Skip to content

Support remote project skills#11459

Open
moirahuang wants to merge 1 commit into
moira/skills-acquisition-repometadatafrom
moira/skills
Open

Support remote project skills#11459
moirahuang wants to merge 1 commit into
moira/skills-acquisition-repometadatafrom
moira/skills

Conversation

@moirahuang
Copy link
Copy Markdown
Contributor

@moirahuang moirahuang commented May 21, 2026

Description

Support remote project skills by threading through LocalOrRemotePath and fetching remote project skill content

Testing

Added unit tests + locally tested

  • I have manually tested my changes locally with ./script/run

Screenshots / Videos

Screenshot 2026-05-21 at 11 23 33 AM

Agent Mode

  • Warp Agent Mode - This PR was created via Warp's AI Agent Mode

@cla-bot cla-bot Bot added the cla-signed label May 21, 2026
Copy link
Copy Markdown
Contributor Author

moirahuang commented May 21, 2026

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

This stack of pull requests is managed by Graphite. Learn more about stacking.

return;
};
let repo_metadata = RepoMetadataModel::as_ref(ctx);
let skill_paths = find_skill_files_in_tree(repo_id, repo_metadata, ctx);
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lmk if this approach makes sense to get the remote skills scan_remote_repository_for_skills -> find_skill_files_in_tree -> spawn_read_remote_skills

@moirahuang moirahuang marked this pull request as ready for review May 21, 2026 18:56
@moirahuang moirahuang requested a review from kevinyang372 May 21, 2026 18:56
@oz-for-oss
Copy link
Copy Markdown
Contributor

oz-for-oss Bot commented May 21, 2026

@moirahuang

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Copy link
Copy Markdown
Contributor

@oz-for-oss oz-for-oss Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overview

This PR threads LocalOrRemotePath through skill discovery/invocation and adds remote project skill hydration from remote repo metadata.

Concerns

  • Remote project skills are only scanned on the initial remote repository update; later remote file-tree updates and repository removals are ignored, so the skill cache can become stale.
  • Remote skill hydration reads every discovered remote SKILL.md without a cumulative batch limit.

Security

  • The remote skill-content read has no cumulative byte budget, allowing a repository with many large skill files to drive unbounded network and memory work during metadata updates.

Verdict

Found: 0 critical, 2 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Comment on lines +191 to +196
RepoMetadataEvent::RepositoryRemoved {
id: RepositoryIdentifier::Local(_) | RepositoryIdentifier::Remote(_),
}
| RepoMetadataEvent::FileTreeEntryUpdated {
id: RepositoryIdentifier::Remote(_),
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [IMPORTANT] Remote repo metadata is the only change signal for remote skills. Ignoring remote removals and file-tree updates leaves deleted/disconnected skills cached and misses new or modified SKILL.md files after the initial snapshot; handle remote removals by deleting cached paths and rescan on remote file-tree updates.

})
.collect(),
max_file_bytes: None,
max_batch_bytes: None,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [IMPORTANT] [SECURITY] This auto-read requests every discovered remote SKILL.md with no cumulative byte limit (max_batch_bytes: None). A repo with many large skill files can force unbounded network/memory work during metadata updates; set a bounded batch budget or cap the number of files before reading remote skill content.

Comment thread app/src/ai/agent/api/convert_from.rs Outdated
match skill_ref.skill_reference {
Some(api::skill_ref::SkillReference::Path(path)) => Some(SkillReference::Path(path.into())),
Some(api::skill_ref::SkillReference::Path(path)) => Some(SkillReference::Path(
warp_util::local_or_remote_path::LocalOrRemotePath::Local(path.into()),
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we assuming local path here?

.and_then(|skill_path| {
SkillManager::as_ref(app).skill_by_path(&skill_path)
SkillManager::as_ref(app)
.skill_by_path(&LocalOrRemotePath::Local(skill_path))
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also why are we assuming Local path here?

.and_then(|skill_path| {
SkillManager::as_ref(app).skill_by_path(&skill_path)
SkillManager::as_ref(app)
.skill_by_path(&LocalOrRemotePath::Local(skill_path))
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also also why are we assuming Local path here?

.and_then(|common| skill_path_from_file_path(&common))
.and_then(|skill_path| SkillManager::as_ref(app).skill_by_path(&skill_path));
.and_then(|skill_path| {
SkillManager::as_ref(app).skill_by_path(&LocalOrRemotePath::Local(skill_path))
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also also also why are we assuming Local path here?

@@ -71,7 +77,9 @@ impl SkillWatcher {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should read_skills_for_repos take in LocalOrRemotePaths?

It's unclear what method assumes local and what assumes remote

RepoMetadataEvent::RepositoryUpdated {
id: remote_id @ RepositoryIdentifier::Remote(_),
} => {
me.scan_remote_repository_for_skills(remote_id, ctx);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to avoid having separate APIs for remote / local especially now we have LocalOrRemotePath. We should think about taking in LocalOrRemotePath as parameter and only branch off on local / remote when we need to

@moirahuang moirahuang changed the base branch from master to graphite-base/11459 May 22, 2026 23:45
@moirahuang moirahuang changed the base branch from graphite-base/11459 to moira/skills-acquisition-repometadata May 22, 2026 23:46
Co-Authored-By: Oz <oz-agent@warp.dev>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants