TalonT-Org
diff --git a/‎CLAUDE.md‎
Lines changed: 4 additions & 2 deletions b/‎CLAUDE.md‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎src/autoskillit/core/__init__.py‎
Lines changed: 2 additions & 0 deletions b/‎src/autoskillit/core/__init__.py‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎src/autoskillit/core/types.py‎
Lines changed: 11 additions & 0 deletions b/‎src/autoskillit/core/types.py‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎src/autoskillit/execution/headless.py‎
Lines changed: 3 additions & 1 deletion b/‎src/autoskillit/execution/headless.py‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎src/autoskillit/hook_registry.py‎
Lines changed: 4 additions & 0 deletions b/‎src/autoskillit/hook_registry.py‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎src/autoskillit/hooks/open_kitchen_guard.py‎
Lines changed: 38 additions & 0 deletions b/‎src/autoskillit/hooks/open_kitchen_guard.py‎
Lines changed: 38 additions & 0 deletions
diff --git a/‎src/autoskillit/pipeline/context.py‎
Lines changed: 20 additions & 17 deletions b/‎src/autoskillit/pipeline/context.py‎
Lines changed: 20 additions & 17 deletions
diff --git a/‎src/autoskillit/server/__init__.py‎
Lines changed: 7 additions & 0 deletions b/‎src/autoskillit/server/__init__.py‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎src/autoskillit/server/_factory.py‎
Lines changed: 13 additions & 1 deletion b/‎src/autoskillit/server/_factory.py‎
Lines changed: 13 additions & 1 deletion
diff --git a/‎src/autoskillit/server/_state.py‎
Lines changed: 9 additions & 0 deletions b/‎src/autoskillit/server/_state.py‎
Lines changed: 9 additions & 0 deletions
@@ -134,9 +134,10 @@ src/autoskillit/
 │   ├── session.py           #   ClaudeSessionResult, SkillResult, extract_token_usage
 │   └── testing.py           #   Pytest output parsing and pass/fail adjudication
 ├── workspace/               # L1 workspace sub-package
-│   ├── __init__.py          #   Re-exports CleanupResult, SkillResolver, clone_repo, remove_clone, push_to_remote
+│   ├── __init__.py          #   Re-exports CleanupResult, SkillResolver, SessionSkillManager, clone_repo, remove_clone, push_to_remote
 │   ├── cleanup.py           #   Directory teardown utilities (CleanupResult, preserve list)
 │   ├── clone.py             #   Clone-based run isolation: clone_repo, remove_clone, push_to_remote
+│   ├── session_skills.py    #   Per-session ephemeral skill dirs (SkillsDirectoryProvider, SessionSkillManager, TIER2_SKILLS, resolve_ephemeral_root)
 │   └── skills.py            #   Bundled skill listing (SkillResolver)
 ├── recipe/                  # L2 recipe sub-package
 │   ├── __init__.py          #   Re-exports Recipe, RecipeStep, validate_recipe, load_recipe, etc.
@@ -196,7 +197,8 @@ src/autoskillit/
 │   ├── quota_check.py       #   Quota guard hook — blocks run_skill when threshold exceeded
 │   ├── remove_clone_guard.py #  Remove-clone guard — denies remove_clone calls with keep != "true"
 │   ├── skill_cmd_check.py   #   PreToolUse hook — validates skill_command path argument format
-│   └── skill_command_guard.py #  PreToolUse hook — blocks run_skill with non-slash skill_command
+│   ├── skill_command_guard.py #  PreToolUse hook — blocks run_skill with non-slash skill_command
+│   └── open_kitchen_guard.py #  PreToolUse hook — blocks open_kitchen from headless sessions
 ├── migrations/              # Data: versioned migration YAML notes
 │   └── __init__.py
 ├── recipes/                 # Bundled recipe YAML definitions
 
@@ -58,6 +58,7 @@
     RestartScope,
     RetryReason,
     SessionOutcome,
+    SessionSkillManager,
     Severity,
     SkillResult,
     SkillSource,
@@ -124,6 +125,7 @@
     "SessionOutcome",
     "Severity",
     "SkillResult",
+    "SessionSkillManager",
     "SkillSource",
     "SubprocessResult",
     "SubprocessRunner",
 
@@ -786,3 +786,14 @@ async def status(
         run_id: int | None = None,
         cwd: str = "",
     ) -> dict[str, Any]: ...
+
+
+@runtime_checkable
+class SessionSkillManager(Protocol):
+    """Protocol for managing per-session ephemeral skill directories."""
+
+    def init_session(self, session_id: str, *, cook_session: bool = False) -> Path: ...
+
+    def activate_tier2(self, session_id: str, skill_name: str) -> bool: ...
+
+    def cleanup_stale(self, max_age_seconds: int = 86400) -> int: ...
@@ -403,9 +403,11 @@ async def run_headless_core(
         if add_dir:
             cmd.extend([ClaudeFlags.ADD_DIR, add_dir])
 
+        env_vars = ["AUTOSKILLIT_HEADLESS=1"]
         delay_ms = cfg.exit_after_stop_delay_ms
         if delay_ms > 0:
-            cmd = ["env", f"CLAUDE_CODE_EXIT_AFTER_STOP_DELAY={delay_ms}"] + cmd
+            env_vars.append(f"CLAUDE_CODE_EXIT_AFTER_STOP_DELAY={delay_ms}")
+        cmd = ["env"] + env_vars + cmd
 
         effective_timeout = timeout if timeout is not None else cfg.timeout
         effective_stale = stale_threshold if stale_threshold is not None else cfg.stale_threshold
 
@@ -28,6 +28,10 @@ class HookDef:
         matcher="mcp__.*autoskillit.*__remove_clone",
         scripts=["remove_clone_guard.py"],
     ),
+    HookDef(
+        matcher=r"mcp__.*autoskillit.*__open_kitchen.*",
+        scripts=["open_kitchen_guard.py"],
+    ),
 ]
 
 
 
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""PreToolUse hook — blocks open_kitchen from headless sessions.
+
+Headless sessions launched by run_skill have AUTOSKILLIT_HEADLESS=1 in their
+environment. This hook denies open_kitchen calls from those sessions, enforcing
+that only humans (via /autoskillit:open-kitchen) can open the kitchen.
+"""
+
+import json
+import os
+import sys
+
+
+def main() -> None:
+    try:
+        json.loads(sys.stdin.read())
+    except (json.JSONDecodeError, ValueError, OSError):
+        sys.exit(0)  # fail-open on malformed input or broken pipe
+
+    if os.environ.get("AUTOSKILLIT_HEADLESS") == "1":
+        payload = json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "PreToolUse",
+                    "permissionDecision": "deny",
+                    "permissionDecisionReason": (
+                        "open_kitchen cannot be called from headless sessions. "
+                        "Open the kitchen in your human session using /autoskillit:open-kitchen."
+                    ),
+                }
+            }
+        )
+        sys.stdout.write(payload + "\n")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
@@ -21,6 +21,7 @@
     MigrationService,
     OutputPatternResolver,
     RecipeRepository,
+    SessionSkillManager,
     SubprocessRunner,
     TestRunner,
     TimingStore,
@@ -39,23 +40,24 @@ class ToolContext:
 
     Fields
     ------
-    config:        AutomationConfig loaded from .autoskillit/config.yaml
-    audit:         AuditStore — records pipeline failures
-    token_log:     TokenStore — per-step token tracking
-    timing_log:    TimingStore — per-step wall-clock duration tracking
-    gate:          GatePolicy — enables/disables gated tools
-    plugin_dir:    Absolute path string to the autoskillit package directory
-    runner:        SubprocessRunner implementation (DefaultSubprocessRunner in production,
-                   MockSubprocessRunner in tests)
-    executor:      HeadlessExecutor — runs headless Claude Code sessions
-    tester:        TestRunner — runs the project test suite
-    recipes:       RecipeRepository — loads and lists pipeline recipes
-    migrations:    MigrationService — applies versioned migration notes to recipes
-    db_reader:     DatabaseReader — executes read-only SQLite queries
-    workspace_mgr: WorkspaceManager — manages workspace directory teardown
-    clone_mgr:     CloneManager — clone-based pipeline run isolation
-    github_client: GitHubFetcher — fetches GitHub issue content
-    ci_watcher:    CIWatcher — watches GitHub Actions CI runs
+    config:               AutomationConfig loaded from .autoskillit/config.yaml
+    audit:                AuditStore — records pipeline failures
+    token_log:            TokenStore — per-step token tracking
+    timing_log:           TimingStore — per-step wall-clock duration tracking
+    gate:                 GatePolicy — enables/disables gated tools
+    plugin_dir:           Absolute path string to the autoskillit package directory
+    runner:               SubprocessRunner implementation (DefaultSubprocessRunner in production,
+                          MockSubprocessRunner in tests)
+    executor:             HeadlessExecutor — runs headless Claude Code sessions
+    tester:               TestRunner — runs the project test suite
+    recipes:              RecipeRepository — loads and lists pipeline recipes
+    migrations:           MigrationService — applies versioned migration notes to recipes
+    db_reader:            DatabaseReader — executes read-only SQLite queries
+    workspace_mgr:        WorkspaceManager — manages workspace directory teardown
+    clone_mgr:            CloneManager — clone-based pipeline run isolation
+    github_client:        GitHubFetcher — fetches GitHub issue content
+    ci_watcher:           CIWatcher — watches GitHub Actions CI runs
+    session_skill_manager: SessionSkillManager — manages per-session ephemeral skill dirs
     """
 
     config: AutomationConfig
@@ -75,3 +77,4 @@ class ToolContext:
     github_client: GitHubFetcher | None = field(default=None)
     ci_watcher: CIWatcher | None = field(default=None)
     output_pattern_resolver: OutputPatternResolver | None = field(default=None)
+    session_skill_manager: SessionSkillManager | None = field(default=None)
@@ -46,6 +46,8 @@
 # Import all tool sub-modules to trigger @mcp.tool() registration.
 # These imports must come AFTER mcp, _get_ctx, _get_config are defined
 # because tool modules import `mcp` from this package at import time.
+import os  # noqa: E402
+
 from autoskillit.core import PIPELINE_FORBIDDEN_TOOLS  # noqa: E402, F401
 from autoskillit.server import (  # noqa: E402, F401
     helpers,
@@ -64,3 +66,8 @@
 # Apply global visibility transform: all sessions start with kitchen tools hidden.
 # Must appear after all tool module imports so the registered tools are in place.
 mcp.disable(tags={"kitchen"})
+
+# Cook sessions (AUTOSKILLIT_KITCHEN_OPEN=1) pre-reveal kitchen tools at module load
+# so the session starts with all 36 tools visible without calling open_kitchen.
+if os.environ.get("AUTOSKILLIT_KITCHEN_OPEN") == "1":
+    mcp.enable(tags={"kitchen"})
@@ -35,7 +35,13 @@
     load_bundled_manifest,
     resolve_skill_name,
 )
-from autoskillit.workspace import DefaultCloneManager, DefaultWorkspaceManager
+from autoskillit.workspace import (
+    DefaultCloneManager,
+    DefaultSessionSkillManager,
+    DefaultWorkspaceManager,
+    SkillsDirectoryProvider,
+    resolve_ephemeral_root,
+)
 
 # Sentinel: distinguish "caller passed runner=None explicitly" from "not provided"
 _UNSET: Any = object()
@@ -87,6 +93,11 @@ def make_context(
     gate = DefaultGateState(enabled=False)
     if os.environ.get("AUTOSKILLIT_KITCHEN_OPEN") == "1":
         gate.enable()
+
+    provider = SkillsDirectoryProvider()
+    ephemeral_root = resolve_ephemeral_root()
+    session_mgr = DefaultSessionSkillManager(provider, ephemeral_root)
+
     ctx = ToolContext(
         config=config,
         audit=DefaultAuditLog(),
@@ -102,6 +113,7 @@ def make_context(
         clone_mgr=DefaultCloneManager(),
         github_client=DefaultGitHubFetcher(token=github_token),
         ci_watcher=DefaultCIWatcher(token=github_token),
+        session_skill_manager=session_mgr,
     )
 
     def _resolve_output_patterns(skill_command: str) -> list[str]:
 
@@ -70,6 +70,15 @@ def _initialize(ctx: ToolContext) -> None:
     except Exception:
         logger.warning("telemetry_recovery_at_startup_failed", exc_info=True)
 
+    # Session skill cleanup: remove ephemeral skill dirs from previous server runs.
+    if ctx.session_skill_manager is not None:
+        try:
+            removed = ctx.session_skill_manager.cleanup_stale()
+            if removed:
+                logger.info("session_skill_cleanup", extra={"removed": removed})
+        except Exception:
+            logger.warning("session_skill_cleanup_failed", exc_info=True)
+
 
 def _get_ctx() -> ToolContext:
     """Return the active ToolContext. Raises if _initialize() has not been called."""
Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,10 @@ class HookDef:`
`28`	`28`	`matcher="mcp__.autoskillit.__remove_clone",`
`29`	`29`	`scripts=["remove_clone_guard.py"],`
`30`	`30`	`),`
	`31`	`+ HookDef(`
	`32`	`+ matcher=r"mcp__.autoskillit.__open_kitchen.*",`
	`33`	`+ scripts=["open_kitchen_guard.py"],`
	`34`	`+ ),`
`31`	`35`	`]`
`32`	`36`
`33`	`37`