@gajae-code/coding-agent 0.18.6 → 0.18.8

package/src/defaults/gjc-skills.generated.ts

@@ -1,9 +1,34 @@
 /**
  * Generated bundled GJC workflow skill catalog.
  *
- * Keep this module metadata-only: skill bodies are loaded through literal
- * dynamic imports only when a caller asks for their content.
+ * Keep this module metadata-only: skill bodies are read from their embedded
+ * `type: "file"` paths only when a caller asks for their content. Do not also
+ * import a body with `type: "text"`: Bun caches a module per specifier, so the
+ * second import of the same file would return the first one's value.
  */
+import { readFile } from "node:fs/promises";
+import autoresearchAutoCriticPath from "./gjc/skills/autoresearch/auto-critic.md" with { type: "file" };
+import autoresearchAutoIteratePath from "./gjc/skills/autoresearch/auto-iterate.md" with { type: "file" };
+import autoresearchSkillPath from "./gjc/skills/autoresearch/SKILL.md" with { type: "file" };
+import deepInterviewAutoAnswerUncertainPath from "./gjc/skills/deep-interview/auto-answer-uncertain.md" with {
+	type: "file",
+};
+import deepInterviewLateralReviewPanelPath from "./gjc/skills/deep-interview/lateral-review-panel.md" with {
+	type: "file",
+};
+import deepInterviewSkillPath from "./gjc/skills/deep-interview/SKILL.md" with { type: "file" };
+import ralplanSkillPath from "./gjc/skills/ralplan/SKILL.md" with { type: "file" };
+import ultragoalAiSlopCleanerPath from "./gjc/skills/ultragoal/ai-slop-cleaner.md" with { type: "file" };
+import ultragoalBoundaryCohortGatePath from "./gjc/skills/ultragoal/boundary-cohort-gate.md" with { type: "file" };
+import ultragoalCrossRepositorySuccessionPath from "./gjc/skills/ultragoal/cross-repository-succession.md" with {
+	type: "file",
+};
+import ultragoalSkillPath from "./gjc/skills/ultragoal/SKILL.md" with { type: "file" };
+import ultragoalTerminalCriticGatePath from "./gjc/skills/ultragoal/terminal-critic-gate.md" with { type: "file" };
+import ultragoalValidationBatchContractsPath from "./gjc/skills/ultragoal/validation-batch-contracts.md" with {
+	type: "file",
+};
+
 export type BundledGjcSkillName = "autoresearch" | "deep-interview" | "ralplan" | "ultragoal";
 
 export interface BundledGjcSkillCatalogEntry {
@@ -12,49 +37,34 @@ export interface BundledGjcSkillCatalogEntry {
 	readonly parentSkillName?: BundledGjcSkillName;
 	readonly relativePath: string;
 	readonly description?: string;
+	/**
+	 * Path of the bundled body. A `type: "file"` import, so `bun build --compile`
+	 * embeds the file and this resolves inside `/$bunfs` in compiled binaries.
+	 */
+	readonly sourcePath?: string;
 	readonly loadContent: () => Promise<string>;
 }
 
-const deepInterview = () =>
-	import("./gjc/skills/deep-interview/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const ralplan = () =>
-	import("./gjc/skills/ralplan/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const autoresearch = () =>
-	import("./gjc/skills/autoresearch/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const ultragoal = () =>
-	import("./gjc/skills/ultragoal/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const autoAnswerUncertain = () =>
-	import("./gjc/skills/deep-interview/auto-answer-uncertain.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const lateralReviewPanel = () =>
-	import("./gjc/skills/deep-interview/lateral-review-panel.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const aiSlopCleaner = () =>
-	import("./gjc/skills/ultragoal/ai-slop-cleaner.md", { with: { type: "text" } }).then(module => module.default);
-const validationBatchContracts = () =>
-	import("./gjc/skills/ultragoal/validation-batch-contracts.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const boundaryCohortGate = () =>
-	import("./gjc/skills/ultragoal/boundary-cohort-gate.md", { with: { type: "text" } }).then(module => module.default);
-const terminalCriticGate = () =>
-	import("./gjc/skills/ultragoal/terminal-critic-gate.md", { with: { type: "text" } }).then(module => module.default);
-const crossRepositorySuccession = () =>
-	import("./gjc/skills/ultragoal/cross-repository-succession.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const autoresearchIterate = () =>
-	import("./gjc/skills/autoresearch/auto-iterate.md", { with: { type: "text" } }).then(module => module.default);
-const autoresearchCritic = () =>
-	import("./gjc/skills/autoresearch/auto-critic.md", { with: { type: "text" } }).then(module => module.default);
+const deepInterview = () => readFile(deepInterviewSkillPath, "utf8");
+const ralplan = () => readFile(ralplanSkillPath, "utf8");
+const autoresearch = () => readFile(autoresearchSkillPath, "utf8");
+const ultragoal = () => readFile(ultragoalSkillPath, "utf8");
+const autoAnswerUncertain = () => readFile(deepInterviewAutoAnswerUncertainPath, "utf8");
+const lateralReviewPanel = () => readFile(deepInterviewLateralReviewPanelPath, "utf8");
+const aiSlopCleaner = () => readFile(ultragoalAiSlopCleanerPath, "utf8");
+const validationBatchContracts = () => readFile(ultragoalValidationBatchContractsPath, "utf8");
+const boundaryCohortGate = () => readFile(ultragoalBoundaryCohortGatePath, "utf8");
+const terminalCriticGate = () => readFile(ultragoalTerminalCriticGatePath, "utf8");
+const crossRepositorySuccession = () => readFile(ultragoalCrossRepositorySuccessionPath, "utf8");
+const autoresearchIterate = () => readFile(autoresearchAutoIteratePath, "utf8");
+const autoresearchCritic = () => readFile(autoresearchAutoCriticPath, "utf8");
 
 export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] = [
 	{
 		kind: "skill",
 		name: "deep-interview",
 		relativePath: "skills/deep-interview/SKILL.md",
+		sourcePath: deepInterviewSkillPath,
 		description: "Socratic deep interview with mathematical ambiguity gating before explicit execution approval",
 		loadContent: deepInterview,
 	},
@@ -62,6 +72,7 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "ralplan",
 		relativePath: "skills/ralplan/SKILL.md",
+		sourcePath: ralplanSkillPath,
 		description: "Consensus planning entrypoint that auto-gates vague ultragoal requests before execution",
 		loadContent: ralplan,
 	},
@@ -69,6 +80,7 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "autoresearch",
 		relativePath: "skills/autoresearch/SKILL.md",
+		sourcePath: autoresearchSkillPath,
 		description: "Goal-directed research missions interleaving web and data evidence into a structured verdict",
 		loadContent: autoresearch,
 	},
@@ -76,6 +88,7 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "ultragoal",
 		relativePath: "skills/ultragoal/SKILL.md",
+		sourcePath: ultragoalSkillPath,
 		description: "Create and execute durable repo-native multi-goal plans over GJC goal mode artifacts.",
 		loadContent: ultragoal,
 	},
@@ -83,54 +96,63 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill-fragment",
 		parentSkillName: "deep-interview",
 		relativePath: "skill-fragments/deep-interview/auto-answer-uncertain.md",
+		sourcePath: deepInterviewAutoAnswerUncertainPath,
 		loadContent: autoAnswerUncertain,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "deep-interview",
 		relativePath: "skill-fragments/deep-interview/lateral-review-panel.md",
+		sourcePath: deepInterviewLateralReviewPanelPath,
 		loadContent: lateralReviewPanel,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/ai-slop-cleaner.md",
+		sourcePath: ultragoalAiSlopCleanerPath,
 		loadContent: aiSlopCleaner,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/validation-batch-contracts.md",
+		sourcePath: ultragoalValidationBatchContractsPath,
 		loadContent: validationBatchContracts,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/boundary-cohort-gate.md",
+		sourcePath: ultragoalBoundaryCohortGatePath,
 		loadContent: boundaryCohortGate,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/terminal-critic-gate.md",
+		sourcePath: ultragoalTerminalCriticGatePath,
 		loadContent: terminalCriticGate,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/cross-repository-succession.md",
+		sourcePath: ultragoalCrossRepositorySuccessionPath,
 		loadContent: crossRepositorySuccession,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "autoresearch",
 		relativePath: "skill-fragments/autoresearch/auto-iterate.md",
+		sourcePath: autoresearchAutoIteratePath,
 		loadContent: autoresearchIterate,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "autoresearch",
 		relativePath: "skill-fragments/autoresearch/auto-critic.md",
+		sourcePath: autoresearchAutoCriticPath,
 		loadContent: autoresearchCritic,
 	},
 ];

package/src/discovery/agents.ts

@@ -79,7 +79,12 @@ async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 		scanSkillsFromDir(ctx, { dir, providerId: PROVIDER_ID, level: "project" }),
 	);
 	const userScans = getUserPathCandidates(ctx, "skills").map(dir =>
-		scanSkillsFromDir(ctx, { dir, providerId: PROVIDER_ID, level: "user" }),
+		scanSkillsFromDir(ctx, {
+			dir,
+			providerId: PROVIDER_ID,
+			level: "user",
+			allowExternalUserSkillSymlinks: ctx.allowExternalUserSkillSymlinks,
+		}),
 	);
 
 	const results = await Promise.all([...projectScans, ...userScans]);

package/src/discovery/builtin.ts

@@ -22,6 +22,7 @@ import { type SlashCommand, slashCommandCapability } from "../capability/slash-c
 import { type SystemPrompt, systemPromptCapability } from "../capability/system-prompt";
 import { type CustomTool, toolCapability } from "../capability/tool";
 import type { LoadContext, LoadResult } from "../capability/types";
+import { resolveGlobalUserSkillLinkTrust } from "../config/skill-settings-defaults";
 import { expandTilde } from "../tools/path-utils";
 import {
 	buildRuleFromMarkdown,
@@ -220,6 +221,7 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 				cwd: serverConfig.cwd as string | undefined,
 				url: serverConfig.url as string | undefined,
 				headers: serverConfig.headers as Record<string, string> | undefined,
+				publicNetwork: serverConfig.publicNetwork === true ? true : undefined,
 				auth: serverConfig.auth as
 					| {
 							type: "oauth" | "apikey";
@@ -359,6 +361,14 @@ async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 			level: "user",
 			scope: "native",
 			requireDescription: true,
+			allowExternalUserSkillSymlinks:
+				ctx.allowExternalUserSkillSymlinks ??
+				(typeof ctx.settings?.getGlobal === "function"
+					? resolveGlobalUserSkillLinkTrust({
+							trustUserSkills: ctx.settings.getGlobal("skills.trustUserSkills"),
+							enablePiUser: ctx.settings.getGlobal("skills.enablePiUser"),
+						})
+					: true),
 		}),
 	);
 

package/src/discovery/helpers.ts

@@ -203,10 +203,13 @@ export function getProjectPath(ctx: LoadContext, source: SourceId, subpath: stri
 
 /** Build the filesystem authority for a provider read. */
 export function getReadOptions(
-	ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity">,
+	ctx: Pick<
+		LoadContext,
+		"home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache"
+	>,
 	scope: ReadScope,
 ): ReadFileOptions | undefined {
-	if (!ctx.isolatedHome) return undefined;
+	if (!ctx.isolatedHome) return ctx.bypassCache ? { bypassCache: true } : undefined;
 	return {
 		isolatedHome: true,
 		home: ctx.home,
@@ -219,7 +222,10 @@ export function getReadOptions(
 }
 
 export async function getReadOptionsForContainment(
-	ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity">,
+	ctx: Pick<
+		LoadContext,
+		"home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache"
+	>,
 	scope: ReadScope,
 	containmentRoot?: string,
 ): Promise<ReadFileOptions | undefined> {
@@ -473,6 +479,8 @@ export interface ScanSkillsFromDirOptions {
 	linkContainmentRoot?: string;
 	/** Filesystem authority for explicit-home reads. */
 	scope?: ReadScope;
+	/** User-owned permission to follow symlinks outside a user-scope scan root. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 // Stable ordering used for skill lists in prompts: name (case-insensitive), then name, then path.
@@ -492,6 +500,8 @@ export const SKILL_FRONTMATTER_SCAN_TOTAL_BYTES = 64 * 1024;
 
 export const SkillDiscoveryTestHooks: {
 	afterCandidateValidated?: (candidatePath: string) => void | Promise<void>;
+	afterSkillLinksCaptured?: (candidatePath: string) => void | Promise<void>;
+	afterSkillPathResolved?: (candidatePath: string) => void | Promise<void>;
 	afterAuthorityRootValidated?: (root: string) => void | Promise<void>;
 	afterAuthorityRootMissing?: (root: string) => void | Promise<void>;
 	afterContainedRootValidated?: (root: string) => void | Promise<void>;
@@ -511,6 +521,25 @@ interface ScanRootLinkIdentity {
 	target: DirectoryIdentity;
 }
 
+interface SkillFileIdentity {
+	dev: bigint;
+	ino: bigint;
+	realPath: string;
+}
+
+interface SkillLinkIdentity {
+	path: string;
+	dev: bigint;
+	ino: bigint;
+	linkText: string;
+	target: {
+		dev: bigint;
+		ino: bigint;
+		realPath: string;
+		kind: "directory" | "file";
+	};
+}
+
 async function captureScanRootLinkIdentity(root: string): Promise<ScanRootLinkIdentity | null> {
 	const observed = await fs.promises.lstat(root, { bigint: true });
 	if (!observed.isSymbolicLink()) return null;
@@ -571,6 +600,38 @@ async function directoryIdentityIsCurrent(
 	}
 }
 
+async function captureSkillLinkIdentity(linkPath: string): Promise<SkillLinkIdentity | null> {
+	const observed = await fs.promises.lstat(linkPath, { bigint: true });
+	if (!observed.isSymbolicLink()) return null;
+	const linkText = await fs.promises.readlink(linkPath);
+	const realPath = await fs.promises.realpath(linkPath);
+	const target = await fs.promises.stat(realPath, { bigint: true });
+	const kind = target.isDirectory() ? "directory" : target.isFile() ? "file" : undefined;
+	if (!kind) return null;
+	return {
+		path: linkPath,
+		dev: observed.dev,
+		ino: observed.ino,
+		linkText,
+		target: { dev: target.dev, ino: target.ino, realPath, kind },
+	};
+}
+
+async function skillLinkIdentityIsCurrent(expected: SkillLinkIdentity): Promise<boolean> {
+	try {
+		const observed = await fs.promises.lstat(expected.path, { bigint: true });
+		if (!observed.isSymbolicLink() || observed.dev !== expected.dev || observed.ino !== expected.ino) return false;
+		if ((await fs.promises.readlink(expected.path)) !== expected.linkText) return false;
+		const realPath = await fs.promises.realpath(expected.path);
+		if (normalizePathForComparison(realPath) !== normalizePathForComparison(expected.target.realPath)) return false;
+		const target = await fs.promises.stat(realPath, { bigint: true });
+		const kind = target.isDirectory() ? "directory" : target.isFile() ? "file" : undefined;
+		return kind === expected.target.kind && target.dev === expected.target.dev && target.ino === expected.target.ino;
+	} catch {
+		return false;
+	}
+}
+
 export async function scanSkillsFromDir(
 	_ctx: LoadContext,
 	options: ScanSkillsFromDirOptions,
@@ -687,7 +748,36 @@ export async function scanSkillsFromDir(
 		const relative = path.relative(realRoot, candidate);
 		return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
 	};
-	const openSkillFileSafely = async (skillPath: string): Promise<FileHandle> => {
+	const skillPathAndLinksAreCurrent = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<boolean> => {
+		try {
+			const [realPath, currentFile, currentLinks] = await Promise.all([
+				fs.promises.realpath(skillPath),
+				expectedFile ? fs.promises.stat(expectedFile.realPath, { bigint: true }) : Promise.resolve(undefined),
+				Promise.all(linkIdentities.map(skillLinkIdentityIsCurrent)),
+			]);
+			if (!expectedFile) return isWithinRoot(realPath) && currentLinks.every(Boolean);
+			if (!currentFile) return false;
+			return (
+				normalizePathForComparison(realPath) === normalizePathForComparison(expectedFile.realPath) &&
+				currentFile.isFile() &&
+				currentFile.nlink === 1n &&
+				currentFile.dev === expectedFile.dev &&
+				currentFile.ino === expectedFile.ino &&
+				currentLinks.every(Boolean)
+			);
+		} catch {
+			return false;
+		}
+	};
+	const openSkillFileSafely = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<FileHandle> => {
 		if (
 			!(await scanRootIsCurrent()) ||
 			(options.authorityRoot &&
@@ -701,14 +791,14 @@ export async function scanSkillsFromDir(
 			(process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
 		const handle = await fs.promises.open(skillPath, flags);
 		try {
-			const [opened, observed, currentPath, currentScanRoot, currentAuthorityRoot] = await Promise.all([
+			const [opened, observed, currentScanRoot, currentAuthorityRoot, currentSkillPath] = await Promise.all([
 				handle.stat({ bigint: true }),
 				fs.promises.lstat(skillPath, { bigint: true }),
-				fs.promises.realpath(skillPath),
 				scanRootIsCurrent(),
 				options.authorityRoot && authorityIdentity
 					? directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity)
 					: true,
+				skillPathAndLinksAreCurrent(skillPath, expectedFile, linkIdentities),
 			]);
 			if (
 				!opened.isFile() ||
@@ -717,9 +807,10 @@ export async function scanSkillsFromDir(
 				!observed.isFile() ||
 				opened.dev !== observed.dev ||
 				opened.ino !== observed.ino ||
-				!isWithinRoot(currentPath) ||
+				(expectedFile !== undefined && (opened.dev !== expectedFile.dev || opened.ino !== expectedFile.ino)) ||
 				!currentScanRoot ||
-				!currentAuthorityRoot
+				!currentAuthorityRoot ||
+				!currentSkillPath
 			) {
 				throw new Error(`Unsafe skill file: ${skillPath}`);
 			}
@@ -729,15 +820,20 @@ export async function scanSkillsFromDir(
 			throw error;
 		}
 	};
-	const readSkillContentSafely = async (skillPath: string): Promise<string> => {
-		const handle = await openSkillFileSafely(skillPath);
+	const readSkillContentSafely = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<string> => {
+		const handle = await openSkillFileSafely(skillPath, expectedFile, linkIdentities);
 		try {
 			const content = await handle.readFile({ encoding: "utf8" });
 			if (
 				!(await scanRootIsCurrent()) ||
 				(options.authorityRoot &&
 					authorityIdentity &&
-					!(await directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity)))
+					!(await directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity))) ||
+				!(await skillPathAndLinksAreCurrent(skillPath, expectedFile, linkIdentities))
 			) {
 				throw new Error(`Unsafe skill authority root for: ${skillPath}`);
 			}
@@ -748,8 +844,10 @@ export async function scanSkillsFromDir(
 	};
 	const readSkillFrontmatterSafely = async (
 		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
 	): Promise<{ frontmatter: SkillFrontmatter | null; size: number }> => {
-		const handle = await openSkillFileSafely(skillPath);
+		const handle = await openSkillFileSafely(skillPath, expectedFile, linkIdentities);
 		try {
 			const size = Number((await handle.stat({ bigint: true })).size);
 			const scanLimit = Math.min(size, SKILL_FRONTMATTER_SCAN_TOTAL_BYTES);
@@ -782,18 +880,55 @@ export async function scanSkillsFromDir(
 	};
 	const loadSkill = async (candidatePath: string) => {
 		try {
+			const linkIdentities = (
+				await Promise.all([
+					captureSkillLinkIdentity(path.dirname(candidatePath)),
+					captureSkillLinkIdentity(candidatePath),
+				])
+			).filter((identity): identity is SkillLinkIdentity => identity !== null);
+			await SkillDiscoveryTestHooks.afterSkillLinksCaptured?.(candidatePath);
 			const skillPath = await fs.promises.realpath(candidatePath);
-			if (!isWithinRoot(skillPath)) {
-				warnings.push(`Refusing skill path outside scan root: ${candidatePath}`);
+			await SkillDiscoveryTestHooks.afterSkillPathResolved?.(candidatePath);
+			const allowOutsideRoot = options.allowExternalUserSkillSymlinks && level === "user";
+			if (!isWithinRoot(skillPath) && !allowOutsideRoot) {
+				const remedy =
+					level === "user"
+						? `add ${path.dirname(path.dirname(skillPath))} to skills.customDirectories to load it, or enable skills.trustUserSkills`
+						: "keep project skill targets inside the skills scan root";
+				warnings.push(
+					`Refusing skill path outside scan root: ${candidatePath} (resolves to ${skillPath}; ${remedy})`,
+				);
 				return;
 			}
-			const stat = await fs.promises.stat(skillPath);
-			if (!stat.isFile() || stat.nlink !== 1) {
+			const stat = await fs.promises.stat(skillPath, { bigint: true });
+			if (!stat.isFile() || stat.nlink !== 1n) {
 				warnings.push(`Skill path is not a regular file: ${candidatePath}`);
 				return;
 			}
+			const pinExternalTarget = !isWithinRoot(skillPath) && allowOutsideRoot;
+			const fileLink = linkIdentities.find(identity => identity.path === candidatePath);
+			const parentLink = linkIdentities.find(identity => identity.path === path.dirname(candidatePath));
+			let capturedLinkTargetPath: string | undefined;
+			if (fileLink?.target.kind === "file") {
+				capturedLinkTargetPath = fileLink.target.realPath;
+			} else if (parentLink?.target.kind === "directory") {
+				capturedLinkTargetPath = path.join(parentLink.target.realPath, path.basename(candidatePath));
+			}
+			if (
+				pinExternalTarget &&
+				(!capturedLinkTargetPath ||
+					normalizePathForComparison(skillPath) !== normalizePathForComparison(capturedLinkTargetPath))
+			) {
+				warnings.push(`Refusing skill path not bound to its captured external link target: ${candidatePath}`);
+				return;
+			}
+			const fileIdentity = pinExternalTarget ? { dev: stat.dev, ino: stat.ino, realPath: skillPath } : undefined;
+			const pinnedLinkIdentities = pinExternalTarget ? linkIdentities : [];
 			await SkillDiscoveryTestHooks.afterCandidateValidated?.(candidatePath);
-			const { frontmatter, size } = await readSkillFrontmatterSafely(skillPath);
+			const { frontmatter, size } = await readSkillFrontmatterSafely(skillPath, fileIdentity, pinnedLinkIdentities);
+			if (!(await skillPathAndLinksAreCurrent(skillPath, fileIdentity, pinnedLinkIdentities))) {
+				throw new Error(`Unsafe skill link for: ${candidatePath}`);
+			}
 			if (!frontmatter) {
 				if (size > SKILL_FRONTMATTER_SCAN_TOTAL_BYTES) {
 					warnings.push(
@@ -817,8 +952,9 @@ export async function scanSkillsFromDir(
 			items.push({
 				name,
 				path: skillPath,
+				discoveryPath: candidatePath,
 				loadContent: async () => {
-					const content = await readSkillContentSafely(skillPath);
+					const content = await readSkillContentSafely(skillPath, fileIdentity, pinnedLinkIdentities);
 					return parseFrontmatter(content, { source: skillPath }).body;
 				},
 				frontmatter: frontmatter as SkillFrontmatter,
@@ -917,8 +1053,17 @@ export async function readContainedFile(
  * Expand environment variables in a string.
  * Supports ${VAR} and ${VAR:-default} syntax.
  */
-function expandEnvVars(value: string, extraEnv?: Record<string, string>): string {
+const SENSITIVE_ENV_NAME = /key|secret|token|pass|auth|credential|cookie|dsn|url$/i;
+
+export function isSensitiveEnvName(name: string): boolean {
+	return SENSITIVE_ENV_NAME.test(name);
+}
+
+function expandEnvVars(value: string, extraEnv?: Record<string, string>, skipSensitiveNames = false): string {
 	return value.replace(/\$\{([^}:]+)(?::-([^}]*))?\}/g, (_, varName: string, defaultValue?: string) => {
+		if (skipSensitiveNames && isSensitiveEnvName(varName)) {
+			return defaultValue !== undefined ? defaultValue : `\${${varName}}`;
+		}
 		const envValue = extraEnv?.[varName] ?? Bun.env[varName];
 		if (envValue !== undefined) return envValue;
 		if (defaultValue !== undefined) return defaultValue;
@@ -929,17 +1074,17 @@ function expandEnvVars(value: string, extraEnv?: Record<string, string>): string
 /**
  * Recursively expand environment variables in an object.
  */
-export function expandEnvVarsDeep<T>(obj: T, extraEnv?: Record<string, string>): T {
+export function expandEnvVarsDeep<T>(obj: T, extraEnv?: Record<string, string>, skipSensitiveNames = false): T {
 	if (typeof obj === "string") {
-		return expandEnvVars(obj, extraEnv) as T;
+		return expandEnvVars(obj, extraEnv, skipSensitiveNames) as T;
 	}
 	if (Array.isArray(obj)) {
-		return obj.map(item => expandEnvVarsDeep(item, extraEnv)) as T;
+		return obj.map(item => expandEnvVarsDeep(item, extraEnv, skipSensitiveNames)) as T;
 	}
 	if (obj !== null && typeof obj === "object") {
 		const result: Record<string, unknown> = {};
 		for (const [key, value] of Object.entries(obj)) {
-			result[key] = expandEnvVarsDeep(value, extraEnv);
+			result[key] = expandEnvVarsDeep(value, extraEnv, skipSensitiveNames);
 		}
 		return result as T;
 	}

package/src/discovery/mcp-json.ts

@@ -217,6 +217,12 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta, quiet = f
 				cwd: serverConfig.cwd,
 				url: serverConfig.url,
 				headers: serverConfig.headers,
+				publicNetwork:
+					serverConfig.type === "http" &&
+					"publicNetwork" in serverConfig &&
+					(serverConfig as { publicNetwork?: boolean }).publicNetwork === true
+						? true
+						: undefined,
 				auth: serverConfig.auth,
 				oauth: serverConfig.oauth,
 				transport: serverConfig.type,

package/src/discovery/ssh.ts

@@ -34,9 +34,14 @@ interface SSHConfigFile {
 
 function parsePort(value: number | string | undefined): number | undefined {
 	if (value === undefined) return undefined;
-	if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
-	const parsed = Number.parseInt(value, 10);
-	return Number.isNaN(parsed) ? undefined : parsed;
+	// The JSON is not validated against SSHConfigFile, so anything else (e.g. an
+	// array, which parseInt would coerce: parseInt([2222]) === 2222) is rejected.
+	if (typeof value !== "number" && typeof value !== "string") return undefined;
+	// `Number.parseInt` accepts trailing garbage (parseInt("22oops") === 22), so a
+	// string must be plain digits.
+	if (typeof value === "string" && !/^\d+$/.test(value)) return undefined;
+	const port = typeof value === "number" ? value : Number.parseInt(value, 10);
+	return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : undefined;
 }
 
 function parseCompat(value: boolean | string | undefined): boolean | undefined {
@@ -114,7 +119,7 @@ async function loadSshJsonFile(
 		warnings.push(`Failed to parse JSON in ${canonicalPath}`);
 		return { items, warnings };
 	}
-	const config = expandEnvVarsDeep(parsed);
+	const config = expandEnvVarsDeep(parsed, undefined, level === "project");
 	if (!config.hosts || typeof config.hosts !== "object") {
 		warnings.push(`Missing hosts in ${canonicalPath}`);
 		return { items, warnings };

package/src/discovery/substitute-plugin-root.ts

@@ -8,7 +8,9 @@ const GJC_VAR = "$" + "{GJC_PLUGIN_ROOT}";
 
 export function substitutePluginRoot<T>(value: T, rootPath: string): T {
 	if (typeof value === "string") {
-		return value.replaceAll(CLAUDE_VAR, rootPath).replaceAll(GJC_VAR, rootPath) as T;
+		// Function replacers: a string replacement would expand `$&`, `$$`, `` $` ``
+		// and `$'` inside the install path instead of inserting it verbatim.
+		return value.replaceAll(CLAUDE_VAR, () => rootPath).replaceAll(GJC_VAR, () => rootPath) as T;
 	}
 	if (Array.isArray(value)) {
 		return value.map(v => substitutePluginRoot(v, rootPath)) as T;

package/src/edit/file-read-cache.ts

@@ -27,7 +27,7 @@ import type { ToolSession } from "../tools";
 
 const MAX_PATHS_PER_SESSION = 30;
 /** Snapshot generations retained per path (newest first). */
-const MAX_GENERATIONS_PER_PATH = 4;
+const MAX_GENERATIONS_PER_PATH = 8;
 
 export interface FileReadSnapshot {
 	/** 1-indexed line number → exact line content as observed by `read`/`search`. */