morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1463] [MERGED] fix(skills): expose authored skill to repository discovery #2903

New issue

Closed

opened 2026-10-17 21:11:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:11:36 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1463
Author: @morluto
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @morluto

Base: main ← Head: codex/fix-skill-source-discovery

📝 Commits (1)

696fb83 fix(skills): expose authored skill to repository discovery

📊 Changes

18 files changed (+119 additions, -14 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/android-applications.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/evidence-workflows.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/javascript-applications.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/runtime-observation.md (+0 -0)
📝 .github/pull_request_template.md (+1 -1)
📝 AGENTS.md (+1 -1)
📝 CONTRIBUTING.md (+6 -2)
📝 docs/installation.md (+1 -1)
📝 scripts/generate-package-metadata.mjs (+1 -1)
📝 scripts/generate-skill-metadata.mjs (+2 -2)
📝 scripts/verify-package-pack.mjs (+1 -1)
📝 scripts/verify-package.mjs (+4 -0)
➕ scripts/verify-repository-skill.mjs (+97 -0)
📝 tests/boundary/filesystem/dependencyInstall.test.ts (+1 -1)
📝 tests/boundary/filesystem/generatedSkill.test.ts (+1 -1)
📝 turbo.json (+3 -3)

📄 Description

Summary

Fixes #1459.

Make npx skills add https://github.com/morluto/rea --skill reverse-engineer-anything discover and install the complete public skill from the repository root. Move its six authored files to .agents/skills/reverse-engineer-anything/ and preserve the generated npm bundle used by rea-agents setup.

Problem and expected behavior

Skills 1.7.2 searches conventional skill directories before its recursive fallback. REA's contributor skill at .agents/skills/rea-tool-design/ satisfies that search, so Skills never reaches the public bundle under skill-src/. The documented root command exits 1 with No matching skills found for: reverse-engineer-anything and lists only rea-tool-design.

The public skill now lives in a directory Skills searches directly. Installation needs neither a source subdirectory URL nor --full-depth nor a REA build.

Change and scope

Rename the authored skill and all five references without changing their contents.
Update metadata generators, Turbo inputs, filesystem fixtures, contributor guidance and the installation link to the new source location.
Keep generation and npm packaging at skills/reverse-engineer-anything/, including release pinning and catalog metadata.
Extend verify:package with the real Skills 1.7.2 consumer. It copies Git-tracked source files into an isolated snapshot without generated output, uses default root discovery, checks that only the requested skill was installed and compares every installed file byte for byte.

Contract and boundary impact

Semantic owner and earliest changed stage: authored skill location and repository discovery.
CLI and MCP/tool-catalog contract: no changes.
Provider, bridge, target-format, or platform compatibility: no changes.
Evidence, artifact, provenance, or reconstruction contract: no changes.
Process execution, authorization, cleanup, or containment impact: the distribution verifier runs the pinned Skills CLI with isolated home/config directories and cleans up its workspace. Setup approval semantics are preserved.
Generated metadata, package, or installation impact: generators consume .agents/skills/reverse-engineer-anything/; npm continues shipping the generated skills/ bundle. The pack verifier rejects authored .agents/ sources in the tarball.

Evidence and regression coverage

The new consumer check fails against a clean export of base revision c89c8f531 with the original missing-skill error and passes with this change, installing all six files exactly.
A live npx --yes skills@1.7.2 add 'https://github.com/morluto/rea#codex/fix-skill-source-discovery' --skill reverse-engineer-anything --agent codex --yes installation from the pushed GitHub branch also passed, with all six files byte-identical to the authored bundle.
The existing generation tests cover source preservation, CRLF normalization, stale/missing/extra references and pinned release commands at the new source path.
A real npx --yes --package <packed-release.tgz> rea-agents setup --client codex --yes --json run in an isolated home returned ready, configured Codex and applied installed_skill. All six installed files matched the generated release bundle. Repeating the same command returned ready with no planned or applied actions.
Remaining proof gaps: package setup uses fake provider fixtures on macOS arm64. This verifies distribution and setup behavior; real Hopper/Ghidra/IDA workflows were not exercised.

Validation performed

npm run test:focused -- tests/boundary/filesystem/generatedSkill.test.ts tests/boundary/filesystem/dependencyInstall.test.ts — 10 tests passed.
npm run check — passed, including types, lint, formatting, metadata, Knip and architecture guards.
npm run docs:check — passed.
npm run verify:package — passed, including root Skills discovery, complete skill installation, setup planning, idempotency, backups, recovery and uninstall.
npm pack --dry-run --json — passed; all six generated skill files are included and authored .agents/ sources are excluded.
Packed-release npx rea-agents setup smoke test — passed twice as described above.
Pre-commit formatting/lint and pre-push check:fast — passed.

Compatibility, safety, and release

Breaking changes or migration steps: none for installed users. Contributors edit the new authored source directory.
Real Hopper/Ghidra, browser, or OS coverage: macOS arm64 distribution/setup with fake providers; no new real-provider claims.
Package or release metadata impact: no version bump or generated outputs committed.
Security, privacy, process, or containment review: install probes used disposable homes and preserved setup's existing authority rules.

Review checklist

This PR addresses a concrete problem with one focused outcome and a Conventional Commit title.
Related issue is linked.
Regression coverage exercises observable consumer behavior and fails on the base revision.
Owning docs, build inputs and source consumers are updated.
Final diff checked for secrets, unrelated changes and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1463 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/fix-skill-source-discovery` --- ### 📝 Commits (1) - [`696fb83`](https://github.com/morluto/rea/commit/696fb834b8873ac9f6df0c4d45377bdd7c3c5762) fix(skills): expose authored skill to repository discovery ### 📊 Changes **18 files changed** (+119 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/android-applications.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/evidence-workflows.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/javascript-applications.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/runtime-observation.md` (+0 -0) 📝 `.github/pull_request_template.md` (+1 -1) 📝 `AGENTS.md` (+1 -1) 📝 `CONTRIBUTING.md` (+6 -2) 📝 `docs/installation.md` (+1 -1) 📝 `scripts/generate-package-metadata.mjs` (+1 -1) 📝 `scripts/generate-skill-metadata.mjs` (+2 -2) 📝 `scripts/verify-package-pack.mjs` (+1 -1) 📝 `scripts/verify-package.mjs` (+4 -0) ➕ `scripts/verify-repository-skill.mjs` (+97 -0) 📝 `tests/boundary/filesystem/dependencyInstall.test.ts` (+1 -1) 📝 `tests/boundary/filesystem/generatedSkill.test.ts` (+1 -1) 📝 `turbo.json` (+3 -3) </details> ### 📄 Description ## Summary Fixes #1459. Make `npx skills add https://github.com/morluto/rea --skill reverse-engineer-anything` discover and install the complete public skill from the repository root. Move its six authored files to `.agents/skills/reverse-engineer-anything/` and preserve the generated npm bundle used by `rea-agents setup`. ## Problem and expected behavior Skills 1.7.2 searches conventional skill directories before its recursive fallback. REA's contributor skill at `.agents/skills/rea-tool-design/` satisfies that search, so Skills never reaches the public bundle under `skill-src/`. The documented root command exits 1 with `No matching skills found for: reverse-engineer-anything` and lists only `rea-tool-design`. The public skill now lives in a directory Skills searches directly. Installation needs neither a source subdirectory URL nor `--full-depth` nor a REA build. ## Change and scope - Rename the authored skill and all five references without changing their contents. - Update metadata generators, Turbo inputs, filesystem fixtures, contributor guidance and the installation link to the new source location. - Keep generation and npm packaging at `skills/reverse-engineer-anything/`, including release pinning and catalog metadata. - Extend `verify:package` with the real Skills 1.7.2 consumer. It copies Git-tracked source files into an isolated snapshot without generated output, uses default root discovery, checks that only the requested skill was installed and compares every installed file byte for byte. ## Contract and boundary impact - Semantic owner and earliest changed stage: authored skill location and repository discovery. - CLI and MCP/tool-catalog contract: no changes. - Provider, bridge, target-format, or platform compatibility: no changes. - Evidence, artifact, provenance, or reconstruction contract: no changes. - Process execution, authorization, cleanup, or containment impact: the distribution verifier runs the pinned Skills CLI with isolated home/config directories and cleans up its workspace. Setup approval semantics are preserved. - Generated metadata, package, or installation impact: generators consume `.agents/skills/reverse-engineer-anything/`; npm continues shipping the generated `skills/` bundle. The pack verifier rejects authored `.agents/` sources in the tarball. ## Evidence and regression coverage - The new consumer check fails against a clean export of base revision `c89c8f531` with the original missing-skill error and passes with this change, installing all six files exactly. - A live `npx --yes skills@1.7.2 add 'https://github.com/morluto/rea#codex/fix-skill-source-discovery' --skill reverse-engineer-anything --agent codex --yes` installation from the pushed GitHub branch also passed, with all six files byte-identical to the authored bundle. - The existing generation tests cover source preservation, CRLF normalization, stale/missing/extra references and pinned release commands at the new source path. - A real `npx --yes --package <packed-release.tgz> rea-agents setup --client codex --yes --json` run in an isolated home returned `ready`, configured Codex and applied `installed_skill`. All six installed files matched the generated release bundle. Repeating the same command returned `ready` with no planned or applied actions. - Remaining proof gaps: package setup uses fake provider fixtures on macOS arm64. This verifies distribution and setup behavior; real Hopper/Ghidra/IDA workflows were not exercised. ## Validation performed - `npm run test:focused -- tests/boundary/filesystem/generatedSkill.test.ts tests/boundary/filesystem/dependencyInstall.test.ts` — 10 tests passed. - `npm run check` — passed, including types, lint, formatting, metadata, Knip and architecture guards. - `npm run docs:check` — passed. - `npm run verify:package` — passed, including root Skills discovery, complete skill installation, setup planning, idempotency, backups, recovery and uninstall. - `npm pack --dry-run --json` — passed; all six generated skill files are included and authored `.agents/` sources are excluded. - Packed-release `npx rea-agents setup` smoke test — passed twice as described above. - Pre-commit formatting/lint and pre-push `check:fast` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none for installed users. Contributors edit the new authored source directory. - Real Hopper/Ghidra, browser, or OS coverage: macOS arm64 distribution/setup with fake providers; no new real-provider claims. - Package or release metadata impact: no version bump or generated outputs committed. - Security, privacy, process, or containment review: install probes used disposable homes and preserved setup's existing authority rules. ## Review checklist - [x] This PR addresses a concrete problem with one focused outcome and a Conventional Commit title. - [x] Related issue is linked. - [x] Regression coverage exercises observable consumer behavior and fails on the base revision. - [x] Owning docs, build inputs and source consumers are updated. - [x] Final diff checked for secrets, unrelated changes and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:11:36 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:08:59 +00:00

[PR #3417] [MERGED] fix(test): honor Ghidra startup budgets in Windows verification #5730

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2903

No description provided.

Rows
Columns