feat(skills-picker): show GitHub URL next to each skill in TUI

scripts/install.sh

@@ -1289,10 +1289,13 @@ if [[ "$SKILLS" -eq 1 ]]; then
     TUI_GROUPS=()
     # shellcheck disable=SC2034
     TUI_DESCS=()
+    # shellcheck disable=SC2034  # consumed by tui_checklist for inline GitHub URL render
+    TUI_URLS=()
     local_total=${#SKILLS_CATALOG[@]}
     for ((i=0; i<local_total; i++)); do
         TUI_GROUPS+=("Skills")
         TUI_DESCS+=("$(_skills_description "${SKILLS_CATALOG[$i]}")")
+        TUI_URLS+=("$(_skills_upstream_url "${SKILLS_CATALOG[$i]}")")
     done
 
     # Selection precedence (UX-FLOW-01 mirror of the MCP branch above):

scripts/lib/skills.sh

@@ -116,6 +116,62 @@ _skills_default_mirror_path() {
     echo "${TK_SKILLS_MIRROR_PATH:-${d}/../../templates/skills-marketplace}"
 }
 
+# Internal helper — resolves manifest.json path honoring TK_MANIFEST_PATH seam.
+# Manifest lives at repo root, two levels above the mirror dir
+# (templates/skills-marketplace/).
+_skills_default_manifest_path() {
+    local mirror
+    mirror="$(_skills_default_mirror_path)"
+    echo "${TK_MANIFEST_PATH:-${mirror}/../../manifest.json}"
+}
+
+# _skills_upstream_url <name> — return GitHub URL for a skill from manifest skills_pins.
+# Construction: ${repo}/tree/${commit}/${path} when both commit + path present,
+# ${repo}/tree/${commit} when only commit present, ${repo} when only repo present.
+# Returns empty (no stdout) when:
+#   - manifest.json absent or unreadable
+#   - jq absent
+#   - skill name absent from skills_pins
+#   - skill marked _status: "no-upstream-found" (e.g. memo-skill)
+#   - repo field missing/empty
+# Caller uses to render an inline GitHub link in the skills picker TUI.
+_skills_upstream_url() {
+    local name="${1:-}"
+    [[ -z "$name" ]] && return 0
+    command -v jq >/dev/null 2>&1 || return 0
+    local manifest
+    manifest="$(_skills_default_manifest_path)"
+    [[ -f "$manifest" ]] || return 0
+
+    # Bash treats \t as IFS-whitespace — consecutive tabs collapse and leading
+    # tabs are skipped, so @tsv loses empty leading fields. Emit each field on
+    # its own line and read 4 lines instead. Also keeps URLs (which may contain
+    # `:` `/`) untouched.
+    local lines
+    lines=$(jq -r --arg n "$name" '
+        .skills_pins[$n] // empty
+        | (.repo // ""), (.commit // ""), (.path // ""), (._status // "")
+    ' "$manifest" 2>/dev/null) || return 0
+    [[ -z "$lines" ]] && return 0
+
+    local repo commit path status
+    { IFS= read -r repo
+      IFS= read -r commit
+      IFS= read -r path
+      IFS= read -r status
+    } <<<"$lines"
+    [[ "$status" == "no-upstream-found" ]] && return 0
+    [[ -z "$repo" ]] && return 0
+
+    if [[ -n "$commit" && -n "$path" ]]; then
+        echo "${repo}/tree/${commit}/${path}"
+    elif [[ -n "$commit" ]]; then
+        echo "${repo}/tree/${commit}"
+    else
+        echo "$repo"
+    fi
+}
+
 # skills_catalog_names — print all skill names from SKILLS_CATALOG, one per line.
 skills_catalog_names() {
     printf '%s\n' "${SKILLS_CATALOG[@]}"

scripts/lib/tui.sh

@@ -191,6 +191,16 @@ _tui_render() {
         local required="${TUI_REQUIRED[$i]:-0}"
         local checked="${TUI_RESULTS[$i]:-0}"
         local desc="${TUI_DESCS[$i]:-}"
+        # Optional parallel array TUI_URLS[]; callers (skills picker) populate
+        # an upstream GitHub URL string per row. Empty when caller omits the
+        # array entirely (MCP / TK pickers) or per-row when no upstream is
+        # known (e.g. memo-skill in skills picker). Rendered after desc as
+        # ` · ${url}` when non-empty; tui itself adds no truncation — caller
+        # owns width policy.
+        local url=""
+        if [[ -n "${TUI_URLS[*]+x}" ]]; then
+            url="${TUI_URLS[$i]:-}"
+        fi
         local row_num=$((i + 1))
 
         # Section header on group change — extra blank line above for clearer separation.
@@ -268,6 +278,9 @@ _tui_render() {
         if [[ -n "$desc" ]]; then
             _label_render+=" — ${desc}"
         fi
+        if [[ -n "$url" ]]; then
+            _label_render+=" · ${url}"
+        fi
         # Immutable rows (installed/required) render dim so they read as
         # "disabled" — user knows space won't toggle them. Exception:
         # reinstall state is bright light-green (call-out, not dim) so