feat(skills): skills-over-MCP reference implementation (SEP r2)

crates/goose-cli/src/scenario_tests/scenario_runner.rs

@@ -232,6 +232,7 @@ where
             Arc::new(mock_client),
             None,
             None,
+            None,
         )
         .await;
 

crates/goose-server/src/routes/config_management.rs

@@ -150,6 +150,10 @@ pub struct SlashCommand {
     pub command: String,
     pub help: String,
     pub command_type: CommandType,
+    /// For MCP-sourced skills, the name of the originating MCP extension
+    /// (e.g. "github"). `None` for filesystem skills and non-skill commands.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub origin: Option<String>,
 }
 #[derive(Serialize, ToSchema)]
 pub struct SlashCommandsResponse {
@@ -402,6 +406,9 @@ pub async fn get_provider_models(
 pub struct SlashCommandsQuery {
     /// Optional working directory to discover local skills from
     pub working_dir: Option<String>,
+    /// Optional session id; when provided, the endpoint also includes
+    /// MCP-served skills from the corresponding agent's connected extensions.
+    pub session_id: Option<String>,
 }
 
 #[utoipa::path(
@@ -413,6 +420,7 @@ pub struct SlashCommandsQuery {
     )
 )]
 pub async fn get_slash_commands(
+    axum::extract::State(state): axum::extract::State<Arc<AppState>>,
     axum::extract::Query(query): axum::extract::Query<SlashCommandsQuery>,
 ) -> Result<Json<SlashCommandsResponse>, ErrorResponse> {
     let mut commands: Vec<_> = slash_commands::list_commands()
@@ -421,6 +429,7 @@ pub async fn get_slash_commands(
             command: command.command.clone(),
             help: command.recipe_path.clone(),
             command_type: CommandType::Recipe,
+            origin: None,
         })
         .collect();
 
@@ -429,6 +438,7 @@ pub async fn get_slash_commands(
             command: cmd_def.name.to_string(),
             help: cmd_def.description.to_string(),
             command_type: CommandType::Builtin,
+            origin: None,
         });
     }
 
@@ -438,6 +448,7 @@ pub async fn get_slash_commands(
             command: source.name,
             help: source.description,
             command_type: CommandType::Skill,
+            origin: None,
         });
     }
 
@@ -456,10 +467,24 @@ pub async fn get_slash_commands(
                 command: source.name,
                 help: source.description,
                 command_type: CommandType::Agent,
+                origin: None,
             });
         }
     }
 
+    if let Some(session_id) = query.session_id.as_deref() {
+        if let Ok(agent) = state.get_agent(session_id.to_string()).await {
+            for entry in agent.extension_manager.aggregated_mcp_skills().await {
+                commands.push(SlashCommand {
+                    command: entry.name,
+                    help: entry.description,
+                    command_type: CommandType::Skill,
+                    origin: Some(entry.server),
+                });
+            }
+        }
+    }
+
     Ok(Json(SlashCommandsResponse { commands }))
 }
 

crates/goose/src/acp/fs.rs

@@ -1,7 +1,7 @@
 use crate::acp::tools::AcpAwareToolMeta;
 use crate::agents::mcp_client::{Error as McpError, McpClientTrait};
 use crate::agents::platform_extensions::developer::edit::{
-    resolve_path, string_replace, FileEditParams, FileReadParams, FileWriteParams,
+    reject_uri_path, resolve_path, string_replace, FileEditParams, FileReadParams, FileWriteParams,
 };
 use crate::agents::platform_extensions::developer::shell::{ShellParams, OUTPUT_LIMIT_BYTES};
 use crate::agents::platform_extensions::developer::DeveloperClient;
@@ -131,6 +131,9 @@ impl AcpTools {
             Ok(p) => p,
             Err(e) => return Ok(error_result(e)),
         };
+        if let Some(err) = reject_uri_path(&params.path) {
+            return Ok(err);
+        }
         let path = resolve_path(&params.path, ctx.working_dir.as_deref());
         self.update_tool_call(
             ctx,
@@ -156,6 +159,9 @@ impl AcpTools {
             Ok(p) => p,
             Err(e) => return Ok(error_result(e)),
         };
+        if let Some(err) = reject_uri_path(&params.path) {
+            return Ok(err);
+        }
         let path = resolve_path(&params.path, ctx.working_dir.as_deref());
         self.update_tool_call(
             ctx,
@@ -193,6 +199,9 @@ impl AcpTools {
             Ok(p) => p,
             Err(e) => return Ok(error_result(e)),
         };
+        if let Some(err) = reject_uri_path(&params.path) {
+            return Ok(err);
+        }
         let path = resolve_path(&params.path, ctx.working_dir.as_deref());
         self.update_tool_call(
             ctx,

crates/goose/src/acp/server.rs

@@ -1455,7 +1455,7 @@ impl GooseAcpAgent {
                     let info = client.get_info().cloned();
                     agent
                         .extension_manager
-                        .add_client("developer".into(), config, client, info, None)
+                        .add_client("developer".into(), config, client, info, None, None)
                         .await;
                 }
 

crates/goose/src/agents/agent.rs

@@ -2143,7 +2143,7 @@ impl Agent {
             .await?;
         let extensions_info = self
             .extension_manager
-            .get_extensions_info(&session.working_dir)
+            .get_extensions_info(session_id, &session.working_dir)
             .await;
         tracing::debug!("Retrieved {} extensions info", extensions_info.len());
         let (extension_count, tool_count) = self