agentbundle 0.29.5__tar.gz → 0.29.7__tar.gz

{agentbundle-0.29.5 → agentbundle-0.29.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.29.5
+Version: 0.29.7
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT
@@ -269,7 +269,10 @@ ignore them there; the separation is structural, not incidental.
 `keywords` once; the build projects the cleanly-mappable subset — plus the
 pack's `README.md` — into each distribution route's manifest (the `plugin.json`
 / `marketplace.json` entry), so the catalogue describes each pack richly rather
-than with a single sentence. Extra fields stay in `pack.toml`; the projection
+than with a single sentence. A marketplace entry's `source` is a `git-subdir`
+object (`url`, `path`, and one of `ref`/`sha`) pointing at the pack's directory
+on the published distribution branch, and every entry is schema-validated at
+build time against `marketplace-entry.schema.json`. Extra fields stay in `pack.toml`; the projection
 is deliberately lossy per tool.
 
 Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
@@ -285,8 +288,9 @@ The org hint fires after the user-config but before the on-disk IDE probe — so
 
 **Bundled contracts** — the wheel ships the machine contracts used for offline validation:
 `pack.schema.json`, `skill.schema.json`, `guide.schema.json`, `skill-manifest.schema.json`,
-`profile.schema.json`, `catalogue.schema.json`, `target-vocab.toml`, and the adapter
-contract files. All are available without network access via `importlib.resources`.
+`profile.schema.json`, `catalogue.schema.json`, `plugin-manifest.schema.json`,
+`plugin-manifest.derived.schema.json`, `marketplace-entry.schema.json`,
+`target-vocab.toml`, and the adapter contract files. All are available without network access via `importlib.resources`.
 
 **Lint your catalogue** — shallow structural checks run without extra dependencies:
 

{agentbundle-0.29.5 → agentbundle-0.29.7}/README-pypi.md

@@ -247,7 +247,10 @@ ignore them there; the separation is structural, not incidental.
 `keywords` once; the build projects the cleanly-mappable subset — plus the
 pack's `README.md` — into each distribution route's manifest (the `plugin.json`
 / `marketplace.json` entry), so the catalogue describes each pack richly rather
-than with a single sentence. Extra fields stay in `pack.toml`; the projection
+than with a single sentence. A marketplace entry's `source` is a `git-subdir`
+object (`url`, `path`, and one of `ref`/`sha`) pointing at the pack's directory
+on the published distribution branch, and every entry is schema-validated at
+build time against `marketplace-entry.schema.json`. Extra fields stay in `pack.toml`; the projection
 is deliberately lossy per tool.
 
 Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
@@ -263,8 +266,9 @@ The org hint fires after the user-config but before the on-disk IDE probe — so
 
 **Bundled contracts** — the wheel ships the machine contracts used for offline validation:
 `pack.schema.json`, `skill.schema.json`, `guide.schema.json`, `skill-manifest.schema.json`,
-`profile.schema.json`, `catalogue.schema.json`, `target-vocab.toml`, and the adapter
-contract files. All are available without network access via `importlib.resources`.
+`profile.schema.json`, `catalogue.schema.json`, `plugin-manifest.schema.json`,
+`plugin-manifest.derived.schema.json`, `marketplace-entry.schema.json`,
+`target-vocab.toml`, and the adapter contract files. All are available without network access via `importlib.resources`.
 
 **Lint your catalogue** — shallow structural checks run without extra dependencies:
 

{agentbundle-0.29.5 → agentbundle-0.29.7}/agentbundle/_data/adapter.toml

@@ -188,12 +188,14 @@ install-routes = ["cli", "claude-plugins", "apm"]
 primitive = "skill"
 mode = "direct-directory"
 target-path = ".claude/skills/"
+plugin-target-path = "skills/"
 on-conflict = "prompt-then-preserve"
 
 [[adapter."claude-code".projection]]
 primitive = "agent"
 mode = "direct-file"
 target-path = ".claude/agents/"
+plugin-target-path = "agents/"
 on-conflict = "prompt-then-preserve"
 
 [[adapter."claude-code".projection]]
@@ -213,6 +215,7 @@ on-conflict = "merge-managed-key-only"
 primitive = "command"
 mode = "direct-file"
 target-path = ".claude/commands/"
+plugin-target-path = "commands/"
 on-conflict = "prompt-then-preserve"
 
 # hook-body — scope-conditional target.

{agentbundle-0.29.5 → agentbundle-0.29.7}/agentbundle/_data/catalogue-scaffold/manifest.json

@@ -2,7 +2,7 @@
   "files": {
     "guides/_shared/reference/catalogue-authoring-standards.md": "cec0f7afd7a0bf61d7bedd9facd096b083cb7413679a6fbcd0af28d40bece58c",
     "guides/_shared/reference/catalogue-ci-contract.md": "fae793ab47989b6dd3c731afcb0b4cda21c7d08bbe7fa40fca6d3abb3d158141",
-    "packs/AGENTS.md": "861a029007741cd7645cdfcc018e5ac85cf218d332f6688115156c9c676381b8",
+    "packs/AGENTS.md": "9bfeda4069826e518a4f4fdae45bd40f4393c1c5aaf146149d3eb4aece30be83",
     "packs/README.md": "d2de5f9556f4c8e521103474bde74636e02cc805f9bf5312a3a61a1f3eb45d8f",
     "packs/_example/.apm/skills/example-skill/SKILL.md": "33be8cbf4b2c014a5a63e788b7d0b350ad8061c6c4b2579369a3e984135bf9f1",
     "packs/_example/.apm/skills/example-skill/evals/eval_queries.json": "f41ecda0834a22f3b4823c81ab02e58b0e4beba610e3b40c185579abff9cfeee",

{agentbundle-0.29.5 → agentbundle-0.29.7}/agentbundle/_data/catalogue-scaffold/packs/AGENTS.md

@@ -6,9 +6,11 @@ Read `packs/AGENTS.local.md` when present — it carries host-specific overrides
 ## Pack layout
 
 The pack is the ownership and test-execution boundary; `.apm/` is the runtime export boundary; a skill is the
-evaluation-fixture boundary. Tests go in `packs/<pack>/tests/`, never under `.apm/`; evals stay skill-local at
-`.apm/skills/<skill>/evals/` and project with the skill. `tools/lint-pack-test-boundary.py` enforces both across
-every pack, plus one pytest process per skill test dir. Shape: `docs/architecture/pack-layout.md`.
+evaluation-fixture boundary. Skill tests go in `packs/<pack>/tests/skills/<skill>/` and hook tests in
+`packs/<pack>/tests/hooks/` — never under `.apm/`, which adapters project verbatim into an installed tree.
+Evals stay skill-local at `.apm/skills/<skill>/evals/` and project with the skill. Run **one pytest process
+per skill test directory**: two skills may ship the same test basename, and a shared `sys.path` binds one
+skill's module for both suites and passes green.
 
 | Path | Purpose |
 |------|---------|
@@ -28,14 +30,13 @@ every pack, plus one pytest process per skill test dir. Shape: `docs/architectur
 
 ## Reserved authoring assets
 
-Any immediate child of the packs root whose name begins with `_` is a reserved authoring asset.
-Reserved directories are not catalogue payload — they do not appear in `list-packs`, are not
-installed, and are not included in packaged archives. See `packs/README.md`.
+Any immediate child of the packs root whose name begins with `_` is a reserved authoring asset: not
+catalogue payload, absent from `list-packs`, never installed or packaged. See `packs/README.md`.
 
 ## pack.toml schema map
 
-> The machine source of truth for pack.toml format is `contracts/pack.schema.json`.
-> The table below is a navigational summary; the JSON Schema is normative.
+> The normative source for pack.toml format is the `pack` JSON Schema that ships inside `agentbundle`;
+> `agentbundle catalogue lint --root .` validates against it. The table below is a navigational summary.
 
 | Table | Required fields | Notable optional fields |
 |-------|----------------|------------------------|
@@ -64,14 +65,14 @@ For CI pipeline orchestration — publication ordering, exit codes, JSON output
 
 ## Version bump rule
 
-Every **non-cosmetic** change to pack content requires a version bump in both:
-1. `pack.toml` → `[pack] version`
-2. `.claude-plugin/plugin.json` → `"version"`
+Every **non-cosmetic** change to pack content requires a version bump in **both** `pack.toml` →
+`[pack] version` and `.claude-plugin/plugin.json` → `"version"`.
 
 Which increment: **patch** for changed bodies/directives/conventions; **minor** for new primitives;
 **major** for removals. Never ride an unreleased version from another in-flight PR.
 
-Host-specific post-bump steps (changelog, marketplace regeneration) are in `packs/AGENTS.local.md`.
+Further post-bump steps (changelog, marketplace regeneration) are host-specific — see `AGENTS.local.md` if
+your catalogue has one.
 
 ## Self-hosting projection
 
@@ -80,52 +81,50 @@ projects them to every shipped adapter's layout. Never edit a projected output d
 
 On a dirty working tree: `agentbundle catalogue self-host --root . --write --force`.
 
-**Critical ordering:** when a session edits both seeds and non-seed pack sources (`.apm/**`,
-`pack.toml`), run self-host AFTER all edits — not between them.
+**Critical ordering:** when a session edits both seeds and non-seed pack sources (`.apm/**`, `pack.toml`),
+run self-host AFTER all edits — not between them.
 
 ## Claude plugin JSON format
 
-Each pack's `.claude-plugin/plugin.json` is validated against `contracts/plugin-manifest.schema.json`.
-Non-compliant manifests block publishing.
+Each pack's `.claude-plugin/plugin.json` is validated against the plugin-manifest JSON Schema that ships
+inside `agentbundle`; `agentbundle catalogue lint --root .` reports violations. Non-compliant manifests
+block publishing.
 
 **Required:** `name` (string), `version` (string matching `pack.toml`), `description` (string).
 
-**Allowed optional fields** — `skills`, `agents` (arrays of strings); `author` (`{name, email?}`);
-`license`, `homepage`, `repository`, `category`, `displayName` (strings); `keywords` (array);
-`source` (`{source, repo, branch, directory}`).
+**Allowed optional fields** — `skills`, `agents` (arrays of strings); `author` (`{name, email?}`); `license`,
+`homepage`, `repository`, `category`, `displayName` (strings); `keywords` (array); `source`
+(`{source, repo, branch, directory}`).
 
 `additionalProperties: false` — any unknown key fails validation.
 
 ## Authoring or editing a skill
 
-`README.md` states pack intent and the user journey it serves — not a contributor capability list.
-Edit `.apm/skills/<name>/SKILL.md`. Run self-host to project. Run
-`agentbundle catalogue lint --root . --deep` to confirm spec compliance.
+`README.md` states pack intent and the user journey it serves — not a contributor capability list. Edit
+`.apm/skills/<name>/SKILL.md`, run self-host to project, then `agentbundle catalogue lint --root . --deep`.
 
-Full authoring standards — frontmatter key whitelist, body structure, naming, three-tier dependency
-policy, and evals — live in [`guides/_shared/how-to/author-a-skill.md`](../guides/_shared/how-to/author-a-skill.md).
+Full authoring standards — frontmatter key whitelist, body structure, naming, three-tier dependency policy,
+evals — live in [`catalogue-authoring-standards.md`](../guides/_shared/reference/catalogue-authoring-standards.md).
 
 ## Eval coverage
 
 A non-cosmetic pack update must also update the pack's eval harness:
-- **Tier-A activation** — `evals/eval_queries.json` (~8–10 should-trigger + ~8–10 near-miss) and
-  a `[pack.evals]` block in `pack.toml` listing every user-triggered skill.
+- **Tier-A activation** — `evals/eval_queries.json` (~8–10 should-trigger + ~8–10 near-miss) and a
+  `[pack.evals]` block in `pack.toml` listing every user-triggered skill.
 - **Tier-4 LLM-judge rubric** — `evals/evals.json` for judgment/authoring skills.
 - **Tier-B-lite behavior check** — add an `expect` block to an `evals/evals.json` entry (non-destructive,
-  non-credentialed skills only). Four things that must be explicit to avoid format churn:
-  - Field name is **`files`** (not `fixture`): paths are relative to the **skill root**
-    (e.g. `"evals/files/sample.md"`), not relative to `evals/`. The runner seeds a temp workspace
-    with these files before invoking the skill.
+  non-credentialed skills only). Four things must be explicit, or the format churns:
+  - The field is **`files`**, not `fixture`, and its paths are relative to the **skill root**
+    (`"evals/files/sample.md"`) — not to `evals/`. The runner seeds a temp workspace with them first.
   - `expect.produces`: filenames the run must create in the workspace.
   - `expect.output_contains` / `expect.output_excludes`: substrings in captured output.
-  - **Your skill script must accept the workspace path** — via a `--fixture`/`--root` flag or by
-    treating CWD as the workspace — so the runner can confine writes and verify `produces`.
-  Full procedure: [`guides/_shared/how-to/author-a-skill.md`](../guides/_shared/how-to/author-a-skill.md).
+  - **Your skill script must accept the workspace path** — a `--fixture`/`--root` flag, or treat CWD as
+    the workspace — so the runner can confine writes and verify `produces`.
+  Full procedure: [`guides/_shared/reference/catalogue-authoring-standards.md`](../guides/_shared/reference/catalogue-authoring-standards.md).
 
 ## Windows-safe Python scripts
 
-Any script under `.apm/` that prints to stdout or stderr must include the UTF-8 reconfigure guard
-immediately after `import sys`, before any `print()` call:
+Any script under `.apm/` that prints to stdout or stderr must include the UTF-8 reconfigure guard immediately after `import sys`, before any `print()` call:
 
 ```python
 sys.stdout.reconfigure(encoding="utf-8", errors="strict")
@@ -145,6 +144,7 @@ Stubs in `plan.md` tasks must be `raise NotImplementedError  # STUB: ACn` — no
 
 ## Shipped pack content carries no internal-governance citations
 
-Anywhere under `packs/` — `.apm/**`, `pack.toml`, `README`/`JOURNEY`/`DESIGN`, `seeds/**` —
-never cite this catalogue's own governance: `RFC-0NNN`, `ADR-0NNN`, spec/plan or AC citations,
-internal doc paths. Keep the rule, drop the citation. Detail: `packs/AGENTS.local.md`.
+Anywhere under `packs/` — `.apm/**`, `pack.toml`, `README`/`JOURNEY`/`DESIGN`, `seeds/**` — never cite your
+catalogue's own governance: decision-record or proposal numbers, spec/plan or acceptance-criterion citations,
+or repository-only paths. Shipped content lands in someone else's tree, where each is a dead end. **Keep the
+rule, drop the citation** — state what the reader must do, in full.

agentbundle-0.29.7/agentbundle/_data/marketplace-entry.schema.json

@@ -0,0 +1,110 @@
+{
+  "x-spec": "docs/specs/claude-plugins-manifest-correctness",
+  "type": "object",
+  "required": [
+    "name",
+    "version",
+    "description"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "skills": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "agents": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "author": {
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "email": {
+          "type": "string"
+        }
+      }
+    },
+    "license": {
+      "type": "string"
+    },
+    "homepage": {
+      "type": "string"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "keywords": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "displayName": {
+      "type": "string"
+    },
+    "category": {
+      "type": "string"
+    },
+    "source": {
+      "type": "object",
+      "required": [
+        "source",
+        "url",
+        "path"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "enum": [
+            "git-subdir"
+          ]
+        },
+        "url": {
+          "type": "string",
+          "pattern": "^https://github\\.com/[^/]+/[^/]+\\.git$"
+        },
+        "path": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "ref": {
+          "type": "string"
+        },
+        "sha": {
+          "type": "string"
+        }
+      },
+      "if": {
+        "required": [
+          "ref"
+        ]
+      },
+      "then": {},
+      "else": {
+        "required": [
+          "sha"
+        ]
+      }
+    }
+  }
+}

agentbundle-0.29.7/agentbundle/_data/plugin-manifest.derived.schema.json

@@ -0,0 +1,147 @@
+{
+  "x-spec": "docs/specs/claude-plugins-manifest-correctness",
+  "type": "object",
+  "required": [
+    "name",
+    "version",
+    "description"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "skills": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "agents": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "author": {
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "email": {
+          "type": "string"
+        }
+      }
+    },
+    "license": {
+      "type": "string"
+    },
+    "homepage": {
+      "type": "string"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "keywords": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "displayName": {
+      "type": "string"
+    },
+    "source": {
+      "type": "object",
+      "required": [
+        "source",
+        "url",
+        "path"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "enum": [
+            "git-subdir"
+          ]
+        },
+        "url": {
+          "type": "string",
+          "pattern": "^https://github\\.com/[^/]+/[^/]+\\.git$"
+        },
+        "path": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "ref": {
+          "type": "string"
+        },
+        "sha": {
+          "type": "string"
+        }
+      },
+      "if": {
+        "required": [
+          "ref"
+        ]
+      },
+      "then": {},
+      "else": {
+        "required": [
+          "sha"
+        ]
+      }
+    },
+    "hooks": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "SessionStart": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "hooks": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "required": [
+                    "type",
+                    "command"
+                  ],
+                  "additionalProperties": false,
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "enum": [
+                        "command"
+                      ]
+                    },
+                    "command": {
+                      "type": "string"
+                    },
+                    "timeout": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

agentbundle-0.29.7/agentbundle/_data/plugin-manifest.schema.json

@@ -0,0 +1,110 @@
+{
+  "x-spec": "docs/specs/claude-plugins-manifest-correctness",
+  "type": "object",
+  "required": [
+    "name",
+    "version",
+    "description"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "skills": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "agents": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "author": {
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "email": {
+          "type": "string"
+        }
+      }
+    },
+    "license": {
+      "type": "string"
+    },
+    "homepage": {
+      "type": "string"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "keywords": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "category": {
+      "type": "string"
+    },
+    "displayName": {
+      "type": "string"
+    },
+    "source": {
+      "type": "object",
+      "required": [
+        "source",
+        "url",
+        "path"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "enum": [
+            "git-subdir"
+          ]
+        },
+        "url": {
+          "type": "string",
+          "pattern": "^https://github\\.com/[^/]+/[^/]+\\.git$"
+        },
+        "path": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "ref": {
+          "type": "string"
+        },
+        "sha": {
+          "type": "string"
+        }
+      },
+      "if": {
+        "required": [
+          "ref"
+        ]
+      },
+      "then": {},
+      "else": {
+        "required": [
+          "sha"
+        ]
+      }
+    }
+  }
+}

{agentbundle-0.29.5 → agentbundle-0.29.7}/agentbundle/build/adapters/claude_code.py

@@ -62,11 +62,33 @@ def project_packs(pack_paths: list[Path], contract: dict, output_root: Path) ->
 # Mirror of kiro.py:_skill_direct_directory_target — keep in sync.
 # A shared helper is barred by the spec's `Never do` boundary (no
 # expansion of projections/direct_directory.py beyond `sweep_orphans`).
+def _resolve_target(output_root: Path, target_path: str) -> Path:
+    """Join a contract ``target-path`` onto ``output_root``, confined.
+
+    ``target-path`` (and its route-scoped sibling ``plugin-target-path``) are
+    contract *data*. An absolute value discards the base entirely on join
+    (``Path("/a/b") / "/etc/x"`` is ``/etc/x``) and a ``..``-bearing one walks
+    out of it — and because the orphan sweep resolves the same value, an
+    escaped target becomes the root of a ``shutil.rmtree``. Confine after
+    resolution rather than trusting the string (CWE-73, not just CWE-22).
+    """
+    candidate = output_root / target_path.rstrip("/")
+    root_resolved = output_root.resolve()
+    try:
+        candidate.resolve().relative_to(root_resolved)
+    except ValueError:
+        raise ValueError(
+            f"claude-code: target-path {target_path!r} escapes the output root "
+            f"{output_root}"
+        ) from None
+    return candidate
+
+
 def _skill_direct_directory_target(contract: dict, output_root: Path) -> Path | None:
     adapter_block = contract["adapter"]["claude-code"]
     for entry in adapter_block.get("projection", []):
         if entry.get("primitive") == "skill" and entry.get("mode") == "direct-directory":
-            return output_root / entry["target-path"].rstrip("/")
+            return _resolve_target(output_root, entry["target-path"])
     return None
 
 
@@ -128,8 +150,11 @@ def _project_single(pack_path: Path, contract: dict, output_root: Path) -> None:
             continue
 
         if mode == "direct-directory":
-            _project_direct_directory(source_dir, output_root / rule["target-path"].rstrip("/"))
+            _project_direct_directory(
+                source_dir, _resolve_target(output_root, rule["target-path"])
+            )
         elif mode == "direct-file":
+            _resolve_target(output_root, rule["target-path"])  # confinement check
             _project_direct_file(source_dir, output_root, rule["target-path"])
         elif mode == "merge-json":
             project_merge_json(source_dir, output_root, rule)