agents: caller-provided skills hook (move node1-ssh to the owning repo) #65

2026-07-05T16:36:22+02:00

ffaerber commented

2026-07-05 16:36:22 +02:00

Adds a caller-provided skills hook so a consuming repo can ship its own opencode skills instead of them being hardcoded in this shared framework. First use: moving the deploy-host node1-ssh skill out to the homelab repo (companion PR: homelab#feat/own-node1-skill).

Mechanism

A caller repo commits skills under .gitea/agent-skills/<name>/:

SKILL.md — the opencode Skill doc (copied verbatim into the registry)
skill.json — {"agents":["senior","lead"]} — which agents may load it
setup.sh (optional) — runtime setup (e.g. write an SSH alias). Runs only when the running agent is allowed the skill; receives $SECRETS_JSON (= toJSON(secrets)) and extracts the repo-specific secrets it needs via jq (the framework can't know their names).

install-caller-skills.sh scans the checked-out caller workspace, installs the allowed skills, runs their setup, and merges them into the permission.skill allow-list opencode already wrote.

Changes

new install-caller-skills.sh
agent.yml — replace the hardcoded node1 step with the generic caller-skills step (NAME, WORKSPACE, SECRETS_JSON)
delete skill-node1-ssh.sh; drop "node1-ssh" from agents.json (senior/lead) — homelab owns it now
run-agent.sh — note caller skills aren't in the roster (route via the caller's AGENTS.md)

Verification

toJSON(secrets) confirmed supported on this Gitea (1.27) via an isolated workflow_dispatch probe (valid JSON, real values in-env, masked in logs). YAML validated. Merge this before the homelab PR so the hook exists when homelab's skill lands.

Adds a **caller-provided skills** hook so a consuming repo can ship its own opencode skills instead of them being hardcoded in this shared framework. First use: moving the deploy-host `node1-ssh` skill out to the `homelab` repo (companion PR: `homelab#feat/own-node1-skill`). ## Mechanism A caller repo commits skills under `.gitea/agent-skills/<name>/`: - `SKILL.md` — the opencode Skill doc (copied verbatim into the registry) - `skill.json` — `{"agents":["senior","lead"]}` — which agents may load it - `setup.sh` (optional) — runtime setup (e.g. write an SSH alias). Runs only when the running agent is allowed the skill; receives `$SECRETS_JSON` (= `toJSON(secrets)`) and extracts the repo-specific secrets it needs via `jq` (the framework can't know their names). `install-caller-skills.sh` scans the checked-out caller workspace, installs the allowed skills, runs their setup, and merges them into the `permission.skill` allow-list opencode already wrote. ## Changes - **new** `install-caller-skills.sh` - `agent.yml` — replace the hardcoded node1 step with the generic caller-skills step (`NAME`, `WORKSPACE`, `SECRETS_JSON`) - **delete** `skill-node1-ssh.sh`; drop `"node1-ssh"` from `agents.json` (senior/lead) — homelab owns it now - `run-agent.sh` — note caller skills aren't in the roster (route via the caller's `AGENTS.md`) ## Verification `toJSON(secrets)` confirmed supported on this Gitea (1.27) via an isolated `workflow_dispatch` probe (valid JSON, real values in-env, masked in logs). YAML validated. Merge this **before** the homelab PR so the hook exists when homelab's skill lands.

ffaerber added 1 commit 2026-07-05 16:36:23 +02:00

agents: caller-provided skills hook — repos can ship their own opencode skills 0f8893330f

A consuming repo can now add repo-specific skills under .gitea/agent-skills/<name>/
(SKILL.md + skill.json + optional setup.sh); the framework installs the ones
allowed for the running agent. This keeps deploy-target / infra specifics in the
repo they belong to instead of hardcoded in the shared workflow.

- install-caller-skills.sh: scans the caller workspace, installs each skill whose
  skill.json `agents` list includes the running agent, runs its optional setup.sh
  with all inherited secrets available as $SECRETS_JSON (toJSON(secrets) — so a
  caller's setup can read repo-specific secret names the framework can't know),
  and merges the allowed skills into the permission.skill allow-list.
- agent.yml: replace the hardcoded node1-ssh step with the generic caller-skills
  step (passes NAME, WORKSPACE, SECRETS_JSON).
- Remove the built-in node1-ssh skill: delete skill-node1-ssh.sh, drop "node1-ssh"
  from agents.json (senior/lead). The homelab repo now owns that skill.
- run-agent.sh: note caller-provided skills aren't in the roster (route them via
  the caller's AGENTS.md).

toJSON(secrets) verified supported on this Gitea (1.27) via an isolated probe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ffaerber merged commit 269e932b19 into main

2026-07-05 16:37:13 +02:00

ffaerber deleted branch feat/caller-provided-skills

2026-07-05 16:37:14 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: gitea/agents#65