De-bundle the Claude Code plugin: skills ship from the agent-skills marketplace (LCR-181)

[cailmdaley]

Linear: LCR-181 · Design: de-bundling design doc

This PR de-bundles the Claude Code plugin from the wheel. Skills, hooks, and the lc-extractor agent now ship from the agent-skills marketplace. The CLI keeps the commands, the scaffold, and the compatibility surface the plugin talks to.

The install path

The CLI and the plugin are installed globally, once. Projects only activate.

uv tool install lightcone-cli installs one global command: lc. lc init registers the agent-skills marketplace globally with each harness on the PATH: claude plugin marketplace add for Claude Code, codex plugin marketplace add + codex plugin add for Codex. Registration is idempotent and best-effort; a missing harness is skipped silently.

Activation is per project. lc init writes one key into .claude/settings.json: enabledPlugins. The plugin loads only in lc init directories, on folder trust. The key carries no version and no marketplace source. Codex has no project-scoped plugin config yet (openai/codex#18115), so its plugin stays globally active.

astra is global too. The lightcone-cli wheel exposes both commands, so one uv tool install yields one lc and one astra per machine — no version skew between them. lc init still creates the project venv, but empty — it installs nothing into it. The venv is the project's analysis environment: the plugin's session-start hook activates it, so packages the agent installs land there. Containerized analysis dependencies flow through requirements.txt into the container. When an analysis needs validation against its exact declared spec version, uvx --from astra-tools==X --with astra-spec==Y astra gives a spec-matched toolchain per invocation.

lc init scaffolds new projects only: the target directory must be empty or nonexistent, checked before any file is written. Re-running init and adopting an existing ASTRA project are unsupported — astra init hard-fails on non-empty directories, so a convergent init needs an upstream astra-tools change first (design doc, Open Questions).

The upgrade model

Two artifacts carry two versions:

• The plugin ships from the marketplace. A skill edit ships without a CLI release.
• The CLI ships from PyPI via uv. A CLI change that alters the plugin contract requires a plugin version bump.

There is one plugin install per machine, so there is one plugin version per machine. When a CLI change alters the plugin contract, the plugin version bumps with it.

Compatibility enforcement lives on the plugin side, not in this PR. The plugin manifest will declare a compatible lc version range. A harness-agnostic session-start hook will check it against lc version. That work ships from the agent-skills repo (astra plugin: agent-skills#15; the lc-paired compat hooks: stacked agent-skills#17 / LCR-189). Until it lands, the version numbers alone carry the contract. There is no handshake command in the CLI.

Permissions

lc init no longer writes a permission policy. The permission-tier mechanism is removed; the harness owns the trust level. The docs now recommend the harness-native modes: Claude Code's accept-edits and Auto modes, Codex's "Approve for me" (a.k.a. Auto-review). A future best-practices skill could carry this guidance.

Open questions

• Is the first marketplace release a breaking release? No official release exists yet. The answer decides how much back-compat machinery we owe.
• Migration. Existing pre-plugin projects, and old plugins that call removed subcommands, are out of scope here. They get their own PR once this design settles. A project init'd during dogfooding keeps a stale extraKnownMarketplaces key in its .claude/settings.json; leaving it is intentional — cleanup belongs to the migration PR.
• Version scheme. Per-project pinning is off the table: the harness tracks the marketplace's current version, and the install is global. The current direction is a plugin-declared lc version range (minimum, possibly maximum), checked by a session-start hook. The exact scheme is still open. Opinions welcome.

Testing

Full test suite green (344 tests, ruff, mypy).

Merge checklist

• astra-tools pin — astra-tools 0.2.11 is on PyPI (released 2026-07-23); the git direct reference is gone and the dependency is a plain >=0.2.11 (8bda862).
• Flip the marketplace ref to the default branch when agent-skills#17 merges (the stacked lightcone CLI-compat PR; Add /prism-feedback skill #15 alone does not put the lc-paired hooks on the default branch). MARKETPLACE_BRANCH in cli/commands.py and the @astra-plugin-rework suffix in eval/sandbox.py track the agent-skills PR branch on purpose (INTERIM comments mark both). One small commit drops them at merge time.
• Tag the merge commit v0.4.0. The agent-skills plugin declares 0.4.0 ≤ lc < 0.5.0 with 0.4.0 = first de-bundled release. Version is VCS-derived; without the tag every session warns on version skew.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	lightcone-cli	a8c1094	Commit Preview URL Branch Preview URL	Jul 24 2026, 01:39 PM

[github-actions]

✅ Eval Results

Metric	Value
Score	1.00
Build complete	✅
Cost	$2.55
Turns	83
Duration	478s
lightcone-cli	0.3.8.dev25+g007cf3865 (007cf386)
Results	Download

Graders

✅ spec_valid (1.00)
✅ all_materialized (1.00)

Full output

13:39:10 lightcone.eval.build Building lightcone-cli wheel from /home/runner/work/lightcone-cli/lightcone-cli ...
13:39:15 lightcone.eval.build Built lightcone_cli-0.3.8.dev25+g007cf3865-py3-none-any.whl (commit 007cf386)
13:40:00 lightcone.eval.sandbox Created sandbox ab3168e9-a55e-45f7-aac7-0ad49eea8fd5 for trial build-snae-0
13:40:01 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/ab3168e9-a55e-45f7-aac7-0ad49eea8fd5/files/bulk-upload "HTTP/1.1 200 OK"
13:40:02 lightcone.eval.sandbox Installed wheels: ['lightcone_cli-0.3.8.dev25+g007cf3865-py3-none-any.whl']
13:40:05 lightcone.eval.sandbox Headless lightcone plugin install failed (exit 1); trial runs without plugin skills. See LCR-131.
Adding marketplace…✘ Failed to add marketplace: Failed to clone marketplace repository: SSH host key is not in your known_hosts file. To add it, connect once manually (this will show the fingerprint for you to verify):
  ssh -T git@github.com

Or use an HTTPS URL instead (recommended for public repos).

Original error: Cloning into '/home/evaluser/.claude/plugins/marketplaces/LightconeResearch-agent-skills'...
No ED25519 host key is known for github.com and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.


13:40:06 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/ab3168e9-a55e-45f7-aac7-0ad49eea8fd5/files/bulk-upload "HTTP/1.1 200 OK"
13:40:06 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/ab3168e9-a55e-45f7-aac7-0ad49eea8fd5/files/bulk-upload "HTTP/1.1 200 OK"
13:40:06 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/ab3168e9-a55e-45f7-aac7-0ad49eea8fd5/files/bulk-upload "HTTP/1.1 200 OK"
13:40:07 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/ab3168e9-a55e-45f7-aac7-0ad49eea8fd5/files/bulk-upload "HTTP/1.1 200 OK"
13:48:07 lightcone.eval.sandbox Deleted sandbox for trial build-snae-0
  snae trial 0: score=1.00 complete

lightcone-cli: 0.3.8.dev25+g007cf3865 (HEAD 007cf386)
ASTRA: 0.2.11

  Eval Results: Scores  
┏━━━━━━┳━━━━━━━━━━━━━━━┓
┃ Task ┃     Score     ┃
┡━━━━━━╇━━━━━━━━━━━━━━━┩
│ snae │ 1.00 +/- 0.00 │
│      │ pass@k: 100%  │
└──────┴───────────────┘

   Eval Results: Cost &   
         Duration         
┏━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Task ┃ Cost / Duration ┃
┡━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ snae │      $2.55      │
│      │      478s       │
└──────┴─────────────────┘

Total: 1 trials, $2.55, 478s

Results saved to: eval-results/build-007cf386/results.json