Closes AI-267
This PR adds a skills subpage in the settings UI, where we display
global skills in the user tab and project skills in the corresponding
project tab. The approach taken here was the simplest one out of the
possible avenues we could've taken to implement this (which would
possibly require bigger refactors), given this is potentially the very
first page in the settings UI where we're displaying stuff that does not
correspond to data available in the `settings.json`.
Important to note that a major limitation of the global approach is that
it's dependent on the native agent having loaded the skill index,
meaning there's an edge case where, if you open the settings UI _before_
having opened the agent panel, you won't immediately see the available
skills. Something to discuss but that it felt like a viable option for a
first ship.
Release Notes:
- Agent: Added a skills section to the settings UI.
Closes AI-266
This PR adds a built-in skill called `create-skill`, which allows the
Zed agent to have access to a skill that teaches it how to properly
create skills for Zed. You can manually invoke it as well as just
letting the model auto-invoke it in case your prompt suggests creating a
new skill.
Release Notes:
- Agent: Added a built-in skill called `create-skill` to make the Zed
agent informed about how to do that.
---------
Co-authored-by: Richard Feldman <richard@zed.dev>
Adds a one-time, idempotent startup migration that moves every user Rule
out of the `PromptStore` LMDB database into the new Skills + AGENTS.md
world, in a single pass:
- **Non-Default Rules → global Skills.** Each one becomes
`~/.agents/skills/<slug>/SKILL.md` with `disable-model-invocation:
true`, preserving the original behavior that non-Default Rules were only
ever invoked when the user named them. They're now invokable via
`/skill-name` (and still `@`-mentions).
- **Default Rules → global AGENTS.md.** Each one is appended to
`paths::agents_file()` (e.g. `~/.config/zed/AGENTS.md` on macOS/Linux,
`%APPDATA%\Zed\AGENTS.md` on Windows) under an `## H2` heading
containing the rule's title. Default Rules used to be auto-included in
every conversation; the global AGENTS.md is loaded into the system
prompt of every conversation, so the behavior is preserved.
- **Customized built-in prompts → global AGENTS.md** (currently just the
commit-message prompt). If the user has edited a built-in away from
Zed's shipped `default_content()`, the edited body is appended at the
top of the AGENTS.md block. Uncustomized built-ins (still on the shipped
default) are skipped so we don't pollute AGENTS.md with text the user
never wrote.
The migration is gated on the `skills` feature flag — users without the
flag never have their Rules touched in any way. A single global KVP flag
(`rules_to_skills_migration_done`) short-circuits the migration on
subsequent launches, so it runs at most once per machine even across
release channels. A process-lifetime `AtomicBool` guard additionally
prevents racing duplicate spawns when the underlying `cx.on_flags_ready`
callback fires multiple times at startup.
Migration is intentionally non-destructive: rule rows in the LMDB
database stay in place. Users can still see and edit them through the
existing UI, and a downgrade to a Zed build without skills support won't
lose anything.
Slug generation (`agent_skills::slugify_skill_name`) lowercases ASCII
letters, turns spaces into dashes, and drops every other
non-alphanumeric character entirely — so `foo!bar` becomes `foobar`, not
`foo-bar`. `&` is special-cased to become `and` (so `rock&roll` →
`rock-and-roll`). Slug collisions and pre-existing skill directories are
handled by appending `-2`, `-3`, etc.
A title-bar onboarding banner ("Skills have replaced Rules") surfaces
for every user on the `skills` feature flag. Clicking it opens a small
`AlertModal`-based explainer that summarizes the two destinations and
points users at the new `/skill-name` slash command (and notes that
`@`-mentions still work).
Closes AI-227
Closes AI-232
Release Notes:
- N/A
Treat `.agents/skills/` (project-local) and `~/.agents/skills/` (global)
as **sensitive paths**, on par with `.zed/` and the global config
directory. The agent's built-in editing tools (`edit_file`,
`write_file`, `create_directory`, `delete_path`, `move_path`,
`copy_path`) now require explicit user authorization before modifying
anything inside those paths, because the contents of skill files control
agent behavior.
This protection is worth landing on its own, ahead of Zed adding its own
skills support: other agents (e.g. Claude Code) already write skill
files into these locations, so a Zed installation may already have
skills on disk that should not be silently editable by the agent.
Also tightens the **pre-existing `.zed/` check** to compare path
components case-insensitively. macOS and Windows use case-insensitive
filesystems by default, so without this fix a malicious settings author
could bypass the local-settings classifier with `.ZED/settings.json`
(the canonicalized inode would match, but the path-component comparison
would miss it). The new `.agents/skills/` check has the same hazard and
now shares a single `component_matches_ignore_ascii_case` helper with
the `.zed/` check.
Introduces the `agent_skills` crate, scoped for now to just the path
constants and helpers (`global_skills_dir`,
`project_skills_relative_path`, `SKILL_FILE_NAME`) so the
tool-permission machinery can recognize the agent skills tree without
depending on a skill discovery / parsing / loading layer. Those will
land in follow-up PRs.
Closes AI-217
Release Notes:
- Agent: Require user confirmation before letting tools modify files
inside `.agents/skills/` (per-project) or `~/.agents/skills/` (global),
so skills installed by any agent are protected from unsolicited edits
---------
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Co-authored-by: Martin Ye <martinye022@gmail.com>
Co-authored-by: Danilo Leal <daniloleal09@gmail.com>
