GeezerVison

Add sqlc queries for skills owned by a chat project and authorize them
through the parent project in dbauthz: reading needs chat_project:read
and writing needs chat_project:update. Skill.RBACObject keeps denying
project rows so any unwrapped path fails closed.

Add the chat_project_skill audit resource type and
AuditableChatProjectSkill so the upcoming project skill API can record
audit entries.

…lper

…r project

Add experimental routes to list, create, read, update and delete skills
on a chat project. Reading needs read on the project and writes need
update; callers who lack the permission get a 404 like the project
instructions routes. The handlers reuse the shared skill create and
update path, map the per-project cap and name index to 409, and audit
every write as a chat_project_skill.

Add matching ExperimentalClient methods.

Chats in a project now get the project's enabled skills as a new
"project" skill source, read as the chat owner each turn. Subagents use
the root chat's project. read_skill loads project skill bodies, and
MergeSkills takes sources in merge order so new sources do not change
its signature.

The "/" menu offers the skills of the chat's project, next to personal,
organization and workspace skills, and /clear and /compact defer to a
project skill with the same name. Documents project skills.

…g in the slash menu

Organization and project skills load through one hook, and the menu
renders its skill groups from one ordered list. Adds project loading and
error stories.

…lify skill group offsets

…nd resolve emptiness in the hook

…naming in the composer

Cover the project-only skill tool check in the integration test, the
project skill body loader's not-found mapping, and the chat-projects
experiment gate in the composer.

chatgpt-codex-connector Bot left a comment

… request instead of menu markup

Every observer of the project skills query now shares its retry policy,
and a 403 or 404 after an earlier load also counts as no project skills.

…st access after project skills loaded

chatgpt-codex-connector Bot left a comment

chatd loads project skills only when the chat owner owns the project or it
is shared with them, while the skills list endpoint also honors role
grants. The page and the composer now also consult the caller's project
list, which holds only owned and shared projects, and keep project skills
unknown while that list is unsettled.

The composer tests mock the project list, seed caches with the exported
chatProjectSkillsKey, and wait on query state instead of DOM absence.

chatgpt-codex-connector Bot left a comment

…il refetched

A cached list can predate a share's revocation as well as its creation, so
a project it contains is no more current than one it lacks.

nickvigilante left a comment

Turns check project access once with resolveUsableChatProjectID and then
load instructions and skills, so resolveProjectInstructions had no
production callers. Its tests now cover resolveUsableChatProjectID and
loadProjectInstructions directly.

…coder into chat-project-skills/chatd

…retry prompt for unusable projects

A 403 or 404 from the project skills request means the caller lost access
to the project, which the composer already treats as no project skills.
The slash menu still showed "Could not load project skills" with a retry
hint that could never succeed, so a project the caller cannot use no longer
shows a loading or error status. A story covers the menu in that state.

chatgpt-codex-connector Bot left a comment