[robstolarz]

Adds depot agent pull / push to keep an agent definition (prompt and skills) in a local directory, and session create --definition. This PR lands approved #610 (head 4cfa7ed) as a --no-ff merge onto rob/depot-agents-cli-land-03-files, as part of the per-feature landing stack for DEP-7264. Review: git show --remerge-diff daee81e shows only what the merge changed beyond #610's approved diff.

Stack

1. Land Depot agents CLI 1/6: session commands (DEP-7264) #614 lands feat: add depot agent session commands #606
2. Land Depot agents CLI 2/6: hide depot agent until GA (DEP-7247) #615 lands feat: hide depot agent from root help until GA #611
3. Land Depot agents CLI 3/6: files and chat in attach (DEP-7264) #616 lands feat: send files to Depot agents and chat in attach #607
4. Land Depot agents CLI 4/6: agent pull and push (DEP-7264) #617 lands feat: add depot agent pull and push #610 ← this PR
5. Land Depot agents CLI 5/6: local MCP servers on attach (DEP-7247) #618 lands feat: offer local MCP servers to a Depot agent session on attach (DEP-7247) #609
6. Land Depot agents CLI 6/6: plugin views (DEP-7248) #619 lands Render plugin views and run their controls from the CLI (DEP-7248) #608

Test plan

• go build ./... and go test ./... pass at this tip, including TestDefinitionRoundTripsThroughADirectory, TestDefinitionDirectoryHoldsSkillsInNameOrder, TestReadDefinitionAcceptsCRLFSkills, TestReadDefinitionRejectsBadSkills, TestPullRefusesToMixIntoADefinitionAlreadyThere, TestPullRefusesASkillNameThatEscapesTheDirectory, TestPushStoresADirectoryAndRollsBackToAVersion, and TestForcedPullWithABadSkillNameKeepsTheExistingDefinition (from the fix commit below)
• TODO(verify): no automated pull/push round trip against a deployed API.

Merge resolutions

Clean merge; no conflicts.

Fix on top: Bugbot found that pull --force deleted the existing definition before it rejected an invalid skill name. Names are now checked before anything is removed. This fix is merged forward into the later PRs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NdhqP6oGqJMRJLwBU5Zepm

---

Note

Medium Risk
Changes how agent sessions are configured (instructions, skills, plugins) via new API RPCs and local filesystem I/O; pull includes path-safety checks but mis-pushed definitions affect live agent behavior on the next turn.

Overview
Adds versioned agent definitions to the Depot agents CLI: depot agent pull writes a session’s current (or --version) definition to a local directory (default ./depot-agent), and depot agent push uploads a directory as the next definition version or re-publishes an older version with --version for rollback.

The on-disk layout is AGENTS.md, skills/<name>/SKILL.md (YAML front matter + body), and optional plugins.json. Pull refuses to overwrite an existing tree unless --force, validates skill directory names before any destructive replace, and blocks path-escape skill names.

depot agent session create --definition reads that same directory and sends it on CreateSession as the session’s initial definition (API version 1).

Proto/connect clients gain GetAgentDefinition / PutAgentDefinition and related messages (DepotAgentDefinitionContent, skills, plugin refs). Tests cover directory round-trips, CRLF skills, pull safety, and push/rollback against a fake service.

^{Reviewed by Cursor Bugbot for commit 2afc1dd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

DEP-7264

[robstolarz]

Superseded by #613 (single cli landing PR)

[cursor]

Risk: medium. Approved: Cursor Bugbot completed successfully with no findings that need human review, and this landing of agent pull/push stays within the approval threshold. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}