De-bundle the Claude Code plugin: skills ship from the agent-skills marketplace (LCR-181)

[cailmdaley]

LCR-181: skills move to the agent-skills marketplace

This PR de-bundles the Claude Code plugin from the wheel. Skills, hooks, and the lc-extractor subagent now ship from the LightconeResearch/agent-skills marketplace. The CLI keeps only what a CLI can own: the commands, the scaffold, and the compatibility surface the plugin talks to.

Why

The wheel and the plugin change at different speeds and through different channels. Bundling them coupled a Python release to every skill edit. It also gave projects a plugin frozen at install time. The marketplace gives the plugin its own channel: Claude Code refreshes it automatically, in every project at once.

The upgrade model

De-bundling creates two independent channels. uv upgrades the CLI. The marketplace upgrades the plugin. The channels move in any order. Neither side may assume the other has moved. Three rules make this safe (docs/user/upgrading.md carries the full version):

Skew is detected, not prevented. The plugin's SessionStart hook calls lc compat. The command prints the CLI version, the minimum plugin version the CLI expects, and the plugin name as JSON. The plugin compares its version to the floor and warns with the exact heal command on skew. Skew degrades; it never blocks.

Old plugins must not brick sessions. Pre-marketplace plugins gate Bash|Write|Edit|Skill behind exec lc hook pretool. Removing the subcommand makes click exit 2 — the code Claude Code reads as "block this tool call". Upgrading the CLI ahead of the plugin would wedge every gated tool call, including the edit that fixes the hook. A hidden lc hook stub therefore accepts any arguments, exits 0, and prints a deprecation notice to stderr. It stays until the next breaking release (TODO(next-breaking) marks it).

Layout migrations are convergent lc init. The command is idempotent. In a fresh directory it scaffolds a project. In a directory with an existing astra.yaml it layers on only the missing integration bits — .lightcone/, results/, the marketplace registration (merged non-destructively into any existing .claude/settings.json), the MyST report template — and never touches astra.yaml or an existing CLAUDE.md. It reports what it added and what it skipped. This transition is the motivating example: one lc init per existing project.

Also in this PR

• uv tool install lightcone-cli now exposes astra alongside lc (the wheel re-exports astra-tools' entry point), so astra validate works out of the box.
• The plugin-hint and permission-tier mechanisms are removed; the harness owns skill discovery and the user owns the trust level.
• DOGFOOD PINS (tip commit + marketplace ref:) point at the open agent-skills PR for testing; revert before merge.

The upgrade model was exercised against a live project on a cluster before any of it was designed — the lc hook brick, the missing adoption path, and the unreachable astra executable were all hit in the wild first.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	lightcone-cli	e98d640	Commit Preview URL Branch Preview URL	Jul 19 2026, 11:17 PM

[github-actions]

✅ Eval Results

Metric	Value
Score	1.00
Build complete	✅
Cost	$2.00
Turns	48
Duration	341s
lightcone-cli	0.3.8.dev14+g72830fb63 (72830fb6)
Results	Download

Graders

✅ spec_valid (1.00)
✅ all_materialized (1.00)

Full output

permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
23:22:26 lightcone.eval.sandbox [sandbox build] #13 [10/11] WORKDIR /home/evaluser
23:22:26 lightcone.eval.sandbox [sandbox build] #14 [11/11] RUN mkdir -p ~/.claude && echo '{"hasCompletedOnboarding": true}' > ~/.claude.json
23:22:26 lightcone.eval.sandbox [sandbox build] #15 exporting to image
23:22:43 lightcone.eval.sandbox Created sandbox 99862493-c2a4-4467-afe9-c05ff400811d for trial build-snae-0
23:22:43 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/99862493-c2a4-4467-afe9-c05ff400811d/files/bulk-upload "HTTP/1.1 200 OK"
23:22:44 lightcone.eval.sandbox Installed wheels: ['lightcone_cli-0.3.8.dev14+g72830fb63-py3-none-any.whl']
23:22:45 lightcone.eval.sandbox Headless lightcone plugin install failed (exit 1); trial runs without plugin skills. See LCR-131.
Adding marketplace…✘ Failed to add marketplace: Failed to clone marketplace repository: SSH host key is not in your known_hosts file. To add it, connect once manually (this will show the fingerprint for you to verify):
  ssh -T git@github.com

Or use an HTTPS URL instead (recommended for public repos).

Original error: Cloning into '/home/evaluser/.claude/plugins/marketplaces/LightconeResearch-agent-skills'...
No ED25519 host key is known for github.com and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.


23:22:45 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/99862493-c2a4-4467-afe9-c05ff400811d/files/bulk-upload "HTTP/1.1 200 OK"
23:22:45 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/99862493-c2a4-4467-afe9-c05ff400811d/files/bulk-upload "HTTP/1.1 200 OK"
23:22:45 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/99862493-c2a4-4467-afe9-c05ff400811d/files/bulk-upload "HTTP/1.1 200 OK"
23:22:45 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/99862493-c2a4-4467-afe9-c05ff400811d/files/bulk-upload "HTTP/1.1 200 OK"
23:28:28 lightcone.eval.sandbox Deleted sandbox for trial build-snae-0
  snae trial 0: score=1.00 complete

lightcone-cli: 0.3.8.dev14+g72830fb63 (HEAD 72830fb6)
ASTRA: 0.2.11.dev20+g2546fce55

  Eval Results: Scores  
┏━━━━━━┳━━━━━━━━━━━━━━━┓
┃ Task ┃     Score     ┃
┡━━━━━━╇━━━━━━━━━━━━━━━┩
│ snae │ 1.00 +/- 0.00 │
│      │ pass@k: 100%  │
└──────┴───────────────┘

   Eval Results: Cost &   
         Duration         
┏━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Task ┃ Cost / Duration ┃
┡━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ snae │      $2.00      │
│      │      341s       │
└──────┴─────────────────┘

Total: 1 trials, $2.00, 341s

Results saved to: eval-results/build-72830fb6/results.json