fix(skills): provide isolated agent runtime access

[wen2zhou]

Problem

Agent frameworks can discover Open Science Skills whose source packages live in the protected configuration tree, but their ordinary Read/Bash tools cannot reliably read package references/assets or execute package scripts there. Script runtimes can also try to write caches such as Python bytecode into the protected package. Claude Code, Codex, and OpenCode expose different native discovery surfaces, and delegated attempts previously had no single application-owned runtime contract.

Proposed change

• Materialize complete, normalized Skill packages into a private disposable projection for every backend generation and delegated attempt.
• Redirect Python, Node, R, XDG, and temporary runtime state into lease-owned writable directories through an extensible environment-contributor interface.
• Carry one secret-free SkillRuntimeView through Claude Code, Codex, and OpenCode while preserving each framework's native Skill invocation flow.
• Rebind all framework-native Skill paths when delegated attempts fork, including OpenCode's authoritative JSON config and ephemeral config home.
• Keep rollback framework catalogs physically intact but inactive for new sessions:
  • Claude uses strict plugin-only Skill customization.
  • OpenCode uses an ephemeral XDG config home while retaining stable auth/data.
  • Codex disables legacy Skill documents present at process startup and adds the private runtime root through the pinned adapter patch.
• Move live Connector Skill documents to the versioned derived source runtime-support/connector-skills-v1; new production paths no longer read or write framework rollback catalogs.
• Validate isolated Claude tokens in a disposable empty config profile and refresh Skill generations after Compute host create/delete/probe changes.
• Preserve dynamic catalog retirement, create/resume/adopt/reviewer flows, and delegated runtime cleanup.

flowchart LR
  Source["Protected Skill sources"] --> Lease["Private generation or attempt lease"]
  Lease --> Native["Framework-native Skill discovery"]
  Native --> Read["Ordinary Read and script execution"]
  Native --> Cache["Lease-owned cache and temp directories"]
  Legacy["Rollback framework catalogs"] -. "preserved but inactive" .-> Native

Loading

Scope and non-goals

• No permission changes to configured Skill sources.
• No migration, deletion, or schema change for persistent user data, authentication, or session state.
• Agent-facing Skill invocation remains framework-native; agents do not learn an Open Science-specific replacement tool.
• Read-only mode bits are defense in depth. Isolation comes from private, non-shared projections; deliberate same-user enumeration of another runtime directory is outside the guarantee.
• Accepted V1 Codex boundary: a rollback application that creates a new legacy Skill after the new Codex process has started can race the startup disable enumeration.
• Specialist-specific Skill entitlements and Main-versus-Specialist catalog isolation remain deferred; Specialists use the Main catalog in this release.
• Legacy materialization helpers remain for rollback/tests but have no production caller in the new resolver path.

Acceptance criteria and validation

All listed checks ran after the final material edit and after rebasing onto origin/main.

• Final impact selection → npm run test:affected:explain -- --base origin/main --head HEAD → full fallback selected because global impact manifests changed and the implementation crosses Settings, ACP, framework adapters, Connector, and Compute ownership.
• Type safety across main/preload/renderer consumers → npm run typecheck → passed.
• Repository coding and formatting rules → npm run lint → passed with 0 errors and 10 pre-existing unrelated warnings.
• Complete portable behavior suite, including real Python/Node/R script/cache tests, framework adapter contracts, lease lifecycle/concurrency, source integrity, rollback suppression, dynamic reload, and delegated attempts → npm test → 1,021 files passed, 14 skipped; 15,101 tests passed, 210 skipped.
• Patch hygiene → git diff --check origin/main...HEAD → passed.
• Independent final review → Standards: 0 hard violations; Spec: 0 missing, 0 incorrect, 0 scope creep. Focused reviewer suites passed 299 tests with 2 platform skips.

No UI E2E lane was run locally because this change does not alter a renderer journey; the full portable suite covers the changed main-process interfaces and framework configuration contracts. Cross-platform packaging remains CI/Nightly authority.

Review focus

• Source snapshot validation before/after package copies and exact lease cleanup.
• Framework-specific discovery suppression and delegated runtime rebasing.
• Codex managed adapter patch drift/fail-fast behavior and rollback sentinels.
• Absence of production reads/writes to legacy framework Skill catalogs.
• Dynamic Connector/Compute changes retiring generations without mutating rollback state.