@passioncode-ai/passioncode 0.1.14 → 0.1.17

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/scripts/check_dashboard_link.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Check one structured dashboard handoff from stdin. No I/O effects; exit 0/1.
+
+The caller supplies a trusted host resolver result and observed device/host context.
+This is an output correctness gate, not authentication, discovery, or a relay.
+"""
+import json
+import re
+import sys
+from urllib.parse import parse_qs, urlsplit
+
+
+def require(condition, reason):
+    if not condition:
+        raise ValueError(reason)
+
+
+def safe_path(path):
+    return (isinstance(path, str) and path.startswith('/') and not path.startswith('//')
+            and len(path) <= 2048 and not re.search(r'[\\\x00-\x1f\x7f]', path))
+
+
+def check(data):
+    require(isinstance(data, dict), 'invalid_input')
+    resolved, host, action = (data.get(k) for k in ('resolved', 'host', 'action'))
+    require(all(isinstance(v, dict) for v in (resolved, host, action)), 'missing_context')
+    service, native, http = (resolved.get(k) for k in ('service', 'open_link', 'http_url'))
+    require(isinstance(service, str) and re.fullmatch(r'[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*', service), 'invalid_service')
+    require(isinstance(native, str) and isinstance(http, str), 'missing_resolved_links')
+    require(not re.search(r'[\\\x00-\x20\x7f]', native + http), 'unsafe_url')
+    deep, plain = urlsplit(native), urlsplit(http)
+    require(deep.scheme == 'fabric-dashboards' and not deep.username and not deep.password and not deep.port and not deep.fragment, 'invalid_deep_link')
+    query = parse_qs(deep.query, keep_blank_values=True, strict_parsing=True)
+    if deep.netloc == 'service':
+        require(deep.path in ('/' + service, '/' + service + '/') and set(query) <= {'path'}, 'wrong_service_or_parameter')
+    else:
+        require(deep.netloc == 'open' and deep.path in ('', '/') and query.get('service') == [service] and set(query) <= {'service', 'path'}, 'invalid_legacy_link')
+    require('path' not in query or len(query['path']) == 1, 'duplicate_path')
+    page = query.get('path', [None])[0]
+    require(page is None or safe_path(page), 'unsafe_path')
+    require(plain.scheme == 'http' and plain.hostname in ('127.0.0.1', 'localhost', '::1') and plain.port is not None
+            and not plain.username and not plain.password, 'invalid_http_fallback')
+    http_page = plain.path + ('?' + plain.query if plain.query else '') + ('#' + plain.fragment if plain.fragment else '')
+    require(safe_path(http_page) and http_page == (page or '/'), 'mismatched_page')
+    sensitive = {'token', 'access_token', 'refresh_token', 'password', 'secret', 'login_code'}
+    page_query = parse_qs(urlsplit(http_page).query)
+    require(not sensitive.intersection(k.lower() for k in page_query), 'credential_query')
+    require(urlsplit(http_page).path != '/fabric/v1/login', 'login_link_is_not_dashboard')
+    state = host.get('state')
+    require(state in ('available', 'not_installed', 'unknown', 'incompatible', 'handler_mismatch', 'unsupported'), 'unknown_host_state')
+    target, viewer = data.get('target_device'), data.get('viewer_device')
+    require(all(isinstance(v, str) and 0 < len(v) <= 200 for v in (target, viewer)), 'missing_device')
+    fallback = data.get('fallback', 'if_absent')
+    require(fallback in ('if_absent', 'never'), 'invalid_fallback')
+    kind = action.get('kind')
+    if kind == 'remote_open':
+        require(set(action) <= {'kind', 'device_id', 'service', 'path'}, 'unexpected_action_field')
+        require(action.get('device_id') == target and action.get('service') == service and action.get('path') == page, 'wrong_remote_target')
+        require(viewer != target, 'remote_action_on_local_device')
+    elif kind == 'native_link':
+        require(set(action) == {'kind', 'url'} and action.get('url') == native, 'not_host_provided_link')
+        require(viewer == target, 'wrong_viewer_device')
+        require(state == 'available', 'host_unavailable')
+    elif kind == 'browser_link':
+        require(set(action) == {'kind', 'url'} and action.get('url') == http, 'not_resolved_http_url')
+        require(viewer == target, 'wrong_viewer_device')
+        require(state == 'not_installed' and fallback == 'if_absent', 'browser_fallback_forbidden')
+    else:
+        raise ValueError('unsupported_dashboard_action')
+    return {'ok': True, 'kind': kind}
+
+
+def main():
+    try:
+        raw = sys.stdin.read(65537)
+        require(len(raw) <= 65536, 'input_too_large')
+        result = check(json.loads(raw))
+    except (ValueError, TypeError, KeyError, AttributeError):
+        # Fixed reasons only: never echo a submitted URL, token or JSON blob.
+        result = {'ok': False, 'reason': 'dashboard_handoff_refused'}
+    print(json.dumps(result))
+    return 0 if result['ok'] else 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.14",
+  "version": "0.1.17",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/hooks/repo-rules.js

@@ -32,7 +32,7 @@ function originOf(dir) {
 /** The one line to print at session start in `dir`, or null. */
 function rulesLine(dir) {
   if (!orgOf(originOf(dir))) return null;
-  return `[passioncode] passioncode-ai repository: read the knowledge base (${KNOWLEDGE} or ${KNOWLEDGE_WEB}), then this repository's AGENTS.md, before the first edit; after the work, update the knowledge base page that owns any cross-repository fact you changed.`;
+  return `[passioncode] passioncode-ai repository: read the knowledge base (${KNOWLEDGE} or ${KNOWLEDGE_WEB}), then this repository's AGENTS.md, before the first edit; after the work, update the knowledge base page that owns any cross-repository fact you changed; edit each canonical task source declared in docs/backlog-sources.json and publish the derived workspace backlog.`;
 }
 
 module.exports = { KNOWLEDGE, KNOWLEDGE_WEB, orgOf, rulesLine };

package/payload/plugins/passioncode/hooks/session-start.js

@@ -16,24 +16,32 @@ const DIR = process.env.PASSIONCODE_HOME || path.join(os.homedir(), '.passioncod
 const STATE = path.join(DIR, 'state.json');
 const DAY = 24 * 60 * 60 * 1000;
 
-function read(file, fallback) { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) { return fallback; } }
+function read(file, fallback) {
+  try { const doc = JSON.parse(fs.readFileSync(file, 'utf8')); return doc && typeof doc === 'object' && !Array.isArray(doc) ? doc : fallback; }
+  catch (_) { return fallback; }
+}
 function detached(cmd, args, logName) {
-  try {
-    fs.mkdirSync(path.join(DIR, 'logs'), { recursive: true });
-    const out = fs.openSync(path.join(DIR, 'logs', logName), 'a');
-    spawn(cmd, args, { detached: true, stdio: ['ignore', out, out], env: process.env }).unref();
-    return true;
-  } catch (_) { return false; /* a missing npm must not break the session */ }
+  return new Promise((resolve) => {
+    let out;
+    try {
+      fs.mkdirSync(path.join(DIR, 'logs'), { recursive: true });
+      out = fs.openSync(path.join(DIR, 'logs', logName), 'a');
+      const child = spawn(cmd, args, { detached: true, stdio: ['ignore', out, out], env: process.env });
+      child.once('error', () => resolve(false));
+      child.once('spawn', () => { child.unref(); resolve(true); });
+    } catch (_) { resolve(false); }
+    finally { if (out !== undefined) fs.closeSync(out); }
+  });
 }
 
-try {
+async function main() {
   const state = read(STATE, {});
   const now = Date.now();
-  if (!state.checkedAt || !(now - Date.parse(state.checkedAt) <= DAY)) {
-    detached(process.execPath, [path.join(__dirname, 'probe.js')], 'probe.log');
+  const age = now - Date.parse(state.checkedAt);
+  if (!Number.isFinite(age) || age < 0 || age > DAY) {
+    await detached(process.execPath, [path.join(__dirname, 'probe.js')], 'probe.log');
   }
   const { lines, spawn: args, stateChanges } = decide(state, loadTrust(), now);
-  if (args && !detached('npx', args, 'update.log')) delete stateChanges.updatingSince;
   if (Object.keys(stateChanges).length) {
     // Re-read: the probe may have written meanwhile; only our own keys change.
     const fresh = { ...read(STATE, {}), ...stateChanges };
@@ -42,10 +50,24 @@ try {
     fs.writeFileSync(tmp, JSON.stringify(fresh, null, 2));
     fs.renameSync(tmp, STATE);
   }
+  // Record the attempt before spawning: a fast update must not finish and then
+  // have this hook put the old "running" marker back.
+  if (args && !await detached('npx', args, 'update.log')) {
+    const fresh = read(STATE, {});
+    if (fresh.updatingSince === stateChanges.updatingSince) {
+      delete fresh.updatingSince;
+      const tmp = `${STATE}.${process.pid}.hook`;
+      fs.writeFileSync(tmp, JSON.stringify(fresh, null, 2));
+      fs.renameSync(tmp, STATE);
+    }
+    lines.pop(); // decide appends the update-start notice last when it returns args
+    lines.push('[passioncode] could not start the background update; check that npx is on PATH and retry next session.');
+  }
   // Claude Code passes the session's directory on stdin; the process cwd is the fallback.
   let cwd = process.cwd();
   try { const input = JSON.parse(fs.readFileSync(0, 'utf8') || '{}'); if (input && typeof input.cwd === 'string') cwd = input.cwd; } catch (_) { /* no stdin */ }
   const rules = rulesLine(cwd);
   if (rules) lines.unshift(rules);
   if (lines.length) process.stdout.write(lines.join('\n') + '\n');
-} catch (_) { /* never fail a session start */ }
+}
+main().catch(() => { /* never fail a session start */ });

package/payload/plugins/passioncode/hooks/update-check.js

@@ -47,10 +47,13 @@ function accountName(entry) {
 function parseView(stdout, error) {
   let doc = null;
   try { doc = JSON.parse(String(stdout || '').trim()); } catch (_) { /* judged below */ }
+  // npm 12 wraps a single-version answer in an array; ambiguous answers stay rejected.
+  if (Array.isArray(doc) && doc.length === 1) doc = doc[0];
   if (doc && typeof doc === 'object' && doc.error) {
     if (doc.error.code === 'E404') return { published: false };
     return { checkError: `${doc.error.code || 'npm error'}: ${oneLine(doc.error.summary || '')}`.trim() };
   }
+  if (error) return { checkError: oneLine(error.message) };
   if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
     return { checkError: error ? oneLine(error.message) : 'npm answered with something that is not the expected JSON' };
   }
@@ -117,16 +120,18 @@ function decide(state, trust, now = Date.now()) {
 
   const latest = typeof state.latest === 'string' && VERSION.test(state.latest) ? state.latest : null;
   if (state.published !== false && latest && state.installed && newer(latest, state.installed)) {
-    const maintainers = Array.isArray(state.maintainers) ? state.maintainers.filter((m) => typeof m === 'string') : [];
+    const maintainers = Array.isArray(state.maintainers) ? state.maintainers : [];
     const trusted = new Set(trust);
     const untrusted = [...maintainers, ...(state.publisher ? [state.publisher] : [])].filter((m) => !trusted.has(m));
-    if (!maintainers.length) {
+    if (!maintainers.length || !maintainers.every((m) => typeof m === 'string' && accountName(m) === m)
+      || typeof state.publisher !== 'string' || !state.publisher || accountName(state.publisher) !== state.publisher) {
       lines.push(`[passioncode] ${PACKAGE}@${latest} is on npm but who published it could not be read — not installing; see SECURITY.md.`);
     } else if (untrusted.length) {
       lines.push(`[passioncode] ${PACKAGE}@${latest} is on npm but published by ${[...new Set(untrusted)].join(', ')}, not a trusted PassionCode publisher — not installing; see SECURITY.md.`);
     } else {
       const auto = (state.config && state.config.auto) !== false;
-      const running = state.updatingSince && now - Date.parse(state.updatingSince) < 10 * 60 * 1000;
+      const runningAge = now - Date.parse(state.updatingSince);
+      const running = Number.isFinite(runningAge) && runningAge >= 0 && runningAge < 10 * 60 * 1000;
       if (auto && !running) {
         spawn = ['--yes', `${PACKAGE}@${latest}`, 'update', '--quiet'];
         stateChanges.updatingSince = new Date(now).toISOString();

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -117,7 +117,7 @@ Also, before the first edit:
 - **Ids.** In a repository with `.claude/agent-sync.json`, reserve an id before writing
   it: `agent_sync.py reserve <REGISTER>` (for example `ADR` in fabric). Reading the
   "next free id" line is not reserving it — two agents read the same number.
-- **Leases.** `fabric` and `fabric-agent-contract` guard shared files (their
+- **Leases.** Every enrolled repository guards its declared shared files (its
   `docs/AGENT_SYNC.md` lists them) under a git lease, a ref under
   `refs/agent-sync/leases/` on `origin`, so both machines see it. `acquire` → edit →
   `release`, on every path, failure included.
@@ -128,6 +128,17 @@ Also, before the first edit:
 agent-sync missing: `npx @ssheleg/agent-sync install`. If it cannot be installed, do
 not edit a guarded file — say which file and why you stopped.
 
+### The common backlog
+
+The workspace's `knowledge/backlog.md` owns the aggregation contract. Each repository's
+`docs/backlog-sources.json` declares the canonical local task sources and their vision goals.
+Read those sources before choosing work. Update status only in the owning source under a lease,
+keep stable IDs and closure receipts, and add a new source to the manifest in the same change.
+A cross-repository task has one owner; other repositories link to it instead of copying status.
+The common view at https://wiki.passioncode.ai/backlog is generated from these sources and their
+commit identities. Never edit generated task status. Land the local change, publish through
+Fabric's workspace sync, and check the published source commit before calling it current.
+
 ## 5. Secrets
 
 - Never in Git, a chat message, an issue, a command argument, a URL query string or a
@@ -202,8 +213,8 @@ to a public surface.
   `project-observatory full update --check` and `--apply`.
 - **Launcher** (`passioncode`): members are tagged first, `family.json` refs point at
   those tags, the payload is vendored from tags only.
-- **Contract pins.** `fabric-agent-contract` has no tags, so consumers pin commits, and
-  the pins disagree (org-index `BACKLOG.md` X-4). Move a pin only in a release of the
+- **Contract pins.** `fabric-agent-contract` consumers carry explicit commit pins;
+  compatibility work is tracked in the owning consumer backlog and the derived workspace view. Move a pin only in a release of the
   consumer, and only when its own validation passes against the new commit.
 
 Read [releasing](references/releasing.md) for the step-by-step of each repository's

package/payload/plugins/passioncode/skills/working-in-passioncode/references/releasing.md

@@ -58,7 +58,7 @@ The README section "Validate this repository" is the gate:
 ```bash
 python3 -m unittest discover -s test -v
 python3 test/validate.py
-node --test 'test/*.test.js'
+node --test 'test/*.test.mjs'
 claude plugin validate ./plugins/fabric-agent-adapter --strict
 claude plugin validate . --strict
 ```
@@ -78,16 +78,17 @@ manifests. Trigger and scenario evals change before the instructional prose they
 
 ## Contract pins
 
-- `fabric-agent-contract` publishes no tags; consumers (fabric, the adapter, the
-  Observatory) pin a commit. The pins disagree today — org-index `BACKLOG.md` X-4 tracks
-  it.
+- Consumers declare their own explicit contract pins. Read the actual lock or
+  submodule commit, then the owning consumer backlog and shared workspace view;
+  do not infer compatibility from matching version labels.
 - Moving a pin is a compatibility change of the **consumer**: run the consumer's own
   validation against the new contract commit (for the adapter:
   `adapt_project.py check <bundle> --contract <checkout at the new commit>` for each
   profile), review what changed between the two commits, and ship it as a new consumer
   release. If the validation does not pass, leave the pin and report why.
-- `project-observatory-contract` publishes immutable `rev-N` tags; a schema `$id` change
-  needs a new `rev-N`.
+- `project-observatory-contract` preserves historical immutable `rev-N` tags. Current
+  Project Observatory schemas ship with the engine release and its per-file release pins;
+  the engine publication checker refuses the retired `--stage` and `--publish` operations.
 
 ## After a release