fix: load leading-slash skill paths and group skills in the slash menu

[marius-kilocode]

What Problem This Solves

Fixes #14181. A skills.paths entry written with a leading slash, such as /.github/skills, was read as an absolute filesystem path. Discovery scanned the filesystem root (or the current drive root on Windows), found nothing, logged skill path not found, and skipped the entry. Users who registered a repository skill folder this way saw an empty skill list and Skill "x" not found.

Fixes #14096. The VS Code slash menu listed every loaded skill under the COMMANDS header with no distinct label. When a skill shared its name with a custom command, the menu showed two identical /name rows, and selecting either ran the command, leaving the skill unreachable from the menu.

Why This Change Was Made

The upstream resolver keeps absolute-first semantics for skills.paths and Kilo has no upstream fix to reuse, so the fallback lives in a Kilo-owned helper. A /x or \x entry without a drive letter is still tried as an absolute path first; only when that directory does not exist is it resolved relative to the project root. Drive-qualified (C:\x) and UNC (\\server\share) entries never fall back.

The fallback re-derives a path inside the project, so it must not inherit the trusted status of the config that declared it. Trust now requires that the resolved directory is still the declared value, which keeps the fallback project-scoped and untrusted. Real absolute paths and ~/ entries keep their previous trust behaviour.

For the slash menu, the CLI already resolves name:skill to a skill (the same convention the TUI displays), so the webview applies that suffix to a skill whose name clashes with a command or MCP prompt instead of hiding one of the two rows.

User Impact

• /.github/skills, .github/skills, and ./.github/skills now load the same repository skills.
• Existing relative, ~/, and real absolute entries behave exactly as before.
• Skills loaded through the fallback are treated as project skills and stay untrusted.
• The slash menu gains an ACTIONS / COMMANDS / SKILLS grouping. A clashing skill is listed as /name:skill and inserts /name:skill , so both the command and the skill stay reachable.
• Documentation for skills.paths and for skill slash invocation was added in the VS Code and CLI tabs.

Evidence

Automated: packages/opencode/test/kilocode/skill/paths.test.ts (4 tests: rooted detection for Windows and POSIX forms, leading-slash fallback, relative/dot/absolute regression, missing path skipped). Four new picker tests in packages/kilo-vscode/tests/unit/use-slash-command.test.ts (grouping order, clash renaming, duplicate rows, selection text). All skill suites (90 tests) and the full extension unit suite (5735 tests) pass. bun turbo typecheck, kilo-vscode typecheck and lint, knip, check-kilocode-change, check-opencode-annotations --worktree, and prettier are clean.

VS Code self-test with a fixture repo (skills.paths: ["/.github/skills"], a grill skill, a foo skill, and a foo custom command):

• Settings > Agent Behaviour > Skills shows the /.github/skills path and lists grill and foo as discovered skills with their repository paths.
• The /foo menu shows /foo under COMMANDS and /foo:skill under SKILLS; selecting the skill row inserts /foo:skill .

The failure reproduced identically on v7.4.6, v7.5.16, and current HEAD, so this is a pre-existing gap rather than a recent regression. A resolved code review noted that the v2 ConfigSkillPlugin has a second copy of the resolver without the fallback; nothing user-facing reads the v2 result yet, so that alignment is left for the v2 migration.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/kilo-vscode/webview-ui/src/hooks/useSlashCommand.ts	259	taken only covers server entries, so skills colliding with client-side commands (e.g. review, export, help) are still filtered out and remain unreachable from the / menu.

Files Reviewed (8 files)

• .changeset/skills-paths-leading-slash-and-picker-groups.md
• packages/kilo-docs/pages/customize/skills.md
• packages/kilo-vscode/tests/unit/use-slash-command.test.ts
• packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx
• packages/kilo-vscode/webview-ui/src/hooks/useSlashCommand.ts - 1 issue
• packages/opencode/src/kilocode/skill/paths.ts
• packages/opencode/src/skill/index.ts
• packages/opencode/test/kilocode/skill/paths.test.ts

---

The skill-path fallback itself looks correct: path.join (unlike path.resolve) does not reset on a leading /, so /.github/skills correctly becomes <project>/.github/skills, drive-qualified and UNC entries are excluded by rooted(), and requiring dir === expanded before trusting the entry keeps the fallback project-scoped and untrusted. The "action", "command", "skill" grouping in PromptInput matches the results() ordering used for keyboard navigation.

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}