feat(coderd/x/chatd): inject personal skills into chats#25367
feat(coderd/x/chatd): inject personal skills into chats#25367ibetitsmike wants to merge 1 commit into
Conversation
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5acacdf669
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Roles: rbac.RoleIdentifiers{rbac.RoleMember()}, | ||
| Scope: rbac.ScopeAll, |
There was a problem hiding this comment.
userSkillContext fabricates a new subject with RoleMember and ScopeAll, then uses it for ListUserSkillMetadataByUserID and GetUserSkillByUserIDAndName. In chats started with a restricted API key, this bypasses the original token scopes, so a turn can read personal skills even when the caller did not grant user_skill:read. That is a privilege escalation relative to API key permissions; the chat worker should carry forward the admitted actor scope (or a persisted scoped subject) instead of unconditionally widening to ScopeAll.
Useful? React with 👍 / 👎.
Stack Context
This stack splits experimental personal skills into smaller reviewable PRs. This PR builds on #25366 and completes the feature wiring.
Stack order:
What?
Injects personal skill metadata into chatd prompts, refreshes skill aliases when workspace context changes, and registers the skill-reading tools when personal or workspace skills are available.
Why?
This is the final integration point that makes stored personal skills available to chats without syncing them into workspace filesystems.