-
-
-
-
-
- {children}
+ {/* Keep one guard provider above both sidebar and content so browser history is tracked before guarded routes mount. */}
+
+
-
-
-
-
-
+
+
+
+
+
+
diff --git a/packages/web/src/app/(app)/settings/layout.tsx b/packages/web/src/app/(app)/settings/layout.tsx
index 422785ced..655ca28f5 100644
--- a/packages/web/src/app/(app)/settings/layout.tsx
+++ b/packages/web/src/app/(app)/settings/layout.tsx
@@ -87,7 +87,14 @@ export const getSidebarNavGroups = async () =>
{
title: "Ask Sourcebot",
href: `/settings/accountAskAgent`,
+ hrefRegex: `/settings/accountAskAgent(/.*)?$`,
icon: "bot" as const,
+ },
+ {
+ title: "Skills",
+ href: `/settings/skills`,
+ hrefRegex: `/settings/skills(/.*)?$`,
+ icon: "sparkles" as const,
}
] : []),
],
diff --git a/packages/web/src/app/(app)/settings/members/membersTable.tsx b/packages/web/src/app/(app)/settings/members/membersTable.tsx
index f657ba25b..a3d3078d9 100644
--- a/packages/web/src/app/(app)/settings/members/membersTable.tsx
+++ b/packages/web/src/app/(app)/settings/members/membersTable.tsx
@@ -16,7 +16,6 @@ import {
useReactTable,
} from "@tanstack/react-table";
import { defaultRangeExtractor, useVirtualizer } from "@tanstack/react-virtual";
-import * as TooltipPrimitive from "@radix-ui/react-tooltip";
declare module "@tanstack/react-table" {
// eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -621,11 +620,9 @@ export const MembersTable = ({
-
-
- {section.description}
-
-
+
+ {section.description}
+
•
{section.rows.length}
diff --git a/packages/web/src/app/(app)/settings/skills/layout.tsx b/packages/web/src/app/(app)/settings/skills/layout.tsx
new file mode 100644
index 000000000..2015f25f2
--- /dev/null
+++ b/packages/web/src/app/(app)/settings/skills/layout.tsx
@@ -0,0 +1,6 @@
+import React from "react";
+import { SettingsContainer } from "../components/settingsContainer";
+
+export default function SkillsSettingsLayout({ children }: { children: React.ReactNode }) {
+ return
{children};
+}
diff --git a/packages/web/src/app/(app)/settings/skills/page.tsx b/packages/web/src/app/(app)/settings/skills/page.tsx
new file mode 100644
index 000000000..230ca4a0e
--- /dev/null
+++ b/packages/web/src/app/(app)/settings/skills/page.tsx
@@ -0,0 +1,49 @@
+import { listPersonalAgentSkills, listSharedAgentSkillCatalog } from "@/ee/features/chat/skills/actions";
+import { SkillsPage } from "@/ee/features/chat/skills/components/skillsPage";
+import { hasEntitlement } from "@/lib/entitlements";
+import { ServiceErrorException } from "@/lib/serviceError";
+import { isServiceError } from "@/lib/utils";
+import { authenticatedPage } from "@/middleware/authenticatedPage";
+import { OrgRole } from "@sourcebot/db";
+import { env } from "@sourcebot/shared";
+import { SkillsEntitlementMessage } from "./skillsEntitlementMessage";
+
+interface PageProps extends Record
{
+ // `skill` deep-links a specific skill as the initially-selected one (used by
+ // the workspace admin table's skill-name links).
+ searchParams: Promise<{ skill?: string }>;
+}
+
+export default authenticatedPage(async ({ user, role }, { searchParams }) => {
+ // Skills are part of Ask Sourcebot. Gate the EE skill UI behind the `ask`
+ // entitlement so it never renders on a non-entitled deployment; show the FSL
+ // upsell panel instead.
+ if (!(await hasEntitlement('ask'))) {
+ return ;
+ }
+
+ const [{ skill: initialSelectedId }, [personalSkills, sharedSkills]] = await Promise.all([
+ searchParams,
+ Promise.all([
+ listPersonalAgentSkills(),
+ listSharedAgentSkillCatalog(),
+ ]),
+ ]);
+ if (isServiceError(personalSkills)) {
+ throw new ServiceErrorException(personalSkills);
+ }
+ if (isServiceError(sharedSkills)) {
+ throw new ServiceErrorException(sharedSkills);
+ }
+
+ return (
+
+ );
+});
diff --git a/packages/web/src/app/(app)/settings/skills/skillsEntitlementMessage.tsx b/packages/web/src/app/(app)/settings/skills/skillsEntitlementMessage.tsx
new file mode 100644
index 000000000..0de5adfd2
--- /dev/null
+++ b/packages/web/src/app/(app)/settings/skills/skillsEntitlementMessage.tsx
@@ -0,0 +1,23 @@
+"use client"
+
+import { UpsellPanel } from "@/features/billing/upsellDialog"
+
+/**
+ * Shown in place of the Skills management UI when the deployment is not on a plan
+ * that includes Ask Sourcebot. FSL (not ee/) so it can render for free-plan users
+ * as the upsell surface without mounting any ee/ skill code.
+ */
+export function SkillsEntitlementMessage() {
+ return (
+
+
+
+ )
+}
diff --git a/packages/web/src/app/(app)/settings/workspaceAskAgent/page.tsx b/packages/web/src/app/(app)/settings/workspaceAskAgent/page.tsx
index fd2deff20..b632669fe 100644
--- a/packages/web/src/app/(app)/settings/workspaceAskAgent/page.tsx
+++ b/packages/web/src/app/(app)/settings/workspaceAskAgent/page.tsx
@@ -4,6 +4,9 @@ import { OrgRole } from "@sourcebot/db";
import { getMcpOAuthCallbackUrl } from "@/ee/features/chat/mcp/utils.server";
import { WorkspaceAskAgentPage } from "./workspaceAskAgentPage";
import { WorkspaceAskAgentEntitlementMessage } from "./workspaceAskAgentEntitlementMessage";
+import { listSharedAgentSkillManagement } from "@/ee/features/chat/skills/actions";
+import { ServiceErrorException } from "@/lib/serviceError";
+import { isServiceError } from "@/lib/utils";
interface PageProps extends Record {
searchParams: Promise<{
@@ -20,7 +23,8 @@ export default authenticatedPage(async ({ org, prisma }, { searchPara
// render it for teardown (the page itself disables "add" and only allows
// removal in that state). We only show the upsell when there is nothing to
// clean up.
- if (!(await hasEntitlement("ask"))) {
+ const hasAskEntitlement = await hasEntitlement("ask");
+ if (!hasAskEntitlement) {
const serverCount = await prisma.mcpServer.count({
where: { orgId: org.id },
});
@@ -31,6 +35,10 @@ export default authenticatedPage(async ({ org, prisma }, { searchPara
}
const { status, server, message } = await searchParams;
+ const orgSkills = hasAskEntitlement ? await listSharedAgentSkillManagement() : [];
+ if (isServiceError(orgSkills)) {
+ throw new ServiceErrorException(orgSkills);
+ }
return (
(async ({ org, prisma }, { searchPara
callbackServer={server}
callbackMessage={message}
oauthRedirectUrl={getMcpOAuthCallbackUrl()}
+ initialOrgSkills={orgSkills}
/>
);
}, { minRole: OrgRole.OWNER, redirectTo: '/settings' });
diff --git a/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.test.tsx b/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.test.tsx
new file mode 100644
index 000000000..5507b5f24
--- /dev/null
+++ b/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.test.tsx
@@ -0,0 +1,270 @@
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { afterEach, describe, expect, test, vi } from 'vitest';
+import { TooltipProvider } from '@/components/ui/tooltip';
+import type { ReactNode } from 'react';
+import type { SharedAgentSkillManagementItem } from '@/ee/features/chat/skills/types';
+
+vi.mock('next/navigation', () => ({
+ useRouter: () => ({
+ push: vi.fn(),
+ }),
+}));
+
+// The shared-skills manager links skill names via next/link; render a plain anchor.
+vi.mock('next/link', async () => {
+ const { createElement } = await import('react');
+ return {
+ default: ({ href, children }: { href: string; children: ReactNode }) =>
+ createElement('a', { href }, children),
+ };
+});
+
+vi.mock('@/app/api/(client)/client', () => ({
+ getMcpConfiguration: vi.fn(),
+ getMcpServersWithStatus: vi.fn(),
+}));
+
+vi.mock('@/ee/features/chat/mcp/actions', () => ({
+ checkMcpServerDynamicClientRegistration: vi.fn(),
+ createMcpServer: vi.fn(),
+ createStaticOAuthMcpServer: vi.fn(),
+ deleteMcpServer: vi.fn(),
+ updateMcpServerOAuthScopes: vi.fn(),
+}));
+
+vi.mock('@/ee/features/chat/skills/actions', () => ({
+ deleteSharedAgentSkill: vi.fn(),
+ setSharedSkillFlag: vi.fn(),
+}));
+
+const clientApi = await import('@/app/api/(client)/client');
+const skillActions = await import('@/ee/features/chat/skills/actions');
+const { WorkspaceAskAgentPage } = await import('./workspaceAskAgentPage');
+
+afterEach(() => {
+ cleanup();
+ vi.clearAllMocks();
+});
+
+function renderWorkspaceAskAgentPage({
+ orgSkills,
+ isAskAgentAvailable = true,
+}: {
+ orgSkills: SharedAgentSkillManagementItem[];
+ isAskAgentAvailable?: boolean;
+}) {
+ vi.mocked(clientApi.getMcpConfiguration).mockResolvedValue({
+ allowedMode: 'approved_only',
+ isAskAgentAvailable,
+ servers: [],
+ });
+ vi.mocked(clientApi.getMcpServersWithStatus).mockResolvedValue([]);
+
+ const queryClient = new QueryClient({
+ defaultOptions: {
+ queries: {
+ retry: false,
+ },
+ },
+ });
+
+ return render(
+
+
+
+
+ ,
+ );
+}
+
+describe('WorkspaceAskAgentPage', () => {
+ test('hides shared skills when Ask is unavailable', async () => {
+ const sharedSkill: SharedAgentSkillManagementItem = {
+ id: 'skill-1',
+ scope: 'SHARED',
+ slug: 'review',
+ name: 'Review',
+ description: 'Review risky changes.',
+ enabled: true,
+ autoEnrolled: false,
+ source: null,
+ createdByEmail: 'creator@sourcebot.dev',
+ createdAt: '2026-06-18T00:00:00.000Z',
+ updatedAt: '2026-06-18T00:00:00.000Z',
+ };
+
+ renderWorkspaceAskAgentPage({
+ orgSkills: [sharedSkill],
+ isAskAgentAvailable: false,
+ });
+
+ await screen.findByText('Ask Sourcebot connectors are unavailable');
+
+ expect(screen.queryByText('Review')).toBeNull();
+ expect(screen.queryByText('Available to everyone in your workspace.')).toBeNull();
+ });
+
+ test('disables shared skill delete while a flag update is pending', async () => {
+ const sharedSkill: SharedAgentSkillManagementItem = {
+ id: 'skill-1',
+ scope: 'SHARED',
+ slug: 'review',
+ name: 'Review',
+ description: 'Review risky changes.',
+ enabled: true,
+ autoEnrolled: false,
+ source: null,
+ createdByEmail: 'creator@sourcebot.dev',
+ createdAt: '2026-06-18T00:00:00.000Z',
+ updatedAt: '2026-06-18T00:00:00.000Z',
+ };
+ vi.mocked(skillActions.setSharedSkillFlag).mockReturnValue(new Promise(() => undefined));
+
+ renderWorkspaceAskAgentPage({ orgSkills: [sharedSkill] });
+
+ await screen.findByText('Review');
+
+ const deleteButton = screen.getByRole('button', { name: 'Delete Review' });
+ expect(deleteButton.hasAttribute('disabled')).toBe(false);
+
+ fireEvent.click(screen.getByRole('switch', { name: 'Auto' }));
+
+ await waitFor(() => {
+ expect(deleteButton.hasAttribute('disabled')).toBe(true);
+ });
+ });
+
+ test("allows deleting a different shared skill while another skill's flag update is pending", async () => {
+ const skillA: SharedAgentSkillManagementItem = {
+ id: 'skill-a',
+ scope: 'SHARED',
+ slug: 'review-a',
+ name: 'Review A',
+ description: 'Review risky changes.',
+ enabled: true,
+ autoEnrolled: false,
+ source: null,
+ createdByEmail: 'creator@sourcebot.dev',
+ createdAt: '2026-06-18T00:00:00.000Z',
+ updatedAt: '2026-06-18T00:00:00.000Z',
+ };
+ const skillB: SharedAgentSkillManagementItem = {
+ id: 'skill-b',
+ scope: 'SHARED',
+ slug: 'review-b',
+ name: 'Review B',
+ description: 'Review risky changes.',
+ enabled: true,
+ autoEnrolled: false,
+ source: null,
+ createdByEmail: 'creator@sourcebot.dev',
+ createdAt: '2026-06-18T00:00:00.000Z',
+ updatedAt: '2026-06-18T00:00:00.000Z',
+ };
+ let resolveUpdate!: (value: SharedAgentSkillManagementItem) => void;
+ const pendingUpdate = new Promise((resolve) => {
+ resolveUpdate = resolve;
+ });
+ vi.mocked(skillActions.setSharedSkillFlag).mockReturnValue(pendingUpdate);
+
+ renderWorkspaceAskAgentPage({ orgSkills: [skillA, skillB] });
+
+ await screen.findByText('Review A');
+
+ fireEvent.click(screen.getAllByRole('switch', { name: 'Auto' })[0]);
+ await waitFor(() => {
+ expect(screen.getByRole('button', { name: 'Delete Review A' }).hasAttribute('disabled')).toBe(true);
+ });
+
+ const skillBDeleteButton = screen.getByRole('button', { name: 'Delete Review B' });
+ expect(skillBDeleteButton.hasAttribute('disabled')).toBe(false);
+
+ fireEvent.click(skillBDeleteButton);
+
+ const dialog = await screen.findByRole('alertdialog', { name: 'Delete Shared Skill' });
+ expect(within(dialog).getByText('Review B')).not.toBeNull();
+
+ await act(async () => {
+ resolveUpdate({ ...skillA, autoEnrolled: true });
+ await pendingUpdate;
+ });
+ });
+
+ test('keeps each shared skill delete disabled until its own flag update finishes', async () => {
+ const skillA: SharedAgentSkillManagementItem = {
+ id: 'skill-a',
+ scope: 'SHARED',
+ slug: 'review-a',
+ name: 'Review A',
+ description: 'Review risky changes.',
+ enabled: true,
+ autoEnrolled: false,
+ source: null,
+ createdByEmail: 'creator@sourcebot.dev',
+ createdAt: '2026-06-18T00:00:00.000Z',
+ updatedAt: '2026-06-18T00:00:00.000Z',
+ };
+ const skillB: SharedAgentSkillManagementItem = {
+ id: 'skill-b',
+ scope: 'SHARED',
+ slug: 'review-b',
+ name: 'Review B',
+ description: 'Review risky changes.',
+ enabled: true,
+ autoEnrolled: false,
+ source: null,
+ createdByEmail: 'creator@sourcebot.dev',
+ createdAt: '2026-06-18T00:00:00.000Z',
+ updatedAt: '2026-06-18T00:00:00.000Z',
+ };
+ let resolveA!: (value: SharedAgentSkillManagementItem) => void;
+ let resolveB!: (value: SharedAgentSkillManagementItem) => void;
+ const updateA = new Promise((resolve) => {
+ resolveA = resolve;
+ });
+ const updateB = new Promise((resolve) => {
+ resolveB = resolve;
+ });
+ vi.mocked(skillActions.setSharedSkillFlag).mockImplementation(({ skillId }) =>
+ skillId === 'skill-a' ? updateA : updateB,
+ );
+
+ renderWorkspaceAskAgentPage({ orgSkills: [skillA, skillB] });
+
+ await screen.findByText('Review A');
+ const autoSwitches = screen.getAllByRole('switch', { name: 'Auto' });
+
+ fireEvent.click(autoSwitches[0]);
+ await waitFor(() => {
+ expect(screen.getByRole('button', { name: 'Delete Review A' }).hasAttribute('disabled')).toBe(true);
+ });
+
+ fireEvent.click(autoSwitches[1]);
+ await waitFor(() => {
+ expect(screen.getByRole('button', { name: 'Delete Review B' }).hasAttribute('disabled')).toBe(true);
+ });
+
+ await act(async () => {
+ resolveA({ ...skillA, autoEnrolled: true });
+ await updateA;
+ });
+
+ await waitFor(() => {
+ expect(screen.getByRole('button', { name: 'Delete Review A' }).hasAttribute('disabled')).toBe(false);
+ });
+ expect(screen.getByRole('button', { name: 'Delete Review B' }).hasAttribute('disabled')).toBe(true);
+
+ await act(async () => {
+ resolveB({ ...skillB, autoEnrolled: true });
+ await updateB;
+ });
+
+ await waitFor(() => {
+ expect(screen.getByRole('button', { name: 'Delete Review B' }).hasAttribute('disabled')).toBe(false);
+ });
+ });
+});
diff --git a/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.tsx b/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.tsx
index 4105134f8..78dc1131e 100644
--- a/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.tsx
+++ b/packages/web/src/app/(app)/settings/workspaceAskAgent/workspaceAskAgentPage.tsx
@@ -36,6 +36,8 @@ import { AlertTriangleIcon, CableIcon, CopyIcon, InfoIcon, KeyRoundIcon, Loader2
import { PrefabConnectorPopover } from "@/ee/features/chat/mcp/components/prefabConnectorPopover";
import Markdown from "react-markdown";
import { getStaticOAuthDescription, type PrefabMcpServer } from "@/ee/features/chat/mcp/prefabMcpServers";
+import { WorkspaceSharedSkillsManager } from "@/ee/features/chat/skills/components/workspaceSharedSkillsManager";
+import type { SharedAgentSkillManagementItem } from "@/ee/features/chat/skills/types";
import type { McpConfigurationServer, ServerToolsEntry } from "@/ee/features/chat/mcp/types";
function clearCallbackParams() {
@@ -55,6 +57,7 @@ interface WorkspaceAskAgentPageProps {
callbackServer?: string;
callbackMessage?: string;
oauthRedirectUrl: string;
+ initialOrgSkills: SharedAgentSkillManagementItem[];
}
type WorkspaceConnectorStatus = {
@@ -344,7 +347,7 @@ function WorkspaceConnectorCard({
);
}
-export function WorkspaceAskAgentPage({ callbackStatus, callbackServer, callbackMessage, oauthRedirectUrl }: WorkspaceAskAgentPageProps) {
+export function WorkspaceAskAgentPage({ callbackStatus, callbackServer, callbackMessage, oauthRedirectUrl, initialOrgSkills }: WorkspaceAskAgentPageProps) {
const { toast } = useToast();
const queryClient = useQueryClient();
const router = useRouter();
@@ -419,6 +422,7 @@ export function WorkspaceAskAgentPage({ callbackStatus, callbackServer, callback
const servers = data?.servers ?? [];
const canCreateConnectors = data?.isAskAgentAvailable === true;
const isAskAgentUnavailable = data?.isAskAgentAvailable === false;
+ const canManageWorkspaceSkills = data?.isAskAgentAvailable === true;
const connectedServerCount = useMemo(
() => serversWithStatus?.filter((server) => server.isConnected).length ?? 0,
[serversWithStatus],
@@ -760,6 +764,13 @@ export function WorkspaceAskAgentPage({ callbackStatus, callbackServer, callback
+
+
+## Creating a skill
+
+Go to **Settings -> Skills** and click **Add skill**.
+
+You can create a skill in three ways:
+
+- **New skill**: Create a skill directly in Sourcebot.
+- **Import from file**: Upload a local `.md` or `.markdown` file and review it before saving.
+- **Import from repository**: Choose a markdown file from an indexed repository and keep the skill synced to that file.
+
+Each skill has four fields:
+
+- **Name**: A recognizable name for the skill.
+- **Command**: The slash command users type to run the skill, such as `/deep-research`.
+- **Description**: A short summary of when Ask Sourcebot should use the skill.
+- **Instructions**: The markdown context or guidance Ask Sourcebot uses when the skill runs.
+
+
+ 
+
+
+## Writing instructions
+
+Keep the description specific. Ask Sourcebot uses it to decide when a skill is relevant, and users see it when browsing slash commands.
+
+Put the useful context or guidance in the instructions.
+
+
+ 
+
+
+## Using skills in chat
+
+Type `/` at the start of an Ask Sourcebot prompt to browse available skill commands.
+
+When you select a skill, Ask Sourcebot expands the command into that skill's instructions before answering. If the instructions include file mentions, those files are added to the chat context automatically.
+
+Ask Sourcebot may also load a matching skill automatically. When this happens, the chat details show the loaded skill name and command.
+
+
+ 
+
+
+## Personal and shared skills
+
+Skills can be personal or shared:
+
+- **Personal skills** are private to you in the current workspace.
+- **Shared skills** are published to the workspace skill catalog.
+
+You can add or remove shared skills from your own Ask commands from **Settings -> Skills**. Skill authors and organization owners can edit or delete shared skills.
+
+Organization owners can manage shared skills from **Settings -> Workspace -> Ask Sourcebot**. Owners can also enable **Auto** for a shared skill, which adds it to members' Ask commands by default.
+
+
+ 
+
+
+## Importing skills
+
+### Import from file
+
+File imports support `.md` and `.markdown` files. If the file has front matter, Sourcebot uses it to prefill the skill name, command, and description.
+
+Supported front matter fields:
+
+```md
+---
+name: Debug Build Failure
+slug: debug-build
+description: Investigate a failing CI or build error.
+---
+```
+
+You can also use `title` instead of `name`, and `command` instead of `slug`.
+
+After importing a local file, the skill is editable in Sourcebot.
+
+### Import from repository
+
+Repository imports let you choose a markdown file from an indexed repository. Sourcebot prefills the create form from the file so you can review it, add a missing description, and save. The resulting skill stays synced to that file.
+
+Synced skills behave like manually-created skills, with a link back to their source file:
+
+- Every field stays editable. Local edits are kept until you sync.
+- Sourcebot checks whether the indexed source file has changed.
+- When an update is available, use **Update from source** to replace the skill's content with the file's.
+- When the skill is already up to date, use **Force sync** to restore the content from the source file.
+- Either action warns you first if it would overwrite local edits.
+- Fields the source file does not provide (for example, a missing `description`) keep their local values when you sync.
+
+
+ 
+
+
+## Permissions and synced skills
+
+Synced skills mirror content from a repository file, so Sourcebot only shows them to users who can access the source repository.
+
+If repository permission syncing is enabled, sharing a synced skill shows a warning before publishing it to the workspace. Members without access to the source repository will not see the skill.
+
+Organization owners can still see and manage shared synced skills from workspace settings, even if they do not have access to the source repository.
+
+## Managing skills
+
+From **Settings -> Skills**, you can:
+
+- Search personal and shared skills.
+- Create, edit, delete, or share skills.
+- Add or remove shared skills from your commands.
+- Make a shared skill personal if you manage it.
+- Update synced skills from their source file.
+
+Synced skills show their source repository and file path, plus one of these statuses:
+
+- **Up to date**: The skill matches the indexed source file.
+- **Update available**: The indexed source file has changed.
+- **Source file not found**: The file was renamed, deleted, or no longer resolves at the imported revision.
+- **Source repo unavailable**: The repository is no longer available or visible.
diff --git a/docs/images/skills_create.png b/docs/images/skills_create.png
new file mode 100644
index 000000000..b1ebe7765
Binary files /dev/null and b/docs/images/skills_create.png differ
diff --git a/docs/images/skills_editor.png b/docs/images/skills_editor.png
new file mode 100644
index 000000000..c04776579
Binary files /dev/null and b/docs/images/skills_editor.png differ
diff --git a/docs/images/skills_page.png b/docs/images/skills_page.png
new file mode 100644
index 000000000..5b875dfad
Binary files /dev/null and b/docs/images/skills_page.png differ
diff --git a/docs/images/skills_slash_command.png b/docs/images/skills_slash_command.png
new file mode 100644
index 000000000..d8a4cfe0d
Binary files /dev/null and b/docs/images/skills_slash_command.png differ
diff --git a/docs/images/skills_synced_from_repo.png b/docs/images/skills_synced_from_repo.png
new file mode 100644
index 000000000..23e71a412
Binary files /dev/null and b/docs/images/skills_synced_from_repo.png differ
diff --git a/docs/images/skills_workspace_manager.png b/docs/images/skills_workspace_manager.png
new file mode 100644
index 000000000..2d3017450
Binary files /dev/null and b/docs/images/skills_workspace_manager.png differ
diff --git a/packages/db/prisma/migrations/20260706000100_add_agent_skills/migration.sql b/packages/db/prisma/migrations/20260706000100_add_agent_skills/migration.sql
new file mode 100644
index 000000000..c0b50ec31
--- /dev/null
+++ b/packages/db/prisma/migrations/20260706000100_add_agent_skills/migration.sql
@@ -0,0 +1,87 @@
+-- CreateEnum
+CREATE TYPE "AgentSkillVisibility" AS ENUM ('PERSONAL', 'SHARED');
+
+-- CreateTable
+CREATE TABLE "AgentSkill" (
+ "id" TEXT NOT NULL,
+ "visibility" "AgentSkillVisibility" NOT NULL,
+ "scopeId" TEXT NOT NULL,
+ "slug" TEXT NOT NULL,
+ "name" TEXT NOT NULL,
+ "description" TEXT NOT NULL,
+ "instructions" TEXT NOT NULL,
+ "createdById" TEXT NOT NULL,
+ "updatedById" TEXT,
+ "orgId" INTEGER NOT NULL,
+ "enabled" BOOLEAN NOT NULL DEFAULT true,
+ "autoEnrolled" BOOLEAN NOT NULL DEFAULT false,
+ "sourceRepoName" TEXT,
+ "sourceFilePath" TEXT,
+ "sourceRevision" TEXT,
+ "sourceBlobSha" TEXT,
+ "sourceImportedAt" TIMESTAMP(3),
+ "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ "updatedAt" TIMESTAMP(3) NOT NULL,
+
+ CONSTRAINT "AgentSkill_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AgentSkillAdoption" (
+ "id" TEXT NOT NULL,
+ "userId" TEXT NOT NULL,
+ "orgId" INTEGER NOT NULL,
+ "agentSkillId" TEXT NOT NULL,
+ "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ "removedAt" TIMESTAMP(3),
+
+ CONSTRAINT "AgentSkillAdoption_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AgentSkill_createdById_idx" ON "AgentSkill"("createdById");
+
+-- CreateIndex
+CREATE INDEX "AgentSkill_updatedById_idx" ON "AgentSkill"("updatedById");
+
+-- CreateIndex
+CREATE INDEX "AgentSkill_orgId_idx" ON "AgentSkill"("orgId");
+
+-- CreateIndex
+CREATE INDEX "AgentSkill_orgId_visibility_scopeId_idx" ON "AgentSkill"("orgId", "visibility", "scopeId");
+
+-- CreateIndex
+CREATE INDEX "AgentSkill_shared_catalog_idx" ON "AgentSkill"("orgId", "visibility", "scopeId", "enabled", "updatedAt" DESC, "name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AgentSkill_orgId_visibility_scopeId_slug_key" ON "AgentSkill"("orgId", "visibility", "scopeId", "slug");
+
+-- CreateIndex
+CREATE INDEX "AgentSkillAdoption_userId_orgId_removedAt_idx" ON "AgentSkillAdoption"("userId", "orgId", "removedAt");
+
+-- CreateIndex
+CREATE INDEX "AgentSkillAdoption_agentSkillId_idx" ON "AgentSkillAdoption"("agentSkillId");
+
+-- CreateIndex
+CREATE INDEX "AgentSkillAdoption_orgId_idx" ON "AgentSkillAdoption"("orgId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AgentSkillAdoption_orgId_userId_agentSkillId_key" ON "AgentSkillAdoption"("orgId", "userId", "agentSkillId");
+
+-- AddForeignKey
+ALTER TABLE "AgentSkill" ADD CONSTRAINT "AgentSkill_createdById_fkey" FOREIGN KEY ("createdById") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AgentSkill" ADD CONSTRAINT "AgentSkill_updatedById_fkey" FOREIGN KEY ("updatedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AgentSkill" ADD CONSTRAINT "AgentSkill_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AgentSkillAdoption" ADD CONSTRAINT "AgentSkillAdoption_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AgentSkillAdoption" ADD CONSTRAINT "AgentSkillAdoption_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AgentSkillAdoption" ADD CONSTRAINT "AgentSkillAdoption_agentSkillId_fkey" FOREIGN KEY ("agentSkillId") REFERENCES "AgentSkill"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
index f18889a5f..0f72c97d0 100644
--- a/packages/db/prisma/schema.prisma
+++ b/packages/db/prisma/schema.prisma
@@ -334,6 +334,8 @@ model Org {
repoVisits RepoVisit[]
mcpServers McpServer[]
+ agentSkills AgentSkill[]
+ agentSkillAdoptions AgentSkillAdoption[]
license License?
servicePingEvents ServicePingEvent[]
@@ -519,6 +521,9 @@ model User {
sessionVersion Int @default(0)
userMcpServers UserMcpServer[]
+ createdAgentSkills AgentSkill[] @relation("AgentSkillCreatedBy")
+ updatedAgentSkills AgentSkill[] @relation("AgentSkillUpdatedBy")
+ agentSkillAdoptions AgentSkillAdoption[]
createdAt DateTime @default(now())
updatedAt DateTime @updatedAt
@@ -741,6 +746,93 @@ model ChatAccess {
@@unique([chatId, userId])
}
+enum AgentSkillVisibility {
+ PERSONAL
+ SHARED
+}
+
+model AgentSkill {
+ id String @id @default(cuid())
+
+ // Namespace identity for slash-command uniqueness and lookup.
+ // This is not a foreign key and should not be used as an authorization check by itself.
+ //
+ // Every skill belongs to an org (orgId is always set).
+ // PERSONAL: scopeId is the user id; the skill is private to that user within the org.
+ // SHARED: scopeId is String(orgId); the skill is visible to the whole org (opt-in via adoptions).
+ //
+ // Future sharing/grants should treat this as the skill's home namespace, not as the ACL.
+ visibility AgentSkillVisibility
+ scopeId String
+ slug String
+
+ name String
+ description String
+ instructions String
+
+ // The user who authored the skill. This is audit metadata, separate from
+ // the namespace that owns the slash-command slug.
+ createdBy User @relation("AgentSkillCreatedBy", fields: [createdById], references: [id], onDelete: Cascade)
+ createdById String
+
+ updatedBy User? @relation("AgentSkillUpdatedBy", fields: [updatedById], references: [id], onDelete: SetNull)
+ updatedById String?
+
+ // The owning org. Both PERSONAL and SHARED skills are scoped to an org, so a
+ // user's personal skills change when they switch orgs.
+ org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
+ orgId Int
+
+ enabled Boolean @default(true)
+ autoEnrolled Boolean @default(false)
+
+ // Provenance for skills imported from an indexed repository file. All null for
+ // skills created manually or imported from a local file. When set, the skill's
+ // content is a read-only mirror of the source file: edits happen in the repo and
+ // are pulled in via "Update from source". sourceBlobSha (the git blob OID at
+ // import) is the comparison key used to detect when the indexed file has changed.
+ // Sync is personal-only; publishing to shared snapshots the content and drops
+ // these fields.
+ sourceRepoName String?
+ sourceFilePath String?
+ sourceRevision String?
+ sourceBlobSha String?
+ sourceImportedAt DateTime?
+
+ createdAt DateTime @default(now())
+ updatedAt DateTime @updatedAt
+
+ adoptions AgentSkillAdoption[]
+
+ @@unique([orgId, visibility, scopeId, slug])
+ @@index([createdById])
+ @@index([updatedById])
+ @@index([orgId])
+ @@index([orgId, visibility, scopeId])
+ @@index([orgId, visibility, scopeId, enabled, updatedAt(sort: Desc), name], map: "AgentSkill_shared_catalog_idx")
+}
+
+model AgentSkillAdoption {
+ id String @id @default(cuid())
+
+ user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+ userId String
+
+ org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
+ orgId Int
+
+ agentSkill AgentSkill @relation(fields: [agentSkillId], references: [id], onDelete: Cascade)
+ agentSkillId String
+
+ createdAt DateTime @default(now())
+ removedAt DateTime?
+
+ @@unique([orgId, userId, agentSkillId])
+ @@index([userId, orgId, removedAt])
+ @@index([agentSkillId])
+ @@index([orgId])
+}
+
// OAuth2 Authorization Server models
// @see: https://datatracker.ietf.org/doc/html/rfc6749
diff --git a/packages/db/src/index.ts b/packages/db/src/index.ts
index 245206d9d..7853b4f1d 100644
--- a/packages/db/src/index.ts
+++ b/packages/db/src/index.ts
@@ -1,3 +1,62 @@
-import type { User, Account } from ".prisma/client";
+import type { Account, Prisma, User } from ".prisma/client";
export type UserWithAccounts = User & { accounts: Account[] };
-export * from ".prisma/client";
\ No newline at end of file
+export * from ".prisma/client";
+
+// Personal skills are scoped to the (user, org) pair: a user's personal skills
+// change when they switch orgs. scopeId is the userId; orgId binds it to the org.
+export const personalAgentSkillScope = (userId: string, orgId: number) => ({
+ visibility: "PERSONAL" as const,
+ scopeId: userId,
+ orgId,
+});
+
+// Shared skills are visible to the whole org. scopeId is String(orgId) so every
+// shared skill in an org occupies one slug-uniqueness namespace.
+export const sharedAgentSkillScope = (orgId: number) => ({
+ visibility: "SHARED" as const,
+ scopeId: String(orgId),
+ orgId,
+});
+
+export const personalAgentSkillAuthScope = (userId: string, orgId: number) => ({
+ ...personalAgentSkillScope(userId, orgId),
+ createdById: userId,
+});
+
+export const sharedAgentSkillAuthScope = (orgId: number) => ({
+ ...sharedAgentSkillScope(orgId),
+});
+
+export const sharedAgentSkillVisibleToUserWhere = (userId: string, orgId: number) => ({
+ ...sharedAgentSkillAuthScope(orgId),
+ enabled: true,
+ AND: [
+ {
+ OR: [
+ { autoEnrolled: true },
+ {
+ adoptions: {
+ some: {
+ userId,
+ orgId,
+ removedAt: null,
+ },
+ },
+ },
+ ],
+ },
+ {
+ NOT: {
+ adoptions: {
+ some: {
+ userId,
+ orgId,
+ removedAt: {
+ not: null,
+ },
+ },
+ },
+ },
+ },
+ ],
+}) satisfies Prisma.AgentSkillWhereInput;
diff --git a/packages/web/package.json b/packages/web/package.json
index 64977cd67..0f06c0d58 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -206,6 +206,7 @@
"usehooks-ts": "^3.1.0",
"uuid": "^14.0.0",
"vscode-icons-js": "^11.6.1",
+ "yaml": "^2.8.3",
"zod": "^3.25.76",
"zod-to-json-schema": "^3.24.5"
},
@@ -214,6 +215,7 @@
"@eslint/eslintrc": "^3",
"@react-email/ui": "6.1.4",
"@react-grab/mcp": "^0.1.23",
+ "@tailwindcss/container-queries": "^0.1.1",
"@tanstack/eslint-plugin-query": "^5.74.7",
"@testing-library/dom": "^10.4.1",
"@testing-library/react": "^16.3.0",
diff --git a/packages/web/src/app/(app)/@sidebar/components/settingsSidebar/nav.tsx b/packages/web/src/app/(app)/@sidebar/components/settingsSidebar/nav.tsx
index 11960732a..9f86c73d0 100644
--- a/packages/web/src/app/(app)/@sidebar/components/settingsSidebar/nav.tsx
+++ b/packages/web/src/app/(app)/@sidebar/components/settingsSidebar/nav.tsx
@@ -22,6 +22,7 @@ import {
ServerIcon,
Settings2Icon,
ShieldIcon,
+ SparklesIcon,
UserIcon,
UsersIcon,
} from "lucide-react";
@@ -44,6 +45,7 @@ const iconMap = {
"user": UserIcon,
"mcp": VscMcp,
"bot": BotIcon,
+ "sparkles": SparklesIcon,
} satisfies Record