agentbundle 0.12.0__tar.gz → 0.12.1__tar.gz

{agentbundle-0.12.0 → agentbundle-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.12.0
+Version: 0.12.1
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/commands/_common.py

@@ -40,6 +40,17 @@ def resolve_catalogue_uri(args: "argparse.Namespace") -> str:
     )
 
 
+def resolve_state_path(scope: str, root: Path) -> Path:
+    """Return the state-file path for *scope* under *root*.
+
+    ``scope="repo"`` → ``<root>/.agentbundle-state.toml``
+    ``scope="user"`` → ``<root>/.agentbundle/state.toml``
+    """
+    if scope == "user":
+        return root / ".agentbundle" / "state.toml"
+    return root / ".agentbundle-state.toml"
+
+
 class SeedDelivery(NamedTuple):
     """One seed file's delivery outcome, returned by ``deliver_seeds``.
 
@@ -77,44 +88,20 @@ def _compose_agents_md_bytes(body: bytes, footer_path: Path) -> bytes:
     return (text + footer).encode("utf-8")
 
 
-def deliver_seeds(seeds_dir: Path, output: Path) -> list[SeedDelivery]:
-    """Deliver a pack's ``seeds/`` into ``output`` with Tier-1/2/3 safety.
-
-    For each file under ``seeds_dir`` (recursively):
-      - **Composition fragments** (name starts with ``_``, e.g.
-        ``_agents-footer.md``) are *not* delivered standalone — they are folded
-        into ``AGENTS.md`` instead (per ``CONVENTIONS.md`` §Pack source-of-truth split).
-      - **Absent on disk** → write the seed (Tier-1).
-      - **Present, content matches** → no-op (already in sync).
-      - **Present, content differs** → write a ``*.upstream.<ext>`` companion
-        next to the original; leave the original untouched (Tier-2).
-
-    Every write routes through ``safety.write_jailed`` / ``safety.write_companion``
-    with the **bare under-root jail** (no ``allowed_prefixes`` — seeds land at the
-    repo root and ``docs/``, outside the adapter projection prefixes). The caller
-    decides whether to record state; this helper never writes ``.agentbundle-state.toml``.
+def _classify_seeds(seeds_dir: Path, root: Path) -> list[SeedDelivery]:
+    """Classify seeds without writing — pure read-only; same walk logic as deliver_seeds.
 
-    Raises ``safety.PathJailError`` if any seed relpath would escape ``output``;
-    the caller is expected to catch it, print to stderr, and exit 1.
+    Returns a list of SeedDelivery records with action 'wrote' (absent on disk),
+    'skipped' (byte-identical), or 'companion' (differs — Tier-2). No filesystem
+    writes occur under root.
     """
     import os
 
     from agentbundle import safety
 
     footer_path = seeds_dir / "_agents-footer.md"
-    # Guard the footer read too — ``_compose_agents_md_bytes`` reads
-    # ``footer_path`` directly, so a symlinked footer would be read through.
     footer_ok = footer_path.is_file() and not footer_path.is_symlink()
 
-    # Defence-in-depth against a malicious pack exfiltrating a host file
-    # (``/etc/passwd``, ``~/.ssh/id_rsa``) into the adopter tree by symlinking
-    # a seed — never read *through* a pack-shipped symlink. We must not rely on
-    # ``Path.rglob``'s symlink posture: on Python 3.11/3.12 ``rglob`` recurses
-    # *into* symlinked directories (3.13 changed the default to
-    # ``recurse_symlinks=False``), so ``seeds/x -> /`` would surface real host
-    # files as non-symlink entries. ``os.walk(followlinks=False)`` never
-    # descends into a symlinked directory on any supported Python, and we also
-    # skip symlinked files — closing both the file and directory cases.
     seed_files: list[Path] = []
     for dirpath, _dirnames, filenames in os.walk(seeds_dir, followlinks=False):
         for fname in filenames:
@@ -125,7 +112,6 @@ def deliver_seeds(seeds_dir: Path, output: Path) -> list[SeedDelivery]:
 
     results: list[SeedDelivery] = []
     for seed_file in sorted(seed_files):
-        # Composition fragments are folded in, never delivered standalone.
         if seed_file.name.startswith("_"):
             continue
         relpath = seed_file.relative_to(seeds_dir).as_posix()
@@ -133,19 +119,49 @@ def deliver_seeds(seeds_dir: Path, output: Path) -> list[SeedDelivery]:
         if relpath == "AGENTS.md" and footer_ok:
             content = _compose_agents_md_bytes(content, footer_path)
 
-        on_disk = output / relpath
+        on_disk = root / relpath
         if not on_disk.exists():
-            safety.write_jailed(output, relpath, content)
             results.append(SeedDelivery(relpath, content, "wrote", None))
         elif on_disk.read_bytes() == content:
             results.append(SeedDelivery(relpath, content, "skipped", None))
         else:
-            safety.write_companion(output, relpath, content)
             companion = safety.companion_path(Path(relpath)).as_posix()
             results.append(SeedDelivery(relpath, content, "companion", companion))
     return results
 
 
+def deliver_seeds(seeds_dir: Path, output: Path) -> list[SeedDelivery]:
+    """Deliver a pack's ``seeds/`` into ``output`` with Tier-1/2/3 safety.
+
+    For each file under ``seeds_dir`` (recursively):
+      - **Composition fragments** (name starts with ``_``, e.g.
+        ``_agents-footer.md``) are *not* delivered standalone — they are folded
+        into ``AGENTS.md`` instead (per ``CONVENTIONS.md`` §Pack source-of-truth split).
+      - **Absent on disk** → write the seed (Tier-1).
+      - **Present, content matches** → no-op (already in sync).
+      - **Present, content differs** → write a ``*.upstream.<ext>`` companion
+        next to the original; leave the original untouched (Tier-2).
+
+    Every write routes through ``safety.write_jailed`` / ``safety.write_companion``
+    with the **bare under-root jail** (no ``allowed_prefixes`` — seeds land at the
+    repo root and ``docs/``, outside the adapter projection prefixes). The caller
+    decides whether to record state; this helper never writes ``.agentbundle-state.toml``.
+
+    Raises ``safety.PathJailError`` if any seed relpath would escape ``output``;
+    the caller is expected to catch it, print to stderr, and exit 1.
+    """
+    from agentbundle import safety
+
+    records = _classify_seeds(seeds_dir, output)
+    for record in records:
+        if record.action == "wrote":
+            safety.write_jailed(output, record.relpath, record.content)
+        elif record.action == "companion":
+            safety.write_companion(output, record.relpath, record.content)
+        # "skipped" → no-op
+    return records
+
+
 def check_spec_version_gate(pack_toml: dict[str, Any]) -> int | None:
     """Refuse if the pack's declared spec major version differs from ours.
 

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/commands/diff.py

@@ -22,7 +22,7 @@ import sys
 from pathlib import Path
 
 from agentbundle import render, safety
-from agentbundle.commands._common import check_spec_version_gate
+from agentbundle.commands._common import check_spec_version_gate, resolve_state_path
 from agentbundle.config import ConfigError, load_pack_toml
 
 
@@ -57,7 +57,7 @@ def run(args: argparse.Namespace) -> int:
         # hard cross-version refusal); surface it as a clean refuse rather
         # than a traceback.
         try:
-            repo_state_for_check = load_state(root / ".agentbundle-state.toml")
+            repo_state_for_check = load_state(resolve_state_path("repo", root))
         except ConfigError as exc:
             print(f"diff: {exc}", file=sys.stderr)
             return 1
@@ -65,7 +65,7 @@ def run(args: argparse.Namespace) -> int:
         try:
             user_root_resolved = scope_mod.resolve_user_root()
             user_state_for_check = load_state(
-                user_root_resolved / ".agentbundle" / "state.toml"
+                resolve_state_path("user", user_root_resolved)
             )
             installed_at_user = user_state_for_check.has_pack(pack_name)
         except scope_mod.UserScopeUnresolvable:

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/commands/install.py

@@ -892,30 +892,13 @@ def run(args: "argparse.Namespace") -> int:
         projection = repo_projection if plan.scope == "repo" else user_projection
         if projection is None:
             continue
-        for relpath in projection.keys():
-            target = plan.root / relpath
-            try:
-                safety.assert_under(plan.root, target)
-            except safety.PathJailError as exc:
-                print(f"install: {exc}", file=sys.stderr)
-                return 1
-            # Per-prefix probe fires whenever the plan has an
-            # allowed_prefixes list (user scope always; repo scope when
-            # the per-IDE path is in use — RFC-0012). With
-            # `allowed_prefixes=None` the probe is skipped (legacy
-            # dist-tree producer at repo scope under
-            # --emit-install-routes).
-            if plan.allowed_prefixes is not None:
-                target_relpath = target.resolve().relative_to(plan.root.resolve()).as_posix()
-                prefixes = plan.allowed_prefixes or []
-                # Directory-boundary matching only — see safety.py.
-                if not any(target_relpath.startswith(p) for p in prefixes):
-                    print(
-                        f"install: refusing to write outside allowed prefixes "
-                        f"for scope {plan.scope!r}: {target.resolve()}",
-                        file=sys.stderr,
-                    )
-                    return 1
+        try:
+            safety.assert_projection_jailed(
+                plan.root, projection.keys(), plan.allowed_prefixes, command="install"
+            )
+        except safety.PathJailError as exc:
+            print(str(exc), file=sys.stderr)
+            return 1
 
     # ── Dry-run: all read-only pre-flight passed — preview and stop ───────────
     # At the top of Step 9 (after Step 8's path-jail probe) so every pre-flight
@@ -927,6 +910,8 @@ def run(args: "argparse.Namespace") -> int:
     # recap). `--force` is refused up front, so there is exactly one writing
     # plan here (dual-scope writes arise only under --force).
     if dry_run:
+        from agentbundle.commands._common import _classify_seeds
+
         actions: list[str] = []
         for plan in plans:
             if plan.already_installed:
@@ -946,6 +931,21 @@ def run(args: "argparse.Namespace") -> int:
                 )
                 print(format_plan_line(action, tier.value, relpath, companion))
                 actions.append(action)
+            if plan.scope == "repo":
+                seeds_dir = pack_dir / "seeds"
+                if seeds_dir.is_dir():
+                    for record in _classify_seeds(seeds_dir, plan.root):
+                        if record.action == "skipped":
+                            continue
+                        verb = "create" if record.action == "wrote" else "companion"
+                        tier_str = "tier-1" if record.action == "wrote" else "tier-2"
+                        path_str = (
+                            record.relpath
+                            if record.action == "wrote"
+                            else f"{record.relpath} -> {record.companion_relpath}"
+                        )
+                        print(format_plan_line(verb, tier_str, path_str))
+                        actions.append(verb)
         print(summarize_plan(actions))
         return 0
 

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/commands/uninstall.py

@@ -46,12 +46,13 @@ def run(args: "argparse.Namespace") -> int:
     """
     from agentbundle.config import ConfigError, dump_state, load_state
     from agentbundle import safety
+    from agentbundle.commands._common import resolve_state_path
 
     pack_name: str = args.pack
     cli_scope: str | None = getattr(args, "scope", None)
     cli_adapter: str | None = getattr(args, "adapter", None)
     root = Path(args.root).resolve()
-    state_path = root / ".agentbundle-state.toml"
+    state_path = resolve_state_path("repo", root)
 
     # ── Step 1: Multi-scope disambiguator (RFC-0004) ──────────────────────────
     # If the pack is at both repo and user scopes, --scope is required.
@@ -72,7 +73,7 @@ def run(args: "argparse.Namespace") -> int:
     user_state_for_check = None
     try:
         user_root = scope_mod.resolve_user_root()
-        user_state_path = user_root / ".agentbundle" / "state.toml"
+        user_state_path = resolve_state_path("user", user_root)
         user_state_for_check = load_state(user_state_path)
         installed_at_user = user_state_for_check.has_pack(pack_name)
     except scope_mod.UserScopeUnresolvable:

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/commands/upgrade.py

@@ -79,6 +79,7 @@ def run(args: "argparse.Namespace") -> int:
         format_plan_line,
         plan_action,
         resolve_catalogue_uri,
+        resolve_state_path,
         summarize_plan,
     )
     from agentbundle.config import (
@@ -115,7 +116,7 @@ def run(args: "argparse.Namespace") -> int:
     # If the pack is at both scopes, --scope is required; at one scope, infer.
     from agentbundle import scope as scope_mod
 
-    repo_state_path = root / ".agentbundle-state.toml"
+    repo_state_path = resolve_state_path("repo", root)
     # A legacy (non-v0.4) state file is refused on read too (RFC-0052);
     # surface it as a clean refuse rather than a traceback.
     try:
@@ -129,7 +130,7 @@ def run(args: "argparse.Namespace") -> int:
     user_state_for_check = None
     try:
         user_root_resolved = scope_mod.resolve_user_root()
-        user_state_path = user_root_resolved / ".agentbundle" / "state.toml"
+        user_state_path = resolve_state_path("user", user_root_resolved)
         user_state_for_check = load_state(user_state_path)
         installed_at_user = user_state_for_check.has_pack(pack_name)
     except scope_mod.UserScopeUnresolvable:
@@ -248,7 +249,7 @@ def run(args: "argparse.Namespace") -> int:
     if effective_scope == "user":
         state_path = user_state_path  # already resolved above
     else:
-        state_path = root / ".agentbundle-state.toml"
+        state_path = resolve_state_path("repo", root)
     try:
         state = load_state(state_path, for_write=True)
     except ConfigError as exc:
@@ -541,24 +542,13 @@ def run(args: "argparse.Namespace") -> int:
         # the print loop (probe-all-then-print): a jail violation on a late file
         # aborts with a clean stderr refusal instead of a partial plan already
         # on stdout.
-        for relpath in sorted(work_projection):
-            target = root / relpath
-            try:
-                safety.assert_under(root, target)
-            except safety.PathJailError as exc:
-                print(f"upgrade: {exc}", file=sys.stderr)
-                return 1
-            if allowed_prefixes is not None:
-                target_relpath = (
-                    target.resolve().relative_to(root.resolve()).as_posix()
-                )
-                if not any(target_relpath.startswith(p) for p in allowed_prefixes):
-                    print(
-                        f"upgrade: refusing to write outside allowed prefixes "
-                        f"for scope {effective_scope!r}: {target.resolve()}",
-                        file=sys.stderr,
-                    )
-                    return 1
+        try:
+            safety.assert_projection_jailed(
+                root, sorted(work_projection), allowed_prefixes, command="upgrade"
+            )
+        except safety.PathJailError as exc:
+            print(str(exc), file=sys.stderr)
+            return 1
         actions: list[str] = []
         for relpath in sorted(work_projection):
             tier = safety.classify(relpath, root, state)
@@ -575,6 +565,20 @@ def run(args: "argparse.Namespace") -> int:
         print(summarize_plan(actions))
         return 0
 
+    # ── Path-jail pre-flight (AC4) — probe all before any write ──────────────
+    # Mirror the dry-run probe: refuse if any projected path escapes root or
+    # violates allowed_prefixes, before touching disk. Without this gate a
+    # prefix violation surfaces mid-loop via write_jailed, after earlier files
+    # have already been written — the probe-all-before-write contract means a
+    # violation is always a clean abort.
+    try:
+        safety.assert_projection_jailed(
+            root, sorted(work_projection), allowed_prefixes, command="upgrade"
+        )
+    except safety.PathJailError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
     # ── Walk projection; apply Tier contract ──────────────────────────────────
     # Collect `.upstream.<ext>` companions dropped this run so we can surface
     # them after the walk. Without this notice the upgrade is silent on a

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/safety.py

@@ -162,6 +162,33 @@ def assert_under(root: Path, target: Path) -> None:
         ) from exc
 
 
+def assert_projection_jailed(
+    root: Path,
+    relpaths: "Iterable[str]",
+    allowed_prefixes: "list[str] | None",
+    *,
+    command: str,
+) -> None:
+    """Raise PathJailError if any relpath escapes root or violates allowed_prefixes.
+
+    When allowed_prefixes is None, only root-escape is checked.
+    root must be an absolute resolved Path.
+    The command parameter is prefixed on all PathJailError messages raised.
+    """
+    for relpath in relpaths:
+        target = root / relpath
+        try:
+            assert_under(root, target)
+        except PathJailError as exc:
+            raise PathJailError(f"{command}: {exc}") from exc
+        if allowed_prefixes is not None:
+            target_relpath = target.resolve().relative_to(root.resolve()).as_posix()
+            if not any(target_relpath.startswith(p) for p in allowed_prefixes):
+                raise PathJailError(
+                    f"{command}: path {relpath!r} is not within any declared prefix zone"
+                )
+
+
 # ---------------------------------------------------------------------------
 # Windows-portability guard
 # ---------------------------------------------------------------------------
@@ -320,31 +347,20 @@ def write_jailed(
     assert_under(root, target)
 
     if allowed_prefixes is not None:
-        # Check the resolved target is under one of the declared
-        # prefixes relative to root. Use directory-boundary matching:
-        # the prefix's trailing slash is mandatory, so ``.claude/``
-        # admits ``.claude/skills/foo`` but rejects a top-level
-        # ``.claude`` file (which would otherwise let a pack replace
-        # the directory with a file).
-        prefixes = allowed_prefixes
-        # Defense-in-depth: the adapter contract schema enforces a
-        # trailing slash on every `allowed-prefixes` entry; assert it
-        # at runtime so a future caller that bypasses the schema
-        # (e.g. constructing the list in code) cannot silently widen
-        # the jail. A `.claude` (no slash) prefix would otherwise
-        # admit `.claudefoo` — exactly the bug the equality-clause
-        # removal was meant to fix.
-        if not all(p.endswith("/") for p in prefixes):
+        # Defense-in-depth: the adapter contract schema enforces a trailing
+        # slash on every `allowed-prefixes` entry; assert it at runtime so a
+        # future caller that bypasses the schema (e.g. constructing the list in
+        # code) cannot silently widen the jail. A `.claude` (no slash) prefix
+        # would otherwise admit `.claudefoo` — exactly the bug the
+        # equality-clause removal was meant to fix.
+        if not all(p.endswith("/") for p in allowed_prefixes):
             raise PathJailError(
                 f"refusing to write at scope {scope!r}: allowed_prefixes "
-                f"must each end with '/'; got {prefixes!r}"
-            )
-        target_relpath = target.resolve().relative_to(root.resolve()).as_posix()
-        if not any(target_relpath.startswith(p) for p in prefixes):
-            raise PathJailError(
-                f"refusing to write outside allowed prefixes for scope "
-                f"{scope!r}: {target.resolve()}"
+                f"must each end with '/'; got {allowed_prefixes!r}"
             )
+        assert_projection_jailed(
+            root, [relpath], allowed_prefixes, command=f"scope={scope}"
+        )
     try:
         target.parent.mkdir(parents=True, exist_ok=True)
     except OSError as exc:

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle/version.py

@@ -14,7 +14,7 @@ import tomllib
 from importlib.resources import files
 from pathlib import Path
 
-CLI_VERSION = "0.12.0"
+CLI_VERSION = "0.12.1"
 
 _HERE = Path(__file__).resolve().parent
 

{agentbundle-0.12.0 → agentbundle-0.12.1}/agentbundle.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.12.0
+Version: 0.12.1
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT

{agentbundle-0.12.0 → agentbundle-0.12.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentbundle"
-version = "0.12.0"
+version = "0.12.1"
 description = "npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent."
 requires-python = ">=3.11"
 dependencies = []