feat: add new skill capabilities#8
Merged
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (46)
📒 Files selected for processing (18)
WalkthroughAdds marketplace-backed skill lifecycle (search/install/remove/update) to the CLI, provenance sidecars & integrity checks for installed skills, MCP server declarations and resolver, subprocess-based skill hooks executed during session lifecycle, and wiring of these components into daemon/session notifier and manager flows. Changes
Sequence DiagramssequenceDiagram
actor User
participant CLI
participant Marketplace as Marketplace\n(Registry)
participant FS as Filesystem
participant Verifier
User->>CLI: skill install `@agh/review`
CLI->>Marketplace: Download(slug)
Marketplace-->>CLI: SkillArchive(tar.gz)
CLI->>CLI: Extract & sanitize paths
CLI->>FS: Locate `SKILL.md`
CLI->>Verifier: Parse & validate `SKILL.md`
alt Critical validation errors
Verifier-->>CLI: Validation error
CLI-->>User: Installation blocked
else Valid
Verifier-->>CLI: Valid
CLI->>CLI: Compute directory hash
CLI->>FS: WriteSidecar(.agh-meta.json)
CLI->>FS: Move skill → user skills dir (replace/backup if needed)
CLI-->>User: Installed
end
sequenceDiagram
actor Session as Session\nLifecycle
participant Fanout as notifierFanout
participant Dispatcher as skillsHookDispatcher
participant Workspace as WorkspaceResolver
participant Registry as SkillRegistry
participant Runner as HookRunner
Session->>Fanout: OnSessionCreated(ctx, sess)
Fanout->>Fanout: Notify built-in notifiers
Fanout->>Dispatcher: OnSessionCreated(ctx, sess)
Dispatcher->>Workspace: Resolve(sess.WorkspaceID)
Workspace-->>Dispatcher: ResolvedWorkspace
Dispatcher->>Registry: ForWorkspace(ctx, resolved)
Registry-->>Dispatcher: []*Skill
Dispatcher->>Runner: RunHooks(ctx, on_session_created, skills, payload)
loop for each matching hook
Runner->>Skill: Execute subprocess (stdin JSON, env)
Skill-->>Runner: stdout/stderr + exit code
Runner->>Runner: Log result / continue on failure
end
Runner-->>Dispatcher: []HookResult
Dispatcher-->>Fanout: Return
Fanout-->>Session: Complete
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (8)
internal/skills/catalog_test.go (1)
95-121: Use the repo’s defaultt.Run("Should...")pattern for this new case.This test is fine functionally, but the new addition is now an outlier against the suite’s required subtest structure, which makes it harder to extend cleanly as more disabled-skill cases are added.
As per coding guidelines,
**/*_test.go: Use table-driven tests with subtests (t.Run) as defaultandMUST use t.Run("Should...") pattern for ALL test cases`.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/catalog_test.go` around lines 95 - 121, Convert TestBuildCatalogExcludesDisabledSkills to use the suite’s subtest pattern by wrapping assertions in a t.Run("Should exclude disabled skills") subtest (or convert to a table-driven subtest if you prefer multiple cases), so the test for BuildCatalog uses the required t.Run("Should...") structure; update the function name TestBuildCatalogExcludesDisabledSkills only by enclosing the existing setup and assertions inside t.Run and keep references to BuildCatalog, Skill, and SkillMeta unchanged.internal/config/config_test.go (1)
508-533: Normalize subtest names to the requiredShould...pattern.Please rename these
t.Runcases toShould...form to match the enforced test style (e.g.,ShouldAcceptValidMarketplaceConfig,ShouldRejectEmptyRegistryWhenConfigured).As per coding guidelines, "MUST use t.Run("Should...") pattern for ALL test cases".
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/config/config_test.go` around lines 508 - 533, Rename the two t.Run subtests in the config tests to use the required "Should..." naming pattern: change t.Run("accepts-valid-marketplace-config", ...) to t.Run("ShouldAcceptValidMarketplaceConfig", ...) and t.Run("rejects-empty-registry-when-marketplace-configured", ...) to t.Run("ShouldRejectEmptyRegistryWhenConfigured", ...); keep the test bodies and calls to cfg.Validate() and assertions unchanged so only the subtest names are normalized to the style guide.internal/config/config.go (1)
451-467: Validateskills.marketplace.base_urlformat when provided.Right now malformed URLs are accepted and likely fail later in marketplace calls; validating here gives earlier, clearer feedback.
🔧 Proposed refactor
import ( "errors" "fmt" + "net/url" "os" "path/filepath" "strings" "time" @@ func (c MarketplaceConfig) Validate() error { registry := strings.TrimSpace(c.Registry) baseURL := strings.TrimSpace(c.BaseURL) if registry == "" && baseURL == "" { return nil } if registry == "" { return errors.New("skills.marketplace.registry is required") } + if baseURL != "" { + if _, err := url.ParseRequestURI(baseURL); err != nil { + return fmt.Errorf("skills.marketplace.base_url must be a valid URL: %q", c.BaseURL) + } + } switch strings.ToLower(registry) { case "clawhub": return nil🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/config/config.go` around lines 451 - 467, The Validate method in MarketplaceConfig currently ignores BaseURL format; update MarketplaceConfig.Validate to, after trimming baseURL and before returning success, validate non-empty baseURL by parsing it (use net/url's Parse or ParseRequestURI) and ensure it has a valid scheme (http or https) and a non-empty host; if parsing or checks fail, return a descriptive error like fmt.Errorf("skills.marketplace.base_url is invalid: %v", err). Keep the existing registry checks (registry variable, switch on strings.ToLower(registry) and the "clawhub" requirement) and only perform the URL validation when baseURL is provided (non-empty).internal/config/merge_test.go (1)
56-84: Use subtest pattern for the new marketplace-defaults test.Please wrap this scenario in
t.Run("Should ...")(and table-drive if more cases are expected) to keep it aligned with the suite conventions.As per coding guidelines, "Use table-driven tests with subtests (
t.Run) as default" and "MUST use t.Run("Should...") pattern for ALL test cases".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/config/merge_test.go` around lines 56 - 84, Wrap the existing TestApplyConfigOverlayFileLeavesMarketplaceDefaultsWhenOverlayOmitsFields body in a t.Run subtest using the "Should ..." naming pattern (or convert to a small table-driven loop with t.Run per case) so it follows suite conventions; keep the same setup calls (ResolveHomePathsFrom, DefaultWithHome), overlay creation, ApplyConfigOverlayFile invocation and assertions, but move them into a t.Run("Should leave marketplace defaults when overlay omits fields", func(t *testing.T) { ... }) block (or a table entry) so the test uses subtests while preserving existing referenced symbols.internal/skills/hooks_test.go (1)
194-229: Consider increasing timeout margin for CI stability.The 25ms timeout is quite tight and may cause flakiness on slower CI runners or under load.
💡 Suggested timeout increase
newSkillWithHook("timeout-skill", SourceUser, HookDecl{ Event: HookSessionCreated, Command: "/bin/sh", Args: []string{script}, - Timeout: 25 * time.Millisecond, + Timeout: 100 * time.Millisecond, Env: map[string]string{ "HOOK_TEST_BUSY_LOOP": "1", }, }),🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/hooks_test.go` around lines 194 - 229, The test TestHookRunnerRunHooksTimesOut uses a very small hardcoded timeout (Timeout: 25 * time.Millisecond) which can flake on CI; increase the HookDecl timeout to a more forgiving value (e.g., 200-500ms) in the newSkillWithHook call so the timeout behavior is still exercised but stable in slower environments, and keep assertions against the timeout error and logs unchanged (references: TestHookRunnerRunHooksTimesOut, newSkillWithHook, HookDecl.Timeout).internal/skills/mcp.go (1)
45-84: Consider documenting the last-wins merge strategy.The
Resolvemethod uses a last-wins strategy when servers share the same name (line 67 replaces the existing entry). However, per the context snippet,MergeMCPServersininternal/config/provider.gouses first-wins at the position level. When these are composed, the interaction may produce unexpected results.Consider adding a doc comment clarifying the merge semantics, or ensure the calling code in
manager_lifecycle.gohandles this correctly.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/mcp.go` around lines 45 - 84, Update the Resolve method's doc comment to state that when multiple MCP servers share the same trimmed Name the implementation uses a last-wins merge (the loop replaces an existing entry via index[name] with the later one returned by toConfigMCPServer), and note that this differs from MergeMCPServers (MergeMCPServers uses first-wins at the position level); also call out the combined semantics so callers (e.g., manager lifecycle code) can handle or reconcile these behaviors.internal/skills/registry.go (1)
317-331: Consider clarifying the double verification flow.The current logic calls
VerifyContentat line 320, then callsverifyMarketplaceSkillwhich may returntrueto trigger a secondVerifyContentcall at line 322. The intent appears to be re-verification after detecting hash mismatch, but the control flow is subtle.Consider extracting this into a more explicit pattern:
func (r *Registry) processSkill(dst map[string]*Skill, skill *Skill) bool { r.applyDisabled(skill) // Check marketplace integrity first hashMismatch := r.verifyMarketplaceSkill(skill) // Verify content (re-verify if hash mismatched to capture any tampering) warnings := VerifyContent(skill.Content) if hashMismatch { // Log additional context about the mismatch } r.logVerificationWarnings(skill, warnings) // ... }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/registry.go` around lines 317 - 331, Refactor processSkill to make the double verification explicit: call r.applyDisabled(skill) first, then call r.verifyMarketplaceSkill(skill) and store its boolean result (e.g., hashMismatch) instead of conditionally invoking VerifyContent inline; next call VerifyContent(skill.Content) once to produce warnings and, if hashMismatch is true, optionally re-run VerifyContent or add contextual logging about the hash mismatch before calling r.logVerificationWarnings(skill, warnings); keep the subsequent hasCriticalWarning check and r.overlaySkill(dst, skill) unchanged and reference the existing symbols processSkill, verifyMarketplaceSkill, VerifyContent, logVerificationWarnings, hasCriticalWarning, overlaySkill, and applyDisabled when implementing this change.internal/daemon/notifier.go (1)
75-80: Add a local interface assertion forskillsHookDispatcher.This type is consumed as
sessionHookPhase, but the contract is only enforced indirectly at assignment sites. Keeping the assertion next to the type makes signature drift obvious during future edits.♻️ Suggested change
type skillsHookDispatcher struct { registry session.SkillRegistry runner *skills.HookRunner workspaceResolver workspacepkg.WorkspaceResolver logger *slog.Logger } + +var _ sessionHookPhase = (*skillsHookDispatcher)(nil)As per coding guidelines, "Use compile-time interface verification:
var _ Interface = (*Type)(nil)".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/daemon/notifier.go` around lines 75 - 80, The type skillsHookDispatcher is intended to implement sessionHookPhase but lacks an explicit compile-time assertion; add a local interface verification line `var _ sessionHookPhase = (*skillsHookDispatcher)(nil)` adjacent to the type declaration to ensure the compiler enforces the contract and makes future signature drift obvious (place the assertion right after the skillsHookDispatcher type block).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@internal/daemon/notifier.go`:
- Around line 128-144: Add a package-level compile-time assertion for the
sessionHookPhase interface by adding: var _ sessionHookPhase =
(*skillsHookDispatcher)(nil) so the compiler verifies skillsHookDispatcher
implements sessionHookPhase; then prevent untrusted marketplace skills from
being invoked by filtering the results of Registry.ForWorkspace(...) before
calling d.runner.RunHooks: replicate the allowlist behavior used in mcp.go
(allowedMarketplace) — either filter marketplace-origin skills out in the
notifier path that calls RunHooks or add the same allowlist gating inside
RunHooks itself so only marketplace-trusted skills are dispatched during hook
execution.
In `@internal/skills/loader.go`:
- Around line 276-285: parseHookDecls is currently appending HookDecls even when
Command is empty; modify parseHookDecls to validate the built HookDecl (the
Command field created via stringValue) and fail fast: after creating hook :=
HookDecl{...}, if hook.Command == "" return a descriptive error (include skill
identifier and hook index) instead of appending; ensure callers of
parseHookDecls handle the returned error. This enforces rejecting empty command
entries at parse time rather than deferring to runtime hook execution.
In `@internal/skills/provenance.go`:
- Around line 74-79: After json.Unmarshal into the provenance variable in
ReadSidecar, validate that the required provenance fields are present
(non-zero/empty) and return a descriptive error if any are missing instead of
returning a zero-value Provenance; update ReadSidecar to check the provenance
struct fields that are required by registry.go (e.g., the provenance
identity/ownership fields used to mark marketplace-managed skills) and fail fast
with fmt.Errorf("skills: invalid provenance sidecar %q: missing %s",
sidecarPath, "<field>") when a required field is empty.
In `@internal/skills/testdata/hooks/driver.sh`:
- Around line 17-29: The case for HOOK_TEST_OUTPUT_MODE currently expects
"payload" but the default expansion uses "value", so the default path falls to
the "*" branch and returns the wrong variable; update the case patterns to treat
"value" as an alias for "payload" (for example add a branch matching
"value|payload") or change the default expansion to "payload", ensuring the
payload-printing branch (the existing payload branch) runs for the default case.
---
Nitpick comments:
In `@internal/config/config_test.go`:
- Around line 508-533: Rename the two t.Run subtests in the config tests to use
the required "Should..." naming pattern: change
t.Run("accepts-valid-marketplace-config", ...) to
t.Run("ShouldAcceptValidMarketplaceConfig", ...) and
t.Run("rejects-empty-registry-when-marketplace-configured", ...) to
t.Run("ShouldRejectEmptyRegistryWhenConfigured", ...); keep the test bodies and
calls to cfg.Validate() and assertions unchanged so only the subtest names are
normalized to the style guide.
In `@internal/config/config.go`:
- Around line 451-467: The Validate method in MarketplaceConfig currently
ignores BaseURL format; update MarketplaceConfig.Validate to, after trimming
baseURL and before returning success, validate non-empty baseURL by parsing it
(use net/url's Parse or ParseRequestURI) and ensure it has a valid scheme (http
or https) and a non-empty host; if parsing or checks fail, return a descriptive
error like fmt.Errorf("skills.marketplace.base_url is invalid: %v", err). Keep
the existing registry checks (registry variable, switch on
strings.ToLower(registry) and the "clawhub" requirement) and only perform the
URL validation when baseURL is provided (non-empty).
In `@internal/config/merge_test.go`:
- Around line 56-84: Wrap the existing
TestApplyConfigOverlayFileLeavesMarketplaceDefaultsWhenOverlayOmitsFields body
in a t.Run subtest using the "Should ..." naming pattern (or convert to a small
table-driven loop with t.Run per case) so it follows suite conventions; keep the
same setup calls (ResolveHomePathsFrom, DefaultWithHome), overlay creation,
ApplyConfigOverlayFile invocation and assertions, but move them into a
t.Run("Should leave marketplace defaults when overlay omits fields", func(t
*testing.T) { ... }) block (or a table entry) so the test uses subtests while
preserving existing referenced symbols.
In `@internal/daemon/notifier.go`:
- Around line 75-80: The type skillsHookDispatcher is intended to implement
sessionHookPhase but lacks an explicit compile-time assertion; add a local
interface verification line `var _ sessionHookPhase =
(*skillsHookDispatcher)(nil)` adjacent to the type declaration to ensure the
compiler enforces the contract and makes future signature drift obvious (place
the assertion right after the skillsHookDispatcher type block).
In `@internal/skills/catalog_test.go`:
- Around line 95-121: Convert TestBuildCatalogExcludesDisabledSkills to use the
suite’s subtest pattern by wrapping assertions in a t.Run("Should exclude
disabled skills") subtest (or convert to a table-driven subtest if you prefer
multiple cases), so the test for BuildCatalog uses the required
t.Run("Should...") structure; update the function name
TestBuildCatalogExcludesDisabledSkills only by enclosing the existing setup and
assertions inside t.Run and keep references to BuildCatalog, Skill, and
SkillMeta unchanged.
In `@internal/skills/hooks_test.go`:
- Around line 194-229: The test TestHookRunnerRunHooksTimesOut uses a very small
hardcoded timeout (Timeout: 25 * time.Millisecond) which can flake on CI;
increase the HookDecl timeout to a more forgiving value (e.g., 200-500ms) in the
newSkillWithHook call so the timeout behavior is still exercised but stable in
slower environments, and keep assertions against the timeout error and logs
unchanged (references: TestHookRunnerRunHooksTimesOut, newSkillWithHook,
HookDecl.Timeout).
In `@internal/skills/mcp.go`:
- Around line 45-84: Update the Resolve method's doc comment to state that when
multiple MCP servers share the same trimmed Name the implementation uses a
last-wins merge (the loop replaces an existing entry via index[name] with the
later one returned by toConfigMCPServer), and note that this differs from
MergeMCPServers (MergeMCPServers uses first-wins at the position level); also
call out the combined semantics so callers (e.g., manager lifecycle code) can
handle or reconcile these behaviors.
In `@internal/skills/registry.go`:
- Around line 317-331: Refactor processSkill to make the double verification
explicit: call r.applyDisabled(skill) first, then call
r.verifyMarketplaceSkill(skill) and store its boolean result (e.g.,
hashMismatch) instead of conditionally invoking VerifyContent inline; next call
VerifyContent(skill.Content) once to produce warnings and, if hashMismatch is
true, optionally re-run VerifyContent or add contextual logging about the hash
mismatch before calling r.logVerificationWarnings(skill, warnings); keep the
subsequent hasCriticalWarning check and r.overlaySkill(dst, skill) unchanged and
reference the existing symbols processSkill, verifyMarketplaceSkill,
VerifyContent, logVerificationWarnings, hasCriticalWarning, overlaySkill, and
applyDisabled when implementing this change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3d0c6f1c-e954-412c-b058-0e17d33d512b
⛔ Files ignored due to path filters (36)
.compozy/tasks/skills-v2/_meta.mdis excluded by!**/*.md.compozy/tasks/skills-v2/_tasks.mdis excluded by!**/*.md.compozy/tasks/skills-v2/_techspec.mdis excluded by!**/*.md.compozy/tasks/skills-v2/adrs/adr-001.mdis excluded by!**/*.md.compozy/tasks/skills-v2/adrs/adr-002.mdis excluded by!**/*.md.compozy/tasks/skills-v2/adrs/adr-003.mdis excluded by!**/*.md.compozy/tasks/skills-v2/adrs/adr-004.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/MEMORY.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_01.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_02.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_03.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_04.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_05.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_06.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_07.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_08.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_09.mdis excluded by!**/*.md.compozy/tasks/skills-v2/memory/task_10.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_01.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_02.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_03.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_04.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_05.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_06.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_07.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_08.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_09.mdis excluded by!**/*.md.compozy/tasks/skills-v2/task_10.mdis excluded by!**/*.mddocs/rfcs/skills-system-final.mdis excluded by!**/*.mdinternal/skills/testdata/loader/combined/SKILL.mdis excluded by!**/*.mdinternal/skills/testdata/loader/hooks-only/SKILL.mdis excluded by!**/*.mdinternal/skills/testdata/loader/invalid-hook/SKILL.mdis excluded by!**/*.mdinternal/skills/testdata/loader/invalid-mcp/SKILL.mdis excluded by!**/*.mdinternal/skills/testdata/loader/malformed-agh/SKILL.mdis excluded by!**/*.mdinternal/skills/testdata/loader/mcp-only/SKILL.mdis excluded by!**/*.mdinternal/skills/testdata/loader/no-agh/SKILL.mdis excluded by!**/*.md
📒 Files selected for processing (36)
internal/cli/skill.gointernal/cli/skill_marketplace_integration_test.gointernal/cli/skill_test.gointernal/config/config.gointernal/config/config_test.gointernal/config/merge.gointernal/config/merge_test.gointernal/daemon/boot.gointernal/daemon/daemon.gointernal/daemon/daemon_integration_test.gointernal/daemon/notifier.gointernal/daemon/notifier_integration_test.gointernal/daemon/notifier_test.gointernal/session/interfaces.gointernal/session/manager.gointernal/session/manager_lifecycle.gointernal/session/manager_test.gointernal/skills/catalog.gointernal/skills/catalog_test.gointernal/skills/hooks.gointernal/skills/hooks_test.gointernal/skills/loader.gointernal/skills/loader_test.gointernal/skills/marketplace/clawhub/client.gointernal/skills/marketplace/clawhub/client_test.gointernal/skills/marketplace/registry.gointernal/skills/marketplace/types.gointernal/skills/mcp.gointernal/skills/mcp_test.gointernal/skills/provenance.gointernal/skills/provenance_test.gointernal/skills/registry.gointernal/skills/registry_integration_test.gointernal/skills/registry_test.gointernal/skills/testdata/hooks/driver.shinternal/skills/types.go
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
internal/skills/registry.go (1)
317-337:⚠️ Potential issue | 🔴 CriticalFail closed when marketplace provenance verification fails.
Once a skill is reclassified as
SourceMarketplace, a hash mismatch only produces a warning and the skill is still overlaid into the active registry. That leaves a tampered marketplace install able to contribute prompt content, hooks, and MCP declarations.🛡 Proposed fix
func (r *Registry) processSkill(dst map[string]*Skill, skill *Skill) bool { r.applyDisabled(skill) - hashMismatch := r.verifyMarketplaceSkill(skill) - // Content warnings are derived from the current file body; marketplace hash - // mismatches only add provenance-specific logging above. + if err := r.verifyMarketplaceSkill(skill); err != nil { + return false + } + + // Content warnings are derived from the current file body. warnings := VerifyContent(skill.Content) - if hashMismatch { - r.logger.Debug( - "skills: reusing content verification warnings after marketplace hash mismatch", - "skill_name", skill.Meta.Name, - "path", skill.FilePath, - ) - } r.logVerificationWarnings(skill, warnings) if hasCriticalWarning(warnings) { return false } @@ -func (r *Registry) verifyMarketplaceSkill(skill *Skill) bool { +func (r *Registry) verifyMarketplaceSkill(skill *Skill) error { if skill == nil || skill.Source != SourceMarketplace || skill.Provenance == nil { - return false + return nil } err := VerifyHash(skill.Dir, skill.Provenance) if err == nil { - return false + return nil } @@ - return true + return err } @@ - return false + return err }Also applies to: 370-399
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/registry.go` around lines 317 - 337, processSkill currently treats a marketplace provenance hash mismatch as only a warning and still overlays the skill; change this to fail-closed: after calling verifyMarketplaceSkill (the hashMismatch variable) if hashMismatch is true, log a provenance verification error (use r.logger.* with skill.Meta.Name and skill.FilePath) and return false before calling r.overlaySkill so tampered marketplace installs are not applied. Apply the same change to the corresponding logic block referenced at the other occurrence (lines 370-399) where verifyMarketplaceSkill is used, ensuring both paths abort overlay when marketplace verification fails and update any tests that assumed the old behavior.
🧹 Nitpick comments (2)
internal/skills/provenance_test.go (1)
14-326: Please move these intot.Run("Should...")subtests.The cases are mostly isolated already, but they are still top-level tests. Grouping them into table-driven subtests would match the repo's default structure and remove a lot of repeated setup. As per coding guidelines,
**/*_test.go: MUST uset.Run("Should...")pattern for ALL test cases.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/provenance_test.go` around lines 14 - 326, Wrap each top-level test body into a t.Run subtest with a "Should..." name (e.g., inside TestComputeHashReturnsConsistentSHA256ForSameContent call t.Run("ShouldReturnConsistentSHA256ForSameContent", func(t *testing.T){ ... }) ), move any t.Parallel() calls into the subtest, and keep all existing setup and assertions intact; apply this change to the functions TestComputeHashReturnsConsistentSHA256ForSameContent, TestComputeHashReturnsDifferentHashForDifferentContent, TestWriteSidecarCreatesStableHumanReadableJSON, TestReadSidecarParsesValidJSONIntoProvenance, TestReadSidecarReturnsDescriptiveErrorForMalformedJSON, TestReadSidecarReturnsNotExistForMissingSidecar, TestVerifyHashReturnsNilWhenHashMatches, TestVerifyHashReturnsExpectedAndActualHashWhenTampered, TestHasSidecarReturnsTrueWhenSidecarExists, TestHasSidecarReturnsFalseWhenSidecarMissing, and TestSidecarRoundTripProducesIdenticalProvenance so they each use a single t.Run("Should...") subtest while preserving existing helper calls like WriteSidecar, ReadSidecar, VerifyHash, ComputeHash, HasSidecar, testProvenance, and writeSkillFile.internal/skills/hooks.go (1)
293-323: Add the interface assertion and remove the blank-identifier writes.
limitedHookCaptureis the onlyhookCaptureimplementation in this file, so a compile-time assertion would catch drift cheaply. Also,_, _ = c.buf.Write(...)breaks the repo rule against ignored errors with_; callc.buf.Write(...)directly and leave a brief note thatbytes.Buffer.Writeis effectively infallible.♻️ Suggested cleanup
type hookCapture interface { Write([]byte) (int, error) String() string Len() int Truncated() bool } type limitedHookCapture struct { buf bytes.Buffer truncated bool } + +var _ hookCapture = (*limitedHookCapture)(nil) @@ switch { case remaining <= 0: c.truncated = true case len(p) > remaining: - _, _ = c.buf.Write(p[:remaining]) + c.buf.Write(p[:remaining]) // bytes.Buffer.Write never returns an error c.truncated = true default: - _, _ = c.buf.Write(p) + c.buf.Write(p) // bytes.Buffer.Write never returns an error }As per coding guidelines "Use compile-time interface verification:
var _ Interface = (*Type)(nil)" and "Never ignore errors with_— every error must be handled or have a written justification".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/skills/hooks.go` around lines 293 - 323, Add a compile-time interface assertion for hookCapture by declaring var _ hookCapture = (*limitedHookCapture)(nil) near the type definitions, and replace the blank-identifier writes in limitedHookCapture.Write (the occurrences of "_, _ = c.buf.Write(...)") with real calls that capture the returned (int, error) and either handle the error or explicitly comment that bytes.Buffer.Write cannot fail (e.g., assign to n, err := c.buf.Write(...); if err != nil { /* impossible for bytes.Buffer.Write */ }). Ensure these changes touch the limitedHookCapture type, newHookCapture function and the Write method, and keep reference to hookCaptureLimitBytes unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@internal/skills/hooks.go`:
- Around line 68-76: NewHookRunner currently initializes
HookRunner.allowedMarketplace from cfg.AllowedMarketplaceMCP which conflates MCP
consent with hook consent and marketplaceSkillAllowed checks skill.Meta.Name
(mutable); change this by adding a separate hook allowlist in the config (e.g.,
AllowedMarketplaceHooks or AllowedHookMarketplaceIDs), initialize
HookRunner.allowedHooks from that list instead of AllowedMarketplaceMCP in
NewHookRunner, and update the gating function marketplaceSkillAllowed (or create
a new hookAllowed) to validate against immutable marketplace identity fields
(slug, registry, or hash) on the skill rather than skill.Meta.Name; keep using
cloneStrings for the new list to match existing patterns and ensure all
references to allowedMarketplace are adjusted to use the distinct hook allowlist
where lifecycle hooks are evaluated.
- Around line 149-163: The hook execution needs process-group containment and
the working directory set: replace the plain exec.CommandContext invocation with
a managed command via acp.configureManagedCommand (so SysProcAttr.Setpgid is
applied) and set cmd.Dir = skill.Dir before running; specifically update the
block that creates/sets up cmd (currently using exec.CommandContext with
hook.Command/hook.Args and setting cmd.Stdout/Stderr) to call
configureManagedCommand(ctx, hook.Command, hook.Args...) (or wrap the created
*exec.Cmd with configureManagedCommand) and ensure cmd.Dir = skill.Dir so
descendants are killed on timeout and relative paths resolve to the skill
installation root.
- Around line 153-156: The hook process is started with exec.CommandContext
(creating cmd) but cmd.Dir is never set, so relative hook commands run from the
daemon cwd; set cmd.Dir to the skill's extracted directory (skill.Dir) on the
cmd object before running the command (i.e., after creating cmd and before
starting/awaiting it) so ./script.sh and other relative paths resolve inside the
skill; locate the cmd creation in internal/skills/hooks.go where
exec.CommandContext(hookCtx, hook.Command, hook.Args...) is used and add cmd.Dir
= skill.Dir alongside cmd.Stdin and cmd.Env.
In `@internal/skills/mcp.go`:
- Around line 63-80: The code trims the temporary lookup key `name` but leaves
`resolvedServer.Name` unnormalized, causing entries like " github " and "github"
to dedupe but persist different `Name` values; update the `resolvedServer`
produced by `toConfigMCPServer(server)` so its `Name` field is normalized (e.g.,
set `resolvedServer.Name = strings.TrimSpace(name)` or otherwise normalize
`name`) before using it for replacement (`resolved[idx] = resolvedServer`) or
appending (`resolved = append(resolved, resolvedServer)`), keeping the same
`index`/`mcpOrigin` logic intact.
In `@internal/skills/provenance.go`:
- Around line 36-40: ComputeHash currently only hashes SKILL.md; update it (and
the corresponding VerifyHash logic) to compute a deterministic hash of the full
installed skill payload instead: gather SKILL.md plus every file referenced by
hooks and MCP declarations (or walk the skill directory and build a sorted
manifest of file paths and their contents), concatenate in a stable order and
compute the SHA-256 over that manifest; then change VerifyHash to validate
against that full-payload hash rather than just SKILL.md. Ensure you update the
functions named ComputeHash and VerifyHash (and any callers between lines
~87-111 that verify hashes) to accept or derive the list/manifest of files so
integrity covers declared command targets and auxiliary files.
---
Outside diff comments:
In `@internal/skills/registry.go`:
- Around line 317-337: processSkill currently treats a marketplace provenance
hash mismatch as only a warning and still overlays the skill; change this to
fail-closed: after calling verifyMarketplaceSkill (the hashMismatch variable) if
hashMismatch is true, log a provenance verification error (use r.logger.* with
skill.Meta.Name and skill.FilePath) and return false before calling
r.overlaySkill so tampered marketplace installs are not applied. Apply the same
change to the corresponding logic block referenced at the other occurrence
(lines 370-399) where verifyMarketplaceSkill is used, ensuring both paths abort
overlay when marketplace verification fails and update any tests that assumed
the old behavior.
---
Nitpick comments:
In `@internal/skills/hooks.go`:
- Around line 293-323: Add a compile-time interface assertion for hookCapture by
declaring var _ hookCapture = (*limitedHookCapture)(nil) near the type
definitions, and replace the blank-identifier writes in limitedHookCapture.Write
(the occurrences of "_, _ = c.buf.Write(...)") with real calls that capture the
returned (int, error) and either handle the error or explicitly comment that
bytes.Buffer.Write cannot fail (e.g., assign to n, err := c.buf.Write(...); if
err != nil { /* impossible for bytes.Buffer.Write */ }). Ensure these changes
touch the limitedHookCapture type, newHookCapture function and the Write method,
and keep reference to hookCaptureLimitBytes unchanged.
In `@internal/skills/provenance_test.go`:
- Around line 14-326: Wrap each top-level test body into a t.Run subtest with a
"Should..." name (e.g., inside
TestComputeHashReturnsConsistentSHA256ForSameContent call
t.Run("ShouldReturnConsistentSHA256ForSameContent", func(t *testing.T){ ... })
), move any t.Parallel() calls into the subtest, and keep all existing setup and
assertions intact; apply this change to the functions
TestComputeHashReturnsConsistentSHA256ForSameContent,
TestComputeHashReturnsDifferentHashForDifferentContent,
TestWriteSidecarCreatesStableHumanReadableJSON,
TestReadSidecarParsesValidJSONIntoProvenance,
TestReadSidecarReturnsDescriptiveErrorForMalformedJSON,
TestReadSidecarReturnsNotExistForMissingSidecar,
TestVerifyHashReturnsNilWhenHashMatches,
TestVerifyHashReturnsExpectedAndActualHashWhenTampered,
TestHasSidecarReturnsTrueWhenSidecarExists,
TestHasSidecarReturnsFalseWhenSidecarMissing, and
TestSidecarRoundTripProducesIdenticalProvenance so they each use a single
t.Run("Should...") subtest while preserving existing helper calls like
WriteSidecar, ReadSidecar, VerifyHash, ComputeHash, HasSidecar, testProvenance,
and writeSkillFile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e5358edf-ba0a-4bae-8ba6-c6f67db7faf6
⛔ Files ignored due to path filters (10)
ai-docs/reviews-pr-8/_summary.mdis excluded by!**/*.mdai-docs/reviews-pr-8/issues/001-issue.mdis excluded by!**/*.mdai-docs/reviews-pr-8/issues/002-issue.mdis excluded by!**/*.mdai-docs/reviews-pr-8/issues/003-issue.mdis excluded by!**/*.mdai-docs/reviews-pr-8/issues/004-issue.mdis excluded by!**/*.mdai-docs/reviews-pr-8/issues/005-issue.mdis excluded by!**/*.mdai-docs/reviews-pr-8/issues/006-issue.mdis excluded by!**/*.mddocs/plans/2026-04-08-agh-network-design.mdis excluded by!**/*.mddocs/rfcs/agh-network.mdis excluded by!**/*.mdinternal/skills/testdata/loader/invalid-hook-command/SKILL.mdis excluded by!**/*.md
📒 Files selected for processing (18)
internal/config/config.gointernal/config/config_test.gointernal/config/merge_test.gointernal/daemon/boot.gointernal/daemon/daemon_integration_test.gointernal/daemon/notifier.gointernal/daemon/notifier_integration_test.gointernal/daemon/notifier_test.gointernal/skills/catalog_test.gointernal/skills/hooks.gointernal/skills/hooks_test.gointernal/skills/loader.gointernal/skills/loader_test.gointernal/skills/mcp.gointernal/skills/provenance.gointernal/skills/provenance_test.gointernal/skills/registry.gointernal/skills/testdata/hooks/driver.sh
✅ Files skipped from review due to trivial changes (5)
- internal/daemon/daemon_integration_test.go
- internal/config/config_test.go
- internal/skills/hooks_test.go
- internal/config/config.go
- internal/config/merge_test.go
🚧 Files skipped from review as they are similar to previous changes (4)
- internal/skills/loader.go
- internal/skills/catalog_test.go
- internal/skills/loader_test.go
- internal/daemon/notifier.go
This was referenced Apr 9, 2026
Merged
Merged
Merged
This was referenced May 23, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Merged
pedronauck
added a commit
that referenced
this pull request
May 26, 2026
## Release v0.0.1 This PR prepares the release of version v0.0.1. ### Changelog ## 0.0.1 - 2026-05-26 ### Other Changes - Lessons learned ### ♻️ Refactoring - Project structure (#7) - Kb improvements (#12) - Rename spaces to channels (#17) - Add extensions gaps (#21) - Improve tool calls ui (#22) - Remove web app header - Module improvements (#29) - Memory improvements (#35) - Storybook for web and ui (#38) - Enable AGH network by default for new installs (#57) - Hermes adjustments (#69) - Badges design (#84) - Storybook scenario and logos gallery - Migrate typescript tests (#114) - Internal go packages (#120) - Ui patterns (#127) - Improve e2e tests (#130) - Ui redesign - Workspace isolation across runtime surfaces (#145) - Prod ready applies (#162) - Tool card ui (#164) - Alpha on logo - Prod ready features (#167) - Thread sheet (#202) ### 🎉 Features - Implement config foundation packages - Implement sqlite store package - Add ACP client package - Add session lifecycle manager - Implement observe package - Add daemon composition root - Add uds api server - Implement cli package - Add http api server - Add system design - Add foundation types, schemas, and layout shell for web client - Add daemon health polling and agent sidebar systems for web client - Add session system CRUD, streaming core, and session store for web client - Add chat view, messages, and composer tests for web client - Add tool cards and renderers for web client - Add file-backed memory store core - Scaffold memory session seams - Add memory dream consolidation service - Wire memory assembler into daemon - Add memory api and cli - New skills system (#1) - Add workspace entity (#5) - Add new skill capabilities (#8) - Web ui v2 (#9) - Improve hooks system (#10) - Session resilience (#11) - Add extensability (#13) - Add automation (#16) - Add channels (#14) - Add network implementation (#15) - Add network, bridges and automations web pages (#18) - Ext registry (#20) - Add core tasks (#19) - Bridge adapters (#23) - Add site (#26) - Add ext refac and sandbox (#25) - Settings ui (#37) - Tasks ui (#36) - Harness improvements (#44) - Agent capabilities (#49) - Redesign ui (#48) - Unify capability (#53) - Redesign network workspace (#59) - Add task deletion and split session delete from stop (#58) - Session provider selection (#60) - Production grade adjustments (#66) - Autonomous system (#75) - Add agent session route (#80) - Tools registry (#85) - Agents soul (#88) - Add network threads (#105) - Orchestration improvements (#106) - Memory v2 (#108) - Agent categories (#113) - Providers model (#118) - Add canonical AGH bundled skill (#143) - Onboarding and improvements (#198) - Onboarding and improvements (#201) ### 🐛 Bug Fixes - Review round - Review rounds - Resolve memory extensibility review batch - Embed web into daemon - Defaults agents - Acp integration (#4) - Lint errors - Prd folder - Remove orphan web actions and dead surfaces (#55) - Qa testing and fixes (#73) - New review rounds (#82) - Security audit (#90) - Release qa round (#95) - Add missing tools (#141) - New qa round (#147) - Advanced qa round (#149) - Homebrew tap - Final review round (#151) - Daemon healthy - Reasoning models (#158) - Lint errors (#160) - Review round (#168) - Release adjustments (#171) - Stabilize release ci fixtures - Stabilize release integration gate - Stabilize release verify gates - Stabilize release integration flows - Stabilize release verify gates - Stabilize main verify shutdown - Ignore stale acpmock cancel - Marketplace search focus and filtering (#193) - Website video - Workspace command select ### 📚 Documentation - Update agents.md - Update prd - Update skills - Update compozy tasks - Update compozy - Update compozy - Add new skills - Archive prd - Update prds - Update rfc - Update prds - Update prds - Add automation prd - Channels prd - Update prd - Update prd - New prds - Archive prds - Bridges adapters prd - Sandbox prd - Update - Archive prd - Update - Add new prd - New design - Update prd - Archive prds - Update prds - Tasks-ui prd tasks - Update prd - Update design docs - Agent capabilities prd - Improve site docs - Remove old design references - Udpate - Autonomous prd - Update skills - Blog design - Agent sould prd - Final qa plan - Update - Remove codex ledgers from gitignore - Remove not needed files - Udpate ledger - Update cy-codex-loop skill - Orchestration improves prd - Update prds - Orch improvs prd - Memv2 prd - Providers model prd - Update refacs prd - New design proposal - Update rules - Update skills - New blog posts (#173) - Format docs - Remove old design files - Remove old - Skeeper update ### 📦 Build System - Initial structure - Commitlint - Frontend base structure - Update vscode settings - Add subagents - Coderabbit - Prd and tooling - Bun lock - Lint tooling - Copy.md and tooling adjusts - Add repoclone rc - Upgrade skeeper to v0.2.0 - Update go.mod - Adopt task artifacts into skeeper - Sync codex plans with skeeper - Skeeper lock - Skeeper lock - New skills - Skeeper lock - Skeeper lock - Skeeper lock - Update deps and go - Regenerate daytona sidecar assets for go 1.26.3 - Fix cliff - Ignore docs on fmt - Build web assets before goreleaser - Extend release dry-run timeout ### 🔧 CI/CD - Lint errors - Fint release pr - Fix goreleaser ### 🧪 Testing - Add e2e tests (#27) - Qa rounds (#78) - Improve test suite (#138) - Harden daemon-served restart reloads - Harden daemon-served readiness waits - Stabilize dashboard focus assertion - Stabilize release integration gates - Stabilize release e2e markers - Stabilize release e2e flows Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This was referenced May 26, 2026
Closed
Merged
pedronauck
added a commit
that referenced
this pull request
May 26, 2026
## Release v0.0.1 This PR prepares the release of version v0.0.1. ### Changelog ## 0.0.1 - 2026-05-26 ### Other Changes - Lessons learned ### ♻️ Refactoring - Project structure (#7) - Kb improvements (#12) - Rename spaces to channels (#17) - Add extensions gaps (#21) - Improve tool calls ui (#22) - Remove web app header - Module improvements (#29) - Memory improvements (#35) - Storybook for web and ui (#38) - Enable AGH network by default for new installs (#57) - Hermes adjustments (#69) - Badges design (#84) - Storybook scenario and logos gallery - Migrate typescript tests (#114) - Internal go packages (#120) - Ui patterns (#127) - Improve e2e tests (#130) - Ui redesign - Workspace isolation across runtime surfaces (#145) - Prod ready applies (#162) - Tool card ui (#164) - Alpha on logo - Prod ready features (#167) - Thread sheet (#202) ### 🎉 Features - Implement config foundation packages - Implement sqlite store package - Add ACP client package - Add session lifecycle manager - Implement observe package - Add daemon composition root - Add uds api server - Implement cli package - Add http api server - Add system design - Add foundation types, schemas, and layout shell for web client - Add daemon health polling and agent sidebar systems for web client - Add session system CRUD, streaming core, and session store for web client - Add chat view, messages, and composer tests for web client - Add tool cards and renderers for web client - Add file-backed memory store core - Scaffold memory session seams - Add memory dream consolidation service - Wire memory assembler into daemon - Add memory api and cli - New skills system (#1) - Add workspace entity (#5) - Add new skill capabilities (#8) - Web ui v2 (#9) - Improve hooks system (#10) - Session resilience (#11) - Add extensability (#13) - Add automation (#16) - Add channels (#14) - Add network implementation (#15) - Add network, bridges and automations web pages (#18) - Ext registry (#20) - Add core tasks (#19) - Bridge adapters (#23) - Add site (#26) - Add ext refac and sandbox (#25) - Settings ui (#37) - Tasks ui (#36) - Harness improvements (#44) - Agent capabilities (#49) - Redesign ui (#48) - Unify capability (#53) - Redesign network workspace (#59) - Add task deletion and split session delete from stop (#58) - Session provider selection (#60) - Production grade adjustments (#66) - Autonomous system (#75) - Add agent session route (#80) - Tools registry (#85) - Agents soul (#88) - Add network threads (#105) - Orchestration improvements (#106) - Memory v2 (#108) - Agent categories (#113) - Providers model (#118) - Add canonical AGH bundled skill (#143) - Onboarding and improvements (#198) - Onboarding and improvements (#201) ### 🐛 Bug Fixes - Review round - Review rounds - Resolve memory extensibility review batch - Embed web into daemon - Defaults agents - Acp integration (#4) - Lint errors - Prd folder - Remove orphan web actions and dead surfaces (#55) - Qa testing and fixes (#73) - New review rounds (#82) - Security audit (#90) - Release qa round (#95) - Add missing tools (#141) - New qa round (#147) - Advanced qa round (#149) - Homebrew tap - Final review round (#151) - Daemon healthy - Reasoning models (#158) - Lint errors (#160) - Review round (#168) - Release adjustments (#171) - Stabilize release ci fixtures - Stabilize release integration gate - Stabilize release verify gates - Stabilize release integration flows - Stabilize release verify gates - Stabilize main verify shutdown - Ignore stale acpmock cancel - Marketplace search focus and filtering (#193) - Website video - Workspace command select ### 📚 Documentation - Update agents.md - Update prd - Update skills - Update compozy tasks - Update compozy - Update compozy - Add new skills - Archive prd - Update prds - Update rfc - Update prds - Update prds - Add automation prd - Channels prd - Update prd - Update prd - New prds - Archive prds - Bridges adapters prd - Sandbox prd - Update - Archive prd - Update - Add new prd - New design - Update prd - Archive prds - Update prds - Tasks-ui prd tasks - Update prd - Update design docs - Agent capabilities prd - Improve site docs - Remove old design references - Udpate - Autonomous prd - Update skills - Blog design - Agent sould prd - Final qa plan - Update - Remove codex ledgers from gitignore - Remove not needed files - Udpate ledger - Update cy-codex-loop skill - Orchestration improves prd - Update prds - Orch improvs prd - Memv2 prd - Providers model prd - Update refacs prd - New design proposal - Update rules - Update skills - New blog posts (#173) - Format docs - Remove old design files - Remove old - Skeeper update ### 📦 Build System - Initial structure - Commitlint - Frontend base structure - Update vscode settings - Add subagents - Coderabbit - Prd and tooling - Bun lock - Lint tooling - Copy.md and tooling adjusts - Add repoclone rc - Upgrade skeeper to v0.2.0 - Update go.mod - Adopt task artifacts into skeeper - Sync codex plans with skeeper - Skeeper lock - Skeeper lock - New skills - Skeeper lock - Skeeper lock - Skeeper lock - Update deps and go - Regenerate daytona sidecar assets for go 1.26.3 - Fix cliff - Ignore docs on fmt - Build web assets before goreleaser - Extend release dry-run timeout ### 🔧 CI/CD - Lint errors - Fint release pr - Fix goreleaser - Fix release ### 🧪 Testing - Add e2e tests (#27) - Qa rounds (#78) - Improve test suite (#138) - Harden daemon-served restart reloads - Harden daemon-served readiness waits - Stabilize dashboard focus assertion - Stabilize release integration gates - Stabilize release e2e markers - Stabilize release e2e flows Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Merged
pedronauck
added a commit
that referenced
this pull request
May 26, 2026
## Release v0.0.2 This PR prepares the release of version v0.0.2. ### Changelog ## 0.0.2 - 2026-05-26 ### Other Changes - Lessons learned ### ♻️ Refactoring - Project structure (#7) - Kb improvements (#12) - Rename spaces to channels (#17) - Add extensions gaps (#21) - Improve tool calls ui (#22) - Remove web app header - Module improvements (#29) - Memory improvements (#35) - Storybook for web and ui (#38) - Enable AGH network by default for new installs (#57) - Hermes adjustments (#69) - Badges design (#84) - Storybook scenario and logos gallery - Migrate typescript tests (#114) - Internal go packages (#120) - Ui patterns (#127) - Improve e2e tests (#130) - Ui redesign - Workspace isolation across runtime surfaces (#145) - Prod ready applies (#162) - Tool card ui (#164) - Alpha on logo - Prod ready features (#167) - Thread sheet (#202) ### 🎉 Features - Implement config foundation packages - Implement sqlite store package - Add ACP client package - Add session lifecycle manager - Implement observe package - Add daemon composition root - Add uds api server - Implement cli package - Add http api server - Add system design - Add foundation types, schemas, and layout shell for web client - Add daemon health polling and agent sidebar systems for web client - Add session system CRUD, streaming core, and session store for web client - Add chat view, messages, and composer tests for web client - Add tool cards and renderers for web client - Add file-backed memory store core - Scaffold memory session seams - Add memory dream consolidation service - Wire memory assembler into daemon - Add memory api and cli - New skills system (#1) - Add workspace entity (#5) - Add new skill capabilities (#8) - Web ui v2 (#9) - Improve hooks system (#10) - Session resilience (#11) - Add extensability (#13) - Add automation (#16) - Add channels (#14) - Add network implementation (#15) - Add network, bridges and automations web pages (#18) - Ext registry (#20) - Add core tasks (#19) - Bridge adapters (#23) - Add site (#26) - Add ext refac and sandbox (#25) - Settings ui (#37) - Tasks ui (#36) - Harness improvements (#44) - Agent capabilities (#49) - Redesign ui (#48) - Unify capability (#53) - Redesign network workspace (#59) - Add task deletion and split session delete from stop (#58) - Session provider selection (#60) - Production grade adjustments (#66) - Autonomous system (#75) - Add agent session route (#80) - Tools registry (#85) - Agents soul (#88) - Add network threads (#105) - Orchestration improvements (#106) - Memory v2 (#108) - Agent categories (#113) - Providers model (#118) - Add canonical AGH bundled skill (#143) - Onboarding and improvements (#198) - Onboarding and improvements (#201) ### 🐛 Bug Fixes - Review round - Review rounds - Resolve memory extensibility review batch - Embed web into daemon - Defaults agents - Acp integration (#4) - Lint errors - Prd folder - Remove orphan web actions and dead surfaces (#55) - Qa testing and fixes (#73) - New review rounds (#82) - Security audit (#90) - Release qa round (#95) - Add missing tools (#141) - New qa round (#147) - Advanced qa round (#149) - Homebrew tap - Final review round (#151) - Daemon healthy - Reasoning models (#158) - Lint errors (#160) - Review round (#168) - Release adjustments (#171) - Stabilize release ci fixtures - Stabilize release integration gate - Stabilize release verify gates - Stabilize release integration flows - Stabilize release verify gates - Stabilize main verify shutdown - Ignore stale acpmock cancel - Marketplace search focus and filtering (#193) - Website video - Workspace command select ### 📚 Documentation - Update agents.md - Update prd - Update skills - Update compozy tasks - Update compozy - Update compozy - Add new skills - Archive prd - Update prds - Update rfc - Update prds - Update prds - Add automation prd - Channels prd - Update prd - Update prd - New prds - Archive prds - Bridges adapters prd - Sandbox prd - Update - Archive prd - Update - Add new prd - New design - Update prd - Archive prds - Update prds - Tasks-ui prd tasks - Update prd - Update design docs - Agent capabilities prd - Improve site docs - Remove old design references - Udpate - Autonomous prd - Update skills - Blog design - Agent sould prd - Final qa plan - Update - Remove codex ledgers from gitignore - Remove not needed files - Udpate ledger - Update cy-codex-loop skill - Orchestration improves prd - Update prds - Orch improvs prd - Memv2 prd - Providers model prd - Update refacs prd - New design proposal - Update rules - Update skills - New blog posts (#173) - Format docs - Remove old design files - Remove old - Skeeper update ### 📦 Build System - Initial structure - Commitlint - Frontend base structure - Update vscode settings - Add subagents - Coderabbit - Prd and tooling - Bun lock - Lint tooling - Copy.md and tooling adjusts - Add repoclone rc - Upgrade skeeper to v0.2.0 - Update go.mod - Adopt task artifacts into skeeper - Sync codex plans with skeeper - Skeeper lock - Skeeper lock - New skills - Skeeper lock - Skeeper lock - Skeeper lock - Update deps and go - Regenerate daytona sidecar assets for go 1.26.3 - Fix cliff - Ignore docs on fmt - Build web assets before goreleaser - Extend release dry-run timeout ### 🔧 CI/CD - Lint errors - Fint release pr - Fix goreleaser - Fix release - Fix release process ### 🧪 Testing - Add e2e tests (#27) - Qa rounds (#78) - Improve test suite (#138) - Harden daemon-served restart reloads - Harden daemon-served readiness waits - Stabilize dashboard focus assertion - Stabilize release integration gates - Stabilize release e2e markers - Stabilize release e2e flows - Improve suite speed Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This was referenced May 26, 2026
Closed
Closed
Merged
pedronauck
added a commit
that referenced
this pull request
May 27, 2026
## Release v0.0.2 This PR prepares the release of version v0.0.2. ### Changelog ## 0.0.2 - 2026-05-26 ### Other Changes - Lessons learned ### ♻️ Refactoring - Project structure (#7) - Kb improvements (#12) - Rename spaces to channels (#17) - Add extensions gaps (#21) - Improve tool calls ui (#22) - Remove web app header - Module improvements (#29) - Memory improvements (#35) - Storybook for web and ui (#38) - Enable AGH network by default for new installs (#57) - Hermes adjustments (#69) - Badges design (#84) - Storybook scenario and logos gallery - Migrate typescript tests (#114) - Internal go packages (#120) - Ui patterns (#127) - Improve e2e tests (#130) - Ui redesign - Workspace isolation across runtime surfaces (#145) - Prod ready applies (#162) - Tool card ui (#164) - Alpha on logo - Prod ready features (#167) - Thread sheet (#202) ### 🎉 Features - Implement config foundation packages - Implement sqlite store package - Add ACP client package - Add session lifecycle manager - Implement observe package - Add daemon composition root - Add uds api server - Implement cli package - Add http api server - Add system design - Add foundation types, schemas, and layout shell for web client - Add daemon health polling and agent sidebar systems for web client - Add session system CRUD, streaming core, and session store for web client - Add chat view, messages, and composer tests for web client - Add tool cards and renderers for web client - Add file-backed memory store core - Scaffold memory session seams - Add memory dream consolidation service - Wire memory assembler into daemon - Add memory api and cli - New skills system (#1) - Add workspace entity (#5) - Add new skill capabilities (#8) - Web ui v2 (#9) - Improve hooks system (#10) - Session resilience (#11) - Add extensability (#13) - Add automation (#16) - Add channels (#14) - Add network implementation (#15) - Add network, bridges and automations web pages (#18) - Ext registry (#20) - Add core tasks (#19) - Bridge adapters (#23) - Add site (#26) - Add ext refac and sandbox (#25) - Settings ui (#37) - Tasks ui (#36) - Harness improvements (#44) - Agent capabilities (#49) - Redesign ui (#48) - Unify capability (#53) - Redesign network workspace (#59) - Add task deletion and split session delete from stop (#58) - Session provider selection (#60) - Production grade adjustments (#66) - Autonomous system (#75) - Add agent session route (#80) - Tools registry (#85) - Agents soul (#88) - Add network threads (#105) - Orchestration improvements (#106) - Memory v2 (#108) - Agent categories (#113) - Providers model (#118) - Add canonical AGH bundled skill (#143) - Onboarding and improvements (#198) - Onboarding and improvements (#201) ### 🐛 Bug Fixes - Review round - Review rounds - Resolve memory extensibility review batch - Embed web into daemon - Defaults agents - Acp integration (#4) - Lint errors - Prd folder - Remove orphan web actions and dead surfaces (#55) - Qa testing and fixes (#73) - New review rounds (#82) - Security audit (#90) - Release qa round (#95) - Add missing tools (#141) - New qa round (#147) - Advanced qa round (#149) - Homebrew tap - Final review round (#151) - Daemon healthy - Reasoning models (#158) - Lint errors (#160) - Review round (#168) - Release adjustments (#171) - Stabilize release ci fixtures - Stabilize release integration gate - Stabilize release verify gates - Stabilize release integration flows - Stabilize release verify gates - Stabilize main verify shutdown - Ignore stale acpmock cancel - Marketplace search focus and filtering (#193) - Website video - Workspace command select ### 📚 Documentation - Update agents.md - Update prd - Update skills - Update compozy tasks - Update compozy - Update compozy - Add new skills - Archive prd - Update prds - Update rfc - Update prds - Update prds - Add automation prd - Channels prd - Update prd - Update prd - New prds - Archive prds - Bridges adapters prd - Sandbox prd - Update - Archive prd - Update - Add new prd - New design - Update prd - Archive prds - Update prds - Tasks-ui prd tasks - Update prd - Update design docs - Agent capabilities prd - Improve site docs - Remove old design references - Udpate - Autonomous prd - Update skills - Blog design - Agent sould prd - Final qa plan - Update - Remove codex ledgers from gitignore - Remove not needed files - Udpate ledger - Update cy-codex-loop skill - Orchestration improves prd - Update prds - Orch improvs prd - Memv2 prd - Providers model prd - Update refacs prd - New design proposal - Update rules - Update skills - New blog posts (#173) - Format docs - Remove old design files - Remove old - Skeeper update ### 📦 Build System - Initial structure - Commitlint - Frontend base structure - Update vscode settings - Add subagents - Coderabbit - Prd and tooling - Bun lock - Lint tooling - Copy.md and tooling adjusts - Add repoclone rc - Upgrade skeeper to v0.2.0 - Update go.mod - Adopt task artifacts into skeeper - Sync codex plans with skeeper - Skeeper lock - Skeeper lock - New skills - Skeeper lock - Skeeper lock - Skeeper lock - Update deps and go - Regenerate daytona sidecar assets for go 1.26.3 - Fix cliff - Ignore docs on fmt - Build web assets before goreleaser - Extend release dry-run timeout ### 🔧 CI/CD - Lint errors - Fint release pr - Fix goreleaser - Fix release - Fix release process - Fix release sync - Decouple release dry-run npm auth - Persist web assets git auth ### 🧪 Testing - Add e2e tests (#27) - Qa rounds (#78) - Improve test suite (#138) - Harden daemon-served restart reloads - Harden daemon-served readiness waits - Stabilize dashboard focus assertion - Stabilize release integration gates - Stabilize release e2e markers - Stabilize release e2e flows - Improve suite speed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated web assets dependency to a newer version for improved stability and performance. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/compozy/agh/pull/211?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
](https://app.coderabbit.ai/change-stack/compozy/agh/pull/211?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack){kind=link}
This was referenced May 27, 2026
Closed
Closed
Merged
pedronauck
added a commit
that referenced
this pull request
May 27, 2026
## Release v0.0.2 This PR prepares the release of version v0.0.2. ### Changelog ## 0.0.2 - 2026-05-27 ### Other Changes - Lessons learned ### ♻️ Refactoring - Project structure (#7) - Kb improvements (#12) - Rename spaces to channels (#17) - Add extensions gaps (#21) - Improve tool calls ui (#22) - Remove web app header - Module improvements (#29) - Memory improvements (#35) - Storybook for web and ui (#38) - Enable AGH network by default for new installs (#57) - Hermes adjustments (#69) - Badges design (#84) - Storybook scenario and logos gallery - Migrate typescript tests (#114) - Internal go packages (#120) - Ui patterns (#127) - Improve e2e tests (#130) - Ui redesign - Workspace isolation across runtime surfaces (#145) - Prod ready applies (#162) - Tool card ui (#164) - Alpha on logo - Prod ready features (#167) - Thread sheet (#202) ### 🎉 Features - Implement config foundation packages - Implement sqlite store package - Add ACP client package - Add session lifecycle manager - Implement observe package - Add daemon composition root - Add uds api server - Implement cli package - Add http api server - Add system design - Add foundation types, schemas, and layout shell for web client - Add daemon health polling and agent sidebar systems for web client - Add session system CRUD, streaming core, and session store for web client - Add chat view, messages, and composer tests for web client - Add tool cards and renderers for web client - Add file-backed memory store core - Scaffold memory session seams - Add memory dream consolidation service - Wire memory assembler into daemon - Add memory api and cli - New skills system (#1) - Add workspace entity (#5) - Add new skill capabilities (#8) - Web ui v2 (#9) - Improve hooks system (#10) - Session resilience (#11) - Add extensability (#13) - Add automation (#16) - Add channels (#14) - Add network implementation (#15) - Add network, bridges and automations web pages (#18) - Ext registry (#20) - Add core tasks (#19) - Bridge adapters (#23) - Add site (#26) - Add ext refac and sandbox (#25) - Settings ui (#37) - Tasks ui (#36) - Harness improvements (#44) - Agent capabilities (#49) - Redesign ui (#48) - Unify capability (#53) - Redesign network workspace (#59) - Add task deletion and split session delete from stop (#58) - Session provider selection (#60) - Production grade adjustments (#66) - Autonomous system (#75) - Add agent session route (#80) - Tools registry (#85) - Agents soul (#88) - Add network threads (#105) - Orchestration improvements (#106) - Memory v2 (#108) - Agent categories (#113) - Providers model (#118) - Add canonical AGH bundled skill (#143) - Onboarding and improvements (#198) - Onboarding and improvements (#201) ### 🐛 Bug Fixes - Review round - Review rounds - Resolve memory extensibility review batch - Embed web into daemon - Defaults agents - Acp integration (#4) - Lint errors - Prd folder - Remove orphan web actions and dead surfaces (#55) - Qa testing and fixes (#73) - New review rounds (#82) - Security audit (#90) - Release qa round (#95) - Add missing tools (#141) - New qa round (#147) - Advanced qa round (#149) - Homebrew tap - Final review round (#151) - Daemon healthy - Reasoning models (#158) - Lint errors (#160) - Review round (#168) - Release adjustments (#171) - Stabilize release ci fixtures - Stabilize release integration gate - Stabilize release verify gates - Stabilize release integration flows - Stabilize release verify gates - Stabilize main verify shutdown - Ignore stale acpmock cancel - Marketplace search focus and filtering (#193) - Website video - Workspace command select ### 📚 Documentation - Update agents.md - Update prd - Update skills - Update compozy tasks - Update compozy - Update compozy - Add new skills - Archive prd - Update prds - Update rfc - Update prds - Update prds - Add automation prd - Channels prd - Update prd - Update prd - New prds - Archive prds - Bridges adapters prd - Sandbox prd - Update - Archive prd - Update - Add new prd - New design - Update prd - Archive prds - Update prds - Tasks-ui prd tasks - Update prd - Update design docs - Agent capabilities prd - Improve site docs - Remove old design references - Udpate - Autonomous prd - Update skills - Blog design - Agent sould prd - Final qa plan - Update - Remove codex ledgers from gitignore - Remove not needed files - Udpate ledger - Update cy-codex-loop skill - Orchestration improves prd - Update prds - Orch improvs prd - Memv2 prd - Providers model prd - Update refacs prd - New design proposal - Update rules - Update skills - New blog posts (#173) - Format docs - Remove old design files - Remove old - Skeeper update ### 📦 Build System - Initial structure - Commitlint - Frontend base structure - Update vscode settings - Add subagents - Coderabbit - Prd and tooling - Bun lock - Lint tooling - Copy.md and tooling adjusts - Add repoclone rc - Upgrade skeeper to v0.2.0 - Update go.mod - Adopt task artifacts into skeeper - Sync codex plans with skeeper - Skeeper lock - Skeeper lock - New skills - Skeeper lock - Skeeper lock - Skeeper lock - Update deps and go - Regenerate daytona sidecar assets for go 1.26.3 - Fix cliff - Ignore docs on fmt - Build web assets before goreleaser - Extend release dry-run timeout - Fix release dry-run token contract ### 🔧 CI/CD - Lint errors - Fint release pr - Fix goreleaser - Fix release - Fix release process - Fix release sync - Decouple release dry-run npm auth - Persist web assets git auth - Require npm auth before release merge ### 🧪 Testing - Add e2e tests (#27) - Qa rounds (#78) - Improve test suite (#138) - Harden daemon-served restart reloads - Harden daemon-served readiness waits - Stabilize dashboard focus assertion - Stabilize release integration gates - Stabilize release e2e markers - Stabilize release e2e flows - Improve suite speed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated dependencies to latest versions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/compozy/agh/pull/214?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
](https://app.coderabbit.ai/change-stack/compozy/agh/pull/214?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Tests