Dmitriy Kovalenko 526f6099f6 Preserve filesystem authority when loading skills (#59279) ...

## Why

Skill discovery and metadata loading used raw filesystem handles with unrestricted reads, and cache keys distinguished filesystems without accounting for captured permissions.

## What changed

- Pass borrowed `EnvironmentAccess` accessors through skill root resolution, discovery, canonicalization, and metadata reads.
- Include captured permissions in skill snapshot and empty remote root cache keys.
- Add fixed-path watches to `EnvironmentAccess`, falling back to live discovery when read restrictions prevent using unsandboxed executor watches.
- Keep user and plugin roots under host filesystem authority independently of the selected repository executor.

## Testing

Extend remote root cache coverage to verify that changing captured permissions triggers a fresh scan and that restricted accessors decline unsandboxed watches.

GitOrigin-RevId: 97d4bfdfcba78a93fc8845773c6397d4364494e3

2026-11-04 01:13:54 +00:00

..

src

Preserve filesystem authority when loading skills (#59279)

2026-11-04 01:13:54 +00:00

tests

Preserve filesystem authority when loading skills (#59279)

2026-11-04 01:13:54 +00:00

BUILD.bazel

feat: add skills extension scaffold (#25953)

2026-06-03 01:10:26 +02:00

Cargo.toml

Back off failed cloud skill and plugin catalog refreshes (#55968)

2026-10-21 19:22:57 +00:00