fix(server): honor explicit $skill invocations across providers

[D3OXY]

Problem

The composer flattened a selected skill chip into plain $name text. Provider adapters then guessed intent with a regex, so ordinary dollar-prefixed text could be treated as a skill and provider behavior differed.

Fix

• Preserve selected skill metadata as { name, start, end } from web/mobile composers through durable drafts, queued sends, turn-start events, and provider requests. Timeline text stays canonical.
• Send native structured skill inputs to Codex. Claude Code, Cursor, Grok, and OpenCode receive explicitly selected skill documents with their source file for relative references.
• Validate stale, overlapping, disabled, and unknown invocations at the provider boundary. Plain dollar-prefixed text is never inferred as a skill.
• Discover provider skills once per session instead of scanning during send.
• Preserve Claude argument substitution and reject runtime-only skill fields that the fallback cannot safely emulate.
• Discover Cursor skills in the session workspace and use upstream Grok skill discovery, while honoring provider user-invocation visibility.

Verification

• 470 focused tests across contracts, orchestration, draft/outbox persistence, skill discovery, provider adapters, and upstream Grok reliability paths.
• Contracts, server, shared, web, and mobile typechecks pass. Server reports only existing Effect suggestions.
• Focused lint, formatting, and git diff --check pass.

Addresses #7795.

Implemented with GPT-5.6 Codex in the T3 Code harness.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c28997d-86b2-44a3-85e0-da21670425bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a cross-provider skill invocation pipeline that changes provider health checks and send-turn processing, including filesystem scans, CLI/API discovery, prompt transformation, and structured skill inputs. Its multi-provider scope and substantial new runtime logic exceed a simple self-contained fix and merit human review.

Notes:

• Macroscope's correctness review did not run, so approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Reviewed the new/changed Effect service code (provider/skillInvocations.ts, Layers/codexSkillInvocations.ts, Drivers/CursorSkills.ts, Drivers/GrokSkills.ts, adapters, contracts). Imports, schema-tagged errors, and dependency acquisition follow the conventions; one error-translation issue found in CodexAdapter.mapCodexRuntimeError.

^{Posted via Macroscope — Effect Service Conventions}