feat(claude): install native plugins in an isolated project scope

.github/workflows/agentplugins-native-clients.yml

@@ -69,10 +69,15 @@ jobs:
           AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
         shell: bash
         run: |
+          project_args=()
+          if [[ '${{ matrix.client }}' == 'claude' ]]; then
+            project_args+=(--project-components)
+          fi
           python scripts/run-native-client-matrix.py \
             --client '${{ matrix.client }}' \
             --target '${{ matrix.platform.target }}' \
-            --output '${{ runner.temp }}/native-client-proof'
+            --output '${{ runner.temp }}/native-client-proof' \
+            "${project_args[@]}"
       - name: Upload native evidence including failed stages
         if: ${{ always() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0

docs/plans/project-install-e2e/claude-code-review-r1.md

@@ -0,0 +1,96 @@
+# Claude project implementation independent review R1
+
+Reviewer: core_clients, 2026-10-23. Reviewed initial adapter `3505f0ab`,
+source-only native gate `c47d3393`, scoped SDK/data/restart contracts `40f108c4`,
+and frozen corrective `32dd485e789b57c7825c6c4fb2128263901be78f` in
+`work/uap-project-claude`. The original two client-plan GO results remain
+separate. No production or test file was edited by this reviewer.
+
+## Decision: GO at 32dd485e
+
+One exact native identity finding is independently verified closed. No
+remaining implementation blocker was found in the scoped directory/listing
+lane or the authored source-only native gate. This is an implementation review,
+not a completed hosted native project qualification.
+
+## R1-1: lexical native paths could conceal a different physical project
+
+At `40f108c4`, project listing accepted filepath.Clean(installPath) equal to the
+expected managed path. A native spelling such as skills/alias/../artifact can
+lexically normalize to project A's expected path while physically resolving to
+project B/artifact if alias points at B/sub. The optional projectPath check also
+normalized its input instead of demanding exact selected spelling.
+
+Closed in `32dd485e`. Project entries now require literal installPath equality
+to the validated expected path and literal optional projectPath equality to
+the selected project. The user-only parser behavior is unchanged. Regressions
+include nonclean install/project paths and a real symlink traversal fixture
+that proves physical resolution differs despite lexical normalization. The
+authored native project fixture also rejects nonclean discovered install paths.
+The correction performs no filesystem mutation or trust action.
+
+## Reviewed scope and native evidence boundaries
+
+- Validated original user/project TargetContext selects exact project
+  `.claude` authority and `.claude/skills/<physical-artifact>` delivery.
+  Layout, plan precondition, projection, native registry listing, activation
+  and deactivation revalidate that selected authority. Package staging remains
+  beside the watched skills root, preventing precommit staging from appearing
+  installed. No user-profile surrogate or package-derived project scope exists.
+- Every project listing/removal probe uses fixed selected project cwd and the
+  original user config root in CLAUDE_CONFIG_DIR. The bounded environment and
+  existing timeout/runner supervision remain intact. The user-only list helper
+  remains user-scoped. Project operations do not invoke user uninstall or write
+  native settings/trust/account state.
+- The existing package projector, standard loader, rendered command skills,
+  managed stdio launcher, directory transaction, immutable package receipts and
+  persistent data contract are reused. Core's declared project CLI lifecycle
+  matches the real directory/listing lane; it does not borrow an invented
+  direct-config engine.
+- Activated/installed status requires an actual exact enabled project
+  name@skills-dir listing at the managed path. Wrong scope/path, disabled,
+  duplicate, malformed, load-error and mismatching optional-project rows do
+  not establish installation. Missing or failed observations do not become
+  success. Project attestation is rejected unconditionally before the generic
+  provider shortcut, including prepared component selections and direct reuse.
+- Deactivation requires exact selected-project listing before core removes the
+  owned directory. Recognized absent evidence cannot silently remove an
+  allegedly active binding. No global plugin or whole shared settings document
+  is treated as owned.
+- Public SDK fixture journeys exercise user/A/B install, unchanged update,
+  exact supplied-pin repair after drift despite a moved source, selected update,
+  status and exact removal. Distinct stdio data receipts retain marker bytes.
+  Postcommit listing failure leaves incomplete/nonactive ownership; a fresh
+  installer repairs the recorded pin and reobserves exact identity. Fixture
+  runners are explicitly not native client evidence.
+- The native gate uses the genuine pinned artifact and actual UAP project
+  operations, fresh plugin list/details, command-byte checks and project-B
+  absence checks. Its separate opt-in reaches the unchanged disposable guard
+  before client launch/acquisition. Exact required-test accounting rejects skips
+  or omitted tests; released/draft/prepared inputs cannot select project proof.
+  Claude/Codex selector rows must be unioned on integration as documented.
+
+## Independent execution
+
+Go 1.26.10, GOMAXPROCS=3, `-p=2`, bounded RAM toolchain/cache at final SHA:
+
+- Project listing/client contracts: **PASS 0.007s**.
+- Composed production provider project contracts: **PASS 0.042s**.
+- Public installer user/project-A/project-B lifecycle/data/restart contract:
+  **PASS 0.177s**.
+- Inert native discovered-skill parser contract: **PASS 0.008s**.
+- Native runner Python safety/evidence suite: **56 tests PASS 0.455s**.
+
+An initial SDK run used this reviewer's overly restricted PATH without the
+already installed Node runtime; stdio readiness was withheld and the test's
+required data assertion correctly failed. Retaining the installed Node path
+resolved that harness issue without source, policy or assertion changes.
+The existing full client permission-denial suite requires unprivileged execution
+as documented by the author; this review used the focused project contracts.
+
+No native Claude process, configured MCP command, model, account mutation,
+login, auto-trust or hosted qualification ran in this review. Local official
+binary probes previously aborted with Bun134 and remain crash evidence. The
+authored native gate and historical user native results do not qualify new
+project discovery, skill execution, MCP initialization/tool use, native restart
+or release readiness until genuine hosted results are collected.

docs/plans/project-install-e2e/claude-code-review-r2.md

@@ -0,0 +1,92 @@
+# Claude project adapter independent implementation review R2
+
+Reviewer: cursor_clients, 2026-10-23. Reviewed the final adapter and source-only
+native gate stack through `40f108c43b7dcbd8d5e57c39799072ece048fbc3`, plus the
+R1 corrective frozen checkpoint `32dd485e789b57c7825c6c4fb2128263901be78f`, in
+`work/uap-project-claude`. Read repository governing/capability-preservation
+instructions, the approved two-GO Claude client plan, production adapter,
+public installer and provider fixtures, native gate and matrix selection.
+
+## Decision: GO at corrected checkpoint 32dd485e
+
+No remaining implementation blocker found. The original frozen adapter's
+project listing path normalization weakness was already identified by the
+independent R1 reviewer. This R2 independently checked its final correction:
+project `installPath` and optional `projectPath` require literal equality to
+the validated selected paths; nonclean traversal spellings cannot manufacture
+identity. Legacy user-only listing normalization remains unchanged. The
+actual symlink-plus-parent traversal regression demonstrates that the rejected
+spelling can resolve into another directory even when filepath.Clean makes it
+look equal to the desired managed path.
+
+## Reviewed boundaries
+
+- Native project layout is exactly `.claude/skills/<physical-artifact>`.
+  TargetContext, original detected user ConfigRoot, `.claude` authority,
+  target anchor/root and active child layout are revalidated. Staging remains
+  beside the watched skills directory. Core supplies transactional package
+  ownership, project state/data and physical root authority.
+- All project registry, activation and removal listing commands preserve the
+  original `CLAUDE_CONFIG_DIR` and set Dir to immutable selected ProjectRoot.
+  They do not substitute project configuration for a user profile, depend on
+  ambient cwd, invoke marketplace installation or perform user uninstall.
+  Existing bounded environment and supervised process timeout remain in use.
+- Scoped native listing requires the exact expected `name@skills-dir`, exact
+  selected project scope/path, enabled status, no duplicate identity, no load
+  errors and consistent optional projectPath. Wrong user/path identities are
+  collisions, malformed/unrecognized observations remain unknown, and exact
+  negative evidence cannot be upgraded by attestation.
+- Provider activation preflight runs before generic attestation shortcuts,
+  and direct adapter activation invokes the same guard. Project attestation
+  is refused even when selected components would otherwise take a prepared
+  path. Recognized exact native plugin listing may establish installed plugin
+  activation under the existing lifecycle; it does not establish MCP
+  initialization, skill execution or model/task completion.
+- Project removal uses the same scope/cwd/config roots and verifies exact
+  managed native identity before core removes the owned directory. It never
+  treats a shared settings file or another scope as owned. User behavior and
+  the existing user-only listing entrypoint retain their prior contract.
+- Production loader/planner/renderer/stager/provider contracts cover rendered
+  commands, wrong/disabled/unknown listings, copied/changed scope/root/user
+  authority, attestation refusal and user/project-B isolation.
+- Public SDK tests install all three scopes with separate stdio data locators,
+  retain data through update/repair/removal, repair from exact supplied pinned
+  bytes after source advance, and preserve user/B binding and package bytes.
+  A native listing failure injected after commit produces an incomplete,
+  non-active owned binding; a fresh installer instance repairs the selected
+  pin and reobserves exact project identity. These are production lifecycle
+  fixture contracts with an inert runner/launcher, not native Claude proof.
+- The new source-only native test runs production UAP project operations and
+  genuine pinned read-only plugin list/details processes at project cwd,
+  checks project-B absence, exact rendered commands and foreign hashes, and
+  emits separate project evidence. The unchanged disposable guard runs first.
+  There is no session/model/trust/MCP initialization/login request. Required
+  test accounting refuses skips/omissions, and released/draft/prepared inputs
+  refuse this source-only selection.
+
+## Independent verification
+
+Using Go 1.26.10, GOMAXPROCS=3, `-p=2 -count=1`, independently ran
+`./clients/claude ./providers ./installer -run '^TestProjectClaude|^TestProjectListing'`
+at the clean corrected checkpoint:
+
+- Scoped client listing contracts: PASS, 0.008s.
+- Composed project provider contracts: PASS, 0.118s.
+- Public installer three-scope/data/restart lifecycle: PASS, 0.243s.
+- `python scripts/test_native_client_matrix.py`: PASS, 17 tests.
+
+These are reviewer execution results. No native Claude process, package
+payload, MCP command, model request, login or trust action was executed.
+Existing complete client permission-denial tests were not rerun as task root;
+the author's separately recorded unprivileged full-suite run is not relabeled
+as reviewer execution.
+
+## Integration and native qualification boundary
+
+The shared native matrix delta must retain the union of independently authored
+Codex and Claude project selections/workflow conditions on integration. The
+author evidence explicitly records that requirement. Native fixture authorship,
+parser/compile checks, historical user runtime evidence and local Bun exit134
+probe failures do not qualify the new project runtime. Genuine hosted project
+listing/discovery, MCP/skill execution and fresh-session task evidence remain
+separate gates. This review makes no release-readiness claim.

docs/plans/project-install-e2e/claude-failure-diagnostic-code-review-r1.md

@@ -0,0 +1,49 @@
+# Claude bounded failure-listing diagnostics — independent code R1
+
+Reviewed frozen clean `0b85d4a293beee1be05733cfc75dd4fd9afd260a` in
+`work/uap-project-claude`, after the plan and both GO reports were committed at
+`c53e030e`. **GO** for the diagnostic-only checkpoint. Reviewer did not author
+the implementation and executed no Claude/native process or acquisition.
+
+The production parser, Claude adapter, opt-in and real disposable-host guard
+are unchanged. The four-file diff adds test-only capture/metadata/contracts,
+first-error fixture wiring and truthful evidence. Successful installer runs
+take the original path. The fixture's latch permits only the first returned
+installer error to trigger the fixed two A/B listing observations. It uses the
+already verified genuine client and fresh explicit original profile environment,
+then retains the original result/error and existing foreign-byte check. The
+lifecycle marks a stage failed before running its installer, and the original
+installer stdout/stderr are already recorded before this additional capture;
+diagnostics do not mark it passed or retry it.
+
+Each capture has its own ten-second context, empty stdin/no shell, separate
+stdout/stderr writers capped live at 1MiB, cancellation on overflow and 250ms
+WaitDelay for inherited pipes. Writer state is mutex-protected, never appends
+beyond its cap, and returns an independent snapshot. Direct-child kill/pipe
+bounds are described accurately without a descendant-sandbox claim. Exit -1
+for failure to start, real process exit when available, context deadline,
+per-stream overflow, elapsed time and bounded error remain explicit.
+
+The finite helper copies the fixture environment per child, uses only
+`plugin list --json` from exact A/B cwd, and preserves separate capped raw logs
+and byte/SHA256 metadata. No unknown listing is parsed into ownership, active
+status or a success result; every diagnostic record and aggregate qualification
+remain false. Fixed artifact paths are inside the existing evidence root, whose
+ordinary writer hashes the files for upload. No mutation, guessed plugin ID,
+trust/account/model/MCP action, new acquisition or format relaxation appears.
+
+Independent inert verification:
+`go test -p=2 ./repotests -run '^TestClaudeProjectDiagnostic' -count=1` passed
+both contracts in **0.009s**, without opting in to a native test. They cover
+exact boundary/overflow cancellation, bounded later writes and snapshot copies,
+fixed two-call selection, independent env/streams, failure metadata/hashes and
+bounded error text. `git diff --check` passed. Guard and production adapter bytes
+are unchanged across the reviewed diff. The author's exact lint pass remains
+separate recorded evidence.
+
+No blocking implementation issue found. Root may publish/replay this exact
+diagnostic checkpoint only after the other independent implementation GO.
+Actual raw hosted output and both reviewers' interpretation are still required
+before a separate evidence-based production decoder amendment. This GO does not
+qualify the failed project lane, native discovery/runtime, trust, another OS,
+all-client E2E or a release.

docs/plans/project-install-e2e/claude-failure-diagnostic-code-review-r2.md

@@ -0,0 +1,13 @@
+# Claude first project failure diagnostics — independent code R2
+
+**GO** at frozen clean `0b85d4a293beee1be05733cfc75dd4fd9afd260a` in `work/uap-project-claude`, reviewed by cursor_clients on 2026-10-23. The diff from `c53e030e` is four files: the test-only capture primitive, two inert contracts, the fixture's first-error hook, and the truthful evidence note. Both independent plan GO reports precede source. No production parser, adapter, native success assertion, acquisition, opt-in or hosted guard changes.
+
+The hook runs only when the existing installer runner returns an error and diagnosticAttempted was false. It sets the flag before capture, then uses the same verified client path, exact existing A/B roots and original explicit fixture environment. Its fixed loop produces exactly two fresh `plugin list --json` calls. Successful installer paths launch neither. The original result/error are returned unchanged after diagnostics and the existing foreign-byte check; the installer stdout/stderr had already been recorded by commandsRunInstaller. No retry, details with a guessed ID, native mutation, trust, reload, model or MCP operation is introduced.
+
+Each real capture creates an independent10second context and a direct exec.CommandContext with no shell, empty stdin, copied environment and WaitDelay250ms. Separate mutex-protected writers append at most1MiB each while pipe copying runs. A write beyond the remaining limit stores only the bounded prefix, marks overflow, cancels the child and returns a short-write error. Exact-boundary writes are permitted and the next nonempty write triggers cancellation. Repeated writes after overflow cannot grow the buffer. Snapshot clones cannot modify captured data. The direct-child deadline plus WaitDelay bound inherited pipe closure; this is not OS/process-group isolation, and the evidence note correctly avoids such a claim.
+
+Capture records process exit or -1, bounded512byte error, independent deadline and per-stream limit flags, elapsed duration, separate raw log filenames/lengths/SHA256 and exact argv/cwd. Unknown or malformed JSON is retained raw rather than parsed into installed/active evidence. Each record has qualification:false; the wrapper metadata keeps project_qualified:false and identifies the original installer label/error. New logs/metadata are inside the ordinary evidence root, so existing writeEvidence hashes/uploads them. Supplementary capture failure does not convert the original failed operation into success. Existing fatal IO/foreign-byte checks continue failing the test if evidence cannot be safely recorded or foreign state drifts.
+
+Independent verification: both inert diagnostic tests passed in0.012s. They exercise exact-cap acceptance, overflow cancellation and bounded subsequent writes, cloned snapshots, fixed two-call argv/cwd/environment selection, copied environment, raw separate streams, exit/deadline/limit/hash metadata and bounded errors. git diff --check passed. Static comparison confirms the actual native opt-in and disposable-host guard remain before fixture creation, and all existing production parser/qualifier paths are untouched. No Claude binary, installer, MCP, account or model process was run by this review.
+
+No blocking finding remains. Root can publish/replay this diagnostic-only checkpoint under the existing native guards. The actual failing project artifact remains failed/pending; a successful diagnostic artifact must be independently interpreted before any separately planned parser/scope correction. This GO does not establish project discovery/runtime, trust, other-platform, all-client or release qualification.