Expose project provider skills in chat

[jakeleventhal]

Summary

• add a provider-neutral, cwd-aware listSkills capability, RPC, client query, and composer pipeline
• preserve snapshot fallback, disabled-provider handling, bounded probes, structured causes, keyed caching, and focus-safe chip metadata refreshes from Expose project Codex skills in chat #3901
• discover Grok skills through its source of truth: grok --cwd <cwd> inspect --json
• translate recognized enabled $skill references to Grok native /skill syntax only at the ACP boundary while retaining $skill in stored and rendered messages

This supersedes #3901. The replacement generalizes the project-skill feature across Codex and Grok without adding a second filesystem scanner or provider-specific web/RPC paths.

Validation

• pnpm exec vp check
• pnpm exec vp run typecheck
• 89 focused provider, adapter, registry, composer-token, and skill-search tests
• 104 contract and server tests
• real-app Grok acceptance with a temporary project sentinel: cwd-aware menu discovery, cross-project invalidation, stable $skill chip storage, and successful native skill execution through ACP
• real-app Codex $skill regression check

---

Note

Medium Risk
Spawns provider CLIs on skill menu open and on Grok prompts with skill tokens; failures surface as typed errors and can block sends when discovery is required, but scope is provider adapters and composer UX rather than auth or persistence.

Overview
Project-scoped provider skills are exposed end-to-end: drivers can implement optional listSkills(cwd), the registry and WebSocket layer add server.listProviderSkills, and the chat composer loads skills for the current worktree when the $ skill menu opens (with keyed caching and snapshot fallback only when discovery is unsupported).

Codex lists skills via a scoped app-server probe (includeModels: false, auth-probe timeout). Grok discovers via grok --cwd <cwd> inspect --json (schema mapping, 10s timeout, typed errors). On sendTurn, Grok rewrites enabled $name tokens to /name for ACP only when the prompt has non–env-var skill tokens; $PATH-style tokens skip inspect, and a committed model switch is kept if skill discovery fails afterward.

The composer updates skill chip labels in place when metadata refreshes so an in-flight probe does not reset Lexical focus; submitted prompts can include a trailing $skill token via shared collectComposerInlineTokens options.

^{Reviewed by Cursor Bugbot for commit 1982e2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Expose provider skills in the chat composer via a new server.listProviderSkills RPC endpoint

• Adds a server.listProviderSkills WebSocket RPC endpoint that queries provider-specific skills for a given instance and working directory, returning a structured error when unsupported.
• Implements listSkills on Codex and Grok provider drivers; Grok uses a new listGrokSkills utility that runs grok inspect --json with a 10s timeout.
• Integrates skill discovery into the chat composer: skills are fetched when a skill trigger is active, cached per target key, and fall back to snapshot skills when discovery is unsupported.
• Rewrites $skill tokens to /skill in Grok prompts when the discovered skill is enabled; all-uppercase tokens are excluded from discovery to avoid treating env vars as skills.
• Updates the Lexical editor to refresh skill chip labels in-place when provider skill metadata changes, avoiding a full editor state rewrite and focus disruption.

^{Macroscope summarized 1982e2f.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 768d84a5-f4c9-4fee-b268-41f867cd0650

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 887c718. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature exposing project-aware provider skills in chat, including new RPC endpoints, skill discovery for Grok/Codex providers, and prompt rewriting logic. The scope and cross-cutting nature of these changes warrants human review.

^{You can customize Macroscope's approvability policy. Learn more.}