@yagni-app/code 0.1.0 → 0.2.1

package/README.md

@@ -39,8 +39,9 @@ flag) — ask your workspace admin. Maintainers: the alpha checklist is
 ## Develop
 
 Working in this monorepo, install from the repo instead of the registry. Build
-the extension first — the CLI loads `pi-extension-yagni` at runtime, so an
-unbuilt extension fails on launch — then build and link the CLI:
+the extension first — the CLI's build copies `pi-extension-yagni`'s `dist/` into
+its own `dist/extension/`, and fails loudly if the extension is not built — then
+build and link the CLI:
 
 ```bash
 pnpm --filter pi-extension-yagni build
@@ -65,6 +66,10 @@ Notes:
 
 - **Order matters when changing both.** The CLI bundles the extension, so build
   (or have a watcher running) `pi-extension-yagni` before `@yagni-app/code`.
+- **Watch mode does not re-bundle.** The copy into `dist/extension/` happens on
+  `build`, not on `tsc --watch`, and the launcher prefers that copy. After an
+  extension change, run `pnpm --filter @yagni-app/code bundle` (cheap, copy
+  only) or a full `build`, or you will keep running the previous extension.
 - **`yagni` is long-lived.** A rebuild only takes effect the next time you
   launch it — restart the CLI to pick up new code.
 - **Frontend/backend changes** (e.g. the `/v1` dev proxy) are served by
@@ -83,12 +88,16 @@ yagni -p "explain the deploy pipeline; ask_yagni if unsure"   # one-shot / print
 yagni logout         # revoke the token and clear it locally
 ```
 
-The agent runs on three opaque model tiers routed by YAGNI: `advanced` (the strongest,
-for judgment), `standard` (for execution) and `efficient` (cheapest).
-Interactive sessions default to `advanced`; pass `--model standard` or `--model
-efficient` to switch a run. The `/go` pipeline routes its own steps automatically —
-judgment steps (plan, review) on `advanced`, execution steps (map, implement, fix) on
-`standard`.
+The agent runs on five opaque model tiers routed by YAGNI: `balanced` (the
+interactive default), `peak` (the strongest, for hard judgment), `advanced`,
+`standard` (for execution) and `efficient` (cheapest). `balanced` is a strategy
+rather than a single rung: the session drives on the `advanced` tier and
+escalates a bounded number of hard judgment calls per session to `peak`, so the
+strongest model is consulted where being wrong is expensive instead of being
+paid for on every turn. Pass `--model peak`, `--model standard`, or `--model
+efficient` to pin a run to one tier. The `/go` pipeline routes its own steps
+automatically: judgment steps (plan, review) on `peak`, execution steps (map,
+implement, fix) on `standard`.
 
 `login` opens a device-code flow: it prints a short code and a URL. Open the URL
 in a browser where you are signed in to YAGNI, enter the code, and approve. The
@@ -107,6 +116,22 @@ flags like `--model` and `--print/-p` work.
   agent calls **`ask_yagni`** and gets a cited answer from the YAGNI app instead
   of guessing.
 
+### Works with your existing repo setup
+
+- A repo that already carries Claude Code assets keeps working with nothing to
+  edit: `.claude/skills` and `.claude/commands/*.md` load automatically (each
+  command becomes a `/name` slash command). Project-local assets load only
+  after a one-time per-folder trust prompt; set `YAGNI_DISABLE_CLAUDE_COMPAT=1`
+  to turn the bridge off.
+- `AGENTS.md` and `CLAUDE.md` context files load from the working directory and
+  its ancestors, unmodified.
+- MCP servers registered in your YAGNI workspace are available in-session: run
+  `/mcp` to list them. Calls are proxied through the YAGNI backend with your
+  own identity, so server credentials never reach the laptop and every call is
+  audited; mutating tools go through the same permission gate as file edits.
+  There is no local MCP config file: servers and credentials are managed in the
+  web app (Connections).
+
 ## Environments (profiles)
 
 YAGNI Code keeps a **sticky active environment**. Each environment ("profile") binds a
@@ -134,14 +159,43 @@ yagni use prod                           # switch back (sticky); prod is the def
 
 ## Configuration
 
-| Variable         | Default                  | Purpose                                            |
-| ---------------- | ------------------------ | -------------------------------------------------- |
-| `YAGNI_BASE_URL` | active environment's URL | Override the base URL for a **single run** (escape hatch). Prefer `yagni use` for anything sticky. |
+| Variable                      | Default                  | Purpose                                            |
+| ----------------------------- | ------------------------ | -------------------------------------------------- |
+| `YAGNI_BASE_URL`              | active environment's URL | Override the base URL for a **single run** (escape hatch). Prefer `yagni use` for anything sticky. |
+| `YAGNI_DISABLE_BRANDING`      | unset                    | `1` skips the YAGNI Code system-prompt rewrite entirely, so the engine's assembled prompt passes through byte-exact (no identity swap, no company-brief injection). |
+| `YAGNI_DISABLE_UPDATE_CHECK`  | unset                    | `1` silences the new-version notice and the background update check. |
+| `YAGNI_DISABLE_CLAUDE_COMPAT` | unset                    | `1` turns off the zero-config `.claude` assets bridge (skills and commands). |
+| `YAGNI_DISABLE_CRASH_REPORTS` | unset                    | `1` disables crash reporting (see "What leaves your machine"). |
 
 Credentials live in `~/.yagni-code/profiles/<name>.json` (mode `0600`); the active
 environment is recorded in `~/.yagni-code/config.json`. A pre-profiles
 `~/.yagni-code/credentials.json` is migrated automatically on first run.
 
+Device tokens are revocable from both ends: `yagni logout` revokes the current
+one, and a workspace admin can list every connected device and revoke any token
+from the web app (Settings, YAGNI Code, Connected devices). Tokens are stored
+hashed on the server and a revoked token stops validating immediately.
+
+### What leaves your machine
+
+Everything the agent needs (model calls, grounding lookups, MCP calls, usage
+metering) goes to your YAGNI backend over the authenticated session. No
+third-party analytics or telemetry SDK runs on your laptop, and the underlying
+engine's own telemetry and version pings are disabled at launch. Two outbound
+flows exist beyond your YAGNI backend and your own repo tooling, disclosed
+precisely:
+
+- **Update check.** In the background after launch, the CLI asks the npm
+  registry (or your configured private registry mirror) whether a newer
+  version of this package exists, so the next launch can show a one-line
+  nudge. Package metadata only; no code or workspace data. Disable with
+  `YAGNI_DISABLE_UPDATE_CHECK=1`.
+- **Crash reports.** When the client itself crashes, a sanitized crash report
+  (error class, scrubbed message and stack trace; secrets and env values
+  redacted, paths reduced) is sent to your YAGNI backend, not to any
+  third-party crash service, so we can fix the crash before you have to report
+  it. Disable with `YAGNI_DISABLE_CRASH_REPORTS=1`.
+
 ## Troubleshooting
 
 - **`Not logged in to environment "<name>" … Run \`yagni login\` first.`** — no

package/dist/claudeCompat.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Zero-config Claude Code repo compat.
+ *
+ * A repo that already carries Claude Code assets keeps working under YAGNI
+ * Code with nothing to edit: `.claude/skills` loads through pi's skill
+ * discovery and `.claude/commands/*.md` through pi's prompt templates (the
+ * same markdown-with-frontmatter format Claude Code uses — filename becomes
+ * the `/name` command). The launcher passes both as per-run `--skill` /
+ * `--prompt-template` flags, so nothing repo-local is ever written and no
+ * per-profile settings file accumulates stale per-repo paths.
+ *
+ * The same seams carry installed/enabled Claude Code plugins and the repo's
+ * own `.claude-plugin/marketplace.json` plugins (see claudePlugins.ts):
+ * plugin skills → `--skill`, plugin commands → `--prompt-template`, plugin
+ * `agents/` dirs → YAGNI_CLAUDE_AGENT_DIRS for the extension's subagent
+ * discovery. `.claude/rules` dirs travel as YAGNI_CLAUDE_RULES_DIRS for the
+ * extension's system-prompt rules injection. Design + on-disk evidence:
+ * docs/superpowers/specs/2026-08-08-claude-plugins-design.md.
+ *
+ * Trust: pi gates project-local resources behind a per-folder trust decision
+ * stored in `<agentDir>/trust.json`. Explicit CLI paths bypass that gate, so
+ * the launcher enforces the SAME decision itself: project `.claude` dirs are
+ * wired only when the folder is trusted. With no recorded decision it asks
+ * once (interactive runs only) and persists the answer into pi's own
+ * trust.json — one trust model, shared with pi's prompt, and a "no" is
+ * remembered too. User-scope `~/.claude` dirs are the user's own machine and
+ * load without ceremony, matching how pi treats `~/.agents/skills`.
+ *
+ * Set YAGNI_DISABLE_CLAUDE_COMPAT=1 to turn the whole bridge off.
+ */
+import { type PluginAssets } from "./claudePlugins.js";
+export declare const CLAUDE_COMPAT_DISABLE_ENV = "YAGNI_DISABLE_CLAUDE_COMPAT";
+/** Plugin `agents/` dirs for the extension's subagent discovery (delimiter-joined). */
+export declare const CLAUDE_AGENT_DIRS_ENV = "YAGNI_CLAUDE_AGENT_DIRS";
+/** `.claude/rules` dirs for the extension's rules injection (delimiter-joined). */
+export declare const CLAUDE_RULES_DIRS_ENV = "YAGNI_CLAUDE_RULES_DIRS";
+export interface ClaudeAssetDirs {
+    skills: string | null;
+    commands: string | null;
+    rules: string | null;
+}
+export interface ClaudeCompatProbe {
+    project: ClaudeAssetDirs;
+    user: ClaudeAssetDirs;
+    /** Locally-present plugins sourced from repo config; trust-gated. */
+    projectPlugins: PluginAssets[];
+    /** Plugins the user enabled in their own `~/.claude`; no ceremony. */
+    userPlugins: PluginAssets[];
+    /** Nearest recorded trust decision for the cwd (pi trust.json), if any. */
+    projectTrust: boolean | null;
+    interactive: boolean;
+}
+export interface ClaudeCompatDecision {
+    /** Flags for user-scope dirs; always safe to pass. */
+    userArgv: string[];
+    /** Flags for project dirs; pass only once trust is established. */
+    projectArgv: string[];
+    /** Plugin agent dirs, split by the same trust posture. */
+    userAgentDirs: string[];
+    projectAgentDirs: string[];
+    /** `.claude/rules` dirs, user first so project rules win in the prompt. */
+    userRulesDirs: string[];
+    projectRulesDirs: string[];
+    /** Ask the user for a trust decision before wiring any project content. */
+    needsPrompt: boolean;
+}
+/** Pure policy: what to wire, and whether a trust prompt is required first. */
+export declare function decideClaudeCompat(probe: ClaudeCompatProbe): ClaudeCompatDecision;
+/** The `.claude` asset dirs under `root` that actually exist. */
+export declare function probeClaudeDirs(root: string): ClaudeAssetDirs;
+/**
+ * The nearest recorded decision for `cwd` or an ancestor, else null. Read-only
+ * and fail-soft: a missing or corrupt trust file just means "not decided".
+ */
+export declare function readTrustDecision(agentDir: string, cwd: string): boolean | null;
+/**
+ * Persist a decision into pi's trust.json, holding pi's mkdir-based lock
+ * (`trust.json.lock`) so a concurrently-running session can't lose a write.
+ * Fail-soft: if the lock never frees, skip the write — worst case the user is
+ * asked again next launch.
+ */
+export declare function writeTrustDecision(agentDir: string, cwd: string, decision: boolean): void;
+export interface ClaudeCompatDeps {
+    cwd: string;
+    /** The hermetic pi agent dir for the active profile (holds trust.json). */
+    agentDir: string;
+    homeDir?: string;
+    env?: NodeJS.ProcessEnv;
+    interactive?: boolean;
+    /** The one-time trust question; injectable for tests. */
+    confirm?: (question: string) => Promise<boolean>;
+}
+export declare function compatDisabled(env: NodeJS.ProcessEnv): boolean;
+export interface ClaudeCompatLaunch {
+    /** Extra pi flags (`--skill` / `--prompt-template` paths). */
+    argv: string[];
+    /** Extra child env (plugin agent dirs, rules dirs) for the extension. */
+    env: Record<string, string>;
+}
+/**
+ * The extra pi argv + child env for this launch: user-scope dirs and plugins
+ * unconditionally, project-sourced dirs/plugins/rules once trusted, asking
+ * (and persisting) the trust decision when needed. Everything is fail-soft —
+ * compat can only add flags/env, never break a launch.
+ */
+export declare function claudeCompatArgs(deps: ClaudeCompatDeps): Promise<ClaudeCompatLaunch>;
+/** Whether pi's trust file exists yet (used only for messaging). */
+export declare function trustFileExists(agentDir: string): boolean;
+//# sourceMappingURL=claudeCompat.d.ts.map

package/dist/claudeCompat.js

@@ -0,0 +1,260 @@
+/**
+ * Zero-config Claude Code repo compat.
+ *
+ * A repo that already carries Claude Code assets keeps working under YAGNI
+ * Code with nothing to edit: `.claude/skills` loads through pi's skill
+ * discovery and `.claude/commands/*.md` through pi's prompt templates (the
+ * same markdown-with-frontmatter format Claude Code uses — filename becomes
+ * the `/name` command). The launcher passes both as per-run `--skill` /
+ * `--prompt-template` flags, so nothing repo-local is ever written and no
+ * per-profile settings file accumulates stale per-repo paths.
+ *
+ * The same seams carry installed/enabled Claude Code plugins and the repo's
+ * own `.claude-plugin/marketplace.json` plugins (see claudePlugins.ts):
+ * plugin skills → `--skill`, plugin commands → `--prompt-template`, plugin
+ * `agents/` dirs → YAGNI_CLAUDE_AGENT_DIRS for the extension's subagent
+ * discovery. `.claude/rules` dirs travel as YAGNI_CLAUDE_RULES_DIRS for the
+ * extension's system-prompt rules injection. Design + on-disk evidence:
+ * docs/superpowers/specs/2026-08-08-claude-plugins-design.md.
+ *
+ * Trust: pi gates project-local resources behind a per-folder trust decision
+ * stored in `<agentDir>/trust.json`. Explicit CLI paths bypass that gate, so
+ * the launcher enforces the SAME decision itself: project `.claude` dirs are
+ * wired only when the folder is trusted. With no recorded decision it asks
+ * once (interactive runs only) and persists the answer into pi's own
+ * trust.json — one trust model, shared with pi's prompt, and a "no" is
+ * remembered too. User-scope `~/.claude` dirs are the user's own machine and
+ * load without ceremony, matching how pi treats `~/.agents/skills`.
+ *
+ * Set YAGNI_DISABLE_CLAUDE_COMPAT=1 to turn the whole bridge off.
+ */
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { discoverClaudePlugins } from "./claudePlugins.js";
+export const CLAUDE_COMPAT_DISABLE_ENV = "YAGNI_DISABLE_CLAUDE_COMPAT";
+/** Plugin `agents/` dirs for the extension's subagent discovery (delimiter-joined). */
+export const CLAUDE_AGENT_DIRS_ENV = "YAGNI_CLAUDE_AGENT_DIRS";
+/** `.claude/rules` dirs for the extension's rules injection (delimiter-joined). */
+export const CLAUDE_RULES_DIRS_ENV = "YAGNI_CLAUDE_RULES_DIRS";
+function dirsToArgv(dirs) {
+    const argv = [];
+    if (dirs.skills)
+        argv.push("--skill", dirs.skills);
+    if (dirs.commands)
+        argv.push("--prompt-template", dirs.commands);
+    return argv;
+}
+function pluginsToArgv(plugins) {
+    const argv = [];
+    for (const plugin of plugins) {
+        for (const path of plugin.skillPaths)
+            argv.push("--skill", path);
+        for (const path of plugin.commandPaths)
+            argv.push("--prompt-template", path);
+    }
+    return argv;
+}
+/** Pure policy: what to wire, and whether a trust prompt is required first. */
+export function decideClaudeCompat(probe) {
+    const projectArgv = [...dirsToArgv(probe.project), ...pluginsToArgv(probe.projectPlugins)];
+    const projectAgentDirs = probe.projectPlugins.flatMap((p) => p.agentDirs);
+    const projectRulesDirs = probe.project.rules ? [probe.project.rules] : [];
+    const hasProjectContent = projectArgv.length > 0 || projectAgentDirs.length > 0 || projectRulesDirs.length > 0;
+    return {
+        userArgv: [...dirsToArgv(probe.user), ...pluginsToArgv(probe.userPlugins)],
+        projectArgv,
+        userAgentDirs: probe.userPlugins.flatMap((p) => p.agentDirs),
+        projectAgentDirs,
+        userRulesDirs: probe.user.rules ? [probe.user.rules] : [],
+        projectRulesDirs,
+        needsPrompt: probe.interactive && hasProjectContent && probe.projectTrust === null,
+    };
+}
+function isDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** The `.claude` asset dirs under `root` that actually exist. */
+export function probeClaudeDirs(root) {
+    const skills = join(root, ".claude", "skills");
+    const commands = join(root, ".claude", "commands");
+    const rules = join(root, ".claude", "rules");
+    return {
+        skills: isDirectory(skills) ? skills : null,
+        commands: isDirectory(commands) ? commands : null,
+        rules: isDirectory(rules) ? rules : null,
+    };
+}
+// ── pi trust.json interop ───────────────────────────────────────────────────
+/** Match pi's normalization closely enough for key lookups: resolve + realpath. */
+function normalizeCwd(path) {
+    const resolved = resolve(path);
+    try {
+        return realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+function trustPath(agentDir) {
+    return join(agentDir, "trust.json");
+}
+function readTrustFile(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        const data = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (value === true || value === false || value === null)
+                data[key] = value;
+        }
+        return data;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * The nearest recorded decision for `cwd` or an ancestor, else null. Read-only
+ * and fail-soft: a missing or corrupt trust file just means "not decided".
+ */
+export function readTrustDecision(agentDir, cwd) {
+    const data = readTrustFile(trustPath(agentDir));
+    let current = normalizeCwd(cwd);
+    while (true) {
+        const decision = data[current];
+        if (decision === true || decision === false)
+            return decision;
+        const parent = dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+/**
+ * Persist a decision into pi's trust.json, holding pi's mkdir-based lock
+ * (`trust.json.lock`) so a concurrently-running session can't lose a write.
+ * Fail-soft: if the lock never frees, skip the write — worst case the user is
+ * asked again next launch.
+ */
+export function writeTrustDecision(agentDir, cwd, decision) {
+    const path = trustPath(agentDir);
+    const lock = `${path}.lock`;
+    try {
+        mkdirSync(agentDir, { recursive: true });
+    }
+    catch {
+        // Fail-soft: an uncreatable agent dir must not discard the user's answer
+        // for this launch — the caller still applies it in-process.
+        return;
+    }
+    let locked = false;
+    for (let attempt = 0; attempt < 10; attempt++) {
+        try {
+            mkdirSync(lock);
+            locked = true;
+            break;
+        }
+        catch {
+            const start = Date.now();
+            while (Date.now() - start < 20) {
+                // Brief synchronous wait between lock attempts.
+            }
+        }
+    }
+    if (!locked)
+        return;
+    try {
+        const data = readTrustFile(path);
+        data[normalizeCwd(cwd)] = decision;
+        const sorted = {};
+        for (const key of Object.keys(data).sort())
+            sorted[key] = data[key];
+        const tmp = `${path}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(sorted, null, 2)}\n`, "utf8");
+        renameSync(tmp, path);
+    }
+    catch {
+        // Fail-soft: an unwritable trust file only costs a repeat prompt.
+    }
+    finally {
+        try {
+            rmdirSync(lock);
+        }
+        catch {
+            // Already gone.
+        }
+    }
+}
+export function compatDisabled(env) {
+    const value = env[CLAUDE_COMPAT_DISABLE_ENV];
+    return value !== undefined && value !== "" && value !== "0";
+}
+/**
+ * The extra pi argv + child env for this launch: user-scope dirs and plugins
+ * unconditionally, project-sourced dirs/plugins/rules once trusted, asking
+ * (and persisting) the trust decision when needed. Everything is fail-soft —
+ * compat can only add flags/env, never break a launch.
+ */
+export async function claudeCompatArgs(deps) {
+    const env = deps.env ?? process.env;
+    if (compatDisabled(env))
+        return { argv: [], env: {} };
+    const home = deps.homeDir ?? homedir();
+    const projectTrust = readTrustDecision(deps.agentDir, deps.cwd);
+    let plugins;
+    try {
+        plugins = discoverClaudePlugins({ cwd: deps.cwd, homeDir: home });
+    }
+    catch {
+        plugins = { user: [], project: [] };
+    }
+    const decision = decideClaudeCompat({
+        project: probeClaudeDirs(deps.cwd),
+        user: probeClaudeDirs(home),
+        projectPlugins: plugins.project,
+        userPlugins: plugins.user,
+        projectTrust,
+        interactive: deps.interactive ?? (process.stdin.isTTY === true && process.stdout.isTTY === true),
+    });
+    let trusted = projectTrust;
+    if (decision.needsPrompt && deps.confirm) {
+        try {
+            trusted = await deps.confirm("This folder has Claude Code assets (.claude skills, commands, rules, or plugins). Trust this folder and load them?");
+            writeTrustDecision(deps.agentDir, deps.cwd, trusted);
+        }
+        catch {
+            trusted = null;
+        }
+    }
+    const argv = [...decision.userArgv];
+    if (trusted === true)
+        argv.push(...decision.projectArgv);
+    const agentDirs = [
+        ...decision.userAgentDirs,
+        ...(trusted === true ? decision.projectAgentDirs : []),
+    ];
+    // User rules first, project rules last: the extension appends in order, so
+    // project rules end up closest to the task — matching Claude Code priority.
+    const rulesDirs = [
+        ...decision.userRulesDirs,
+        ...(trusted === true ? decision.projectRulesDirs : []),
+    ];
+    const extraEnv = {};
+    if (agentDirs.length > 0)
+        extraEnv[CLAUDE_AGENT_DIRS_ENV] = agentDirs.join(delimiter);
+    if (rulesDirs.length > 0)
+        extraEnv[CLAUDE_RULES_DIRS_ENV] = rulesDirs.join(delimiter);
+    return { argv, env: extraEnv };
+}
+/** Whether pi's trust file exists yet (used only for messaging). */
+export function trustFileExists(agentDir) {
+    return existsSync(trustPath(agentDir));
+}
+//# sourceMappingURL=claudeCompat.js.map

package/dist/claudePlugins.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Claude Code plugin + marketplace discovery (local content only).
+ *
+ * Finds the plugin content a Claude Code user already has on disk and exposes
+ * it as asset paths the launcher can feed through the existing compat seams:
+ * skills → `--skill`, commands → `--prompt-template`, agents → the subagent
+ * discovery env var. Two sources:
+ *
+ * 1. Installed plugins: `~/.claude/plugins/installed_plugins.json` (version-2
+ *    ledger of `name@marketplace` → cache checkouts), enabled through
+ *    `enabledPlugins` in the user's `~/.claude/settings.json` (user scope) or
+ *    the repo's `.claude/settings{,.local}.json` (project scope). When a
+ *    ledger entry is gone, the marketplace checkout recorded in
+ *    `known_marketplaces.json` is tried as a fallback.
+ * 2. The repo's own `.claude-plugin/marketplace.json` (the internal-
+ *    marketplace pattern): every plugin it defines with a locally-present
+ *    relative-path source loads on the project side, unless explicitly
+ *    disabled via `enabledPlugins`.
+ *
+ * Deliberately NOT here: network installation of any kind, plugin hooks, MCP
+ * servers, LSP servers, themes, output styles. Discovery is read-only.
+ *
+ * Everything is fail-soft: malformed JSON, missing dirs, or hostile path
+ * entries degrade to "that plugin absent" — never a failed launch. Path
+ * entries from marketplace/plugin manifests are containment-checked (realpath
+ * inside the expected root) so a malicious `source` or component override
+ * cannot reach outside its repo/plugin.
+ */
+export interface PluginAssets {
+    /** The plugin's name (marketplace-entry name — the `enabledPlugins` key half). */
+    name: string;
+    /** Absolute plugin root directory. */
+    root: string;
+    /** Dirs (or a lone root SKILL.md file) for pi `--skill`. */
+    skillPaths: string[];
+    /** Dirs or files for pi `--prompt-template`. */
+    commandPaths: string[];
+    /** Dirs of Claude Code-format agent markdown for subagent discovery. */
+    agentDirs: string[];
+}
+export interface DiscoveredClaudePlugins {
+    /** Enabled via the user's own `~/.claude` config; loads without ceremony. */
+    user: PluginAssets[];
+    /** Sourced from repo config; wire only once the folder is trusted. */
+    project: PluginAssets[];
+}
+/**
+ * Resolve `candidate` (a relative path from untrusted JSON) against `root` and
+ * return its realpath only when it exists AND stays inside `root` after
+ * symlink resolution. Absolute candidates and any `../` escape are rejected.
+ */
+export declare function containedExistingPath(root: string, candidate: string): string | null;
+export interface InstalledPluginEntry {
+    installPath: string;
+    projectPath?: string;
+}
+/** `~/.claude/plugins/installed_plugins.json` → `name@marketplace` → entries. */
+export declare function readInstalledPlugins(homeDir: string): Map<string, InstalledPluginEntry[]>;
+export type EnableScope = "user" | "project";
+export interface EnableState {
+    enabled: boolean;
+    scope: EnableScope;
+}
+/**
+ * `enabledPlugins` merged across scopes, later (more specific) winning:
+ * user `~/.claude/settings.json` < project `.claude/settings.json` <
+ * project `.claude/settings.local.json`.
+ */
+export declare function readEnabledPlugins(cwd: string, homeDir: string): Map<string, EnableState>;
+/** `~/.claude/plugins/known_marketplaces.json` → marketplace name → checkout dir. */
+export declare function readKnownMarketplaces(homeDir: string): Map<string, string>;
+export interface MarketplaceEntry {
+    name: string;
+    source: unknown;
+}
+export interface Marketplace {
+    name: string;
+    /** Marketplace root: the dir containing `.claude-plugin/`. */
+    root: string;
+    /** `metadata.pluginRoot`, prepended to bare relative sources. */
+    pluginRoot: string | null;
+    plugins: MarketplaceEntry[];
+}
+/** Parse `<root>/.claude-plugin/marketplace.json`; null when absent/unusable. */
+export declare function readMarketplace(root: string): Marketplace | null;
+/**
+ * The local directory a marketplace entry's source points at, when it is a
+ * relative-path source that exists inside the marketplace root. Object
+ * sources (github/url/npm/...) are network installs → null here.
+ */
+export declare function resolveLocalPluginRoot(mp: Marketplace, entry: MarketplaceEntry): string | null;
+/**
+ * The bridgeable assets inside one plugin checkout, per Claude Code's
+ * component rules: `skills/` (manifest `skills` ADDS dirs), `commands/`
+ * (manifest REPLACES), `agents/` (manifest REPLACES; dirs only — pi's
+ * discovery reads whole dirs), root `SKILL.md` fallback. Null when the plugin
+ * has nothing we can bridge.
+ */
+export declare function pluginAssets(root: string, name: string): PluginAssets | null;
+export interface DiscoverPluginsDeps {
+    cwd: string;
+    homeDir: string;
+}
+/**
+ * All locally-present Claude Code plugin content relevant to `cwd`, split by
+ * the trust posture the launcher must apply. Never throws.
+ */
+export declare function discoverClaudePlugins(deps: DiscoverPluginsDeps): DiscoveredClaudePlugins;
+//# sourceMappingURL=claudePlugins.d.ts.map