@iseoane/agent-depot 0.6.15 → 0.6.16

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.16] - 2026-11-13
+
+### Changed
+
+- `app install` names the Hosts whose setup the recipe declares and the `app setup` command to run, since install never runs Host setup and wiring is not tracked (#131).
+- The built-in `agent-depot-apprecipe` Skill (1.3) checks Host wiring in its preflight (unattended setup per Host, conflicting MCP entries, plugins and packages), prefers `argv` setup when possible, rechecks manual setup on repair and hands off the pending `app setup` command per Host (#131).
+
 ## [0.6.15] - 2026-11-12
 
 ### Changed

package/dist/src/app-cli.js

@@ -1,6 +1,6 @@
 import { PROJECT_HOSTS } from "./project-manifest.js";
 import { APP_RECIPE_SCHEMA } from "./app-schema.js";
-import { checkAppUpdates } from "./app-flow.js";
+import { checkAppUpdates, declaredSetupHosts } from "./app-flow.js";
 import { NO_PROGRESS } from "./progress.js";
 import { CliUsageError } from "./usage-error.js";
 const ACTION_PROGRESS = {
@@ -158,15 +158,27 @@ async function runLifecycle(action, args, apps, output, usage, progress) {
             output(`Manual (never executed): ${result.manual}`);
             output(describeManualCompletion(plan));
         }
+        if (action === "install" && result.status === "installed")
+            showSetupHosts(plan);
         return result.status === "installed" || result.status === "untracked" || result.status === "completed" ? 0 : 1;
     }
+    function showSetupHosts(plan) {
+        const hosts = declaredSetupHosts(plan.entry.recipe);
+        if (!hosts.length)
+            return;
+        output(`Host setup is separate and not tracked; this recipe declares it for: ${hosts.join(", ")}.`);
+        output(`Run app setup ${quoteAppName(name)} --host <host> --yes for each Host you use.`);
+    }
+}
+function quoteAppName(name) {
+    return process.platform === "win32"
+        ? "'" + name.replaceAll("'", "''") + "'"
+        : "'" + name.replaceAll("'", "'\\''") + "'";
 }
 /** Copyable completion command for the platform's documented shell. */
 export function describeManualCompletion(plan) {
     const name = plan.entry.recipe.name;
-    const quotedName = process.platform === "win32"
-        ? "'" + name.replaceAll("'", "''") + "'"
-        : "'" + name.replaceAll("'", "'\\''") + "'";
+    const quotedName = quoteAppName(name);
     const shell = process.platform === "win32" ? "PowerShell" : "POSIX shell";
     return `After completing it, run app ${plan.action} ${quotedName}${plan.host ? ` --host ${plan.host}` : ""} --manual-done --yes to check version (${shell}).`;
 }

package/dist/src/app-flow.js

@@ -7,6 +7,7 @@ import { fetchAppLatest } from "./app-latest.js";
 import { writeFileAtomically } from "./atomic-file.js";
 import { parseAppRecipe } from "./app-recipes.js";
 import { createPortableExecutableResolver } from "./executable-resolution.js";
+import { PROJECT_HOSTS } from "./project-manifest.js";
 import { runProcess } from "./process-runner.js";
 import { defaultSourceStatePath } from "./source-state.js";
 const APP_OUTPUT_LIMIT = 1024 * 1024;
@@ -489,6 +490,10 @@ export function createAppOperations(environment = {}) {
     }
     return { directory, approvalStatus, checkUpdate, load, preview, approve, inspect, inspectForExport, planLifecycle, executeLifecycle, completeManual, cancelManual, trackedApps, previewForget, forgetApp };
 }
+/** Hosts whose user-global setup the recipe declares; install never runs them and wiring is not tracked. */
+export function declaredSetupHosts(recipe) {
+    return PROJECT_HOSTS.filter(host => recipe.setup?.[host] !== undefined);
+}
 /** Concurrent independent checks; one broken App must not hide the rest of a batch. */
 export async function checkAppUpdates(apps) {
     const entries = (await apps.load()).filter(entry => entry.applicable || entry.error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iseoane/agent-depot",
-  "version": "0.6.15",
+  "version": "0.6.16",
   "description": "A cross-platform catalog for reusable coding-agent skills.",
   "license": "MIT",
   "author": "iseoane",

package/skills/agent-depot-apprecipe/SKILL.md

@@ -4,7 +4,7 @@ description: "Trigger: App recipe creation or repair. Research an App's actual i
 license: MIT
 metadata:
   author: "iseoane"
-  version: "1.2"
+  version: "1.3"
 ---
 
 ## Activation Contract
@@ -43,6 +43,7 @@ Check installation **and** update, uninstall, version/latest and each Host setup
 - **Runtime/build and hook requirements:** verify documented engine ranges, compiler/toolchain minimums, architecture/libc support and utilities such as `git`, `curl`, `jq` or extraction tools. Check write access to the actual global prefix and required elevation; never assume sudo or request credentials in chat. Inspect prerequisites for Host plugins separately from the App binary.
 - **Unattended behavior:** use installed manager `--help`/documented help and upstream installer source to establish confirmation defaults and supported flags. Verify explicit formula/cask or package disambiguation where necessary. Do not invent `--yes` flags or rely on stdin EOF to count as consent. Run dry-run/read-only probes only after checking they do not install, register, authenticate or rewrite configuration; never test a lifecycle command just to see whether it prompts.
 - **Version and update signals:** verify a release-meaningful version (not an unchanged `dev`) and a latest signal for the chosen channel. A GitHub release can be ahead of a package-manager formula. Use channel metadata when available and disclose freshness limits; do not run `brew update` or another mutating refresh as a read-only latest probe.
+- **Host wiring:** for each Host the user uses, read the installed App's setup help (for example `<app> setup --help`) and establish, per Host, whether setup runs unattended and which flags it accepts; a flag valid for one Host can be rejected for another. Inspect existing wiring that setup may conflict with or duplicate: user MCP entries (for Claude, `mcpServers` in `~/.claude.json`), Host plugins (`claude plugin list`), Host packages (`pi list`) and permissions entries. Setup that refuses to overwrite a conflicting entry needs a documented removal step first. Flags that grant permissions or bypass prompts are the user's choice: present them, never select them silently.
 - **Preserved state:** identify existing binary copies, data directories and Host wiring without reading private memory content. Explain migrations, backups and teardown scope outside executable argv where appropriate; never delete user data or remove a shared tap/marketplace implicitly.
 
 ### Homebrew checklist
@@ -59,10 +60,10 @@ Read the current schema; do not assume it has dependency or multi-command fields
 
 1. Record upstream evidence and platform support. Inspect all PATH matches (`which -a`/`whence -a`, or Windows `Get-Command -All`), resolved paths, and channel inventories such as `brew list`, `npm ls -g` or `pipx list`. List Windows shims seen from WSL separately: `/mnt/<drive>/` executables cannot serve a Linux recipe. Finish only when the actual channel is established or the user has chosen one.
 2. Complete the Installer Preflight and resolve the prerequisite decision gate before writing required `name`, `install`, `update`, `uninstall`, and `version`. Each lifecycle step uses `argv`, `manual`, or both; manual fallback applies only to spawn failure, never non-zero exit. `version` needs read-only argv and a JavaScript regex with exactly one capture group. Choose optional `latest` as `github: owner/repo`, `npm: package`, or read-only `argv` plus `pattern`; omit it when unknown. Consult [the illustrative example](assets/example.md), not as upstream command evidence.
-3. Put user-global Host wiring in optional `setup`/`teardown` maps keyed by `pi`, `claude`, `codex`, or `opencode`. Keep install separate; uninstall never implicitly runs teardown. Delegate wiring to App commands or manual user instructions, not direct agent edits of Host configuration. Exclude project initialization.
+3. Ask which Hosts the user uses when it is not already established. Put user-global Host wiring in optional `setup`/`teardown` maps keyed by `pi`, `claude`, `codex`, or `opencode`. Keep install separate; uninstall never implicitly runs teardown. Agent Depot never executes `manual` text and does not track wiring, so a manual setup stays undone unless the user runs it: use `argv` whenever the Host Wiring preflight shows an unattended route, and keep `manual` only for steps that need a terminal or a user decision. When repairing a recipe or after an App update, recheck every `manual` setup step against the installed version's help; a new non-interactive flag can make it automatable. Delegate wiring to App commands or manual user instructions, not direct agent edits of Host configuration. Exclude project initialization.
 4. Declare optional `skills` only for documented App-owned directory/link names. Match whole names case-sensitively; only `*` is special, while `?` and brackets are literal. Reject empty/whitespace-only, path separators, NUL and star-only patterns. These declarations filter unmanaged adoption/removal even before approval/install; they verify no artifacts or provenance.
 5. Run `agent-depot app validate <file>...` for current-platform recipes. Fix structural errors; report unapproved recipes as needs approval, not runtime-verified. Distinguish structural validity, recipe approval, prerequisite readiness, installed version and Host wiring; none proves the others. A known missing prerequisite remains a blocker even when validation succeeds. Version commands run only for approved applicable content. Mark other platforms unverified. After user approval, the user can inspect `app list` and separately preview `app install|update|uninstall <name>` or `app setup|teardown <name> --host <host>`.
 
 ## Output Contract
 
-Return file paths, platform/channel evidence, a concise prerequisite status (satisfied/missing/unverified) with preparation commands and whether the recipe is ready or blocked, validation results and runtime-verification limits; unsupported platforms; omitted optional fields and why; license, telemetry/update-check behavior (or unknown); and conflicting duplicate install routes, including plugin-marketplace versus setup routes. Explain that version alone determines installed state, updates require a changed version, and unknown latest is not an available update. End with the user's approval command, without running it.
+Return file paths, platform/channel evidence, a per-Host wiring status for each Host the user uses (wired, pending, manual or conflicting, with the evidence inspected) and the exact `agent-depot app setup <name> --host <host>` command for each pending Host, a concise prerequisite status (satisfied/missing/unverified) with preparation commands and whether the recipe is ready or blocked, validation results and runtime-verification limits; unsupported platforms; omitted optional fields and why; license, telemetry/update-check behavior (or unknown); and conflicting duplicate install routes, including plugin-marketplace versus setup routes. Explain that version alone determines installed state, updates require a changed version, and unknown latest is not an available update. End with the user's approval command, without running it.