[masonc08]

What changed

Imports all eligible connectors and enabled skills returned by the authenticated Anthropic account APIs into third-party Cowork when relay mode is enabled, alongside the workspace plugin and system.ai MCPs. Inference continues through the configured gateway. The plugin retains its existing ug-account-docs@unity-gateway-cowork ID for installed users.

Configure discovers account connectors and downloads enabled skills, including custom skill archives and supporting files with executable permissions. Names use safe aliases and deterministic collision suffixes. SessionStart refreshes enabled skills and requests reloadSkills; connector additions or removals require reconfigure and a fresh task.

An ownership manifest removes confirmed disabled/deleted skills while preserving other plugin files. Individual download failures retain previous copies for the same organization and skill ID; discovery failures preserve the existing account plugin. Archive validation rejects unsafe paths, symlinks, conflicting files, and excessive downloads.

Managed configure carries Claude's newly configured relay flag and proxy-port state into Cowork sync and subsequent agent setup. Previously, the outer state could retain an earlier non-relay mode, causing Cowork sync to remove account resources even though Desktop had just been configured for relay. Switching away from relay also clears the obsolete state.

The transparent stdio-to-HTTP bridge preserves MCP instructions, schemas, annotations, and results, checking connector eligibility and reading or silently refreshing the existing relay credential. Generated configuration contains no bearer. Disabling relay removes the account plugin on configure; revert cleans up both plugins.

These are undocumented Anthropic APIs. Importing skills does not provide missing native browser, artifact, computer-use, or other tools; some imported skills may depend on capabilities unavailable in this session.

How was it tested?

• 361 targeted component tests passed, covering multiple eligible connectors, enabled/custom skills, safe aliases, support-file permissions, partial download failures, organization isolation, disabled/deleted-skill cleanup, rollback, upgrade from the Docs-only layout, relay guards, and an MCP SDK initialization/tool-list/tool-call exchange.
• Managed-configure regressions cover enabling, disabling, and retaining relay mode with Claude alone and with Codex in either order. The transition cases reproduced incorrect Cowork state before the fix.
• Ruff lint/format and ty type checks passed.
• Claude CLI validated a generated marketplace and account plugin with two connectors and three skills.
• Manual Mac API probes succeeded for connector discovery, Claude Docs MCP initialization/tool listing/read-only guide, skill listing, and the docs archive.
• User-reported native third-party Cowork checks loaded 13 enabled account skills, including google-workspace, invoked the Docs read-only guide, and discovered regular workspace tools in the same task. The installed account Google Drive stdio command also initialized and listed 11 tools through the MCP SDK.

Native account Google Drive visibility remains unverified: it was absent from the native connector list despite the successful direct bridge probe, and later inspection found both the account registration and generated source missing. Restoring them after the managed-configure fix and repeated same-session skill reload still require Mac validation. This PR remains draft.