agentbundle 0.3.0__tar.gz → 0.3.1__tar.gz

agentbundle-0.3.1/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: agentbundle
+Version: 0.3.1
+Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
+Author-email: eugenelim <eugenelim@users.noreply.github.com>
+License: Apache-2.0 OR MIT
+Project-URL: Homepage, https://github.com/eugenelim/agent-ready-repo
+Project-URL: Source, https://github.com/eugenelim/agent-ready-repo
+Project-URL: Documentation, https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/install-agentbundle-from-clone.md
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# agentbundle
+
+[![PyPI](https://img.shields.io/pypi/v/agentbundle)](https://pypi.org/project/agentbundle/)
+[![Python](https://img.shields.io/pypi/pyversions/agentbundle)](https://pypi.org/project/agentbundle/)
+[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue)](https://github.com/eugenelim/agent-ready-repo#license)
+
+**The installer for [agent-ready-repo](https://github.com/eugenelim/agent-ready-repo).** Think npm, but for the skills, subagents, and hooks your coding agent runs on.
+
+`agentbundle` installs packs of agent primitives into your repo or your home directory. It projects each primitive into the layout every agent expects. One pack. One command. Every major agent.
+
+```bash
+pip install agentbundle
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo
+```
+
+That lands `core`, the flagship pack and the loop itself, in your repo. Claude Code, Codex, Cursor, Copilot, Gemini, and Kiro all read it.
+
+## Common commands
+
+```bash
+# See what's in a catalogue
+agentbundle list-packs git+https://github.com/eugenelim/agent-ready-repo
+
+# Install the flagship loop into this repo
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo
+
+# Install a pack at user scope, so it follows you across every project
+agentbundle install --pack research git+https://github.com/eugenelim/agent-ready-repo --scope user
+
+# Preview an install without writing a file
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo --dry-run
+
+# Upgrade a pack; it reports the .upstream files you need to reconcile
+agentbundle upgrade --pack core --to 0.4.0 git+https://github.com/eugenelim/agent-ready-repo
+```
+
+A catalogue is a git URL or a local path. Installs auto-detect your agent; pass `--adapter` to override.
+
+## Build your own catalogue
+
+`agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it. A pack is a directory:
+
+```text
+my-pack/
+  pack.toml                  # name, version, adapter-contract, install scope
+  .apm/
+    skills/<name>/SKILL.md    # one folder per skill
+    agents/<name>.md          # subagents
+    hooks/<name>.py           # lifecycle hooks
+  seeds/                      # files scaffolded into the adopter repo
+```
+
+Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
+
+See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/author-a-skill.md).
+
+## Credentials
+
+`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+
+## Learn more
+
+The full story — the loop, the reviewers, the pack catalogue — is in the [agent-ready-repo README](https://github.com/eugenelim/agent-ready-repo#readme).

agentbundle-0.3.1/README.md

@@ -0,0 +1,63 @@
+# agentbundle
+
+[![PyPI](https://img.shields.io/pypi/v/agentbundle)](https://pypi.org/project/agentbundle/)
+[![Python](https://img.shields.io/pypi/pyversions/agentbundle)](https://pypi.org/project/agentbundle/)
+[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue)](https://github.com/eugenelim/agent-ready-repo#license)
+
+**The installer for [agent-ready-repo](https://github.com/eugenelim/agent-ready-repo).** Think npm, but for the skills, subagents, and hooks your coding agent runs on.
+
+`agentbundle` installs packs of agent primitives into your repo or your home directory. It projects each primitive into the layout every agent expects. One pack. One command. Every major agent.
+
+```bash
+pip install agentbundle
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo
+```
+
+That lands `core`, the flagship pack and the loop itself, in your repo. Claude Code, Codex, Cursor, Copilot, Gemini, and Kiro all read it.
+
+## Common commands
+
+```bash
+# See what's in a catalogue
+agentbundle list-packs git+https://github.com/eugenelim/agent-ready-repo
+
+# Install the flagship loop into this repo
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo
+
+# Install a pack at user scope, so it follows you across every project
+agentbundle install --pack research git+https://github.com/eugenelim/agent-ready-repo --scope user
+
+# Preview an install without writing a file
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo --dry-run
+
+# Upgrade a pack; it reports the .upstream files you need to reconcile
+agentbundle upgrade --pack core --to 0.4.0 git+https://github.com/eugenelim/agent-ready-repo
+```
+
+A catalogue is a git URL or a local path. Installs auto-detect your agent; pass `--adapter` to override.
+
+## Build your own catalogue
+
+`agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it. A pack is a directory:
+
+```text
+my-pack/
+  pack.toml                  # name, version, adapter-contract, install scope
+  .apm/
+    skills/<name>/SKILL.md    # one folder per skill
+    agents/<name>.md          # subagents
+    hooks/<name>.py           # lifecycle hooks
+  seeds/                      # files scaffolded into the adopter repo
+```
+
+Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
+
+See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/author-a-skill.md).
+
+## Credentials
+
+`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+
+## Learn more
+
+The full story — the loop, the reviewers, the pack catalogue — is in the [agent-ready-repo README](https://github.com/eugenelim/agent-ready-repo#readme).

{agentbundle-0.3.0 → agentbundle-0.3.1}/agentbundle/catalogue.py

@@ -134,13 +134,14 @@ def _github_archive_url(owner: str, repo: str, ref: str) -> str:
 
 def _fetch_and_extract(url: str, dest: Path) -> None:
     try:
-        with urllib.request.urlopen(url) as resp:  # noqa: S310 — url is assembled from parsed owner/repo/ref
+        # B310: constant github.com archive base assembled from parsed owner/repo/ref.
+        with urllib.request.urlopen(url) as resp:  # nosec B310
             with tarfile.open(fileobj=resp, mode="r|gz") as tf:
                 # filter="data" rejects unsafe members (absolute paths, ..
                 # links, devices, setuid bits) — Python 3.12+ default but
                 # explicit for 3.11 compatibility and to silence the 3.14
                 # DeprecationWarning. Path-jail is belt; this is braces.
-                tf.extractall(path=dest, filter="data")  # noqa: S202
+                tf.extractall(path=dest, filter="data")
     except urllib.error.URLError as exc:
         raise CatalogueError(
             f"Failed to fetch catalogue archive: {url} — {exc.reason}"

{agentbundle-0.3.0 → agentbundle-0.3.1}/agentbundle/config.py

@@ -479,7 +479,7 @@ def finding_id_for(
     contain ``/``.
     """
     raw = f"{pack}:{kind}:{':'.join(sorted(source_paths))}:{':'.join(sorted(dest_paths))}"
-    digest = hashlib.sha1(raw.encode("utf-8")).hexdigest()[:8]
+    digest = hashlib.sha1(raw.encode("utf-8"), usedforsecurity=False).hexdigest()[:8]
     return f"{pack}/{kind}:{digest}"
 
 

agentbundle-0.3.1/agentbundle.egg-info/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: agentbundle
+Version: 0.3.1
+Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
+Author-email: eugenelim <eugenelim@users.noreply.github.com>
+License: Apache-2.0 OR MIT
+Project-URL: Homepage, https://github.com/eugenelim/agent-ready-repo
+Project-URL: Source, https://github.com/eugenelim/agent-ready-repo
+Project-URL: Documentation, https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/install-agentbundle-from-clone.md
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# agentbundle
+
+[![PyPI](https://img.shields.io/pypi/v/agentbundle)](https://pypi.org/project/agentbundle/)
+[![Python](https://img.shields.io/pypi/pyversions/agentbundle)](https://pypi.org/project/agentbundle/)
+[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue)](https://github.com/eugenelim/agent-ready-repo#license)
+
+**The installer for [agent-ready-repo](https://github.com/eugenelim/agent-ready-repo).** Think npm, but for the skills, subagents, and hooks your coding agent runs on.
+
+`agentbundle` installs packs of agent primitives into your repo or your home directory. It projects each primitive into the layout every agent expects. One pack. One command. Every major agent.
+
+```bash
+pip install agentbundle
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo
+```
+
+That lands `core`, the flagship pack and the loop itself, in your repo. Claude Code, Codex, Cursor, Copilot, Gemini, and Kiro all read it.
+
+## Common commands
+
+```bash
+# See what's in a catalogue
+agentbundle list-packs git+https://github.com/eugenelim/agent-ready-repo
+
+# Install the flagship loop into this repo
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo
+
+# Install a pack at user scope, so it follows you across every project
+agentbundle install --pack research git+https://github.com/eugenelim/agent-ready-repo --scope user
+
+# Preview an install without writing a file
+agentbundle install --pack core git+https://github.com/eugenelim/agent-ready-repo --dry-run
+
+# Upgrade a pack; it reports the .upstream files you need to reconcile
+agentbundle upgrade --pack core --to 0.4.0 git+https://github.com/eugenelim/agent-ready-repo
+```
+
+A catalogue is a git URL or a local path. Installs auto-detect your agent; pass `--adapter` to override.
+
+## Build your own catalogue
+
+`agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it. A pack is a directory:
+
+```text
+my-pack/
+  pack.toml                  # name, version, adapter-contract, install scope
+  .apm/
+    skills/<name>/SKILL.md    # one folder per skill
+    agents/<name>.md          # subagents
+    hooks/<name>.py           # lifecycle hooks
+  seeds/                      # files scaffolded into the adopter repo
+```
+
+Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
+
+See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/author-a-skill.md).
+
+## Credentials
+
+`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+
+## Learn more
+
+The full story — the loop, the reviewers, the pack catalogue — is in the [agent-ready-repo README](https://github.com/eugenelim/agent-ready-repo#readme).

{agentbundle-0.3.0 → agentbundle-0.3.1}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentbundle"
-version = "0.3.0"
-description = "Reference CLI and distribution pipeline for the agent-ready-repo adapter contract."
+version = "0.3.1"
+description = "npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent."
 requires-python = ">=3.11"
 dependencies = []
 authors = [{ name = "eugenelim", email = "eugenelim@users.noreply.github.com" }]

agentbundle-0.3.0/PKG-INFO

@@ -1,37 +0,0 @@
-Metadata-Version: 2.4
-Name: agentbundle
-Version: 0.3.0
-Summary: Reference CLI and distribution pipeline for the agent-ready-repo adapter contract.
-Author-email: eugenelim <eugenelim@users.noreply.github.com>
-License: Apache-2.0 OR MIT
-Project-URL: Homepage, https://github.com/eugenelim/agent-ready-repo
-Project-URL: Source, https://github.com/eugenelim/agent-ready-repo
-Project-URL: Documentation, https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/install-agentbundle-from-clone.md
-Classifier: Development Status :: 4 - Beta
-Classifier: License :: OSI Approved :: Apache Software License
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-
-# agentbundle
-
-Runtime library and reference CLI for the
-[agent-ready-repo](https://github.com/eugenelim/agent-ready-repo) adapter
-contract. Ships the `agentbundle` console script — install, validate,
-adapt, and inspect packs — plus the build pipeline (`agentbundle.build`)
-that projects pack sources into adapter-shaped trees.
-
-As of 0.2.0 the `agentbundle.credentials` module that earlier releases
-(0.1.x) exposed has been removed — `agentbundle` no longer ships a
-credential-resolution module. Since RFC-0023, `auth: creds` consumers
-resolve credentials through the standalone, pip-installable `credbroker`
-library, imported in-process (`from credbroker import …`); it replaced the
-build-projected `credentials_shim` sibling, which now survives only as the
-`sso-broker` companion. See the `credbroker` package, RFC-0023, and this
-package's `CHANGELOG.md` for the migration history.
-
-See the [top-level README](https://github.com/eugenelim/agent-ready-repo#readme)
-for install routes, the pack catalogue, and the adapter contract.

agentbundle-0.3.0/README.md

@@ -1,19 +0,0 @@
-# agentbundle
-
-Runtime library and reference CLI for the
-[agent-ready-repo](https://github.com/eugenelim/agent-ready-repo) adapter
-contract. Ships the `agentbundle` console script — install, validate,
-adapt, and inspect packs — plus the build pipeline (`agentbundle.build`)
-that projects pack sources into adapter-shaped trees.
-
-As of 0.2.0 the `agentbundle.credentials` module that earlier releases
-(0.1.x) exposed has been removed — `agentbundle` no longer ships a
-credential-resolution module. Since RFC-0023, `auth: creds` consumers
-resolve credentials through the standalone, pip-installable `credbroker`
-library, imported in-process (`from credbroker import …`); it replaced the
-build-projected `credentials_shim` sibling, which now survives only as the
-`sso-broker` companion. See the `credbroker` package, RFC-0023, and this
-package's `CHANGELOG.md` for the migration history.
-
-See the [top-level README](https://github.com/eugenelim/agent-ready-repo#readme)
-for install routes, the pack catalogue, and the adapter contract.

agentbundle-0.3.0/agentbundle.egg-info/PKG-INFO

@@ -1,37 +0,0 @@
-Metadata-Version: 2.4
-Name: agentbundle
-Version: 0.3.0
-Summary: Reference CLI and distribution pipeline for the agent-ready-repo adapter contract.
-Author-email: eugenelim <eugenelim@users.noreply.github.com>
-License: Apache-2.0 OR MIT
-Project-URL: Homepage, https://github.com/eugenelim/agent-ready-repo
-Project-URL: Source, https://github.com/eugenelim/agent-ready-repo
-Project-URL: Documentation, https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/how-to/install-agentbundle-from-clone.md
-Classifier: Development Status :: 4 - Beta
-Classifier: License :: OSI Approved :: Apache Software License
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-
-# agentbundle
-
-Runtime library and reference CLI for the
-[agent-ready-repo](https://github.com/eugenelim/agent-ready-repo) adapter
-contract. Ships the `agentbundle` console script — install, validate,
-adapt, and inspect packs — plus the build pipeline (`agentbundle.build`)
-that projects pack sources into adapter-shaped trees.
-
-As of 0.2.0 the `agentbundle.credentials` module that earlier releases
-(0.1.x) exposed has been removed — `agentbundle` no longer ships a
-credential-resolution module. Since RFC-0023, `auth: creds` consumers
-resolve credentials through the standalone, pip-installable `credbroker`
-library, imported in-process (`from credbroker import …`); it replaced the
-build-projected `credentials_shim` sibling, which now survives only as the
-`sso-broker` companion. See the `credbroker` package, RFC-0023, and this
-package's `CHANGELOG.md` for the migration history.
-
-See the [top-level README](https://github.com/eugenelim/agent-ready-repo#readme)
-for install routes, the pack catalogue, and the adapter contract.