feat(skills): Scope wildcard discovery by path#144
Conversation
Allow wildcard skill dependencies to select a source subdirectory while preserving recursive discovery, exclusions, and repository-relative lockfile paths. Reject wildcard paths that escape the acquired source root. Fixes #131
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Fail fast for invalid wildcard paths, retain source-relative lock metadata for scoped local and well-known skills, and prune out-of-scope wildcard entries during offline sync. Add canonical path containment and regression coverage for well-known discovery and lockfile round-trips.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
Use one scope matcher for list and sync while retaining legacy lock entries until install records source-relative paths.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9775bfd. Configure here.
|
|
||
| const lockedLocalSkillSchema = z.object({ | ||
| source: z.string(), | ||
| resolved_path: z.string().optional(), |
There was a problem hiding this comment.
Well-known lock entries misclassified as git
Medium Severity
Adding optional resolved_path to well-known lock entries makes those objects satisfy lockedGitSkillSchema, which is tried first in the z.union. Wildcard well-known installs now always persist resolved_path, so load parses them as git skills and breaks the git/well-known lock discrimination the schema relied on.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 9775bfd. Configure here.
There was a problem hiding this comment.
This does not cause observable misclassification. The lockfile variants are structural and no consumer discriminates Git from well-known entries by union branch. A well-known entry with resolved_path parses through the first compatible schema but preserves the identical source, resolved_url, and resolved_path fields; Git-only fields remain absent. Writer/loader round-trip coverage confirms the metadata is preserved.
— Claude Code
Avoid offering wildcard exclusion for stale skills that fall outside the configured path scope.
1 participant
Allow wildcard skill dependencies to limit discovery to one source subdirectory.
A wildcard entry can now set
path, recursively discovering only skills beneath that directory while continuing to applyexclude. Omittingpathpreserves the existing repository-wide discovery behavior.Git-backed skills retain their complete repository-relative paths in
agents.lock, and wildcard paths that escape the acquired source root are rejected. The same scoped discovery behavior is used for Git, local, and well-known sources.Fixes #131