@gajae-code/coding-agent 0.18.7 → 0.18.9

package/src/defaults/gjc-skills.generated.ts

@@ -1,9 +1,34 @@
 /**
  * Generated bundled GJC workflow skill catalog.
  *
- * Keep this module metadata-only: skill bodies are loaded through literal
- * dynamic imports only when a caller asks for their content.
+ * Keep this module metadata-only: skill bodies are read from their embedded
+ * `type: "file"` paths only when a caller asks for their content. Do not also
+ * import a body with `type: "text"`: Bun caches a module per specifier, so the
+ * second import of the same file would return the first one's value.
  */
+import { readFile } from "node:fs/promises";
+import autoresearchAutoCriticPath from "./gjc/skills/autoresearch/auto-critic.md" with { type: "file" };
+import autoresearchAutoIteratePath from "./gjc/skills/autoresearch/auto-iterate.md" with { type: "file" };
+import autoresearchSkillPath from "./gjc/skills/autoresearch/SKILL.md" with { type: "file" };
+import deepInterviewAutoAnswerUncertainPath from "./gjc/skills/deep-interview/auto-answer-uncertain.md" with {
+	type: "file",
+};
+import deepInterviewLateralReviewPanelPath from "./gjc/skills/deep-interview/lateral-review-panel.md" with {
+	type: "file",
+};
+import deepInterviewSkillPath from "./gjc/skills/deep-interview/SKILL.md" with { type: "file" };
+import ralplanSkillPath from "./gjc/skills/ralplan/SKILL.md" with { type: "file" };
+import ultragoalAiSlopCleanerPath from "./gjc/skills/ultragoal/ai-slop-cleaner.md" with { type: "file" };
+import ultragoalBoundaryCohortGatePath from "./gjc/skills/ultragoal/boundary-cohort-gate.md" with { type: "file" };
+import ultragoalCrossRepositorySuccessionPath from "./gjc/skills/ultragoal/cross-repository-succession.md" with {
+	type: "file",
+};
+import ultragoalSkillPath from "./gjc/skills/ultragoal/SKILL.md" with { type: "file" };
+import ultragoalTerminalCriticGatePath from "./gjc/skills/ultragoal/terminal-critic-gate.md" with { type: "file" };
+import ultragoalValidationBatchContractsPath from "./gjc/skills/ultragoal/validation-batch-contracts.md" with {
+	type: "file",
+};
+
 export type BundledGjcSkillName = "autoresearch" | "deep-interview" | "ralplan" | "ultragoal";
 
 export interface BundledGjcSkillCatalogEntry {
@@ -12,49 +37,34 @@ export interface BundledGjcSkillCatalogEntry {
 	readonly parentSkillName?: BundledGjcSkillName;
 	readonly relativePath: string;
 	readonly description?: string;
+	/**
+	 * Path of the bundled body. A `type: "file"` import, so `bun build --compile`
+	 * embeds the file and this resolves inside `/$bunfs` in compiled binaries.
+	 */
+	readonly sourcePath?: string;
 	readonly loadContent: () => Promise<string>;
 }
 
-const deepInterview = () =>
-	import("./gjc/skills/deep-interview/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const ralplan = () =>
-	import("./gjc/skills/ralplan/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const autoresearch = () =>
-	import("./gjc/skills/autoresearch/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const ultragoal = () =>
-	import("./gjc/skills/ultragoal/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const autoAnswerUncertain = () =>
-	import("./gjc/skills/deep-interview/auto-answer-uncertain.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const lateralReviewPanel = () =>
-	import("./gjc/skills/deep-interview/lateral-review-panel.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const aiSlopCleaner = () =>
-	import("./gjc/skills/ultragoal/ai-slop-cleaner.md", { with: { type: "text" } }).then(module => module.default);
-const validationBatchContracts = () =>
-	import("./gjc/skills/ultragoal/validation-batch-contracts.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const boundaryCohortGate = () =>
-	import("./gjc/skills/ultragoal/boundary-cohort-gate.md", { with: { type: "text" } }).then(module => module.default);
-const terminalCriticGate = () =>
-	import("./gjc/skills/ultragoal/terminal-critic-gate.md", { with: { type: "text" } }).then(module => module.default);
-const crossRepositorySuccession = () =>
-	import("./gjc/skills/ultragoal/cross-repository-succession.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
-const autoresearchIterate = () =>
-	import("./gjc/skills/autoresearch/auto-iterate.md", { with: { type: "text" } }).then(module => module.default);
-const autoresearchCritic = () =>
-	import("./gjc/skills/autoresearch/auto-critic.md", { with: { type: "text" } }).then(module => module.default);
+const deepInterview = () => readFile(deepInterviewSkillPath, "utf8");
+const ralplan = () => readFile(ralplanSkillPath, "utf8");
+const autoresearch = () => readFile(autoresearchSkillPath, "utf8");
+const ultragoal = () => readFile(ultragoalSkillPath, "utf8");
+const autoAnswerUncertain = () => readFile(deepInterviewAutoAnswerUncertainPath, "utf8");
+const lateralReviewPanel = () => readFile(deepInterviewLateralReviewPanelPath, "utf8");
+const aiSlopCleaner = () => readFile(ultragoalAiSlopCleanerPath, "utf8");
+const validationBatchContracts = () => readFile(ultragoalValidationBatchContractsPath, "utf8");
+const boundaryCohortGate = () => readFile(ultragoalBoundaryCohortGatePath, "utf8");
+const terminalCriticGate = () => readFile(ultragoalTerminalCriticGatePath, "utf8");
+const crossRepositorySuccession = () => readFile(ultragoalCrossRepositorySuccessionPath, "utf8");
+const autoresearchIterate = () => readFile(autoresearchAutoIteratePath, "utf8");
+const autoresearchCritic = () => readFile(autoresearchAutoCriticPath, "utf8");
 
 export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] = [
 	{
 		kind: "skill",
 		name: "deep-interview",
 		relativePath: "skills/deep-interview/SKILL.md",
+		sourcePath: deepInterviewSkillPath,
 		description: "Socratic deep interview with mathematical ambiguity gating before explicit execution approval",
 		loadContent: deepInterview,
 	},
@@ -62,6 +72,7 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "ralplan",
 		relativePath: "skills/ralplan/SKILL.md",
+		sourcePath: ralplanSkillPath,
 		description: "Consensus planning entrypoint that auto-gates vague ultragoal requests before execution",
 		loadContent: ralplan,
 	},
@@ -69,6 +80,7 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "autoresearch",
 		relativePath: "skills/autoresearch/SKILL.md",
+		sourcePath: autoresearchSkillPath,
 		description: "Goal-directed research missions interleaving web and data evidence into a structured verdict",
 		loadContent: autoresearch,
 	},
@@ -76,6 +88,7 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "ultragoal",
 		relativePath: "skills/ultragoal/SKILL.md",
+		sourcePath: ultragoalSkillPath,
 		description: "Create and execute durable repo-native multi-goal plans over GJC goal mode artifacts.",
 		loadContent: ultragoal,
 	},
@@ -83,54 +96,63 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill-fragment",
 		parentSkillName: "deep-interview",
 		relativePath: "skill-fragments/deep-interview/auto-answer-uncertain.md",
+		sourcePath: deepInterviewAutoAnswerUncertainPath,
 		loadContent: autoAnswerUncertain,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "deep-interview",
 		relativePath: "skill-fragments/deep-interview/lateral-review-panel.md",
+		sourcePath: deepInterviewLateralReviewPanelPath,
 		loadContent: lateralReviewPanel,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/ai-slop-cleaner.md",
+		sourcePath: ultragoalAiSlopCleanerPath,
 		loadContent: aiSlopCleaner,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/validation-batch-contracts.md",
+		sourcePath: ultragoalValidationBatchContractsPath,
 		loadContent: validationBatchContracts,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/boundary-cohort-gate.md",
+		sourcePath: ultragoalBoundaryCohortGatePath,
 		loadContent: boundaryCohortGate,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/terminal-critic-gate.md",
+		sourcePath: ultragoalTerminalCriticGatePath,
 		loadContent: terminalCriticGate,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "ultragoal",
 		relativePath: "skill-fragments/ultragoal/cross-repository-succession.md",
+		sourcePath: ultragoalCrossRepositorySuccessionPath,
 		loadContent: crossRepositorySuccession,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "autoresearch",
 		relativePath: "skill-fragments/autoresearch/auto-iterate.md",
+		sourcePath: autoresearchAutoIteratePath,
 		loadContent: autoresearchIterate,
 	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "autoresearch",
 		relativePath: "skill-fragments/autoresearch/auto-critic.md",
+		sourcePath: autoresearchAutoCriticPath,
 		loadContent: autoresearchCritic,
 	},
 ];

package/src/discovery/agents.ts

@@ -79,7 +79,12 @@ async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 		scanSkillsFromDir(ctx, { dir, providerId: PROVIDER_ID, level: "project" }),
 	);
 	const userScans = getUserPathCandidates(ctx, "skills").map(dir =>
-		scanSkillsFromDir(ctx, { dir, providerId: PROVIDER_ID, level: "user" }),
+		scanSkillsFromDir(ctx, {
+			dir,
+			providerId: PROVIDER_ID,
+			level: "user",
+			allowExternalUserSkillSymlinks: ctx.allowExternalUserSkillSymlinks,
+		}),
 	);
 
 	const results = await Promise.all([...projectScans, ...userScans]);

package/src/discovery/builtin.ts

@@ -22,6 +22,7 @@ import { type SlashCommand, slashCommandCapability } from "../capability/slash-c
 import { type SystemPrompt, systemPromptCapability } from "../capability/system-prompt";
 import { type CustomTool, toolCapability } from "../capability/tool";
 import type { LoadContext, LoadResult } from "../capability/types";
+import { resolveGlobalUserSkillLinkTrust } from "../config/skill-settings-defaults";
 import { expandTilde } from "../tools/path-utils";
 import {
 	buildRuleFromMarkdown,
@@ -137,7 +138,9 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 		const data = tryParseJson<{ mcpServers?: Record<string, unknown> }>(content);
 		if (!data?.mcpServers) return result;
 
-		const expanded = expandEnvVarsDeep(data.mcpServers);
+		// Project mcp.json is repo content. Skip secret-named ${VAR} the same way
+		// project ssh.json does; user scope still expands those names.
+		const expanded = expandEnvVarsDeep(data.mcpServers, undefined, level === "project");
 		for (const [serverName, config] of Object.entries(expanded)) {
 			const serverConfig = config as Record<string, unknown>;
 
@@ -220,6 +223,7 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 				cwd: serverConfig.cwd as string | undefined,
 				url: serverConfig.url as string | undefined,
 				headers: serverConfig.headers as Record<string, string> | undefined,
+				publicNetwork: serverConfig.publicNetwork === true ? true : undefined,
 				auth: serverConfig.auth as
 					| {
 							type: "oauth" | "apikey";
@@ -359,6 +363,14 @@ async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 			level: "user",
 			scope: "native",
 			requireDescription: true,
+			allowExternalUserSkillSymlinks:
+				ctx.allowExternalUserSkillSymlinks ??
+				(typeof ctx.settings?.getGlobal === "function"
+					? resolveGlobalUserSkillLinkTrust({
+							trustUserSkills: ctx.settings.getGlobal("skills.trustUserSkills"),
+							enablePiUser: ctx.settings.getGlobal("skills.enablePiUser"),
+						})
+					: true),
 		}),
 	);
 

package/src/discovery/helpers.ts

@@ -479,6 +479,8 @@ export interface ScanSkillsFromDirOptions {
 	linkContainmentRoot?: string;
 	/** Filesystem authority for explicit-home reads. */
 	scope?: ReadScope;
+	/** User-owned permission to follow symlinks outside a user-scope scan root. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 // Stable ordering used for skill lists in prompts: name (case-insensitive), then name, then path.
@@ -498,6 +500,8 @@ export const SKILL_FRONTMATTER_SCAN_TOTAL_BYTES = 64 * 1024;
 
 export const SkillDiscoveryTestHooks: {
 	afterCandidateValidated?: (candidatePath: string) => void | Promise<void>;
+	afterSkillLinksCaptured?: (candidatePath: string) => void | Promise<void>;
+	afterSkillPathResolved?: (candidatePath: string) => void | Promise<void>;
 	afterAuthorityRootValidated?: (root: string) => void | Promise<void>;
 	afterAuthorityRootMissing?: (root: string) => void | Promise<void>;
 	afterContainedRootValidated?: (root: string) => void | Promise<void>;
@@ -517,6 +521,25 @@ interface ScanRootLinkIdentity {
 	target: DirectoryIdentity;
 }
 
+interface SkillFileIdentity {
+	dev: bigint;
+	ino: bigint;
+	realPath: string;
+}
+
+interface SkillLinkIdentity {
+	path: string;
+	dev: bigint;
+	ino: bigint;
+	linkText: string;
+	target: {
+		dev: bigint;
+		ino: bigint;
+		realPath: string;
+		kind: "directory" | "file";
+	};
+}
+
 async function captureScanRootLinkIdentity(root: string): Promise<ScanRootLinkIdentity | null> {
 	const observed = await fs.promises.lstat(root, { bigint: true });
 	if (!observed.isSymbolicLink()) return null;
@@ -577,6 +600,38 @@ async function directoryIdentityIsCurrent(
 	}
 }
 
+async function captureSkillLinkIdentity(linkPath: string): Promise<SkillLinkIdentity | null> {
+	const observed = await fs.promises.lstat(linkPath, { bigint: true });
+	if (!observed.isSymbolicLink()) return null;
+	const linkText = await fs.promises.readlink(linkPath);
+	const realPath = await fs.promises.realpath(linkPath);
+	const target = await fs.promises.stat(realPath, { bigint: true });
+	const kind = target.isDirectory() ? "directory" : target.isFile() ? "file" : undefined;
+	if (!kind) return null;
+	return {
+		path: linkPath,
+		dev: observed.dev,
+		ino: observed.ino,
+		linkText,
+		target: { dev: target.dev, ino: target.ino, realPath, kind },
+	};
+}
+
+async function skillLinkIdentityIsCurrent(expected: SkillLinkIdentity): Promise<boolean> {
+	try {
+		const observed = await fs.promises.lstat(expected.path, { bigint: true });
+		if (!observed.isSymbolicLink() || observed.dev !== expected.dev || observed.ino !== expected.ino) return false;
+		if ((await fs.promises.readlink(expected.path)) !== expected.linkText) return false;
+		const realPath = await fs.promises.realpath(expected.path);
+		if (normalizePathForComparison(realPath) !== normalizePathForComparison(expected.target.realPath)) return false;
+		const target = await fs.promises.stat(realPath, { bigint: true });
+		const kind = target.isDirectory() ? "directory" : target.isFile() ? "file" : undefined;
+		return kind === expected.target.kind && target.dev === expected.target.dev && target.ino === expected.target.ino;
+	} catch {
+		return false;
+	}
+}
+
 export async function scanSkillsFromDir(
 	_ctx: LoadContext,
 	options: ScanSkillsFromDirOptions,
@@ -693,7 +748,36 @@ export async function scanSkillsFromDir(
 		const relative = path.relative(realRoot, candidate);
 		return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
 	};
-	const openSkillFileSafely = async (skillPath: string): Promise<FileHandle> => {
+	const skillPathAndLinksAreCurrent = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<boolean> => {
+		try {
+			const [realPath, currentFile, currentLinks] = await Promise.all([
+				fs.promises.realpath(skillPath),
+				expectedFile ? fs.promises.stat(expectedFile.realPath, { bigint: true }) : Promise.resolve(undefined),
+				Promise.all(linkIdentities.map(skillLinkIdentityIsCurrent)),
+			]);
+			if (!expectedFile) return isWithinRoot(realPath) && currentLinks.every(Boolean);
+			if (!currentFile) return false;
+			return (
+				normalizePathForComparison(realPath) === normalizePathForComparison(expectedFile.realPath) &&
+				currentFile.isFile() &&
+				currentFile.nlink === 1n &&
+				currentFile.dev === expectedFile.dev &&
+				currentFile.ino === expectedFile.ino &&
+				currentLinks.every(Boolean)
+			);
+		} catch {
+			return false;
+		}
+	};
+	const openSkillFileSafely = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<FileHandle> => {
 		if (
 			!(await scanRootIsCurrent()) ||
 			(options.authorityRoot &&
@@ -707,14 +791,14 @@ export async function scanSkillsFromDir(
 			(process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
 		const handle = await fs.promises.open(skillPath, flags);
 		try {
-			const [opened, observed, currentPath, currentScanRoot, currentAuthorityRoot] = await Promise.all([
+			const [opened, observed, currentScanRoot, currentAuthorityRoot, currentSkillPath] = await Promise.all([
 				handle.stat({ bigint: true }),
 				fs.promises.lstat(skillPath, { bigint: true }),
-				fs.promises.realpath(skillPath),
 				scanRootIsCurrent(),
 				options.authorityRoot && authorityIdentity
 					? directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity)
 					: true,
+				skillPathAndLinksAreCurrent(skillPath, expectedFile, linkIdentities),
 			]);
 			if (
 				!opened.isFile() ||
@@ -723,9 +807,10 @@ export async function scanSkillsFromDir(
 				!observed.isFile() ||
 				opened.dev !== observed.dev ||
 				opened.ino !== observed.ino ||
-				!isWithinRoot(currentPath) ||
+				(expectedFile !== undefined && (opened.dev !== expectedFile.dev || opened.ino !== expectedFile.ino)) ||
 				!currentScanRoot ||
-				!currentAuthorityRoot
+				!currentAuthorityRoot ||
+				!currentSkillPath
 			) {
 				throw new Error(`Unsafe skill file: ${skillPath}`);
 			}
@@ -735,15 +820,20 @@ export async function scanSkillsFromDir(
 			throw error;
 		}
 	};
-	const readSkillContentSafely = async (skillPath: string): Promise<string> => {
-		const handle = await openSkillFileSafely(skillPath);
+	const readSkillContentSafely = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<string> => {
+		const handle = await openSkillFileSafely(skillPath, expectedFile, linkIdentities);
 		try {
 			const content = await handle.readFile({ encoding: "utf8" });
 			if (
 				!(await scanRootIsCurrent()) ||
 				(options.authorityRoot &&
 					authorityIdentity &&
-					!(await directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity)))
+					!(await directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity))) ||
+				!(await skillPathAndLinksAreCurrent(skillPath, expectedFile, linkIdentities))
 			) {
 				throw new Error(`Unsafe skill authority root for: ${skillPath}`);
 			}
@@ -754,8 +844,10 @@ export async function scanSkillsFromDir(
 	};
 	const readSkillFrontmatterSafely = async (
 		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
 	): Promise<{ frontmatter: SkillFrontmatter | null; size: number }> => {
-		const handle = await openSkillFileSafely(skillPath);
+		const handle = await openSkillFileSafely(skillPath, expectedFile, linkIdentities);
 		try {
 			const size = Number((await handle.stat({ bigint: true })).size);
 			const scanLimit = Math.min(size, SKILL_FRONTMATTER_SCAN_TOTAL_BYTES);
@@ -786,20 +878,64 @@ export async function scanSkillsFromDir(
 			await handle.close();
 		}
 	};
-	const loadSkill = async (candidatePath: string) => {
+	const loadSkill = async (candidatePath: string, expectedCanonicalPath?: string) => {
 		try {
+			const linkIdentities = (
+				await Promise.all([
+					captureSkillLinkIdentity(path.dirname(candidatePath)),
+					captureSkillLinkIdentity(candidatePath),
+				])
+			).filter((identity): identity is SkillLinkIdentity => identity !== null);
+			await SkillDiscoveryTestHooks.afterSkillLinksCaptured?.(candidatePath);
 			const skillPath = await fs.promises.realpath(candidatePath);
-			if (!isWithinRoot(skillPath)) {
-				warnings.push(`Refusing skill path outside scan root: ${candidatePath}`);
+			await SkillDiscoveryTestHooks.afterSkillPathResolved?.(candidatePath);
+			if (
+				expectedCanonicalPath &&
+				normalizePathForComparison(skillPath) !== normalizePathForComparison(expectedCanonicalPath)
+			) {
+				warnings.push(`Refusing changed skill path during isolated-home scan: ${candidatePath}`);
+				return;
+			}
+			const allowOutsideRoot = options.allowExternalUserSkillSymlinks && level === "user";
+			if (!isWithinRoot(skillPath) && !allowOutsideRoot) {
+				const remedy =
+					level === "user"
+						? `add ${path.dirname(path.dirname(skillPath))} to skills.customDirectories to load it, or enable skills.trustUserSkills`
+						: "keep project skill targets inside the skills scan root";
+				warnings.push(
+					`Refusing skill path outside scan root: ${candidatePath} (resolves to ${skillPath}; ${remedy})`,
+				);
 				return;
 			}
-			const stat = await fs.promises.stat(skillPath);
-			if (!stat.isFile() || stat.nlink !== 1) {
+			const stat = await fs.promises.stat(skillPath, { bigint: true });
+			if (!stat.isFile() || stat.nlink !== 1n) {
 				warnings.push(`Skill path is not a regular file: ${candidatePath}`);
 				return;
 			}
+			const pinExternalTarget = !isWithinRoot(skillPath) && allowOutsideRoot;
+			const fileLink = linkIdentities.find(identity => identity.path === candidatePath);
+			const parentLink = linkIdentities.find(identity => identity.path === path.dirname(candidatePath));
+			let capturedLinkTargetPath: string | undefined;
+			if (fileLink?.target.kind === "file") {
+				capturedLinkTargetPath = fileLink.target.realPath;
+			} else if (parentLink?.target.kind === "directory") {
+				capturedLinkTargetPath = path.join(parentLink.target.realPath, path.basename(candidatePath));
+			}
+			if (
+				pinExternalTarget &&
+				(!capturedLinkTargetPath ||
+					normalizePathForComparison(skillPath) !== normalizePathForComparison(capturedLinkTargetPath))
+			) {
+				warnings.push(`Refusing skill path not bound to its captured external link target: ${candidatePath}`);
+				return;
+			}
+			const fileIdentity = pinExternalTarget ? { dev: stat.dev, ino: stat.ino, realPath: skillPath } : undefined;
+			const pinnedLinkIdentities = pinExternalTarget ? linkIdentities : [];
 			await SkillDiscoveryTestHooks.afterCandidateValidated?.(candidatePath);
-			const { frontmatter, size } = await readSkillFrontmatterSafely(skillPath);
+			const { frontmatter, size } = await readSkillFrontmatterSafely(skillPath, fileIdentity, pinnedLinkIdentities);
+			if (!(await skillPathAndLinksAreCurrent(skillPath, fileIdentity, pinnedLinkIdentities))) {
+				throw new Error(`Unsafe skill link for: ${candidatePath}`);
+			}
 			if (!frontmatter) {
 				if (size > SKILL_FRONTMATTER_SCAN_TOTAL_BYTES) {
 					warnings.push(
@@ -823,8 +959,9 @@ export async function scanSkillsFromDir(
 			items.push({
 				name,
 				path: skillPath,
+				discoveryPath: candidatePath,
 				loadContent: async () => {
-					const content = await readSkillContentSafely(skillPath);
+					const content = await readSkillContentSafely(skillPath, fileIdentity, pinnedLinkIdentities);
 					return parseFrontmatter(content, { source: skillPath }).body;
 				},
 				frontmatter: frontmatter as SkillFrontmatter,
@@ -841,14 +978,10 @@ export async function scanSkillsFromDir(
 	for (const entry of entries) {
 		if (entry.name.startsWith(".")) continue;
 		if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-		const skillPath = await canonicalizePathWithinHome(
-			_ctx,
-			path.join(scanDir, entry.name, "SKILL.md"),
-			containmentRoot,
-			scope,
-		);
-		if (!skillPath) continue;
-		work.push(loadSkill(skillPath));
+		const candidatePath = path.join(scanDir, entry.name, "SKILL.md");
+		const canonicalSkillPath = await canonicalizePathWithinHome(_ctx, candidatePath, containmentRoot, scope);
+		if (!canonicalSkillPath) continue;
+		work.push(loadSkill(candidatePath, _ctx.isolatedHome ? canonicalSkillPath : undefined));
 	}
 	await Promise.all(work);
 
@@ -923,8 +1056,17 @@ export async function readContainedFile(
  * Expand environment variables in a string.
  * Supports ${VAR} and ${VAR:-default} syntax.
  */
-function expandEnvVars(value: string, extraEnv?: Record<string, string>): string {
+const SENSITIVE_ENV_NAME = /key|secret|token|pass|auth|credential|cookie|dsn|url$/i;
+
+export function isSensitiveEnvName(name: string): boolean {
+	return SENSITIVE_ENV_NAME.test(name);
+}
+
+function expandEnvVars(value: string, extraEnv?: Record<string, string>, skipSensitiveNames = false): string {
 	return value.replace(/\$\{([^}:]+)(?::-([^}]*))?\}/g, (_, varName: string, defaultValue?: string) => {
+		if (skipSensitiveNames && isSensitiveEnvName(varName)) {
+			return defaultValue !== undefined ? defaultValue : `\${${varName}}`;
+		}
 		const envValue = extraEnv?.[varName] ?? Bun.env[varName];
 		if (envValue !== undefined) return envValue;
 		if (defaultValue !== undefined) return defaultValue;
@@ -935,17 +1077,17 @@ function expandEnvVars(value: string, extraEnv?: Record<string, string>): string
 /**
  * Recursively expand environment variables in an object.
  */
-export function expandEnvVarsDeep<T>(obj: T, extraEnv?: Record<string, string>): T {
+export function expandEnvVarsDeep<T>(obj: T, extraEnv?: Record<string, string>, skipSensitiveNames = false): T {
 	if (typeof obj === "string") {
-		return expandEnvVars(obj, extraEnv) as T;
+		return expandEnvVars(obj, extraEnv, skipSensitiveNames) as T;
 	}
 	if (Array.isArray(obj)) {
-		return obj.map(item => expandEnvVarsDeep(item, extraEnv)) as T;
+		return obj.map(item => expandEnvVarsDeep(item, extraEnv, skipSensitiveNames)) as T;
 	}
 	if (obj !== null && typeof obj === "object") {
 		const result: Record<string, unknown> = {};
 		for (const [key, value] of Object.entries(obj)) {
-			result[key] = expandEnvVarsDeep(value, extraEnv);
+			result[key] = expandEnvVarsDeep(value, extraEnv, skipSensitiveNames);
 		}
 		return result as T;
 	}

package/src/discovery/mcp-json.ts

@@ -154,7 +154,12 @@ function validateExactMCPConfig(config: unknown): {
 /**
  * Transform raw MCP config to canonical MCPServer format.
  */
-function transformMCPConfig(config: MCPConfigFile, source: SourceMeta, quiet = false): MCPServer[] {
+function transformMCPConfig(
+	config: MCPConfigFile,
+	source: SourceMeta,
+	quiet = false,
+	skipSensitiveEnvNames = false,
+): MCPServer[] {
 	const servers: MCPServer[] = [];
 
 	if (config.mcpServers) {
@@ -217,21 +222,29 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta, quiet = f
 				cwd: serverConfig.cwd,
 				url: serverConfig.url,
 				headers: serverConfig.headers,
+				publicNetwork:
+					serverConfig.type === "http" &&
+					"publicNetwork" in serverConfig &&
+					(serverConfig as { publicNetwork?: boolean }).publicNetwork === true
+						? true
+						: undefined,
 				auth: serverConfig.auth,
 				oauth: serverConfig.oauth,
 				transport: serverConfig.type,
 				_source: source,
 			};
 
-			// Expand environment variables
-			if (server.command) server.command = expandEnvVarsDeep(server.command);
-			if (server.args) server.args = expandEnvVarsDeep(server.args);
-			if (server.env) server.env = expandEnvVarsDeep(server.env);
-			if (server.cwd) server.cwd = expandEnvVarsDeep(server.cwd);
-			if (server.url) server.url = expandEnvVarsDeep(server.url);
-			if (server.headers) server.headers = expandEnvVarsDeep(server.headers);
-			if (server.auth) server.auth = expandEnvVarsDeep(server.auth);
-			if (server.oauth) server.oauth = expandEnvVarsDeep(server.oauth);
+			// Repo-root mcp.json is project content. Exact `--mcp-config` passes
+			// skipSensitiveEnvNames false so a trusted file can still reference secrets.
+			const expand = <T>(value: T): T => expandEnvVarsDeep(value, undefined, skipSensitiveEnvNames);
+			if (server.command) server.command = expand(server.command);
+			if (server.args) server.args = expand(server.args);
+			if (server.env) server.env = expand(server.env);
+			if (server.cwd) server.cwd = expand(server.cwd);
+			if (server.url) server.url = expand(server.url);
+			if (server.headers) server.headers = expand(server.headers);
+			if (server.auth) server.auth = expand(server.auth);
+			if (server.oauth) server.oauth = expand(server.oauth);
 			servers.push(server);
 		}
 	}
@@ -440,7 +453,7 @@ async function readExactMCPConfigFile(filePath: string): Promise<string | null>
 export async function loadMCPJsonFile(
 	filePath: string,
 	level: "user" | "project",
-	options?: { quiet?: boolean; useCache?: boolean; readOptions?: ReadFileOptions },
+	options?: { quiet?: boolean; useCache?: boolean; readOptions?: ReadFileOptions; skipSensitiveEnvNames?: boolean },
 ): Promise<MCPJsonLoadResult> {
 	const warnings: string[] = [];
 	const items: MCPServer[] = [];
@@ -497,7 +510,7 @@ export async function loadMCPJsonFile(
 		validConfig = config as MCPConfigFile;
 	}
 	const source = createSourceMeta(PROVIDER_ID, sourcePath, level);
-	items.push(...transformMCPConfig(validConfig, source, options?.quiet));
+	items.push(...transformMCPConfig(validConfig, source, options?.quiet, options?.skipSensitiveEnvNames === true));
 
 	return {
 		items,
@@ -515,6 +528,7 @@ async function load(ctx: LoadContext): Promise<LoadResult<MCPServer>> {
 		filenames.map(filename =>
 			loadMCPJsonFile(path.join(ctx.cwd, filename), "project", {
 				readOptions: getReadOptions(ctx, "project"),
+				skipSensitiveEnvNames: true,
 			}),
 		),
 	);

package/src/discovery/ssh.ts

@@ -119,7 +119,7 @@ async function loadSshJsonFile(
 		warnings.push(`Failed to parse JSON in ${canonicalPath}`);
 		return { items, warnings };
 	}
-	const config = expandEnvVarsDeep(parsed);
+	const config = expandEnvVarsDeep(parsed, undefined, level === "project");
 	if (!config.hosts || typeof config.hosts !== "object") {
 		warnings.push(`Missing hosts in ${canonicalPath}`);
 		return { items, warnings };