fix(server): Codex missed skills defined in the current repo

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.

[D3OXY]

Skills committed to a repository never showed up in the composer's $ picker when using Codex — only globally installed ones did. If you added a skill under your repo and reached for it in the composer, it simply wasn't there.

This is Codex-only. Claude already works: its provider probe scans the filesystem for skills using the instance's own cwd, so <cwd>/.claude/skills is picked up as project scope. Codex instead gets its skills from the app-server's skills/list, which the provider snapshot calls without workspace context and caches per instance — so repo-local skills are invisible to it by construction.

What changed

ProviderDriver gains an optional listSkills(cwd). Codex implements it by querying skills/list against the active workspace on demand, exposed through a new server.listProviderSkills RPC and a useProviderSkills hook that the composer reads instead of the snapshot.

The hook is provider-generic, but Codex is the only driver that implements it. Drivers that don't keep serving their snapshot, so Claude's picker returns exactly the same list it does today.

Discovery is best-effort. The query times out after ten seconds and falls back to the snapshot, and an empty result is treated as "couldn't answer" rather than "no skills" — a slow or unreachable workspace can never leave the picker empty. The snapshot fallback drops repo-scoped entries, since a cached snapshot may describe a different workspace than the one you're in.

Testing

ProviderRegistry covers the driver-implements and driver-doesn't-implement paths; server.test.ts covers the RPC end to end. Format, lint, typecheck, and the server, contracts, client-runtime, and web suites pass against a20923ce4.

One unrelated pre-existing failure on this machine: apps/web/src/terminal/ghostty/runtimeAbi.test.ts fails to load ghostty-vt.wasm?inline through vite's import analysis. It fails identically on a clean checkout of main, and this branch touches no ghostty files.

Notes

Rebuilt on current main — the previous revision had gone stale and conflicted. Same approach as before, with the composer's empty-result fallback and a stable memo identity for the skill list fixed along the way.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27d6d7b7-9a8b-400d-a523-c2b5ad3869d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for discovering repo-scoped skills from the current workspace, adding a new RPC endpoint and cross-cutting changes to server, frontend, and auth layers. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding on the new Codex skill-discovery fallback logging. See the inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[Mnigos]

Mentioning skills itself works fine, but when message is sent, the mentioned skill is not formatted properly.

Also why not add this also for claude code?

[D3OXY]

Superseded by #8528.

This PR fixes Codex by moving discovery from process.cwd() to a configured cwd. #8528 fixes the picker path itself: T3 resolves the active project or thread worktree on the server and asks the selected provider to discover skills there. It covers Codex, Claude, Cursor, Grok, and OpenCode across web and mobile.

#8528 is stacked on #8336.