheit",
+  "credentials.tab.quota": "Kontingent",
+  "credentials.tab.policies": "Richtlinien",
+  "credentials.tab.approvals": "Freigaben",
+  "credentials.tab.audit": "Audit",
+  "credentials.card.enabled": "Aktiviert",
+  "credentials.card.total": "Gesamt",
+  "credentials.card.healthy": "Gesund",
+  "credentials.card.degraded": "Beeinträchtigt",
+  "credentials.card.quarantined": "Quarantäne",
+  "credentials.card.revoked": "Widerrufen",
+  "credentials.card.leases": "Leases",
+  "credentials.card.breakers": "Unterbrecher",
+  "credentials.card.vault": "Tresor",
+  "credentials.yes": "ja",
+  "credentials.no": "nein",
+  "credentials.available": "verfügbar",
+  "credentials.unavailable": "nicht verfügbar",
+  "credentials.col.id": "ID",
+  "credentials.col.name": "Name",
+  "credentials.col.provider": "Anbieter",
+  "credentials.col.status": "Status",
+  "credentials.col.health": "Gesundheit",
+  "credentials.col.secret": "Geheimnis",
+  "credentials.col.eligible": "Berechtigt",
+  "credentials.col.actions": "Aktionen",
+  "credentials.col.score": "Score",
+  "credentials.col.adapter": "Adapter",
+  "credentials.col.oauth": "OAuth",
+  "credentials.col.enabled": "Aktiviert",
+  "credentials.col.session": "Sitzung",
+  "credentials.col.redirect": "Weiterleitung",
+  "credentials.col.budget": "Budget",
+  "credentials.col.priority": "Priorität",
+  "credentials.col.action": "Aktion",
+  "credentials.col.target": "Ziel",
+  "credentials.col.when": "Wann",
+  "credentials.col.event": "Ereignis",
+  "credentials.col.actor": "Akteur",
+  "credentials.col.decision": "Entscheidung",
+  "credentials.validate": "Validieren",
+  "credentials.quarantine": "Quarantäne",
+  "credentials.revoke": "Widerrufen",
+  "credentials.healthRun": "Gesundheitsprüfung starten",
+  "credentials.approve": "Freigeben",
+  "credentials.reject": "Ablehnen",
+  "credentials.hashes": "Lesezeichen-Hashes: {hashes}",
+  "credentials.loadFailed": "Anmeldedaten-Laufzeitdaten konnten nicht geladen werden.",
 };