feat(core): backport requirements, skills, headers, fixtures

2026-10-25 03:32:32 +00:00 · 2025-12-19 08:51:11 +10:00
parent 76450bcd23
commit f2750fd620
95 changed files with 3272 additions and 20 deletions
@@ -925,6 +925,7 @@ name = "code-apply-patch"
 version = "0.0.0"
 dependencies = [
 "anyhow",
+ "assert_cmd",
 "pretty_assertions",
 "similar",
 "tempfile",
@@ -22,5 +22,6 @@ tree-sitter = { workspace = true }
 tree-sitter-bash = { workspace = true }

 [dev-dependencies]
+assert_cmd = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
@@ -0,0 +1,3 @@
+// Single integration test binary that aggregates all test modules.
+// The submodules live in `tests/suite/`.
+mod suite;
@@ -0,0 +1 @@
+** text eol=lf
@@ -0,0 +1 @@
+This is a new file
@@ -0,0 +1,4 @@
+*** Begin Patch
+*** Add File: bar.md
+This is a new file
+*** End Patch
@@ -0,0 +1,2 @@
+line1
+changed
@@ -0,0 +1 @@
+created
@@ -0,0 +1 @@
+obsolete
@@ -0,0 +1,2 @@
+line1
+line2
@@ -0,0 +1,9 @@
+*** Begin Patch
+*** Add File: nested/new.txt
+created
+*** Delete File: delete.txt
+*** Update File: modify.txt
+@@
+-line2
+changed
+*** End Patch
@@ -0,0 +1,4 @@
+line1
+changed2
+line3
+changed4
@@ -0,0 +1,4 @@
+line1
+line2
+line3
+line4
@@ -0,0 +1,9 @@
+*** Begin Patch
+*** Update File: multi.txt
+@@
+-line2
+changed2
+@@
+-line4
+changed4
+*** End Patch
@@ -0,0 +1 @@
+unrelated file
@@ -0,0 +1 @@
+new content
@@ -0,0 +1 @@
+old content
@@ -0,0 +1 @@
+unrelated file
@@ -0,0 +1,7 @@
+*** Begin Patch
+*** Update File: old/name.txt
+*** Move to: renamed/dir/name.txt
+@@
+-old content
+new content
+*** End Patch
@@ -0,0 +1 @@
+stable
@@ -0,0 +1 @@
+stable
@@ -0,0 +1,2 @@
+*** Begin Patch
+*** End Patch
@@ -0,0 +1,2 @@
+line1
+line2
@@ -0,0 +1,2 @@
+line1
+line2
@@ -0,0 +1,6 @@
+*** Begin Patch
+*** Update File: modify.txt
+@@
+-missing
+changed
+*** End Patch
@@ -0,0 +1 @@
+stable
@@ -0,0 +1 @@
+stable
@@ -0,0 +1,3 @@
+*** Begin Patch
+*** Delete File: missing.txt
+*** End Patch
@@ -0,0 +1 @@
+stable
@@ -0,0 +1 @@
+stable
@@ -0,0 +1,3 @@
+*** Begin Patch
+*** Update File: foo.txt
+*** End Patch
@@ -0,0 +1 @@
+stable
@@ -0,0 +1 @@
+stable
@@ -0,0 +1,6 @@
+*** Begin Patch
+*** Update File: missing.txt
+@@
+-old
+new
+*** End Patch
@@ -0,0 +1 @@
+unrelated file
@@ -0,0 +1 @@
+new
@@ -0,0 +1 @@
+from
@@ -0,0 +1 @@
+unrelated file
@@ -0,0 +1 @@
+existing
@@ -0,0 +1,7 @@
+*** Begin Patch
+*** Update File: old/name.txt
+*** Move to: renamed/dir/name.txt
+@@
+-from
+new
+*** End Patch
@@ -0,0 +1 @@
+new content
@@ -0,0 +1 @@
+old content
@@ -0,0 +1,4 @@
+*** Begin Patch
+*** Add File: duplicate.txt
+new content
+*** End Patch
@@ -0,0 +1 @@
+stable
@@ -0,0 +1 @@
+stable
@@ -0,0 +1,3 @@
+*** Begin Patch
+*** Delete File: dir
+*** End Patch
@@ -0,0 +1 @@
+stable
@@ -0,0 +1 @@
+stable
@@ -0,0 +1,3 @@
+*** Begin Patch
+*** Frobnicate File: foo
+*** End Patch
@@ -0,0 +1,2 @@
+first line
+second line
@@ -0,0 +1 @@
+no newline at end
@@ -0,0 +1,7 @@
+*** Begin Patch
+*** Update File: no_newline.txt
+@@
+-no newline at end
+first line
+second line
+*** End Patch
@@ -0,0 +1 @@
+hello
@@ -0,0 +1,8 @@
+*** Begin Patch
+*** Add File: created.txt
+hello
+*** Update File: missing.txt
+@@
+-old
+new
+*** End Patch
@@ -0,0 +1,4 @@
+line1
+line2
+added line 1
+added line 2
@@ -0,0 +1,2 @@
+line1
+line2
@@ -0,0 +1,6 @@
+*** Begin Patch
+*** Update File: input.txt
+@@
+added line 1
+added line 2
+*** End Patch
@@ -0,0 +1 @@
+new
@@ -0,0 +1 @@
+old
@@ -0,0 +1,6 @@
+*** Begin Patch
+  *** Update File: foo.txt
+@@
+-old
+new
+*** End Patch
@@ -0,0 +1 @@
+two
@@ -0,0 +1 @@
+one
@@ -0,0 +1,6 @@
+ *** Begin Patch
+*** Update File: file.txt
+@@
+-one
+two
+*** End Patch 
@@ -0,0 +1,3 @@
+line1
+naïve café ✅
+line3
@@ -0,0 +1,3 @@
+line1
+naïve café
+line3
@@ -0,0 +1,7 @@
+*** Begin Patch
+*** Update File: foo.txt
+@@
+ line1
+-naïve café
+naïve café ✅
+*** End Patch
@@ -0,0 +1,18 @@
+# Overview
+This directory is a collection of end to end tests for the apply-patch specification, meant to be easily portable to other languages or platforms.
+
+
+# Specification
+Each test case is one directory, composed of input state (input/), the patch operation (patch.txt), and the expected final state (expected/). This structure is designed to keep tests simple (i.e. test exactly one patch at a time) while still providing enough flexibility to test any given operation across files.
+
+Here's what this would look like for a simple test apply-patch test case to create a new file:
+
+```
+001_add/
+  input/
+    foo.md
+  expected/
+    foo.md
+    bar.md
+  patch.txt
+```
@@ -0,0 +1,90 @@
+use assert_cmd::prelude::*;
+use std::fs;
+use std::process::Command;
+use tempfile::tempdir;
+
+#[test]
+fn test_apply_patch_cli_add_and_update() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let file = "cli_test.txt";
+    let absolute_path = tmp.path().join(file);
+
+    // 1) Add a file
+    let add_patch = format!(
+        r#"*** Begin Patch
+*** Add File: {file}
+hello
+*** End Patch"#
+    );
+    Command::cargo_bin("apply_patch")
+        .expect("should find apply_patch binary")
+        .arg(add_patch)
+        .current_dir(tmp.path())
+        .assert()
+        .success()
+        .stdout(format!("Success. Updated the following files:\nA {file}\n"));
+    assert_eq!(fs::read_to_string(&absolute_path)?, "hello\n");
+
+    // 2) Update the file
+    let update_patch = format!(
+        r#"*** Begin Patch
+*** Update File: {file}
+@@
+-hello
+world
+*** End Patch"#
+    );
+    Command::cargo_bin("apply_patch")
+        .expect("should find apply_patch binary")
+        .arg(update_patch)
+        .current_dir(tmp.path())
+        .assert()
+        .success()
+        .stdout(format!("Success. Updated the following files:\nM {file}\n"));
+    assert_eq!(fs::read_to_string(&absolute_path)?, "world\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_stdin_add_and_update() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let file = "cli_test_stdin.txt";
+    let absolute_path = tmp.path().join(file);
+
+    // 1) Add a file via stdin
+    let add_patch = format!(
+        r#"*** Begin Patch
+*** Add File: {file}
+hello
+*** End Patch"#
+    );
+    let mut cmd =
+        assert_cmd::Command::cargo_bin("apply_patch").expect("should find apply_patch binary");
+    cmd.current_dir(tmp.path());
+    cmd.write_stdin(add_patch)
+        .assert()
+        .success()
+        .stdout(format!("Success. Updated the following files:\nA {file}\n"));
+    assert_eq!(fs::read_to_string(&absolute_path)?, "hello\n");
+
+    // 2) Update the file via stdin
+    let update_patch = format!(
+        r#"*** Begin Patch
+*** Update File: {file}
+@@
+-hello
+world
+*** End Patch"#
+    );
+    let mut cmd =
+        assert_cmd::Command::cargo_bin("apply_patch").expect("should find apply_patch binary");
+    cmd.current_dir(tmp.path());
+    cmd.write_stdin(update_patch)
+        .assert()
+        .success()
+        .stdout(format!("Success. Updated the following files:\nM {file}\n"));
+    assert_eq!(fs::read_to_string(&absolute_path)?, "world\n");
+
+    Ok(())
+}
@@ -0,0 +1,4 @@
+mod cli;
+mod scenarios;
+#[cfg(not(target_os = "windows"))]
+mod tool;
@@ -0,0 +1,114 @@
+use assert_cmd::prelude::*;
+use pretty_assertions::assert_eq;
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::Path;
+use std::path::PathBuf;
+use std::process::Command;
+use tempfile::tempdir;
+
+#[test]
+fn test_apply_patch_scenarios() -> anyhow::Result<()> {
+    for scenario in fs::read_dir("tests/fixtures/scenarios")? {
+        let scenario = scenario?;
+        let path = scenario.path();
+        if path.is_dir() {
+            run_apply_patch_scenario(&path)?;
+        }
+    }
+    Ok(())
+}
+
+/// Reads a scenario directory, copies the input files to a temporary directory, runs apply-patch,
+/// and asserts that the final state matches the expected state exactly.
+fn run_apply_patch_scenario(dir: &Path) -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+
+    // Copy the input files to the temporary directory
+    let input_dir = dir.join("input");
+    if input_dir.is_dir() {
+        copy_dir_recursive(&input_dir, tmp.path())?;
+    }
+
+    // Read the patch.txt file
+    let patch = fs::read_to_string(dir.join("patch.txt"))?;
+
+    // Run apply_patch in the temporary directory. We intentionally do not assert
+    // on the exit status here; the scenarios are specified purely in terms of
+    // final filesystem state, which we compare below.
+    Command::cargo_bin("apply_patch")?
+        .arg(patch)
+        .current_dir(tmp.path())
+        .output()?;
+
+    // Assert that the final state matches the expected state exactly
+    let expected_dir = dir.join("expected");
+    let expected_snapshot = snapshot_dir(&expected_dir)?;
+    let actual_snapshot = snapshot_dir(tmp.path())?;
+
+    assert_eq!(
+        actual_snapshot,
+        expected_snapshot,
+        "Scenario {} did not match expected final state",
+        dir.display()
+    );
+
+    Ok(())
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Entry {
+    File(Vec<u8>),
+    Dir,
+}
+
+fn snapshot_dir(root: &Path) -> anyhow::Result<BTreeMap<PathBuf, Entry>> {
+    let mut entries = BTreeMap::new();
+    if root.is_dir() {
+        snapshot_dir_recursive(root, root, &mut entries)?;
+    }
+    Ok(entries)
+}
+
+fn snapshot_dir_recursive(
+    base: &Path,
+    dir: &Path,
+    entries: &mut BTreeMap<PathBuf, Entry>,
+) -> anyhow::Result<()> {
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        let Some(stripped) = path.strip_prefix(base).ok() else {
+            continue;
+        };
+        let rel = stripped.to_path_buf();
+        let file_type = entry.file_type()?;
+        if file_type.is_dir() {
+            entries.insert(rel.clone(), Entry::Dir);
+            snapshot_dir_recursive(base, &path, entries)?;
+        } else if file_type.is_file() {
+            let contents = fs::read(&path)?;
+            entries.insert(rel, Entry::File(contents));
+        }
+    }
+    Ok(())
+}
+
+fn copy_dir_recursive(src: &Path, dst: &Path) -> anyhow::Result<()> {
+    for entry in fs::read_dir(src)? {
+        let entry = entry?;
+        let path = entry.path();
+        let file_type = entry.file_type()?;
+        let dest_path = dst.join(entry.file_name());
+        if file_type.is_dir() {
+            fs::create_dir_all(&dest_path)?;
+            copy_dir_recursive(&path, &dest_path)?;
+        } else if file_type.is_file() {
+            if let Some(parent) = dest_path.parent() {
+                fs::create_dir_all(parent)?;
+            }
+            fs::copy(&path, &dest_path)?;
+        }
+    }
+    Ok(())
+}
@@ -0,0 +1,257 @@
+use assert_cmd::Command;
+use pretty_assertions::assert_eq;
+use std::fs;
+use std::path::Path;
+use tempfile::tempdir;
+
+fn run_apply_patch_in_dir(dir: &Path, patch: &str) -> anyhow::Result<assert_cmd::assert::Assert> {
+    let mut cmd = Command::cargo_bin("apply_patch")?;
+    cmd.current_dir(dir);
+    Ok(cmd.arg(patch).assert())
+}
+
+fn apply_patch_command(dir: &Path) -> anyhow::Result<Command> {
+    let mut cmd = Command::cargo_bin("apply_patch")?;
+    cmd.current_dir(dir);
+    Ok(cmd)
+}
+
+#[test]
+fn test_apply_patch_cli_applies_multiple_operations() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let modify_path = tmp.path().join("modify.txt");
+    let delete_path = tmp.path().join("delete.txt");
+
+    fs::write(&modify_path, "line1\nline2\n")?;
+    fs::write(&delete_path, "obsolete\n")?;
+
+    let patch = "*** Begin Patch\n*** Add File: nested/new.txt\n+created\n*** Delete File: delete.txt\n*** Update File: modify.txt\n@@\n-line2\n+changed\n*** End Patch";
+
+    run_apply_patch_in_dir(tmp.path(), patch)?.success().stdout(
+        "Success. Updated the following files:\nA nested/new.txt\nM modify.txt\nD delete.txt\n",
+    );
+
+    assert_eq!(
+        fs::read_to_string(tmp.path().join("nested/new.txt"))?,
+        "created\n"
+    );
+    assert_eq!(fs::read_to_string(&modify_path)?, "line1\nchanged\n");
+    assert!(!delete_path.exists());
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_applies_multiple_chunks() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let target_path = tmp.path().join("multi.txt");
+    fs::write(&target_path, "line1\nline2\nline3\nline4\n")?;
+
+    let patch = "*** Begin Patch\n*** Update File: multi.txt\n@@\n-line2\n+changed2\n@@\n-line4\n+changed4\n*** End Patch";
+
+    run_apply_patch_in_dir(tmp.path(), patch)?
+        .success()
+        .stdout("Success. Updated the following files:\nM multi.txt\n");
+
+    assert_eq!(
+        fs::read_to_string(&target_path)?,
+        "line1\nchanged2\nline3\nchanged4\n"
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_moves_file_to_new_directory() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let original_path = tmp.path().join("old/name.txt");
+    let new_path = tmp.path().join("renamed/dir/name.txt");
+    fs::create_dir_all(original_path.parent().expect("parent should exist"))?;
+    fs::write(&original_path, "old content\n")?;
+
+    let patch = "*** Begin Patch\n*** Update File: old/name.txt\n*** Move to: renamed/dir/name.txt\n@@\n-old content\n+new content\n*** End Patch";
+
+    run_apply_patch_in_dir(tmp.path(), patch)?
+        .success()
+        .stdout("Success. Updated the following files:\nM renamed/dir/name.txt\n");
+
+    assert!(!original_path.exists());
+    assert_eq!(fs::read_to_string(&new_path)?, "new content\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_rejects_empty_patch() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr("No files were modified.\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_reports_missing_context() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let target_path = tmp.path().join("modify.txt");
+    fs::write(&target_path, "line1\nline2\n")?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Update File: modify.txt\n@@\n-missing\n+changed\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr("Failed to find expected lines in modify.txt:\nmissing\n");
+    assert_eq!(fs::read_to_string(&target_path)?, "line1\nline2\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_rejects_missing_file_delete() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Delete File: missing.txt\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr("Failed to delete file missing.txt\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_rejects_empty_update_hunk() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Update File: foo.txt\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr("Invalid patch hunk on line 2: Update file hunk for path 'foo.txt' is empty\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_requires_existing_file_for_update() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Update File: missing.txt\n@@\n-old\n+new\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr(
+            "Failed to read file to update missing.txt: No such file or directory (os error 2)\n",
+        );
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_move_overwrites_existing_destination() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let original_path = tmp.path().join("old/name.txt");
+    let destination = tmp.path().join("renamed/dir/name.txt");
+    fs::create_dir_all(original_path.parent().expect("parent should exist"))?;
+    fs::create_dir_all(destination.parent().expect("parent should exist"))?;
+    fs::write(&original_path, "from\n")?;
+    fs::write(&destination, "existing\n")?;
+
+    run_apply_patch_in_dir(
+        tmp.path(),
+        "*** Begin Patch\n*** Update File: old/name.txt\n*** Move to: renamed/dir/name.txt\n@@\n-from\n+new\n*** End Patch",
+    )?
+    .success()
+    .stdout("Success. Updated the following files:\nM renamed/dir/name.txt\n");
+
+    assert!(!original_path.exists());
+    assert_eq!(fs::read_to_string(&destination)?, "new\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_add_overwrites_existing_file() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let path = tmp.path().join("duplicate.txt");
+    fs::write(&path, "old content\n")?;
+
+    run_apply_patch_in_dir(
+        tmp.path(),
+        "*** Begin Patch\n*** Add File: duplicate.txt\n+new content\n*** End Patch",
+    )?
+    .success()
+    .stdout("Success. Updated the following files:\nA duplicate.txt\n");
+
+    assert_eq!(fs::read_to_string(&path)?, "new content\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_delete_directory_fails() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    fs::create_dir(tmp.path().join("dir"))?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Delete File: dir\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr("Failed to delete file dir\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_rejects_invalid_hunk_header() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Frobnicate File: foo\n*** End Patch")
+        .assert()
+        .failure()
+        .stderr("Invalid patch hunk on line 2: '*** Frobnicate File: foo' is not a valid hunk header. Valid hunk headers: '*** Add File: {path}', '*** Delete File: {path}', '*** Update File: {path}'\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_updates_file_appends_trailing_newline() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let target_path = tmp.path().join("no_newline.txt");
+    fs::write(&target_path, "no newline at end")?;
+
+    run_apply_patch_in_dir(
+        tmp.path(),
+        "*** Begin Patch\n*** Update File: no_newline.txt\n@@\n-no newline at end\n+first line\n+second line\n*** End Patch",
+    )?
+    .success()
+    .stdout("Success. Updated the following files:\nM no_newline.txt\n");
+
+    let contents = fs::read_to_string(&target_path)?;
+    assert!(contents.ends_with('\n'));
+    assert_eq!(contents, "first line\nsecond line\n");
+
+    Ok(())
+}
+
+#[test]
+fn test_apply_patch_cli_failure_after_partial_success_leaves_changes() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let new_file = tmp.path().join("created.txt");
+
+    apply_patch_command(tmp.path())?
+        .arg("*** Begin Patch\n*** Add File: created.txt\n+hello\n*** Update File: missing.txt\n@@\n-old\n+new\n*** End Patch")
+        .assert()
+        .failure()
+        .stdout("")
+        .stderr("Failed to read file to update missing.txt: No such file or directory (os error 2)\n");
+
+    assert_eq!(fs::read_to_string(&new_file)?, "hello\n");
+
+    Ok(())
+}
@@ -1428,6 +1428,17 @@ fn command_exists(cmd: &str) -> bool {
        }
    }

+    // Tag OpenAI requests originating from agent runs so server-side telemetry
+    // can distinguish subagent traffic.
+    if use_current_exe || family == "codex" || family == "code" {
+        let subagent = match source_kind {
+            Some(AgentSourceKind::AutoReview) => "review",
+            _ => "agent",
+        };
+        env.entry("CODE_OPENAI_SUBAGENT".to_string())
+            .or_insert_with(|| subagent.to_string());
+    }
+
    // Convenience: map common key names so external CLIs "just work".
    if let Some(google_key) = env.get("GOOGLE_API_KEY").cloned() {
        env.entry("GEMINI_API_KEY".to_string()).or_insert(google_key);
@@ -16,6 +16,7 @@ use httpdate::parse_http_date;
 use regex_lite::Regex;
 use reqwest::StatusCode;
 use reqwest::header::HeaderMap;
+use reqwest::header::HeaderValue;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value;
@@ -70,6 +71,8 @@ use std::sync::RwLock;
 const RESPONSES_BETA_HEADER_V1: &str = "responses=v1";
 const RESPONSES_BETA_HEADER_EXPERIMENTAL: &str = "responses=experimental";

+const CODE_OPENAI_SUBAGENT_ENV: &str = "CODE_OPENAI_SUBAGENT";
+
 #[derive(Default, Debug)]
 struct StreamCheckpoint {
    /// Highest sequence_number observed across attempts. Used to drop replayed deltas.
@@ -652,6 +655,9 @@ impl ModelClient {
                req_builder = req_builder.header("OpenAI-Beta", beta_value);
            }

+            req_builder = attach_openai_subagent_header(req_builder);
+            req_builder = attach_codex_beta_features_header(req_builder, &self.config);
+
            req_builder = req_builder
                // Send `conversation_id`/`session_id` so the server can hit the prompt-cache.
                .header("conversation_id", session_id_str.clone())
@@ -1044,6 +1050,9 @@ impl ModelClient {
            request = request.header("OpenAI-Beta", beta_value);
        }

+        request = attach_openai_subagent_header(request);
+        request = attach_codex_beta_features_header(request, &self.config);
+
        if let Some(auth) = auth.as_ref()
            && auth.mode == AuthMode::ChatGPT
            && let Some(account_id) = auth.get_account_id()
@@ -1120,6 +1129,71 @@ impl ModelClient {
    }
 }

+fn attach_codex_beta_features_header(
+    builder: reqwest::RequestBuilder,
+    config: &Config,
+) -> reqwest::RequestBuilder {
+    let Some(value) = codex_beta_features_header_value(config) else {
+        return builder;
+    };
+
+    let has_header = builder
+        .try_clone()
+        .and_then(|builder| builder.build().ok())
+        .map_or(false, |req| req.headers().contains_key("x-codex-beta-features"));
+    if has_header {
+        return builder;
+    }
+
+    builder.header("x-codex-beta-features", value)
+}
+
+fn codex_beta_features_header_value(config: &Config) -> Option<HeaderValue> {
+    let mut enabled: Vec<&'static str> = Vec::new();
+
+    if config.skills_enabled {
+        enabled.push("skills");
+    }
+    if config.tools_web_search_request {
+        enabled.push("web_search_request");
+    }
+    if config.use_experimental_use_rmcp_client {
+        enabled.push("rmcp_client");
+    }
+
+    let value = enabled.join(",");
+    if value.is_empty() {
+        return None;
+    }
+
+    HeaderValue::from_str(value.as_str()).ok()
+}
+
+fn attach_openai_subagent_header(builder: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
+    let Some(value) = openai_subagent_header_value() else {
+        return builder;
+    };
+
+    let has_header = builder
+        .try_clone()
+        .and_then(|builder| builder.build().ok())
+        .map_or(false, |req| req.headers().contains_key("x-openai-subagent"));
+    if has_header {
+        return builder;
+    }
+
+    builder.header("x-openai-subagent", value)
+}
+
+fn openai_subagent_header_value() -> Option<HeaderValue> {
+    let subagent = std::env::var(CODE_OPENAI_SUBAGENT_ENV).ok()?;
+    let subagent = subagent.trim();
+    if subagent.is_empty() {
+        return None;
+    }
+    HeaderValue::from_str(subagent).ok()
+}
+
 fn clamp_text_verbosity_for_model(
    model: &str,
    requested: TextVerbosityConfig,
@@ -978,6 +978,7 @@ use crate::dry_run_guard::{analyze_command, DryRunAnalysis, DryRunDisposition, D
 use crate::parse_command::parse_command;
 use crate::plan_tool::handle_update_plan;
 use crate::project_doc::get_user_instructions;
+use crate::skills::load_skills;
 use crate::project_features::{ProjectCommand, ProjectHook, ProjectHooks};
 use crate::protocol::AgentMessageDeltaEvent;
 use crate::protocol::AgentMessageEvent;
@@ -1076,7 +1077,18 @@ impl Codex {
        let (tx_sub, rx_sub) = async_channel::unbounded();
        let (tx_event, rx_event) = async_channel::unbounded();

-        let user_instructions = get_user_instructions(&config).await;
+        let skills_outcome = config.skills_enabled.then(|| load_skills(&config));
+        if let Some(outcome) = &skills_outcome {
+            for err in &outcome.errors {
+                warn!("invalid skill {}: {}", err.path.display(), err.message);
+            }
+        }
+
+        let user_instructions = get_user_instructions(
+            &config,
+            skills_outcome.as_ref().map(|outcome| outcome.skills.as_slice()),
+        )
+        .await;

        let configure_session = Op::ConfigureSession {
            provider: config.model_provider.clone(),
@@ -4649,8 +4661,19 @@ async fn submission_loop(
                    new_auto_compact,
                );

-                let computed_user_instructions =
-                    get_user_instructions(&updated_config).await;
+                let skills_outcome =
+                    updated_config.skills_enabled.then(|| load_skills(&updated_config));
+                if let Some(outcome) = &skills_outcome {
+                    for err in &outcome.errors {
+                        warn!("invalid skill {}: {}", err.path.display(), err.message);
+                    }
+                }
+
+                let computed_user_instructions = get_user_instructions(
+                    &updated_config,
+                    skills_outcome.as_ref().map(|outcome| outcome.skills.as_slice()),
+                )
+                .await;
                updated_config.user_instructions = computed_user_instructions.clone();

                let effective_user_instructions = computed_user_instructions.clone();
@@ -68,6 +68,10 @@ use toml_edit::Item as TomlItem;
 use toml_edit::Table as TomlTable;
 use which::which;

+pub use crate::config_constraint::Constrained;
+pub use crate::config_constraint::ConstraintError;
+pub use crate::config_constraint::ConstraintResult;
+
 pub(crate) const OPENAI_DEFAULT_MODEL: &str = "gpt-5.1-codex-max";
 const OPENAI_DEFAULT_REVIEW_MODEL: &str = "gpt-5.1-codex-max";
 pub const GPT_5_CODEX_MEDIUM_MODEL: &str = "gpt-5.2-codex";
@@ -407,6 +411,9 @@ pub struct Config {
    pub use_experimental_use_rmcp_client: bool,
    /// Enable the `view_image` tool that lets the agent attach local images.
    pub include_view_image_tool: bool,
+
+    /// Experimental: enable discovery and injection of skills.
+    pub skills_enabled: bool,
    /// Experimental: enable JSON-based environment context snapshots and deltas (phase gated).
    pub env_ctx_v2: bool,
    /// Retention policy for env_ctx_v2 timeline management (gated by env_ctx_v2).
@@ -479,7 +486,20 @@ impl Config {
        let cfg = deserialize_config_toml_with_cli_warnings(&root_value, &cli_paths)?;

        // Step 4: merge with the strongly-typed overrides.
-        Self::load_from_base_config_with_overrides(cfg, overrides, code_home)
+        let mut config = Self::load_from_base_config_with_overrides(cfg, overrides, code_home)?;
+
+        let requirements = crate::config_loader::load_config_requirements_blocking(
+            &config.code_home,
+            LoaderOverrides::default(),
+        )?;
+
+        let mut constrained_approval_policy = requirements.approval_policy;
+        constrained_approval_policy
+            .set(config.approval_policy)
+            .map_err(|err| std::io::Error::new(std::io::ErrorKind::InvalidInput, err))?;
+        config.approval_policy = constrained_approval_policy.value();
+
+        Ok(config)
    }
 }

@@ -2248,6 +2268,9 @@ pub struct ConfigToml {
    /// Nested tools section for feature toggles
    pub tools: Option<ToolsToml>,

+    /// Experimental feature toggles.
+    pub features: Option<FeaturesToml>,
+
    /// When true, disables burst-paste detection for typed input entirely.
    /// All characters are inserted as they are received, and no buffering
    /// or placeholder replacement will occur for fast keypress bursts.
@@ -2329,6 +2352,13 @@ pub struct ToolsToml {
    pub view_image: Option<bool>,
 }

+#[derive(Deserialize, Debug, Clone, Default)]
+pub struct FeaturesToml {
+    /// Enable discovery and injection of skills.
+    #[serde(default)]
+    pub skills: Option<bool>,
+}
+
 impl ConfigToml {
    /// Derive the effective sandbox policy from the configuration.
    #[cfg(test)]
@@ -2707,6 +2737,12 @@ impl Config {
            .or(cfg.tools.as_ref().and_then(|t| t.view_image))
            .unwrap_or(true);

+        let skills_enabled = cfg
+            .features
+            .as_ref()
+            .and_then(|features| features.skills)
+            .unwrap_or(false);
+
        let env_ctx_v2_flag = *crate::flags::CTX_UI;

        // Determine auth mode early so defaults like model selection can depend on it.
@@ -3071,6 +3107,7 @@ impl Config {
                .experimental_use_rmcp_client
                .unwrap_or(false),
            include_view_image_tool: include_view_image_tool_flag,
+            skills_enabled,
            env_ctx_v2: env_ctx_v2_flag,
            retention: crate::config_types::RetentionConfig::default(),
            responses_originator_header,
@@ -0,0 +1,232 @@
+use std::fmt;
+use std::sync::Arc;
+
+use thiserror::Error;
+
+#[derive(Debug, Error, PartialEq, Eq)]
+#[error("{message}")]
+pub struct ConstraintError {
+    pub message: String,
+}
+
+impl ConstraintError {
+    pub fn invalid_value(candidate: impl Into<String>, allowed: impl Into<String>) -> Self {
+        let candidate = candidate.into();
+        let allowed = allowed.into();
+        Self {
+            message: format!("value `{candidate}` is not in the allowed set {allowed}"),
+        }
+    }
+
+    pub fn empty_field(field_name: impl Into<String>) -> Self {
+        let field_name = field_name.into();
+        Self {
+            message: format!("field `{field_name}` cannot be empty"),
+        }
+    }
+}
+
+pub type ConstraintResult<T> = Result<T, ConstraintError>;
+
+impl From<ConstraintError> for std::io::Error {
+    fn from(err: ConstraintError) -> Self {
+        std::io::Error::new(std::io::ErrorKind::InvalidInput, err)
+    }
+}
+
+type ConstraintValidator<T> = dyn Fn(&T) -> ConstraintResult<()> + Send + Sync;
+
+#[derive(Clone)]
+pub struct Constrained<T> {
+    value: T,
+    validator: Arc<ConstraintValidator<T>>,
+}
+
+impl<T: Send + Sync> Constrained<T> {
+    pub fn new(
+        initial_value: T,
+        validator: impl Fn(&T) -> ConstraintResult<()> + Send + Sync + 'static,
+    ) -> ConstraintResult<Self> {
+        let validator: Arc<ConstraintValidator<T>> = Arc::new(validator);
+        validator(&initial_value)?;
+        Ok(Self {
+            value: initial_value,
+            validator,
+        })
+    }
+
+    pub fn allow_any(initial_value: T) -> Self {
+        Self {
+            value: initial_value,
+            validator: Arc::new(|_| Ok(())),
+        }
+    }
+
+    pub fn allow_any_from_default() -> Self
+    where
+        T: Default,
+    {
+        Self::allow_any(T::default())
+    }
+
+    pub fn allow_only(value: T) -> Self
+    where
+        T: PartialEq + Send + Sync + fmt::Debug + Clone + 'static,
+    {
+        let expected = value.clone();
+        let validator: Arc<ConstraintValidator<T>> = Arc::new(move |candidate| {
+            if *candidate == expected {
+                Ok(())
+            } else {
+                Err(ConstraintError::invalid_value(
+                    format!("{candidate:?}"),
+                    format!("{expected:?}"),
+                ))
+            }
+        });
+
+        Self { value, validator }
+    }
+
+    pub fn allow_values(initial_value: T, allowed: Vec<T>) -> ConstraintResult<Self>
+    where
+        T: PartialEq + Send + Sync + fmt::Debug + 'static,
+    {
+        Self::new(initial_value, move |candidate| {
+            if allowed.contains(candidate) {
+                Ok(())
+            } else {
+                Err(ConstraintError::invalid_value(
+                    format!("{candidate:?}"),
+                    format!("{allowed:?}"),
+                ))
+            }
+        })
+    }
+
+    pub fn get(&self) -> &T {
+        &self.value
+    }
+
+    pub fn value(&self) -> T
+    where
+        T: Copy,
+    {
+        self.value
+    }
+
+    pub fn can_set(&self, candidate: &T) -> ConstraintResult<()> {
+        (self.validator)(candidate)
+    }
+
+    pub fn set(&mut self, value: T) -> ConstraintResult<()> {
+        (self.validator)(&value)?;
+        self.value = value;
+        Ok(())
+    }
+}
+
+impl<T> std::ops::Deref for Constrained<T> {
+    type Target = T;
+
+    fn deref(&self) -> &Self::Target {
+        &self.value
+    }
+}
+
+impl<T: fmt::Debug> fmt::Debug for Constrained<T> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Constrained")
+            .field("value", &self.value)
+            .finish()
+    }
+}
+
+impl<T: PartialEq> PartialEq for Constrained<T> {
+    fn eq(&self, other: &Self) -> bool {
+        self.value == other.value
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn constrained_allow_any_accepts_any_value() {
+        let mut constrained = Constrained::allow_any(5);
+        constrained.set(-10).expect("allow any accepts all values");
+        assert_eq!(constrained.value(), -10);
+    }
+
+    #[test]
+    fn constrained_allow_any_default_uses_default_value() {
+        let constrained = Constrained::<i32>::allow_any_from_default();
+        assert_eq!(constrained.value(), 0);
+    }
+
+    #[test]
+    fn constrained_new_rejects_invalid_initial_value() {
+        let result = Constrained::new(0, |value| {
+            if *value > 0 {
+                Ok(())
+            } else {
+                Err(ConstraintError::invalid_value(
+                    value.to_string(),
+                    "positive values",
+                ))
+            }
+        });
+
+        assert_eq!(
+            result,
+            Err(ConstraintError::invalid_value("0", "positive values"))
+        );
+    }
+
+    #[test]
+    fn constrained_set_rejects_invalid_value_and_leaves_previous() {
+        let mut constrained = Constrained::new(1, |value| {
+            if *value > 0 {
+                Ok(())
+            } else {
+                Err(ConstraintError::invalid_value(
+                    value.to_string(),
+                    "positive values",
+                ))
+            }
+        })
+        .expect("initial value should be accepted");
+
+        let err = constrained
+            .set(-5)
+            .expect_err("negative values should be rejected");
+        assert_eq!(err, ConstraintError::invalid_value("-5", "positive values"));
+        assert_eq!(constrained.value(), 1);
+    }
+
+    #[test]
+    fn constrained_can_set_allows_probe_without_setting() {
+        let constrained = Constrained::new(1, |value| {
+            if *value > 0 {
+                Ok(())
+            } else {
+                Err(ConstraintError::invalid_value(
+                    value.to_string(),
+                    "positive values",
+                ))
+            }
+        })
+        .expect("initial value should be accepted");
+
+        constrained
+            .can_set(&2)
+            .expect("can_set should accept positive value");
+        let err = constrained
+            .can_set(&-1)
+            .expect_err("can_set should reject negative value");
+        assert_eq!(err, ConstraintError::invalid_value("-1", "positive values"));
+        assert_eq!(constrained.value(), 1);
+    }
+}
@@ -0,0 +1,58 @@
+use crate::config::Constrained;
+use crate::config::ConstraintError;
+use crate::protocol::AskForApproval;
+use serde::Deserialize;
+
+/// Normalized version of [`ConfigRequirementsToml`] after deserialization and normalization.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct ConfigRequirements {
+    pub(crate) approval_policy: Constrained<AskForApproval>,
+}
+
+impl Default for ConfigRequirements {
+    fn default() -> Self {
+        Self {
+            approval_policy: Constrained::allow_any_from_default(),
+        }
+    }
+}
+
+/// Base config deserialized from /etc/code/requirements.toml or MDM.
+#[derive(Deserialize, Debug, Clone, Default, PartialEq)]
+pub(crate) struct ConfigRequirementsToml {
+    pub allowed_approval_policies: Option<Vec<AskForApproval>>,
+}
+
+impl TryFrom<ConfigRequirementsToml> for ConfigRequirements {
+    type Error = ConstraintError;
+
+    fn try_from(toml: ConfigRequirementsToml) -> Result<Self, Self::Error> {
+        let approval_policy: Constrained<AskForApproval> = match toml.allowed_approval_policies {
+            Some(policies) => {
+                let default_value = AskForApproval::default();
+                if policies.contains(&default_value) {
+                    Constrained::allow_values(default_value, policies)?
+                } else if let Some(first) = policies.first() {
+                    Constrained::allow_values(*first, policies)?
+                } else {
+                    return Err(ConstraintError::empty_field("allowed_approval_policies"));
+                }
+            }
+            None => Constrained::allow_any_from_default(),
+        };
+        Ok(ConfigRequirements { approval_policy })
+    }
+}
+
+/// The legacy mechanism for specifying admin-enforced configuration is to
+/// provide a file like `/etc/code/managed_config.toml` that has the same
+/// structure as `config.toml`, where fields like `approval_policy` specify a
+/// single value rather than a set of allowed values.
+///
+/// When present, this can be treated as a `requirements.toml` where each field
+/// is constrained to its specified value.
+#[derive(Deserialize, Debug, Clone, Default, PartialEq)]
+pub(crate) struct LegacyManagedConfigToml {
+    pub(crate) approval_policy: Option<AskForApproval>,
+}
+
@@ -1,6 +1,10 @@
+mod config_requirements;
 mod macos;

 use crate::config::CONFIG_TOML_FILE;
+use config_requirements::ConfigRequirements;
+use config_requirements::ConfigRequirementsToml;
+use config_requirements::LegacyManagedConfigToml;
 use macos::load_managed_admin_config_layer;
 use std::io;
 use std::path::Path;
@@ -12,6 +16,9 @@ use toml::Value as TomlValue;
 #[cfg(unix)]
 const CODE_MANAGED_CONFIG_SYSTEM_PATH: &str = "/etc/code/managed_config.toml";

+#[cfg(unix)]
+const CODE_REQUIREMENTS_SYSTEM_PATH: &str = "/etc/code/requirements.toml";
+
 #[derive(Debug)]
 pub(crate) struct LoadedConfigLayers {
    pub base: TomlValue,
@@ -22,6 +29,7 @@ pub(crate) struct LoadedConfigLayers {
 #[derive(Debug, Default)]
 pub(crate) struct LoaderOverrides {
    pub managed_config_path: Option<PathBuf>,
+    pub requirements_path: Option<PathBuf>,
    #[cfg(target_os = "macos")]
    pub managed_preferences_base64: Option<String>,
 }
@@ -69,6 +77,14 @@ pub(crate) fn load_config_as_toml_blocking(
    block_on_loader(async move { load_config_as_toml_with_overrides(&code_home, overrides).await })
 }

+pub(crate) fn load_config_requirements_blocking(
+    code_home: &Path,
+    overrides: LoaderOverrides,
+) -> io::Result<ConfigRequirements> {
+    let code_home = code_home.to_path_buf();
+    block_on_loader(async move { load_config_requirements_internal(&code_home, overrides).await })
+}
+
 async fn load_config_as_toml_with_overrides(
    code_home: &Path,
    overrides: LoaderOverrides,
@@ -84,12 +100,14 @@ async fn load_config_layers_internal(
    #[cfg(target_os = "macos")]
    let LoaderOverrides {
        managed_config_path,
+        requirements_path: _,
        managed_preferences_base64,
    } = overrides;

    #[cfg(not(target_os = "macos"))]
    let LoaderOverrides {
        managed_config_path,
+        requirements_path: _,
    } = overrides;

    let managed_config_path =
@@ -113,6 +131,76 @@ async fn load_config_layers_internal(
    })
 }

+async fn load_config_requirements_internal(
+    code_home: &Path,
+    overrides: LoaderOverrides,
+) -> io::Result<ConfigRequirements> {
+    #[cfg(target_os = "macos")]
+    let LoaderOverrides {
+        managed_config_path,
+        requirements_path,
+        managed_preferences_base64,
+    } = overrides;
+
+    #[cfg(not(target_os = "macos"))]
+    let LoaderOverrides {
+        managed_config_path,
+        requirements_path,
+    } = overrides;
+
+    let managed_config_path =
+        managed_config_path.unwrap_or_else(|| managed_config_default_path(code_home));
+    let requirements_path = requirements_path.unwrap_or_else(|| requirements_default_path(code_home));
+
+    let mut requirements = if let Some(value) = read_config_from_path(&requirements_path, false).await? {
+        let parsed: ConfigRequirementsToml =
+            value.try_into().map_err(|err: toml::de::Error| {
+                io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("Failed to parse config requirements TOML: {err}"),
+                )
+            })?;
+        ConfigRequirements::try_from(parsed)
+            .map_err(|err| io::Error::new(io::ErrorKind::InvalidInput, err))?
+    } else {
+        ConfigRequirements::default()
+    };
+
+    let managed_config = read_config_from_path(&managed_config_path, false).await?;
+
+    #[cfg(target_os = "macos")]
+    let managed_preferences =
+        load_managed_admin_config_layer(managed_preferences_base64.as_deref()).await?;
+
+    #[cfg(not(target_os = "macos"))]
+    let managed_preferences = None;
+
+    // If multiple legacy layers specify approval_policy (e.g. both a managed_config
+    // file and macOS managed preferences), allow the later/higher-precedence layer
+    // to override earlier ones.
+    let mut legacy_approval_policy = None;
+
+    for legacy in [managed_config, managed_preferences].into_iter().flatten() {
+        let legacy: LegacyManagedConfigToml = legacy.try_into().map_err(|err: toml::de::Error| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("Failed to parse legacy managed_config TOML: {err}"),
+            )
+        })?;
+
+        if let Some(approval_policy) = legacy.approval_policy {
+            legacy_approval_policy = Some(approval_policy);
+        }
+    }
+
+    if let Some(approval_policy) = legacy_approval_policy {
+        requirements.approval_policy.can_set(&approval_policy)?;
+        requirements.approval_policy = crate::config::Constrained::allow_only(approval_policy);
+    }
+
+    Ok(requirements)
+}
+
 async fn read_config_from_path(
    path: &Path,
    log_missing_as_info: bool,
@@ -170,6 +258,19 @@ fn managed_config_default_path(code_home: &Path) -> PathBuf {
    }
 }

+fn requirements_default_path(code_home: &Path) -> PathBuf {
+    #[cfg(unix)]
+    {
+        let _ = code_home;
+        PathBuf::from(CODE_REQUIREMENTS_SYSTEM_PATH)
+    }
+
+    #[cfg(not(unix))]
+    {
+        code_home.join("requirements.toml")
+    }
+}
+
 fn apply_managed_layers(layers: LoadedConfigLayers) -> TomlValue {
    let LoadedConfigLayers {
        mut base,
@@ -245,6 +346,7 @@ extra = true

        let overrides = LoaderOverrides {
            managed_config_path: Some(managed_path),
+            requirements_path: None,
            #[cfg(target_os = "macos")]
            managed_preferences_base64: None,
        };
@@ -272,6 +374,7 @@ extra = true
        let managed_path = tmp.path().join("managed_config.toml");
        let overrides = LoaderOverrides {
            managed_config_path: Some(managed_path),
+            requirements_path: None,
            #[cfg(target_os = "macos")]
            managed_preferences_base64: None,
        };
@@ -332,6 +435,7 @@ flag = true

        let overrides = LoaderOverrides {
            managed_config_path: Some(managed_path),
+            requirements_path: None,
            managed_preferences_base64: Some(encoded),
        };

@@ -23,6 +23,7 @@ pub mod token_data;
 pub use code_conversation::CodexConversation;
 mod command_safety;
 pub mod config;
+mod config_constraint;
 pub mod config_edit;
 pub mod config_profile;
 pub mod config_types;
@@ -73,6 +74,7 @@ pub mod history;
 mod truncate;
 mod unified_exec;
 mod user_instructions;
+mod skills;
 pub use model_provider_info::BUILT_IN_OSS_MODEL_PROVIDER_ID;
 pub use model_provider_info::ModelProviderInfo;
 pub use model_provider_info::OpenRouterConfig;
@@ -14,6 +14,8 @@
 //! 3.  We do **not** walk past the Git root.

 use crate::config::Config;
+use crate::skills::SkillMetadata;
+use crate::skills::render_skills_section;
 use std::collections::HashSet;
 use std::path::PathBuf;
 use tokio::io::AsyncReadExt;
@@ -31,7 +33,12 @@ const PROJECT_DOC_SEPARATOR: &str = "\n\n--- project-doc ---\n\n";

 /// Combines `Config::instructions` and `AGENTS.md` (if present) into a single
 /// string of instructions.
-pub(crate) async fn get_user_instructions(config: &Config) -> Option<String> {
+pub(crate) async fn get_user_instructions(
+    config: &Config,
+    skills: Option<&[SkillMetadata]>,
+) -> Option<String> {
+    let skills_section = skills.and_then(render_skills_section);
+
    let project_doc_parts = match read_project_doc_parts(config).await {
        Ok(Some(parts)) => parts,
        Ok(None) => Vec::new(),
@@ -63,14 +70,21 @@ pub(crate) async fn get_user_instructions(config: &Config) -> Option<String> {
        }
    }

+    if let Some(skills_section) = skills_section {
+        let key = skills_section.trim();
+        if !key.is_empty() && seen.insert(key.to_string()) {
+            unique_project_docs.push(skills_section);
+        }
+    }
+
    match (base_instructions, unique_project_docs.is_empty()) {
        (None, true) => None,
        (Some(base), true) => Some(base),
        (None, false) => Some(unique_project_docs.join("\n\n")),
-        (Some(base), false) => Some(format!(
-            "{base}{PROJECT_DOC_SEPARATOR}{}",
-            unique_project_docs.join("\n\n")
-        )),
+        (Some(base), false) => {
+            let docs = unique_project_docs.join("\n\n");
+            Some(format!("{base}{PROJECT_DOC_SEPARATOR}{docs}"))
+        }
    }
 }

@@ -284,7 +298,7 @@ mod tests {
    async fn no_doc_file_returns_none() {
        let tmp = tempfile::tempdir().expect("tempdir");

-        let res = get_user_instructions(&make_config(&tmp, 4096, None)).await;
+        let res = get_user_instructions(&make_config(&tmp, 4096, None), None).await;
        assert!(
            res.is_none(),
            "Expected None when AGENTS.md is absent and no system instructions provided"
@@ -298,7 +312,7 @@ mod tests {
        let tmp = tempfile::tempdir().expect("tempdir");
        fs::write(tmp.path().join("AGENTS.md"), "hello world").unwrap();

-        let res = get_user_instructions(&make_config(&tmp, 4096, None))
+        let res = get_user_instructions(&make_config(&tmp, 4096, None), None)
            .await
            .expect("doc expected");

@@ -317,7 +331,7 @@ mod tests {
        let huge = "A".repeat(LIMIT * 2); // 2 KiB
        fs::write(tmp.path().join("AGENTS.md"), &huge).unwrap();

-        let res = get_user_instructions(&make_config(&tmp, LIMIT, None))
+        let res = get_user_instructions(&make_config(&tmp, LIMIT, None), None)
            .await
            .expect("doc expected");

@@ -349,7 +363,7 @@ mod tests {
        let mut cfg = make_config(&repo, 4096, None);
        cfg.cwd = nested;

-        let res = get_user_instructions(&cfg).await.expect("doc expected");
+        let res = get_user_instructions(&cfg, None).await.expect("doc expected");
        assert_eq!(res, "root level doc");
    }

@@ -359,7 +373,7 @@ mod tests {
        let tmp = tempfile::tempdir().expect("tempdir");
        fs::write(tmp.path().join("AGENTS.md"), "something").unwrap();

-        let res = get_user_instructions(&make_config(&tmp, 0, None)).await;
+        let res = get_user_instructions(&make_config(&tmp, 0, None), None).await;
        assert!(
            res.is_none(),
            "With limit 0 the function should return None"
@@ -375,7 +389,7 @@ mod tests {

        const INSTRUCTIONS: &str = "base instructions";

-        let res = get_user_instructions(&make_config(&tmp, 4096, Some(INSTRUCTIONS)))
+        let res = get_user_instructions(&make_config(&tmp, 4096, Some(INSTRUCTIONS)), None)
            .await
            .expect("should produce a combined instruction string");

@@ -391,7 +405,7 @@ mod tests {
        let tmp = tempfile::tempdir().expect("tempdir");
        fs::write(tmp.path().join("AGENTS.md"), "same text").unwrap();

-        let res = get_user_instructions(&make_config(&tmp, 4096, Some("same text")))
+        let res = get_user_instructions(&make_config(&tmp, 4096, Some("same text")), None)
            .await
            .expect("instructions expected");

@@ -415,7 +429,9 @@ mod tests {
        let mut cfg = make_config(&repo, 4096, Some("shared"));
        cfg.cwd = nested;

-        let res = get_user_instructions(&cfg).await.expect("instructions expected");
+        let res = get_user_instructions(&cfg, None)
+            .await
+            .expect("instructions expected");

        assert_eq!(res, format!("shared{PROJECT_DOC_SEPARATOR}{}", "new info"));
    }
@@ -436,7 +452,7 @@ mod tests {
        let mut cfg = make_config(&repo, 4096, None);
        cfg.cwd = nested;

-        let res = get_user_instructions(&cfg).await.expect("doc expected");
+        let res = get_user_instructions(&cfg, None).await.expect("doc expected");
        assert_eq!(res, "root doc");
    }

@@ -448,7 +464,7 @@ mod tests {

        const INSTRUCTIONS: &str = "some instructions";

-        let res = get_user_instructions(&make_config(&tmp, 4096, Some(INSTRUCTIONS))).await;
+        let res = get_user_instructions(&make_config(&tmp, 4096, Some(INSTRUCTIONS)), None).await;

        assert_eq!(res, Some(INSTRUCTIONS.to_string()));
    }
@@ -477,7 +493,7 @@ mod tests {
        let mut cfg = make_config(&repo, 4096, None);
        cfg.cwd = nested;

-        let res = get_user_instructions(&cfg).await.expect("doc expected");
+        let res = get_user_instructions(&cfg, None).await.expect("doc expected");
        assert_eq!(res, "root doc\n\ncrate doc");
    }

@@ -0,0 +1,169 @@
+---
+name: plan
+description: Plan lifecycle management for Codex plans stored in $CODEX_HOME/plans (default ~/.codex/plans). Use when a user asks to create, find, read, update, delete, or manage plan documents for implementation work or overview/reference documentation.
+---
+
+# Plan
+
+## Overview
+
+Create and manage plan documents on disk. Plans stored on disk are markdown files with YAML frontmatter and free-form content. When drafting in chat, output only the plan body without frontmatter; add frontmatter only when stashing to disk. Support both implementation plans and overview/reference plans. Only write to the plans folder; do not modify the repository codebase.
+
+## Core rules
+
+- Resolve the plans directory as `$CODEX_HOME/plans` or `~/.codex/plans` when `CODEX_HOME` is not set.
+- Create the plans directory if it does not exist.
+- Never write to the repo; only read files to understand context.
+- Require frontmatter with **only** `name` and `description` (single-line values) for on-disk plans.
+- When presenting a draft plan in chat, omit frontmatter and start at `# Plan`.
+- Enforce naming rules: short, lower-case, hyphen-delimited; filename must equal `<name>.md`.
+- If a plan is not found, state it clearly and offer to create one.
+- Allow overview-style plans that document flows, architecture, or context without a work checklist.
+
+## Decide the task
+
+1. **Find/list**: discover plans by frontmatter summary; confirm if multiple matches exist.
+2. **Read/use**: validate frontmatter; present summary and full contents.
+3. **Create**: inspect repo read-only; choose plan style (implementation vs overview); draft plan; write to plans directory only.
+4. **Update**: load plan; revise content and/or description; preserve frontmatter keys; overwrite the plan file.
+5. **Delete**: confirm intent, then remove the plan file if asked.
+
+## Plan discovery
+
+- Prefer `scripts/list_plans.py` for quick summaries.
+- Use `scripts/read_plan_frontmatter.py` to validate a specific plan.
+- If name mismatches filename or frontmatter is missing fields, call it out and ask whether to fix.
+
+## Plan creation workflow
+
+1. Read relevant docs and entry points (`README.md`, `docs/`, key modules) to scope requirements.
+2. Identify scope, constraints, and data model/API implications (or capture existing behavior for an overview).
+3. Draft either an ordered implementation plan or a structured overview plan with diagrams/notes as needed.
+4. Immediately output the plan body only (no frontmatter), then ask the user if they want to 1. Make changes, 2. Implement it, 3. Stash it as per plan.
+5. If the user wants to stash it, prepend frontmatter and save the plan under the computed plans directory using `scripts/create_plan.py`.
+
+## Plan update workflow
+
+- Re-read the plan and related code/docs before updating.
+- Keep the plan name stable unless the user explicitly wants a rename.
+- If renaming, update both frontmatter `name` and filename together.
+
+## Scripts (low-freedom helpers)
+
+Create a plan file (body only; frontmatter is written for you). Run from the plan skill directory:
+
+```bash
+python ./scripts/create_plan.py \
+  --name codex-rate-limit-overview \
+  --description "Scope and update plan for Codex rate limiting" \
+  --body-file /tmp/plan-body.md
+```
+
+Read frontmatter summary for a plan (run from the plan skill directory):
+
+```bash
+python ./scripts/read_plan_frontmatter.py ~/.codex/plans/codex-rate-limit-overview.md
+```
+
+List plan summaries (optional filter; run from the plan skill directory):
+
+```bash
+python ./scripts/list_plans.py --query "rate limit"
+```
+
+## Plan file format
+
+Use one of the structures below for the plan body. When drafting, output only the body (no frontmatter). When stashing, prepend this frontmatter:
+
+```markdown
+---
+name: <plan-name>
+description: <1-line summary>
+---
+```
+
+### Implementation plan body template
+
+```markdown
+# Plan
+
+<1-3 sentences: intent, scope, and approach.>
+
+## Requirements
+- <Requirement 1>
+- <Requirement 2>
+
+## Scope
+- In:
+- Out:
+
+## Files and entry points
+- <File/module/entry point 1>
+- <File/module/entry point 2>
+
+## Data model / API changes
+- <If applicable, describe schema or contract changes>
+
+## Action items
+[ ] <Step 1>
+[ ] <Step 2>
+[ ] <Step 3>
+[ ] <Step 4>
+[ ] <Step 5>
+[ ] <Step 6>
+
+## Testing and validation
+- <Tests, commands, or validation steps>
+
+## Risks and edge cases
+- <Risk 1>
+- <Risk 2>
+
+## Open questions
+- <Question 1>
+- <Question 2>
+```
+
+### Overview plan body template
+
+```markdown
+# Plan
+
+<1-3 sentences: intent and scope of the overview.>
+
+## Overview
+<Describe the system, flow, or architecture at a high level.>
+
+## Diagrams
+<Include text or Mermaid diagrams if helpful.>
+
+## Key file references
+- <File/module/entry point 1>
+- <File/module/entry point 2>
+
+## Auth / routing / behavior notes
+- <Capture relevant differences (e.g., auth modes, routing paths).>
+
+## Current status
+- <What is live today vs pending work, if known.>
+
+## Action items
+- None (overview only).
+
+## Testing and validation
+- None (overview only).
+
+## Risks and edge cases
+- None (overview only).
+
+## Open questions
+- None.
+```
+
+## Writing guidance
+
+- Keep action items ordered and concrete; include file/entry-point hints.
+- For overview plans, keep action items minimal and set sections to "None" when not applicable.
+- Always include testing/validation and risks/edge cases in implementation plans.
+- Use open questions only when necessary (max 3).
+- If a section is not applicable, note "None" briefly rather than removing it.
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""Create or overwrite a plan markdown file in $CODEX_HOME/plans."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from plan_utils import get_plans_dir, validate_plan_name
+
+DEFAULT_TEMPLATE = """# Plan
+
+<1-3 sentences: intent, scope, and approach.>
+
+## Requirements
+- <Requirement 1>
+- <Requirement 2>
+
+## Scope
+- In:
+- Out:
+
+## Files and entry points
+- <File/module/entry point 1>
+- <File/module/entry point 2>
+
+## Data model / API changes
+- <If applicable, describe schema or contract changes>
+
+## Action items
+[ ] <Step 1>
+[ ] <Step 2>
+[ ] <Step 3>
+[ ] <Step 4>
+[ ] <Step 5>
+[ ] <Step 6>
+
+## Testing and validation
+- <Tests, commands, or validation steps>
+
+## Risks and edge cases
+- <Risk 1>
+- <Risk 2>
+
+## Open questions
+- <Question 1>
+- <Question 2>
+"""
+
+
+def read_body(args: argparse.Namespace) -> str | None:
+    if args.template:
+        return DEFAULT_TEMPLATE
+    if args.body_file:
+        return Path(args.body_file).read_text(encoding="utf-8")
+    if not sys.stdin.isatty():
+        return sys.stdin.read()
+    return None
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Create a plan file under $CODEX_HOME/plans or ~/.codex/plans."
+    )
+    parser.add_argument("--name", required=True, help="Plan name (lower-case, hyphen-delimited).")
+    parser.add_argument("--description", required=True, help="Short plan description.")
+    parser.add_argument(
+        "--body-file",
+        help="Path to markdown body (without frontmatter). If omitted, read from stdin.",
+    )
+    parser.add_argument(
+        "--template",
+        action="store_true",
+        help="Write a template body instead of reading from stdin or --body-file.",
+    )
+    parser.add_argument(
+        "--overwrite",
+        action="store_true",
+        help="Overwrite the plan file if it already exists.",
+    )
+    args = parser.parse_args()
+
+    name = args.name.strip()
+    description = args.description.strip()
+    validate_plan_name(name)
+    if not description or "\n" in description:
+        raise SystemExit("Description must be a single line.")
+
+    body = read_body(args)
+    if body is None:
+        raise SystemExit("Provide --body-file, stdin, or --template to supply plan content.")
+
+    body = body.strip()
+    if not body:
+        raise SystemExit("Plan body cannot be empty.")
+    if body.lstrip().startswith("---"):
+        raise SystemExit("Plan body should not include frontmatter.")
+
+    plans_dir = get_plans_dir()
+    plans_dir.mkdir(parents=True, exist_ok=True)
+    plan_path = plans_dir / f"{name}.md"
+
+    if plan_path.exists() and not args.overwrite:
+        raise SystemExit(f"Plan already exists: {plan_path}. Use --overwrite to replace.")
+
+    content = f"---\nname: {name}\ndescription: {description}\n---\n\n{body}\n"
+    plan_path.write_text(content, encoding="utf-8")
+    print(str(plan_path))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""List plan summaries by reading frontmatter only."""
+
+from __future__ import annotations
+
+import argparse
+import json
+
+from plan_utils import get_plans_dir, parse_frontmatter
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="List plan summaries from $CODEX_HOME/plans.")
+    parser.add_argument("--query", help="Case-insensitive substring to filter name/description.")
+    parser.add_argument("--json", action="store_true", help="Emit JSON output.")
+    args = parser.parse_args()
+
+    plans_dir = get_plans_dir()
+    if not plans_dir.exists():
+        raise SystemExit(f"Plans directory not found: {plans_dir}")
+
+    query = args.query.lower() if args.query else None
+    items = []
+    for path in sorted(plans_dir.glob("*.md")):
+        try:
+            data = parse_frontmatter(path)
+        except ValueError:
+            continue
+        name = data.get("name")
+        description = data.get("description")
+        if not name or not description:
+            continue
+        if query:
+            haystack = f"{name} {description}".lower()
+            if query not in haystack:
+                continue
+        items.append({"name": name, "description": description, "path": str(path)})
+
+    if args.json:
+        print(json.dumps(items))
+    else:
+        for item in items:
+            print(f"{item['name']}\t{item['description']}\t{item['path']}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Shared helpers for plan scripts."""
+
+from __future__ import annotations
+
+import os
+import re
+from pathlib import Path
+
+_NAME_RE = re.compile(r"^[a-z0-9]+(-[a-z0-9]+)*$")
+
+
+def get_codex_home() -> Path:
+    """Return CODEX_HOME if set, else ~/.codex."""
+    return Path(os.environ.get("CODEX_HOME", "~/.codex")).expanduser()
+
+
+def get_plans_dir() -> Path:
+    return get_codex_home() / "plans"
+
+
+def validate_plan_name(name: str) -> None:
+    if not name or not _NAME_RE.match(name):
+        raise ValueError(
+            "Invalid plan name. Use short, lower-case, hyphen-delimited names "
+            "(e.g., codex-rate-limit-overview)."
+        )
+
+
+def parse_frontmatter(path: Path) -> dict:
+    """Parse YAML frontmatter from a markdown file without reading the body."""
+    with path.open("r", encoding="utf-8") as handle:
+        first = handle.readline()
+        if first.strip() != "---":
+            raise ValueError("Frontmatter must start with '---'.")
+
+        data: dict[str, str] = {}
+        for line in handle:
+            stripped = line.strip()
+            if stripped == "---":
+                return data
+            if not stripped or stripped.startswith("#"):
+                continue
+            if ":" not in line:
+                raise ValueError(f"Invalid frontmatter line: {line.rstrip()}")
+            key, value = line.split(":", 1)
+            key = key.strip()
+            value = value.strip()
+            if value and len(value) >= 2 and value[0] == value[-1] and value[0] in ('"', "'"):
+                value = value[1:-1]
+            data[key] = value
+
+    raise ValueError("Frontmatter must end with '---'.")
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""Read plan frontmatter without loading the full markdown body."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+from plan_utils import parse_frontmatter
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Read name/description from plan frontmatter.")
+    parser.add_argument("plan_path", help="Path to the plan markdown file.")
+    parser.add_argument("--json", action="store_true", help="Emit JSON output.")
+    args = parser.parse_args()
+
+    path = Path(args.plan_path).expanduser()
+    if not path.exists():
+        raise SystemExit(f"Plan not found: {path}")
+
+    data = parse_frontmatter(path)
+    name = data.get("name")
+    description = data.get("description")
+    if not name or not description:
+        raise SystemExit("Frontmatter must include name and description.")
+
+    payload = {"name": name, "description": description, "path": str(path)}
+    if args.json:
+        print(json.dumps(payload))
+    else:
+        print(f"name: {name}")
+        print(f"description: {description}")
+        print(f"path: {path}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,362 @@
+---
+name: Skill Creator
+description: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations.
+---
+
+# Skill Creator
+
+This skill provides guidance for creating effective skills.
+
+## About Skills
+
+Skills are modular, self-contained packages that extend Codex's capabilities by providing
+specialized knowledge, workflows, and tools. Think of them as "onboarding guides" for specific
+domains or tasks—they transform Codex from a general-purpose agent into a specialized agent
+equipped with procedural knowledge that no model can fully possess.
+
+### What Skills Provide
+
+1. Specialized workflows - Multi-step procedures for specific domains
+2. Tool integrations - Instructions for working with specific file formats or APIs
+3. Domain expertise - Company-specific knowledge, schemas, business logic
+4. Bundled resources - Scripts, references, and assets for complex and repetitive tasks
+
+## Core Principles
+
+### Concise is Key
+
+The context window is a public good. Skills share the context window with everything else Codex needs: system prompt, conversation history, other Skills' metadata, and the actual user request.
+
+**Default assumption: Codex is already very smart.** Only add context Codex doesn't already have. Challenge each piece of information: "Does Codex really need this explanation?" and "Does this paragraph justify its token cost?"
+
+Prefer concise examples over verbose explanations.
+
+### Set Appropriate Degrees of Freedom
+
+Match the level of specificity to the task's fragility and variability:
+
+**High freedom (text-based instructions)**: Use when multiple approaches are valid, decisions depend on context, or heuristics guide the approach.
+
+**Medium freedom (pseudocode or scripts with parameters)**: Use when a preferred pattern exists, some variation is acceptable, or configuration affects behavior.
+
+**Low freedom (specific scripts, few parameters)**: Use when operations are fragile and error-prone, consistency is critical, or a specific sequence must be followed.
+
+Think of Codex as exploring a path: a narrow bridge with cliffs needs specific guardrails (low freedom), while an open field allows many routes (high freedom).
+
+### Anatomy of a Skill
+
+Every skill consists of a required SKILL.md file and optional bundled resources:
+
+```
+skill-name/
+├── SKILL.md (required)
+│   ├── YAML frontmatter metadata (required)
+│   │   ├── name: (required)
+│   │   └── description: (required)
+│   └── Markdown instructions (required)
+└── Bundled Resources (optional)
+    ├── scripts/          - Executable code (Python/Bash/etc.)
+    ├── references/       - Documentation intended to be loaded into context as needed
+    └── assets/           - Files used in output (templates, icons, fonts, etc.)
+```
+
+#### SKILL.md (required)
+
+Every SKILL.md consists of:
+
+- **Frontmatter** (YAML): Contains `name` and `description` fields. These are the only fields that Codex reads to determine when the skill gets used, thus it is very important to be clear and comprehensive in describing what the skill is, and when it should be used.
+- **Body** (Markdown): Instructions and guidance for using the skill. Only loaded AFTER the skill triggers (if at all).
+
+#### Bundled Resources (optional)
+
+##### Scripts (`scripts/`)
+
+Executable code (Python/Bash/etc.) for tasks that require deterministic reliability or are repeatedly rewritten.
+
+- **When to include**: When the same code is being rewritten repeatedly or deterministic reliability is needed
+- **Example**: `scripts/rotate_pdf.py` for PDF rotation tasks
+- **Benefits**: Token efficient, deterministic, may be executed without loading into context
+- **Note**: Scripts may still need to be read by Codex for patching or environment-specific adjustments
+
+##### References (`references/`)
+
+Documentation and reference material intended to be loaded as needed into context to inform Codex's process and thinking.
+
+- **When to include**: For documentation that Codex should reference while working
+- **Examples**: `references/finance.md` for financial schemas, `references/mnda.md` for company NDA template, `references/policies.md` for company policies, `references/api_docs.md` for API specifications
+- **Use cases**: Database schemas, API documentation, domain knowledge, company policies, detailed workflow guides
+- **Benefits**: Keeps SKILL.md lean, loaded only when Codex determines it's needed
+- **Best practice**: If files are large (>10k words), include grep search patterns in SKILL.md
+- **Avoid duplication**: Information should live in either SKILL.md or references files, not both. Prefer references files for detailed information unless it's truly core to the skill—this keeps SKILL.md lean while making information discoverable without hogging the context window. Keep only essential procedural instructions and workflow guidance in SKILL.md; move detailed reference material, schemas, and examples to references files.
+
+##### Assets (`assets/`)
+
+Files not intended to be loaded into context, but rather used within the output Codex produces.
+
+- **When to include**: When the skill needs files that will be used in the final output
+- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate, `assets/font.ttf` for typography
+- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample documents that get copied or modified
+- **Benefits**: Separates output resources from documentation, enables Codex to use files without loading them into context
+
+#### What to Not Include in a Skill
+
+A skill should only contain essential files that directly support its functionality. Do NOT create extraneous documentation or auxiliary files, including:
+
+- README.md
+- INSTALLATION_GUIDE.md
+- QUICK_REFERENCE.md
+- CHANGELOG.md
+- etc.
+
+The skill should only contain the information needed for an AI agent to do the job at hand. It should not contain auxiliary context about the process that went into creating it, setup and testing procedures, user-facing documentation, etc. Creating additional documentation files just adds clutter and confusion.
+
+### Progressive Disclosure Design Principle
+
+Skills use a three-level loading system to manage context efficiently:
+
+1. **Metadata (name + description)** - Always in context (~100 words)
+2. **SKILL.md body** - When skill triggers (<5k words)
+3. **Bundled resources** - As needed by Codex (Unlimited because scripts can be executed without reading into context window)
+
+#### Progressive Disclosure Patterns
+
+Keep SKILL.md body to the essentials and under 500 lines to minimize context bloat. Split content into separate files when approaching this limit. When splitting out content into other files, it is very important to reference them from SKILL.md and describe clearly when to read them, to ensure the reader of the skill knows they exist and when to use them.
+
+**Key principle:** When a skill supports multiple variations, frameworks, or options, keep only the core workflow and selection guidance in SKILL.md. Move variant-specific details (patterns, examples, configuration) into separate reference files.
+
+**Pattern 1: High-level guide with references**
+
+```markdown
+# PDF Processing
+
+## Quick start
+
+Extract text with pdfplumber:
+[code example]
+
+## Advanced features
+
+- **Form filling**: See [FORMS.md](FORMS.md) for complete guide
+- **API reference**: See [REFERENCE.md](REFERENCE.md) for all methods
+- **Examples**: See [EXAMPLES.md](EXAMPLES.md) for common patterns
+```
+
+Codex loads FORMS.md, REFERENCE.md, or EXAMPLES.md only when needed.
+
+**Pattern 2: Domain-specific organization**
+
+For Skills with multiple domains, organize content by domain to avoid loading irrelevant context:
+
+```
+bigquery-skill/
+├── SKILL.md (overview and navigation)
+└── reference/
+    ├── finance.md (revenue, billing metrics)
+    ├── sales.md (opportunities, pipeline)
+    ├── product.md (API usage, features)
+    └── marketing.md (campaigns, attribution)
+```
+
+When a user asks about sales metrics, Codex only reads sales.md.
+
+Similarly, for skills supporting multiple frameworks or variants, organize by variant:
+
+```
+cloud-deploy/
+├── SKILL.md (workflow + provider selection)
+└── references/
+    ├── aws.md (AWS deployment patterns)
+    ├── gcp.md (GCP deployment patterns)
+    └── azure.md (Azure deployment patterns)
+```
+
+When the user chooses AWS, Codex only reads aws.md.
+
+**Pattern 3: Conditional details**
+
+Show basic content, link to advanced content:
+
+```markdown
+# DOCX Processing
+
+## Creating documents
+
+Use docx-js for new documents. See [DOCX-JS.md](DOCX-JS.md).
+
+## Editing documents
+
+For simple edits, modify the XML directly.
+
+**For tracked changes**: See [REDLINING.md](REDLINING.md)
+**For OOXML details**: See [OOXML.md](OOXML.md)
+```
+
+Codex reads REDLINING.md or OOXML.md only when the user needs those features.
+
+**Important guidelines:**
+
+- **Avoid deeply nested references** - Keep references one level deep from SKILL.md. All reference files should link directly from SKILL.md.
+- **Structure longer reference files** - For files longer than 100 lines, include a table of contents at the top so Codex can see the full scope when previewing.
+
+## Skill Creation Process
+
+Skill creation involves these steps:
+
+1. Understand the skill with concrete examples
+2. Plan reusable skill contents (scripts, references, assets)
+3. Initialize the skill (run init_skill.py)
+4. Edit the skill (implement resources and write SKILL.md)
+5. Package the skill (run package_skill.py)
+6. Iterate based on real usage
+
+Follow these steps in order, skipping only if there is a clear reason why they are not applicable.
+
+### Skill Naming
+
+- Use lowercase letters, digits, and hyphens only; normalize user-provided titles to hyphen-case (e.g., "Plan Mode" -> `plan-mode`).
+- Prefer short, verb-led phrases that describe the action.
+- Namespace by tool when it improves clarity or triggering (e.g., `gh-address-comments`, `linear-address-issue`).
+- Name the skill folder exactly after the skill name.
+
+### Step 1: Understanding the Skill with Concrete Examples
+
+Skip this step only when the skill's usage patterns are already clearly understood. It remains valuable even when working with an existing skill.
+
+To create an effective skill, clearly understand concrete examples of how the skill will be used. This understanding can come from either direct user examples or generated examples that are validated with user feedback.
+
+For example, when building an image-editor skill, relevant questions include:
+
+- "What functionality should the image-editor skill support? Editing, rotating, anything else?"
+- "Can you give some examples of how this skill would be used?"
+- "I can imagine users asking for things like 'Remove the red-eye from this image' or 'Rotate this image'. Are there other ways you imagine this skill being used?"
+- "What would a user say that should trigger this skill?"
+
+To avoid overwhelming users, avoid asking too many questions in a single message. Start with the most important questions and follow up as needed for better effectiveness.
+
+Conclude this step when there is a clear sense of the functionality the skill should support.
+
+### Step 2: Planning the Reusable Skill Contents
+
+To turn concrete examples into an effective skill, analyze each example by:
+
+1. Considering how to execute on the example from scratch
+2. Identifying what scripts, references, and assets would be helpful when executing these workflows repeatedly
+
+Example: When building a `pdf-editor` skill to handle queries like "Help me rotate this PDF," the analysis shows:
+
+1. Rotating a PDF requires re-writing the same code each time
+2. A `scripts/rotate_pdf.py` script would be helpful to store in the skill
+
+Example: When designing a `frontend-webapp-builder` skill for queries like "Build me a todo app" or "Build me a dashboard to track my steps," the analysis shows:
+
+1. Writing a frontend webapp requires the same boilerplate HTML/React each time
+2. An `assets/hello-world/` template containing the boilerplate HTML/React project files would be helpful to store in the skill
+
+Example: When building a `big-query` skill to handle queries like "How many users have logged in today?" the analysis shows:
+
+1. Querying BigQuery requires re-discovering the table schemas and relationships each time
+2. A `references/schema.md` file documenting the table schemas would be helpful to store in the skill
+
+To establish the skill's contents, analyze each concrete example to create a list of the reusable resources to include: scripts, references, and assets.
+
+### Step 3: Initializing the Skill
+
+At this point, it is time to actually create the skill.
+
+Skip this step only if the skill being developed already exists, and iteration or packaging is needed. In this case, continue to the next step.
+
+When creating a new skill from scratch, always run the `init_skill.py` script. The script conveniently generates a new template skill directory that automatically includes everything a skill requires, making the skill creation process much more efficient and reliable.
+
+Usage:
+
+```bash
+scripts/init_skill.py <skill-name> --path <output-directory>
+```
+
+The script:
+
+- Creates the skill directory at the specified path
+- Generates a SKILL.md template with proper frontmatter and TODO placeholders
+- Creates example resource directories: `scripts/`, `references/`, and `assets/`
+- Adds example files in each directory that can be customized or deleted
+
+After initialization, customize or remove the generated SKILL.md and example files as needed.
+
+### Step 4: Edit the Skill
+
+When editing the (newly-generated or existing) skill, remember that the skill is being created for another instance of Codex to use. Include information that would be beneficial and non-obvious to Codex. Consider what procedural knowledge, domain-specific details, or reusable assets would help another Codex instance execute these tasks more effectively.
+
+#### Learn Proven Design Patterns
+
+Consult these helpful guides based on your skill's needs:
+
+- **Multi-step processes**: See references/workflows.md for sequential workflows and conditional logic
+- **Specific output formats or quality standards**: See references/output-patterns.md for template and example patterns
+
+These files contain established best practices for effective skill design.
+
+#### Start with Reusable Skill Contents
+
+To begin implementation, start with the reusable resources identified above: `scripts/`, `references/`, and `assets/` files. Note that this step may require user input. For example, when implementing a `brand-guidelines` skill, the user may need to provide brand assets or templates to store in `assets/`, or documentation to store in `references/`.
+
+Added scripts must be tested by actually running them to ensure there are no bugs and that the output matches what is expected. If there are many similar scripts, only a representative sample needs to be tested to ensure confidence that they all work while balancing time to completion.
+
+Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.
+
+#### Update SKILL.md
+
+**Writing Guidelines:** Always use imperative/infinitive form.
+
+##### Frontmatter
+
+Write the YAML frontmatter with `name` and `description`:
+
+- `name`: The skill name
+- `description`: This is the primary triggering mechanism for your skill, and helps Codex understand when to use the skill.
+  - Include both what the Skill does and specific triggers/contexts for when to use it.
+  - Include all "when to use" information here - Not in the body. The body is only loaded after triggering, so "When to Use This Skill" sections in the body are not helpful to Codex.
+  - Example description for a `docx` skill: "Comprehensive document creation, editing, and analysis with support for tracked changes, comments, formatting preservation, and text extraction. Use when Codex needs to work with professional documents (.docx files) for: (1) Creating new documents, (2) Modifying or editing content, (3) Working with tracked changes, (4) Adding comments, or any other document tasks"
+
+Do not include any other fields in YAML frontmatter.
+
+##### Body
+
+Write instructions for using the skill and its bundled resources.
+
+### Step 5: Packaging a Skill
+
+Once development of the skill is complete, it must be packaged into a distributable .skill file that gets shared with the user. The packaging process automatically validates the skill first to ensure it meets all requirements:
+
+```bash
+scripts/package_skill.py <path/to/skill-folder>
+```
+
+Optional output directory specification:
+
+```bash
+scripts/package_skill.py <path/to/skill-folder> ./dist
+```
+
+The packaging script will:
+
+1. **Validate** the skill automatically, checking:
+
+   - YAML frontmatter format and required fields
+   - Skill naming conventions and directory structure
+   - Description completeness and quality
+   - File organization and resource references
+
+2. **Package** the skill if validation passes, creating a .skill file named after the skill (e.g., `my-skill.skill`) that includes all files and maintains the proper directory structure for distribution. The .skill file is a zip file with a .skill extension.
+
+If validation fails, the script will report the errors and exit without creating a package. Fix any validation errors and run the packaging command again.
+
+### Step 6: Iterate
+
+After testing the skill, users may request improvements. Often this happens right after using the skill, with fresh context of how the skill performed.
+
+**Iteration workflow:**
+
+1. Use the skill on real tasks
+2. Notice struggles or inefficiencies
+3. Identify how SKILL.md or bundled resources should be updated
+4. Implement changes and test again
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -0,0 +1,327 @@
+#!/usr/bin/env python3
+"""
+Skill Initializer - Creates a new skill from template
+
+Usage:
+    init_skill.py <skill-name> --path <path>
+
+Examples:
+    init_skill.py my-new-skill --path skills/public
+    init_skill.py my-api-helper --path skills/private
+    init_skill.py custom-skill --path /custom/location
+"""
+
+import re
+import sys
+from pathlib import Path
+
+MAX_SKILL_NAME_LENGTH = 64
+
+SKILL_TEMPLATE = """---
+name: {skill_name}
+description: [TODO: Complete and informative explanation of what the skill does and when to use it. Include WHEN to use this skill - specific scenarios, file types, or tasks that trigger it.]
+---
+
+# {skill_title}
+
+## Overview
+
+[TODO: 1-2 sentences explaining what this skill enables]
+
+## Structuring This Skill
+
+[TODO: Choose the structure that best fits this skill's purpose. Common patterns:
+
+**1. Workflow-Based** (best for sequential processes)
+- Works well when there are clear step-by-step procedures
+- Example: DOCX skill with "Workflow Decision Tree" → "Reading" → "Creating" → "Editing"
+- Structure: ## Overview → ## Workflow Decision Tree → ## Step 1 → ## Step 2...
+
+**2. Task-Based** (best for tool collections)
+- Works well when the skill offers different operations/capabilities
+- Example: PDF skill with "Quick Start" → "Merge PDFs" → "Split PDFs" → "Extract Text"
+- Structure: ## Overview → ## Quick Start → ## Task Category 1 → ## Task Category 2...
+
+**3. Reference/Guidelines** (best for standards or specifications)
+- Works well for brand guidelines, coding standards, or requirements
+- Example: Brand styling with "Brand Guidelines" → "Colors" → "Typography" → "Features"
+- Structure: ## Overview → ## Guidelines → ## Specifications → ## Usage...
+
+**4. Capabilities-Based** (best for integrated systems)
+- Works well when the skill provides multiple interrelated features
+- Example: Product Management with "Core Capabilities" → numbered capability list
+- Structure: ## Overview → ## Core Capabilities → ### 1. Feature → ### 2. Feature...
+
+Patterns can be mixed and matched as needed. Most skills combine patterns (e.g., start with task-based, add workflow for complex operations).
+
+Delete this entire "Structuring This Skill" section when done - it's just guidance.]
+
+## [TODO: Replace with the first main section based on chosen structure]
+
+[TODO: Add content here. See examples in existing skills:
+- Code samples for technical skills
+- Decision trees for complex workflows
+- Concrete examples with realistic user requests
+- References to scripts/templates/references as needed]
+
+## Resources
+
+This skill includes example resource directories that demonstrate how to organize different types of bundled resources:
+
+### scripts/
+Executable code (Python/Bash/etc.) that can be run directly to perform specific operations.
+
+**Examples from other skills:**
+- PDF skill: `fill_fillable_fields.py`, `extract_form_field_info.py` - utilities for PDF manipulation
+- DOCX skill: `document.py`, `utilities.py` - Python modules for document processing
+
+**Appropriate for:** Python scripts, shell scripts, or any executable code that performs automation, data processing, or specific operations.
+
+**Note:** Scripts may be executed without loading into context, but can still be read by Codex for patching or environment adjustments.
+
+### references/
+Documentation and reference material intended to be loaded into context to inform Codex's process and thinking.
+
+**Examples from other skills:**
+- Product management: `communication.md`, `context_building.md` - detailed workflow guides
+- BigQuery: API reference documentation and query examples
+- Finance: Schema documentation, company policies
+
+**Appropriate for:** In-depth documentation, API references, database schemas, comprehensive guides, or any detailed information that Codex should reference while working.
+
+### assets/
+Files not intended to be loaded into context, but rather used within the output Codex produces.
+
+**Examples from other skills:**
+- Brand styling: PowerPoint template files (.pptx), logo files
+- Frontend builder: HTML/React boilerplate project directories
+- Typography: Font files (.ttf, .woff2)
+
+**Appropriate for:** Templates, boilerplate code, document templates, images, icons, fonts, or any files meant to be copied or used in the final output.
+
+---
+
+**Any unneeded directories can be deleted.** Not every skill requires all three types of resources.
+"""
+
+EXAMPLE_SCRIPT = '''#!/usr/bin/env python3
+"""
+Example helper script for {skill_name}
+
+This is a placeholder script that can be executed directly.
+Replace with actual implementation or delete if not needed.
+
+Example real scripts from other skills:
+- pdf/scripts/fill_fillable_fields.py - Fills PDF form fields
+- pdf/scripts/convert_pdf_to_images.py - Converts PDF pages to images
+"""
+
+def main():
+    print("This is an example script for {skill_name}")
+    # TODO: Add actual script logic here
+    # This could be data processing, file conversion, API calls, etc.
+
+if __name__ == "__main__":
+    main()
+'''
+
+EXAMPLE_REFERENCE = """# Reference Documentation for {skill_title}
+
+This is a placeholder for detailed reference documentation.
+Replace with actual reference content or delete if not needed.
+
+Example real reference docs from other skills:
+- product-management/references/communication.md - Comprehensive guide for status updates
+- product-management/references/context_building.md - Deep-dive on gathering context
+- bigquery/references/ - API references and query examples
+
+## When Reference Docs Are Useful
+
+Reference docs are ideal for:
+- Comprehensive API documentation
+- Detailed workflow guides
+- Complex multi-step processes
+- Information too lengthy for main SKILL.md
+- Content that's only needed for specific use cases
+
+## Structure Suggestions
+
+### API Reference Example
+- Overview
+- Authentication
+- Endpoints with examples
+- Error codes
+- Rate limits
+
+### Workflow Guide Example
+- Prerequisites
+- Step-by-step instructions
+- Common patterns
+- Troubleshooting
+- Best practices
+"""
+
+EXAMPLE_ASSET = """# Example Asset File
+
+This placeholder represents where asset files would be stored.
+Replace with actual asset files (templates, images, fonts, etc.) or delete if not needed.
+
+Asset files are NOT intended to be loaded into context, but rather used within
+the output Codex produces.
+
+Example asset files from other skills:
+- Brand guidelines: logo.png, slides_template.pptx
+- Frontend builder: hello-world/ directory with HTML/React boilerplate
+- Typography: custom-font.ttf, font-family.woff2
+- Data: sample_data.csv, test_dataset.json
+
+## Common Asset Types
+
+- Templates: .pptx, .docx, boilerplate directories
+- Images: .png, .jpg, .svg, .gif
+- Fonts: .ttf, .otf, .woff, .woff2
+- Boilerplate code: Project directories, starter files
+- Icons: .ico, .svg
+- Data files: .csv, .json, .xml, .yaml
+
+Note: This is a text placeholder. Actual assets can be any file type.
+"""
+
+
+def normalize_skill_name(skill_name):
+    """Normalize a skill name to lowercase hyphen-case."""
+    normalized = skill_name.strip().lower()
+    normalized = re.sub(r"[^a-z0-9]+", "-", normalized)
+    normalized = normalized.strip("-")
+    normalized = re.sub(r"-{2,}", "-", normalized)
+    return normalized
+
+
+def title_case_skill_name(skill_name):
+    """Convert hyphenated skill name to Title Case for display."""
+    return " ".join(word.capitalize() for word in skill_name.split("-"))
+
+
+def init_skill(skill_name, path):
+    """
+    Initialize a new skill directory with template SKILL.md.
+
+    Args:
+        skill_name: Name of the skill
+        path: Path where the skill directory should be created
+
+    Returns:
+        Path to created skill directory, or None if error
+    """
+    # Determine skill directory path
+    skill_dir = Path(path).resolve() / skill_name
+
+    # Check if directory already exists
+    if skill_dir.exists():
+        print(f"❌ Error: Skill directory already exists: {skill_dir}")
+        return None
+
+    # Create skill directory
+    try:
+        skill_dir.mkdir(parents=True, exist_ok=False)
+        print(f"✅ Created skill directory: {skill_dir}")
+    except Exception as e:
+        print(f"❌ Error creating directory: {e}")
+        return None
+
+    # Create SKILL.md from template
+    skill_title = title_case_skill_name(skill_name)
+    skill_content = SKILL_TEMPLATE.format(skill_name=skill_name, skill_title=skill_title)
+
+    skill_md_path = skill_dir / "SKILL.md"
+    try:
+        skill_md_path.write_text(skill_content)
+        print("✅ Created SKILL.md")
+    except Exception as e:
+        print(f"❌ Error creating SKILL.md: {e}")
+        return None
+
+    # Create resource directories with example files
+    try:
+        # Create scripts/ directory with example script
+        scripts_dir = skill_dir / "scripts"
+        scripts_dir.mkdir(exist_ok=True)
+        example_script = scripts_dir / "example.py"
+        example_script.write_text(EXAMPLE_SCRIPT.format(skill_name=skill_name))
+        example_script.chmod(0o755)
+        print("✅ Created scripts/example.py")
+
+        # Create references/ directory with example reference doc
+        references_dir = skill_dir / "references"
+        references_dir.mkdir(exist_ok=True)
+        example_reference = references_dir / "api_reference.md"
+        example_reference.write_text(EXAMPLE_REFERENCE.format(skill_title=skill_title))
+        print("✅ Created references/api_reference.md")
+
+        # Create assets/ directory with example asset placeholder
+        assets_dir = skill_dir / "assets"
+        assets_dir.mkdir(exist_ok=True)
+        example_asset = assets_dir / "example_asset.txt"
+        example_asset.write_text(EXAMPLE_ASSET)
+        print("✅ Created assets/example_asset.txt")
+    except Exception as e:
+        print(f"❌ Error creating resource directories: {e}")
+        return None
+
+    # Print next steps
+    print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}")
+    print("\nNext steps:")
+    print("1. Edit SKILL.md to complete the TODO items and update the description")
+    print("2. Customize or delete the example files in scripts/, references/, and assets/")
+    print("3. Run the validator when ready to check the skill structure")
+
+    return skill_dir
+
+
+def main():
+    if len(sys.argv) < 4 or sys.argv[2] != "--path":
+        print("Usage: init_skill.py <skill-name> --path <path>")
+        print("\nSkill name requirements:")
+        print("  - Use a hyphen-case identifier (e.g., 'data-analyzer')")
+        print(
+            "  - Input is normalized to lowercase letters, digits, and hyphens only "
+            "(e.g., 'Plan Mode' -> 'plan-mode')"
+        )
+        print(f"  - Max {MAX_SKILL_NAME_LENGTH} characters after normalization")
+        print("  - Directory name matches the normalized skill name")
+        print("\nExamples:")
+        print("  init_skill.py my-new-skill --path skills/public")
+        print("  init_skill.py my-api-helper --path skills/private")
+        print("  init_skill.py custom-skill --path /custom/location")
+        sys.exit(1)
+
+    raw_skill_name = sys.argv[1]
+    skill_name = normalize_skill_name(raw_skill_name)
+    if not skill_name:
+        print("❌ Error: Skill name must include at least one letter or digit.")
+        sys.exit(1)
+    if len(skill_name) > MAX_SKILL_NAME_LENGTH:
+        print(
+            f"❌ Error: Skill name '{skill_name}' is too long ({len(skill_name)} characters). "
+            f"Maximum is {MAX_SKILL_NAME_LENGTH} characters."
+        )
+        sys.exit(1)
+    if skill_name != raw_skill_name:
+        print(f"Note: Normalized skill name from '{raw_skill_name}' to '{skill_name}'.")
+
+    path = sys.argv[3]
+
+    print(f"🚀 Initializing skill: {skill_name}")
+    print(f"   Location: {path}")
+    print()
+
+    result = init_skill(skill_name, path)
+
+    if result:
+        sys.exit(0)
+    else:
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""
+Skill Packager - Creates a distributable .skill file of a skill folder
+
+Usage:
+    python utils/package_skill.py <path/to/skill-folder> [output-directory]
+
+Example:
+    python utils/package_skill.py skills/public/my-skill
+    python utils/package_skill.py skills/public/my-skill ./dist
+"""
+
+import sys
+import zipfile
+from pathlib import Path
+
+from quick_validate import validate_skill
+
+
+def package_skill(skill_path, output_dir=None):
+    """
+    Package a skill folder into a .skill file.
+
+    Args:
+        skill_path: Path to the skill folder
+        output_dir: Optional output directory for the .skill file (defaults to current directory)
+
+    Returns:
+        Path to the created .skill file, or None if error
+    """
+    skill_path = Path(skill_path).resolve()
+
+    # Validate skill folder exists
+    if not skill_path.exists():
+        print(f"❌ Error: Skill folder not found: {skill_path}")
+        return None
+
+    if not skill_path.is_dir():
+        print(f"❌ Error: Path is not a directory: {skill_path}")
+        return None
+
+    # Validate SKILL.md exists
+    skill_md = skill_path / "SKILL.md"
+    if not skill_md.exists():
+        print(f"❌ Error: SKILL.md not found in {skill_path}")
+        return None
+
+    # Run validation before packaging
+    print("🔍 Validating skill...")
+    valid, message = validate_skill(skill_path)
+    if not valid:
+        print(f"❌ Validation failed: {message}")
+        print("   Please fix the validation errors before packaging.")
+        return None
+    print(f"✅ {message}\n")
+
+    # Determine output location
+    skill_name = skill_path.name
+    if output_dir:
+        output_path = Path(output_dir).resolve()
+        output_path.mkdir(parents=True, exist_ok=True)
+    else:
+        output_path = Path.cwd()
+
+    skill_filename = output_path / f"{skill_name}.skill"
+
+    # Create the .skill file (zip format)
+    try:
+        with zipfile.ZipFile(skill_filename, "w", zipfile.ZIP_DEFLATED) as zipf:
+            # Walk through the skill directory
+            for file_path in skill_path.rglob("*"):
+                if file_path.is_file():
+                    # Calculate the relative path within the zip
+                    arcname = file_path.relative_to(skill_path.parent)
+                    zipf.write(file_path, arcname)
+                    print(f"  Added: {arcname}")
+
+        print(f"\n✅ Successfully packaged skill to: {skill_filename}")
+        return skill_filename
+
+    except Exception as e:
+        print(f"❌ Error creating .skill file: {e}")
+        return None
+
+
+def main():
+    if len(sys.argv) < 2:
+        print("Usage: python utils/package_skill.py <path/to/skill-folder> [output-directory]")
+        print("\nExample:")
+        print("  python utils/package_skill.py skills/public/my-skill")
+        print("  python utils/package_skill.py skills/public/my-skill ./dist")
+        sys.exit(1)
+
+    skill_path = sys.argv[1]
+    output_dir = sys.argv[2] if len(sys.argv) > 2 else None
+
+    print(f"📦 Packaging skill: {skill_path}")
+    if output_dir:
+        print(f"   Output directory: {output_dir}")
+    print()
+
+    result = package_skill(skill_path, output_dir)
+
+    if result:
+        sys.exit(0)
+    else:
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""
+Quick validation script for skills - minimal version
+"""
+
+import re
+import sys
+from pathlib import Path
+
+import yaml
+
+
+def validate_skill(skill_path):
+    """Basic validation of a skill"""
+    skill_path = Path(skill_path)
+
+    skill_md = skill_path / "SKILL.md"
+    if not skill_md.exists():
+        return False, "SKILL.md not found"
+
+    content = skill_md.read_text()
+    if not content.startswith("---"):
+        return False, "No YAML frontmatter found"
+
+    match = re.match(r"^---\n(.*?)\n---", content, re.DOTALL)
+    if not match:
+        return False, "Invalid frontmatter format"
+
+    frontmatter_text = match.group(1)
+
+    try:
+        frontmatter = yaml.safe_load(frontmatter_text)
+        if not isinstance(frontmatter, dict):
+            return False, "Frontmatter must be a YAML dictionary"
+    except yaml.YAMLError as e:
+        return False, f"Invalid YAML in frontmatter: {e}"
+
+    allowed_properties = {"name", "description", "license", "allowed-tools", "metadata"}
+
+    unexpected_keys = set(frontmatter.keys()) - allowed_properties
+    if unexpected_keys:
+        allowed = ", ".join(sorted(allowed_properties))
+        unexpected = ", ".join(sorted(unexpected_keys))
+        return (
+            False,
+            f"Unexpected key(s) in SKILL.md frontmatter: {unexpected}. Allowed properties are: {allowed}",
+        )
+
+    if "name" not in frontmatter:
+        return False, "Missing 'name' in frontmatter"
+    if "description" not in frontmatter:
+        return False, "Missing 'description' in frontmatter"
+
+    name = frontmatter.get("name", "")
+    if not isinstance(name, str):
+        return False, f"Name must be a string, got {type(name).__name__}"
+    name = name.strip()
+    if name:
+        if not re.match(r"^[a-z0-9-]+$", name):
+            return (
+                False,
+                f"Name '{name}' should be hyphen-case (lowercase letters, digits, and hyphens only)",
+            )
+        if name.startswith("-") or name.endswith("-") or "--" in name:
+            return (
+                False,
+                f"Name '{name}' cannot start/end with hyphen or contain consecutive hyphens",
+            )
+        if len(name) > 64:
+            return False, f"Name is too long ({len(name)} characters). Maximum is 64 characters."
+
+    description = frontmatter.get("description", "")
+    if not isinstance(description, str):
+        return False, f"Description must be a string, got {type(description).__name__}"
+    description = description.strip()
+    if description:
+        if "<" in description or ">" in description:
+            return False, "Description cannot contain angle brackets (< or >)"
+        if len(description) > 1024:
+            return (
+                False,
+                f"Description is too long ({len(description)} characters). Maximum is 1024 characters.",
+            )
+
+    return True, "Skill is valid!"
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print("Usage: python quick_validate.py <skill_directory>")
+        sys.exit(1)
+
+    valid, message = validate_skill(sys.argv[1])
+    print(message)
+    sys.exit(0 if valid else 1)
@@ -0,0 +1,283 @@
+use crate::config::Config;
+use crate::config::resolve_code_path_for_read;
+use crate::git_info::resolve_root_git_project_for_trust;
+use crate::skills::model::SkillError;
+use crate::skills::model::SkillLoadOutcome;
+use crate::skills::model::SkillMetadata;
+use crate::skills::model::SkillScope;
+use crate::skills::system::system_cache_root_dir;
+use crate::skills::system::install_system_skills;
+use dunce::canonicalize as normalize_path;
+use serde::Deserialize;
+use std::collections::HashSet;
+use std::collections::VecDeque;
+use std::error::Error;
+use std::fmt;
+use std::fs;
+use std::path::Path;
+use std::path::PathBuf;
+use tracing::error;
+
+#[derive(Debug, Deserialize)]
+struct SkillFrontmatter {
+    name: String,
+    description: String,
+}
+
+const SKILLS_FILENAME: &str = "SKILL.md";
+const SKILLS_DIR_NAME: &str = "skills";
+const REPO_ROOT_CONFIG_DIR_NAME: &str = ".codex";
+const MAX_NAME_LEN: usize = 64;
+const MAX_DESCRIPTION_LEN: usize = 1024;
+
+#[derive(Debug)]
+enum SkillParseError {
+    Read(std::io::Error),
+    MissingFrontmatter,
+    InvalidYaml(serde_yaml::Error),
+    MissingField(&'static str),
+    InvalidField { field: &'static str, reason: String },
+}
+
+impl fmt::Display for SkillParseError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            SkillParseError::Read(e) => write!(f, "failed to read file: {e}"),
+            SkillParseError::MissingFrontmatter => {
+                write!(f, "missing YAML frontmatter delimited by ---")
+            }
+            SkillParseError::InvalidYaml(e) => write!(f, "invalid YAML: {e}"),
+            SkillParseError::MissingField(field) => write!(f, "missing field `{field}`"),
+            SkillParseError::InvalidField { field, reason } => {
+                write!(f, "invalid {field}: {reason}")
+            }
+        }
+    }
+}
+
+impl Error for SkillParseError {}
+
+pub fn load_skills(config: &Config) -> SkillLoadOutcome {
+    if let Err(err) = install_system_skills(&config.code_home) {
+        tracing::error!("failed to install system skills: {err}");
+    }
+    load_skills_from_roots(skill_roots(config))
+}
+
+pub(crate) struct SkillRoot {
+    pub(crate) path: PathBuf,
+    pub(crate) scope: SkillScope,
+}
+
+pub(crate) fn load_skills_from_roots<I>(roots: I) -> SkillLoadOutcome
+where
+    I: IntoIterator<Item = SkillRoot>,
+{
+    let mut outcome = SkillLoadOutcome::default();
+    for root in roots {
+        discover_skills_under_root(&root.path, root.scope, &mut outcome);
+    }
+
+    let mut seen: HashSet<String> = HashSet::new();
+    outcome
+        .skills
+        .retain(|skill| seen.insert(skill.name.clone()));
+
+    outcome
+        .skills
+        .sort_by(|a, b| a.name.cmp(&b.name).then_with(|| a.path.cmp(&b.path)));
+
+    outcome
+}
+
+pub(crate) fn user_skills_root(config: &Config) -> SkillRoot {
+    let root = resolve_code_path_for_read(&config.code_home, Path::new(SKILLS_DIR_NAME));
+    SkillRoot {
+        path: root,
+        scope: SkillScope::User,
+    }
+}
+
+pub(crate) fn system_skills_root(config: &Config) -> SkillRoot {
+    SkillRoot {
+        path: system_cache_root_dir(&config.code_home),
+        scope: SkillScope::System,
+    }
+}
+
+pub(crate) fn repo_skills_root(cwd: &Path) -> Option<SkillRoot> {
+    let base = if cwd.is_dir() { cwd } else { cwd.parent()? };
+    let base = normalize_path(base).unwrap_or_else(|_| base.to_path_buf());
+
+    let repo_root =
+        resolve_root_git_project_for_trust(&base).map(|root| normalize_path(&root).unwrap_or(root));
+
+    let scope = SkillScope::Repo;
+    if let Some(repo_root) = repo_root.as_deref() {
+        for dir in base.ancestors() {
+            let skills_root = dir.join(REPO_ROOT_CONFIG_DIR_NAME).join(SKILLS_DIR_NAME);
+            if skills_root.is_dir() {
+                return Some(SkillRoot {
+                    path: skills_root,
+                    scope,
+                });
+            }
+
+            if dir == repo_root {
+                break;
+            }
+        }
+        return None;
+    }
+
+    let skills_root = base.join(REPO_ROOT_CONFIG_DIR_NAME).join(SKILLS_DIR_NAME);
+    skills_root.is_dir().then_some(SkillRoot {
+        path: skills_root,
+        scope,
+    })
+}
+
+fn skill_roots(config: &Config) -> Vec<SkillRoot> {
+    let mut roots = Vec::new();
+
+    if let Some(repo_root) = repo_skills_root(&config.cwd) {
+        roots.push(repo_root);
+    }
+
+    // Load order matters: we dedupe by name, keeping the first occurrence.
+    // This makes repo/user skills win over system skills.
+    roots.push(user_skills_root(config));
+    roots.push(system_skills_root(config));
+
+    roots
+}
+
+fn discover_skills_under_root(root: &Path, scope: SkillScope, outcome: &mut SkillLoadOutcome) {
+    let Ok(root) = normalize_path(root) else {
+        return;
+    };
+
+    if !root.is_dir() {
+        return;
+    }
+
+    let mut queue: VecDeque<PathBuf> = VecDeque::from([root]);
+    while let Some(dir) = queue.pop_front() {
+        let entries = match fs::read_dir(&dir) {
+            Ok(entries) => entries,
+            Err(e) => {
+                error!("failed to read skills dir {}: {e:#}", dir.display());
+                continue;
+            }
+        };
+
+        for entry in entries.flatten() {
+            let path = entry.path();
+            let file_name = match path.file_name().and_then(|f| f.to_str()) {
+                Some(name) => name,
+                None => continue,
+            };
+
+            if file_name.starts_with('.') {
+                continue;
+            }
+
+            let Ok(file_type) = entry.file_type() else {
+                continue;
+            };
+
+            if file_type.is_symlink() {
+                continue;
+            }
+
+            if file_type.is_dir() {
+                queue.push_back(path);
+                continue;
+            }
+
+            if file_type.is_file() && file_name == SKILLS_FILENAME {
+                match parse_skill_file(&path, scope) {
+                    Ok(skill) => {
+                        outcome.skills.push(skill);
+                    }
+                    Err(err) => {
+                        if scope != SkillScope::System {
+                            outcome.errors.push(SkillError {
+                                path,
+                                message: err.to_string(),
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+fn parse_skill_file(path: &Path, scope: SkillScope) -> Result<SkillMetadata, SkillParseError> {
+    let contents = fs::read_to_string(path).map_err(SkillParseError::Read)?;
+
+    let frontmatter = extract_frontmatter(&contents).ok_or(SkillParseError::MissingFrontmatter)?;
+
+    let parsed: SkillFrontmatter =
+        serde_yaml::from_str(&frontmatter).map_err(SkillParseError::InvalidYaml)?;
+
+    let name = sanitize_single_line(&parsed.name);
+    let description = sanitize_single_line(&parsed.description);
+
+    validate_field(&name, MAX_NAME_LEN, "name")?;
+    validate_field(&description, MAX_DESCRIPTION_LEN, "description")?;
+
+    let resolved_path = normalize_path(path).unwrap_or_else(|_| path.to_path_buf());
+
+    Ok(SkillMetadata {
+        name,
+        description,
+        path: resolved_path,
+        scope,
+    })
+}
+
+fn sanitize_single_line(raw: &str) -> String {
+    raw.split_whitespace().collect::<Vec<_>>().join(" ")
+}
+
+fn validate_field(
+    value: &str,
+    max_len: usize,
+    field_name: &'static str,
+) -> Result<(), SkillParseError> {
+    if value.is_empty() {
+        return Err(SkillParseError::MissingField(field_name));
+    }
+    if value.chars().count() > max_len {
+        return Err(SkillParseError::InvalidField {
+            field: field_name,
+            reason: format!("exceeds maximum length of {max_len} characters"),
+        });
+    }
+    Ok(())
+}
+
+fn extract_frontmatter(contents: &str) -> Option<String> {
+    let mut lines = contents.lines();
+    if !matches!(lines.next(), Some(line) if line.trim() == "---") {
+        return None;
+    }
+
+    let mut frontmatter_lines: Vec<&str> = Vec::new();
+    let mut found_closing = false;
+    for line in lines.by_ref() {
+        if line.trim() == "---" {
+            found_closing = true;
+            break;
+        }
+        frontmatter_lines.push(line);
+    }
+
+    if frontmatter_lines.is_empty() || !found_closing {
+        return None;
+    }
+
+    Some(frontmatter_lines.join("\n"))
+}
@@ -0,0 +1,8 @@
+pub mod loader;
+pub mod model;
+pub mod render;
+pub mod system;
+
+pub use loader::load_skills;
+pub use model::SkillMetadata;
+pub use render::render_skills_section;
@@ -0,0 +1,29 @@
+use std::path::PathBuf;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SkillScope {
+    Repo,
+    User,
+    System,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SkillMetadata {
+    pub name: String,
+    pub description: String,
+    pub path: PathBuf,
+    pub scope: SkillScope,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SkillError {
+    pub path: PathBuf,
+    pub message: String,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct SkillLoadOutcome {
+    pub skills: Vec<SkillMetadata>,
+    pub errors: Vec<SkillError>,
+}
+
@@ -0,0 +1,42 @@
+use crate::skills::model::SkillMetadata;
+
+pub fn render_skills_section(skills: &[SkillMetadata]) -> Option<String> {
+    if skills.is_empty() {
+        return None;
+    }
+
+    let mut lines: Vec<String> = Vec::new();
+    lines.push("## Skills".to_string());
+    lines.push("These skills are discovered at startup from multiple local sources. Each entry includes a name, description, and file path so you can open the source for full instructions.".to_string());
+
+    for skill in skills {
+        let path_str = skill.path.to_string_lossy().replace('\\', "/");
+        let name = skill.name.as_str();
+        let description = skill.description.as_str();
+        lines.push(format!("- {name}: {description} (file: {path_str})"));
+    }
+
+    lines.push(
+        r###"- Discovery: Available skills are listed in project docs and may also appear in a runtime "## Skills" section (name + description + file path). These are the sources of truth; skill bodies live on disk at the listed paths.
+- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.
+- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.
+- How to use a skill (progressive disclosure):
+  1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.
+  2) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.
+  3) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.
+  4) If `assets/` or templates exist, reuse them instead of recreating from scratch.
+- Description as trigger: The YAML `description` in `SKILL.md` is the primary trigger signal; rely on it to decide applicability. If unsure, ask a brief clarification before proceeding.
+- Coordination and sequencing:
+  - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.
+  - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.
+- Context hygiene:
+  - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.
+  - Avoid deeply nested references; prefer one-hop files explicitly linked from `SKILL.md`.
+  - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.
+- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue."###
+            .to_string(),
+    );
+
+    Some(lines.join("\n"))
+}
+
@@ -0,0 +1,153 @@
+use std::collections::hash_map::DefaultHasher;
+use std::fs;
+use std::hash::Hash;
+use std::hash::Hasher;
+use std::path::Path;
+use std::path::PathBuf;
+
+use thiserror::Error;
+
+const SYSTEM_SKILLS_DIR_NAME: &str = ".system";
+const SKILLS_DIR_NAME: &str = "skills";
+const SYSTEM_SKILLS_MARKER_FILENAME: &str = ".codex-system-skills.marker";
+
+const EMBEDDED_SYSTEM_SKILLS: &[(&str, &[u8])] = &[
+    (
+        "plan/SKILL.md",
+        include_bytes!("assets/samples/plan/SKILL.md"),
+    ),
+    (
+        "plan/scripts/create_plan.py",
+        include_bytes!("assets/samples/plan/scripts/create_plan.py"),
+    ),
+    (
+        "plan/scripts/list_plans.py",
+        include_bytes!("assets/samples/plan/scripts/list_plans.py"),
+    ),
+    (
+        "plan/scripts/plan_utils.py",
+        include_bytes!("assets/samples/plan/scripts/plan_utils.py"),
+    ),
+    (
+        "plan/scripts/read_plan_frontmatter.py",
+        include_bytes!("assets/samples/plan/scripts/read_plan_frontmatter.py"),
+    ),
+    (
+        "skill-creator/SKILL.md",
+        include_bytes!("assets/samples/skill-creator/SKILL.md"),
+    ),
+    (
+        "skill-creator/license.txt",
+        include_bytes!("assets/samples/skill-creator/license.txt"),
+    ),
+    (
+        "skill-creator/scripts/init_skill.py",
+        include_bytes!("assets/samples/skill-creator/scripts/init_skill.py"),
+    ),
+    (
+        "skill-creator/scripts/package_skill.py",
+        include_bytes!("assets/samples/skill-creator/scripts/package_skill.py"),
+    ),
+    (
+        "skill-creator/scripts/quick_validate.py",
+        include_bytes!("assets/samples/skill-creator/scripts/quick_validate.py"),
+    ),
+];
+
+/// Returns the on-disk cache location for embedded system skills.
+///
+/// This is typically located at `CODEX_HOME/skills/.system`.
+pub(crate) fn system_cache_root_dir(code_home: &Path) -> PathBuf {
+    code_home.join(SKILLS_DIR_NAME).join(SYSTEM_SKILLS_DIR_NAME)
+}
+
+/// Installs embedded system skills into `CODEX_HOME/skills/.system`.
+///
+/// Clears any existing system skills directory first and then writes the embedded
+/// skills directory into place.
+///
+/// To avoid doing unnecessary work on every startup, a marker file is written
+/// with a fingerprint of the embedded directory. When the marker matches, the
+/// install is skipped.
+pub(crate) fn install_system_skills(code_home: &Path) -> Result<(), SystemSkillsError> {
+    let skills_root_dir = code_home.join(SKILLS_DIR_NAME);
+    fs::create_dir_all(&skills_root_dir)
+        .map_err(|source| SystemSkillsError::io("create skills root dir", source))?;
+
+    let dest_system = system_cache_root_dir(code_home);
+    let marker_path = dest_system.join(SYSTEM_SKILLS_MARKER_FILENAME);
+    let expected_fingerprint = embedded_system_skills_fingerprint();
+
+    if dest_system.is_dir() && read_marker(&marker_path).is_ok_and(|m| m == expected_fingerprint) {
+        return Ok(());
+    }
+
+    if dest_system.exists() {
+        fs::remove_dir_all(&dest_system)
+            .map_err(|source| SystemSkillsError::io("remove existing system skills dir", source))?;
+    }
+
+    write_embedded_files(&dest_system)?;
+    fs::write(&marker_path, format!("{expected_fingerprint}\n"))
+        .map_err(|source| SystemSkillsError::io("write system skills marker", source))?;
+    Ok(())
+}
+
+fn read_marker(path: &Path) -> Result<String, SystemSkillsError> {
+    Ok(fs::read_to_string(path)
+        .map_err(|source| SystemSkillsError::io("read system skills marker", source))?
+        .trim()
+        .to_string())
+}
+
+fn embedded_system_skills_fingerprint() -> String {
+    let mut items: Vec<(&str, u64)> = EMBEDDED_SYSTEM_SKILLS
+        .iter()
+        .map(|&(rel, bytes)| {
+            let mut file_hasher = DefaultHasher::new();
+            bytes.hash(&mut file_hasher);
+            (rel, file_hasher.finish())
+        })
+        .collect();
+    items.sort_unstable_by(|(a, _), (b, _)| a.cmp(b));
+
+    let mut hasher = DefaultHasher::new();
+    for (path, contents_hash) in items {
+        path.hash(&mut hasher);
+        contents_hash.hash(&mut hasher);
+    }
+    format!("{:x}", hasher.finish())
+}
+
+fn write_embedded_files(dest_root: &Path) -> Result<(), SystemSkillsError> {
+    fs::create_dir_all(dest_root)
+        .map_err(|source| SystemSkillsError::io("create system skills dir", source))?;
+
+    for &(rel, bytes) in EMBEDDED_SYSTEM_SKILLS {
+        let path = dest_root.join(rel);
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent)
+                .map_err(|source| SystemSkillsError::io("create system skills file parent", source))?;
+        }
+        fs::write(&path, bytes)
+            .map_err(|source| SystemSkillsError::io("write system skill file", source))?;
+    }
+
+    Ok(())
+}
+
+#[derive(Debug, Error)]
+pub(crate) enum SystemSkillsError {
+    #[error("io error while {action}: {source}")]
+    Io {
+        action: &'static str,
+        #[source]
+        source: std::io::Error,
+    },
+}
+
+impl SystemSkillsError {
+    fn io(action: &'static str, source: std::io::Error) -> Self {
+        Self::Io { action, source }
+    }
+}