refactor: move credential deny rules to ask, support multi-skill repo entries - #868
Conversation
…epo entries Deny permissions silently blocked access with no recovery path; moving them to ask lets the user approve on a case-by-case basis instead. Also reworks the skills install loop to support installing multiple skills per repo via a repo=skill1,skill2 entry format. Co-Authored-By: Claude <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR updates the chezmoi onchange script to construct an agents array and install repo-specific skills via npx skills add instead of a global wildcard skill list, and modifies the Claude settings JSON template's permissions (ask, read, deny) patterns. ChangesAgent Skill Wiring
Claude Settings Permissions
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ BASH | shfmt | 3 | 0 | 0 | 0 | 0.02s |
| prettier | 9 | 0 | 1 | 0 | 0.53s | |
| markdownlint | 6 | 0 | 2 | 0 | 0.58s | |
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.17s |
| ✅ YAML | prettier | 10 | 0 | 0 | 0 | 0.53s |
Detailed Issues
⚠️ MARKDOWN / markdownlint - 2 errors
chezmoi/private_dot_claude/modify_CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
chezmoi/private_dot_config/opencode/modify_AGENTS.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
⚠️ JSON / prettier - 1 error
chezmoi/.chezmoitemplates/claude-settings.json 88ms (unchanged)
chezmoi/.chezmoitemplates/mcp_servers.json 6ms (unchanged)
chezmoi/.chezmoitemplates/opencode-tui.json 2ms (unchanged)
chezmoi/.chezmoitemplates/opencode.json 4ms (unchanged)
[error] chezmoi/private_dot_claude/modify_settings.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/mcp/modify_mcp_servers.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_opencode.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_tui.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
renovate.json 5ms (unchanged)
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters BASH_SHFMT,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,YAML_PRETTIER
Show us your support by starring ⭐ the repository
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the agent plugins installation script to support mapping specific skills to repositories, and updates the Claude settings template by reorganizing allowed file patterns, removing the global deny list, and removing sandbox credential restrictions. Feedback on the installation script highlights that the --global flag was mistakenly removed, which breaks global installation, and that the script lacks fallback handling for repository entries without an = delimiter.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ BASH | bash-exec | 3 | 0 | 0 | 0.01s | |
| ✅ BASH | shellcheck | 3 | 0 | 0 | 0.1s | |
| ✅ REPOSITORY | checkov | yes | no | no | 23.98s | |
| ✅ REPOSITORY | devskim | yes | no | no | 2.22s | |
| ✅ REPOSITORY | dustilock | yes | no | no | 0.01s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 1.54s | |
| ✅ REPOSITORY | grype | yes | no | no | 48.76s | |
| ✅ REPOSITORY | kingfisher | yes | no | no | 8.59s | |
| osv-scanner | yes | 1 | no | 0.12s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.8s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.85s | |
| ✅ REPOSITORY | trivy | yes | no | no | 11.28s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.18s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.9s |
Detailed Issues
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
End status: 40 dirs visited, 140 inodes visited, 0 Extract calls, 3.682847ms elapsed, 3.682997ms wall time
No package sources found, --help for usage information.
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters BASH_EXEC,BASH_SHELLCHECK,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER
Show us your support by starring ⭐ the repository
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 5 | 0 | 0 | 0.32s | |
| ✅ ACTION | zizmor | 5 | 0 | 0 | 0 | 0.98s |
| ✅ BASH | bash-exec | 3 | 0 | 0 | 0.01s | |
| ✅ BASH | shellcheck | 3 | 0 | 0 | 0.12s | |
| ✅ BASH | shfmt | 3 | 0 | 0 | 0 | 0.02s |
| ✅ COPYPASTE | jscpd | yes | no | no | 0.87s | |
| ✅ EDITORCONFIG | editorconfig-checker | 67 | 0 | 0 | 0.08s | |
| prettier | 9 | 0 | 1 | 0 | 0.55s | |
| ✅ JSON | v8r | 9 | 0 | 0 | 4.02s | |
| markdownlint | 6 | 0 | 2 | 0 | 0.7s | |
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.27s |
| ✅ REPOSITORY | checkov | yes | no | no | 24.04s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 1.19s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| ✅ REPOSITORY | grype | yes | no | no | 47.33s | |
| osv-scanner | yes | 1 | no | 0.27s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.33s | |
| ✅ REPOSITORY | syft | yes | no | no | 2.6s | |
| ✅ REPOSITORY | trivy | yes | no | no | 11.84s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.29s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.99s | |
| lychee | 25 | 2 | 0 | 1.12s | ||
| ✅ YAML | prettier | 10 | 0 | 0 | 0 | 0.55s |
| ✅ YAML | v8r | 10 | 0 | 0 | 7.62s | |
| ✅ YAML | yamllint | 10 | 0 | 0 | 0.53s |
Detailed Issues
⚠️ SPELL / lychee - 2 errors
📝 Summary
---------------------
🔍 Total...........21
🔗 Unique..........16
✅ Successful......19
⏳ Timeouts.........0
🔀 Redirected.......4
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2
Errors in chezmoi/.chezmoitemplates/mcp_servers.json
[406] https://mcp.deepwiki.com/mcp (at 11:15) | Rejected status code: 406 Not Acceptable
Errors in chezmoi/.chezmoitemplates/opencode.json
[406] https://mcp.deepwiki.com/mcp (at 25:15) | Rejected status code: 406 Not Acceptable
Hint: Followed 4 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 2 errors
chezmoi/private_dot_claude/modify_CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
chezmoi/private_dot_config/opencode/modify_AGENTS.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
End status: 40 dirs visited, 140 inodes visited, 0 Extract calls, 15.555669ms elapsed, 15.555899ms wall time
No package sources found, --help for usage information.
⚠️ JSON / prettier - 1 error
chezmoi/.chezmoitemplates/claude-settings.json 85ms (unchanged)
chezmoi/.chezmoitemplates/mcp_servers.json 7ms (unchanged)
chezmoi/.chezmoitemplates/opencode-tui.json 2ms (unchanged)
chezmoi/.chezmoitemplates/opencode.json 7ms (unchanged)
[error] chezmoi/private_dot_claude/modify_settings.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/mcp/modify_mcp_servers.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_opencode.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_tui.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
renovate.json 8ms (unchanged)
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,COPYPASTE_JSCPD,EDITORCONFIG_EDITORCONFIG_CHECKER,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
chezmoi/.chezmoitemplates/claude-settings.json (1)
36-47: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd the missing credential paths to
askchezmoi/.chezmoitemplates/claude-settings.json:36-47—~/.cargo/credentials,~/.gem/credentials,~/.netrc, and~/.pypircare still missing here. Withdenyremoved anddefaultMode: "auto", those paths would no longer be gated. If they’re meant to stay protected, add matchingEdit(...)/Read(...)entries.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@chezmoi/.chezmoitemplates/claude-settings.json` around lines 36 - 47, Add the missing credential entries to the `ask` list in `claude-settings.json`: include matching `Edit(...)` or `Read(...)` rules for `~/.cargo/credentials`, `~/.gem/credentials`, `~/.netrc`, and `~/.pypirc` alongside the existing paths. Update the `ask` array in the Claude settings template so these secrets remain gated now that `deny` is removed and `defaultMode` is `auto`.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@chezmoi/.chezmoiscripts/run_onchange_after_agent_plugins.sh.tmpl`:
- Around line 34-38: The skills installation call in
run_onchange_after_agent_plugins.sh.tmpl is passing arrays to npx skills add as
single flag occurrences, so multiple skills and agents are not applied
correctly. Update the loop around repo_skills so the command invocation repeats
the --skill and --agent flags once per value from the skills and agents arrays,
preserving each item as its own flag argument while keeping the existing repo
and yes parameters intact.
---
Outside diff comments:
In `@chezmoi/.chezmoitemplates/claude-settings.json`:
- Around line 36-47: Add the missing credential entries to the `ask` list in
`claude-settings.json`: include matching `Edit(...)` or `Read(...)` rules for
`~/.cargo/credentials`, `~/.gem/credentials`, `~/.netrc`, and `~/.pypirc`
alongside the existing paths. Update the `ask` array in the Claude settings
template so these secrets remain gated now that `deny` is removed and
`defaultMode` is `auto`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 740d056e-2bfb-4d15-b77a-babae5e55214
📒 Files selected for processing (2)
chezmoi/.chezmoiscripts/run_onchange_after_agent_plugins.sh.tmplchezmoi/.chezmoitemplates/claude-settings.json
| for entry in "${repo_skills[@]}"; do | ||
| repo="${entry%%=*}" | ||
| skills_csv="${entry#*=}" | ||
| IFS=',' read -r -a skills <<<"${skills_csv}" | ||
| npx --yes skills add "${repo}" --skill "${skills[@]}" --agent "${agents[@]}" --yes |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files 'chezmoi/.chezmoiscripts/run_onchange_after_agent_plugins.sh.tmpl'
printf '\n--- file excerpt ---\n'
cat -n chezmoi/.chezmoiscripts/run_onchange_after_agent_plugins.sh.tmpl | sed -n '1,120p'
printf '\n--- nearby references to skills add ---\n'
rg -n --no-heading 'skills add|--skill|--agent' chezmoi . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || trueRepository: yxtay/dotfiles
Length of output: 1539
🌐 Web query:
vercel-labs skills CLI add command --skill --agent repeated flags space-separated values documentation
💡 Result:
In the Vercel Skills CLI, the add command supports installing multiple skills or targeting multiple agents using repeated flags [1][2][3]. When using flags that accept multiple values, such as --skill (or -s) and --agent (or -a), you provide the values by repeating the flag for each item [1][4][2]. Examples of this usage: To install multiple specific skills: npx skills add vercel-labs/agent-skills --skill frontend-design --skill skill-creator [4][5][2] To install skills to multiple specific agents: npx skills add vercel-labs/agent-skills --agent claude-code --agent cursor [4][2][3] Key notes on syntax: - Repeated flags: Do not use space-separated values behind a single flag (e.g., --skill "skill1 skill2" will not work as intended for multiple individual skills) [1][2]. Instead, repeat the flag: --skill skill1 --skill skill2 [4][5][2]. - Quoting: If a skill name contains spaces, ensure it is wrapped in quotes (e.g., --skill "Convex Best Practices") [5][2]. - Wildcards: You can use the '*' character to target all available skills or all detected agents (e.g., --skill '' or --agent '') [1][2][3]. - Shorthand: The CLI also supports aliasing flags, such as -s for --skill and -a for --agent [1][2][3].
Citations:
- 1: https://vercel-labs-skills.mintlify.app/api/cli-options
- 2: https://github.com/vercel-labs/skills/blob/master/README.md
- 3: https://github.com/vercel-labs/add-skill/
- 4: https://vercel-labs-skills.mintlify.app/quickstart
- 5: https://vercel-labs-skills.mintlify.app/guides/source-formats
Repeat --skill and --agent per value
npx skills add expects repeated flags here, so --skill "${skills[@]}" / --agent "${agents[@]}" will not apply multiple skills or agents correctly; the extra items get treated as separate args.
Suggested fix
for entry in "${repo_skills[@]}"; do
repo="${entry%%=*}"
skills_csv="${entry#*=}"
IFS=',' read -r -a skills <<<"${skills_csv}"
- npx --yes skills add "${repo}" --skill "${skills[@]}" --agent "${agents[@]}" --yes
+ args=()
+ for s in "${skills[@]}"; do args+=(--skill "$s"); done
+ for a in "${agents[@]}"; do args+=(--agent "$a"); done
+ npx --yes skills add "${repo}" "${args[@]}" --yes
done📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| for entry in "${repo_skills[@]}"; do | |
| repo="${entry%%=*}" | |
| skills_csv="${entry#*=}" | |
| IFS=',' read -r -a skills <<<"${skills_csv}" | |
| npx --yes skills add "${repo}" --skill "${skills[@]}" --agent "${agents[@]}" --yes | |
| for entry in "${repo_skills[@]}"; do | |
| repo="${entry%%=*}" | |
| skills_csv="${entry#*=}" | |
| IFS=',' read -r -a skills <<<"${skills_csv}" | |
| args=() | |
| for s in "${skills[@]}"; do args+=(--skill "$s"); done | |
| for a in "${agents[@]}"; do args+=(--agent "$a"); done | |
| npx --yes skills add "${repo}" "${args[@]}" --yes |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@chezmoi/.chezmoiscripts/run_onchange_after_agent_plugins.sh.tmpl` around
lines 34 - 38, The skills installation call in
run_onchange_after_agent_plugins.sh.tmpl is passing arrays to npx skills add as
single flag occurrences, so multiple skills and agents are not applied
correctly. Update the loop around repo_skills so the command invocation repeats
the --skill and --agent flags once per value from the skills and agents arrays,
preserving each item as its own flag argument while keeping the existing repo
and yes parameters intact.
git writes .git/config.lock (and other config* variants) before renaming into place, so plain allowWrite of the config file alone still blocked git commands like branch --set-upstream-to. Co-Authored-By: Claude <noreply@anthropic.com>
1 participant
Summary
askso access can be approved case-by-case instead of being silently blocked; drop the now-emptydenylist and matchingsandbox.credentialsblock.run_onchange_after_agent_plugins.sh.tmplto support installing multiple skills from one repo via arepo=skill1,skill2entry format.permissions.askentries alphabetically.Test plan
chezmoi applyruns the onchange script without errornpx skills add <repo> --skill <name1> <name2> --agent <agents>installs the expected skillsdenySummary by CodeRabbit
New Features
Bug Fixes