refactor(tools-skills): move the skill-reading tool into a package

CONTRIBUTING.md

@@ -142,7 +142,8 @@ change follows, whether a person or a coding agent writes it.
 ## Releasing
 
 Maintainers bump `version` in the root, `apps/hub`, `apps/web`,
-`packages/client` and `packages/schemas` package.json files, run
+`packages/client`, `packages/schemas`, `packages/tools-hub` and
+`packages/tools-skills` package.json files, run
 `bun install`, and merge. Once the publish workflow for that commit on main has
 finished, `git tag -s vX.Y.Z && git push origin vX.Y.Z` retags its hub and
 sidecar images as `X.Y.Z` and publishes the GitHub release; a 0.x version or

apps/hub/package.json

@@ -20,6 +20,8 @@
     "@corbits-builder/designer": "workspace:*",
     "@corbits-builder/reviewer": "workspace:*",
     "@corbits-builder/schemas": "workspace:*",
+    "@corbits-builder/tools-hub": "workspace:*",
+    "@corbits-builder/tools-skills": "workspace:*",
     "@corbits-builder/writer": "workspace:*",
     "@corbits/agent-token": "0.2.2",
     "@corbits/artifacts": "0.3.0",

apps/hub/src/artifacts/design-tools.ts

@@ -8,8 +8,10 @@ import { DesignBundle } from "@corbits-builder/schemas/artifact";
 import { designCheckFor } from "../builds/design-check.ts";
 import { withDesignTokens } from "./design-tokens.ts";
 import { DESIGN_STYLES } from "./design-tweaks.ts";
-import { resolveWorkflowProjectScope } from "../workflows/project-scope.ts";
-import { workflowHttpJson } from "../workflows/http-json.ts";
+import {
+  resolveWorkflowProjectScope,
+  workflowHttpJson,
+} from "@corbits-builder/tools-hub";
 import { failure, HubArtifactReceipt } from "./tools.ts";
 
 interface DesignToolEnv extends BaseEnv {

apps/hub/src/artifacts/tools.ts

@@ -15,11 +15,12 @@ import {
 } from "@corbits-builder/schemas/artifact";
 import type { WorkflowRole } from "@corbits-builder/schemas/installed-workflows";
 import { unpackDesign } from "./design-tools.ts";
+import { projectScopeFailure } from "../workflows/project-scope.ts";
 import {
-  projectScopeFailure,
   resolveWorkflowProjectScope,
-} from "../workflows/project-scope.ts";
-import { workflowHttpJson, WorkflowHttpError } from "../workflows/http-json.ts";
+  workflowHttpJson,
+  WorkflowHttpError,
+} from "@corbits-builder/tools-hub";
 
 interface ArtifactToolEnv extends BaseEnv {
   capabilities: RuntimeCapabilities;

apps/hub/src/builds/app-repository.ts

@@ -32,7 +32,7 @@ import {
   mediatedHttpJson,
   WorkflowHttpError,
   workflowHttpJson,
-} from "../workflows/http-json.ts";
+} from "@corbits-builder/tools-hub";
 
 const AppPushAccess = type({
   path: "string",

apps/hub/src/builds/app-snapshot.ts

@@ -12,7 +12,10 @@ import {
   DesignDraft,
   MAX_APP_BYTES,
 } from "@corbits-builder/schemas/artifact";
-import { WorkflowHttpError, workflowHttpJson } from "../workflows/http-json.ts";
+import {
+  WorkflowHttpError,
+  workflowHttpJson,
+} from "@corbits-builder/tools-hub";
 import { INPUTS_DIRECTORY } from "../config/inputs.ts";
 
 // Installs and builds are rebuilt by setup and check-app, and .builder and the inputs come from

apps/hub/src/builds/sidecar-tools.ts

@@ -11,8 +11,10 @@ import {
   type ToolRunner,
 } from "@intx/types/runtime";
 import type { RuntimeCapabilities } from "@intx/types/runtime-capabilities";
-import { resolveWorkflowProjectScope } from "../workflows/project-scope.ts";
-import { WorkflowHttpError } from "../workflows/http-json.ts";
+import {
+  resolveWorkflowProjectScope,
+  WorkflowHttpError,
+} from "@corbits-builder/tools-hub";
 import { APP_STATUS_TOOL, createCodingTools } from "./coding-tools.ts";
 import { createPosixBuildExecutor } from "./posix-sandbox.ts";
 import { browserTools } from "./browser.ts";

apps/hub/src/projects/deploy-tools.ts

@@ -1,7 +1,9 @@
+import { projectScopeFailure } from "../workflows/project-scope.ts";
 import {
-  projectScopeFailure,
   resolveWorkflowProjectScope,
-} from "../workflows/project-scope.ts";
+  workflowHttpJson,
+  WorkflowHttpError,
+} from "@corbits-builder/tools-hub";
 import {
   defineTool,
   type BaseEnv,
@@ -50,7 +52,6 @@ import {
   designLookIdeas,
 } from "../config/design.ts";
 import { QUESTIONS_ASKED } from "../config/questions.ts";
-import { workflowHttpJson, WorkflowHttpError } from "../workflows/http-json.ts";
 import { assignmentToWriterMessage } from "../workflows/writer-task.ts";
 import { coderTaskMessage } from "@corbits-builder/coder/contract";
 

apps/hub/src/workflows/coder-package.ts

@@ -8,7 +8,7 @@ import { browserCatalog } from "../builds/browser-catalog.ts" with { type: "macr
 import { mcpTools } from "@corbits/mcp/interchange/client";
 import { mail, type MailToolEnv } from "@intx/tools-mail/sidecar-bundle";
 import { createArtifactTools } from "../artifacts/tools.ts";
-import { createSkillTools } from "../skills/tools.ts";
+import { createSkillTools } from "@corbits-builder/tools-skills";
 import { roleInference } from "./role-inference.ts";
 import {
   compactingDirector,

apps/hub/src/workflows/entries/coordinator.ts

@@ -2,7 +2,7 @@ import { createCoordinatorAgent } from "@corbits-builder/coordinator/agent";
 import { createCoordinatorWorkflow } from "@corbits-builder/coordinator";
 import { createArtifactTools } from "../../artifacts/tools.ts";
 import { createDeployTools } from "../../projects/deploy-tools.ts";
-import { createSkillTools } from "../../skills/tools.ts";
+import { createSkillTools } from "@corbits-builder/tools-skills";
 import { roleInference } from "../role-inference.ts";
 import {
   compactingDirector,

apps/hub/src/workflows/entries/writer.ts

@@ -1,7 +1,7 @@
 import { createWriterAgent } from "@corbits-builder/writer/agent";
 import { createWriterWorkflow } from "@corbits-builder/writer";
 import { createArtifactTools } from "../../artifacts/tools.ts";
-import { createSkillTools } from "../../skills/tools.ts";
+import { createSkillTools } from "@corbits-builder/tools-skills";
 import { roleInference } from "../role-inference.ts";
 import {
   compactingDirector,

apps/hub/src/workflows/project-scope.ts

@@ -1,47 +1,13 @@
-import { HUB_CREDENTIAL_HANDLE } from "@intx/types/credential-delivery";
-import type { RuntimeCapabilities } from "@intx/types/runtime-capabilities";
-import {
-  WorkflowProjectScope,
-  type WorkflowRole,
-} from "@corbits-builder/schemas/installed-workflows";
 import { getLogger } from "@intx/log";
+import { projectScopeCode } from "@corbits-builder/tools-hub";
 import { requestErrorMetadata } from "../request-error.ts";
-import { WorkflowHttpError, workflowHttpJson } from "./http-json.ts";
 
 const log = getLogger(["corbits-builder", "hub", "workflow-project-scope"]);
-const SAFE_CODE = /^[a-z0-9_:]+$/;
-// A deployed agent keeps the bundle it started with; a field a newer hub adds must not refuse its scope.
-const HubProjectScope = WorkflowProjectScope.onDeepUndeclaredKey("ignore");
 
-// The model sees only the original code (never a refusal body or arbitrary message); the cause stays in the hub log.
 export function projectScopeFailure(callId: string, error: unknown) {
   log.error(
     "Workflow project scope or tool call failed",
     requestErrorMetadata(error),
   );
-  const code =
-    error instanceof WorkflowHttpError && error.refusalCode
-      ? error.refusalCode
-      : error instanceof Error && SAFE_CODE.test(error.message)
-        ? error.message
-        : "workflow_project_scope_unavailable";
-  return { callId, content: code, isError: true };
-}
-
-export async function resolveWorkflowProjectScope(
-  capabilities: RuntimeCapabilities,
-  role: WorkflowRole,
-  signal: AbortSignal,
-) {
-  const scope = HubProjectScope.assert(
-    await workflowHttpJson({
-      capabilities,
-      handle: HUB_CREDENTIAL_HANDLE,
-      path: "/api/workflow-project-scope",
-      maxResponseBytes: 16384,
-      signal,
-    }),
-  );
-  if (scope.role !== role) throw new Error("workflow_project_role_refused");
-  return scope;
+  return { callId, content: projectScopeCode(error), isError: true };
 }

docs/DEV.md

@@ -7,16 +7,18 @@ running with Docker Compose is in
 
 ## Architecture in brief
 
-| Path                 | What it is                                                                                                                                                                                                                                                          |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `vendor/interchange` | [Interchange](https://github.com/faremeter/interchange) at the commit in `vendor/VENDORED_REVISION`, plus local patches recorded in `vendor/interchange.manifest.json`. It owns the agent loop, mail, spawning, approvals, credentials, sidecars and run lifecycle. |
-| `apps/hub`           | The server: a Postgres control plane, tenancy and sign-in, documents (versioned artifacts with content hashes), approvals and the glue that starts each role. It runs Interchange in-process.                                                                       |
-| `packages/client`    | A typed client for the hub's API (`@corbits-builder/client`). It never touches the database or Interchange internals.                                                                                                                                               |
-| `apps/web`           | The UI: Vite and React over that client, with its own small router in `src/routes.ts`.                                                                                                                                                                              |
-| `workflows/*`        | One package per role: its agent, prompt and workflow definition; the hub supplies its tools.                                                                                                                                                                        |
-| `packages/schemas`   | Types and schemas shared by the hub, the client and the workflows.                                                                                                                                                                                                  |
-| `scripts/`           | Dev and verification scripts: pin and vendor checks, the commit check, the Google sign-in emulator and React UI API generation.                                                                                                                                     |
-| `deploy/`            | The Dockerfile and Compose files ([SELF_HOST.md](https://github.com/corbitsdev/corbits-builder/blob/main/docs/SELF_HOST.md)).                                                                                                                                       |
+| Path                    | What it is                                                                                                                                                                                                                                                          |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `vendor/interchange`    | [Interchange](https://github.com/faremeter/interchange) at the commit in `vendor/VENDORED_REVISION`, plus local patches recorded in `vendor/interchange.manifest.json`. It owns the agent loop, mail, spawning, approvals, credentials, sidecars and run lifecycle. |
+| `apps/hub`              | The server: a Postgres control plane, tenancy and sign-in, documents (versioned artifacts with content hashes), approvals and the glue that starts each role. It runs Interchange in-process.                                                                       |
+| `packages/client`       | A typed client for the hub's API (`@corbits-builder/client`). It never touches the database or Interchange internals.                                                                                                                                               |
+| `apps/web`              | The UI: Vite and React over that client, with its own small router in `src/routes.ts`.                                                                                                                                                                              |
+| `workflows/*`           | One package per role: its agent, prompt and workflow definition; the hub supplies its tools.                                                                                                                                                                        |
+| `packages/schemas`      | Types and schemas shared by the hub, the client and the workflows.                                                                                                                                                                                                  |
+| `packages/tools-hub`    | The helpers the hub's agent tools use to call the hub and resolve a run's project (`@corbits-builder/tools-hub`).                                                                                                                                                   |
+| `packages/tools-skills` | The `read_skill` tool that gives agents the designer's and writer's skills (`@corbits-builder/tools-skills`).                                                                                                                                                       |
+| `scripts/`              | Dev and verification scripts: pin and vendor checks, the commit check, the Google sign-in emulator and React UI API generation.                                                                                                                                     |
+| `deploy/`               | The Dockerfile and Compose files ([SELF_HOST.md](https://github.com/corbitsdev/corbits-builder/blob/main/docs/SELF_HOST.md)).                                                                                                                                       |
 
 The roles: