feat(opencode): add reload_skills tool and live skill management - #16
Merged
Conversation
Replaces the one-time InstanceState snapshot with a Ref<State> that can be updated atomically. Adds refresh() which rescans all configured skill directories and updates the Ref without restarting the process. Security fixes included: - Prevent path traversal in URL-sourced skill discovery (skill.name and file paths validated against cache boundary before download) - Use Object.create(null) for skills Record to prevent prototype pollution via __proto__ skill names - XML-escape skill name and description in fmt() verbose output to prevent prompt injection in the LLM system context Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>
Adds a reload_skills tool that calls Skill.Service.refresh() and returns the updated skill list immediately. Skills created or modified during an active session are available without restart. - Command.Service.list() and get() now read skills live from Skill.Service (Ref.get, no I/O) instead of a one-time init snapshot — new skills appear in the slash command picker immediately after reload_skills runs - Publishes command.catalog.updated event after refresh; stream transport detects this and calls loadCatalog() to update the TUI picker Closes anomalyco#27956, anomalyco#6719, anomalyco#23304, anomalyco#29266 Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>
Skill invocations in the web UI now show `[skill] name` instead of just the skill name, making them clearly identifiable in the chat. Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>
shoootyou
force-pushed
the
feat/reload-skills-tool
branch
from
June 14, 2026 09:36
8cfe339 to
91c7ab4
Compare
Registers /reload as a built-in slash command in Command.Service. When invoked, the template instructs the LLM to call the reload_skills tool — rescanning configured skill directories and refreshing the available skill list without restarting the session. Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>
shoootyou
force-pushed
the
feat/reload-skills-tool
branch
from
June 14, 2026 09:49
815358a to
cf832c7
Compare
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an explicit
reload_skillstool that rescans configured skill directories and makes newly created or modified skills available immediately — no restart required.What changes
Skill.Service: state moves from a one-time init snapshot to aRef<State>with an explicitrefresh()methodreload_skillstool: rescans and returns the updated skill listCommand.Service: reads skills live on eachlist()/get()call so the slash command picker reflects changes immediately[skill] namefor clear identification in the chatUsage
Security fixes included
Object.create(null)) for skill name recordsfmt()verbose output to prevent prompt injectionCloses anomalyco#27956, anomalyco#6719, anomalyco#23304