Repository navigation
feat(sdk,cli): install -p claude/codex writes the live bundle's skills apart from the shipped ones, and --refresh-skills rewrites them - #1104
Merged
frontegg-david merged 3 commits intoNov 4, 2026
Conversation
…OpenAPI bundle's skills A CLI built for a Skilled OpenAPI server installed a copy of the bundle skills made at build time: no actions, no CLI usage, for no particular caller, never refreshed, and a skill name with a space stopped the install. install now keeps two kinds of skill apart. The server's own @skills come from the build's metadata, as before. The bundle's skills are read from the running server (in-process or the daemon) as the logged-in caller, through skill://index.json and load_skill, so only what that caller may use is written. Each SKILL.md has the instructions, a ready `<bin> execute <actionId> --input` line per action, how to chain actions with run_workflow, and the bundle version it was generated for. A bundle skill's folder is its name in kebab-case, with a suffix when taken. install --refresh-skills rewrites only the bundle skills after a new bundle, removing the folders of skills that are gone. -p codex now writes both kinds to .codex/skills/<bin>/. --dry-run and --status list both kinds. The SDK's build-time skill asset collection marks a skill a plugin registered from a bundle with its bundleVersion, so the build leaves it out of bin-meta.json and _skills/.
… bundle skills A CLI whose server has a @skill of its own beside a bundle with a skill named with a space: install -p claude writes both kinds, leaves out the skill the caller may not use, and the SKILL.md execute and run_workflow lines run as written. --refresh-skills after a bundle change rewrites only the bundle skills. The login spec installs as an admin, then refreshes as a viewer. The Codex install tests write the skills under their own HOME with --scope user.
…eat/cli-install-bundle-skills
frontegg-david
marked this pull request as ready for review
November 4, 2026 22:26
Contributor
Author
|
@coderabbitai review |
Contributor
|
Warning Review limit reachedYour organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Next included review available in 6 minutes. View limit details
|
Contributor
Action not completed
|
alexmercerpo
approved these changes
Nov 4, 2026
Contributor
Performance Test ResultsStatus: ✅ All tests passed Summary
Total: 101 tests across 21 projects 📊 View full report in workflow run Generated at: 2026-11-04T22:41:44.523Z |
This was referenced Nov 4, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacks on #1103 (the model-eval harness), which stacks on #1102 (the generated CLI's Skilled OpenAPI commands).
What and why
<bin> install -p claude(and-p codex) now teaches a coding agent the Skilled OpenAPI bundle's skills, so the agent can use the API through the CLI. The server's own@Skills and the bundle's skills are different things, and install now keeps them apart.Until now, a CLI built for a Skilled OpenAPI server installed a copy of the bundle skills made at build time. That copy had no actions and no CLI usage, wasn't filtered for any caller, was never refreshed, and a skill named with a space stopped the install (
Invalid plugin name "Guarded action").@Skills, are installed from the build's metadata, as before.skill://index.jsonand callsload_skillas the logged-in caller, so only the skills and actions that caller may use are written. A server with no bundle loaded, or a caller who isn't logged in whencli.authRequiredis set, fails the install and nothing is written.SKILL.mdwith:name(the display name) anddescription, plusmetadatawithsource,bundle-versionandgenerated-by;## Actionssection: each action's summary, a ready<bin> execute <actionId> --input '<json>'line built from its input schema, and its optional fields;<bin> run_workflow, with an example.install: by its name fromPATH, otherwise by absolute paths. On a server with tools of its own they useskills executeandskills run. They also say that a confirmation is given with--yes.Guarded actionbecomesguarded-action). A folder that a shipped skill or another bundle skill already has gets-2,-3, and so on. A shipped skill's name is still validated as before.<bin> install --refresh-skillsrewrites only the bundle skills, for each install it finds or for the-pproviders given. It adds new skills and removes the folder of a skill the bundle no longer has. The shipped skills, the commands and the MCP entry are left as they are. It takes--dry-run.-p codexalso writes both kinds of skill to.codex/skills/<bin>/(or~/.codex/skills/<bin>/with--scope user). They are tracked in a.frontmcp.jsonthat Codex skips, anduninstall -p codexremoves them.--dry-runand--statuslist the skills by kind, with the bundle version.collectSkillAssets()) setsbundleVersionon a skill that a plugin registered at runtime from a bundle. The CLI build uses this to leave bundle skills out ofbin-meta.jsonand_skills/. The SDK browser bundle sizes are unchanged: every budget passes.User-facing change
<bin> install -p claude|codexwrites the bundle's skills from the running server, as the caller, with CLI usage;<bin> install --refresh-skills;-p codexnow writes skills;--dry-runand--statuslist skills by kind;SkillAssetEntry.bundleVersionis new in the SDK.executeandrun_workflowlines, in kebab-case folders.install --refresh-skillsrewrites the bundle skills and removes the ones that are gone.-p codexwrote only the[mcp_servers]entry → it also writes the skills.--no-skillswas described for-p claudeonly → it skips both kinds for both providers.cli.authRequiredand no login, install now exits 1 withError: could not read the bundle skills from <bin>: Not logged in. ....--target clireference (install section);frontmcp-deployment/references/build-for-cli.md: a new section, "Teaching a coding agent the bundle skills";frontmcp-deployment/references/mcp-client-integration.md: the per-bin commands, what gets written, the Codex skills, and folder names;README.mdand the plugin'sREADME.md.Tests
libs/cli:npx nx test clipasses: 133 suites, 2226 tests. New and changed tests:bundle-skills.spec.ts(14 tests): composing a bundleSKILL.md(frontmatter, the bundle-version marker and refresh line, execute lines from the input schemas, optional input, the--yesnote,run_workflowchaining,skillsgroup commands, a tool left out, no actions); reading the skills from the index andload_skillin batches of 10, skipping shipped skills, failing when no bundle is loaded; shell quoting.skill-tree.spec.ts(15 tests): folder names (spaces, symbols, accents,../, non-Latin names, length), collisions with reserved folders and between skills, and the--statusand refresh summaries.plugin-emitter.spec.ts(15 new tests):generate-cli-entry.spec.ts(2 new tests):installis wired with the CLI's Skilled commands and--refresh-skills; a server without the plugin gets no bundle skills.libs/sdk: thesrc/directsuites pass, 21 suites and 344 tests. A new test checks thatcollectSkillAssets()marks a bundle skill with itsbundleVersion.demo-e2e-cli-exec: the newcli-install-bundle-skills.e2e.spec.ts(8 tests) uses a Skilled OpenAPI server with a@Skillof its own and a bundle skill named with a space. Its CLI runs by name fromPATH. It checks that:bin-meta.jsonlists only the shipped skill;--dry-runlists both kinds and writes nothing;install -p claudewrites both kinds, the space-named skill goes inguarded-action/, and the admin-only skill is left out;SKILL.md'sexecuteandrun_workflowlines, run withsh -c, reach the API and print the invoice;--statuslists both kinds;--refresh-skills --dry-runplans the change, and--refresh-skillsadds one skill, updates one and removes one, leaving the hand-edited shipped skill alone.cli-install-claude-plugin.e2e.spec.ts: the Codex tests now use--scope userand check the Codex skills.cli-login-authorities.e2e.spec.ts: 2 new tests. Install before login exits 1 and writes nothing. An admin's install writes the admin skill, and a viewer's refresh removes it. This spec runs where credentials are kept in a file, so CI on Linux; it is skipped on macOS.demo-e2e-cli-execsuite: 42 suites passed and 1 skipped on macOS; 257 tests passed, 6 skipped.cli-dev-eventsfails here, 3 tests. That spec coversfrontmcp devand touches nothing this PR changes.@frontmcp/observability, the dev server writes no stall events.package.jsonmaps#js-yamlto./src/third-party/lazy-js-yaml.ts, whichdistdoesn't have.demo-e2e-bundle-sizepasses, 12 suites and 63 tests, with the budgets unchanged.nx run-many -t typecheck -p cli,sdk,demo-e2e-cli-exec:typecheck-e2e,tsc --noEmitfor the cli and sdk libraries, prettier and eslint on the changed files,fix-unused-imports, andyarn install --immutable.