[Bug] skills.enable allowlist has no effect on native/plugin skills (only disabled_skills filters them)

skills.enable (the documented allowlist) only filters skills discovered through the config-source path. Skills that arrive through the native/plugin merge are filtered only by the disabled_skills denylist, so an allowlist cannot hide them.

Mechanism (oh-my-openagent 4.19.4, dist/index.js)

enable is consumed in exactly one place ΓÇö the config-source skill map (111245ΓÇô111256):

if (disabledSkillNames.size > 0) { ... isDisabledSkillAlias ... }
if (normalizedConfig.enable.length > 0) {
  const enableSet = new Set(normalizedConfig.enable);
  for (const name of skillMap.keys()) {
    if (!enableSet.has(name)) skillMap.delete(name);
  }
}

Native skills (opencode core registry, plugin-provided skills) are merged separately and filtered by the denylist only (125379ΓÇô125387):

function mergeNativeSkills(skills2, nativeSkills, disabledSkills) {
  const disabledSkillAliases = normalizeDisabledSkills(disabledSkills);
  ... if (disabledSkillAliases && isDisabledSkillAlias(nativeSkillToAliasCheckSkill(native), disabledSkillAliases)) ...
}

getAllSkills likewise filters its merged list with isDisabledSkillAlias(...) (111153) ΓÇö again denylist only. collectDisabledSkillAliases (111521ΓÇô111540) reads disabled_skills, skills.disable, and per-skill disable; it never reads skills.enable.

Repro

1. ~/.omo/omo.jsonc:

   "skills": { "enable": ["tavily","firecrawl","exa-agent","search"] }
   

2. Restart opencode.
3. Inspect the skill tool's available list (or the plugin-registered skills, e.g. oh-my-claudecode / superpowers / azure / caveman entries).

Expected vs actual

Expected: only the allowlisted skills are listed/loadable.

Actual: the allowlisted set is filtered, but plugin/native skills remain listed and loadable ΓÇö the allowlist silently does not apply to them. Setting disabled_skills with the same names does remove them, which confirms the two paths differ.

Suggested fix

Either apply enable in the native merge as well (mirror the enableSet check inside mergeNativeSkills/getAllSkills), or document explicitly that skills.enable is config-source-only and disabled_skills is the only way to hide native/plugin skills.

Verified 2026-09-13 on oh-my-openagent 4.19.4 / opencode 1.18.30 (Windows).

---

Environment (software)

item	value
OS	Microsoft Windows 10 Pro — 10.0.19045 (Build 19045), 64-bit
Shell	PowerShell 7.6.6 (+ Windows Terminal)
opencode	1.18.30
plugins	oh-my-openagent 4.19.4 · @cortexkit/opencode-antigravity-auth 2.2.1
runtimes	Node v24.19.0 · npm 11.17.0 · Bun 1.4.2
LSP binaries	biome 2.5.13 · basedpyright 1.40.1 · roslyn-language-server 5.12.0-1.26426.8 · bash-language-server 5.6.0 · shellcheck 0.11.0 · vscode-langservers-extracted 4.10.0 · PowerShellEditorServices 4.7.0 · PSScriptAnalyzer 1.25.0
logs	~/.local/share/opencode/log/opencode.log · ~/.omo/agent/OmO-debug.log · ~/.omo/agent/logs/config-reload.log

OS facts collected with:

Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture

No hardware, hostname, username, or credentials included.