feat: add native skill package runtime with explicit target-repo skill trust

Author: iamjacobjia

agentflow/cli.py

@@ -24,6 +24,7 @@
     DoctorReport,
     LocalToolchainReport,
     ShellBridgeRecommendation,
+    build_pipeline_skill_policy_context,
     build_bash_login_shell_bridge_recommendation,
     build_local_kimi_toolchain_report,
     build_local_kimi_bootstrap_doctor_report,
@@ -813,21 +814,29 @@ def _doctor_report_for_path(path: str | None = None) -> tuple[object, dict[str,
         except typer.Exit:
             return report, None, None
         include_ok_local_checks = _include_ok_local_preflight_checks(selected_path, pipeline)
+        pipeline_context = {"auto_preflight": _auto_smoke_preflight_metadata(selected_path, pipeline)}
+        skill_policy_context = build_pipeline_skill_policy_context(pipeline)
+        if skill_policy_context:
+            pipeline_context.update(skill_policy_context)
         return (
             _augment_preflight_report(
                 report,
                 pipeline,
                 include_ok_local_checks=include_ok_local_checks,
             ),
-            {"auto_preflight": _auto_smoke_preflight_metadata(selected_path, pipeline)},
+            pipeline_context,
             pipeline,
         )
     pipeline = _load_pipeline(path)
     report = _preflight_base_report(path, pipeline)
     include_ok_local_checks = _include_ok_local_preflight_checks(path, pipeline)
+    pipeline_context = {"auto_preflight": _auto_smoke_preflight_metadata(path, pipeline)}
+    skill_policy_context = build_pipeline_skill_policy_context(pipeline)
+    if skill_policy_context:
+        pipeline_context.update(skill_policy_context)
     return (
         _augment_preflight_report(report, pipeline, include_ok_local_checks=include_ok_local_checks),
-        {"auto_preflight": _auto_smoke_preflight_metadata(path, pipeline)},
+        pipeline_context,
         pipeline,
     )
 
@@ -1574,6 +1583,9 @@ def _load_pipeline_with_optional_smoke_preflight(
             preflight_context = {
                 "auto_preflight": _auto_smoke_preflight_metadata(path or selected_path, preflight_pipeline)
             }
+            skill_policy_context = build_pipeline_skill_policy_context(preflight_pipeline)
+            if skill_policy_context:
+                preflight_context.update(skill_policy_context)
         if report.status == "failed":
             _echo_doctor_report(
                 report,
@@ -1623,6 +1635,38 @@ def _render_shell_bridge_summary(shell_bridge: object | None) -> str:
     )
 
 
+def _render_skill_policy_summary_lines(pipeline: dict[str, object] | None) -> list[str]:
+    if not isinstance(pipeline, dict):
+        return []
+
+    skill_policy = pipeline.get("skill_policy")
+    if not isinstance(skill_policy, dict):
+        return []
+
+    lines: list[str] = []
+    owned_roots = [str(root) for root in skill_policy.get("owned_roots", []) if isinstance(root, str) and root]
+    if owned_roots:
+        lines.append(f"Pipeline skill roots: AgentFlow-owned `.agents/skills/` -> {', '.join(owned_roots)}")
+
+    target_roots = [str(root) for root in skill_policy.get("target_roots", []) if isinstance(root, str) and root]
+    target_suffix = f" -> {', '.join(target_roots)}" if target_roots else ""
+    if skill_policy.get("default_target_repo_skill_trust") is False:
+        lines.append(f"Pipeline target repo skills: ignored by default{target_suffix}")
+
+    trusted_nodes = [str(node_id) for node_id in skill_policy.get("trusted_nodes", []) if isinstance(node_id, str) and node_id]
+    if trusted_nodes:
+        lines.append(f"Pipeline target repo skill trust: enabled for {', '.join(trusted_nodes)}")
+
+    boundary = skill_policy.get("repo_instructions_boundary")
+    if isinstance(boundary, str) and boundary.strip():
+        lines.append(
+            "Pipeline repo instructions: separate from skill trust; use `repo_instructions_mode` for `AGENTS.md`, "
+            "`CLAUDE.md`, and related instruction files."
+        )
+
+    return lines
+
+
 def _doctor_check_summary_suffix(check: object) -> str:
     if getattr(check, "name", None) != "bash_login_startup":
         return ""
@@ -1672,6 +1716,7 @@ def _render_doctor_summary(
             rendered_matches = [match for match in matches if isinstance(match, str) and match]
             if rendered_matches:
                 lines.append(f"{auto_preflight_label} matches: {', '.join(rendered_matches)}")
+    lines.extend(_render_skill_policy_summary_lines(pipeline))
     if include_shell_bridge:
         lines.append(_render_shell_bridge_summary(shell_bridge))
     return "\n".join(lines)

agentflow/context.py

@@ -229,7 +229,11 @@ def render_node_prompt(
         current_tick_started_at=current_tick_started_at,
     )
     prompt = render_template(node.prompt, context)
-    skill_prelude = compile_skill_prelude(node.skills, pipeline.working_path)
+    skill_prelude = compile_skill_prelude(
+        node.skills,
+        pipeline.working_path,
+        target_skill_policy=node.target_skill_policy,
+    )
     if skill_prelude:
         return f"Selected skills:\n{skill_prelude}\n\nTask:\n{prompt}"
     return prompt

agentflow/doctor.py

@@ -13,6 +13,7 @@
 
 from pydantic import ValidationError
 
+from agentflow import skill_roots
 from agentflow.env import merge_env_layers
 from agentflow.local_shell import (
     _bash_login_startup_has_direct_agentflow_bootstrap,
@@ -25,6 +26,7 @@
 )
 from agentflow.prepared import PreparedExecution, build_execution_paths
 from agentflow.runners.local import LocalRunner
+from agentflow.skill_packages import is_package_skill_ref
 from agentflow.specs import AgentKind, LocalTarget, provider_uses_kimi_anthropic_auth, resolve_provider
 from agentflow.utils import looks_sensitive_key
 
@@ -437,6 +439,58 @@ def _dict_env(env: object) -> dict[str, str]:
     }
 
 
+def build_pipeline_skill_policy_context(pipeline: object | None) -> dict[str, object] | None:
+    if pipeline is None:
+        return None
+
+    nodes = getattr(pipeline, "nodes", None) or []
+    node_entries: list[dict[str, object]] = []
+    trusted_nodes: list[str] = []
+    for node in nodes:
+        raw_skills = _object_value(node, "skills", ()) or ()
+        package_skills = [
+            str(skill)
+            for skill in raw_skills
+            if isinstance(skill, str) and is_package_skill_ref(skill)
+        ]
+        target_skill_policy = _status_value(_object_value(node, "target_skill_policy", "none")) or "none"
+        if not package_skills and target_skill_policy == "none":
+            continue
+
+        node_id = str(_object_value(node, "id", "node"))
+        repo_instructions_mode = _status_value(_object_value(node, "repo_instructions_mode", "inherit")) or "inherit"
+        node_entries.append(
+            {
+                "node_id": node_id,
+                "repo_instructions_mode": repo_instructions_mode,
+                "target_skill_policy": target_skill_policy,
+                "package_skills": package_skills,
+            }
+        )
+        if target_skill_policy == "inherit_all":
+            trusted_nodes.append(node_id)
+
+    if not node_entries:
+        return None
+
+    working_path = _object_value(pipeline, "working_path")
+    owned_roots = [str(Path(root).expanduser().resolve()) for root in skill_roots.owned_skill_package_roots()]
+    target_roots = [str(Path(root).expanduser().resolve()) for root in skill_roots.target_repo_skill_package_roots(working_path)]
+    return {
+        "skill_policy": {
+            "owned_roots": owned_roots,
+            "target_roots": target_roots,
+            "default_target_repo_skill_trust": False,
+            "repo_instructions_boundary": (
+                "Repo-local instructions are controlled separately by `repo_instructions_mode`; "
+                "target repo skill trust only affects `.agents/skills/` packages."
+            ),
+            "trusted_nodes": trusted_nodes,
+            "nodes": node_entries,
+        }
+    }
+
+
 def _toolchain_ambient_base_urls() -> dict[str, str]:
     ambient: dict[str, str] = {}
     for key in _TOOLCHAIN_AMBIENT_BASE_URL_VARS: