feat(mcp): surface workspace skill hints

[mirnoorata]

feat(mcp): surface workspace skill hints

Implements the portable Codexa portion of the workspace audit remediation: bounded workspace session-start digest, configured skill/playbook hints, structured MCP compaction, and regression coverage.

Summary

a076e15 feat(mcp): surface workspace skill hints
src/init.ts | 159 +++++++++
src/mcp/compaction.ts | 3 +
src/mcp/resources.ts | 4 +
src/query/context.ts | 19 +
src/skill-hints.ts | 425 +++++++++++++++++++++++
src/types/query-data.ts | 2 +
tests/init.test.ts | 41 +++
tests/mcp-01-keeps-the-primary-mcp-happy.test.ts | 68 ++++
8 files changed, 721 insertions(+)
create mode 100644 src/skill-hints.ts

Verification

• git diff --check: passed
• npm run check: passed
• Codexa post-edit-review: local artifact recorded
• Codexa test-plan: local artifact recorded
• Codexa proof-card: local artifact recorded
• Codexa outcome-to-row: WORKING.md bridge updated
• git diff --cached --check: passed
• staged safety scan: passed
• summary staged safety scan: passed

Summary Artifact

• Committed Markdown: docs/pr-summaries/claude-general-codexa-20260704-091747-focus-orientation/summary.md
• Committed PDF: docs/pr-summaries/claude-general-codexa-20260704-091747-focus-orientation/summary.pdf

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66e7b27c17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Redact rejected home skill roots

When a repo-controlled .codex/skill-hints.json points skillRoots at a disallowed home path such as ~/SecretClient/skills, resolveConfiguredRoot rejects it but still renders the warning through this branch, exposing ~/SecretClient/skills in codexa://repo/codebase/skill-hints.md. That leaks private workspace/project names despite the new boundary that refuses to scan outside the repo; use an opaque placeholder for rejected non-repo roots instead of preserving the home-relative suffix.

Useful? React with 👍 / 👎.