feat: skill-aligned execution harness

[byapparov]

Implemented automatic skill loading from .opencode/skills into system prompt. Pruned environment noise in headless mode and decoupled TUI dependencies for a lean, specialized execution context. Optimized for one-shot agentic automations.

[github-actions]

Code Review: feat: skill-aligned execution harness

Summary

This PR adds automatic skill loading, headless mode optimizations, and a CI code review workflow. The implementation is solid overall with a few observations.

---

Code Quality

packages/cli/src/session/prompt.ts:654-658

const{ Skill }=awaitimport("../skill/skill")constallSkills=awaitSkill.all()for(constskillofallSkills){system.unshift(`AVAILABLE SKILL: ${skill.name}\n\n${skill.content}`)}

• Consider wrapping in try/catch. If Skill.all() throws (e.g., malformed skill file), it will crash the session initialization.

packages/cli/src/session/system.ts:48

project.vcs==="git"&&false

• Dead code - && false makes this always return empty string. Debug leftover?

---

Security

.opencode/tool/github-comment.ts (new file)

• Token handling is correct - uses process.env.GITHUB_TOKEN via env var, not hardcoded.
• ✅ No security concerns in the workflow - secrets passed via env vars, appropriate permissions declared.

---

Streaming Integrity

No streaming-related changes in this PR. The modifications are limited to config path resolution, instruction loading, and prompt construction - none of which affect SSE/streaming proxy logic.

---

Reliability

packages/cli/src/session/instruction.ts:135-146 - safeFetch implementation is good:

• Proper try/catch wrapping
• 5-second timeout via AbortSignal
• Graceful fallback to empty string

packages/cli/src/skill/skill.ts - Skill discovery is robust:

• All file operations wrapped in .catch()
• Duplicate skills logged as warnings, not errors
• Missing paths handled gracefully

.github/workflows/code-review.yml

• Good: timeout-minutes: 15 prevents hanging jobs
• Good: SHA tracking prevents duplicate reviews
• Good: Removes .opencode/tool/*.ts to avoid @aictrl/plugin dependency issues

---

Suggestions (Low Priority)

1. The globalFiles() early return in headless mode (instruction.ts:20-23) skips global config entirely. Intentional for isolation, but worth documenting.

2. The skill auto-loading prepends all skills to system prompt unconditionally. For large skill sets, this could bloat context. Consider a max or filtering mechanism.

---

Reviewed SHA: 985fc30

[github-actions]

Code Review: feat: skill-aligned execution harness

Code Quality

prompt.ts:654-660 - Silent error swallowing

try{const{ Skill }=awaitimport("../skill/skill")constallSkills=awaitSkill.all()for(constskillofallSkills){system.unshift(`AVAILABLE SKILL: ${skill.name}\n\n${skill.content}`)}}catch{}

A malformed skill or module error will silently fail. Consider at minimum logging the error:

}catch(e){log.warn("failed to auto-load skills",{error: e})}

instruction.ts:88-93 - Logic issue with break

for(constfileofglobalFiles()){if(awaitFilesystem.exists(file)){paths.add(path.resolve(file))break// Only first existing file is used}}

In non-headless mode, if .opencode/AGENTS.md exists locally, global config (~/.config/aictrl/AGENTS.md) is never checked. The early return in headless mode (lines 20-23) is intentional, but the break behavior means users can't layer instructions from multiple sources.

Security

✅ No issues found. API keys properly passed via environment variables (ZHIPUAI_API_KEY, GITHUB_TOKEN). Workflow permissions are appropriately scoped.

Streaming Integrity

No streaming-related changes in this PR.

Reliability

Good: safeFetch in instruction.ts:135-147 is a solid defensive improvement with proper null checking before .ok access.

Good: CI workflow has proper SHA tracking to prevent duplicate reviews, concurrency controls, and graceful skipping logic.

Suggestions

1. prompt.ts: Log warnings on skill load failures instead of silent catch
2. instruction.ts: Document or reconsider the "first match wins" behavior for global instruction files
3. CI workflow: Consider adding a timeout to the gh pr view calls in the change detection step

Reviewed SHA: 26cb375