fix(code-review): P1 CLI DELETE URL + P1 regex sync comment + P2 enhance contamination tag

P1 #2: CLI $-removal now hits correct URL (/skill/:name not /skill with body)
P1 #1: Added sync comment linking CLI regex to skill-parse.ts source of truth
P2 #3: Tagged enhancePrompt as contamination from prax/enhance-prompt (PR #9)
P2 #5/#6: bootstrap.ts + message-v2.ts contamination accepted as-is (too intertwined)

Author: praxstack

packages/app/src/components/prompt-input.tsx

@@ -284,6 +284,9 @@ export const PromptInput: Component<PromptInputProps> = (props) => {
   }
 
   const [steerPending, setSteerPending] = createSignal(false)
+  // TODO(contamination): enhancePrompt belongs to prax/enhance-prompt (PR #9).
+  // It leaked into this branch during extraction from prax-dev.
+  // Remove when prax/enhance-prompt is merged via prax-build.sh.
   const [enhancing, setEnhancing] = createSignal(false)
 
   const enhancePrompt = async () => {

packages/opencode/src/cli/cmd/tui/component/prompt/index.tsx

@@ -634,6 +634,8 @@ export function Prompt(props: PromptProps) {
       // Guards: $ must be at start-of-line or after whitespace (not $$).
       // $name  → adds skill to session (SkillPart in parts array)
       // $-name → removes skill from session (DELETE API call)
+      // NOTE: This regex MUST stay in sync with packages/app/src/util/skill-parse.ts
+      // (the web frontend's source-of-truth parser). If you change it here, update there too.
       const skillPattern = /(?:^|(?<=\s))\$(-?[a-zA-Z][\w-]*)/g
       const skills: Array<{ type: "skill"; name: string }> = []
       const removals: string[] = []
@@ -644,13 +646,11 @@ export function Prompt(props: PromptProps) {
         else skills.push({ type: "skill" as const, name: token })
       }
 
-      // Process $-removal requests via DELETE /session/:id/skill
+      // Process $-removal requests via DELETE /session/:id/skill/:name
       if (sessionID) {
         for (const name of removals) {
-          fetch(`${sdk.url}/session/${sessionID}/skill`, {
+          fetch(`${sdk.url}/session/${sessionID}/skill/${encodeURIComponent(name)}`, {
             method: "DELETE",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ name }),
           }).catch(() => {
             toast.show({
               variant: "error",