skills-init: commit-SHA skill refs never start (git checkout -- <sha> reads the SHA as a pathspec)

Open Beginner friendly
  • Is something wrong?
#3,571 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
git, go, kubernetes
Domain
backend, devops

Research direction

Read go/core/internal/skillsinit/git.go, focusing on CloneGit and its Full ref checkout path. The issue gives a minimal plain Git reproduction; confirm how the checkout arguments are passed, then inspect nearby tests for this behavior. Done when commit SHA refs check out successfully on the 0.10 line and branch and tag refs still work.

Written by the indexing model from the issue text.

Description

What happens

An agent whose skills pin a commit SHA never leaves Init. skills-init fails with:

error: pathspec '<sha>' did not match any file(s) known to git
skills-init: clone <url>: exit status 1

Agents that pin a branch or tag are fine.

Why

CloneGit in go/core/internal/skillsinit/git.go takes the Full path for a commit SHA and runs:

if err := runGitIn(ref.Dest, "checkout", "--", ref.Ref); err != nil {

With the -- separator, git treats everything after it as a pathspec, not a revision. So the SHA is looked up as a file name and the checkout fails. The commit is present in the clone; only the argument parsing is wrong.

The comment above the call says the separator is there so "a ref starting with -" cannot be parsed as a flag, and notes that refs are already validated as 40-char hex when Full is true. That validation is real — the controller sets Full from isCommitSHA, which is ^[0-9a-fA-F]{40}$ — so a 40-character hex string can never be an option and the separator protects nothing.

Minimal reproduction

No kagent needed; this is plain git:

git clone https://github.com/<any>/<repo>.git /tmp/r
cd /tmp/r
git checkout -- "$(git rev-parse HEAD)"   # error: pathspec ... did not match any file(s) known to git
git checkout    "$(git rev-parse HEAD)"   # works

Fix

Drop the separator:

if err := runGitIn(ref.Dest, "checkout", ref.Ref); err != nil {

git checkout <sha> -- (separator last) also works, but the plain form is what the surrounding comment already describes.

Versions

Present in v0.10.4, v0.10.5 and v0.10.6 — the same line in all three.

Already fixed on main / v1.0.0-rc3, where CloneGit was rewritten to git fetch --depth 1 origin <commit> followed by git checkout --detach FETCH_HEAD. So this only affects the 0.10 line.

Impact

Any agent using skills.gitRefs with a commit SHA — which is the recommended way to pin skills — cannot start on 0.10.x. Branch and tag refs are unaffected.

Dominant language
Go
Stars
4.1k
Forks
871
Avg merge
1d 8h
Merged PRs (30d)
183

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from kagent-dev/kagent

All issues in kagent-dev/kagent

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.