Skill dashboard

Your own avatars' skills in one place, organised by avatar: the family skills your avatars share with each other and each avatar's private scripts, with scores, authors, version history and the code. It is personal: you only ever see your own avatars, nobody else's, and nobody else sees yours. Only signed-in people can open it; there is no public version, and it is read-only.

Environment	Page
TEST	test.autorune.xyz/skill-dashboard (sign-in required)

The market (every family's skills side by side) is gone; its old addresses no longer exist.

Who can see it

• You, signed in, and only your own avatars. Signed out, the page shows the normal sign-in screen; after signing in with Discord you land back on the dashboard. The API behind it answers 401 without a session and returns only rows owned by the signed-in account: no other family, no family names, no Discord usernames.
• Never agents. Your avatars don't see this page, so a private script stays private from its siblings exactly as before: an avatar only sees its siblings' shared skills, through its skill library (Skills and learning). The sandbox gate refuses every dashboard address (/skill-dashboard, /skill_dashboard, the code address below, and the old /skill-market names, any case, separator or encoding) with 403 before anything is forwarded. See Security and privacy.

Using the page

The page opens with a short reminder (only you see this page, and only you can view, copy and download the code; agents never see it) and a Back to AutoRune link. It works on phones (from 360 px wide, safe areas respected) and desktop browsers, and scrolls on its own, like any long page. The app's settings link to it (the dashboard icon next to 📜 avatar logs and 🏆 hiscores), and so does Settings → Scripts & skills (Open Skill dashboard).

• Summary at the top: family skills, private scripts, total runs (every version of every entry), success rate and best score.
• 👪 Family skills first: every shared skill of your avatars, one entry per skill at its latest shared version, each tagged with its authors (below).
• Then one section per avatar, collapsible: its 🔒 private scripts and a compact line of the family skills it authored or uses. Tap a name in that line to jump to the family skill (it opens).
• Search (name, goal, needs, result, tags, avatar, authors), topic chips (one per topic tag present, most common first, with counts), sort (Best score, Most used, Recently used) and All / 👪 Family / 🔒 Private. While filtering, a line says how many entries match, with Clear. The search bar stays at the top while you scroll.
• Empty states: no avatars yet; an avatar without private scripts; no family skills yet.

The badges and words are the same as in Settings → Scripts & skills: 🔒 Private (only that avatar uses it) and 👪 Family (shared with your other avatars). Scripts & skills stays as a quick list; the dashboard is the full view.

Authors

A family skill is tagged with every avatar that wrote it:

• its creator, the avatar that shared it ("Pickles (creator)");
• every other avatar of yours that made an improved copy built on it, with the versions of that copy ("Rnchk (v3, v5)"). A copy counts when it descends from the skill (its version chain) or names it in its From: line (a copied and adapted family-skills file), the same rule as siblings' use and copies.

New versions of a skill by its own avatar don't add authors: they are its version history.

What each entry shows

Each entry is a compact card; tap it for the rest.

On the card: name and version ("v8 · 7 versions": a family skill counts its shared versions, a private script all of its versions), the score 0–1000 of that version (green from 700, yellow from 400), the 🔒/👪 badge, runs and ok runs, for a family skill how many siblings used it and its author chips, and the first three topic tags.

After a tap:

• What it does: the goal from its @skill header, then Needs (preconditions) and Result when known, as plain text: secrets scrubbed, code, inline code, file paths and links removed, at most 300 characters. A private script without a header shows what was stored for it, or No description yet.
• Used by (your avatars that ran it) and when it was last used; for a family skill also its siblings' runs, their copies and the feedback lessons they wrote about it.
• The score's KPI breakdown (Reliability, Effectiveness, Confidence, Freshness, Damage: points of each maximum and the figures behind them). How the score is computed: Skills and learning → the score.
• Versions: newest first, numbers only, and "best: v5, 812" when an older version scored higher. See one entry per skill.
• View code, for family skills and private scripts alike (all of them are yours): loaded when you open it, the latest version first, another one from the version list. Plain text in a monospace box that scrolls sideways inside itself, with Copy and Download (saves the version shown as <name>-v<version>.ts, made in the browser from the same response: no download link or endpoint).

What it never shows

• anything of another account: skills, scripts, avatars, family names, Discord usernames;
• execute_code snippets and lab log lessons (only a count of feedback lessons on a family skill);
• internal ids other than your own entries' and avatars', emails, file paths.

The dashboard list itself never carries code: its schema is strict and a test asserts that no script or code field ever appears in it. Code only comes through its own request, for you.

The API

GET /skill-dashboard with the app's normal session (Bearer access token), read-only:

• 401 without a session; rate-limited per user (429 with Retry-After); cached per user for 30 seconds; private, no-store;
• only rows whose owner is the signed-in user (the source reads that owner's rows alone, and the route filters again);
• response: totals, skills[] (id, kind family or private, name, avatarId, avatar, description, preconditions, result, tags, avatars, version, score, kpis, lastUsed, versionCount, versions, best, authors, sharing, lessons) and agents[] (id, name, authored, uses: ids of family skills).

GET /skill-dashboard/skills/:id/code (optionally ?version=N), same session, read-only:

• returns name, version, versions and script for one of your own entries: a family skill (its shared versions) or a private script (any of its versions);
• anyone else, an unknown id or version, a family skill's private draft: 404 (never 403, so it doesn't confirm that a skill exists); 401 without a session; rate-limited per user;
• the script was scrubbed of secrets when it was recorded and is scrubbed again on the way out (your avatars' passwords, credential-looking lines); never cached by the browser (private, no-store), never reachable by agents.

The old /skill-market API routes are removed.