feat(skills): Codex unification — bring your skills, use them anywhere

[k11kirky]

Problem

Users who work in both PostHog Code and Codex have no way to access their Codex-authored skills from the Skills tab, and no way to bring those skills into their editable user skills collection. Similarly, skills created or installed in PostHog Code are invisible to Codex sessions.

Changes

New codex skill source

• Added "codex" as a valid SkillSource type and wired it through the Zod schema, precedence ordering, source labels, and UI display config (using a Robot icon).
• Codex skills appear in their own "Codex" section in the Skills view, between repo and bundled skills.
• Codex skills are read-only in the UI.

Codex skill deduplication

• Skills in ~/.agents/skills that were synced there by the official bundled pipeline, or mirrored out from the user's own skills, are hidden from the Codex section to avoid confusing duplicates. Only genuinely Codex-authored skills surface.

Import Codex skill

• Added an "Import" button on the detail panel for Codex skills. Clicking it copies the skill into ~/.claude/skills, making it an ordinary editable user skill.
• If a skill with the same name already exists locally, an overwrite confirmation dialog is shown before replacing it.
• After import, the mirror takes ownership of the Codex copy so future user-skill mirrors carry edits back without duplicating or clobbering.
• Added importCodex tRPC mutation and useImportCodexSkill hook.
• Path validation ensures only skills inside the Codex skills directory can be imported.

User-to-Codex mirroring (codex-mirror.ts)

• Introduced a one-way mirror that copies every user skill into ~/.agents/skills so skills created, edited, or installed in PostHog Code are available in Codex sessions.
• A .posthog-mirror.json state file tracks which skills were placed there by the mirror, ensuring the mirror never overwrites Codex-native skills it didn't create.
• Mirrors whose source skill has been deleted are cleaned up automatically.
• Mirroring runs on startup and after each periodic skills update. Failures are logged as warnings and never interrupt the main skills pipeline.

How did you test this?

• Added unit tests for mirrorUserSkillsToCodex covering: initial copy, collision avoidance, update propagation, deletion cleanup, and import ownership handoff.
• Added unit tests for readCodexMirrorState covering missing and corrupt state files.
• Added integration tests in skills.test.ts covering: listing codex skills with deduplication, importing a codex skill with mirror ownership, and rejection of paths outside the codex skills directory.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[k11kirky]

• refactor(skills): apply simplify-pass cleanups across the stack #2612
• feat(skills): Codex unification — bring your skills, use them anywhere #2611 👈 (View in Graphite)
• feat(skills): publish skills to the team and install team skills locally #2610
• feat(skills): PostHog cloud team skills — read path #2609
• feat(skills): skills.sh marketplace browse and install #2608
• feat(skills): validation and shadowing signals #2607
• feat(skills): live refresh from the filesystem #2606
• feat(skills): create, edit, and delete user and repo skills #2605
• feat(skills): render full skill directories #2604
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor could not complete this scan.

No React dependency found in /tmp/react-doctor-baseline-O8f8l7/package.json. Add "react" to dependencies (or peerDependencies) and re-run.

_{Reviewed by React Doctor for commit 7df61f0.}

[greptile-apps]

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
packages/workspace-server/src/services/skills/skills.test.ts:189-192
**Test silently passes without executing assertions**

When `~/.claude/skills/codex-only` already exists on the developer's machine or CI runner, the test returns at line 192 without running any `expect` calls — the test is marked passing while nothing was verified. The root cause is that `importCodexSkill` hardcodes `path.join(os.homedir(), ".claude", "skills", name)` as the target, unlike the source side where `getCodexSkillsDir()` was extracted specifically to be mockable. Adding a parallel `getUserSkillsDir()` helper (mocked in tests to the temp directory the same way `getCodexSkillsDir` already is) would let this test run fully against the isolated temp dir, remove the early-return guard, and avoid writing to the real user filesystem during every test run.

### Issue 2 of 3
packages/ui/src/features/skills/SkillDetailPanel.tsx:177
**Fragile string-match gate for overwrite confirmation**

`message.includes("already exists")` ties the UI's overwrite flow to the exact wording of a backend error message. If the string in `skills.ts` is ever rephrased (e.g., "A skill with this name already exists"), this check silently falls through to the generic `toast.error` path — users never see the overwrite dialog and can't complete the import. Since tRPC is already in play here, throwing a `TRPCError` with a stable code (`CONFLICT`) and checking `error.data?.httpStatus === 409` (or a custom `code` field in the error data) on the client would make this contract explicit and refactoring-safe.

### Issue 3 of 3
packages/workspace-server/src/services/skills/skills.ts:464-490
**`mirroredNames` set is checked against both `skill.name` (display name) and `dirName` (directory name)**

The mirror state file stores directory basenames (confirmed by `addMirroredName` using `path.basename(resolved)` and `mirrorUserSkillsToCodex` tracking `name` from `findSkillDirs`). The extra `!mirroredNames.has(skill.name)` guard checks the display name (from SKILL.md frontmatter) against a set of directory names. If a Codex-only skill's frontmatter title happens to equal any mirrored directory name, it will be incorrectly hidden from the UI. Since the canonical key is the directory name, the `skill.name` check appears to be redundant and creates a false-positive suppression path.

_{Reviews (1): Last reviewed commit: "feat(skills): Codex unification — bring ..." | Re-trigger Greptile}

[k11kirky]

Merge activity

• Jun 12, 11:31 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 12, 11:32 AM UTC: Graphite couldn't merge this pull request because a downstack PR feat(skills): create, edit, and delete user and repo skills #2605 failed to merge.
• Jun 12, 11:54 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 12, 1:03 PM UTC: Graphite rebased this pull request as part of a merge.
• Jun 12, 1:10 PM UTC: @k11kirky merged this pull request with Graphite.