Files
deepseek-harness/packages/skill
Tianyi Cui 0664b25cd9 fix(review): validate skill roots at mount and isolate provider default roots
ds-review-bot round 1 on the repository-plugin runtime:
- a manifest-declared skill root absent or non-directory in the installed
  package now fails the plugin load (skill-local treats a missing root as
  legitimately empty, which silently mounted a skill-less plugin)
- includeDefaultRoots: false no longer inherits $DSH_BUNDLED_SKILL_DIR, so
  isolated repository providers see only their explicit roots
- prepared wrapper baseUrl schema requires the file: scheme, failing hostile
  URLs at the declared validation boundary
- preparedPath reuses format.ts's isOutside; SERVER_NAME_PATTERN is exported
  and pinned equal to dsh-mcp-client's, with the restatement justified (the
  prepare bin keeps a zod-only module graph); the unexplained `as never`
  cast now carries its schemastery rationale
- the import-free wrapper assertion also rejects dynamic import(
- the headless fixture wrapper is regenerated by the real prepareDshPlugin
  and a drift test pins fixture == generator output
- prepareDshPlugin JSDoc states the non-atomic publish repair contract
2026-08-02 01:25:02 +08:00
..

skill/ - skill capability family

English | 中文

The canonical three-package capability seam for reusable agent instructions: a provider registry, a local implementation, and the model-facing catalog/loader consumer. All are product packages.

Package Role ctx key
skill/ Provider registry, precedence resolution, complete/incomplete catalog snapshots, and full-definition lookup ctx.skills
skill-local/ Project/custom/user filesystem provider with membership watching (registers on ctx.skills)
tool-skill/ Initial and replacement catalogs plus the model-facing skill loader (registers on ctx.tools)

The interface lives at skill/skill/. Providers register synchronously and perform asynchronous discovery through ctx.skills; tool-skill consumes only that interface, so an embedded or remote provider can replace or complement skill-local without changing the model-facing contract. agent-core loads this family by default, but it remains a capability outside the core control spine, parallel to bash/, fs/, web/, and subagent/.