@sayknow-cli/coding-agent 0.2.6 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,38 @@ Sayknow-CLI is a rebranded fork of [gajae-code](https://github.com/Yeachan-Heo/g
 This file tracks the **fork's own releases**; upstream's full feature history lives
 in that project. Each release notes the upstream version it is built on.
 
+## [0.3.0] — 2026-06-23
+
+### Changed
+
+- Synced onto upstream **gajae-code v0.7.1** (from v0.6.5), bringing 0.7.0's mobile
+  notifications SDK + managed Telegram daemon and 0.7.1's fixes (assistant
+  notification lead-in, stale tmux session reuse, packaged native imports, and the
+  glm-zcode Z.AI provider) while preserving the Sayknow-CLI brand.
+
+### Added
+
+- **Decepticon red-team integration.** Vendored [Decepticon](https://github.com/PurpleAILAB/Decepticon)
+  as a git submodule (`vendor/decepticon`) plus `python/decepticon-bridge` — an
+  `skc-rpc` host-tool bridge that exposes Decepticon's red-team agents to skc
+  (`decepticon_run_agent` / `decepticon_list_agents`).
+- **Ponytail default rule.** Bundled the ponytail "lazy senior dev" ruleset as an
+  always-on default rule: pick the simplest working solution first (YAGNI, reuse,
+  stdlib/native first) without ever cutting validation, error handling, security,
+  or accessibility. Adapted from [ponytail](https://github.com/DietrichGebert/ponytail) (MIT).
+
+## [0.2.7] — 2026-06-23
+
+### Added
+
+- **Plugin install security scan (advisory).** Newly installed plugins/skills are now
+  statically scanned before activation for risky patterns — `curl|bash` download-and-exec,
+  `eval`/dynamic import, credential/secret access, obfuscation, cron persistence, and
+  package-install markers — with risk scoring. Findings surface as warnings in the install
+  output and in `plugin doctor`. Controlled by `plugins.security.scanMode`
+  (`warn` = default, `off`, `block`) and `plugins.security.riskThreshold`. Warn-only by
+  default — it never blocks an install unless you opt into `block` mode.
+
 ## [0.2.6] — 2026-06-22
 
 ### Fixed

package/dist/types/async/job-manager.d.ts

@@ -68,7 +68,9 @@ export interface SubagentLiveHandle {
     /** Request a cooperative safe-boundary pause (never aborts the in-flight tool). */
     requestPause(): void;
     /** Inject a steering message into the live session. */
-    injectMessage(content: string, deliverAs: "steer" | "followUp" | "nextTurn"): Promise<void>;
+    injectMessage(content: string, deliverAs: "steer" | "followUp" | "nextTurn", opts?: {
+        fromAgentId?: string;
+    }): Promise<void>;
 }
 /**
  * Canonical, stable-id-keyed record for a subagent. Survives `AsyncJob`

package/dist/types/cli/daemon-cli.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `skc daemon` command handler.
+ *
+ * Generic over the static built-in daemon controller map: lists/inspects
+ * daemons and drives cooperative stop/reload. Telegram is the only kind today.
+ */
+import { Settings } from "../config/settings";
+import type { BuiltInDaemonController, DaemonKind } from "../daemon/control-types";
+export type DaemonCliAction = "list" | "status" | "stop" | "reload";
+export interface DaemonCommandArgs {
+    action: DaemonCliAction;
+    kinds: DaemonKind[];
+    all: boolean;
+    json: boolean;
+    force: boolean;
+    gracefulTimeoutMs?: number;
+    killTimeoutMs?: number;
+    spawnIfStopped?: boolean;
+}
+export interface DaemonCommandDeps {
+    settings?: Settings;
+    controllers?: BuiltInDaemonController[];
+}
+export declare function parseDaemonArgs(argv: string[]): DaemonCommandArgs | undefined;
+export declare function runDaemonCommand(cmd: DaemonCommandArgs, deps?: DaemonCommandDeps): Promise<void>;

package/dist/types/cli/notify-cli.d.ts

@@ -0,0 +1,23 @@
+import { Settings } from "../config/settings";
+export type NotifyAction = "setup" | "status" | "daemon-internal";
+export interface NotifyCommandArgs {
+    action: NotifyAction;
+    smoke?: boolean;
+    rawArgs: string[];
+    token?: string;
+    chatId?: string;
+    redact?: boolean;
+}
+export interface NotifyCommandDeps {
+    fetchImpl?: typeof fetch;
+    apiBase?: string;
+    settings?: Settings;
+    setupToken?: string;
+    pollTimeoutMs?: number;
+    pollIntervalMs?: number;
+    setupChatId?: string;
+    setupRedact?: boolean;
+}
+export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
+export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;
+export declare function printNotifyHelp(): void;

package/dist/types/cli/setup-cli.d.ts

@@ -3,7 +3,9 @@
  *
  * Handles `skc setup [component]` to install the normal defaults or optional feature dependencies.
  */
-export type SetupComponent = "credentials" | "defaults" | "hermes" | "hooks" | "provider" | "python" | "stt";
+import { AuthStorage, SqliteAuthCredentialStore } from "@sayknow-cli/ai";
+import { runExternalCredentialAutoImport } from "../setup/credential-auto-import";
+export type SetupComponent = "claude" | "codex" | "credentials" | "defaults" | "hermes" | "hooks" | "provider" | "python" | "stt";
 export interface SetupCommandArgs {
     component: SetupComponent;
     flags: {
@@ -34,6 +36,7 @@ export interface SetupCommandArgs {
         profileDir?: string;
         yes?: boolean;
         dryRun?: boolean;
+        keychain?: boolean;
     };
 }
 /**
@@ -48,6 +51,22 @@ export declare function parseSetupArgs(args: string[]): SetupCommandArgs | undef
  * Run the setup command.
  */
 export declare function runSetupCommand(cmd: SetupCommandArgs): Promise<void>;
+/**
+ * Discover existing Claude Code / Codex CLI credentials and import them into the
+ * skc credential store after a redacted preview + confirmation. Falls back to
+ * manual-setup guidance when nothing importable is found.
+ */
+export interface CredentialsSetupDependencies {
+    openStore?: typeof SqliteAuthCredentialStore.open;
+    createAuthStorage?: (store: Awaited<ReturnType<typeof SqliteAuthCredentialStore.open>>) => AuthStorage;
+    discover?: Parameters<typeof runExternalCredentialAutoImport>[0]["discover"];
+}
+export declare function handleCredentialsSetup(flags: {
+    json?: boolean;
+    yes?: boolean;
+    dryRun?: boolean;
+    keychain?: boolean;
+}, deps?: CredentialsSetupDependencies): Promise<void>;
 /**
  * Print setup command help.
  */

package/dist/types/commands/daemon.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Manage SKC background daemons (status/list/stop/reload).
+ */
+import { Command } from "@sayknow-cli/utils/cli";
+import { type DaemonCliAction } from "../cli/daemon-cli";
+export default class Daemon extends Command {
+    static description: string;
+    static args: {
+        action: import("@sayknow-cli/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            options: DaemonCliAction[];
+        };
+        kind: import("@sayknow-cli/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            multiple: true;
+        };
+    };
+    static flags: {
+        all: import("@sayknow-cli/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        json: import("@sayknow-cli/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        force: import("@sayknow-cli/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "graceful-timeout-ms": import("@sayknow-cli/utils/cli").FlagDescriptor<"integer"> & {
+            description: string;
+        };
+        "kill-timeout-ms": import("@sayknow-cli/utils/cli").FlagDescriptor<"integer"> & {
+            description: string;
+        };
+        "spawn-if-stopped": import("@sayknow-cli/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    run(): Promise<void>;
+}

package/dist/types/commands/notify.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Configure Telegram notifications.
+ */
+import { Command } from "@sayknow-cli/utils/cli";
+import { type NotifyAction } from "../cli/notify-cli";
+export default class Notify extends Command {
+    static description: string;
+    static args: {
+        action: import("@sayknow-cli/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            options: NotifyAction[];
+        };
+        extra: import("@sayknow-cli/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            multiple: true;
+        };
+    };
+    static flags: {
+        smoke: import("@sayknow-cli/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        token: import("@sayknow-cli/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "chat-id": import("@sayknow-cli/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        redact: import("@sayknow-cli/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "owner-id": import("@sayknow-cli/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "agent-dir": import("@sayknow-cli/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+    };
+    run(): Promise<void>;
+}

package/dist/types/config/model-profile-activation.d.ts

@@ -7,6 +7,8 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
     setModelTemporary?: AgentSession["setModelTemporary"];
     setActiveModelProfile?: (name: string | undefined) => void;
     getActiveModelProfile?: () => string | undefined;
+    getSessionDefaultModelSelector?: () => string | undefined;
+    recordResumeDefaultModel?: (selector: string) => void;
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
@@ -23,10 +25,20 @@ export interface PreparedModelProfileActivation {
     previousModel: Model<Api> | undefined;
     previousThinkingLevel: ThinkingLevel | undefined;
     previousAgentModelOverrides: Record<string, string>;
+    previousModelRoles: Record<string, string>;
     defaultModel: Model<Api> | undefined;
     defaultThinkingLevel: ThinkingLevel | undefined;
+    modelRoles: Record<string, string>;
     agentModelOverrides: Record<string, string>;
     previousActiveModelProfile: string | undefined;
+    /**
+     * The session resume default ("provider/id") captured BEFORE activation —
+     * the model resume would restore prior to this profile. Snapshotted
+     * separately from `previousModel` (the live runtime model, which may be a
+     * transient switch) so a failed-activation rollback restores the correct
+     * resume default without promoting a transient model to it.
+     */
+    previousSessionDefaultModel: string | undefined;
 }
 export declare function formatModelProfileCredentialError(profileName: string, providers: readonly string[]): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;

package/dist/types/config/model-profiles.d.ts

@@ -20,7 +20,8 @@ export interface ModelProfileDefinition {
 }
 export interface ResolvedProfileBinding {
     defaultSelector?: string;
-    agentModelOverrides: Partial<Record<Exclude<ModelProfileRole, "default">, string>>;
+    modelRoles: Partial<Record<"vision", string>>;
+    agentModelOverrides: Partial<Record<Exclude<ModelProfileRole, "default" | "vision">, string>>;
 }
 export declare function deriveModelProfileMappedProviders(definition: Pick<ModelProfileDefinition, "modelMapping">): string[];
 export declare function aggregateModelProfileRequiredProviders(requiredProviders: readonly string[], definition: Pick<ModelProfileDefinition, "modelMapping">): string[];

package/dist/types/config/model-registry.d.ts

@@ -11,7 +11,7 @@ import { type Settings } from "./settings";
 export type { CanonicalModelIndex, CanonicalModelRecord, CanonicalModelVariant, ModelEquivalenceConfig };
 export declare const kNoAuth = "N/A";
 export declare function isAuthenticated(apiKey: string | undefined | null): apiKey is string;
-export type ModelRole = "default";
+export type ModelRole = "default" | "vision";
 export interface ModelRoleInfo {
     tag?: string;
     name: string;
@@ -19,7 +19,7 @@ export interface ModelRoleInfo {
 }
 export declare const MODEL_ROLES: Record<ModelRole, ModelRoleInfo>;
 export declare const MODEL_ROLE_IDS: ModelRole[];
-export type SkcModelAssignmentTargetId = "default" | "executor" | "architect" | "planner" | "critic";
+export type SkcModelAssignmentTargetId = "default" | "vision" | "executor" | "architect" | "planner" | "critic";
 export interface SkcModelAssignmentTargetInfo extends ModelRoleInfo {
     id: SkcModelAssignmentTargetId;
     settingsPath: "modelRoles" | "task.agentModelOverrides";
@@ -268,7 +268,7 @@ export declare const ModelsConfigFile: ConfigFile<{
     profiles?: Record<string, {
         required_providers: string[];
         display_name?: string | undefined;
-        model_mapping: Partial<Record<"architect" | "critic" | "default" | "executor" | "planner", string>>;
+        model_mapping: Partial<Record<"architect" | "critic" | "default" | "executor" | "planner" | "vision", string>>;
     }> | undefined;
 }>;
 /** Provider override config (baseUrl, headers, apiKey, compat, transport) without custom models */

package/dist/types/config/models-config-schema.d.ts

@@ -68,6 +68,7 @@ export declare const ProfileRoleSchema: z.ZodEnum<{
     default: "default";
     executor: "executor";
     planner: "planner";
+    vision: "vision";
 }>;
 export declare const ProfileModelSelectorSchema: z.ZodString;
 export declare const ProfileModelMappingSchema: z.ZodRecord<z.ZodEnum<{
@@ -76,6 +77,7 @@ export declare const ProfileModelMappingSchema: z.ZodRecord<z.ZodEnum<{
     default: "default";
     executor: "executor";
     planner: "planner";
+    vision: "vision";
 }> & z.core.$partial, z.ZodString>;
 export declare const ProfileDefinitionSchema: z.ZodObject<{
     required_providers: z.ZodArray<z.ZodString>;
@@ -86,6 +88,7 @@ export declare const ProfileDefinitionSchema: z.ZodObject<{
         default: "default";
         executor: "executor";
         planner: "planner";
+        vision: "vision";
     }> & z.core.$partial, z.ZodString>;
 }, z.core.$strict>;
 export declare const ProfilesSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -97,6 +100,7 @@ export declare const ProfilesSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
         default: "default";
         executor: "executor";
         planner: "planner";
+        vision: "vision";
     }> & z.core.$partial, z.ZodString>;
 }, z.core.$strict>>;
 export declare const ModelOverrideSchema: z.ZodObject<{
@@ -687,6 +691,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
             default: "default";
             executor: "executor";
             planner: "planner";
+            vision: "vision";
         }> & z.core.$partial, z.ZodString>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;

package/dist/types/config/settings-schema.d.ts

@@ -118,6 +118,32 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "string";
         readonly default: undefined;
     };
+    readonly "notifications.enabled": {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly "notifications.telegram.botToken": {
+        readonly type: "string";
+        readonly default: undefined;
+    };
+    readonly "notifications.telegram.chatId": {
+        readonly type: "string";
+        readonly default: undefined;
+    };
+    readonly "notifications.redact": {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly "notifications.verbosity": {
+        readonly type: "string";
+        readonly default: "lean";
+        readonly validate: (value: string) => value is "lean" | "verbose";
+    };
+    readonly "notifications.daemon.idleTimeoutMs": {
+        readonly type: "number";
+        readonly default: 60000;
+        readonly validate: (value: number) => boolean;
+    };
     readonly autoResume: {
         readonly type: "boolean";
         readonly default: false;
@@ -3433,6 +3459,39 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "number";
         readonly default: 65536;
     };
+    readonly "plugins.security.scanMode": {
+        readonly type: "enum";
+        readonly values: readonly ["warn", "off", "block"];
+        readonly default: "warn";
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Plugin Security Scan Mode";
+            readonly description: "warn: scan on install and log advisory findings (default); off: skip scan; block: deny install when score exceeds threshold";
+            readonly options: readonly [{
+                readonly value: "warn";
+                readonly label: "Warn";
+                readonly description: "Scan and log advisory findings (default)";
+            }, {
+                readonly value: "off";
+                readonly label: "Off";
+                readonly description: "Disable security scanning";
+            }, {
+                readonly value: "block";
+                readonly label: "Block";
+                readonly description: "Deny install when risk score exceeds threshold";
+            }];
+        };
+    };
+    readonly "plugins.security.riskThreshold": {
+        readonly type: "number";
+        readonly default: 60;
+        readonly validate: (value: number) => boolean;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Plugin Security Risk Threshold";
+            readonly description: "Score threshold (0\u2013100) above which block mode denies install. Default 60.";
+        };
+    };
 };
 type Schema = typeof SETTINGS_SCHEMA;
 /** All valid setting paths */
@@ -3585,6 +3644,17 @@ export interface ShellMinimizerSettings {
     except: string[];
     maxCaptureBytes: number;
 }
+export interface NotificationsSettings {
+    enabled: boolean;
+    telegram: {
+        botToken: string | undefined;
+        chatId: string | undefined;
+    };
+    redact: boolean;
+    daemon: {
+        idleTimeoutMs: number;
+    };
+}
 /** Map group prefix -> typed settings interface */
 export interface GroupTypeMap {
     compaction: CompactionSettings;
@@ -3603,6 +3673,7 @@ export interface GroupTypeMap {
     modelTags: ModelTagsSettings;
     cycleOrder: string[];
     shellMinimizer: ShellMinimizerSettings;
+    notifications: NotificationsSettings;
 }
 export type GroupPrefix = keyof GroupTypeMap;
 export {};

package/dist/types/coordinator/contract.d.ts

@@ -1,4 +1,4 @@
 export declare const COORDINATOR_MCP_PROTOCOL_VERSION = "2024-11-05";
 export declare const COORDINATOR_MCP_SERVER_NAME = "skc-coordinator-mcp";
-export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["skc_coordinator_list_sessions", "skc_coordinator_read_status", "skc_coordinator_read_tail", "skc_coordinator_list_questions", "skc_coordinator_list_artifacts", "skc_coordinator_read_artifact", "skc_coordinator_read_coordination_status", "skc_coordinator_watch_events", "skc_coordinator_register_session", "skc_coordinator_start_session", "skc_coordinator_send_prompt", "skc_coordinator_submit_question_answer", "skc_coordinator_read_turn", "skc_coordinator_await_turn", "skc_coordinator_report_status"];
+export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["skc_coordinator_list_sessions", "skc_coordinator_read_status", "skc_coordinator_read_tail", "skc_coordinator_list_questions", "skc_coordinator_list_artifacts", "skc_coordinator_read_artifact", "skc_coordinator_read_coordination_status", "skc_coordinator_watch_events", "skc_coordinator_register_session", "skc_coordinator_start_session", "skc_coordinator_send_prompt", "skc_coordinator_submit_question_answer", "skc_coordinator_read_turn", "skc_coordinator_await_turn", "skc_coordinator_report_status", "skc_delegate_plan", "skc_delegate_execute", "skc_delegate_team"];
 export type CoordinatorToolName = (typeof COORDINATOR_MCP_TOOL_NAMES)[number];

package/dist/types/daemon/builtin.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Static built-in daemon controller map.
+ *
+ * Intentionally a static map keyed by daemon kind rather than a mutable plugin
+ * registry: there is exactly one kind today (`telegram`). Promote to a richer
+ * registry only when a second daemon kind exists.
+ */
+import type { Settings } from "../config/settings";
+import { type TelegramDaemonControlDeps } from "../notifications/telegram-daemon-control";
+import type { BuiltInDaemonController, DaemonKind } from "./control-types";
+export declare const BUILT_IN_DAEMON_KINDS: readonly ["telegram"];
+export interface BuiltInDaemonControllerDeps {
+    telegram?: TelegramDaemonControlDeps;
+}
+export declare function createBuiltInDaemonControllers(settings: Settings, deps?: BuiltInDaemonControllerDeps): Record<DaemonKind, BuiltInDaemonController>;
+/**
+ * Resolve the controllers a command should act on. `--all` selects every
+ * built-in kind; otherwise the explicit `kinds` (defaulting to `telegram`).
+ */
+export declare function selectDaemonControllers(settings: Settings, kinds: DaemonKind[] | undefined, all: boolean, deps?: BuiltInDaemonControllerDeps): BuiltInDaemonController[];

package/dist/types/daemon/control-types.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Public types for the `skc daemon` control plane.
+ *
+ * Deliberately compact: a small result/status surface plus a built-in
+ * controller contract. There is exactly one daemon kind today (`telegram`);
+ * a richer registry is intentionally deferred until a second kind exists.
+ */
+export type DaemonKind = "telegram";
+export type DaemonAction = "list" | "status" | "stop" | "reload";
+export type DaemonHealth = "not_configured" | "stopped" | "running" | "stale" | "stopping" | "error";
+export interface DaemonRuntimeInfo {
+    /** `source` when respawn goes through bun/node + the entry script; `compiled` for a single-file binary. */
+    mode: "source" | "compiled";
+    execPath: string;
+    /** True only in source/dev mode, where a respawn loads amended TypeScript directly. */
+    reloadPicksUpSourceEdits: boolean;
+    /** Present when the runtime mode constrains what reload can achieve (e.g. compiled binary). */
+    warning?: string;
+}
+export interface DaemonStatus {
+    kind: DaemonKind;
+    configured: boolean;
+    health: DaemonHealth;
+    pid?: number;
+    ownerId?: string;
+    startedAt?: number;
+    heartbeatAt?: number;
+    roots?: string[];
+    rootCount?: number;
+    runtime: DaemonRuntimeInfo;
+    detail?: string;
+}
+export interface DaemonOperationOptions {
+    /** How long to wait for cooperative release before escalating. */
+    gracefulTimeoutMs?: number;
+    /** How long to wait for the old pid to die after SIGKILL. */
+    killTimeoutMs?: number;
+    /** Allow hard-kill escalation / acting on a still-live owner. */
+    force?: boolean;
+    /** For reload: spawn a fresh owner even when none is currently running. */
+    spawnIfStopped?: boolean;
+}
+export interface DaemonOperationResult {
+    kind: DaemonKind;
+    action: Exclude<DaemonAction, "list">;
+    ok: boolean;
+    before?: DaemonStatus;
+    after?: DaemonStatus;
+    warnings: string[];
+    message: string;
+}
+export interface BuiltInDaemonController {
+    readonly kind: DaemonKind;
+    status(): Promise<DaemonStatus>;
+    stop(opts?: DaemonOperationOptions): Promise<DaemonOperationResult>;
+    reload(opts?: DaemonOperationOptions): Promise<DaemonOperationResult>;
+}

package/dist/types/daemon/runtime.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared source-vs-compiled runtime detection for daemon spawning.
+ *
+ * Centralizes the logic previously embedded in `ensureTelegramDaemonRunning`
+ * so session autostart, reload, and status reporting agree on how a daemon
+ * process is launched and whether a reload can pick up amended source.
+ */
+export interface SkcRuntimeSpawnInfo {
+    execPath: string;
+    mode: "source" | "compiled";
+    /** Prefix prepended before the skc subcommand args; `[Bun.main]` in source mode, otherwise `[]`. */
+    argsPrefix: string[];
+    /** True only when respawn loads edited TypeScript directly (source/dev mode). */
+    reloadPicksUpSourceEdits: boolean;
+    /** Set in compiled mode to explain that a rebuild is required before reload picks up source edits. */
+    warning?: string;
+}
+/**
+ * Resolve how to spawn a detached skc subcommand for the current runtime.
+ *
+ * Source/dev mode (bun/node) prepends the entry script (`Bun.main`) so the
+ * respawn loads edited source. A compiled single-file binary self-spawns its
+ * own subcommand directly and cannot pick up workspace source edits.
+ */
+export declare function resolveSkcRuntimeSpawnInfo(execPath?: string): SkcRuntimeSpawnInfo;

package/dist/types/defaults/skc-defaults.d.ts

@@ -1,6 +1,6 @@
 export declare const DEFAULT_SKC_DEFINITION_NAMES: readonly ["deep-interview", "ralplan", "team", "ultragoal"];
 export type DefaultSkcDefinitionName = (typeof DEFAULT_SKC_DEFINITION_NAMES)[number];
-export type DefaultSkcDefinitionKind = "skill" | "skill-fragment";
+export type DefaultSkcDefinitionKind = "skill" | "skill-fragment" | "rule";
 export type EmbeddedDefaultSkcSkill = {
     name: DefaultSkcDefinitionName;
     description: string;
@@ -23,7 +23,13 @@ export interface DefaultSkcSkillFragmentDefinition {
     relativePath: string;
     content: string;
 }
-export type DefaultSkcDefinition = DefaultSkcSkillDefinition | DefaultSkcSkillFragmentDefinition;
+export interface DefaultSkcRuleDefinition {
+    kind: "rule";
+    name: string;
+    relativePath: string;
+    content: string;
+}
+export type DefaultSkcDefinition = DefaultSkcSkillDefinition | DefaultSkcSkillFragmentDefinition | DefaultSkcRuleDefinition;
 export interface InstallDefaultSkcDefinitionsOptions {
     check?: boolean;
     force?: boolean;
@@ -39,6 +45,11 @@ export type DefaultSkcDefinitionInstallFile = {
     parentSkillName: DefaultSkcDefinitionName;
     path: string;
     status: DefaultSkcInstallStatus;
+} | {
+    kind: "rule";
+    name: string;
+    path: string;
+    status: DefaultSkcInstallStatus;
 };
 export interface DefaultSkcDefinitionInstallResult {
     targetRoot: string;

package/dist/types/extensibility/extensions/types.d.ts

@@ -20,6 +20,7 @@ import type { PythonResult } from "../../eval/py/executor";
 import type { BashResult } from "../../exec/bash-executor";
 import type { ExecOptions, ExecResult } from "../../exec/exec";
 import type { CustomEditor } from "../../modes/components/custom-editor";
+import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/unattended-session";
 import type { Theme } from "../../modes/theme/theme";
 import type { CustomMessage } from "../../session/messages";
 import type { ReadonlySessionManager, SessionManager } from "../../session/session-manager";
@@ -206,6 +207,11 @@ export interface ExtensionContext {
     getSystemPrompt(): string[];
     /** @deprecated Use hasPendingMessages() instead */
     hasQueuedMessages(): boolean;
+    /**
+     * Unattended workflow-gate bridge. Present only when the session runs in
+     * unattended/RPC mode; `undefined` in interactive/TUI mode (notify-only).
+     */
+    workflowGate?: WorkflowGateEmitter;
 }
 /**
  * Extended context for command handlers.
@@ -834,6 +840,8 @@ export interface ExtensionContextActions {
     getContextUsage: () => ContextUsage | undefined;
     compact: (instructionsOrOptions?: string | CompactOptions) => Promise<void>;
     getSystemPrompt: () => string[];
+    /** Unattended workflow-gate bridge (present only in unattended/RPC mode). */
+    getWorkflowGate?: () => WorkflowGateEmitter | undefined;
 }
 /** Actions for ExtensionCommandContext (ctx.* in command handlers). */
 export interface ExtensionCommandContextActions {

package/dist/types/extensibility/plugins/index.d.ts

@@ -4,4 +4,5 @@ export * from "./loader";
 export * from "./manager";
 export * from "./marketplace";
 export * from "./parser";
+export * from "./security-scanner";
 export type * from "./types";

package/dist/types/extensibility/plugins/security-scanner.d.ts

@@ -0,0 +1,31 @@
+import type { DoctorCheck } from "./types";
+export type RiskLevel = "none" | "low" | "medium" | "high";
+export type FindingCategory = "credential" | "execution" | "network" | "obfuscation" | "package_install" | "persistence";
+export interface SecurityFinding {
+    category: FindingCategory;
+    id: string;
+    label: string;
+    severity: "low" | "medium" | "high";
+    file: string;
+    line?: number;
+    snippet?: string;
+}
+export interface ScanReport {
+    findings: SecurityFinding[];
+    networkUrls: string[];
+    riskLevel: RiskLevel;
+    score: number;
+    reasoning: string;
+    recommendation: string;
+}
+/**
+ * Recursively scan `dir` for risky patterns.
+ * Never throws — on any top-level error returns an empty safe report.
+ */
+export declare function scanPluginDir(dir: string): Promise<ScanReport>;
+/**
+ * Convert a ScanReport into DoctorCheck entries for the plugin health check.
+ * Returns [] when riskLevel is "none".
+ * NEVER emits status:"error" — advisory only.
+ */
+export declare function toDoctorChecks(pluginName: string, report: ScanReport): DoctorCheck[];