@gajae-code/coding-agent 0.18.7 → 0.18.9

package/src/extensibility/extensions/function-hooks-internal.ts

@@ -4,6 +4,30 @@ import { type FunctionHookRegistration, validateFunctionHookTarget } from "./fun
 
 export type TaggedFunctionHookHandler = (...args: unknown[]) => Promise<unknown>;
 
+// Host SDK lifecycle observers publish the accepted run's bookkeeping. They do
+// not execute user work and must not consume provider-attempt replay authority.
+const sdkLifecycleObservers = new WeakSet<(...args: never[]) => unknown>();
+const providerRequestHandlers = new WeakMap<(...args: never[]) => unknown, string>();
+
+/** Host-owned provider adapters must not consume replay authority for other providers. */
+export function tagProviderRequestHandler<T extends (...args: never[]) => unknown>(provider: string, handler: T): T {
+	providerRequestHandlers.set(handler, provider);
+	return handler;
+}
+
+export function getProviderRequestHandlerProvider(handler: (...args: never[]) => unknown): string | undefined {
+	return providerRequestHandlers.get(handler);
+}
+
+export function tagSdkLifecycleObserver<T extends (...args: never[]) => unknown>(handler: T): T {
+	sdkLifecycleObservers.add(handler);
+	return handler;
+}
+
+export function isSdkLifecycleObserver(handler: (...args: never[]) => unknown): boolean {
+	return sdkLifecycleObservers.has(handler);
+}
+
 const registrations = new WeakMap<TaggedFunctionHookHandler, FunctionHookRegistration>();
 const registrationOrders = new WeakMap<(...args: never[]) => unknown, number>();
 
@@ -21,6 +45,9 @@ export function wrapExtensionHandlerRegistration<T extends (...args: never[]) =>
 ): T {
 	const registered = ((...args: never[]) => handler(...args)) as T;
 	registrationOrders.set(registered, registrationOrder);
+	if (sdkLifecycleObservers.has(handler)) sdkLifecycleObservers.add(registered);
+	const provider = providerRequestHandlers.get(handler);
+	if (provider !== undefined) providerRequestHandlers.set(registered, provider);
 	return registered;
 }
 

package/src/extensibility/extensions/runner.ts

@@ -51,6 +51,8 @@ import {
 import {
 	getExtensionHandlerRegistrationOrder,
 	getFunctionHookRegistration,
+	getProviderRequestHandlerProvider,
+	isSdkLifecycleObserver,
 	readConstrainedFunctionHookFile,
 } from "./function-hooks-internal";
 import type {
@@ -325,6 +327,7 @@ export class ExtensionRunner {
 	#getArtifactRangeFn: ExtensionContextActions["getArtifactRange"] = undefined;
 
 	#getJobsFn: ExtensionContextActions["getJobs"] = undefined;
+	#getProjectProgressFn: ExtensionContextActions["getProjectProgress"] = undefined;
 	#onJobFoldFn: ExtensionContextActions["onJobFold"] = undefined;
 	#onSessionEventFn: ExtensionContextActions["onSessionEvent"] = undefined;
 	#sdkControlFn: ExtensionContextActions["sdkControl"] = undefined;
@@ -482,6 +485,7 @@ export class ExtensionRunner {
 		this.#getArtifactRangeFn = contextActions.getArtifactRange;
 
 		this.#getJobsFn = contextActions.getJobs;
+		this.#getProjectProgressFn = contextActions.getProjectProgress;
 		this.#onJobFoldFn = contextActions.onJobFold;
 		this.#onSessionEventFn = contextActions.onSessionEvent;
 		this.#sdkControlFn = contextActions.sdkControl;
@@ -848,6 +852,7 @@ export class ExtensionRunner {
 			getArtifactRange: (id, offset, length) => this.#getArtifactRangeFn?.(id, offset, length),
 
 			getJobs: () => this.#getJobsFn?.(),
+			...(this.#getProjectProgressFn ? { getProjectProgress: this.#getProjectProgressFn } : {}),
 			onJobFold: listener => this.#onJobFoldFn?.(listener) ?? (() => {}),
 			onSessionEvent: listener => this.#onSessionEventFn?.(listener) ?? (() => {}),
 			sdkControl: (operation, input) => this.#sdkControlFn?.(operation, input),
@@ -867,6 +872,7 @@ export class ExtensionRunner {
 				...(this.#getExtensionsFn ? ["getExtensions"] : []),
 				...(this.#getArtifactRangeFn ? ["getArtifactRange"] : []),
 				...(this.#getJobsFn ? ["getJobs"] : []),
+				...(this.#getProjectProgressFn ? ["getProjectProgress"] : []),
 				...(this.#onJobFoldFn ? ["onJobFold"] : []),
 				...(this.#sdkControlFn ? ["sdkControl"] : []),
 				...(this.#invokeSkillFn ? ["invokeSkill"] : []),
@@ -914,6 +920,13 @@ export class ExtensionRunner {
 		const wildcard = this.#handlersByEvent.get("*") ?? [];
 		const matches: IndexedHandler[] = [];
 		for (const indexed of [...exact, ...wildcard]) {
+			const provider = getProviderRequestHandlerProvider(indexed.handler);
+			if (
+				event.type === "before_provider_request" &&
+				provider !== undefined &&
+				this.createContext().model?.provider !== provider
+			)
+				continue;
 			const registration = getFunctionHookRegistration(indexed.handler);
 			if (!registration) {
 				if (includeLegacyToolHandlers && indexed.registrationOrder >= 0 && exact.includes(indexed))
@@ -1072,7 +1085,8 @@ export class ExtensionRunner {
 		if (handlers.length === 0) return { action: "continue", event };
 		const includesLegacy = handlers.some(indexed => getFunctionHookRegistration(indexed.handler) === undefined);
 		if (includesLegacy) this.#requireScopeOrFailClosed(options.scope, event.type);
-		this.#markAttemptExecuted(options.scope);
+		if (handlers.some(indexed => event.type !== "agent_start" || !isSdkLifecycleObserver(indexed.handler)))
+			this.#markAttemptExecuted(options.scope);
 		const functionHookDepth = this.#functionHookDepth.getStore() ?? 0;
 		if (functionHookDepth >= 16) {
 			const reason = "Function hook re-entry depth exceeded";

package/src/extensibility/extensions/types.ts

@@ -49,6 +49,7 @@ import type { ExecOptions, ExecResult } from "../../exec/exec";
 import type { CustomEditor } from "../../modes/components/custom-editor";
 import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { Theme } from "../../modes/theme/theme";
+import type { ProjectProgressSnapshot } from "../../progress/progress-contract";
 import type { AgentSessionEventListener } from "../../session/agent-session";
 import type {
 	ClientBridge,
@@ -538,6 +539,8 @@ export interface ExtensionContext {
 		| Promise<{ bytes: Uint8Array; totalBytes: number } | undefined>;
 
 	getJobs(): unknown;
+	/** Read-only project progress snapshot (`session.progress`), derived from durable session state. */
+	getProjectProgress?(): Promise<ProjectProgressSnapshot>;
 	/** Subscribe to foreground-wait folds (`bash_folded`). Returns an unsubscribe function. */
 	onJobFold?(listener: (event: JobFoldEvent) => void): () => void;
 	/** Observe session events synchronously in producer order. Returns an unsubscribe function. */
@@ -764,6 +767,8 @@ export interface AgentStartEvent extends SharedAgentStartEvent {
 	sdkRunToken?: string;
 	/** Complete set of SDK queue owners consumed together by this run. */
 	sdkRunTokens?: string[];
+	/** Internal public lifecycle boundary; accepted retries with a suppressed predecessor end retain it. */
+	lifecycleScope?: AttemptScope;
 }
 
 /** Fired when an agent run fails before emitting agent_end. The error is the
@@ -1723,6 +1728,8 @@ export interface ExtensionContextActions {
 		| undefined
 		| Promise<{ bytes: Uint8Array; totalBytes: number } | undefined>;
 	getJobs?: () => unknown;
+	/** Read-only project progress snapshot backing the `session.progress` SDK query. */
+	getProjectProgress?: () => Promise<ProjectProgressSnapshot>;
 	/** Subscribe to foreground-wait folds so the SDK host can publish `bash_folded`. Returns an unsubscribe. */
 	onJobFold?: (listener: (event: JobFoldEvent) => void) => () => void;
 	/** Ordered, synchronous AgentSession subscription, independent of async extension hooks. */

package/src/extensibility/gjc-plugins/mcp-policy.ts

@@ -6,7 +6,7 @@ import { GjcPluginLoadError, type GjcPluginMcpManifestEntry } from "./types";
 /**
  * Shared MCP security policy applied at BOTH install validation and runtime
  * connect for third-party plugin-bundle MCP servers. Defaults are deny-first:
- * HTTPS only, no private/loopback/link-local/metadata endpoints, stdio confined
+ * HTTPS only, no private/loopback/link-local/CGNAT/metadata endpoints, stdio confined
  * to the plugin root.
  */
 
@@ -34,6 +34,7 @@ export function isDeniedIpv4(host: string): boolean {
 	if (a === 172 && b >= 16 && b <= 31) return true; // private 172.16.0.0/12
 	if (a === 192 && b === 168) return true; // private 192.168.0.0/16
 	if (a === 169 && b === 254) return true; // link-local 169.254.0.0/16 (incl 169.254.169.254 metadata)
+	if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT 100.64.0.0/10
 	if (a === 0) return true; // 0.0.0.0/8 unspecified/this-network
 	if (a >= 224) return true; // multicast/reserved 224.0.0.0/4 and 240.0.0.0/4
 	return false;

package/src/extensibility/gjc-plugins/runtime-adapters.ts

@@ -149,22 +149,82 @@ const initialTemporaryRoots = initialProcessEnvironment.then(async environment =
 	}
 	return [...roots];
 });
-const initialNodeAuthorities = initialProcessEnvironment.then(async environment => {
-	const authorities = new Map<string, string>();
+
+/** Startup identity of a file: the object `hashStableFile` must still be reading. */
+export interface StableFileIdentity {
+	dev: number;
+	ino: number;
+	size: number;
+	mtimeMs: number;
+	ctimeMs: number;
+}
+
+/**
+ * Startup identity of every canonical `node` on PATH, keyed by realpath. Only
+ * `stat` runs at startup; the digest is computed on first use from a descriptor
+ * whose identity must still match this snapshot, so a later replacement cannot
+ * become launch authority.
+ */
+const initialNodeIdentities = initialProcessEnvironment.then(async environment => {
+	const identities = new Map<string, StableFileIdentity>();
 	const temporaryRoots = await initialTemporaryRoots;
 	for (const pathEntry of (environment.get("PATH") ?? "").split(path.delimiter).filter(path.isAbsolute)) {
 		const lexical = path.join(pathEntry, process.platform === "win32" ? "node.exe" : "node");
 		try {
 			const real = await fs.realpath(lexical);
+			// A temporary root is writable by other local users and by checkouts the user
+			// never vetted, so a `node` resolved there never becomes launch authority.
 			if (temporaryRoots.some(root => isWithin(root, real))) continue;
-			authorities.set(real, await hashStableFile(real, "Initial Node executable", MCP_LAUNCHER_MAX_BYTES));
+			if (identities.has(real)) continue;
+			const stat = await fs.stat(real);
+			identities.set(real, {
+				dev: stat.dev,
+				ino: stat.ino,
+				size: stat.size,
+				mtimeMs: stat.mtimeMs,
+				ctimeMs: stat.ctimeMs,
+			});
 		} catch {
-			// Missing or unstable startup candidates do not become authority.
+			// Missing startup candidates do not become authority.
 		}
 	}
-	return authorities;
+	return identities;
 });
 
+/**
+ * First-use digests of startup Node candidates, keyed by realpath. Successful and
+ * in-flight digests stay memoized; a failed attempt is evicted so a transient error
+ * (e.g. EMFILE) can be retried against the same startup identity.
+ */
+const initialNodeHashes = new Map<string, Promise<string | undefined>>();
+
+/**
+ * Digest of a `node` that was on PATH at startup, or `undefined` when the path
+ * was not a startup candidate or no longer is the startup file object.
+ */
+export function getInitialNodeHash(realPath: string): Promise<string | undefined> {
+	const cached = initialNodeHashes.get(realPath);
+	if (cached) return cached;
+
+	const attempt = initialNodeIdentities.then(async identities => {
+		const identity = identities.get(realPath);
+		if (!identity) return undefined;
+		try {
+			return await hashStableFile(realPath, "Initial Node executable", MCP_LAUNCHER_MAX_BYTES, identity);
+		} catch {
+			// Do not memoize failed attempts to allow retries on transient errors
+			// (e.g., EMFILE on file open/read). Remove the pending entry so the next
+			// call can retry the operation with the same startup identity.
+			initialNodeHashes.delete(realPath);
+			return undefined;
+		}
+	});
+	// Memoize the in-flight attempt so only one concurrent operation runs, but
+	// the entry may be deleted if the operation fails (to allow retry).
+	initialNodeHashes.set(realPath, attempt);
+	return attempt;
+}
+
 async function snapshotExistingFile(filePath: string): Promise<FileSnapshot | null> {
 	try {
 		const stat = await fs.stat(filePath);
@@ -416,11 +476,28 @@ const STABLE_HASH_CHUNK_BYTES = 1024 * 1024;
  * on PATH; buffering each interpreter (~120 MiB) held its full bytes in the
  * session process until exit.
  */
-export async function hashStableFile(filePath: string, label: string, maxBytes: number): Promise<string> {
+export async function hashStableFile(
+	filePath: string,
+	label: string,
+	maxBytes: number,
+	expected?: StableFileIdentity,
+): Promise<string> {
 	const handle = await fs.open(filePath, fs.constants.O_RDONLY);
 	try {
 		const before = await handle.stat();
 		if (!before.isFile()) throw new Error(`${label} is not a regular file`);
+		// Checked on the opened descriptor, so the digest belongs to the expected
+		// file object even if the path is swapped around the open.
+		if (
+			expected &&
+			(before.dev !== expected.dev ||
+				before.ino !== expected.ino ||
+				before.size !== expected.size ||
+				before.mtimeMs !== expected.mtimeMs ||
+				before.ctimeMs !== expected.ctimeMs)
+		) {
+			throw new Error(`${label} is not the expected file`);
+		}
 		if (before.size > maxBytes) throw new Error(`${label} exceeds its byte limit`);
 		const hash = createHash("sha256");
 		const chunk = Buffer.allocUnsafe(STABLE_HASH_CHUNK_BYTES);
@@ -515,7 +592,7 @@ async function isInitialManagedNodeLauncherPath(
 	const real = await fs.realpath(executablePath);
 	if (untrustedRoots.some(root => isWithin(root, real))) return false;
 	if ((await initialTemporaryRoots).some(root => isWithin(root, real))) return false;
-	const expected = (await initialNodeAuthorities).get(real);
+	const expected = await getInitialNodeHash(real);
 	if (!expected) return false;
 	return (await hashStableFile(real, "Initial Node executable", MCP_LAUNCHER_MAX_BYTES)) === expected;
 }
@@ -671,7 +748,7 @@ async function prepareVerifiedStdioLaunch(input: {
 		true,
 	);
 	const launcherReal = await fs.realpath(input.launcherPath);
-	const expectedLauncherHash = (await initialNodeAuthorities).get(launcherReal);
+	const expectedLauncherHash = await getInitialNodeHash(launcherReal);
 	if (!expectedLauncherHash || sha256(launcherBytes) !== expectedLauncherHash) {
 		throw new Error("Plugin MCP Node interpreter drifted from startup authority");
 	}

package/src/extensibility/plugins/manager.ts

@@ -12,6 +12,7 @@ import {
 } from "@gajae-code/utils";
 import { withFileLock } from "../../config/file-lock";
 import { extractPackageName, parsePluginSpec } from "./parser";
+import { resolvePluginLinkPath } from "./plugin-link-path";
 import type {
 	DoctorCheck,
 	DoctorOptions,
@@ -535,11 +536,11 @@ export class PluginManager {
 
 		await this.#ensurePluginsDir();
 
-		const linkPath = path.join(getPluginsNodeModules(), pkg.name);
+		const linkPath = resolvePluginLinkPath(getPluginsNodeModules(), pkg.name);
 
 		// Handle scoped packages
 		if (pkg.name.startsWith("@")) {
-			const scopeDir = path.join(getPluginsNodeModules(), pkg.name.split("/")[0]);
+			const scopeDir = path.dirname(linkPath);
 			await fs.promises.mkdir(scopeDir, { recursive: true });
 		}
 

package/src/extensibility/plugins/marketplace/cache.ts

@@ -87,6 +87,21 @@ export async function cachePlugin(
 	return targetPath;
 }
 
+/** Write a regular file. A symlink at the destination is removed, not followed. */
+export async function writeCachedRegularFile(targetPath: string, content: string): Promise<void> {
+	try {
+		const stat = await fs.lstat(targetPath);
+		if (stat.isSymbolicLink()) {
+			await fs.unlink(targetPath);
+		} else if (!stat.isFile()) {
+			throw new Error("unsafe cache artifact");
+		}
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	await Bun.write(targetPath, content);
+}
+
 export async function stageCachedPlugin(sourcePath: string, stagingPath: string): Promise<string> {
 	await fs.rm(stagingPath, { recursive: true, force: true });
 	await fs.cp(sourcePath, stagingPath, { recursive: true, errorOnExist: true, verbatimSymlinks: true });

package/src/extensibility/plugins/marketplace/manager.ts

@@ -19,7 +19,13 @@ import {
 } from "@gajae-code/natives";
 import { isEnoent, logger, pathIsWithin } from "@gajae-code/utils";
 import { withFileLock } from "../../../config/file-lock";
-import { cachePlugin, getCachedPluginPath, inspectCachedPlugin, stageCachedPlugin } from "./cache";
+import {
+	cachePlugin,
+	getCachedPluginPath,
+	inspectCachedPlugin,
+	stageCachedPlugin,
+	writeCachedRegularFile,
+} from "./cache";
 import { classifySource, fetchMarketplace, parseMarketplaceCatalog, promoteCloneToCache } from "./fetcher";
 import {
 	addInstalledPlugin,
@@ -1430,12 +1436,14 @@ export class MarketplaceManager {
 			if (!pathIsWithin(cachePath, sourcePath)) {
 				throw new Error(`Plugin "${entry.name}" lspServers path escapes the plugin directory`);
 			}
+			const sourceStat = await fs.lstat(sourcePath);
+			if (sourceStat.isSymbolicLink()) throw new Error(`Plugin "${entry.name}" lspServers path is a symlink`);
 			const content = await Bun.file(sourcePath).text();
-			await Bun.write(targetPath, content);
+			await writeCachedRegularFile(targetPath, content);
 			return;
 		}
 
-		await Bun.write(targetPath, `${JSON.stringify({ servers: lspServers }, null, 2)}\n`);
+		await writeCachedRegularFile(targetPath, `${JSON.stringify({ servers: lspServers }, null, 2)}\n`);
 	}
 
 	/**

package/src/extensibility/plugins/plugin-link-path.ts

@@ -0,0 +1,12 @@
+import path from "node:path";
+
+/** Resolve a package.json name under the plugins node_modules root, or throw. */
+export function resolvePluginLinkPath(root: string, name: string): string {
+	const base = path.resolve(root);
+	const destination = path.resolve(base, name);
+	const relative = path.relative(base, destination);
+	if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+		throw new Error(`package.json name is not a safe plugin link path: ${name}`);
+	}
+	return destination;
+}

package/src/extensibility/runtime-skill-discovery.ts

@@ -9,7 +9,7 @@ import {
 import { findRepoRoot } from "../capability/fs";
 import type { Skill as CapabilitySkill } from "../capability/skill";
 import type { SkillsSettings } from "../config/settings-schema";
-import { resolveSkillScopeTrust } from "../config/skill-settings-defaults";
+import { resolveGlobalUserSkillLinkTrust, resolveSkillScopeTrust } from "../config/skill-settings-defaults";
 import { BUNDLED_GJC_SKILL_CATALOG } from "../defaults/gjc-skills.generated";
 import { scanClaudeProjectSkills, scanClaudeUserSkills } from "../discovery/claude";
 import { loadMarketplaceSkills } from "../discovery/claude-plugins";
@@ -79,6 +79,8 @@ export interface DiscoverRuntimeSkillsOptions {
 	offset?: number;
 	source?: RuntimeSkillDiscoveryScope | "all";
 	policy?: SkillsSettings;
+	/** User-owned permission to read external user skill symlinks; defaults to the direct policy value. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 function getRuntimeHome(): string {
@@ -296,6 +298,7 @@ async function scanProjectOrUserDir(
 	source: RuntimeSkillDiscoveryScope,
 	providerPriority: number,
 	authorityRoot?: string,
+	allowExternalUserSkillSymlinks?: boolean,
 ): Promise<ScanJobResult> {
 	const result = await scanSkillsFromDir(ctx, {
 		dir,
@@ -304,6 +307,7 @@ async function scanProjectOrUserDir(
 		providerId: "runtime",
 		level,
 		requireDescription: true,
+		allowExternalUserSkillSymlinks,
 	});
 	return {
 		items: result.items.map(skill => ({ skill, source, providerPriority })),
@@ -449,6 +453,8 @@ export async function discoverRuntimeSkills(
 	const home = options.home ?? getRuntimeHome();
 	const source = options.source ?? "all";
 	const policy = options.policy;
+	const allowExternalUserSkillSymlinks =
+		options.allowExternalUserSkillSymlinks ?? resolveGlobalUserSkillLinkTrust(policy ?? {});
 	const diagnostics: string[] = [];
 	const agentDir = resolveRuntimeAgentDir(home, options.agentDir, hasExplicitHome);
 	const profileAuthority =
@@ -478,6 +484,7 @@ export async function discoverRuntimeSkills(
 					"user",
 					100,
 					path.resolve(dir) === path.resolve(agentDir, "skills") ? agentDir : undefined,
+					allowExternalUserSkillSymlinks,
 				),
 			);
 		}
@@ -485,7 +492,16 @@ export async function discoverRuntimeSkills(
 	if ((source === "all" || source === "user") && policy?.enabled === true) {
 		for (const dir of getCustomSkillDirs(policy, home)) {
 			scanJobs.push(
-				scanProjectOrUserDir({ cwd: options.cwd, home, repoRoot: home }, dir, "user", `custom ${dir}`, "user", 0),
+				scanProjectOrUserDir(
+					{ cwd: options.cwd, home, repoRoot: home },
+					dir,
+					"user",
+					`custom ${dir}`,
+					"user",
+					0,
+					undefined,
+					allowExternalUserSkillSymlinks,
+				),
 			);
 		}
 	}
@@ -630,6 +646,7 @@ export async function findRuntimeSkillByName(
 	home?: string,
 	agentDir?: string,
 	profileAuthority?: "default" | "custom",
+	allowExternalUserSkillSymlinks?: boolean,
 ): Promise<Skill | undefined> {
 	const normalized = name.trim();
 	if (!normalized) return undefined;
@@ -650,6 +667,7 @@ export async function findRuntimeSkillByName(
 		home: resolvedHome,
 		agentDir: resolvedAgentDir,
 		profileAuthority: resolvedProfileAuthority,
+		allowExternalUserSkillSymlinks: allowExternalUserSkillSymlinks ?? resolveGlobalUserSkillLinkTrust(policy ?? {}),
 	});
 	return loaded.skills.find(skill => skill.name === normalized);
 }

package/src/extensibility/skill-management.ts

@@ -56,6 +56,7 @@ export type SkillDisabledReason = "protected" | "scope-trust" | "ignored" | "inc
 export interface ManagedSkillRecord {
 	name: string;
 	description: string;
+	importedFrom?: string;
 	path: string;
 	scope: SkillScope;
 	/** Canonical source label, e.g. "project .gjc/skills" or "user ~/.gjc/agent/skills". */
@@ -299,8 +300,10 @@ export async function listNativeSkillsForManagement(options: {
 	cwd: string;
 	home?: string;
 	agentDir?: string;
-	/** Resolver-owned profile classification; unlike path comparison, this survives HOME refreshes. */
+	/** Resolver-owned profile classification; unlike path comparison, this survives HOME/config refreshes. */
 	profileAuthority?: "default" | "custom";
+	/** User-owned permission to follow symlinks outside user skill scan roots. */
+	allowExternalUserSkillSymlinks?: boolean;
 	policy?: SkillManagementPolicy;
 }): Promise<ManagedSkillRecord[]> {
 	const homeWasInjected = options.home !== undefined;
@@ -321,6 +324,7 @@ export async function listNativeSkillsForManagement(options: {
 	const policy = options.policy;
 	const projectTrusted = resolveSkillScopeTrust(policy ?? {}, "project");
 	const userTrusted = resolveSkillScopeTrust(policy ?? {}, "user");
+	const allowExternalUserSkillSymlinks = options.allowExternalUserSkillSymlinks ?? userTrusted;
 
 	const scanJobs: Array<Promise<{ dir: string; scope: SkillScope; items: CapabilitySkill[] }>> = [];
 	const projectDirs = await getProjectSkillDirs(options.cwd, home);
@@ -351,6 +355,7 @@ export async function listNativeSkillsForManagement(options: {
 						providerId: "runtime",
 						level: "user",
 						requireDescription: true,
+						allowExternalUserSkillSymlinks,
 					},
 				).then(result => ({ dir, scope: "user" as const, items: result.items })),
 			);
@@ -388,10 +393,12 @@ export async function listNativeSkillsForManagement(options: {
 
 			if (!seenNames.has(skill.name)) {
 				seenNames.add(skill.name);
+				const importedFrom = skill.frontmatter?.xGjcImportedFrom ?? skill.frontmatter?.["x-gjc-imported-from"];
 				records.push({
 					name: skill.name,
 					description: typeof skill.frontmatter?.description === "string" ? skill.frontmatter.description : "",
-					path: skill.path,
+					...(typeof importedFrom === "string" ? { importedFrom } : {}),
+					path: skill.discoveryPath ?? skill.path,
 					scope,
 					source,
 					hidden: skill.frontmatter?.hide === true,

package/src/extensibility/skills.ts

@@ -125,6 +125,8 @@ export interface LoadSkillsOptions extends SkillsSettings {
 	agentDir?: string;
 	/** Resolver-owned classification for the selected agent directory. */
 	profileAuthority?: "default" | "custom";
+	/** User-owned permission to follow symlinks outside user skill scan roots. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 /**
@@ -167,6 +169,7 @@ export async function loadSkills(options: LoadSkillsOptions = {}): Promise<LoadS
 
 	const projectTrusted = resolveSkillScopeTrust(options, "project");
 	const userTrusted = resolveSkillScopeTrust(options, "user");
+	const allowExternalUserSkillSymlinks = options.allowExternalUserSkillSymlinks ?? userTrusted;
 
 	// Skill scope trust decides which canonical locations are loaded: project
 	// scope covers `.gjc/skills` (walk-up), user scope covers `~/.gjc/agent/skills`
@@ -197,6 +200,7 @@ export async function loadSkills(options: LoadSkillsOptions = {}): Promise<LoadS
 		userAgentDir: agentDir,
 		profileAuthority,
 		repoRoot: await findRepoRoot(cwd),
+		allowExternalUserSkillSymlinks,
 	};
 	const providerResults = await Promise.all(
 		providers.map(async provider => {
@@ -311,12 +315,13 @@ export async function loadSkills(options: LoadSkillsOptions = {}): Promise<LoadS
 		customDirectories.map(async dir => {
 			const expandedDir = expandTilde(dir, home);
 			const scanResult = await scanSkillsFromDir(
-				{ cwd, home, repoRoot: null },
+				{ cwd, home, repoRoot: null, allowExternalUserSkillSymlinks },
 				{
 					dir: expandedDir,
 					providerId: "custom",
 					level: "user",
 					requireDescription: true,
+					allowExternalUserSkillSymlinks,
 				},
 			);
 			return { expandedDir, scanResult };