@passioncode-ai/passioncode 0.1.28 → 0.1.29

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.29 - 2026-10-05
+
+### Changed
+
+- **Observatory Log is pinned at `v0.17.3`** (plugin 0.17.3; it was `v0.16.0`). Its
+  SessionStart hook keeps Project Observatory current:
+  - for an engine at 0.17.0 or later, it schedules the engine's hourly maintenance job where
+    it is missing;
+  - for an engine from 0.7.0 to 0.16.0, which has no updater of its own, it installs the newer
+    release once a day with that engine's `full update --apply`, unless the person turned
+    automatic updates off.
+
+  Both run detached, at most every six hours or once a day, and never hold up a session.
+
 ## 0.1.28 - 2026-10-05
 
 The launcher meets the organization's

package/COMMERCIAL-LICENSE.md

@@ -5,7 +5,7 @@ This repository is open source under the [GNU Affero General Public License v3.0
 meet the AGPL's terms — for example inside a closed-source product, or as a modified hosted
 service whose source is not published.
 
-To obtain a commercial license, write to **contact@passioncode.ai**.
+To obtain a commercial license, tell us about your use at **https://passioncode.ai/business/**, or write to **commercial@passioncode.ai**.
 
 SPDX: `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial`. Copyright (c) 2026 Siarhei Sheleh.
 Contributions are accepted under [CLA.md](CLA.md), which allows this dual licence.

package/README.md

@@ -115,7 +115,7 @@ reads a member from `<dir>/<repository name>`, and `PASSIONCODE_CHECKOUT_<MEMBER
 ## License
 
 Open source under the [GNU AGPL-3.0](LICENSE). A [commercial license](COMMERCIAL-LICENSE.md) is
-available for use that does not meet the AGPL's terms — contact@passioncode.ai.
+available for use that does not meet the AGPL's terms — [passioncode.ai/business](https://passioncode.ai/business/).
 Versions before 0.1.12 were released under PolyForm Noncommercial or Internal Use (v0.1.5 to
 v0.1.11) and MIT (v0.1.4 and earlier); each keeps the licence it was released under.
 Contributions are accepted under [CLA.md](CLA.md) ([CONTRIBUTING.md](CONTRIBUTING.md)).

package/family.json

@@ -22,7 +22,7 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "repo": "passioncode-ai/project-observatory-dashboard",
-      "ref": "v0.16.0",
+      "ref": "v0.17.3",
       "kind": "plugin",
       "path": "observatory/engine/skill/plugins/observatory-log",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -23,7 +23,7 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "source": "./plugins/observatory-log",
-      "version": "0.16.0",
+      "version": "0.17.3",
       "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.28",
+      "version": "0.1.29",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,6 +1,6 @@
 {
   "family": "passioncode",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "release": true,
   "members": [
     {
@@ -34,9 +34,9 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "repo": "passioncode-ai/project-observatory-dashboard",
-      "ref": "v0.16.0",
-      "commit": "aa6788d51e248de54c3f7184b17206af43e0b28e",
-      "version": "0.16.0",
+      "ref": "v0.17.3",
+      "commit": "58bf0d9aabc452da95133fc561ee08d5279d6cf5",
+      "version": "0.17.3",
       "via": "clone of https://***@github.com/passioncode-ai/project-observatory-dashboard.git",
       "skills": [
         "explaining-changes",
@@ -49,7 +49,7 @@
       "legacyMarketplaces": [
         "observatory-log"
       ],
-      "contentHash": "sha256:f0bfd0f79ee99d25e6c82ad5f84337de2ce09f406fb4f5036cb45e3aa20d490a",
+      "contentHash": "sha256:615c85cd2486ac990c04a1df834639ace0e22f2ab3d2830ccafa72453b3e0b3a",
       "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.28",
+      "ref": "v0.1.29",
       "commit": null,
-      "version": "0.1.28",
+      "version": "0.1.29",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:c071f7a058bd6a8b8135ca7dd498f0b72ecd31cff1086ebbd3567611d66dbc98",
+      "contentHash": "sha256:61bfba01e7a1d988d4a68b31b11cabf695996b1d4285c1518189e80bb2795adc",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/observatory-log/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "observatory-log",
   "displayName": "Observatory Log",
   "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
-  "version": "0.16.0",
+  "version": "0.17.3",
   "license": "AGPL-3.0-only OR LicenseRef-PassionCode-Commercial",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/observatory-log/hooks/session-start.sh

@@ -18,10 +18,83 @@ if [ -z "$root" ] && [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     c="$n"
   done
 fi
+if [ -z "$root" ] && command -v project-observatory >/dev/null 2>&1; then
+  # Installed by the PassionCode launcher with no `full agent install`: ask the engine.
+  root="$(project-observatory full-path 2>/dev/null || true)"
+fi
 [ -n "$root" ] || exit 0
-[ -f "$root/tools/session_start.py" ] || exit 0
-py="${OBSERVATORY_PYTHON:-$root/.venv/bin/python}"   # set by `full agent install`
-[ -x "$py" ] || py="$(command -v python3 2>/dev/null)"
+[ -d "$root" ] || exit 0
+
+# The engine's own virtual environment (the ancestor holding pyvenv.cfg), so the jobs
+# below run the installed package and never whichever python3 is first on PATH.
+venv=""; c="$root"
+for _ in 1 2 3 4 5 6 7 8; do
+  [ -f "$c/pyvenv.cfg" ] && { venv="$c"; break; }
+  n="$(dirname "$c")"; [ "$n" = "$c" ] && break; c="$n"
+done
+py="${OBSERVATORY_PYTHON:-}"                              # set by `full agent install`
+[ -n "$py" ] && [ -x "$py" ] || py=""
+[ -z "$py" ] && [ -n "$venv" ] && [ -x "$venv/bin/python" ] && py="$venv/bin/python"
+[ -z "$py" ] && [ -x "$root/.venv/bin/python" ] && py="$root/.venv/bin/python"
+[ -z "$py" ] && py="$(command -v python3 2>/dev/null)"
 [ -n "$py" ] || exit 0
-printf '%s' "$payload" | "$py" "$root/tools/session_start.py" 2>/dev/null || true
+
+if [ -f "$root/tools/session_start.py" ]; then
+  printf '%s' "$payload" | "$py" "$root/tools/session_start.py" 2>/dev/null || true
+fi
+
+# Updates that arrive by themselves (docs/runs/2026-10-05-auto-update, D8). Detached and
+# rate-limited, so a session never waits for it and never fails because of it.
+stamps="${XDG_STATE_HOME:-$HOME/.local/state}/project-observatory"
+mkdir -p "$stamps" 2>/dev/null && chmod 700 "$stamps" 2>/dev/null
+# claim NAME SECONDS: true for exactly one caller per window. `mkdir` is atomic, so twenty
+# sessions starting at once start one job, not twenty (review F6).
+claim() {
+  local lock="$stamps/$1.claim" then now
+  if ! mkdir "$lock" 2>/dev/null; then
+    then="$(stat -c %Y "$lock" 2>/dev/null || stat -f %m "$lock" 2>/dev/null || echo 0)"
+    now="$(date +%s)"
+    [ $((now - then)) -ge "$2" ] || return 1
+    rmdir "$lock" 2>/dev/null; mkdir "$lock" 2>/dev/null || return 1
+  fi
+  return 0
+}
+# detach LOG CMD...: a new session of its own, so ending this session or its process group
+# cannot stop an install half-way (review F8).
+detach() {
+  local log="$1"; shift
+  "$py" -c 'import subprocess, sys
+log = open(sys.argv[1], "a")
+subprocess.Popen(sys.argv[2:], stdin=subprocess.DEVNULL, stdout=log, stderr=log, start_new_session=True)' \
+    "$log" "$@" 2>/dev/null || true
+}
+if [ -f "$root/tools/maintain.py" ]; then
+  # 0.17.0 and later: schedule the hourly job where it is missing, or run a pass where
+  # this machine has no scheduler. At most every six hours.
+  if claim maintain-hook 21600; then
+    OBSERVATORY_SYSTEM_SETUP=1 detach "$stamps/maintain-hook.log" "$py" "$root/tools/maintain.py" hook
+  fi
+else
+  # The bridge for engines from before 0.17.0, which carry no updater of their own:
+  # once a day, check; when a newer stable release exists and the person has not turned
+  # automatic updates off (`updates.auto` false), install it with `full update --apply`.
+  po=""
+  [ -n "$venv" ] && [ -x "$venv/bin/project-observatory" ] && po="$venv/bin/project-observatory"
+  [ -n "$po" ] || po="$(command -v project-observatory 2>/dev/null)"
+  if [ -n "$po" ] && claim update-bridge 86400; then
+    detach "$stamps/update-bridge.log" /bin/bash -c '
+      po="$1"; py="$2"
+      home="${OBSERVATORY_FULL_HOME:-${OBSERVATORY_HOME:-$HOME/.local/share/project-observatory-full}}"
+      off="$("$py" -c "import json,sys
+try: d=json.load(open(sys.argv[1]))
+except Exception: d={}
+print(1 if (d.get(\"updates\") or {}).get(\"auto\") is False else 0)" "$home/config/settings.json" 2>/dev/null)"
+      [ "$off" = "1" ] && { echo "$(date -u +%FT%TZ) automatic updates are off"; exit 0; }
+      "$po" full update --check >/dev/null 2>&1; rc=$?
+      echo "$(date -u +%FT%TZ) check exit $rc"
+      [ "$rc" = "10" ] || exit 0
+      "$po" full update --apply; echo "$(date -u +%FT%TZ) apply exit $?"
+    ' _ "$po" "$py"
+  fi
+fi
 exit 0

package/payload/plugins/observatory-log/skills/explaining-changes/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   decision with different evidence.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.16.0"
+  version: "0.17.3"
 compatibility: >-
   Requires an initialized full Project Observatory installation to persist
   records. Uses its MCP server when available in the current host; the bundled

package/payload/plugins/observatory-log/skills/handling-secrets/SKILL.md

@@ -10,7 +10,7 @@ description: >-
   provider permissions or choosing a project's authentication architecture.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.16.0"
+  version: "0.17.3"
 compatibility: >-
   Requires an initialized full Project Observatory installation, Python 3.11+
   and local shell access on macOS or Linux. Provider operations additionally
@@ -30,7 +30,7 @@ names. Never ask the user to paste a credential into the conversation.
 2. Select the user's initialized `OBSERVATORY_HOME`. Run
    `project-observatory full doctor`. A missing workspace
    needs the documented onboarding before secret operations.
-3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.16.0`
+3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.17.3`
    (`full agent install` records that interpreter; the stock macOS `python3` is too old).
    If stale, read the installed skill once and follow its compatible commands.
    Do not turn an unavailable version check into a retry loop.
@@ -154,6 +154,16 @@ bucket's resource only. Before anything is delivered, the S3 pair must prove a
 put, a get and a delete, and must be refused a bucket list. It lands in three
 slots on stdin: `<PREFIX>_ACCESS_KEY_ID`, `<PREFIX>_SECRET_ACCESS_KEY` and
 `<PREFIX>_ENDPOINT`. A second issue rolls the same token and keeps the key id.
+The lifecycle is `--expire-days` over the whole bucket (30 when nothing else is
+given) plus one rule per repeatable `--lifecycle-rule PREFIX:DAYS`, for example
+`--lifecycle-rule staging/:2`: objects under the prefix are deleted after DAYS,
+and its unfinished multipart uploads are aborted after a day. Each run replaces
+the bucket's lifecycle with exactly that set and reads every rule back. A rule
+that could never fire is refused, such as a prefix kept longer than the
+whole-bucket rule. To change only an existing bucket's rules, run
+`cloudflare.py lifecycle --account <slug> --bucket <name> [--jurisdiction eu]
+[--expire-days N] [--lifecycle-rule PREFIX:DAYS ...]`. It mints only the setup
+token, never creates a bucket and never mints, rolls or delivers a key.
 
 An application that sends transactional email through Cloudflare Email Service
 gets `cloudflare.py issue --preset email-send --account <slug> --vault

package/payload/plugins/observatory-log/skills/tracking-resources/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   the repository.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.16.0"
+  version: "0.17.3"
 compatibility: >-
   Requires a full Project Observatory installation with organizations.json
   configured; the observatory MCP server or its local CLI. Creating the resource

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -152,16 +152,18 @@ Fabric's workspace sync, and check the published source commit before calling it
 ## 6. Licensing and the repository standard
 
 - **Every repository** is open source under the GNU AGPL-3.0, or available under a commercial
-  license from PassionCode.ai (contact@passioncode.ai):
-  `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` (Fabric ADR-0092; the knowledge base
-  `licensing.md` owns it). Copyright: Siarhei Sheleh. No price or term is stated anywhere.
+  license from PassionCode.ai — the request form https://passioncode.ai/business/, or
+  commercial@passioncode.ai: `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` (Fabric
+  ADR-0092; the knowledge base `licensing.md` owns it). Copyright: Siarhei Sheleh. No price or
+  term is stated anywhere; every commercial path points to the form. Security reports stay at
+  contact@passioncode.ai.
 - `LICENSE`, `COMMERCIAL-LICENSE.md` and `CLA.md` are copied **byte for byte** from the knowledge
   base's `templates/`; every manifest and SKILL.md `license:` carries the expression.
 - A version released earlier keeps its licence — MIT or PolyForm Noncommercial or Internal Use —
   and the README may say which. Never write that a released version changed.
 - The README's `## License` section uses the knowledge base wording and names the earlier
   licences: "Open source under the GNU AGPL-3.0. A commercial license is available for use that
-  does not meet the AGPL's terms — contact@passioncode.ai."
+  does not meet the AGPL's terms — [passioncode.ai/business](https://passioncode.ai/business/)."
 - Contributions are accepted under the repository's `CLA.md`; opening a pull request is the
   agreement, so a PR template never carries a CLA checkbox.
 - **The repository standard** (the knowledge base `repository-standard.md`): README first heading

package/payload/plugins/passioncode/skills/working-in-passioncode/references/publishing.md

@@ -14,7 +14,7 @@ change to a license, a manifest's `license` field, `CLA.md` or a PR template.
 ## The license, file by file
 
 Every repository is open source under the GNU AGPL-3.0, or available under a commercial
-license from PassionCode.ai (contact@passioncode.ai): SPDX
+license from PassionCode.ai (https://passioncode.ai/business/, commercial@passioncode.ai): SPDX
 `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` (Fabric ADR-0092). The owning page is the
 knowledge base's `licensing.md`; the file list is its `repository-standard.md`, and org-index
 `scripts/check_format.py` (rules F7–F11) checks it. The three licence files are **copied byte
@@ -47,14 +47,15 @@ for byte** from the knowledge base's `templates/` — never retyped, reflowed or
   ## License
 
   Open source under the [GNU AGPL-3.0](LICENSE). A [commercial license](COMMERCIAL-LICENSE.md) is
-  available for use that does not meet the AGPL's terms — contact@passioncode.ai.
+  available for use that does not meet the AGPL's terms — [passioncode.ai/business](https://passioncode.ai/business/).
   Versions before <first AGPL version> were released under <MIT | PolyForm Noncommercial or Internal Use>.
   ```
 
 - "Source-available" and the PolyForm expression describe past releases only; never state
   them as the current licence.
 - No price or term for the commercial licence is stated anywhere; point to
-  contact@passioncode.ai.
+  https://passioncode.ai/business/ (commercial@passioncode.ai is the commercial contact). Security
+  reports stay at contact@passioncode.ai.
 - Positioning and names come from the knowledge base (`vision.md`, `principles.md` §2); do not
   restate a tagline from memory.