Promote main to release

.gitleaks.toml

@@ -50,3 +50,14 @@ paths = ['''^pr-\d+/''']
 description = "Prompt-injection steer-eval secrets fixture (inert)"
 targetRules = ["stripe-access-token"]
 paths = ['''^benchmarks/steer/fixtures/injection-project/secrets\.env$''']
+
+[[allowlists]]
+# The container runner's argv test carries an inert per-run proxy token
+# (decision A7 in docs/plans/thread-in-container.md) so it can assert the
+# token lands on the guest's proxy URL and in COPSE_EGRESS_TOKEN and nowhere
+# else. The first fixture value was a hex string and tripped the entropy
+# heuristic; the value is plain words now, but the path exemption also clears
+# the finding in branch history. Scope to that one rule and file.
+description = "Container run proxy-token fixture (inert)"
+targetRules = ["generic-api-key"]
+paths = ['''^src/main/services/container-runtime/thread-container\.test\.ts$''']

docs/acp-agents.md

@@ -61,6 +61,18 @@ auth), while Copse keeps ownership of the workspace and the approval UX.
   from whichever channel carries it. A consequence worth knowing: under Cursor,
   a bridged or MCP call that is auto-approved never produces a permission
   request, so it can keep the generic `MCP: tool` label.
+- **An abandoned bridged call does not lose its approval.** MCP clients give
+  up on a silent tool call after their own timeout (Codex: roughly 300 s), and
+  a bridged `run_shell` blocked on "Run outside sandbox?" is silent for as long
+  as the user takes to answer. The bridge aborts the call with an
+  `AbandonedCallAbort` reason; the approval service (`approval.ts`) treats that
+  as a detach rather than a cancel — the prompt stays open, the call fails with
+  a clear "approval is still pending, retry the exact same call" error (which
+  reaches the agent when it cancelled over MCP; a dropped connection has no one
+  to deliver it to), and the user's eventual answer is kept for ten minutes so
+  the identical retry (same command, working directory and thread) reuses it
+  without prompting again. A retry that arrives while the prompt is still open
+  simply joins it. Turn end still dismisses the prompt, as before.
 - Because that title is also how Copse recognises **its own** bridged tools to
   skip a duplicate approval prompt, the same per-agent spread applies: Cursor's
   `copse-gh_pr_list: gh_pr_list` and Claude's `mcp__copse__gh_pr_view` are both

docs/cursor-plugins.md

@@ -68,12 +68,12 @@ use this module.
 
 ### Trust model
 
-| Source                    | Skills trust                            | MCP trust                                                   |
-| ------------------------- | --------------------------------------- | ----------------------------------------------------------- |
-| `~/.cursor/skills` (user) | Trusted                                 | —                                                           |
-| Cursor plugin (`plugin`)  | Untrusted (delimited as data in prompt) | Trusted (user installed via Cursor; full env interpolation) |
-| Project workspace         | Untrusted                               | Requires workspace trust (#100)                             |
-| `skillPluginPaths`        | Untrusted                               | —                                                           |
+| Source                                          | Skills trust                            | MCP trust                                                   |
+| ----------------------------------------------- | --------------------------------------- | ----------------------------------------------------------- |
+| `~/.{cursor,agents,claude,codex}/skills` (user) | Trusted                                 | —                                                           |
+| Cursor plugin (`plugin`)                        | Untrusted (delimited as data in prompt) | Trusted (user installed via Cursor; full env interpolation) |
+| Project workspace                               | Untrusted                               | Requires workspace trust (#100)                             |
+| `skillPluginPaths`                              | Untrusted                               | —                                                           |
 
 Plugin skills are untrusted because their text is still attacker-influenceable
 content (a malicious marketplace plugin). Plugin MCP configs are treated like
@@ -85,6 +85,58 @@ Merge priority for duplicate MCP server names:
 2. Cursor plugin `.mcp.json` files
 3. Project `.cursor/mcp.json` / `.mcp.json` (only when workspace is trusted)
 
+## Skill discovery roots and frontmatter
+
+Skills are `<root>/<name>/SKILL.md` files (the folder name must equal the
+frontmatter `name`). `skills-registry.ts` scans these roots, in this order;
+the first skill loaded for a name wins, so an earlier root overrides a later
+one:
+
+1. **User** — `~/.cursor/skills`, `~/.agents/skills`, `~/.claude/skills`,
+   `~/.codex/skills` (source `user`, trusted). `.codex` is the Codex CLI's
+   layout; it was added after a Codex-backed thread could not find the skill it
+   had been asked to run (reconcile-worktrees post-mortem, 2026-09-09).
+2. **Bundled Cursor plugin skills** shipped with Copse (`bundled`, trusted).
+3. **Project** — the same four container directories under the workspace,
+   including monorepo packages, but never inside a nested repository such as a
+   `.claude/worktrees/*` checkout (`project`, untrusted). Within the project
+   scope the containers keep the order above.
+4. **Cursor plugins** (`~/.cursor/plugins/{local,cache}`) and
+   `skillPluginPaths` (`plugin` / `plugin-path`, untrusted).
+5. **Built-in skills** shipped in `assets/skills` (`bundled`); last, so any
+   user or project skill of the same name overrides a first-party one.
+
+### Frontmatter
+
+```yaml
+---
+name: reconcile-worktrees # must match the folder name
+description: One line the model sees in the catalog
+disable-model-invocation: true # optional: user-only, hidden from the model
+paths: # optional: extra read-only entries, relative to this directory
+  - data
+  - references/schema.json
+---
+```
+
+- `disable-model-invocation` keeps a skill out of the model's catalog; the
+  user can still invoke it with `/name`.
+- `paths` declares extra read-only entries for `run_shell`. When a skill is
+  invoked, that thread's sandboxed shell may **read** the skill directory for
+  the rest of the thread (never write to it); `paths` adds entries relative to
+  the skill directory. Entries are validated, not trusted: absolute paths, `~`,
+  `$VAR`, and `..` are rejected; anything that is or lives under a credential
+  file or directory (`.env*`, `.ssh`, `.aws`, key files, …) is rejected; the
+  home directory, the filesystem root, and any parent of home are rejected. A
+  symlink that leaves the skill directory is honoured only for a trusted
+  (`user` / `bundled`) skill. Refused entries are reported in the invoked-skill
+  prompt so the model does not rely on them. See
+  `src/main/services/skills/skill-read-roots.ts` and
+  `src/main/services/security/thread-read-roots.ts`.
+
+Reads outside these roots — and every write outside the workspace — still go
+through the normal "Run outside sandbox?" approval.
+
 ## Local development
 
 Symlink a plugin repo into Cursor's local plugins directory (from Kingston skills

docs/plans/README.md

@@ -75,7 +75,8 @@ Last audited against `main`, GitHub issues, and open PRs on **2026-07-21**.
 | [Terminal file links](terminal-file-links-improvements.md)                  | Partial / deferred               | File links and line/column navigation shipped in [#415](https://github.com/copse-dev/agent-pane/pull/415). Cwd-aware resolution is deferred.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | [Thread referencing](thread-referencing.md)                                 | Resolved core                    | [#644](https://github.com/copse-dev/agent-pane/issues/644) is closed and [#647](https://github.com/copse-dev/agent-pane/pull/647) shipped the filesystem-native store and `@` references. Lazy loading and streaming partials remain separate follow-ups.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | [UI kit](ui-kit.md)                                                         | Active                           | First slice: `.ui-btn*` CSS + light-DOM `<copse-ui-actions>` / `<copse-ui-field>` under `src/renderer/ui/`. No button factory (class sugar only). Panel shells (browser/terminals) planned next. Shadow DOM deferred.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| [Unattended runs on a contained runtime](unattended-runs.md)                | Proposed                         | Proposes an unattended-run mode on a per-thread Docker runtime, separate from Guarded YOLO, so long-horizon work continues with nobody watching. Nothing implemented. Consumes `execution-runtime-security.md` (capabilities, egress, credentials), `copse-cloud-workspaces.md` C1 (local-docker provider), and `deferred-approvals.md` (non-blocking gate); measured with the Docker eval harness in `industry-benchmarks.md`.                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| [Running a thread inside a container](thread-in-container.md)               | Active (prototype on branch)     | A thread runs unattended inside a hardened local Docker container with no prompts: the headless agent host runs in the guest, an attested `container` tier lets the gate allow contained effects and defer outward ones (`shell-outward-effect`), egress is a named unix-socket broker, and work returns as commits under `refs/copse/runs/<id>`. Records where it diverges from `unattended-runs.md` (loop in the guest; one provider key in the guest). Driven by `pnpm run thread:container`; end-to-end test is opt-in.                                                                                                                                                                                                                                                                                                                                             |
+| [Unattended runs on a contained runtime](unattended-runs.md)                | Proposed                         | Proposes an unattended-run mode on a per-thread Docker runtime, separate from Guarded YOLO, so long-horizon work continues with nobody watching. Nothing implemented under its own decisions; `thread-in-container.md` prototypes the mode with the loop in the guest and records the divergence. Consumes `execution-runtime-security.md` (capabilities, egress, credentials), `copse-cloud-workspaces.md` C1 (local-docker provider), and `deferred-approvals.md` (non-blocking gate); measured with the Docker eval harness in `industry-benchmarks.md`.                                                                                                                                                                                                                                                                                                             |
 | [Unowned capability gaps](unowned-capability-gaps.md)                       | Reference audit, dispersed       | 2026-08-07 audit against the capabilities local-first assistants have converged on, excluding anything with an existing plan or issue. All ten findings now live elsewhere: [#1570](https://github.com/copse-dev/agent-pane/issues/1570) (plan-step schema), [#1571](https://github.com/copse-dev/agent-pane/issues/1571) (todo-check root, unverified), [#1572](https://github.com/copse-dev/agent-pane/issues/1572) (LAN peer decision), [#1573](https://github.com/copse-dev/agent-pane/issues/1573) (R-05 profiles), plus amendments to eight existing documents. Kept as evidence, not a backlog.                                                                                                                                                                                                                                                                  |
 | [User control surface gaps](user-control-surface-gaps.md)                   | Proposed                         | Audit of the missing session-control surface with per-requirement ownership across 32 plans, 66 open issues and a 139-item roadmap. 22 requirements, R-01–R-22; only six need a new issue and two of those are decision records. Phase 0 is session control and task lifecycle. Companions: `mission-control.md`, `competitive-landscape.md`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | [VNC remote desktop](vnc-remote-desktop.md)                                 | Active (V0/V1 first release)     | The opt-in, read-only Desktop pane now connects to loopback or an active SSH workspace through loopback-only ControlMaster forwards. Main owns the socket; an IPC-backed channel feeds bundled noVNC 1.5.0 without relaxing renderer CSP. Forward teardown is tied to connection, host, owner, and app lifecycles; focused unit and fake-RFB visual coverage are included. Reconnect reconciliation, a generic browser consumer, and the live-host harness remain V0/V1 follow-ups. V2+ human input, discovery, credentials, screenshots, and all agent control remain unimplemented because desktop input bypasses the shell permission gate.                                                                                                                                                                                                                          |

docs/plans/automations.md

@@ -91,6 +91,30 @@ ingress waits for the detached worker/control-plane phase.
 
 ## Pack boundary
 
+### Integrated editor
+
+The side cog opens a menu with **Automations** and **New automation…**. The
+adjacent Settings label remains a direct shortcut. Both menu actions mount the
+same project-scoped editor used in Settings in a native modal, with an explicit
+plugin enable/disable action. Changing enablement preserves an unsaved draft.
+Sidebar automation setup links use this modal too; the modal closes if the active
+project changes. No second store, scheduler, or form is introduced.
+
+The first-party plugin declares `automation-manager` in the level-3 `app-dialog`
+slot. The host only exposes this shipped view when the matching first-party
+declaration is present. Like Settings, configuration is reachable while disabled;
+the plugin flag continues to gate scheduled execution and Run now.
+
+Acceptance criteria:
+
+- The side cog opens the automation list or a new automation form without opening Settings.
+- Settings and the modal edit the same project-owned schedules using the same editor.
+- Plugin enablement preserves an unsaved draft; disabled plugins cannot run automations.
+- Sidebar setup links open the named schedule in the modal, and project changes close it.
+- Focused Electron coverage saves cog-menu, creation, and management screenshots.
+
+### Ownership
+
 `copse.automations` is a default-off first-party pack. The pack owns atomic
 enablement, a level-3 `settings-pack-detail` UI declaration, and its namespaced
 storage declaration. Host code owns the clock and thread-store write; renderer