@passioncode-ai/passioncode 0.1.29 → 0.1.30

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.3"
+  version: "0.8.0"
   contract-version: "0.1.0"
-  contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
+  contract-commit: "23f9fda4c05f8a3852246ee98d4f2adf74ed0875"
 ---
 
 # Creating Fabric-compatible agents
@@ -119,12 +119,16 @@ python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/adapt_project.py
   --schema-base <immutable-base-uri>
 ```
 
-Pin exactly contract `0.1.0` at commit `2ce392291c6668598d12cd38327e24696b5ca15c` and
+Pin exactly contract `0.1.0` at commit `23f9fda4c05f8a3852246ee98d4f2adf74ed0875` and
 read the pinned guide before implementing protocol details. If this skill is installed
 without its sibling, the scaffolder is absent: create the bundle by hand from the pinned
 contract's `docs/guides/connecting-compatible-agents.md` and mark the structural check
 `NOT_RUN` — do not reconstruct normative rules from memory.
 
+This default accepts underscore capability names; a declared communications name does
+not grant COM access or prove runtime admission. Existing bundles retain their explicit
+supported revision and require its exact checkout; never silently migrate their lock.
+
 The generated placeholders are deliberate blockers; a bundle still containing one is not
 ready for admission.
 

package/payload/plugins/observatory-log/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "observatory-log",
   "displayName": "Observatory Log",
   "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "license": "AGPL-3.0-only OR LicenseRef-PassionCode-Commercial",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/observatory-log/hooks/session-start.sh

@@ -47,17 +47,28 @@ fi
 # rate-limited, so a session never waits for it and never fails because of it.
 stamps="${XDG_STATE_HOME:-$HOME/.local/state}/project-observatory"
 mkdir -p "$stamps" 2>/dev/null && chmod 700 "$stamps" 2>/dev/null
-# claim NAME SECONDS: true for exactly one caller per window. `mkdir` is atomic, so twenty
-# sessions starting at once start one job, not twenty (review F6).
+# claim NAME SECONDS: true for exactly one caller per window. The check and the stamp happen
+# under one exclusive lock, so twenty sessions starting at once start one job, not twenty —
+# also when the previous window has just expired (audit A20).
 claim() {
-  local lock="$stamps/$1.claim" then now
-  if ! mkdir "$lock" 2>/dev/null; then
-    then="$(stat -c %Y "$lock" 2>/dev/null || stat -f %m "$lock" 2>/dev/null || echo 0)"
-    now="$(date +%s)"
-    [ $((now - then)) -ge "$2" ] || return 1
-    rmdir "$lock" 2>/dev/null; mkdir "$lock" 2>/dev/null || return 1
-  fi
-  return 0
+  "$py" - "$stamps/$1.at" "$2" <<'PYCLAIM' 2>/dev/null
+import fcntl, os, sys, time
+path, window = sys.argv[1], int(sys.argv[2])
+fd = os.open(path + ".lock", os.O_CREAT | os.O_RDWR, 0o600)
+try:
+    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+except BlockingIOError:
+    sys.exit(1)
+try:
+    last = os.stat(path).st_mtime
+except OSError:
+    last = 0
+if time.time() - last < window:
+    sys.exit(1)
+with open(path, "a"):
+    pass
+os.utime(path, None)
+PYCLAIM
 }
 # detach LOG CMD...: a new session of its own, so ending this session or its process group
 # cannot stop an install half-way (review F8).
@@ -93,7 +104,10 @@ print(1 if (d.get(\"updates\") or {}).get(\"auto\") is False else 0)" "$home/con
       "$po" full update --check >/dev/null 2>&1; rc=$?
       echo "$(date -u +%FT%TZ) check exit $rc"
       [ "$rc" = "10" ] || exit 0
-      "$po" full update --apply; echo "$(date -u +%FT%TZ) apply exit $?"
+      # No launchd (Linux): nothing for the update to stop, and saying so lets it run (A02).
+      if command -v launchctl >/dev/null 2>&1; then "$po" full update --apply
+      else "$po" full update --apply --writers-stopped; fi
+      echo "$(date -u +%FT%TZ) apply exit $?"
     ' _ "$po" "$py"
   fi
 fi

package/payload/plugins/observatory-log/skills/explaining-changes/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   decision with different evidence.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.17.3"
+  version: "0.18.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation to persist
   records. Uses its MCP server when available in the current host; the bundled

package/payload/plugins/observatory-log/skills/handling-secrets/SKILL.md

@@ -10,7 +10,7 @@ description: >-
   provider permissions or choosing a project's authentication architecture.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.17.3"
+  version: "0.18.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation, Python 3.11+
   and local shell access on macOS or Linux. Provider operations additionally
@@ -30,7 +30,7 @@ names. Never ask the user to paste a credential into the conversation.
 2. Select the user's initialized `OBSERVATORY_HOME`. Run
    `project-observatory full doctor`. A missing workspace
    needs the documented onboarding before secret operations.
-3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.17.3`
+3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.18.0`
    (`full agent install` records that interpreter; the stock macOS `python3` is too old).
    If stale, read the installed skill once and follow its compatible commands.
    Do not turn an unavailable version check into a retry loop.

package/payload/plugins/observatory-log/skills/tracking-resources/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   the repository.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.17.3"
+  version: "0.18.0"
 compatibility: >-
   Requires a full Project Observatory installation with organizations.json
   configured; the observatory MCP server or its local CLI. Creating the resource

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",