agentbundle 0.20.0__tar.gz → 0.21.0__tar.gz

{agentbundle-0.20.0 → agentbundle-0.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.20.0
+Version: 0.21.0
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT
@@ -34,6 +34,8 @@ Requires-Dist: pyyaml>=6.0; extra == "lint"
 pip install agentbundle
 ```
 
+Requires Python 3.11+. Runs on macOS, Linux, and Windows.
+
 **Install into a repo** — so everyone who clones it gets the pack. `core` is the flagship pack, the loop itself:
 
 ```bash
@@ -240,6 +242,38 @@ agentbundle pack evals run --pack <pack-name> --catalogue-root .
 
 See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
 
+## Catalogue defaults and pack config API
+
+**Catalogue defaults** let operators ship sensible starting values for every pack they distribute. Add a `[pack-defaults.<pack-name>]` table to `catalogue.toml` and the defaults are baked in at publish time. They slot into the three-layer cascade: pack-source defaults → operator defaults → user config. A custom install root is also supported via `[catalogue] user-dir = "~/custom/path"`.
+
+**Pack scripts** can resolve their user-scope directory and read the merged config at runtime using the `agentbundle.config` API:
+
+```python
+from agentbundle.config import pack_dir, load_pack_config
+
+directory = pack_dir("my-pack")                 # ~/.agentbundle/my-pack/
+config = load_pack_config("my-pack")            # merged dict: pack defaults + operator + user
+```
+
+**Operation log** — scripts can append structured JSONL records to `<pack_dir>/ops.jsonl` for lightweight audit trails:
+
+```python
+from agentbundle.oplog import write_entry
+
+write_entry("my-pack", "install", src="git+https://example.com/my-pack")
+```
+
+**CLI commands** to read, write, and inspect pack config and operation logs:
+
+```bash
+agentbundle pack-config show my-pack            # all config values for a pack
+agentbundle pack-config get  my-pack api-key    # single value
+agentbundle pack-config set  my-pack api-key v  # write to user config.toml
+
+agentbundle oplog show  my-pack                 # JSONL operation history
+agentbundle oplog clear my-pack                 # wipe history (asks first)
+```
+
 ## Credentials
 
 `agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.

{agentbundle-0.20.0 → agentbundle-0.21.0}/README.md

@@ -12,6 +12,8 @@
 pip install agentbundle
 ```
 
+Requires Python 3.11+. Runs on macOS, Linux, and Windows.
+
 **Install into a repo** — so everyone who clones it gets the pack. `core` is the flagship pack, the loop itself:
 
 ```bash
@@ -218,6 +220,38 @@ agentbundle pack evals run --pack <pack-name> --catalogue-root .
 
 See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
 
+## Catalogue defaults and pack config API
+
+**Catalogue defaults** let operators ship sensible starting values for every pack they distribute. Add a `[pack-defaults.<pack-name>]` table to `catalogue.toml` and the defaults are baked in at publish time. They slot into the three-layer cascade: pack-source defaults → operator defaults → user config. A custom install root is also supported via `[catalogue] user-dir = "~/custom/path"`.
+
+**Pack scripts** can resolve their user-scope directory and read the merged config at runtime using the `agentbundle.config` API:
+
+```python
+from agentbundle.config import pack_dir, load_pack_config
+
+directory = pack_dir("my-pack")                 # ~/.agentbundle/my-pack/
+config = load_pack_config("my-pack")            # merged dict: pack defaults + operator + user
+```
+
+**Operation log** — scripts can append structured JSONL records to `<pack_dir>/ops.jsonl` for lightweight audit trails:
+
+```python
+from agentbundle.oplog import write_entry
+
+write_entry("my-pack", "install", src="git+https://example.com/my-pack")
+```
+
+**CLI commands** to read, write, and inspect pack config and operation logs:
+
+```bash
+agentbundle pack-config show my-pack            # all config values for a pack
+agentbundle pack-config get  my-pack api-key    # single value
+agentbundle pack-config set  my-pack api-key v  # write to user config.toml
+
+agentbundle oplog show  my-pack                 # JSONL operation history
+agentbundle oplog clear my-pack                 # wipe history (asks first)
+```
+
 ## Credentials
 
 `agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/_data/catalogue.schema.json

@@ -12,6 +12,14 @@
       "description": "Schema version — must be 1.",
       "enum": [1]
     },
+    "pack-defaults": {
+      "type": "object",
+      "description": "Per-pack configuration defaults baked into install-defaults.toml at build time.",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": { "type": "string" }
+      }
+    },
     "catalogue": {
       "type": "object",
       "additionalProperties": false,
@@ -25,6 +33,10 @@
         "package"
       ],
       "properties": {
+        "user-dir": {
+          "type": "string",
+          "description": "User-scope pack directory root (must start with ~/). Defaults to ~/.agentbundle when absent."
+        },
         "name": {
           "type": "string",
           "description": "Safe identifier — [A-Za-z0-9][A-Za-z0-9_-]*.",

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/_data/install-marker.py

@@ -48,16 +48,12 @@ Exit codes:
 """
 
 import argparse
+import contextlib
 import datetime
 import hashlib
 import json
 import os
 import pathlib
-import sys
-import tempfile
-import tomllib
-from datetime import timezone
-
 
 # ---------------------------------------------------------------------------
 # Vendored pack-name / pack-version shape rules — copied from
@@ -69,6 +65,9 @@ from datetime import timezone
 # pack.toml would pass unchecked and land phantom TOML lines in the marker.
 # ---------------------------------------------------------------------------
 import re as _re
+import sys
+import tempfile
+import tomllib
 
 _PACK_NAME_RE = _re.compile(r"^[a-z0-9][a-z0-9-]*$")
 _PACK_VERSION_RE = _re.compile(
@@ -164,11 +163,11 @@ def _assert_under(target: pathlib.Path, jail: pathlib.Path) -> None:
     # jail is already resolved; do not call os.path.realpath on it again.
     try:
         resolved_target.relative_to(jail)
-    except ValueError:
+    except ValueError as exc:
         raise ValueError(
             f"install-marker: marker path {resolved_target} escapes the per-scope jail "
             f"{jail}; refusing write"
-        )
+        ) from exc
 
 
 def _assert_portable_name(component: str) -> None:
@@ -196,7 +195,7 @@ def _assert_portable_name(component: str) -> None:
                 f"install-marker: refusing path component with control character "
                 f"U+{ord(ch):04X}: {component!r}"
             )
-    if component.endswith(".") or component.endswith(" "):
+    if component.endswith((".", " ")):
         raise ValueError(
             f"install-marker: refusing path component with trailing dot or space: "
             f"{component!r}"
@@ -294,7 +293,7 @@ def _marker_scope(origin: str) -> str:
 def _pack_toml(plugin_root: pathlib.Path) -> dict:
     """Load and return the pack manifest dict from ``pack.toml``."""
     toml_path = plugin_root / "pack.toml"
-    with open(toml_path, "rb") as fh:
+    with toml_path.open("rb") as fh:
         return tomllib.load(fh)
 
 
@@ -343,12 +342,11 @@ def _marker_path(
         agentbundle.mkdir(mode=0o700, parents=True, exist_ok=True)
         resolved_jail = pathlib.Path(os.path.realpath(agentbundle))
         return agentbundle / ".adapt-install-marker.toml", resolved_jail
-    else:
-        # repo scope — project_dir must be set; callers ensure this.
-        if project_dir is None:
-            raise ValueError("project_dir required for repo-scope marker")
-        resolved_jail = pathlib.Path(os.path.realpath(project_dir))
-        return project_dir / ".adapt-install-marker.toml", resolved_jail
+    # repo scope — project_dir must be set; callers ensure this.
+    if project_dir is None:
+        raise ValueError("project_dir required for repo-scope marker")
+    resolved_jail = pathlib.Path(os.path.realpath(project_dir))
+    return project_dir / ".adapt-install-marker.toml", resolved_jail
 
 
 def _should_fire(
@@ -606,18 +604,14 @@ def _write_marker(
         os.write(tmp_fd, content_bytes)
         os.close(tmp_fd)
         tmp_fd = -1
-        os.replace(tmp_name, marker_path)
+        pathlib.Path(tmp_name).replace(marker_path)
     except Exception:
         # Clean up tempfile on error (best effort).
         if tmp_fd >= 0:
-            try:
+            with contextlib.suppress(OSError):
                 os.close(tmp_fd)
-            except OSError:
-                pass
-        try:
-            os.unlink(tmp_name)
-        except OSError:
-            pass
+        with contextlib.suppress(OSError):
+            pathlib.Path(tmp_name).unlink()
         raise
 
 
@@ -640,17 +634,13 @@ def _write_hash(plugin_data: pathlib.Path, current_hash: str) -> None:
         os.write(tmp_fd, content_bytes)
         os.close(tmp_fd)
         tmp_fd = -1
-        os.replace(tmp_name, hash_path)
+        pathlib.Path(tmp_name).replace(hash_path)
     except Exception:
         if tmp_fd >= 0:
-            try:
+            with contextlib.suppress(OSError):
                 os.close(tmp_fd)
-            except OSError:
-                pass
-        try:
-            os.unlink(tmp_name)
-        except OSError:
-            pass
+        with contextlib.suppress(OSError):
+            pathlib.Path(tmp_name).unlink()
         raise
 
 
@@ -892,7 +882,7 @@ def _main_claude_plugins(args: argparse.Namespace) -> int:
     new_entry: dict = {
         "name": pack_name,
         "version": pack_version,
-        "installed-at": datetime.datetime.now(timezone.utc),
+        "installed-at": datetime.datetime.now(datetime.UTC),
         "install-route": args.install_route,
     }
 
@@ -912,7 +902,10 @@ def _main_claude_plugins(args: argparse.Namespace) -> int:
     except Exception as exc:
         # Hash write failure is non-fatal for the adopter (the marker was written),
         # but log it so the next session retries detection rather than silently skipping.
-        print(f"install-marker: hash write failed (next session will retry): {exc}", file=sys.stderr)
+        print(
+            f"install-marker: hash write failed (next session will retry): {exc}",
+            file=sys.stderr,
+        )
 
     return 0
 
@@ -935,7 +928,7 @@ def _main_apm(args: argparse.Namespace) -> int:
     home = pathlib.Path(home_str)
 
     # --- Resolve data directory per AC3 precedence ---
-    plugin_data = _resolve_data_dir(env)
+    plugin_data = _resolve_data_dir(env)  # type: ignore[arg-type]
     if plugin_data is None:
         # No-match fall-through (no APM data-directory token set); exit 0
         # without writing marker or hash file (the no-partial-state rail).
@@ -1072,7 +1065,7 @@ def _main_apm(args: argparse.Namespace) -> int:
     new_entry: dict = {
         "name": pack_name,
         "version": pack_version,
-        "installed-at": datetime.datetime.now(timezone.utc),
+        "installed-at": datetime.datetime.now(datetime.UTC),
         "install-route": args.install_route,
     }
 

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/build/self_host.py

@@ -1482,7 +1482,7 @@ def run_build_check_drift_gates(
                     except _PARITY_EXPECTED_EXC as exc:
                         source_out = f"<{type(exc).__name__}: {exc}>"
                     try:
-                        template_out: object = template_emit(test_input)
+                        template_out: object = template_emit(test_input)  # type: ignore[operator]
                     except _PARITY_EXPECTED_EXC as exc:
                         template_out = f"<{type(exc).__name__}: {exc}>"
                     if source_out != template_out:

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/catalogue.py

@@ -103,8 +103,7 @@ def _resolve_https(uri: str) -> Path:
     atexit.register(shutil.rmtree, str(tmpdir), True)
     _fetch_and_extract(tarball_url, tmpdir)
     # The GitHub archive extracts to <repo>-<ref>/ (with '/' → '-' in SHAs).
-    inner = _find_inner_dir(tmpdir)
-    return inner
+    return _find_inner_dir(tmpdir)
 
 
 def _ref_type(ref: str) -> str:
@@ -148,13 +147,12 @@ def _github_archive_url(owner: str, repo: str, ref: str) -> str:
 def _fetch_and_extract(url: str, dest: Path) -> None:
     try:
         # B310: constant github.com archive base assembled from parsed owner/repo/ref.
-        with urllib.request.urlopen(url) as resp:  # nosec B310
-            with tarfile.open(fileobj=resp, mode="r|gz") as tf:
-                # filter="data" rejects unsafe members (absolute paths, ..
-                # links, devices, setuid bits) — Python 3.12+ default but
-                # explicit for 3.11 compatibility and to silence the 3.14
-                # DeprecationWarning. Path-jail is belt; this is braces.
-                tf.extractall(path=dest, filter="data")
+        with urllib.request.urlopen(url) as resp, tarfile.open(fileobj=resp, mode="r|gz") as tf:  # nosec B310
+            # filter="data" rejects unsafe members (absolute paths, ..
+            # links, devices, setuid bits) — Python 3.12+ default but
+            # explicit for 3.11 compatibility and to silence the 3.14
+            # DeprecationWarning. Path-jail is belt; this is braces.
+            tf.extractall(path=dest, filter="data")
     except urllib.error.URLError as exc:
         raise CatalogueError(
             f"Failed to fetch catalogue archive: {url} — {exc.reason}"

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/catalogue_tooling/archive.py

@@ -58,7 +58,10 @@ def _check_sha256_sidecar(archive: Path, sha256_file: Path | None) -> list[Diagn
         return [_err("CAT-V-ARC-001", f"cannot read sha256 sidecar: {exc}")]
     actual_hex = hashlib.sha256(archive.read_bytes()).hexdigest()
     if expected_hex != actual_hex:
-        return [_err("CAT-V-ARC-001", f"sha256 sidecar mismatch: expected {expected_hex}, got {actual_hex}")]
+        return [_err(
+            "CAT-V-ARC-001",
+            f"sha256 sidecar mismatch: expected {expected_hex}, got {actual_hex}",
+        )]
     return []
 
 
@@ -74,7 +77,10 @@ def _check_gzip_parseable(archive: Path) -> list[Diagnostic]:
 def _check_compressed_size(archive: Path) -> list[Diagnostic]:
     size = archive.stat().st_size
     if size > _MAX_COMPRESSED_BYTES:
-        return [_err("CAT-V-ARC-003", f"compressed size {size} exceeds limit {_MAX_COMPRESSED_BYTES}")]
+        return [_err(
+            "CAT-V-ARC-003",
+            f"compressed size {size} exceeds limit {_MAX_COMPRESSED_BYTES}",
+        )]
     return []
 
 
@@ -102,7 +108,11 @@ def check_members(members: list[tarfile.TarInfo]) -> list[Diagnostic]:
     # no device/special files or FIFOs
     for m in members:
         if m.isdev() or m.isfifo():
-            diags.append(_err("CAT-V-ARC-007", f"device/special/FIFO in archive: {m.name!r}", path=m.name))
+            diags.append(_err(
+                "CAT-V-ARC-007",
+                f"device/special/FIFO in archive: {m.name!r}",
+                path=m.name,
+            ))
 
     # AC13: no duplicate members
     seen: set[str] = set()
@@ -125,7 +135,10 @@ def check_members(members: list[tarfile.TarInfo]) -> list[Diagnostic]:
 
     # member count limit
     if len(members) > _MAX_MEMBERS:
-        diags.append(_err("CAT-V-ARC-003", f"member count {len(members)} exceeds limit {_MAX_MEMBERS}"))
+        diags.append(_err(
+            "CAT-V-ARC-003",
+            f"member count {len(members)} exceeds limit {_MAX_MEMBERS}",
+        ))
 
     return diags
 
@@ -133,7 +146,10 @@ def check_members(members: list[tarfile.TarInfo]) -> list[Diagnostic]:
 def _check_expanded_size(members: list[tarfile.TarInfo]) -> list[Diagnostic]:
     total = sum(m.size for m in members if m.isreg())
     if total > _MAX_EXPANDED_BYTES:
-        return [_err("CAT-V-ARC-003", f"expanded size {total} exceeds limit {_MAX_EXPANDED_BYTES}")]
+        return [_err(
+            "CAT-V-ARC-003",
+            f"expanded size {total} exceeds limit {_MAX_EXPANDED_BYTES}",
+        )]
     return []
 
 
@@ -180,7 +196,10 @@ def _check_manifest_schema(manifest: dict) -> list[Diagnostic]:
         diags.append(_err("CAT-V-ARC-011", f"manifest schema must be 1 or 2, got {schema!r}"))
     for field in ("bundle", "release", "generated_at"):
         if not isinstance(manifest.get(field), str):
-            diags.append(_err("CAT-V-ARC-011", f"manifest missing required string field {field!r}"))
+            diags.append(_err(
+                "CAT-V-ARC-011",
+                f"manifest missing required string field {field!r}",
+            ))
     if not isinstance(manifest.get("files"), list):
         diags.append(_err("CAT-V-ARC-011", "manifest 'files' must be a list"))
     if not isinstance(manifest.get("packs"), list):
@@ -201,11 +220,19 @@ def _check_all_manifest_digests(
         member_name = f"{prefix}{rel_path}" if prefix else rel_path
         member = member_map.get(member_name)
         if member is None:
-            diags.append(_err("CAT-V-ARC-013", f"manifest declares {rel_path!r} but not in archive", path=rel_path))
+            diags.append(_err(
+                "CAT-V-ARC-013",
+                f"manifest declares {rel_path!r} but not in archive",
+                path=rel_path,
+            ))
             continue
         fobj = tf.extractfile(member)
         if fobj is None:
-            diags.append(_err("CAT-V-ARC-012", f"cannot extract {rel_path!r} for digest check", path=rel_path))
+            diags.append(_err(
+                "CAT-V-ARC-012",
+                f"cannot extract {rel_path!r} for digest check",
+                path=rel_path,
+            ))
             continue
         actual_sha = hashlib.sha256(fobj.read()).hexdigest()
         if actual_sha != expected_sha:
@@ -268,7 +295,10 @@ def _check_min_agentbundle_compat(manifest: dict) -> list[Diagnostic]:
     except ValueError:
         return []
     if running < required:
-        return [_err("CAT-V-ARC-015", f"archive requires agentbundle >= {min_ver}, running {CLI_VERSION}")]
+        return [_err(
+            "CAT-V-ARC-015",
+            f"archive requires agentbundle >= {min_ver}, running {CLI_VERSION}",
+        )]
     return []
 
 
@@ -335,7 +365,8 @@ def verify_archive(archive: Path, sha256_file: Path | None = None) -> VerifyResu
                 try:
                     tf.extractall(tmpdir, filter="data")
                 except TypeError:
-                    # Python < 3.12: extract member-by-member; paths pre-validated by check_members()
+                    # Python < 3.12: extract member-by-member;
+                    # paths pre-validated by check_members()
                     for _m in tf.getmembers():
                         _dest = tmpdir / _m.name
                         _dest.parent.mkdir(parents=True, exist_ok=True)

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/catalogue_tooling/build.py

@@ -101,18 +101,18 @@ def build_catalogue(
 
     # Temporarily override module-level constants when config is present.
     # Restored in finally to avoid cross-test pollution.
-    saved_branch = _build_main._DIST_BRANCH
-    saved_desc = _build_main._MARKETPLACE_DESCRIPTION
+    saved_branch = _build_main._DIST_BRANCH  # type: ignore[attr-defined]
+    saved_desc = _build_main._MARKETPLACE_DESCRIPTION  # type: ignore[attr-defined]
     try:
         if config and config.build.claude_plugin_branch:
-            _build_main._DIST_BRANCH = config.build.claude_plugin_branch
+            _build_main._DIST_BRANCH = config.build.claude_plugin_branch  # type: ignore[attr-defined]
         if config and config.build.marketplace_description:
-            _build_main._MARKETPLACE_DESCRIPTION = config.build.marketplace_description
+            _build_main._MARKETPLACE_DESCRIPTION = config.build.marketplace_description  # type: ignore[attr-defined]
 
         rc = cmd_build(args)
     finally:
-        _build_main._DIST_BRANCH = saved_branch
-        _build_main._MARKETPLACE_DESCRIPTION = saved_desc
+        _build_main._DIST_BRANCH = saved_branch  # type: ignore[attr-defined]
+        _build_main._MARKETPLACE_DESCRIPTION = saved_desc  # type: ignore[attr-defined]
 
     return BuildResult(
         ok=(rc == 0),

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/catalogue_tooling/config.py

@@ -16,13 +16,22 @@ from __future__ import annotations
 import json
 import re
 import tomllib
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from urllib.parse import urlsplit
 
 # Bundled recipe IDs that are always valid without a path on disk.
 _BUNDLED_RECIPES: frozenset[str] = frozenset({"default"})
 
+# Pack slug pattern (must match agentbundle.config._PACK_NAME_RE).
+_SLUG_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
+
+# Reserved slugs that collide with well-known user-scope paths.
+_RESERVED_SLUGS: frozenset[str] = frozenset({"bin", "state", "credentials", "state.toml"})
+
+# Default user-scope pack directory.
+_DEFAULT_USER_DIR = "~/.agentbundle"
+
 # Safe identifier pattern for catalogue names.
 _SAFE_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_\-]*$")
 
@@ -95,6 +104,9 @@ class CatalogueConfig:
     build: CatalogueBuild
     package: CataloguePackage
     distribution: DistributionConfig
+    # RFC-0074: per-pack config defaults and user-scope directory.
+    user_dir: str = _DEFAULT_USER_DIR
+    pack_defaults: dict[str, dict[str, str]] = field(default_factory=dict)
 
 
 def _load_schema() -> dict:
@@ -224,10 +236,10 @@ def _validate_path(root: Path, p: str, field_name: str) -> None:
     resolved_root = root.resolve()
     try:
         resolved_path = (root / p).resolve()
-    except OSError:
+    except OSError as exc:
         raise CatalogueConfigError(
             f"catalogue.toml: {field_name!r} path cannot be resolved: {p!r}"
-        )
+        ) from exc
     if not resolved_path.is_relative_to(resolved_root):
         raise CatalogueConfigError(
             f"catalogue.toml: {field_name!r} path escapes catalogue root "
@@ -446,6 +458,52 @@ def load_catalogue_config(root: Path) -> CatalogueConfig | None:
     )
     distribution = DistributionConfig(agentbundle=agentbundle_dist)
 
+    # --- RFC-0074: user-dir and pack-defaults ---
+
+    user_dir_raw = cat.get("user-dir", _DEFAULT_USER_DIR)
+    if not isinstance(user_dir_raw, str):
+        raise CatalogueConfigError(
+            f"catalogue.toml: catalogue.user-dir must be a string, "
+            f"got {type(user_dir_raw).__name__}"
+        )
+    # Must start with ~/ (home-relative). Absolute paths outside $HOME are rejected.
+    if not user_dir_raw.startswith("~/"):
+        raise CatalogueConfigError(
+            f"catalogue.toml: catalogue.user-dir must start with ~/ (home-relative); "
+            f"got {user_dir_raw!r}. Absolute paths outside $HOME are not allowed."
+        )
+    # Reject path traversal sequences (e.g. ~/../../etc).
+    from pathlib import PurePosixPath
+
+    if ".." in PurePosixPath(user_dir_raw[2:]).parts:
+        raise CatalogueConfigError(
+            f"catalogue.toml: catalogue.user-dir must not contain '..' path components; "
+            f"got {user_dir_raw!r}"
+        )
+
+    raw_pack_defaults = raw.get("pack-defaults", {}) or {}
+    if not isinstance(raw_pack_defaults, dict):
+        raise CatalogueConfigError(
+            "catalogue.toml: pack-defaults must be a table"
+        )
+    pack_defaults: dict[str, dict[str, str]] = {}
+    for slug, kv in raw_pack_defaults.items():
+        if not _SLUG_RE.match(slug):
+            raise CatalogueConfigError(
+                f"catalogue.toml: pack-defaults key {slug!r} must match "
+                f"^[a-z0-9][a-z0-9-]*$"
+            )
+        if slug in _RESERVED_SLUGS:
+            raise CatalogueConfigError(
+                f"catalogue.toml: pack-defaults key {slug!r} is reserved "
+                f"({sorted(_RESERVED_SLUGS)})"
+            )
+        if not isinstance(kv, dict):
+            raise CatalogueConfigError(
+                f"catalogue.toml: pack-defaults.{slug} must be a table"
+            )
+        pack_defaults[slug] = {str(k): str(v) for k, v in kv.items()}
+
     return CatalogueConfig(
         schema=schema_val,
         name=name,
@@ -456,4 +514,6 @@ def load_catalogue_config(root: Path) -> CatalogueConfig | None:
         build=build,
         package=package,
         distribution=distribution,
+        user_dir=user_dir_raw,
+        pack_defaults=pack_defaults,
     )

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/catalogue_tooling/defaults.py

@@ -11,8 +11,12 @@ from __future__ import annotations
 
 from pathlib import Path
 
-from agentbundle.catalogue_tooling.config import CatalogueConfig, CatalogueConfigError, load_catalogue_config
-from agentbundle.catalogue_tooling.results import Diagnostic, SyncDefaultsResult, Severity
+from agentbundle.catalogue_tooling.config import (
+    CatalogueConfig,
+    CatalogueConfigError,
+    load_catalogue_config,
+)
+from agentbundle.catalogue_tooling.results import Diagnostic, Severity, SyncDefaultsResult
 
 _GENERATED_HEADER = (
     "# Generated by agentbundle catalogue sync-defaults"
@@ -93,6 +97,16 @@ def compile_defaults(config: CatalogueConfig) -> str:
         parts.append("\n")
         parts.append(_emit_section("defaults", defaults_rows))
 
+    # [pack-defaults.<pack>] — sorted by pack name, then by key within each section.
+    for pack_name in sorted(config.pack_defaults):
+        kv = config.pack_defaults[pack_name]
+        rows: list[tuple[str, str]] = sorted(
+            (k, _emit_str(v)) for k, v in kv.items()
+        )
+        if rows:
+            parts.append("\n")
+            parts.append(_emit_section(f"pack-defaults.{pack_name}", rows))
+
     return "".join(parts)
 
 

{agentbundle-0.20.0 → agentbundle-0.21.0}/agentbundle/catalogue_tooling/diagnostics.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import enum
 
 
-class DiagnosticCode(str, enum.Enum):
+class DiagnosticCode(enum.StrEnum):
     UNKNOWN = "UNKNOWN"
 
     # Lint codes — CAT-L001 through CAT-L027
@@ -38,5 +38,5 @@ class DiagnosticCode(str, enum.Enum):
     CAT_L027 = "CAT-L027"   # Multiline metadata form not supported
     CAT_L028 = "CAT-L028"   # Install profile invariant violation (scope, deps, order)
     CAT_L029 = "CAT-L029"   # Catalogue seeds lint failure (blocklist, placeholder, patterns.jsonl)
-    CAT_L030 = "CAT-L030"   # First-value contract violation (Level A/B fields, writes-to-repo, tutorial)
-    CAT_L031 = "CAT-L031"   # Credentialed-skill convention violation (D1/D2/D2b/D3/broker-specific)
+    CAT_L030 = "CAT-L030"   # First-value contract violation (Level A/B fields, writes-to-repo, tutorial)  # noqa: E501
+    CAT_L031 = "CAT-L031"   # Credentialed-skill convention violation (D1/D2/D2b/D3/broker-specific)  # noqa: E501