create-agentic-workspace 0.9.0 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.9.0",
+    "plugin_version": "1.10.0",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.9.0",
+  "generated_for_plugin_version": "1.10.0",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
@@ -268,6 +268,11 @@
       "tier": "allow",
       "rationale": "read-only programme resolution + ready-set/idle/wake derivation; writes nothing (asserted byte-level over a whole fixture tree by AC-CDW-6) and issues no merge, dispatch, or authorization. NOT write-free means side-effect-free: via foundry_release it runs read-only git plumbing (log/rev-parse) in a repo dir, and it exec_module's the in-tree wave planner. Manifest-named spec_ref/contract_ref are confinement-checked BEFORE any derivation. NOT covered: the dir git runs in comes from the contract's own target_repo via _resolve_repo, whose unrecognized-key fallback can leave the corpus - pre-existing shipped behaviour, reached only through an already-confined, authorized contract"
     },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_command_deck_watch.py:*)",
+      "tier": "allow",
+      "rationale": "the command-deck watcher lifecycle: renders the tick prompt and keeps the watcher record. Reads are the read-only derivation it delegates to foundry_command_deck.py (same reach, same confinement). WRITES EXACTLY ONE PATH SHAPE: .foundry/watchers/<programme>.json under the project dir, where <programme> is re-checked against a [a-z0-9-]+ fullmatch BEFORE any path join, so a traversing or absolute identifier cannot reach os.path.join at all; forget removes only that same path. The record is inert data - no derivation reads it, it grants nothing and gates nothing. Manifest-derived text reaching the rendered prompt is passed through the shipped as_data sanitiser. NOT covered: it inherits foundry_command_deck.py's own pre-existing target_repo git-dir reach, unchanged by this script"
+    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_release.py accept:*)",
       "tier": "ask",

package/src/pluginRefresh.mjs

@@ -201,13 +201,40 @@ export function migrationActions(trigger, { scope, marketplaceName, marketplaceR
  * `before` carried survives with its ORIGINAL value except `extraKnownMarketplaces` — the one key
  * the migration exists to change — and `enabledPlugins` is unconditionally guaranteed to still name
  * the plugin, regardless of what either side carried. */
-export function repairScopeSettings(before, after, pluginKey) {
+/** ALLOWLIST, not "everything except `source`". The migration replaces the whole registration
+ * entry, and Claude Code publishes no schema for what may live in it — so a skip-`source` denylist
+ * carries an UNKNOWN key forward by default, and the dangerous shape is a second pin-like key. The
+ * shipped `claude` binary carries `ref`, `commit`, `scope` and `lastUpdated` strings in marketplace
+ * context: restoring a stale `commit` would be pin resurrection under a different name, defeating
+ * the very migration this repair serves. So the carry-forward set is enumerated, and a key nobody
+ * anticipated is DROPPED rather than restored — the platform re-adds what it still wants. Adding a
+ * key here is a deliberate one-line decision with this paragraph attached. */
+const CARRY_FORWARD = ['autoUpdate'];
+
+export function repairScopeSettings(before, after, pluginKey, marketplaceName) {
   const repaired = { ...after };
   for (const key of Object.keys(before)) {
     if (key === 'extraKnownMarketplaces') continue;
     repaired[key] = before[key];
   }
   repaired.enabledPlugins = { ...(repaired.enabledPlugins || {}), [pluginKey]: true };
+
+  // `!Array.isArray` on both sides: `typeof [] === 'object'`, so an array in this slot would merge
+  // its INDICES in as keys (`{"0": "...", source: {...}}`). Only a plain object is a registration.
+  const isEntry = (v) => v && typeof v === 'object' && !Array.isArray(v);
+  const beforeEntry = (before || {}).extraKnownMarketplaces?.[marketplaceName];
+  const afterEntry = repaired.extraKnownMarketplaces?.[marketplaceName];
+  if (isEntry(beforeEntry) && isEntry(afterEntry)) {
+    const merged = { ...afterEntry };
+    for (const key of CARRY_FORWARD) {
+      if (!Object.prototype.hasOwnProperty.call(beforeEntry, key)) continue;
+      // hasOwnProperty.call, NOT `key in merged`: `in` is true for INHERITED names, so a key
+      // literally called `toString` / `constructor` would read as "the platform already declared
+      // it" and be skipped. Own-property is the question actually being asked.
+      if (!Object.prototype.hasOwnProperty.call(merged, key)) merged[key] = beforeEntry[key];
+    }
+    repaired.extraKnownMarketplaces = { ...repaired.extraKnownMarketplaces, [marketplaceName]: merged };
+  }
   return repaired;
 }
 
@@ -236,7 +263,7 @@ export function migrateScope({ scopeSnap, trigger, marketplaceName, marketplaceR
   }
   if (fs.existsSync(scopeSnap.settingsPath)) {
     const after = readScopeSettings(scopeSnap).obj;
-    const repaired = repairScopeSettings(scopeSnap.obj, after, pluginKey);
+    const repaired = repairScopeSettings(scopeSnap.obj, after, pluginKey, marketplaceName);
     writeTargetAtomically(scopeSnap.settingsPath, repaired);
   }
   if (caught) throw caught;