Support repo/external skill command metadata

[shiny-code-bot]

Current Status

Issue #235 is closed for bundled system skills and repo-local bundled helper skills. The remaining schema gap is command metadata for workflows that intentionally invoke repo-root tools or external commands instead of helper scripts bundled inside a skill directory.

This issue is the focused follow-up for that gap.

Finish Line

Every Code can represent repo-relative and external skill commands in structured skill metadata without weakening strict validation for existing skill-bundled commands[].resource_path helpers.

Scope

In:

• Add a small schema shape for structured commands that are repo-relative or external/non-bundled.
• Render these commands clearly in the skills section so agents know they are not skill-bundled helper scripts.
• Add loader/render regression tests that cover skill-bundled commands and the new repo/external command shape.
• Migrate the repo-local skills that exposed the gap:
  • .codex/skills/remote-tests/SKILL.md
  • .codex/skills/test-tui/SKILL.md

Out:

• Migrating the shared /Users/cbusillo/Developer/codex-skills library.
• Adding per-command option/variant schemas.
• Adding execution capability/policy fields such as requires_network.
• Relaxing validation for current skill-bundled resource_path commands.

Starting Evidence

• remote-tests references repo-root ./scripts/test-remote-env.sh, which cannot be declared as a skill-relative bundled resource today.
• test-tui references just codex ..., which is an external/repo workflow command rather than a file under the skill directory.
• PR docs(skills): add repo-local helper metadata #258 deliberately deferred both so Move reusable skill workflow prose into structured config #235 could close cleanly.

Candidate Design Direction

Prefer a minimal additive field over changing the existing commands[].resource_path semantics. For example, keep bundled helper commands as-is and introduce an explicit command kind/source for non-bundled commands, with validation that prevents ambiguous mixed forms.

Validation

• Use focused loader/render tests while implementing.
• Final required gate: ./build-fast.sh from the repo root.

Agent Handoff Notes

A clean agent should inspect:

• code-rs/core/src/skills/model.rs
• code-rs/core/src/skills/loader.rs
• code-rs/core/src/skills/render.rs
• .codex/skills/remote-tests/SKILL.md
• .codex/skills/test-tui/SKILL.md

Keep the change narrow. Do not use this issue to solve shared skill-library migration or rich command option metadata.

[shiny-code-bot]

Implemented and merged in #261.

What changed:

• Added commands[].source with skill, repo, and external values.
• Kept source: skill as the default and preserved strict bundled-helper validation: resource_path must be declared in resources[] and exist as a file.
• Added explicit validation that source: repo only appears on repo-scoped skills and does not declare resource_path.
• Added explicit validation that source: external does not declare resource_path.
• Rendered repo and external commands as repo/external commands instead of helper scripts.
• Migrated .codex/skills/remote-tests/SKILL.md and .codex/skills/test-tui/SKILL.md to structured command metadata.

Validation:

• cargo test -p code-core skills::
• ./build-fast.sh

Reviewed the design with Opus, Antigravity/Gemini-style, and GPT agents before implementation. The implementation preserves the key invariant they agreed on: bundled resource_path commands remain strict and are not weakened by repo/external examples.

Remaining related work is outside this issue:

• Shared/global /Users/cbusillo/Developer/codex-skills migration.
• Richer per-command variants/options.
• Execution capability metadata such as network or sandbox requirements.