Skip to content

Inject the pstack skills dir so a poteto-agent child can find poteto-mode - #1

Merged
sammyjoyce merged 1 commit into
mainfrom
fix/poteto-agent-skills-dir
Sep 14, 2026
Merged

sammyjoyce merged 1 commit into
mainfrom
fix/poteto-agent-skills-dir

Conversation

@sammyjoyce

@sammyjoyce sammyjoyce commented Sep 14, 2026

Copy link
Copy Markdown
Owner

What changes for a user

A child spawned with the poteto-agent brief can now find and read poteto-mode's SKILL.md. Before, the brief told the child to look up poteto-mode in its <available_skills> list. poteto-mode is hidden (disable-model-invocation: true), so it is never listed there, and the instruction could not resolve.

Every session now carries one extra line in its system prompt, whether or not /poteto-mode is on:

pstack skills dir: <path>/skills (every pstack skill, hidden ones included, is <name>/SKILL.md under it)

This matches upstream. In Cursor, a poteto-agent child resolves poteto-mode by name through the host, from any parent, with no toggle. Prime Agent has no equivalent inside a child, so a stable, always-present path is the closest native form.

How it was done

  • extensions/pstack/index.ts: new skillsDirLine(); systemPromptInjection takes skillsDir and always leads with that line. The before_agent_start hook passes the same SKILLS_DIR that /pstack off already uses.
  • agents/poteto-agent.md: body is back to upstream's sentence plus one clause pointing at the injected line. The Pi-era fffind sentence and the Prime-era <location> sentence are both gone.
  • scripts/reground-from-pi.mjs: the poteto-agent-find seam emits the same clause, so the wording survives a sync if upstream ever moves that text under skills/.
  • README.md, docs/guide.md, CHANGELOG.md: describe the line and why it is unconditional.

Tests:

  • extensions/pstack/index.test.ts: injection strings updated for the new first line; a skillsDirLine unit test; an end-to-end test that registers the extension against a fake host, fires before_agent_start, parses the injected path, and asserts <dir>/poteto-mode/SKILL.md exists on disk. With index.ts reverted, that test fails.
  • scripts/reground-from-pi.test.mjs: pins the seam output.

Verified live: prime-agent -p --no-tools -e <this worktree> answered "What is the pstack skills dir?" with the worktree's skills/ path and "Is poteto-mode listed as an available skill?" with No.

Checks

  • npm run check passes locally (lint 47 skills, 0 problems; node 53 pass; bun 52 pass)
  • Skill text changed only through scripts/reground-from-pi.mjs seams or scripts/prime-overrides/ (not by hand under skills/). npm run sync:upstream writes 0 files under skills/.
  • Extension changes have a test

Note

Low Risk
Prompt and extension injection only; no auth, data, or spawn semantics changes beyond giving children a stable path to an existing skill file.

Overview
poteto-agent children can now locate hidden poteto-mode. The brief no longer tells them to use <available_skills> (where poteto-mode never appears because it is disable-model-invocation: true). Instead it points at <dir>/poteto-mode/SKILL.md, with <dir> taken from a new always-on system-prompt line.

The pstack extension adds skillsDirLine() and makes systemPromptInjection lead every turn with pstack skills dir: <path> …, including when /poteto-mode is off and for rlm.spawn children. The before_agent_start hook always appends that block (not only when poteto mode or a role table is active).

agents/poteto-agent.md, scripts/reground-from-pi.mjs (poteto-agent-find seam), and README / guide / CHANGELOG are aligned with that contract. Tests cover the new line, updated injection strings, and an integration check that the injected path contains poteto-mode/SKILL.md on disk.

Reviewed by Cursor Bugbot for commit 27e231b. Bugbot is set up for automated code reviews on this repo. Configure here.

…mode

The poteto-agent brief told a child to read poteto-mode's SKILL.md at the
<location> of its <available_skills> entry. poteto-mode is hidden
(disable-model-invocation: true), so the host never lists it there and the
instruction could not resolve. Upstream Cursor has no such sentence: a
poteto-agent child resolves the skill by name through the host.

Prime Agent has no equivalent, so the extension now appends one line on every
turn, mode on or off:

  pstack skills dir: <SKILLS_DIR> (every pstack skill, hidden ones included,
  is <name>/SKILL.md under it)

The brief body is back to upstream's sentence plus one clause that points at
that line. The poteto-agent-find seam emits the same clause, so the wording
survives a sync if upstream ever moves the text under skills/.

Tests: systemPromptInjection strings updated for the new first line, a
skillsDirLine unit test, an end-to-end before_agent_start test that registers
the extension against a fake host and asserts <dir>/poteto-mode/SKILL.md
exists at the injected path, and a lever test pinning the seam output.
npm run check passes; npm run sync:upstream writes 0 files under skills/.

@barnard-33 barnard-33 Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tau PR review — Approved. See the Tau PR review summary comment for the full overview.

* skill paths from. `agents/poteto-agent.md` points children at it.
*/
export function skillsDirLine(skillsDir: string): string {
return `pstack skills dir: ${skillsDir} (every pstack skill, hidden ones included, is <name>/SKILL.md under it)`;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

non_blocking (correctness, confidence 0.84): The injected line does not delimit or encode the skills directory unambiguously. If the package is installed below a path containing ( such as /opt/Prime Agent (Beta)/..., the same ( sequence appears inside the path and before the explanatory suffix. A child following the documented line-based lookup can truncate the path and fail to read poteto-mode/SKILL.md.

Suggested fix: Put the raw skills directory on a line by itself, or encode/quote it with an unambiguous format and update the brief and test parser to use that format.

sendUserMessage: () => undefined,
};
const previous = process.env.PRIME_AGENT_CODING_AGENT_DIR;
process.env.PRIME_AGENT_CODING_AGENT_DIR = mkdtempSync(join(tmpdir(), "pstack-agent-dir-"));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

non_blocking (other, confidence 0.99): The new end-to-end test creates a unique temporary agent directory but never removes it. Each test run leaves an empty pstack-agent-dir-* directory under the system temporary directory.

Suggested fix: Store the result of mkdtempSync in an agentDir variable and call rmSync(agentDir, { recursive: true, force: true }) in the existing finally block, while restoring the environment variable.

@barnard-33

barnard-33 Bot commented Sep 14, 2026

Copy link
Copy Markdown

Tau PR review

Verdict: Approved
Action taken: Approved this pull request.

Coordinator approved; risk tier full; specialists completed 14/14. Blocking findings: 0; non-blocking findings: 2. Approval bias applied: approved with comments unless a concrete blocking shipping risk remained after dedupe/downgrade.

Findings

  • non_blocking (correctness, confidence 0.84) extensions/pstack/index.ts:40: The injected line does not delimit or encode the skills directory unambiguously. If the package is installed below a path containing ( such as /opt/Prime Agent (Beta)/..., the same ( sequence appears inside the path and before the explanatory suffix. A child following the documented line-based lookup can truncate the path and fail to read poteto-mode/SKILL.md.
    • Suggested fix: Put the raw skills directory on a line by itself, or encode/quote it with an unambiguous format and update the brief and test parser to use that format.
  • non_blocking (other, confidence 0.99) extensions/pstack/index.test.ts:82: The new end-to-end test creates a unique temporary agent directory but never removes it. Each test run leaves an empty pstack-agent-dir-* directory under the system temporary directory.
    • Suggested fix: Store the result of mkdtempSync in an agentDir variable and call rmSync(agentDir, { recursive: true, force: true }) in the existing finally block, while restoring the environment variable.

Review scope

  • Files inspected (deterministic): 8
  • Checks performed: Reviewed all eight included diff files and surrounding extension code., Traced before_agent_start prompt assembly, pstack-off skill stripping, and package-relative SKILLS_DIR derivation., Checked all in-repository systemPromptInjection call sites and pstack skills path references., Verified the checkout contains skills/poteto-mode/SKILL.md and the expected skill directory layout., Reviewed reground seam ordering, fixpoint behavior, and the related unit tests., Compared temporary-directory handling with adjacent extension tests., Reviewed every supplied diff hunk for changed-code correctness and regressions., Traced before_agent_start prompt construction through skillsEnabled on/off, role-table present/absent, and Poteto Mode on/off paths., Verified the new systemPromptInjection parameter is supplied at repository call sites., Verified SKILLS_DIR is derived from the installed extension module location and resolves to the packaged skills directory layout., Checked the reground seam ordering and fixpoint behavior, including the earlier pi-pstack-to-prime-pstack transform used by the new test., Reviewed new tests for prompt ordering, hidden-skill path resolution, environment restoration, and seam output., Inspected all included diff hunks for new secret, credential, permission, prompt-injection, path-traversal, and data-integrity risks., Traced the package-derived SKILLS_DIR through before_agent_start and checked its interaction with the existing pstack-off skill stripping., Inspected the related skill metadata, skill-strip implementation, package manifest, security guidance, and child brief for privilege or sensitive-data implications., Reviewed the changed system-prompt injection path for prompt injection, path traversal, and untrusted-input flows., Verified the injected skills directory is derived from the extension module's static import.meta.url location rather than user-controlled task text or configuration., Reviewed the unconditional absolute-path disclosure for secret, credential, PII, and cross-session data exposure; no concrete sensitive-data disclosure beyond package location was established., Reviewed the hidden-skill lookup change for authorization or permission-boundary bypass; disable-model-invocation is used as discoverability metadata, and the changed code does not alter filesystem or tool permissions., Reviewed changed tests and regrounding seam for unsafe deserialization, filesystem writes in production paths, and data-integrity regressions., Reviewed the changed before_agent_start and systemPromptInjection paths for new synchronous I/O, loops, large allocations, and prompt-size effects., Traced the related skill-stripping and role-table formatting helpers used by the changed runtime path., Confirmed the changed reground seam is sync-time tooling and does not add work to the per-turn extension path., Reviewed the added tests for production-only performance behavior and resource cleanup., Reviewed the changed before_agent_start prompt-injection path for added blocking I/O, unbounded work, repeated traversal, and large allocations., Reviewed skillsDirLine and systemPromptInjection for changed algorithmic complexity and per-request memory growth., Reviewed the new tests and reground seam for introduced loops, temporary-resource growth, or materially slower changed paths., Inspected adjacent configuration loading and skill-stripping code to distinguish pre-existing synchronous work from work introduced by this diff., Mapped the changed injection and seam code paths to their updated unit and end-to-end tests., Checked all call sites and verified the shared SKILLS_DIR is passed through the extension hook., Reviewed test coverage for mode/table combinations, on-disk poteto-mode path resolution, and reground seam output., Reviewed the changed file set for scope creep beyond the skills-directory injection behavior., Reviewed every changed diff hunk for concrete test-coverage and scope risks., Verified unit coverage for unconditional skills-directory injection across Poteto mode on/off, empty role-table, configured role-table, and budget-table cases., Verified the before_agent_start integration test checks that the injected directory resolves to an existing poteto-mode/SKILL.md while preserving the base prompt., Verified existing skill-strip tests cover removal of pstack skill listings, supporting the /pstack off path that now retains the separately appended directory line., Verified the reground seam test exercises the new poteto-agent wording through the ordered transformation pipeline and pins the resulting text., Checked package test scripts to confirm the modified extension and reground test files are included in the repository's normal test command., Assessed documentation and agent-brief changes for scope creep tied to the stated behavior., Compared the changed README, guide, changelog, and poteto-agent brief against the injected skills-directory behavior and package layout., Checked that the generated seam wording and its regression test agree with the checked-in poteto-agent brief., Searched for stale , <available_skills>, and pi-pstack path instructions related to poteto-mode., Searched for AGENTS.md, CLAUDE.md, WORKFLOW.md, and docs/agents instruction files; none are present in the checkout., Compared the changed README, guide, changelog, and agent-brief claims against the prompt-injection implementation and its tests., Verified the poteto-agent brief wording matches the reground seam output and the surrounding poteto-mode subagent instructions., Checked repository guidance for change-placement and generated-skill conventions; the extension, brief, seam, and test changes follow the documented locations., Searched the checkout for AGENTS.md, CLAUDE.md, and WORKFLOW.md instruction files; none are present, and the review input classifies the documentation materiality as low., Reviewed the /pstack off documentation alongside the unconditional skills-directory line; the existing contract specifically says discoverable skill entries are hidden from the prompt, which remains accurate., Traced SKILLS_DIR resolution from extensions/pstack/index.ts to the repository package layout and verified the referenced hidden skill exists., Inspected package.json files and pi metadata to confirm the runtime extension, skills tree, and agent briefs are shipped together., Searched all in-repository systemPromptInjection and before_agent_start call sites for signature and lifecycle compatibility., Reviewed /pstack off stripping versus the unconditional skills-directory injection for configuration and rollout behavior., Reviewed the reground seam and CI sync/fixpoint workflow for release-process compatibility., Reviewed the changed system-prompt injection and agent brief for upgrade and rollback compatibility., Verified all repository call sites of systemPromptInjection pass the new skillsDir argument., Verified the package manifest ships extensions/, skills/, and agents/, preserving the relative path used to compute the installed skills directory., Verified the change does not alter persisted config/schema versions, require a migration, or introduce a deployment manifest change., Reviewed the reground seam and its test for consistency with the shipped agent brief., Statically reviewed the added tests for coverage of the installed-path assumption and unconditional injection behavior., Statically reviewed all eight changed files for licensing, attribution, telemetry, external sinks, retention, audit-record, access-control, and regulated-data changes., Traced before_agent_start and /pstack off behavior against the hidden-skill metadata and documented manual /skill invocation behavior., Inspected package distribution metadata, SECURITY.md, NOTICE, and LICENSE for changed security or attribution obligations., Inspected the new tests and reground seam for newly introduced file or data handling paths., Reviewed all changed hunks for licensing and attribution impacts., Traced the new system-prompt injection to the package-relative SKILLS_DIR source and checked whether it introduces regulated-data, credential, consent, retention, access-control, audit-log, or record-keeping behavior., Reviewed the poteto-agent brief and reground seam changes for new data access or disclosure instructions., Checked existing SECURITY.md, LICENSE, NOTICE, and package metadata for concrete conflicts with the changed behavior., Reviewed added tests statically for compliance-relevant filesystem, environment-variable, or external-system effects.

Skipped checks

  • Automated tests and builds: The review is read-only and the session instructions prohibit running, building, or testing the code.
  • Live child-session verification: The checked-out tree does not provide the Prime Agent host runtime, so I could not independently verify that rlm.spawn children receive the extension hook.
  • Git history or base comparison: The checkout is the PR-head tree without git history; review relied on the supplied diff and current files.
  • Execute automated tests or runtime checks: The review-session capability explicitly prohibits building, running, or testing the code; validation was limited to static inspection.
  • Inspect git history or compare upstream runtime behavior: The supplied checkout is the captured PR-head tree without git history, and external/network inspection is outside this read-only review scope.
  • Runtime execution and tests: This phase is read-only and the review policy prohibits building, running, or testing the code.
  • Provider-side prompt/privacy verification: The checkout does not expose provider transport, logging, credentials, or request capture; assessment was limited to source-level behavior.
  • Runtime and test execution: The review session explicitly prohibits building, running, or testing code; assessment was static and read-only.
  • Provider-side prompt retention or telemetry behavior: No provider configuration or credentials are available in scope, so external retention of the injected package path could not be observed.
  • Runtime benchmark: This read-only review phase forbids running or building the code, and no benchmark data was supplied.
  • Test execution: Tests were not run because the review constraints limit this phase to read-only inspection.
  • Runtime benchmarks and test execution: The review session explicitly prohibits building, running, or testing code; performance assessment was static and limited to the supplied diff plus the read-only PR-head tree.
  • Runtime test execution: The specialist review is read-only and the review policy prohibits building, running, or testing the checkout.
  • Installed-package and real child-session integration: No runtime Prime Agent host or package-install execution is available in this phase; verification was limited to static checkout and test inspection.
  • Execute automated tests or runtime child-session validation: The review instructions prohibit building, running, or testing code; assessment was limited to static inspection of the PR-head tree and supplied diff.
  • Automated tests and runtime verification: The review contract makes this a read-only inspection phase and forbids building, running, or testing the checkout, so child-session inheritance and live installation behavior could not be independently exercised.
  • Runtime child-session propagation: The read-only specialist review cannot launch Prime Agent or an rlm.spawn child, so the documentation claim that the extension line reaches child system prompts was assessed from the extension hook and repository tests only.
  • Test execution: The session explicitly permits inspection only and prohibits building, running, or testing code.
  • Prime Agent runtime and child-session smoke test: This is a read-only specialist phase; the Prime Agent host, extension hooks, and child spawn behavior were not executed.
  • Packed artifact/install smoke test: No package-manager, archive, build, or install command was run; packaging was assessed statically from package.json.
  • Upgrade and rollback matrix against a prior release: The checkout contains no git history or separately installed previous package, so prior-version rollback behavior could not be exercised.
  • Execute tests or build: The review session explicitly prohibits running or testing code; tests were inspected statically only.
  • Pack and install release artifact: Creating a package tarball or installation would mutate the filesystem and is outside this read-only phase.
  • Runtime and test execution: This is a read-only review phase, and the review instructions prohibit building, running, or testing the checkout.
  • External legal or regulatory requirement mapping: No organization-specific privacy, data-residency, retention, consent, or regulated-data requirements or external policy source is available in the supplied context.
  • Runtime/provider data-flow and retention verification: The review is read-only and the repository does not define the external model providers' transmission, residency, or retention policies; no runtime checks were performed.
  • Automated test execution: The session instructions prohibit building, running, or testing the code; tests were inspected statically only.

Tau PR review — risk tier full. Full-checkout review: specialists inspected the pull request head tree (shallow, no git history). No build or test execution.
This automated review augments, and does not replace, human review.
Weak spots: cross-file/runtime behavior, intent vs. ticket, and changes outside the supplied diff hunks.

@sammyjoyce
sammyjoyce merged commit 3a0a85a into main Sep 14, 2026
1 of 4 checks passed
@sammyjoyce
sammyjoyce deleted the fix/poteto-agent-skills-dir branch September 14, 2026 12:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant