Add Hivemind: Zero-Cost Multi-Agent Orchestration Skill - #1628

Babysit review — needs path fix

Nice content, but the new files live at the repo root hivemind/ instead of skills/hivemind/ — the repo's skill scanner won't pick them up, so the skill is effectively invisible after merge. Also: .runs/hive-smoke.jsonl is a runtime artifact and shouldn't be committed; and oc-worker.mjs defaults to an external opencode model (mimo-v2.5-free) — please document that dependency. Move the directory, drop the .runs/ trace, and re-push.

Thanks for the review — all three points are addressed, force-pushed as a single verified commit rebased on current main.

• Path: hivemind/ → skills/hivemind/, so the skill scanner picks it up.
• Runtime artifact: .runs/hive-smoke.jsonl removed, and .runs/ is now gitignored inside the skill folder so traces can't be committed again.
• External dependency: SKILL.md opens with a Prerequisites table covering Node >= 18, the opencode CLI, authentication, and the default opencode/mimo-v2.5-free model — including that the free tier belongs to opencode (not Anthropic) and that availability, rate limits, and pricing are theirs to change. It also states plainly that worker traffic leaves for opencode's endpoints, so secrets and private code shouldn't be delegated.

Two things I fixed while in there, since they'd have been the next round of review:

• The skill referenced seven slash commands and three worker agents that weren't in the PR at all. They now ship under assets/commands/ and assets/agents/, with a Setup section explaining where to copy them. Their invocations previously carried an absolute C:\Users\<me>\... path; that's now $HIVEMIND_HOME.
• resolveOpencode() probed with where.exe unconditionally, so it silently fell back to a bare opencode on macOS and Linux. It now uses which off-Windows and keeps the .cmd-shim parsing on Windows (Node's EINVAL policy blocks spawning .cmd directly).

Both blocking items are fixed, plus 3 and 4. Pushed as a follow-up verified commit.

1. license frontmatter key — added:

name: hivemind
description: ...
license: Complete terms in LICENSE.txt

2. LICENSE.txt — added at skills/hivemind/LICENSE.txt, Apache 2.0, byte-identical to the copy in skills/canvas-design apart from the copyright line, which reads Copyright 2026 N Hanish (@Hanishchow). rather than Anthropic PBC, since I'm contributing the content rather than assigning it. If you'd rather it match the other skills exactly, say so and I'll change it in one push — no objection either way.

3. description — 390 → 300 chars, core trigger first:

Orchestrate free opencode workers from Claude Code to cut token costs. Use when delegating grunt work to a single worker or a parallel swarm (scout/coder/tester) with worktree isolation, benchmarking against opencode, or when the user says "spawn a worker", "swarm", "delegate to opencode", or "/oc".

4. Shell injection — you were right to flag it, and chasing it turned up a second, more likely bug. ensureServer() now spawns with an args array and shell: false, so nothing is interpolated:

const child = spawn(bin, ["serve", "--port", PORT], { shell: false, detached: true, stdio: "ignore", windowsHide: true });

That also removed the manual path-quoting the shell form needed. PORT is now produced by a resolvePort() that rejects anything non-numeric or out of range.

The second bug: a malformed HIVEMIND_SERVER_URL made new URL() throw at module top level, so the script died with a stack trace on stdout/stderr — breaking the one-JSON-line contract the whole skill depends on. Now:

$ HIVEMIND_SERVER_URL="not a url" node scripts/oc-worker.mjs "task"
{"ok":false,"stage":"args","error":"HIVEMIND_SERVER_URL is not a valid URL","result":"",...}

$ HIVEMIND_SERVER_URL="http://127.0.0.1:70000" node scripts/oc-worker.mjs "task"
{"ok":false,"stage":"args","error":"HIVEMIND_SERVER_URL is not a valid URL","result":"",...}

The env var and its validation are now documented in SKILL.md next to the server-management paragraph.

On 5 — noted, and I'd rather it stay flagged than buried. If the third-party dependency ever becomes disqualifying for this repo, tell me and I'll withdraw it without argument.