fix(codex): show project-local skills in composer

[Githubguy132010]

Fixes #7710

Codex project skills installed under .agents/skills were available in the repository but missing from T3 Code's $ picker because the composer only used skills reported by the provider.

The server now discovers project-local SKILL.md files through a read-scoped RPC. The web, desktop, and mobile composers merge those results into Codex skill suggestions. Other providers are unchanged.

Verification

• Manually verified that typing $unsl shows the project-local unslop skill
• vp test run packages/client-runtime/src/providerSkills.test.ts
• vp test run apps/server/src/workspace/WorkspaceEntries.test.ts apps/server/src/auth/RpcAuthorization.test.ts
• vp test run apps/server/src/server.test.ts -t "routes websocket rpc project file and skill reads"
• Typechecked packages/contracts, packages/client-runtime, apps/server, apps/web, and apps/mobile

Note

This PR was pushed on behalf of @Githubguy132010.

Model: gpt-5.6-sol
Reasoning effort: high
Harness: Codex Desktop with codex-cli 0.147.0

Note

Add project-local skills to composer for codex providers

• Adds projects.listSkills RPC and server WorkspaceEntries.listSkills to scan .agents/skills/ for SKILL.md frontmatter and return parsed skill entries with scope project
• Adds mergeProviderSkills util to union provider and project skills (project overrides by name) sorted by name; mobile and web composers fetch and merge these for codex providers when a cwd is set
• Composers show a loading state while project skills are pending
• Fixes ThreadComposer to receive threadCwd instead of projectWorkspaceRoot so skill discovery uses the correct directory
• Behavioral Change: new WS_METHODS.projectsListSkills requires AuthOrchestrationReadScope; WorkspaceEntries.listSkills silently skips entries with unreadable or invalid frontmatter

^{Macroscope summarized 6a78f76.}

---

Note

Medium Risk
Adds a new workspace RPC that reads files under a client-supplied cwd. Scope is read-only and aligned with existing project file APIs, but it expands filesystem exposure for skill discovery.

Overview
Codex $ skill suggestions now include project-local skills from .agents/skills, not just skills reported by the provider.

Adds a read-scoped projects.listSkills RPC that scans SKILL.md files, parses YAML frontmatter, and returns scope: "project" entries. Web and mobile composers fetch this for Codex when a cwd is set, merge with provider skills (project wins on name), and show a loading state while the query is pending.

Mobile also passes threadCwd into the composer so discovery uses the thread workspace, not the project root.

^{Reviewed by Cursor Bugbot for commit 6a78f76. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a283918-7b67-472f-b4dd-ada442b205af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 070c40c. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces new functionality to discover and display project-local skills from .agents/skills/ directory, adding new RPC endpoints, filesystem operations, and UI changes across mobile and web. New features with cross-cutting behavior changes warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Duplicates maintainer-owned project skill discovery in #7909 and #5335.