feat(cli): add skilld run for transient Skills - #123
Merged
Conversation
🤖 READY · 88/100
|
A remote run wrote every file, executable bits included, to a run cache before printing a byte of SKILL.md. Nothing pruned it and nothing rechecked it, so a directory sitting at the digest path was served as verified. A remote run now writes nothing. SKILL.md renders from memory, supporting files are named but never printed, and an Agent reads one with --file. A file skilld will not hand over as text is a file that needs an install.
… oversized local Skills
Pin follow-up reads and installs to the reviewed commit. Keep command output safe for terminals and shell reuse. Reuse source limits and the shared JSON contract so local and remote runs fail consistently.
Search now leads one-off use through transient runs. Keep the generated command intact on narrow terminals so its quoted arguments remain safe to copy.
Collaborator
Author
🤖 READY · 95/100
|
Require exact revisions for remote file reads and preserve bundled identity without staging files. Make generated commands safe for their declared shell, and reject source values that cannot round-trip safely.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
❓ Type of change
📚 Description
skilld run <SOURCE>prints a Skill for one-off use. It does not install the Skill.A remote run retains no Skill files. It creates no lockfile entry, Agent target, project file, or Skill cache.
The initial load returns the exact Git revision it reviewed. Every generated file-read command uses that revision. A moving branch cannot mix instructions from one commit with files from another.
Remote file reads without that revision fail before fetching content. The bundled
skilldSkill runs from embedded bytes without temporary staging.Search now leads with
skilld run. The supporting-file inventory lists each path, kind, and size. It prints no supporting file content until the Agent requests a named file.The output contract now includes:
Local runs reuse install source checks. They reject invalid names, links, unsafe terminal characters, and non-UTF-8 paths. They enforce depth, file-count, and total-size limits. These checks fail before skilld returns partial output.
Executable and binary files remain withheld. The output asks for user approval before an install writes them to disk.
One performance improvement remains separate. Direct GitHub runs still fetch every blob while they build the manifest. Selective remote delivery needs a focused provider change.