agentbundle 0.29.4__tar.gz → 0.29.5__tar.gz

{agentbundle-0.29.4 → agentbundle-0.29.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.29.4
+Version: 0.29.5
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT
@@ -156,6 +156,13 @@ Produces a deterministic, reproducible gzip archive (versioned) and a mutable ch
 descriptor JSON (`stable.json`), ready to upload to Artifactory. Identical inputs
 produce byte-identical archives (honors `SOURCE_DATE_EPOCH`).
 
+Build residue is excluded, so it does not matter whether you packaged a working
+tree you had just tested or npm-installed in. Pruned at every level of a pack:
+`__pycache__`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`, `.tox`,
+`.hypothesis`, `htmlcov`, `node_modules`, `.venv`, `venv` — plus `*.pyc`,
+`*.pyo`, `.DS_Store`, `coverage.xml` and `.coverage*` shards. The drop is
+silent, so do not name a directory you mean to ship after one of those.
+
 **Source distribution for air-gapped or self-hosted catalogues:**
 
 ```bash
@@ -167,7 +174,7 @@ agentbundle catalogue package \
   --output dist/
 ```
 
-Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files). Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
+Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files), with the same build-residue exclusions as the default flavour. Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
 
 **Org bootstrap — ship the default channel in your fork:**
 

{agentbundle-0.29.4 → agentbundle-0.29.5}/README-pypi.md

@@ -134,6 +134,13 @@ Produces a deterministic, reproducible gzip archive (versioned) and a mutable ch
 descriptor JSON (`stable.json`), ready to upload to Artifactory. Identical inputs
 produce byte-identical archives (honors `SOURCE_DATE_EPOCH`).
 
+Build residue is excluded, so it does not matter whether you packaged a working
+tree you had just tested or npm-installed in. Pruned at every level of a pack:
+`__pycache__`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`, `.tox`,
+`.hypothesis`, `htmlcov`, `node_modules`, `.venv`, `venv` — plus `*.pyc`,
+`*.pyo`, `.DS_Store`, `coverage.xml` and `.coverage*` shards. The drop is
+silent, so do not name a directory you mean to ship after one of those.
+
 **Source distribution for air-gapped or self-hosted catalogues:**
 
 ```bash
@@ -145,7 +152,7 @@ agentbundle catalogue package \
   --output dist/
 ```
 
-Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files). Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
+Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files), with the same build-residue exclusions as the default flavour. Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
 
 **Org bootstrap — ship the default channel in your fork:**
 

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle/_data/catalogue-scaffold/guides/_shared/reference/catalogue-authoring-standards.md

@@ -156,17 +156,51 @@ credentials or private data, prefer synthetic data, stay modest in size, and
 name their licence when sourced externally. Fuzzing corpora, generated output,
 coverage reports, and caches are neither committed nor packaged.
 
+The packager enforces the second half. It prunes these directory names at every
+level of a pack, and never descends into them:
+
+```
+__pycache__  .pytest_cache  .mypy_cache  .ruff_cache  .tox
+.hypothesis  htmlcov  node_modules  .venv  venv
+```
+
+plus `*.pyc`, `*.pyo`, `.DS_Store`, `coverage.xml`, and any `.coverage*` shard.
+A directory you mean to ship must not be named one of those — the drop is
+silent. Note this is matched by name at any depth, so it is deliberately *not*
+the same list as the repository-root exclusions.
+
 ### Repository-root tests
 
 A test concerning one pack stays inside that pack. Behaviour no single pack
 owns — the catalogue system, packaging, shared projection machinery, profiles,
 cross-pack interaction — belongs to the repository, not to a pack.
 
-Where that lives is the repository's call. This catalogue keeps it in the
-engine's own suite (`packages/agentbundle/tests/`) rather than a root `tests/`
-tree; a catalogue that wants the separate tree can add one. Don't create a
-top-level directory for a single test — the ownership rule is what matters,
-not the path.
+Where that lives is the repository's call. This catalogue splits it: behaviour
+that exercises the engine keeps to the engine's own suite
+(`packages/agentbundle/tests/`), while cross-pack *lints* — the ones that read
+every pack's tree and belong to no pack — live with the repository's other
+tooling. Neither is a root `tests/` tree; a catalogue that wants the separate
+tree can add one. Don't create a top-level directory for a single test — the
+ownership rule is what matters, not the path.
+
+### One test process per skill
+
+Run each skill's suite in its own process. This is a correctness requirement,
+not a performance preference.
+
+Skills are independent, so two of them may reasonably ship a `render.py`, and
+their suites may both be called `test_render.py`. Collect them into one pytest
+run and two things break: pytest refuses the duplicate test basenames outright
+(`import file mismatch`), and if it did not, the first `render` module imported
+would serve every suite that expects its own.
+
+```
+pytest packs/<pack>/tests/skills/<skill>/     # one invocation per skill
+```
+
+An invocation that spans two skill test directories is safe only while their
+basenames happen not to collide — which is a property of today's contents, not
+of the layout. Keep the invocations separate and the question never arises.
 
 ### Normative summary
 

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle/_data/catalogue-scaffold/manifest.json

@@ -1,8 +1,8 @@
 {
   "files": {
-    "guides/_shared/reference/catalogue-authoring-standards.md": "0d278062872d62d059e322bae9e5af9f573d79bc93ff24ca18fb750705da5cc6",
+    "guides/_shared/reference/catalogue-authoring-standards.md": "cec0f7afd7a0bf61d7bedd9facd096b083cb7413679a6fbcd0af28d40bece58c",
     "guides/_shared/reference/catalogue-ci-contract.md": "fae793ab47989b6dd3c731afcb0b4cda21c7d08bbe7fa40fca6d3abb3d158141",
-    "packs/AGENTS.md": "7b534acfdaab757079ca678d9290c2257267d7f4e0b4b3c3401d9da22cb4be0b",
+    "packs/AGENTS.md": "861a029007741cd7645cdfcc018e5ac85cf218d332f6688115156c9c676381b8",
     "packs/README.md": "d2de5f9556f4c8e521103474bde74636e02cc805f9bf5312a3a61a1f3eb45d8f",
     "packs/_example/.apm/skills/example-skill/SKILL.md": "33be8cbf4b2c014a5a63e788b7d0b350ad8061c6c4b2579369a3e984135bf9f1",
     "packs/_example/.apm/skills/example-skill/evals/eval_queries.json": "f41ecda0834a22f3b4823c81ab02e58b0e4beba610e3b40c185579abff9cfeee",

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle/_data/catalogue-scaffold/packs/AGENTS.md

@@ -6,8 +6,9 @@ Read `packs/AGENTS.local.md` when present — it carries host-specific overrides
 ## Pack layout
 
 The pack is the ownership and test-execution boundary; `.apm/` is the runtime export boundary; a skill is the
-evaluation-fixture boundary. Tests go in `packs/<pack>/tests/`, never under `.apm/`. Evals stay skill-local at
-`.apm/skills/<skill>/evals/` and project with the skill.
+evaluation-fixture boundary. Tests go in `packs/<pack>/tests/`, never under `.apm/`; evals stay skill-local at
+`.apm/skills/<skill>/evals/` and project with the skill. `tools/lint-pack-test-boundary.py` enforces both across
+every pack, plus one pytest process per skill test dir. Shape: `docs/architecture/pack-layout.md`.
 
 | Path | Purpose |
 |------|---------|

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle/catalogue_tooling/package.py

@@ -62,14 +62,60 @@ _REQUIRED_PATHS: tuple[str, ...] = (
 )
 
 # Implicit denylist — top-level directories always excluded regardless of include.
-_IMPLICIT_DENY_DIRS: frozenset[str] = frozenset({
-    ".git",
-    "tools",
-    "packages",
-    "dist",
+# Build residue: never authored, never packaged. Pruned at *every* level of every
+# collection walk, so a cache anywhere under an included root is dropped.
+#
+# This replaces an earlier `_IMPLICIT_DENY_DIRS` that also listed `.git`,
+# `tools`, `packages` and `dist`. That set was referenced nowhere — the archive
+# collected caches for as long as it has existed — and it could not simply be
+# applied as written: those four are *repository-root* names, already excluded
+# because `_DEFAULT_INCLUDE_DIRS` is an allowlist, and pruning them at every
+# level would have silently dropped real content. `packs/monorepo-extras/seeds/packages/`
+# is exactly that case.
+#
+# `catalogue-authoring-standards.md` § 4 tells adopters that caches, coverage
+# output and generated artefacts are "neither committed nor packaged". This is
+# what makes the second half true.
+_TRANSIENT_DIRS: frozenset[str] = frozenset({
     "__pycache__",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".ruff_cache",
+    ".tox",
+    "node_modules",
+    ".venv",
+    "venv",
+    "htmlcov",
+    ".hypothesis",
 })
 
+# Same idea, for files that sit beside authored content rather than in a cache
+# directory of their own.
+_TRANSIENT_FILE_SUFFIXES: tuple[str, ...] = (".pyc", ".pyo")
+_TRANSIENT_FILE_NAMES: frozenset[str] = frozenset({".DS_Store", "coverage.xml"})
+
+
+def _is_transient_file(p: Path) -> bool:
+    # `.coverage` by prefix, not equality: `coverage combine` writes shards named
+    # `.coverage.<host>.<pid>.<random>`, whose suffix is the random component.
+    return (
+        p.name in _TRANSIENT_FILE_NAMES
+        or p.name.startswith(".coverage")
+        or p.suffix in _TRANSIENT_FILE_SUFFIXES
+    )
+
+
+def _prune(dp: Path, dirnames: list[str]) -> None:
+    """Drop symlinked and build-residue directories from an `os.walk` descent.
+
+    Mutates `dirnames` in place — that is how `os.walk` is told not to descend.
+    """
+    dirnames[:] = [
+        dn for dn in dirnames
+        if dn not in _TRANSIENT_DIRS and not (dp / dn).is_symlink()
+    ]
+
+
 # Path-safety pattern for --bundle/--release/--channel flag values.
 _SAFE_NAME_RE = re.compile(r"^[A-Za-z0-9\-._]+$")
 
@@ -111,17 +157,22 @@ def _scan_content(root: Path, pack_include: list[str] | None = None) -> list[Pat
                     f"contain path traversal components"
                 )
             d = root / entry
-            if not d.is_dir():
+            if not d.is_dir() or d.is_symlink():
                 raise ValueError(
                     f"pack_include entry {entry!r} does not exist on disk at {d}"
                 )
+            if Path(entry).name in _TRANSIENT_DIRS:
+                raise ValueError(
+                    f"pack_include entry {entry!r} names build residue; "
+                    f"it is never packaged"
+                )
             for dirpath, dirnames, filenames in os.walk(str(d), followlinks=False):
                 dp = Path(dirpath)
+                _prune(dp, dirnames)
                 for fname in filenames:
                     p = dp / fname
-                    if p.is_file() and not p.is_symlink():
+                    if p.is_file() and not p.is_symlink() and not _is_transient_file(p):
                         collected.append(p)
-                dirnames[:] = [dn for dn in dirnames if not (dp / dn).is_symlink()]
         for dir_parts in _DEFAULT_INCLUDE_DIRS:
             if dir_parts[0] == "packs":
                 continue
@@ -133,15 +184,12 @@ def _scan_content(root: Path, pack_include: list[str] | None = None) -> list[Pat
                 dp = Path(dirpath)
                 for fname in filenames:
                     p = dp / fname
-                    if p.is_file() and not p.is_symlink():
+                    if p.is_file() and not p.is_symlink() and not _is_transient_file(p):
                         collected.append(p)
+                _prune(dp, dirnames)
                 if is_catalogue_root and dp == d:
-                    dirnames[:] = [
-                        dn for dn in dirnames
-                        if not dn.startswith("_") and not (dp / dn).is_symlink()
-                    ]
-                else:
-                    dirnames[:] = [dn for dn in dirnames if not (dp / dn).is_symlink()]
+                    # Reserved authoring dirs, at the catalogue root only.
+                    dirnames[:] = [dn for dn in dirnames if not dn.startswith("_")]
     else:
         for dir_parts in _DEFAULT_INCLUDE_DIRS:
             d = root.joinpath(*dir_parts)
@@ -152,16 +200,12 @@ def _scan_content(root: Path, pack_include: list[str] | None = None) -> list[Pat
                 dp = Path(dirpath)
                 for fname in filenames:
                     p = dp / fname
-                    if p.is_file() and not p.is_symlink():
+                    if p.is_file() and not p.is_symlink() and not _is_transient_file(p):
                         collected.append(p)
-                # At packs/ and profiles/ root level, exclude reserved authoring dirs.
+                _prune(dp, dirnames)
                 if is_catalogue_root and dp == d:
-                    dirnames[:] = [
-                        dn for dn in dirnames
-                        if not dn.startswith("_") and not (dp / dn).is_symlink()
-                    ]
-                else:
-                    dirnames[:] = [dn for dn in dirnames if not (dp / dn).is_symlink()]
+                    # Reserved authoring dirs, at the catalogue root only.
+                    dirnames[:] = [dn for dn in dirnames if not dn.startswith("_")]
 
     for fname in _DEFAULT_INCLUDE_ROOT_FILES:
         p = root / fname
@@ -226,17 +270,27 @@ def _validate_content(root: Path, content_paths: list[Path]) -> str | None:
             if candidate.exists() and candidate.is_symlink():
                 return f"error: symlink not allowed: {candidate}"
 
-    # 4. Symlink walk inside allowlisted dirs
+    # 4. Symlink walk inside allowlisted dirs.
+    #    Scoped to what the archive actually collects. Build residue is pruned
+    #    the same way `_scan_content` prunes it — otherwise a real `node_modules`
+    #    (whose `.bin/` is always symlinks) or a virtualenv aborts packaging for
+    #    files that were never going to ship.
     for dir_parts in _DEFAULT_INCLUDE_DIRS:
         d = root.joinpath(*dir_parts)
         if not d.is_dir() or d.is_symlink():
             continue
         for dirpath, dirnames, filenames in os.walk(str(d), followlinks=False):
             dp = Path(dirpath)
+            # Check *before* pruning: `_prune` drops symlinked directories, and
+            # a symlinked directory in authored content is precisely what this
+            # step exists to reject. Only build residue is skipped.
             for entry in list(dirnames) + list(filenames):
                 full = dp / entry
+                if entry in _TRANSIENT_DIRS or _is_transient_file(full):
+                    continue
                 if full.is_symlink():
                     return f"error: symlink not allowed: {full}"
+            _prune(dp, dirnames)
 
     # 5. Hard-link detection (POSIX only)
     for p in content_paths:
@@ -260,6 +314,8 @@ def _validate_content(root: Path, content_paths: list[Path]) -> str | None:
             continue
         if pack_dir.name.startswith("_"):
             continue
+        if pack_dir.name in _TRANSIENT_DIRS:
+            continue  # build residue, not a pack — and not in the archive
         pack_toml_path = pack_dir / "pack.toml"
         try:
             pack_data = load_pack_toml(pack_toml_path)
@@ -771,10 +827,10 @@ def package_source_flavour(
         if d.is_dir() and not d.is_symlink():
             for dirpath, dirnames, filenames in os.walk(str(d), followlinks=False):
                 dp = Path(dirpath)
-                dirnames[:] = [dn for dn in dirnames if not (dp / dn).is_symlink()]
+                _prune(dp, dirnames)
                 for fname in filenames:
                     fp = dp / fname
-                    if fp.is_file() and not fp.is_symlink():
+                    if fp.is_file() and not fp.is_symlink() and not _is_transient_file(fp):
                         collected.append(fp)
 
     # guides/_shared/
@@ -782,10 +838,10 @@ def package_source_flavour(
     if guides_shared.is_dir() and not guides_shared.is_symlink():
         for dirpath, dirnames, filenames in os.walk(str(guides_shared), followlinks=False):
             dp = Path(dirpath)
-            dirnames[:] = [dn for dn in dirnames if not (dp / dn).is_symlink()]
+            _prune(dp, dirnames)
             for fname in filenames:
                 fp = dp / fname
-                if fp.is_file() and not fp.is_symlink():
+                if fp.is_file() and not fp.is_symlink() and not _is_transient_file(fp):
                     collected.append(fp)
 
     # .claude-plugin/marketplace.json

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle/catalogue_tooling/self_host_windows.py

@@ -84,16 +84,27 @@ def run_windows_compat(root: Path) -> int:
             [py, "-m", "pytest", str(root / "packs" / "core" / "tests" / "hooks")],
             root,
         ),
-        # Atlassian SSO suites (asyncio + SSL-context wiring is platform-sensitive)
+        # Atlassian SSO suites (asyncio + SSL-context wiring is platform-sensitive).
+        # Pack tests live outside the runtime payload (ADR-0071).
+        #
+        # Probe the dependencies first. Both trios `importorskip("credbroker")` at
+        # module scope, and `_step` below judges a step by its return code alone —
+        # so without this, a machine missing credbroker skips both suites entirely
+        # and the step reports pass.
+        (
+            "atlassian SSO dependency probe",
+            [py, "-c", "import credbroker, httpx"],
+            root,
+        ),
         (
             "jira SSO suites (atlassian-sso-cookie)",
             [py, "-m", "pytest", "test_sso_config.py", "test_sso_client.py", "test_setup_sso.py"],
-            root / "packs" / "atlassian" / ".apm" / "skills" / "jira" / "scripts",
+            root / "packs" / "atlassian" / "tests" / "skills" / "jira",
         ),
         (
             "confluence-crawler SSO suites (atlassian-sso-cookie)",
             [py, "-m", "pytest", "test_sso_config.py", "test_sso_client.py", "test_setup_sso.py"],
-            root / "packs" / "atlassian" / ".apm" / "skills" / "confluence-crawler" / "scripts",
+            root / "packs" / "atlassian" / "tests" / "skills" / "confluence-crawler",
         ),
         # Experience agnosticism lint (proves `python` portability, not `python3`)
         (

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle/version.py

@@ -14,7 +14,7 @@ import tomllib
 from importlib.resources import files
 from pathlib import Path
 
-CLI_VERSION = "0.29.4"
+CLI_VERSION = "0.29.5"
 
 _HERE = Path(__file__).resolve().parent
 

{agentbundle-0.29.4 → agentbundle-0.29.5}/agentbundle.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.29.4
+Version: 0.29.5
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT
@@ -156,6 +156,13 @@ Produces a deterministic, reproducible gzip archive (versioned) and a mutable ch
 descriptor JSON (`stable.json`), ready to upload to Artifactory. Identical inputs
 produce byte-identical archives (honors `SOURCE_DATE_EPOCH`).
 
+Build residue is excluded, so it does not matter whether you packaged a working
+tree you had just tested or npm-installed in. Pruned at every level of a pack:
+`__pycache__`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`, `.tox`,
+`.hypothesis`, `htmlcov`, `node_modules`, `.venv`, `venv` — plus `*.pyc`,
+`*.pyo`, `.DS_Store`, `coverage.xml` and `.coverage*` shards. The drop is
+silent, so do not name a directory you mean to ship after one of those.
+
 **Source distribution for air-gapped or self-hosted catalogues:**
 
 ```bash
@@ -167,7 +174,7 @@ agentbundle catalogue package \
   --output dist/
 ```
 
-Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files). Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
+Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files), with the same build-residue exclusions as the default flavour. Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
 
 **Org bootstrap — ship the default channel in your fork:**
 

{agentbundle-0.29.4 → agentbundle-0.29.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentbundle"
-version = "0.29.4"
+version = "0.29.5"
 description = "npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent."
 requires-python = ">=3.11"
 dependencies = []