fix(composer): show project skills in menus

[t3-code]

problem

the composer only used the provider snapshot for skills, so project-only skills could be missing while global skills still appeared.

fix

• add a read-only projects.listSkills rpc scoped to the active workspace and provider
• discover .agents/skills for every provider, plus native project roots for claude, cursor, grok, and opencode
• merge project skills with the provider snapshot, with project definitions winning name collisions
• use the merged list in both / and $ menus on web, desktop, and mobile
• keep unknown/future providers compatible through the shared .agents/skills root

testing

• 51 focused tests passed across client runtime, workspace discovery, rpc authorization, web slash search, and mobile slash search
• websocket rpc integration test passed
• targeted typechecks passed for contracts, client runtime, server, web, and mobile
• targeted formatting and lint passed

ui

no layout changes. this populates the existing skill rows in both composer menus.

model: gpt-5.6-sol
harness: Hermes Agent

request provenance

• requested by: @maria-rcks

---

Note

Medium Risk
Adds a new workspace-scoped RPC that reads SKILL.md files from the given cwd, plus composer menu data sources. Auth is read-only and discovery is tested, but wrong cwd or merge order would surface the wrong skills.

Overview
Composer skill menus no longer rely only on the provider snapshot. Web and mobile now query project skills for the thread/worktree cwd and merge them with global provider skills so project-only skills appear and same-name project skills win.

Adds a read-only projects.listSkills RPC. WorkspaceEntries.listSkills scans .agents/skills for every driver plus native roots (.claude, .cursor, .grok, .opencode), parses SKILL.md frontmatter, and prefers native dirs over common ones on name collisions.

mergeProviderSkills is the client merge. Slash and skill menus use the merged list; loading copy is “Searching workspace skills...” for those triggers (not file-search text). Mobile path search and skill fetch now take threadCwd instead of the parent project workspace root.

^{Reviewed by Cursor Bugbot for commit 1ced740. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Show project-scoped skills in web and mobile composer menus

• Adds server RPC projects.listSkills that discovers skills from .agents/skills and provider-native directories, parses SKILL.md frontmatter, and merges duplicates by name with provider-native precedence
• Adds mergeProviderSkills in client-runtime to overlay project skills onto provider skills by name
• Updates both ChatComposer (web) and ThreadComposer (mobile) to query project skills by cwd and selected provider driver, then pass merged skills to slash and skill menus with correct loading copy
• Adds AuthOrchestrationReadScope requirement for the new RPC in RpcAuthorization
• Risk: renames projectCwd to threadCwd in ThreadComposerProps and removes projectWorkspaceRoot from ThreadDetailScreenProps; all in-tree call sites in ThreadRouteScreen are updated but out-of-tree consumers must adapt

^{Macroscope summarized 1ced740.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.4 KiB	−10 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−6 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.5 KiB	+24 B (+0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+5 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+19 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.8 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2c4158f · PR result: 1ced740 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One finding: the new slash-command branch of isComposerMenuLoading reaches an empty-state copy path in ComposerCommandMenu that only special-cases the skill trigger, so a pending project-skills query renders file-search copy in the / menu.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Extending the loading flag to the slash-command trigger surfaces the wrong copy. ComposerCommandMenu only branches loading text on triggerKind === "skill" and otherwise falls back to "Searching workspace files..." (ComposerCommandMenu.tsx lines 114-117), so when / is open with no matching items yet (e.g. a query that currently matches only an un-loaded project skill) the menu says it is searching workspace files even though no path search is running.

Smallest fix: either keep the new pending condition scoped to composerTriggerKind === "skill", or add a slash-command branch to the loading copy in ComposerCommandMenu so it reads "Searching workspace skills..." — i.e. gate the file-search wording on triggerKind === "path" instead of using it as the default.

^{Posted via Macroscope — UI Consistency}

[t3-code]

fixed in 8cf3736 with a regression test: slash-trigger loading now says "Searching workspace skills..." rather than file-search copy.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e99ce6. Configure here.}

[macroscopeapp]

Approvability

Verdict: Skipped

Macroscope did not run approvability analysis for this PR. Macroscope could not determine whether this PR modifies its approvability configuration, so the PR was not approved automatically. A PR that may change the rules that govern approval is never approved automatically.