@yagni-app/code-staging 1.2.4-staging.1778.1 → 1.2.4-staging.1809.1

package/dist/agentSources.d.ts

@@ -0,0 +1,78 @@
+/**
+ * A cloud run's skill sources (YAG-784): the mission file `sources.json` the
+ * backend writes beside `ticket.md`, and the compat options it turns into.
+ *
+ * The backend decides everything here: whether the working repo is trusted
+ * for agent runs (an admin's per-repo flag, standing in for pi's trust.json),
+ * and which org marketplace and personal skills snapshots it fetched and
+ * extracted under AGENT_SOURCES_ROOT. The CLI only reads the file, so it
+ * carries its own small validator rather than importing @yagni/shared (this
+ * package never takes a build-time dependency on a private workspace package).
+ * The contract is `AgentRunSourcesFile` in packages/shared/src/agentSources.ts.
+ *
+ * Everything is fail-soft: a missing, oversized, or garbled file means "no
+ * cloud sources" (the caller falls back to local behavior), and one bad
+ * source is dropped without touching the others.
+ */
+import type { CompatExtraRoot, CompatMarketplace } from "./claudeCompat.js";
+/** Where the backend extracts the org and personal snapshots in the sandbox. */
+export declare const AGENT_SOURCES_ROOT = "/opt/yagni/sources";
+export declare const AGENT_RUN_SOURCES_FILE_NAME = "sources.json";
+/** pi-harness.sh's default when YAGNI_MISSION_DIR is unset. */
+export declare const DEFAULT_MISSION_DIR = "/opt/yagni/mission";
+export interface AgentRunSources {
+    repo: {
+        fullName: string;
+        sha: string;
+        trusted: boolean;
+    };
+    org: {
+        fullName: string;
+        ref: string | null;
+        sha: string;
+        dir: string;
+        enabledPlugins: string[];
+    } | null;
+    personal: {
+        fullName: string;
+        ref: string | null;
+        sha: string;
+        dir: string;
+        userId: string;
+    } | null;
+}
+/** Validate a parsed sources.json (version 1). Null when it isn't one. */
+export declare function parseAgentRunSources(raw: unknown): AgentRunSources | null;
+/**
+ * Read `<missionDir>/sources.json`. Null when absent, too large, or invalid.
+ * Never throws. A file that is there but unusable is not the same as no file:
+ * the backend already recorded its sources as loaded, so `warn` says so (one
+ * stderr line in a headless run) rather than degrade to local mode silently.
+ */
+export declare function readAgentRunSources(missionDir: string, warn?: (line: string) => void): AgentRunSources | null;
+/** The mission dir the harness wrote into (`YAGNI_MISSION_DIR`, else its default). */
+export declare function missionDirFromEnv(env: NodeJS.ProcessEnv): string;
+/**
+ * `dir` as a realpath when it is absolute, an existing directory, and inside
+ * `sourcesRoot` after symlink resolution; else the reason it was refused.
+ */
+export declare function checkSourceDir(dir: string, sourcesRoot: string): {
+    dir: string;
+} | {
+    refused: string;
+};
+/** What a valid sources file asks `claudeCompatArgs` to load. */
+export interface CloudCompatOptions {
+    trustOverride: boolean;
+    extraRoots: CompatExtraRoot[];
+    marketplaces: CompatMarketplace[];
+    /** `label: reason` for each source dir that was refused. */
+    refused: string[];
+}
+/**
+ * Turn a sources file into compat options. Snapshot dirs must sit under
+ * `sourcesRoot` (AGENT_SOURCES_ROOT in the sandbox); any other dir is refused
+ * and reported, never loaded.
+ */
+export declare function cloudCompatOptions(sources: AgentRunSources, sourcesRoot?: string): CloudCompatOptions;
+//# sourceMappingURL=agentSources.d.ts.map

package/dist/agentSources.js

@@ -0,0 +1,194 @@
+/**
+ * A cloud run's skill sources (YAG-784): the mission file `sources.json` the
+ * backend writes beside `ticket.md`, and the compat options it turns into.
+ *
+ * The backend decides everything here: whether the working repo is trusted
+ * for agent runs (an admin's per-repo flag, standing in for pi's trust.json),
+ * and which org marketplace and personal skills snapshots it fetched and
+ * extracted under AGENT_SOURCES_ROOT. The CLI only reads the file, so it
+ * carries its own small validator rather than importing @yagni/shared (this
+ * package never takes a build-time dependency on a private workspace package).
+ * The contract is `AgentRunSourcesFile` in packages/shared/src/agentSources.ts.
+ *
+ * Everything is fail-soft: a missing, oversized, or garbled file means "no
+ * cloud sources" (the caller falls back to local behavior), and one bad
+ * source is dropped without touching the others.
+ */
+import { closeSync, fstatSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, sep } from "node:path";
+/** Where the backend extracts the org and personal snapshots in the sandbox. */
+export const AGENT_SOURCES_ROOT = "/opt/yagni/sources";
+export const AGENT_RUN_SOURCES_FILE_NAME = "sources.json";
+/** pi-harness.sh's default when YAGNI_MISSION_DIR is unset. */
+export const DEFAULT_MISSION_DIR = "/opt/yagni/mission";
+/** A sources file is a few hundred bytes; anything past this is not one. */
+const MAX_SOURCES_FILE_BYTES = 64 * 1024;
+/** Mirrors MAX_ENABLED_PLUGINS in the shared contract. */
+const MAX_ENABLED_PLUGINS = 50;
+/**
+ * A label, never a path. The owner allows `_` because a working repo can
+ * belong to an Enterprise Managed User (`jane_acme`); rejecting it would drop
+ * the whole file and silently ignore the repo's trust flag.
+ */
+const FULL_NAME = /^[A-Za-z0-9_-]{1,39}\/[A-Za-z0-9._-]{1,100}$/;
+const SHA = /^[0-9a-f]{40}$/;
+/** Same shape as claudePlugins' SAFE_SEGMENT: plugin names are path segments. */
+const PLUGIN_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function refOf(value) {
+    if (value === undefined || value === null)
+        return null;
+    return typeof value === "string" && value.length > 0 && value.length <= 255 ? value : undefined;
+}
+function snapshotBase(value) {
+    if (!isRecord(value))
+        return null;
+    const { fullName, sha, dir } = value;
+    const ref = refOf(value.ref);
+    if (typeof fullName !== "string" || !FULL_NAME.test(fullName))
+        return null;
+    if (typeof sha !== "string" || !SHA.test(sha))
+        return null;
+    if (typeof dir !== "string" || dir.length === 0)
+        return null;
+    if (ref === undefined)
+        return null;
+    return { fullName, ref, sha, dir };
+}
+/** Validate a parsed sources.json (version 1). Null when it isn't one. */
+export function parseAgentRunSources(raw) {
+    if (!isRecord(raw) || raw.version !== 1 || !isRecord(raw.repo))
+        return null;
+    const { fullName, sha, trusted } = raw.repo;
+    if (typeof fullName !== "string" || !FULL_NAME.test(fullName))
+        return null;
+    if (typeof sha !== "string" || !SHA.test(sha))
+        return null;
+    if (typeof trusted !== "boolean")
+        return null;
+    let org = null;
+    const orgBase = snapshotBase(raw.org);
+    if (orgBase && isRecord(raw.org) && Array.isArray(raw.org.enabledPlugins)) {
+        const enabledPlugins = [
+            ...new Set(raw.org.enabledPlugins.filter((p) => typeof p === "string" && PLUGIN_NAME.test(p))),
+        ].slice(0, MAX_ENABLED_PLUGINS);
+        org = { ...orgBase, enabledPlugins };
+    }
+    let personal = null;
+    const personalBase = snapshotBase(raw.personal);
+    if (personalBase && isRecord(raw.personal) && typeof raw.personal.userId === "string") {
+        personal = { ...personalBase, userId: raw.personal.userId };
+    }
+    return { repo: { fullName, sha, trusted }, org, personal };
+}
+/**
+ * Read `<missionDir>/sources.json`. Null when absent, too large, or invalid.
+ * Never throws. A file that is there but unusable is not the same as no file:
+ * the backend already recorded its sources as loaded, so `warn` says so (one
+ * stderr line in a headless run) rather than degrade to local mode silently.
+ */
+export function readAgentRunSources(missionDir, warn = () => { }) {
+    const path = join(missionDir, AGENT_RUN_SOURCES_FILE_NAME);
+    let fd = null;
+    try {
+        try {
+            fd = openSync(path, "r");
+        }
+        catch (err) {
+            if (err?.code === "ENOENT")
+                return null;
+            throw err;
+        }
+        const size = fstatSync(fd).size;
+        if (size === 0 || size > MAX_SOURCES_FILE_BYTES) {
+            warn(`Skills: ${path} ignored (${size === 0 ? "empty" : `larger than ${MAX_SOURCES_FILE_BYTES} bytes`}); no skills sources loaded`);
+            return null;
+        }
+        const buffer = Buffer.alloc(size);
+        readSync(fd, buffer, 0, size, 0);
+        const parsed = parseAgentRunSources(JSON.parse(buffer.toString("utf8")));
+        if (!parsed)
+            warn(`Skills: ${path} ignored (not a valid version 1 sources file); no skills sources loaded`);
+        return parsed;
+    }
+    catch (err) {
+        const why = err instanceof SyntaxError ? "not valid JSON" : err instanceof Error ? err.message : String(err);
+        warn(`Skills: ${path} ignored (${why}); no skills sources loaded`);
+        return null;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Already closed.
+            }
+        }
+    }
+}
+/** The mission dir the harness wrote into (`YAGNI_MISSION_DIR`, else its default). */
+export function missionDirFromEnv(env) {
+    const dir = env.YAGNI_MISSION_DIR?.trim();
+    return dir ? dir : DEFAULT_MISSION_DIR;
+}
+/**
+ * `dir` as a realpath when it is absolute, an existing directory, and inside
+ * `sourcesRoot` after symlink resolution; else the reason it was refused.
+ */
+export function checkSourceDir(dir, sourcesRoot) {
+    if (!isAbsolute(dir))
+        return { refused: "not an absolute path" };
+    let real;
+    let realRoot;
+    try {
+        real = realpathSync(dir);
+        realRoot = realpathSync(sourcesRoot);
+    }
+    catch {
+        return { refused: "not present in the sandbox" };
+    }
+    if (!real.startsWith(realRoot + sep))
+        return { refused: `outside ${sourcesRoot}` };
+    try {
+        if (!statSync(real).isDirectory())
+            return { refused: "not a directory" };
+    }
+    catch {
+        return { refused: "not present in the sandbox" };
+    }
+    return { dir: real };
+}
+/**
+ * Turn a sources file into compat options. Snapshot dirs must sit under
+ * `sourcesRoot` (AGENT_SOURCES_ROOT in the sandbox); any other dir is refused
+ * and reported, never loaded.
+ */
+export function cloudCompatOptions(sources, sourcesRoot = AGENT_SOURCES_ROOT) {
+    const out = {
+        trustOverride: sources.repo.trusted,
+        extraRoots: [],
+        marketplaces: [],
+        refused: [],
+    };
+    if (sources.org) {
+        const label = `${sources.org.fullName} @ ${sources.org.sha.slice(0, 7)}`;
+        const checked = checkSourceDir(sources.org.dir, sourcesRoot);
+        if ("dir" in checked)
+            out.marketplaces.push({ root: checked.dir, enabled: sources.org.enabledPlugins, label });
+        else
+            out.refused.push(`${label}: ${checked.refused}`);
+    }
+    if (sources.personal) {
+        const label = `${sources.personal.fullName} @ ${sources.personal.sha.slice(0, 7)}`;
+        const checked = checkSourceDir(sources.personal.dir, sourcesRoot);
+        if ("dir" in checked)
+            out.extraRoots.push({ root: checked.dir, label });
+        else
+            out.refused.push(`${label}: ${checked.refused}`);
+    }
+    return out;
+}
+//# sourceMappingURL=agentSources.js.map

package/dist/claudeCompat.d.ts

@@ -107,6 +107,60 @@ export declare function readTrustDecision(agentDir: string, cwd: string): boolea
  * asked again next launch.
  */
 export declare function writeTrustDecision(agentDir: string, cwd: string, decision: boolean): void;
+/**
+ * A personal skills root (a person's own skills repository, extracted into the
+ * sandbox). Any of the layouts in EXTRA_ROOT_LAYOUT that exist load,
+ * regardless of the working repo's trust: the backend only hands over a root
+ * it authorized.
+ */
+export interface CompatExtraRoot {
+    root: string;
+    /** Human label for logs, e.g. `jane/skills`. */
+    label: string;
+}
+/**
+ * A plugin marketplace checkout (`<root>/.claude-plugin/marketplace.json`) of
+ * which only the `enabled` plugins load. Only relative-path plugin sources are
+ * supported; object sources (github, url, npm) are reported, never fetched.
+ */
+export interface CompatMarketplace {
+    root: string;
+    enabled: string[];
+    label: string;
+}
+/** Personal root layouts, in load order. */
+export declare const EXTRA_ROOT_LAYOUT: {
+    readonly skills: readonly ["skills", ".claude/skills", ".agents/skills"];
+    readonly commands: readonly ["commands", ".claude/commands"];
+    readonly rules: readonly ["rules", ".claude/rules"];
+};
+/** Bound on the symlink scan of one asset path, so a huge tree can't stall a launch. */
+export declare const SYMLINK_SCAN_LIMIT = 20000;
+/**
+ * `<root>/<rel>` as a realpath when it exists, is a directory, stays inside
+ * `root` after symlink resolution, and holds no symlink pointing outside it.
+ * Every source the interactive launcher never read goes through this, so a
+ * hostile link in a repo or snapshot can't hand pi a directory outside it.
+ * `scanLimit` exists for tests: a tree with more entries than it is refused.
+ */
+export declare function safeSourceDir(root: string, rel: string, scanLimit?: number): string | null;
+/** One source's contribution, summarized for the launcher's log line. */
+export interface CompatSourceSummary {
+    label: string;
+    kind: "user" | "project" | "personal" | "org-marketplace";
+    skills: string[];
+    commands: string[];
+    rulesDirs: string[];
+    /** `name@marketplace` keys of the plugins it contributed. */
+    plugins: string[];
+    /** Things present but not loaded (unsupported plugin parts, missing plugins). */
+    unsupported: string[];
+}
+/** The enabled plugins of one marketplace checkout, plus what could not load. Never throws. */
+export declare function marketplacePlugins(mp: CompatMarketplace): {
+    plugins: PluginAssets[];
+    unsupported: string[];
+};
 export interface ClaudeCompatDeps {
     cwd: string;
     /** The hermetic pi agent dir for the active profile (holds trust.json). */
@@ -116,6 +170,26 @@ export interface ClaudeCompatDeps {
     interactive?: boolean;
     /** The one-time trust question; injectable for tests. */
     confirm?: (question: string) => Promise<boolean>;
+    /**
+     * A trust decision made elsewhere (a cloud run's per-repo admin flag). It
+     * replaces the trust.json lookup and the prompt, and is never written back.
+     */
+    trustOverride?: boolean;
+    /** False skips `~/.claude`, home plugins and the YAGNI ledger. Default true. */
+    userScope?: boolean;
+    /** False never emits YAGNI_CLAUDE_PLUGIN_MCP (headless runs). Default true. */
+    pluginMcp?: boolean;
+    /**
+     * Once the folder is trusted, also wire `<cwd>/.agents/skills`, `.pi/skills`
+     * (`--skill`) and `.pi/prompts` (`--prompt-template`) explicitly, so a
+     * headless run never needs pi's `--approve` (which would also run the repo's
+     * `.pi/extensions` code). Default false.
+     */
+    projectNativeSkills?: boolean;
+    /** Personal skills roots; load regardless of the folder's trust. */
+    extraRoots?: CompatExtraRoot[];
+    /** Plugin marketplaces with an explicit enabled list; load regardless of trust. */
+    marketplaces?: CompatMarketplace[];
 }
 export declare function compatDisabled(env: NodeJS.ProcessEnv): boolean;
 export interface ClaudeCompatLaunch {
@@ -123,12 +197,21 @@ export interface ClaudeCompatLaunch {
     argv: string[];
     /** Extra child env (plugin agent dirs, rules dirs) for the extension. */
     env: Record<string, string>;
+    /**
+     * What each source contributed, for logging. Absent when nothing loaded and
+     * no extra source was asked for.
+     */
+    sources?: CompatSourceSummary[];
 }
 /**
  * The extra pi argv + child env for this launch: user-scope dirs and plugins
  * unconditionally, project-sourced dirs/plugins/rules once trusted, asking
  * (and persisting) the trust decision when needed. Everything is fail-soft —
  * compat can only add flags/env, never break a launch.
+ *
+ * The optional deps (`trustOverride`, `userScope`, `pluginMcp`,
+ * `projectNativeSkills`, `extraRoots`, `marketplaces`) serve headless cloud
+ * runs; left unset, the argv and env are exactly the interactive behavior.
  */
 export declare function claudeCompatArgs(deps: ClaudeCompatDeps): Promise<ClaudeCompatLaunch>;
 /** One plugin as the in-session `/plugin` panel sees it. */

package/dist/claudeCompat.js

@@ -28,10 +28,10 @@
  *
  * Set YAGNI_DISABLE_CLAUDE_COMPAT=1 to turn the whole bridge off.
  */
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, statSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { delimiter, dirname, join, resolve } from "node:path";
-import { discoverClaudePlugins } from "./claudePlugins.js";
+import { delimiter, dirname, join, resolve, sep } from "node:path";
+import { containedExistingPath, discoverClaudePlugins, pluginAssets, readMarketplace, resolveLocalPluginRoot, } from "./claudePlugins.js";
 import { pluginsHome, readLedger } from "./pluginStore.js";
 export const CLAUDE_COMPAT_DISABLE_ENV = "YAGNI_DISABLE_CLAUDE_COMPAT";
 /** Plugin `agents/` dirs for the extension's subagent discovery (delimiter-joined). */
@@ -241,6 +241,137 @@ export function writeTrustDecision(agentDir, cwd, decision) {
         }
     }
 }
+/** Personal root layouts, in load order. */
+export const EXTRA_ROOT_LAYOUT = {
+    skills: ["skills", ".claude/skills", ".agents/skills"],
+    commands: ["commands", ".claude/commands"],
+    rules: ["rules", ".claude/rules"],
+};
+/** Project dirs pi loads only behind its own trust; wired explicitly instead. */
+const PROJECT_NATIVE_SKILLS = [".agents/skills", ".pi/skills"];
+const PROJECT_NATIVE_PROMPTS = [".pi/prompts"];
+/** Bound on the symlink scan of one asset path, so a huge tree can't stall a launch. */
+export const SYMLINK_SCAN_LIMIT = 20_000;
+function isContainedIn(realRoot, real) {
+    return real === realRoot || real.startsWith(realRoot + sep);
+}
+/**
+ * True when `path` (inside `realRoot`) holds no symlink that resolves outside
+ * `realRoot`. A tree too large to scan within the bound counts as unsafe.
+ */
+function symlinksStayInside(path, realRoot, scanLimit = SYMLINK_SCAN_LIMIT) {
+    let budget = scanLimit;
+    const stack = [path];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        let entries;
+        try {
+            if (!lstatSync(current).isDirectory())
+                continue;
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (--budget < 0)
+                return false;
+            const child = join(current, entry.name);
+            if (entry.isSymbolicLink()) {
+                let real;
+                try {
+                    real = realpathSync(child);
+                }
+                catch {
+                    continue; // Dangling: nothing can be read through it.
+                }
+                if (!isContainedIn(realRoot, real))
+                    return false;
+            }
+            else if (entry.isDirectory()) {
+                stack.push(child);
+            }
+        }
+    }
+    return true;
+}
+/**
+ * `<root>/<rel>` as a realpath when it exists, is a directory, stays inside
+ * `root` after symlink resolution, and holds no symlink pointing outside it.
+ * Every source the interactive launcher never read goes through this, so a
+ * hostile link in a repo or snapshot can't hand pi a directory outside it.
+ * `scanLimit` exists for tests: a tree with more entries than it is refused.
+ */
+export function safeSourceDir(root, rel, scanLimit = SYMLINK_SCAN_LIMIT) {
+    const contained = containedExistingPath(root, rel);
+    if (!contained || !isDirectory(contained))
+        return null;
+    let realRoot;
+    try {
+        realRoot = realpathSync(root);
+    }
+    catch {
+        return null;
+    }
+    return symlinksStayInside(contained, realRoot, scanLimit) ? contained : null;
+}
+function emptySummary(label, kind) {
+    return { label, kind, skills: [], commands: [], rulesDirs: [], plugins: [], unsupported: [] };
+}
+function summaryHasContent(s) {
+    return s.skills.length + s.commands.length + s.rulesDirs.length + s.plugins.length + s.unsupported.length > 0;
+}
+function addPluginsToSummary(summary, plugins) {
+    for (const plugin of plugins) {
+        summary.plugins.push(plugin.key);
+        summary.skills.push(...plugin.skillPaths);
+        summary.commands.push(...plugin.commandPaths);
+        summary.unsupported.push(...plugin.unsupported.map((u) => `${plugin.key}: ${u}`));
+    }
+}
+/** The enabled plugins of one marketplace checkout, plus what could not load. Never throws. */
+export function marketplacePlugins(mp) {
+    const marketplace = readMarketplace(mp.root);
+    let realRoot = null;
+    try {
+        realRoot = realpathSync(mp.root);
+    }
+    catch {
+        realRoot = null;
+    }
+    if (!marketplace || !realRoot) {
+        return { plugins: [], unsupported: [".claude-plugin/marketplace.json missing or unreadable"] };
+    }
+    const plugins = [];
+    const unsupported = [];
+    for (const name of new Set(mp.enabled)) {
+        const entry = marketplace.plugins.find((p) => p.name === name);
+        if (!entry) {
+            unsupported.push(`${name}: not in the marketplace`);
+            continue;
+        }
+        const root = resolveLocalPluginRoot(marketplace, entry);
+        if (!root) {
+            unsupported.push(`${name}: plugin source not supported`);
+            continue;
+        }
+        if (!symlinksStayInside(root, realRoot)) {
+            unsupported.push(`${name}: links outside the marketplace`);
+            continue;
+        }
+        const assets = pluginAssets(root, name, {
+            key: `${name}@${marketplace.name}`,
+            origin: "org-marketplace",
+            version: entry.version ?? null,
+        });
+        if (!assets) {
+            unsupported.push(`${name}: nothing to load`);
+            continue;
+        }
+        plugins.push(assets);
+    }
+    return { plugins, unsupported };
+}
 export function compatDisabled(env) {
     const value = env[CLAUDE_COMPAT_DISABLE_ENV];
     return value !== undefined && value !== "" && value !== "0";
@@ -250,27 +381,34 @@ export function compatDisabled(env) {
  * unconditionally, project-sourced dirs/plugins/rules once trusted, asking
  * (and persisting) the trust decision when needed. Everything is fail-soft —
  * compat can only add flags/env, never break a launch.
+ *
+ * The optional deps (`trustOverride`, `userScope`, `pluginMcp`,
+ * `projectNativeSkills`, `extraRoots`, `marketplaces`) serve headless cloud
+ * runs; left unset, the argv and env are exactly the interactive behavior.
  */
 export async function claudeCompatArgs(deps) {
     const env = deps.env ?? process.env;
     if (compatDisabled(env))
         return { argv: [], env: {} };
     const home = deps.homeDir ?? homedir();
-    const projectTrust = readTrustDecision(deps.agentDir, deps.cwd);
+    const userScope = deps.userScope !== false;
+    const projectTrust = deps.trustOverride ?? readTrustDecision(deps.agentDir, deps.cwd);
     let plugins;
     try {
         plugins = discoverClaudePlugins({
             cwd: deps.cwd,
             homeDir: home,
-            yagniLedger: readLedger(pluginsHome(env, home)),
+            ...(userScope ? { yagniLedger: readLedger(pluginsHome(env, home)) } : { includeUserScope: false }),
         });
     }
     catch {
         plugins = { user: [], project: [] };
     }
+    const projectDirs = probeClaudeDirs(deps.cwd);
+    const userDirs = userScope ? probeClaudeDirs(home) : { skills: null, commands: null, rules: null };
     const decision = decideClaudeCompat({
-        project: probeClaudeDirs(deps.cwd),
-        user: probeClaudeDirs(home),
+        project: projectDirs,
+        user: userDirs,
         projectPlugins: plugins.project,
         userPlugins: plugins.user,
         projectTrust,
@@ -286,27 +424,106 @@ export async function claudeCompatArgs(deps) {
             trusted = null;
         }
     }
-    const argv = [...decision.userArgv];
-    if (trusted === true)
+    // Backend-authorized sources (the org marketplace's enabled plugins and the
+    // personal roots) load whatever the folder's trust says.
+    const summaries = [];
+    const orgPlugins = [];
+    // Only keys that will actually load shadow an org copy: an untrusted repo's
+    // plugins never load, so they must not hide the org marketplace's copy.
+    const seenKeys = new Set([...plugins.user, ...(trusted === true ? plugins.project : [])].map((p) => p.key));
+    for (const mp of deps.marketplaces ?? []) {
+        const summary = emptySummary(mp.label, "org-marketplace");
+        const found = marketplacePlugins(mp);
+        const fresh = found.plugins.filter((p) => !seenKeys.has(p.key));
+        for (const p of fresh)
+            seenKeys.add(p.key);
+        orgPlugins.push(...fresh);
+        addPluginsToSummary(summary, fresh);
+        summary.unsupported.push(...found.unsupported);
+        summaries.push(summary);
+    }
+    const extraArgv = [];
+    const extraRulesDirs = [];
+    for (const extra of deps.extraRoots ?? []) {
+        const summary = emptySummary(extra.label, "personal");
+        const found = (rels) => rels.map((rel) => safeSourceDir(extra.root, rel)).filter((dir) => dir !== null);
+        summary.skills.push(...found(EXTRA_ROOT_LAYOUT.skills));
+        summary.commands.push(...found(EXTRA_ROOT_LAYOUT.commands));
+        summary.rulesDirs.push(...found(EXTRA_ROOT_LAYOUT.rules));
+        for (const dir of summary.skills)
+            extraArgv.push("--skill", dir);
+        for (const dir of summary.commands)
+            extraArgv.push("--prompt-template", dir);
+        extraRulesDirs.push(...summary.rulesDirs);
+        summaries.push(summary);
+    }
+    const nativeSkills = [];
+    const nativePrompts = [];
+    if (trusted === true && deps.projectNativeSkills === true) {
+        for (const rel of PROJECT_NATIVE_SKILLS) {
+            const dir = safeSourceDir(deps.cwd, rel);
+            if (dir)
+                nativeSkills.push(dir);
+        }
+        for (const rel of PROJECT_NATIVE_PROMPTS) {
+            const dir = safeSourceDir(deps.cwd, rel);
+            if (dir)
+                nativePrompts.push(dir);
+        }
+    }
+    const argv = [...decision.userArgv, ...pluginsToArgv(orgPlugins), ...extraArgv];
+    if (trusted === true) {
         argv.push(...decision.projectArgv);
+        for (const dir of nativeSkills)
+            argv.push("--skill", dir);
+        for (const dir of nativePrompts)
+            argv.push("--prompt-template", dir);
+    }
     const agentDirs = [
         ...decision.userAgentDirs,
+        ...orgPlugins.flatMap((p) => p.agentDirs),
         ...(trusted === true ? decision.projectAgentDirs : []),
     ];
     // User rules first, project rules last: the extension appends in order, so
     // project rules end up closest to the task — matching Claude Code priority.
     const rulesDirs = [
         ...decision.userRulesDirs,
+        ...extraRulesDirs,
         ...(trusted === true ? decision.projectRulesDirs : []),
     ];
-    const mcpEntries = [
-        ...decision.userMcp,
-        ...(trusted === true ? decision.projectMcp : []),
-    ];
+    // Org plugin servers come from repo config, so they ride the approval gate.
+    const mcpEntries = deps.pluginMcp === false
+        ? []
+        : [
+            ...decision.userMcp,
+            ...pluginMcpEntries(orgPlugins, true),
+            ...(trusted === true ? decision.projectMcp : []),
+        ];
     const loadedKeys = [
         ...plugins.user.map((p) => p.key),
+        ...orgPlugins.map((p) => p.key),
         ...(trusted === true ? plugins.project.map((p) => p.key) : []),
     ];
+    const user = emptySummary("~/.claude", "user");
+    if (userDirs.skills)
+        user.skills.push(userDirs.skills);
+    if (userDirs.commands)
+        user.commands.push(userDirs.commands);
+    user.rulesDirs.push(...decision.userRulesDirs);
+    addPluginsToSummary(user, plugins.user);
+    summaries.unshift(user);
+    if (trusted === true) {
+        const project = emptySummary("repository", "project");
+        if (projectDirs.skills)
+            project.skills.push(projectDirs.skills);
+        if (projectDirs.commands)
+            project.commands.push(projectDirs.commands);
+        project.rulesDirs.push(...decision.projectRulesDirs);
+        project.skills.push(...nativeSkills);
+        project.commands.push(...nativePrompts);
+        addPluginsToSummary(project, plugins.project);
+        summaries.push(project);
+    }
     const extraEnv = {};
     if (agentDirs.length > 0)
         extraEnv[CLAUDE_AGENT_DIRS_ENV] = agentDirs.join(delimiter);
@@ -316,7 +533,10 @@ export async function claudeCompatArgs(deps) {
         extraEnv[CLAUDE_PLUGIN_MCP_ENV] = JSON.stringify(mcpEntries);
     if (loadedKeys.length > 0)
         extraEnv[CLAUDE_PLUGIN_KEYS_ENV] = loadedKeys.join(delimiter);
-    return { argv, env: extraEnv };
+    // Explicitly requested sources are always reported (an empty one is news);
+    // user and project scope only when they contributed something.
+    const sources = summaries.filter((s) => s.kind === "org-marketplace" || s.kind === "personal" || summaryHasContent(s));
+    return { argv, env: extraEnv, ...(sources.length > 0 ? { sources } : {}) };
 }
 function toInventory(plugin, gated) {
     return {

package/dist/claudePlugins.d.ts

@@ -38,7 +38,12 @@
  * cannot reach outside its repo/plugin.
  */
 import type { PluginLedger } from "./pluginStore.js";
-export type PluginOrigin = "yagni" | "claude-code" | "repo-marketplace";
+/**
+ * `org-marketplace`: a workspace's plugin marketplace snapshot handed to a
+ * cloud run (YAG-784); loaded by `claudeCompatArgs`'s `marketplaces` option,
+ * never by `discoverClaudePlugins`.
+ */
+export type PluginOrigin = "yagni" | "claude-code" | "repo-marketplace" | "org-marketplace";
 export interface PluginMcp {
     /** File the servers came from (plugin `.mcp.json` or `plugin.json`). */
     sourcePath: string;
@@ -98,6 +103,8 @@ export interface EnableState {
  * project `.claude/settings.local.json`.
  */
 export declare function readEnabledPlugins(cwd: string, homeDir: string): Map<string, EnableState>;
+/** Project-scope `enabledPlugins` only (no user `~/.claude/settings.json`). */
+export declare function readProjectEnabledPlugins(cwd: string): Map<string, EnableState>;
 /** `~/.claude/plugins/known_marketplaces.json` → marketplace name → checkout dir. */
 export declare function readKnownMarketplaces(homeDir: string): Map<string, string>;
 /**
@@ -142,6 +149,13 @@ export interface DiscoverPluginsDeps {
     homeDir: string;
     /** YAGNI's own ledger (`readLedger` from pluginStore.ts); wins over the mirrored Claude Code state. */
     yagniLedger?: PluginLedger;
+    /**
+     * False skips everything under `homeDir` (the YAGNI ledger, Claude Code's
+     * install ledger, known marketplaces, user `enabledPlugins`), leaving only
+     * the repo's own marketplace and project `enabledPlugins` opt-outs. Headless
+     * cloud runs use it so nothing a sandbox step wrote under HOME can load.
+     */
+    includeUserScope?: boolean;
 }
 /**
  * All locally-present Claude Code plugin content relevant to `cwd`, split by

package/dist/claudePlugins.js

@@ -145,6 +145,13 @@ export function readEnabledPlugins(cwd, homeDir) {
     collectEnabled(join(cwd, ".claude", "settings.local.json"), "project", out);
     return out;
 }
+/** Project-scope `enabledPlugins` only (no user `~/.claude/settings.json`). */
+export function readProjectEnabledPlugins(cwd) {
+    const out = new Map();
+    collectEnabled(join(cwd, ".claude", "settings.json"), "project", out);
+    collectEnabled(join(cwd, ".claude", "settings.local.json"), "project", out);
+    return out;
+}
 /** `~/.claude/plugins/known_marketplaces.json` → marketplace name → checkout dir. */
 export function readKnownMarketplaces(homeDir) {
     const out = new Map();
@@ -365,9 +372,10 @@ function resolveInstalledRoot(key, installed, marketplaces, realCwd) {
  */
 export function discoverClaudePlugins(deps) {
     try {
-        const installed = readInstalledPlugins(deps.homeDir);
-        const enabled = readEnabledPlugins(deps.cwd, deps.homeDir);
-        const marketplaces = readKnownMarketplaces(deps.homeDir);
+        const userScope = deps.includeUserScope !== false;
+        const installed = userScope ? readInstalledPlugins(deps.homeDir) : new Map();
+        const enabled = userScope ? readEnabledPlugins(deps.cwd, deps.homeDir) : readProjectEnabledPlugins(deps.cwd);
+        const marketplaces = userScope ? readKnownMarketplaces(deps.homeDir) : new Map();
         const realCwd = realOrNull(deps.cwd) ?? resolve(deps.cwd);
         const user = [];
         const project = [];
@@ -375,7 +383,7 @@ export function discoverClaudePlugins(deps) {
         // YAGNI-installed plugins are the user's own explicit action (`yagni
         // plugin install`), so both scopes load without ceremony; a project-scope
         // install applies only inside its repo.
-        for (const [key, entries] of Object.entries(deps.yagniLedger?.plugins ?? {})) {
+        for (const [key, entries] of Object.entries((userScope ? deps.yagniLedger?.plugins : undefined) ?? {})) {
             const applicable = entries.filter((e) => {
                 if (!e.enabled || !isDirectory(e.installPath))
                     return false;

package/dist/extension/pipeline/headlessGo.d.ts

@@ -143,6 +143,11 @@ export interface HeadlessGoDeps {
     env?: NodeJS.ProcessEnv;
     /** Environment for spawned stage children. Defaults to `env`. */
     childEnv?: NodeJS.ProcessEnv;
+    /**
+     * Extra pi flags for the build and fix stage children: the launcher's
+     * `--skill` / `--prompt-template` paths (YAG-784). See RunPipelineDeps.extraArgs.
+     */
+    extraArgs?: string[];
     /** Wall clock (epoch ms) the host's time left is anchored to. Defaults to `Date.now`; injected in tests. */
     now?: () => number;
     runPipeline?: typeof defaultRunPipeline;

package/dist/extension/pipeline/headlessGo.js

@@ -322,6 +322,7 @@ export async function runHeadlessGo(argv, deps = {}) {
     const pipelineDeps = {
         cwd,
         childEnv,
+        ...(deps.extraArgs?.length ? { extraArgs: deps.extraArgs } : {}),
         // `go.fanout` rides the same env surface as the tier cap, so a benchmark lane
         // pins the implement diamond without a second flag (spec decision 8).
         fanout: resolveFanoutMode(env),

package/dist/extension/pipeline/invocation.d.ts

@@ -73,5 +73,6 @@ export declare function buildStageInvocation(stage: PipelineStage, ctx: {
 export declare function groundedChildArgv(stageArgv: string[], opts: {
     piCli: string;
     extensionPath: string;
+    extraArgs?: string[];
 }): string[];
 //# sourceMappingURL=invocation.d.ts.map

package/dist/extension/pipeline/invocation.js

@@ -89,12 +89,19 @@ export function buildStageInvocation(stage, ctx) {
  */
 export function groundedChildArgv(stageArgv, opts) {
     const userChoseProvider = stageArgv.includes("--provider");
+    // Extra flags (the launcher's `--skill` / `--prompt-template` paths for a
+    // build or fix stage) go before the positional `Task: …` prompt, which pi
+    // reads as the message only while it stays last.
+    const extra = opts.extraArgs ?? [];
+    const passthrough = extra.length > 0 && stageArgv.length > 0
+        ? [...stageArgv.slice(0, -1), ...extra, stageArgv[stageArgv.length - 1]]
+        : stageArgv;
     return [
         opts.piCli,
         "-e",
         opts.extensionPath,
         ...(userChoseProvider ? [] : ["--provider", "yagni"]),
-        ...stageArgv,
+        ...passthrough,
     ];
 }
 //# sourceMappingURL=invocation.js.map

package/dist/extension/pipeline/orchestrator.d.ts

@@ -98,6 +98,14 @@ export interface RunPipelineDeps {
     grounded?: boolean;
     /** Environment inherited by spawned child stages. Defaults to the parent process env. */
     childEnv?: NodeJS.ProcessEnv;
+    /**
+     * Extra pi flags for the stages that write code: the single-writer
+     * implement, each builder, the synthesizer, every fixer, and the review
+     * loop's fix stage. Headless /go passes the launcher's `--skill` /
+     * `--prompt-template` paths here (YAG-784). Map, plan, the partitioner and
+     * the review lenses never get them.
+     */
+    extraArgs?: string[];
     /**
      * The no-op guard's git seam (injected for unit tests). Captures the repo
      * HEAD + porcelain status so the orchestrator can tell whether the build half

package/dist/extension/pipeline/orchestrator.js

@@ -275,12 +275,14 @@ export async function runPipeline(ticket, deps) {
     // `go:implement:<workstream>`), so per-workstream spend attributes for free the
     // way review lenses do. Every other stage leaves it undefined and keeps the
     // runner's own `go:<stage>` default.
-    const stageDepsFor = (tag, callerLabel) => {
+    // `writes` marks a build or fix child, the only ones that get `extraArgs`.
+    const stageDepsFor = (tag, callerLabel, writes = false) => {
         const onEvent = deps.onEvent;
         return {
             cwd: deps.cwd,
             signal: deps.signal,
             ...(deps.childEnv ? { env: deps.childEnv } : {}),
+            ...(writes && deps.extraArgs?.length ? { extraArgs: deps.extraArgs } : {}),
             ...(runId ? { attribution: { runId } } : {}),
             ...(callerLabel ? { callerLabel } : {}),
             onEvent: (ev) => {
@@ -462,7 +464,7 @@ export async function runPipeline(ticket, deps) {
         // after the builders have fixed what it pointed at.
         let summaryDefects = [];
         if (fanned) {
-            const synth = await runStageFn({ ...synthesizerStage(), tools: stage.tools }, { ticket: promptTicket, previous: composeSynthesizerInput(handoff, report), grounded }, stageDepsFor({ stageId: stage.id }, SYNTHESIZER_CALLER_LABEL));
+            const synth = await runStageFn({ ...synthesizerStage(), tools: stage.tools }, { ticket: promptTicket, previous: composeSynthesizerInput(handoff, report), grounded }, stageDepsFor({ stageId: stage.id }, SYNTHESIZER_CALLER_LABEL, true));
             stages.push(synth);
             if (!isFailed(synth) && synth.finalOutput.trim()) {
                 body = synth.finalOutput;
@@ -495,7 +497,7 @@ export async function runPipeline(ticket, deps) {
                 const fixes = await mapWithConcurrencyLimit(assigned, ceiling, async (a) => {
                     const siblings = workstreams.filter((s) => s.name !== a.workstream.name);
                     progress({ kind: "stage_start", stageId: stage.id, workstream: a.workstream.name });
-                    const fixed = await runStageFn({ ...fixerStage(a.workstream, renderFindings(a.findings), siblings), tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id, workstream: a.workstream.name }, workstreamCallerLabel(a.workstream.name)));
+                    const fixed = await runStageFn({ ...fixerStage(a.workstream, renderFindings(a.findings), siblings), tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id, workstream: a.workstream.name }, workstreamCallerLabel(a.workstream.name), true));
                     progress({
                         kind: "stage_done",
                         stageId: stage.id,
@@ -520,7 +522,7 @@ export async function runPipeline(ticket, deps) {
             if (unassigned.length > 0) {
                 const findingsText = renderFindings(unassigned);
                 const fixStage = fanned ? synthesizerFixStage(findingsText) : fixerStage(undefined, findingsText);
-                const fixed = await runStageFn({ ...fixStage, tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id }, fanned ? SYNTHESIZER_CALLER_LABEL : undefined));
+                const fixed = await runStageFn({ ...fixStage, tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id }, fanned ? SYNTHESIZER_CALLER_LABEL : undefined, true));
                 stages.push(fixed);
                 if (fanned) {
                     if (!isFailed(fixed) && fixed.finalOutput.trim()) {
@@ -587,7 +589,7 @@ export async function runPipeline(ticket, deps) {
         const partitionTag = { stageId: stage.id };
         const runSingleWriter = async (decision) => {
             recordDecision(decision, beforeBuild);
-            const written = await runStageFn(stage, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id }));
+            const written = await runStageFn(stage, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id }, undefined, true));
             stages.push(written);
             // A failed or credit-starved writer never reaches the checker: the build
             // loop's own guard turns it into `partial` or the honest stage error, and
@@ -670,7 +672,7 @@ export async function runPipeline(ticket, deps) {
             // starts and finishes on its own timing, tagged so interleaved events stay
             // attributed, and callers that ignore the tag still see one implement pair.
             progress({ kind: "stage_start", stageId: stage.id, workstream: w.name });
-            const built = await runStageFn({ ...builderStage(w, siblings), tools: stage.tools }, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id, workstream: w.name }, workstreamCallerLabel(w.name)));
+            const built = await runStageFn({ ...builderStage(w, siblings), tools: stage.tools }, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id, workstream: w.name }, workstreamCallerLabel(w.name), true));
             // A child that died says so on its own done beat (the `degraded` flag the
             // review lenses already use), so no surface paints a dead builder as built.
             progress({
@@ -1107,7 +1109,7 @@ export async function runPipeline(ticket, deps) {
         const fixStartedAt = clock();
         progress({ kind: "stage_start", stageId: "fix", round });
         stageEvent("fix", "start", { round });
-        const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: designContext ? `${serializeBlocking(findings)}\n\n${designContext}` : serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }));
+        const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: designContext ? `${serializeBlocking(findings)}\n\n${designContext}` : serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }, undefined, true));
         observedMs.fix = clock() - fixStartedAt;
         stages.push(fixResult);
         log("stage_done", { stageId: "fix", exitCode: fixResult.exitCode });

package/dist/extension/pipeline/runner.d.ts

@@ -35,6 +35,12 @@ export interface RunStageDeps {
     };
     /** Optional environment for spawned child stages. Defaults to Node's inherited env. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * Extra pi flags for this child, placed before the positional task prompt.
+     * Headless /go passes the launcher's `--skill` / `--prompt-template` paths
+     * here for build and fix stages only (YAG-784).
+     */
+    extraArgs?: string[];
     /**
      * YAG-471 attribution: the tracked run's server-assigned id (a UUID), sent to
      * the child as `YAGNI_RUN_ID` so the model proxy's `x-yagni-run-id` header

package/dist/extension/pipeline/runner.js

@@ -122,7 +122,11 @@ export async function runStage(stage, ctx, deps) {
             ...(tierCap ? { tierCap } : {}),
         });
         const { piCli, extensionPath } = resolveChild();
-        const argv = groundedChildArgv(passthrough, { piCli, extensionPath });
+        const argv = groundedChildArgv(passthrough, {
+            piCli,
+            extensionPath,
+            ...(deps.extraArgs?.length ? { extraArgs: deps.extraArgs } : {}),
+        });
         // Fold events into a fixed-size accumulator as they stream — never retain
         // the full array (that OOMs on a verbose stage; YAG-317 follow-up).
         const acc = newEventAccumulator();

package/dist/goHeadless.d.ts

@@ -14,7 +14,18 @@
  * `--plan-file`, optional `--memo-file`, `--run-id`, `--json`), so what Jack
  * runs locally and what the fleet executes are the same binary and the same
  * pipeline.
+ *
+ * Skills (YAG-784): the launcher also wires the same Claude Code compat seams
+ * an interactive launch gets, minus plugin MCP. In a cloud run the backend's
+ * `sources.json` mission file decides: the repo's committed skills load only
+ * when an admin marked it trusted for agent runs, and the org marketplace and
+ * personal skills snapshots load from AGENT_SOURCES_ROOT. With no such file
+ * (every local run) the folder's own pi trust decides, as it does
+ * interactively. The skill flags reach only the build and fix stages; rules
+ * and agent dirs ride the env to every stage.
  */
+import { type AgentRunSources } from "./agentSources.js";
+import { type ClaudeCompatDeps, type ClaudeCompatLaunch, type CompatSourceSummary } from "./claudeCompat.js";
 import { type OtelLaunchConfig } from "./otel.js";
 /** Mirrors HEADLESS_GO_EXIT in the extension; duplicated to keep the packages independent. */
 export declare const GO_EXIT: {
@@ -28,6 +39,7 @@ interface HeadlessGoModule {
         cwd?: string;
         env?: NodeJS.ProcessEnv;
         childEnv?: NodeJS.ProcessEnv;
+        extraArgs?: string[];
     }) => Promise<{
         exitCode: number;
     }>;
@@ -48,6 +60,12 @@ export interface GoCommandDeps {
     writeErr?: (line: string) => void;
     env?: NodeJS.ProcessEnv;
     cwd?: string;
+    /** Compat seam (tests inject one so nothing reads the real home). */
+    claudeCompat?: (deps: ClaudeCompatDeps) => Promise<ClaudeCompatLaunch>;
+    /** The `sources.json` reader; defaults to `$YAGNI_MISSION_DIR/sources.json`. */
+    readSources?: (env: NodeJS.ProcessEnv) => AgentRunSources | null;
+    /** Root every cloud snapshot dir must sit under; tests point it at a temp dir. */
+    sourcesRoot?: string;
 }
 /**
  * Build the environment every pipeline stage child inherits: the proxy
@@ -68,6 +86,12 @@ export declare function buildHeadlessChildEnv(opts: {
     /** Resolved OTel export config; stage children export when present. */
     otel?: OtelLaunchConfig;
 }): NodeJS.ProcessEnv;
+/** The one stderr line naming what each source contributed; null when there is nothing to say. */
+export declare function skillsSummaryLine(opts: {
+    cloud: AgentRunSources | null;
+    sources: CompatSourceSummary[];
+    refused: string[];
+}): string | null;
 /**
  * Run `yagni go`. Returns the process exit code: 0 only on a verified
  * candidate, 1 on any other pipeline outcome, 2 on a usage or credential

package/dist/goHeadless.js

@@ -14,11 +14,23 @@
  * `--plan-file`, optional `--memo-file`, `--run-id`, `--json`), so what Jack
  * runs locally and what the fleet executes are the same binary and the same
  * pipeline.
+ *
+ * Skills (YAG-784): the launcher also wires the same Claude Code compat seams
+ * an interactive launch gets, minus plugin MCP. In a cloud run the backend's
+ * `sources.json` mission file decides: the repo's committed skills load only
+ * when an admin marked it trusted for agent runs, and the org marketplace and
+ * personal skills snapshots load from AGENT_SOURCES_ROOT. With no such file
+ * (every local run) the folder's own pi trust decides, as it does
+ * interactively. The skill flags reach only the build and fix stages; rules
+ * and agent dirs ride the env to every stage.
  */
 import { randomUUID } from "node:crypto";
 import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { AGENT_SOURCES_ROOT, cloudCompatOptions, missionDirFromEnv, readAgentRunSources, } from "./agentSources.js";
 import { agentDirEnvVar } from "./branding.js";
+import { CLAUDE_AGENT_DIRS_ENV, CLAUDE_PLUGIN_KEYS_ENV, CLAUDE_PLUGIN_MCP_ENV, CLAUDE_RULES_DIRS_ENV, claudeCompatArgs, } from "./claudeCompat.js";
 import { agentDir, credentialsDir } from "./credentials.js";
 import { otelChildEnv, resolveOtelLaunchWithWorkspace } from "./otel.js";
 import { credentialsFromProfile, profilePath, readActiveProfile } from "./profiles.js";
@@ -60,6 +72,83 @@ export function buildHeadlessChildEnv(opts) {
         ...(opts.otel ? otelChildEnv(opts.otel, opts.baseEnv) : {}),
     };
 }
+/** The compat keys a headless launch computes itself rather than inherits. */
+const COMPAT_ENV_KEYS = [CLAUDE_AGENT_DIRS_ENV, CLAUDE_RULES_DIRS_ENV, CLAUDE_PLUGIN_MCP_ENV, CLAUDE_PLUGIN_KEYS_ENV];
+/** The run's working dir as the pipeline will resolve it (`--cwd` wins). */
+function pipelineCwd(args, fallback) {
+    for (let i = 0; i < args.length; i++) {
+        const token = args[i];
+        if (token === "--cwd" && args[i + 1])
+            return resolve(fallback, args[i + 1]);
+        if (token.startsWith("--cwd=") && token.length > 6)
+            return resolve(fallback, token.slice(6));
+    }
+    return fallback;
+}
+function countsOf(s) {
+    const parts = [];
+    const n = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+    if (s.plugins.length > 0)
+        parts.push(n(s.plugins.length, "plugin"));
+    if (s.skills.length > 0)
+        parts.push(n(s.skills.length, "skills dir"));
+    if (s.commands.length > 0)
+        parts.push(n(s.commands.length, "commands dir"));
+    if (s.rulesDirs.length > 0)
+        parts.push(n(s.rulesDirs.length, "rules dir"));
+    if (s.unsupported.length > 0)
+        parts.push(`${s.unsupported.length} not loaded (${s.unsupported.join("; ")})`);
+    return parts.length > 0 ? parts.join(", ") : "nothing to load";
+}
+/** The one stderr line naming what each source contributed; null when there is nothing to say. */
+export function skillsSummaryLine(opts) {
+    const parts = opts.sources.map((s) => {
+        const label = s.kind === "project" ? `${opts.cloud?.repo.fullName ?? "repository"} (trusted)` : s.label;
+        return `${label}: ${countsOf(s)}`;
+    });
+    if (opts.cloud && !opts.cloud.repo.trusted)
+        parts.push(`${opts.cloud.repo.fullName}: repository skills off (not trusted for agent runs)`);
+    for (const refused of opts.refused)
+        parts.push(`${refused} (skipped)`);
+    return parts.length > 0 ? `Skills: ${parts.join(" | ")}` : null;
+}
+/**
+ * The compat argv + env for a headless run. Cloud mode (a valid sources.json)
+ * trusts what the backend decided and never reads HOME; local mode keeps the
+ * folder's pi trust decision and the user's own `~/.claude`. Plugin MCP never
+ * loads headlessly. Never throws: a failure here only means no skills, and
+ * it says so on stderr so it is not mistaken for "nothing configured".
+ */
+async function headlessCompat(opts) {
+    const { cwd, agentDir, childEnv, deps, writeErr } = opts;
+    try {
+        const cloud = (deps.readSources ?? ((env) => readAgentRunSources(missionDirFromEnv(env), writeErr)))(childEnv);
+        const compat = deps.claudeCompat ?? claudeCompatArgs;
+        const base = { cwd, agentDir, env: childEnv, interactive: false, pluginMcp: false };
+        let refused = [];
+        let launch;
+        if (cloud) {
+            const plan = cloudCompatOptions(cloud, deps.sourcesRoot ?? AGENT_SOURCES_ROOT);
+            refused = plan.refused;
+            launch = await compat({
+                ...base,
+                trustOverride: plan.trustOverride,
+                userScope: false,
+                projectNativeSkills: true,
+                extraRoots: plan.extraRoots,
+                marketplaces: plan.marketplaces,
+            });
+        }
+        else {
+            launch = await compat(base);
+        }
+        return { launch, summary: skillsSummaryLine({ cloud, sources: launch.sources ?? [], refused }) };
+    }
+    catch (err) {
+        const why = err instanceof Error && err.message ? err.message : String(err);
+        return { launch: { argv: [], env: {} }, summary: `Skills: not loaded (the skills setup failed: ${why})` };
+    }
+}
 /**
  * Run `yagni go`. Returns the process exit code: 0 only on a verified
  * candidate, 1 on any other pipeline outcome, 2 on a usage or credential
@@ -135,10 +224,27 @@ export async function goCommand(args, deps = {}, cliVersion) {
         writeErr(err instanceof Error ? err.message : String(err));
         return GO_EXIT.usage;
     }
+    const cwd = deps.cwd ?? process.cwd();
+    const compat = await headlessCompat({
+        cwd: pipelineCwd(args, cwd),
+        agentDir: childEnv[agentDirEnvVar()],
+        childEnv,
+        deps,
+        writeErr,
+    });
+    // Recompute the compat keys rather than inherit a parent session's: plugin
+    // MCP especially must never reach a headless stage child.
+    for (const key of COMPAT_ENV_KEYS)
+        delete childEnv[key];
+    Object.assign(childEnv, compat.launch.env);
+    delete childEnv[CLAUDE_PLUGIN_MCP_ENV];
+    if (compat.summary)
+        writeErr(compat.summary);
     const outcome = await headless.runHeadlessGo(args, {
-        cwd: deps.cwd ?? process.cwd(),
+        cwd,
         env: baseEnv,
         childEnv,
+        ...(compat.launch.argv.length > 0 ? { extraArgs: compat.launch.argv } : {}),
     });
     return outcome.exitCode;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.4-staging.1778.1",
+  "version": "1.2.4-staging.1809.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "4aedf8e9e5093b88e04de0470bbf2c527583b644"
+  "yagniSourceSha": "33de16e5a97a30639624793c8e9f9d5120b7aea8"
 }