agentbundle 0.12.1__tar.gz → 0.17.0__tar.gz

{agentbundle-0.12.1 → agentbundle-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.12.1
+Version: 0.17.0
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT
@@ -15,6 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
+Provides-Extra: lint
+Requires-Dist: pyyaml>=6.0; extra == "lint"
 
 # agentbundle
 
@@ -64,6 +66,8 @@ agentbundle show core --format json          # stable object for scripts/agents
 agentbundle list-installed
 agentbundle list-installed --no-check       # skip the catalogue check (offline, fast)
 agentbundle list-installed --check-drift    # also count locally edited files
+agentbundle list-installed --format json    # machine-readable JSON (schema_version 1)
+agentbundle list-installed --updates-only   # show only rows needing attention
 
 # Install a whole curated profile — a single-scope set of packs — in one command
 agentbundle install --profile inception
@@ -80,7 +84,7 @@ agentbundle uninstall --pack core --dry-run
 agentbundle uninstall --pack core --yes
 ```
 
-**`list-installed`** reads your state files (not the catalogue) and reports every installed `(pack, adapter)` at each scope with its version and an `up-to-date` / `upgrade-available` / `unknown` status; it degrades to `unknown` (never an error) when the catalogue can't be resolved, and `--no-check` skips the check entirely.
+**`list-installed`** reads your state files (not the catalogue) and reports every installed `(pack, adapter)` at each scope with its version and a four-value status — `up-to-date`, `upgrade-available`, `ahead` (installed version is newer than catalogue), or `unknown`; it degrades to `unknown` (never an error) when the catalogue can't be resolved, and `--no-check` skips the check entirely. `--format json` emits a stable JSON contract (`schema_version: 1`) to stdout — useful for CI automation of upgrade decisions. `--updates-only` hides `up-to-date` rows.
 
 **`show <pack>`** answers "what skills and agents does this pack contain?" by walking the pack's source tree live on each call — so the answer can't drift, and nothing is persisted. `--format json` emits a stable object (`name`, `version`, `description`, `skills`, `agents`, `source`) for scripts and agents. When the catalogue can't be resolved, an *installed* pack still reports its inventory from your state files (marked `source: installed-state`); a not-installed pack errors.
 
@@ -88,6 +92,90 @@ A **profile** is a catalogue-curated, single-scope set of packs you install in o
 
 **Mutating commands ask first.** `uninstall`, the `--force` cleanup, and the upgrade offer all preview what they'll do and confirm before touching anything; `--dry-run` previews without writing, and `--yes` skips the prompt for non-interactive / CI use (where, without it, they refuse rather than hang).
 
+## Enterprise distribution
+
+For organizations running an internal Artifactory mirror or any static HTTPS server,
+agentbundle's enterprise distribution capabilities handle the full adoption loop —
+from org-wide channel configuration to CI-driven bulk upgrades.
+
+**Install from an internal Artifactory channel:**
+
+```bash
+# Point agentbundle at your org's channel descriptor (one-time per machine,
+# or pre-configured in your org fork — see Org bootstrap below)
+agentbundle config set source catalogue+https://artifactory.example.test/agentbundle/catalogues/core/channels/stable.json
+
+agentbundle install --pack core
+```
+
+The channel descriptor points to an immutable versioned archive; agentbundle
+fetches, verifies its SHA-256 digest, and installs. Pass a bearer token via
+`AGENTBUNDLE_HTTP_BEARER_TOKEN` — it is never stored in state, never printed, and
+never forwarded to a different host.
+
+**JSON output for CI pipelines:**
+
+```bash
+# See what's installed and what needs upgrading — machine-readable
+agentbundle list-installed --format json
+agentbundle list-installed --format json --updates-only
+```
+
+Returns a stable JSON contract (`schema_version` 1) with per-row status
+(`up-to-date` / `upgrade-available` / `ahead` / `unknown`) and machine-readable
+reason codes for unknown rows. Pipe into `jq` or your CI annotation step.
+
+**Bulk upgrade in one scoped command:**
+
+```bash
+# Upgrade all installed packs in a scope — preflights before any write
+agentbundle upgrade --all --scope repo --yes
+agentbundle upgrade --all --scope user --format json --yes
+```
+
+Preflights all rows before writing anything; a blocked row stops the run before the
+filesystem is touched. Partial failure is reported honestly — not described as a
+rollback. Never silently downgrades an `ahead` row.
+
+**Package your catalogue for Artifactory:**
+
+```bash
+agentbundle package-catalogue \
+  --root /path/to/catalogue \
+  --bundle my-packs \
+  --release 1.0.0 \
+  --channel stable \
+  --output dist/
+```
+
+Produces a deterministic, reproducible gzip archive (versioned) and a mutable channel
+descriptor JSON (`stable.json`), ready to upload to Artifactory. Identical inputs
+produce byte-identical archives (honors `SOURCE_DATE_EPOCH`).
+
+**Org bootstrap — ship the default channel in your fork:**
+
+Add an `[organization.artifactory]` block to
+`agentbundle/_data/install-defaults.toml` in your org's agentbundle fork:
+
+```toml
+[organization.artifactory]
+enabled = true
+base-url = "https://artifactory.example.test"
+repository = "agentbundle"
+bundle = "core"
+channel = "stable"
+```
+
+Developers installing from your fork get the internal channel without a manual
+`config set source` step. The block ships `enabled = false` in the public package.
+A malformed `enabled = true` config fails closed — no silent fallback to the public
+source.
+
+See the full enterprise adoption guide at
+`docs/guides/_shared/how-to/use-an-artifactory-catalogue.md` for all six flows
+(org bootstrap, repo-scope CI upgrade, user-scope MDM, source-conflict remediation,
+disconnected hosts, and security controls).
+
 ## Build your own catalogue
 
 `agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it. A pack is a directory:
@@ -120,6 +208,34 @@ is deliberately lossy per tool.
 
 Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
 
+**Org adapter default:** If your org ships a private `agentbundle` wheel (or a fork pinned to your internal catalogue), you can set a default adapter for all developers without requiring them to run `agentbundle config set` or pass `--adapter` on every install. Add an `[organization]` table to `_data/install-defaults.toml` in your fork:
+
+```toml
+[organization]
+preferred_adapter = "cursor"
+```
+
+The org hint fires after the user-config but before the on-disk IDE probe — so `--adapter`, user-config, and upgrade state-hints all take priority. An invalid value exits 1 before writing anything. See the [`agentbundle` reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/reference/agentbundle.md#org-adapter-default) for the full cascade.
+
+**Lint your catalogue** — shallow structural checks run without extra dependencies:
+
+```bash
+agentbundle catalogue lint --root .
+```
+
+For full [agentskills.io spec](https://agentskills.io/specification) compliance (frontmatter key set, description policy, encoding, evals schema), install the `lint` extra and run with `--deep`:
+
+```bash
+pip install 'agentbundle[lint]'
+agentbundle catalogue lint --root . --deep
+```
+
+**Run Tier-A activation evals** to measure whether each covered skill fires on the prompts it should:
+
+```bash
+agentbundle pack evals run --pack <pack-name> --catalogue-root .
+```
+
 See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
 
 ## Credentials

{agentbundle-0.12.1 → agentbundle-0.17.0}/README.md

@@ -46,6 +46,8 @@ agentbundle show core --format json          # stable object for scripts/agents
 agentbundle list-installed
 agentbundle list-installed --no-check       # skip the catalogue check (offline, fast)
 agentbundle list-installed --check-drift    # also count locally edited files
+agentbundle list-installed --format json    # machine-readable JSON (schema_version 1)
+agentbundle list-installed --updates-only   # show only rows needing attention
 
 # Install a whole curated profile — a single-scope set of packs — in one command
 agentbundle install --profile inception
@@ -62,7 +64,7 @@ agentbundle uninstall --pack core --dry-run
 agentbundle uninstall --pack core --yes
 ```
 
-**`list-installed`** reads your state files (not the catalogue) and reports every installed `(pack, adapter)` at each scope with its version and an `up-to-date` / `upgrade-available` / `unknown` status; it degrades to `unknown` (never an error) when the catalogue can't be resolved, and `--no-check` skips the check entirely.
+**`list-installed`** reads your state files (not the catalogue) and reports every installed `(pack, adapter)` at each scope with its version and a four-value status — `up-to-date`, `upgrade-available`, `ahead` (installed version is newer than catalogue), or `unknown`; it degrades to `unknown` (never an error) when the catalogue can't be resolved, and `--no-check` skips the check entirely. `--format json` emits a stable JSON contract (`schema_version: 1`) to stdout — useful for CI automation of upgrade decisions. `--updates-only` hides `up-to-date` rows.
 
 **`show <pack>`** answers "what skills and agents does this pack contain?" by walking the pack's source tree live on each call — so the answer can't drift, and nothing is persisted. `--format json` emits a stable object (`name`, `version`, `description`, `skills`, `agents`, `source`) for scripts and agents. When the catalogue can't be resolved, an *installed* pack still reports its inventory from your state files (marked `source: installed-state`); a not-installed pack errors.
 
@@ -70,6 +72,90 @@ A **profile** is a catalogue-curated, single-scope set of packs you install in o
 
 **Mutating commands ask first.** `uninstall`, the `--force` cleanup, and the upgrade offer all preview what they'll do and confirm before touching anything; `--dry-run` previews without writing, and `--yes` skips the prompt for non-interactive / CI use (where, without it, they refuse rather than hang).
 
+## Enterprise distribution
+
+For organizations running an internal Artifactory mirror or any static HTTPS server,
+agentbundle's enterprise distribution capabilities handle the full adoption loop —
+from org-wide channel configuration to CI-driven bulk upgrades.
+
+**Install from an internal Artifactory channel:**
+
+```bash
+# Point agentbundle at your org's channel descriptor (one-time per machine,
+# or pre-configured in your org fork — see Org bootstrap below)
+agentbundle config set source catalogue+https://artifactory.example.test/agentbundle/catalogues/core/channels/stable.json
+
+agentbundle install --pack core
+```
+
+The channel descriptor points to an immutable versioned archive; agentbundle
+fetches, verifies its SHA-256 digest, and installs. Pass a bearer token via
+`AGENTBUNDLE_HTTP_BEARER_TOKEN` — it is never stored in state, never printed, and
+never forwarded to a different host.
+
+**JSON output for CI pipelines:**
+
+```bash
+# See what's installed and what needs upgrading — machine-readable
+agentbundle list-installed --format json
+agentbundle list-installed --format json --updates-only
+```
+
+Returns a stable JSON contract (`schema_version` 1) with per-row status
+(`up-to-date` / `upgrade-available` / `ahead` / `unknown`) and machine-readable
+reason codes for unknown rows. Pipe into `jq` or your CI annotation step.
+
+**Bulk upgrade in one scoped command:**
+
+```bash
+# Upgrade all installed packs in a scope — preflights before any write
+agentbundle upgrade --all --scope repo --yes
+agentbundle upgrade --all --scope user --format json --yes
+```
+
+Preflights all rows before writing anything; a blocked row stops the run before the
+filesystem is touched. Partial failure is reported honestly — not described as a
+rollback. Never silently downgrades an `ahead` row.
+
+**Package your catalogue for Artifactory:**
+
+```bash
+agentbundle package-catalogue \
+  --root /path/to/catalogue \
+  --bundle my-packs \
+  --release 1.0.0 \
+  --channel stable \
+  --output dist/
+```
+
+Produces a deterministic, reproducible gzip archive (versioned) and a mutable channel
+descriptor JSON (`stable.json`), ready to upload to Artifactory. Identical inputs
+produce byte-identical archives (honors `SOURCE_DATE_EPOCH`).
+
+**Org bootstrap — ship the default channel in your fork:**
+
+Add an `[organization.artifactory]` block to
+`agentbundle/_data/install-defaults.toml` in your org's agentbundle fork:
+
+```toml
+[organization.artifactory]
+enabled = true
+base-url = "https://artifactory.example.test"
+repository = "agentbundle"
+bundle = "core"
+channel = "stable"
+```
+
+Developers installing from your fork get the internal channel without a manual
+`config set source` step. The block ships `enabled = false` in the public package.
+A malformed `enabled = true` config fails closed — no silent fallback to the public
+source.
+
+See the full enterprise adoption guide at
+`docs/guides/_shared/how-to/use-an-artifactory-catalogue.md` for all six flows
+(org bootstrap, repo-scope CI upgrade, user-scope MDM, source-conflict remediation,
+disconnected hosts, and security controls).
+
 ## Build your own catalogue
 
 `agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it. A pack is a directory:
@@ -102,6 +188,34 @@ is deliberately lossy per tool.
 
 Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
 
+**Org adapter default:** If your org ships a private `agentbundle` wheel (or a fork pinned to your internal catalogue), you can set a default adapter for all developers without requiring them to run `agentbundle config set` or pass `--adapter` on every install. Add an `[organization]` table to `_data/install-defaults.toml` in your fork:
+
+```toml
+[organization]
+preferred_adapter = "cursor"
+```
+
+The org hint fires after the user-config but before the on-disk IDE probe — so `--adapter`, user-config, and upgrade state-hints all take priority. An invalid value exits 1 before writing anything. See the [`agentbundle` reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/reference/agentbundle.md#org-adapter-default) for the full cascade.
+
+**Lint your catalogue** — shallow structural checks run without extra dependencies:
+
+```bash
+agentbundle catalogue lint --root .
+```
+
+For full [agentskills.io spec](https://agentskills.io/specification) compliance (frontmatter key set, description policy, encoding, evals schema), install the `lint` extra and run with `--deep`:
+
+```bash
+pip install 'agentbundle[lint]'
+agentbundle catalogue lint --root . --deep
+```
+
+**Run Tier-A activation evals** to measure whether each covered skill fires on the prompts it should:
+
+```bash
+agentbundle pack evals run --pack <pack-name> --catalogue-root .
+```
+
 See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
 
 ## Credentials

agentbundle-0.17.0/agentbundle/_data/catalogue.schema.json

@@ -0,0 +1,170 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "catalogue.schema.json",
+  "title": "CatalogueConfig",
+  "description": "JSON Schema for catalogue.toml — ini-005 Bucket 3 configuration layer.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "catalogue", "distribution"],
+  "properties": {
+    "schema": {
+      "type": "integer",
+      "description": "Schema version — must be 1.",
+      "enum": [1]
+    },
+    "catalogue": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name",
+        "display-name",
+        "description",
+        "minimum-agentbundle-version",
+        "paths",
+        "build",
+        "package"
+      ],
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Safe identifier — [A-Za-z0-9][A-Za-z0-9_-]*.",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9_\\-]*$"
+        },
+        "display-name": {
+          "type": "string",
+          "description": "Human-readable catalogue name."
+        },
+        "description": {
+          "type": "string",
+          "description": "One-line description of the catalogue."
+        },
+        "minimum-agentbundle-version": {
+          "type": "string",
+          "description": "Minimum agentbundle version required to use this catalogue."
+        },
+        "paths": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["packs", "profiles", "contracts", "marketplace", "build-output"],
+          "properties": {
+            "packs": {
+              "type": "string",
+              "description": "Relative path to the packs directory."
+            },
+            "profiles": {
+              "type": "string",
+              "description": "Relative path to the profiles directory."
+            },
+            "contracts": {
+              "type": "string",
+              "description": "Relative path to the contracts directory."
+            },
+            "marketplace": {
+              "type": "string",
+              "description": "Relative path to the marketplace.json file."
+            },
+            "build-output": {
+              "type": "string",
+              "description": "Relative path for build output."
+            }
+          }
+        },
+        "build": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["recipes", "self-host", "claude-plugin-branch", "marketplace-description"],
+          "properties": {
+            "recipes": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Build recipe IDs or relative .toml paths."
+            },
+            "self-host": {
+              "type": "boolean",
+              "description": "Whether to generate self-host install-defaults.toml."
+            },
+            "claude-plugin-branch": {
+              "type": "string",
+              "description": "Branch name for claude-plugin publishing."
+            },
+            "marketplace-description": {
+              "type": "string",
+              "description": "Description for marketplace.json."
+            }
+          }
+        },
+        "package": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["include", "required"],
+          "properties": {
+            "include": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Pack paths to include in a packaged archive."
+            },
+            "required": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Pack paths that must be present (subset of include)."
+            }
+          }
+        }
+      }
+    },
+    "distribution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["agentbundle"],
+      "properties": {
+        "agentbundle": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "install-defaults-output",
+            "preferred-adapter",
+            "default-source",
+            "artifactory"
+          ],
+          "properties": {
+            "install-defaults-output": {
+              "type": "string",
+              "description": "Relative path for generated install-defaults.toml."
+            },
+            "preferred-adapter": {
+              "type": "string",
+              "description": "Default adapter hint written to install-defaults.toml."
+            },
+            "default-source": {
+              "type": "string",
+              "description": "Default catalogue source URI (git+https:// or local path)."
+            },
+            "artifactory": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["enabled"],
+              "properties": {
+                "enabled": {
+                  "type": "boolean",
+                  "description": "Whether the Artifactory bootstrap is active."
+                },
+                "base-url": {
+                  "type": "string",
+                  "description": "Artifactory base URL (https:// only, required when enabled)."
+                },
+                "repository": {
+                  "type": "string",
+                  "description": "Artifactory repository name (required when enabled)."
+                },
+                "bundle": {
+                  "type": "string",
+                  "description": "Catalogue bundle name (required when enabled)."
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

agentbundle-0.17.0/agentbundle/_data/install-defaults.toml

@@ -0,0 +1,9 @@
+# Generated by agentbundle catalogue sync-defaults — source of truth: catalogue.toml
+[organization]
+preferred_adapter = "claude-code"
+
+[organization.artifactory]
+enabled = false
+
+[defaults]
+source = "git+https://github.com/eugenelim/agent-ready-repo"

{agentbundle-0.12.1 → agentbundle-0.17.0}/agentbundle/build/__init__.py

@@ -111,7 +111,7 @@ def _build_parser() -> argparse.ArgumentParser:
         default="dist",
         help="Where to write build artefacts (default: dist/).",
     )
-    build_parser.set_defaults(func=cmd_build)
+    build_parser.set_defaults(func=_cmd_build_shim)
 
     self_parser = subparsers.add_parser(
         "self",
@@ -130,7 +130,7 @@ def _build_parser() -> argparse.ArgumentParser:
             "OS for filesystems or workflows that disallow symlinks."
         ),
     )
-    self_parser.set_defaults(func=cmd_self)
+    self_parser.set_defaults(func=_cmd_self_shim)
 
     check_parser = subparsers.add_parser(
         "check",
@@ -146,7 +146,7 @@ def _build_parser() -> argparse.ArgumentParser:
             "regular-file CLAUDE.md copy rather than a symlink."
         ),
     )
-    check_parser.set_defaults(func=cmd_check)
+    check_parser.set_defaults(func=_cmd_check_shim)
 
     scaffold_parser = subparsers.add_parser(
         "scaffold",
@@ -162,14 +162,53 @@ def _build_parser() -> argparse.ArgumentParser:
         help=(
             "Windows-portability lint: reject packs that ship symlinks "
             "or Windows-poisonous names under seeds/ or .apm/."
+            " [deprecated: use 'agentbundle catalogue lint']"
         ),
     )
     lint_packs_parser.add_argument("--packs-dir", default="packs")
-    lint_packs_parser.set_defaults(func=cmd_lint_packs)
+    lint_packs_parser.set_defaults(func=_cmd_lint_packs_shim)
 
     return parser
 
 
+def _cmd_build_shim(args) -> int:
+    print(
+        "agentbundle.build build is deprecated; use 'agentbundle catalogue build --root .' instead",
+        file=sys.stderr,
+    )
+    return int(cmd_build(args))
+
+
+def _cmd_self_shim(args) -> int:
+    print(
+        "agentbundle.build self is deprecated; use 'agentbundle catalogue self-host --write --root .' instead",
+        file=sys.stderr,
+    )
+    return int(cmd_self(args))
+
+
+def _cmd_check_shim(args) -> int:
+    print(
+        "agentbundle.build check is deprecated; use 'agentbundle catalogue self-host --check --root .' instead",
+        file=sys.stderr,
+    )
+    return int(cmd_check(args))
+
+
+def _cmd_lint_packs_shim(args) -> int:
+    print(
+        "agentbundle.build lint-packs is deprecated; use 'agentbundle catalogue lint --root .' instead",
+        file=sys.stderr,
+    )
+    from agentbundle.catalogue_tooling.lint import lint_catalogue, render_table
+
+    packs_dir = Path(getattr(args, "packs_dir", "packs")).resolve()
+    root = packs_dir.parent
+    result = lint_catalogue(root)
+    print(render_table(result), file=sys.stderr)
+    return 0 if result.ok else 1
+
+
 def _cmd_scaffold(args) -> int:
     pack_seeds = Path(args.packs_dir) / args.pack / "seeds"
     output = Path(args.output)

{agentbundle-0.12.1 → agentbundle-0.17.0}/agentbundle/build/adapters/claude_code.py

@@ -14,6 +14,7 @@ deep-merging the incoming TOML payload.
 
 from __future__ import annotations
 
+import os
 import shutil
 from pathlib import Path
 from typing import Iterator
@@ -107,15 +108,17 @@ def _project_single(pack_path: Path, contract: dict, output_root: Path) -> None:
             raise ValueError(f"claude-code: unhandled mode {mode!r} for {primitive_name}")
 
 
-def _ignore_symlinks(directory: str, names: list[str]) -> set[str]:
-    """`shutil.copytree` ignore callback: skip every symlink member.
+def _ignore_absolute_symlinks(directory: str, names: list[str]) -> set[str]:
+    """`shutil.copytree` ignore callback: drop symlinks with absolute targets.
 
-    Drops nested symlinks so they are never reproduced in the output
-    tree. The top-level `is_symlink()` skip in `_project_direct_directory`
-    covers the skill root; this covers the subtree.
+    Relative symlinks (intra-skill cross-references) are preserved as
+    symlinks. Absolute symlinks always escape the tree and are a path-escape vector.
     """
     base = Path(directory)
-    return {name for name in names if (base / name).is_symlink()}
+    return {
+        name for name in names
+        if (base / name).is_symlink() and os.path.isabs(os.readlink(base / name))
+    }
 
 
 def _project_direct_directory(source_dir: Path, target_dir: Path) -> None:
@@ -136,10 +139,13 @@ def _project_direct_directory(source_dir: Path, target_dir: Path) -> None:
                 destination.unlink()
             elif destination.exists():
                 shutil.rmtree(destination)
-            # `ignore=_ignore_symlinks` drops nested symlinks so they are
-            # never reproduced in the output tree. A malicious pack with a
-            # symlink to /etc/passwd cannot exfiltrate the target.
-            shutil.copytree(entry, destination, ignore=_ignore_symlinks)
+            # symlinks=True preserves relative nested symlinks; absolute
+            # targets are filtered out by _ignore_absolute_symlinks.
+            shutil.copytree(
+                entry, destination,
+                symlinks=True,
+                ignore=_ignore_absolute_symlinks,
+            )
 
 
 def _project_direct_file(source_dir: Path, output_root: Path, target_prefix: str) -> None:

{agentbundle-0.12.1 → agentbundle-0.17.0}/agentbundle/build/adapters/codex.py

@@ -29,16 +29,6 @@ from agentbundle.build.projections.codex_agent_toml import (
 )
 
 
-def _ignore_symlinks(directory: str, names: list[str]) -> set[str]:
-    """`shutil.copytree` ignore callback: skip every symlink member.
-
-    Drops nested symlinks so they are never reproduced in the output
-    tree. The top-level `is_symlink()` skip in `project_packs` covers
-    the skill root; this covers the subtree.
-    """
-    base = Path(directory)
-    return {name for name in names if (base / name).is_symlink()}
-
 
 def _iter_primitives(contract: dict) -> Iterator[str]:
     """Yield Codex's projected primitive names in phase order."""
@@ -142,11 +132,13 @@ def project_packs(pack_paths: list[Path], contract: dict, output_root: Path) ->
                             destination.unlink()
                         elif destination.exists():
                             shutil.rmtree(destination)
-                        # `ignore=_ignore_symlinks` drops nested symlinks
-                        # entirely — never reproduced in the output tree.
-                        # A malicious pack with a symlink to /etc/passwd
-                        # cannot exfiltrate.
-                        shutil.copytree(entry, destination, ignore=_ignore_symlinks)
+                        # symlinks=True preserves relative nested symlinks;
+                        # absolute targets are filtered by _ignore_absolute_symlinks.
+                        shutil.copytree(
+                            entry, destination,
+                            symlinks=True,
+                            ignore=_ignore_absolute_symlinks,
+                        )
             # Bound to `skill` only per spec § Never do. Other
             # direct-directory primitives opt in explicitly.
             if primitive_name == "skill":
@@ -166,6 +158,19 @@ def project_packs(pack_paths: list[Path], contract: dict, output_root: Path) ->
             raise ValueError(f"codex: unhandled mode {mode!r} for {primitive_name}")
 
 
+def _ignore_absolute_symlinks(directory: str, names: list[str]) -> set[str]:
+    """`shutil.copytree` ignore callback: drop symlinks with absolute targets.
+
+    Relative symlinks (intra-skill cross-references) are preserved (AC5).
+    Absolute symlinks always escape the tree and are a path-escape vector.
+    """
+    base = Path(directory)
+    return {
+        name for name in names
+        if (base / name).is_symlink() and os.path.isabs(os.readlink(base / name))
+    }
+
+
 def _project_direct_file(source_dir: Path, output_root: Path, target_prefix: str) -> None:
     target_dir = output_root / target_prefix.rstrip("/")
     target_dir.mkdir(parents=True, exist_ok=True)