@passioncode-ai/passioncode 0.1.28 → 0.1.30

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.3"
+  version: "0.8.0"
   contract-version: "0.1.0"
-  contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
+  contract-commit: "23f9fda4c05f8a3852246ee98d4f2adf74ed0875"
 ---
 
 # Creating Fabric-compatible agents
@@ -119,12 +119,16 @@ python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/adapt_project.py
   --schema-base <immutable-base-uri>
 ```
 
-Pin exactly contract `0.1.0` at commit `2ce392291c6668598d12cd38327e24696b5ca15c` and
+Pin exactly contract `0.1.0` at commit `23f9fda4c05f8a3852246ee98d4f2adf74ed0875` and
 read the pinned guide before implementing protocol details. If this skill is installed
 without its sibling, the scaffolder is absent: create the bundle by hand from the pinned
 contract's `docs/guides/connecting-compatible-agents.md` and mark the structural check
 `NOT_RUN` — do not reconstruct normative rules from memory.
 
+This default accepts underscore capability names; a declared communications name does
+not grant COM access or prove runtime admission. Existing bundles retain their explicit
+supported revision and require its exact checkout; never silently migrate their lock.
+
 The generated placeholders are deliberate blockers; a bundle still containing one is not
 ready for admission.
 

package/payload/plugins/observatory-log/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "observatory-log",
   "displayName": "Observatory Log",
   "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "license": "AGPL-3.0-only OR LicenseRef-PassionCode-Commercial",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/observatory-log/hooks/session-start.sh

@@ -18,10 +18,97 @@ if [ -z "$root" ] && [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     c="$n"
   done
 fi
+if [ -z "$root" ] && command -v project-observatory >/dev/null 2>&1; then
+  # Installed by the PassionCode launcher with no `full agent install`: ask the engine.
+  root="$(project-observatory full-path 2>/dev/null || true)"
+fi
 [ -n "$root" ] || exit 0
-[ -f "$root/tools/session_start.py" ] || exit 0
-py="${OBSERVATORY_PYTHON:-$root/.venv/bin/python}"   # set by `full agent install`
-[ -x "$py" ] || py="$(command -v python3 2>/dev/null)"
+[ -d "$root" ] || exit 0
+
+# The engine's own virtual environment (the ancestor holding pyvenv.cfg), so the jobs
+# below run the installed package and never whichever python3 is first on PATH.
+venv=""; c="$root"
+for _ in 1 2 3 4 5 6 7 8; do
+  [ -f "$c/pyvenv.cfg" ] && { venv="$c"; break; }
+  n="$(dirname "$c")"; [ "$n" = "$c" ] && break; c="$n"
+done
+py="${OBSERVATORY_PYTHON:-}"                              # set by `full agent install`
+[ -n "$py" ] && [ -x "$py" ] || py=""
+[ -z "$py" ] && [ -n "$venv" ] && [ -x "$venv/bin/python" ] && py="$venv/bin/python"
+[ -z "$py" ] && [ -x "$root/.venv/bin/python" ] && py="$root/.venv/bin/python"
+[ -z "$py" ] && py="$(command -v python3 2>/dev/null)"
 [ -n "$py" ] || exit 0
-printf '%s' "$payload" | "$py" "$root/tools/session_start.py" 2>/dev/null || true
+
+if [ -f "$root/tools/session_start.py" ]; then
+  printf '%s' "$payload" | "$py" "$root/tools/session_start.py" 2>/dev/null || true
+fi
+
+# Updates that arrive by themselves (docs/runs/2026-10-05-auto-update, D8). Detached and
+# rate-limited, so a session never waits for it and never fails because of it.
+stamps="${XDG_STATE_HOME:-$HOME/.local/state}/project-observatory"
+mkdir -p "$stamps" 2>/dev/null && chmod 700 "$stamps" 2>/dev/null
+# claim NAME SECONDS: true for exactly one caller per window. The check and the stamp happen
+# under one exclusive lock, so twenty sessions starting at once start one job, not twenty —
+# also when the previous window has just expired (audit A20).
+claim() {
+  "$py" - "$stamps/$1.at" "$2" <<'PYCLAIM' 2>/dev/null
+import fcntl, os, sys, time
+path, window = sys.argv[1], int(sys.argv[2])
+fd = os.open(path + ".lock", os.O_CREAT | os.O_RDWR, 0o600)
+try:
+    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+except BlockingIOError:
+    sys.exit(1)
+try:
+    last = os.stat(path).st_mtime
+except OSError:
+    last = 0
+if time.time() - last < window:
+    sys.exit(1)
+with open(path, "a"):
+    pass
+os.utime(path, None)
+PYCLAIM
+}
+# detach LOG CMD...: a new session of its own, so ending this session or its process group
+# cannot stop an install half-way (review F8).
+detach() {
+  local log="$1"; shift
+  "$py" -c 'import subprocess, sys
+log = open(sys.argv[1], "a")
+subprocess.Popen(sys.argv[2:], stdin=subprocess.DEVNULL, stdout=log, stderr=log, start_new_session=True)' \
+    "$log" "$@" 2>/dev/null || true
+}
+if [ -f "$root/tools/maintain.py" ]; then
+  # 0.17.0 and later: schedule the hourly job where it is missing, or run a pass where
+  # this machine has no scheduler. At most every six hours.
+  if claim maintain-hook 21600; then
+    OBSERVATORY_SYSTEM_SETUP=1 detach "$stamps/maintain-hook.log" "$py" "$root/tools/maintain.py" hook
+  fi
+else
+  # The bridge for engines from before 0.17.0, which carry no updater of their own:
+  # once a day, check; when a newer stable release exists and the person has not turned
+  # automatic updates off (`updates.auto` false), install it with `full update --apply`.
+  po=""
+  [ -n "$venv" ] && [ -x "$venv/bin/project-observatory" ] && po="$venv/bin/project-observatory"
+  [ -n "$po" ] || po="$(command -v project-observatory 2>/dev/null)"
+  if [ -n "$po" ] && claim update-bridge 86400; then
+    detach "$stamps/update-bridge.log" /bin/bash -c '
+      po="$1"; py="$2"
+      home="${OBSERVATORY_FULL_HOME:-${OBSERVATORY_HOME:-$HOME/.local/share/project-observatory-full}}"
+      off="$("$py" -c "import json,sys
+try: d=json.load(open(sys.argv[1]))
+except Exception: d={}
+print(1 if (d.get(\"updates\") or {}).get(\"auto\") is False else 0)" "$home/config/settings.json" 2>/dev/null)"
+      [ "$off" = "1" ] && { echo "$(date -u +%FT%TZ) automatic updates are off"; exit 0; }
+      "$po" full update --check >/dev/null 2>&1; rc=$?
+      echo "$(date -u +%FT%TZ) check exit $rc"
+      [ "$rc" = "10" ] || exit 0
+      # No launchd (Linux): nothing for the update to stop, and saying so lets it run (A02).
+      if command -v launchctl >/dev/null 2>&1; then "$po" full update --apply
+      else "$po" full update --apply --writers-stopped; fi
+      echo "$(date -u +%FT%TZ) apply exit $?"
+    ' _ "$po" "$py"
+  fi
+fi
 exit 0

package/payload/plugins/observatory-log/skills/explaining-changes/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   decision with different evidence.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.16.0"
+  version: "0.18.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation to persist
   records. Uses its MCP server when available in the current host; the bundled

package/payload/plugins/observatory-log/skills/handling-secrets/SKILL.md

@@ -10,7 +10,7 @@ description: >-
   provider permissions or choosing a project's authentication architecture.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.16.0"
+  version: "0.18.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation, Python 3.11+
   and local shell access on macOS or Linux. Provider operations additionally
@@ -30,7 +30,7 @@ names. Never ask the user to paste a credential into the conversation.
 2. Select the user's initialized `OBSERVATORY_HOME`. Run
    `project-observatory full doctor`. A missing workspace
    needs the documented onboarding before secret operations.
-3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.16.0`
+3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.18.0`
    (`full agent install` records that interpreter; the stock macOS `python3` is too old).
    If stale, read the installed skill once and follow its compatible commands.
    Do not turn an unavailable version check into a retry loop.
@@ -154,6 +154,16 @@ bucket's resource only. Before anything is delivered, the S3 pair must prove a
 put, a get and a delete, and must be refused a bucket list. It lands in three
 slots on stdin: `<PREFIX>_ACCESS_KEY_ID`, `<PREFIX>_SECRET_ACCESS_KEY` and
 `<PREFIX>_ENDPOINT`. A second issue rolls the same token and keeps the key id.
+The lifecycle is `--expire-days` over the whole bucket (30 when nothing else is
+given) plus one rule per repeatable `--lifecycle-rule PREFIX:DAYS`, for example
+`--lifecycle-rule staging/:2`: objects under the prefix are deleted after DAYS,
+and its unfinished multipart uploads are aborted after a day. Each run replaces
+the bucket's lifecycle with exactly that set and reads every rule back. A rule
+that could never fire is refused, such as a prefix kept longer than the
+whole-bucket rule. To change only an existing bucket's rules, run
+`cloudflare.py lifecycle --account <slug> --bucket <name> [--jurisdiction eu]
+[--expire-days N] [--lifecycle-rule PREFIX:DAYS ...]`. It mints only the setup
+token, never creates a bucket and never mints, rolls or delivers a key.
 
 An application that sends transactional email through Cloudflare Email Service
 gets `cloudflare.py issue --preset email-send --account <slug> --vault

package/payload/plugins/observatory-log/skills/tracking-resources/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   the repository.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.16.0"
+  version: "0.18.0"
 compatibility: >-
   Requires a full Project Observatory installation with organizations.json
   configured; the observatory MCP server or its local CLI. Creating the resource

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -152,16 +152,18 @@ Fabric's workspace sync, and check the published source commit before calling it
 ## 6. Licensing and the repository standard
 
 - **Every repository** is open source under the GNU AGPL-3.0, or available under a commercial
-  license from PassionCode.ai (contact@passioncode.ai):
-  `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` (Fabric ADR-0092; the knowledge base
-  `licensing.md` owns it). Copyright: Siarhei Sheleh. No price or term is stated anywhere.
+  license from PassionCode.ai — the request form https://passioncode.ai/business/, or
+  commercial@passioncode.ai: `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` (Fabric
+  ADR-0092; the knowledge base `licensing.md` owns it). Copyright: Siarhei Sheleh. No price or
+  term is stated anywhere; every commercial path points to the form. Security reports stay at
+  contact@passioncode.ai.
 - `LICENSE`, `COMMERCIAL-LICENSE.md` and `CLA.md` are copied **byte for byte** from the knowledge
   base's `templates/`; every manifest and SKILL.md `license:` carries the expression.
 - A version released earlier keeps its licence — MIT or PolyForm Noncommercial or Internal Use —
   and the README may say which. Never write that a released version changed.
 - The README's `## License` section uses the knowledge base wording and names the earlier
   licences: "Open source under the GNU AGPL-3.0. A commercial license is available for use that
-  does not meet the AGPL's terms — contact@passioncode.ai."
+  does not meet the AGPL's terms — [passioncode.ai/business](https://passioncode.ai/business/)."
 - Contributions are accepted under the repository's `CLA.md`; opening a pull request is the
   agreement, so a PR template never carries a CLA checkbox.
 - **The repository standard** (the knowledge base `repository-standard.md`): README first heading

package/payload/plugins/passioncode/skills/working-in-passioncode/references/publishing.md

@@ -14,7 +14,7 @@ change to a license, a manifest's `license` field, `CLA.md` or a PR template.
 ## The license, file by file
 
 Every repository is open source under the GNU AGPL-3.0, or available under a commercial
-license from PassionCode.ai (contact@passioncode.ai): SPDX
+license from PassionCode.ai (https://passioncode.ai/business/, commercial@passioncode.ai): SPDX
 `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` (Fabric ADR-0092). The owning page is the
 knowledge base's `licensing.md`; the file list is its `repository-standard.md`, and org-index
 `scripts/check_format.py` (rules F7–F11) checks it. The three licence files are **copied byte
@@ -47,14 +47,15 @@ for byte** from the knowledge base's `templates/` — never retyped, reflowed or
   ## License
 
   Open source under the [GNU AGPL-3.0](LICENSE). A [commercial license](COMMERCIAL-LICENSE.md) is
-  available for use that does not meet the AGPL's terms — contact@passioncode.ai.
+  available for use that does not meet the AGPL's terms — [passioncode.ai/business](https://passioncode.ai/business/).
   Versions before <first AGPL version> were released under <MIT | PolyForm Noncommercial or Internal Use>.
   ```
 
 - "Source-available" and the PolyForm expression describe past releases only; never state
   them as the current licence.
 - No price or term for the commercial licence is stated anywhere; point to
-  contact@passioncode.ai.
+  https://passioncode.ai/business/ (commercial@passioncode.ai is the commercial contact). Security
+  reports stay at contact@passioncode.ai.
 - Positioning and names come from the knowledge base (`vision.md`, `principles.md` §2); do not
   restate a tagline from memory.