agentbundle 0.32.0__tar.gz → 0.33.0__tar.gz

{agentbundle-0.32.0/agentbundle.egg-info → agentbundle-0.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.32.0
+Version: 0.33.0
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License-Expression: Apache-2.0 OR MIT
@@ -200,7 +200,12 @@ agentbundle catalogue package \
   --output dist/
 ```
 
-Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files), with the same build-residue exclusions as the default flavour. Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
+Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist
+(`catalogue.toml`, packs, profiles, guides, a marketplace manifest when
+present, and legal files), with the same build-residue exclusions as the
+default flavour. Includes a `self-hosted-source-manifest.json` with per-file
+SHA-256 digests and provenance fields. `agentbundle install` refuses to install
+a source archive, preventing accidental misuse.
 
 **Org bootstrap — ship the default channel in your fork:**
 
@@ -233,7 +238,10 @@ security boundary.
 
 ## Build your own catalogue
 
-`agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it.
+`agentbundle` isn't tied to the agent-ready-repo catalogue. A catalogue source
+has two required root markers: a valid `catalogue.toml` and a literal `packs/`
+directory. A custom `catalogue.paths.packs` value controls where pack content
+is read from; it does not replace the root `packs/` marker.
 
 **Bootstrap a new catalogue** in an empty directory:
 
@@ -334,6 +342,11 @@ The org hint fires after the user-config but before the on-disk IDE probe — so
 agentbundle catalogue lint --root .
 ```
 
+Lint validates both source markers and then checks the configured pack content.
+It requires `.claude-plugin/marketplace.json` only when the effective self-host
+adapters include `claude-code`. A Kiro-only catalogue can omit that Claude
+artifact; the default Claude Code and Codex projection still requires it.
+
 For full [agentskills.io spec](https://agentskills.io/specification) compliance (frontmatter key set, description policy, encoding, evals schema), install the `lint` extra and run with `--deep`:
 
 ```bash

{agentbundle-0.32.0 → agentbundle-0.33.0}/README-pypi.md

@@ -180,7 +180,12 @@ agentbundle catalogue package \
   --output dist/
 ```
 
-Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist (packs, profiles, guides, marketplace manifest, legal files), with the same build-residue exclusions as the default flavour. Includes a `self-hosted-source-manifest.json` with per-file SHA-256 digests and provenance fields. `agentbundle install` refuses to install a source archive, preventing accidental misuse.
+Produces a `catalogue-source-<release>.tar.gz` from a positive allowlist
+(`catalogue.toml`, packs, profiles, guides, a marketplace manifest when
+present, and legal files), with the same build-residue exclusions as the
+default flavour. Includes a `self-hosted-source-manifest.json` with per-file
+SHA-256 digests and provenance fields. `agentbundle install` refuses to install
+a source archive, preventing accidental misuse.
 
 **Org bootstrap — ship the default channel in your fork:**
 
@@ -213,7 +218,10 @@ security boundary.
 
 ## Build your own catalogue
 
-`agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it.
+`agentbundle` isn't tied to the agent-ready-repo catalogue. A catalogue source
+has two required root markers: a valid `catalogue.toml` and a literal `packs/`
+directory. A custom `catalogue.paths.packs` value controls where pack content
+is read from; it does not replace the root `packs/` marker.
 
 **Bootstrap a new catalogue** in an empty directory:
 
@@ -314,6 +322,11 @@ The org hint fires after the user-config but before the on-disk IDE probe — so
 agentbundle catalogue lint --root .
 ```
 
+Lint validates both source markers and then checks the configured pack content.
+It requires `.claude-plugin/marketplace.json` only when the effective self-host
+adapters include `claude-code`. A Kiro-only catalogue can omit that Claude
+artifact; the default Claude Code and Codex projection still requires it.
+
 For full [agentskills.io spec](https://agentskills.io/specification) compliance (frontmatter key set, description policy, encoding, evals schema), install the `lint` extra and run with `--deep`:
 
 ```bash

{agentbundle-0.32.0 → agentbundle-0.33.0}/agentbundle/build/self_host.py

@@ -310,6 +310,11 @@ def _effective_adapters(preferred_adapter: str | None) -> tuple[str, ...]:
     return SELF_HOST_ADAPTERS
 
 
+def projects_claude_artifacts(preferred_adapter: str | None) -> bool:
+    """Return whether self-host projection includes Claude project artifacts."""
+    return "claude-code" in _effective_adapters(preferred_adapter)
+
+
 def _project_all_adapters(
     output_root: Path,
     packs_dir: Path,
@@ -1268,7 +1273,7 @@ def run_self_host(
     # preferred-adapter is kiro-ide or kiro-cli (or any other adapter not in
     # SELF_HOST_ADAPTERS), those artifacts are neither written nor expected in
     # the drift check.
-    _project_claude_artifacts = "claude-code" in _effective_adapters(preferred_adapter)
+    project_claude_artifacts = projects_claude_artifacts(preferred_adapter)
 
     if dry_run:
         with tempfile.TemporaryDirectory(prefix="agentbundle-shadow-") as shadow_str:
@@ -1286,11 +1291,11 @@ def run_self_host(
             except ValueError as exc:
                 print(f"self-host: {exc}", file=sys.stderr)
                 return 4
-            if _project_claude_artifacts:
+            if project_claude_artifacts:
                 _aggregate_marketplace(packs_dir, shadow, owner=owner, name=marketplace_name)
                 _recreate_claude_symlink(shadow, force_copy=no_symlink)
             extra_marker_paths = list(seed_map.keys())
-            if _project_claude_artifacts:
+            if project_claude_artifacts:
                 extra_marker_paths.append(Path(".claude-plugin") / "marketplace.json")
             if agents_path is not None:
                 extra_marker_paths.append(Path("AGENTS.md"))
@@ -1347,11 +1352,11 @@ def run_self_host(
     except ValueError as exc:
         print(f"self-host: {exc}", file=sys.stderr)
         return 4
-    if _project_claude_artifacts:
+    if project_claude_artifacts:
         _aggregate_marketplace(packs_dir, working_tree, owner=owner, name=marketplace_name)
         _recreate_claude_symlink(working_tree, force_copy=no_symlink)
     extra_marker_paths = list(seed_map.keys())
-    if _project_claude_artifacts:
+    if project_claude_artifacts:
         extra_marker_paths.append(Path(".claude-plugin") / "marketplace.json")
     if agents_path is not None:
         extra_marker_paths.append(Path("AGENTS.md"))

{agentbundle-0.32.0 → agentbundle-0.33.0}/agentbundle/catalogue_tooling/archive.py

@@ -10,10 +10,11 @@ from __future__ import annotations
 import hashlib
 import json
 import tarfile
-import tempfile
 from pathlib import Path
 
+from agentbundle.catalogue import CatalogueError
 from agentbundle.catalogue_tooling.results import Diagnostic, Severity, VerifyResult
+from agentbundle.https_catalogue import _validated_archive_destination
 
 _MANIFEST_NAME = "catalogue-manifest.json"
 _SOURCE_MANIFEST_NAME = "self-hosted-source-manifest.json"
@@ -87,15 +88,19 @@ def check_members(members: list[tarfile.TarInfo]) -> list[Diagnostic]:
     """Member-level safety checks. Exported for unit tests (T1)."""
     diags: list[Diagnostic] = []
 
-    # No absolute paths
+    # No absolute, traversal, or platform-ambiguous paths. Tar member names
+    # are POSIX paths; backslashes are rejected rather than reinterpreted on
+    # Windows during extraction.
     for m in members:
-        if m.name.startswith("/") or (len(m.name) > 1 and m.name[1] == ":"):
-            diags.append(_err("CAT-V-ARC-004", f"absolute member path: {m.name!r}", path=m.name))
-
-    # No traversal paths
-    for m in members:
-        if ".." in Path(m.name).parts:
-            diags.append(_err("CAT-V-ARC-005", f"traversal path: {m.name!r}", path=m.name))
+        try:
+            _validated_archive_destination(Path("/"), m.name)
+        except CatalogueError as exc:
+            code = (
+                "CAT-V-ARC-004"
+                if m.name.startswith("/") or (len(m.name) > 1 and m.name[1] == ":")
+                else "CAT-V-ARC-005"
+            )
+            diags.append(_err(code, str(exc), path=m.name))
 
     # No symlinks or hard links
     for m in members:
@@ -262,7 +267,7 @@ def _check_no_undeclared_members(
 
 
 def _check_catalogue_markers(members: list[tarfile.TarInfo]) -> list[Diagnostic]:
-    """At least one catalogue marker must be present at the archive root."""
+    """At least one installable-archive marker must be present at its root."""
     prefix = _detect_prefix(members)
     marker_tops = {"catalogue.toml", "AGENTS.md", ".agentbundle"}
     found: set[str] = set()
@@ -280,6 +285,54 @@ def _check_catalogue_markers(members: list[tarfile.TarInfo]) -> list[Diagnostic]
     return []
 
 
+def _check_marketplace_entries(
+    tf: tarfile.TarFile,
+    members: list[tarfile.TarInfo],
+) -> list[Diagnostic]:
+    """Apply source-equivalent marketplace semantics without source identity."""
+    prefix = _detect_prefix(members)
+    member_name = f"{prefix}.claude-plugin/marketplace.json"
+    marketplace = next((m for m in members if m.name == member_name), None)
+    if marketplace is None:
+        return []
+
+    try:
+        fobj = tf.extractfile(marketplace)
+        if fobj is None:
+            raise ValueError("marketplace member is not a regular file")
+        payload = json.loads(fobj.read().decode("utf-8"))
+
+        from agentbundle.build.main import _read_bundled
+        from agentbundle.catalogue_tooling.verify import _validate_marketplace_entries
+
+        entry_schema = json.loads(_read_bundled("marketplace-entry.schema.json"))
+    except Exception as exc:
+        return [_err(
+            "CAT-V-ARC-017",
+            f"marketplace validation failed: {exc}",
+            path=".claude-plugin/marketplace.json",
+        )]
+
+    source_diags = _validate_marketplace_entries(
+        payload,
+        entry_schema,
+        ".claude-plugin/marketplace.json",
+    )
+    return [
+        Diagnostic(
+            code="CAT-V-ARC-017",
+            severity=diagnostic.severity,
+            pack=diagnostic.pack,
+            path=diagnostic.path,
+            line=diagnostic.line,
+            col=diagnostic.col,
+            message=diagnostic.message,
+            remediation=diagnostic.remediation,
+        )
+        for diagnostic in source_diags
+    ]
+
+
 def _check_min_agentbundle_compat(manifest: dict) -> list[Diagnostic]:
     min_ver = manifest.get("minimum_agentbundle_version")
     if not min_ver or not isinstance(min_ver, str):
@@ -316,9 +369,9 @@ def _make_result(diags: list[Diagnostic], operation: str) -> VerifyResult:
 def verify_archive(archive: Path, sha256_file: Path | None = None) -> VerifyResult:
     """Verify a catalogue archive (.tar.gz).
 
-    Runs the full safety + semantic pipeline. Stops after safety errors.
-    Sha256 sidecar mismatch causes immediate early return.
-    On pass, extracts to tmpdir and calls verify_catalogue for round-trip.
+    Runs the full safety + archive-semantic pipeline. Stops after safety errors.
+    Sha256 sidecar mismatch causes immediate early return. Installable archives
+    are not source catalogues, so they are not passed to ``verify_catalogue``.
     """
     diags: list[Diagnostic] = []
 
@@ -368,34 +421,7 @@ def verify_archive(archive: Path, sha256_file: Path | None = None) -> VerifyResu
         diags.extend(_check_all_manifest_digests(tf, members, manifest))
         diags.extend(_check_no_undeclared_members(members, manifest))
         diags.extend(_check_catalogue_markers(members))
+        diags.extend(_check_marketplace_entries(tf, members))
         diags.extend(_check_min_agentbundle_compat(manifest))
 
-        # Local discoverability — extract to tmpdir and verify as catalogue
-        if not any(d.severity == Severity.ERROR for d in diags):
-            prefix = _detect_prefix(members)
-            with tempfile.TemporaryDirectory() as tmpdir_str:
-                tmpdir = Path(tmpdir_str)
-                try:
-                    tf.extractall(tmpdir, filter="data")
-                except TypeError:
-                    # Python < 3.12: extract member-by-member;
-                    # paths pre-validated by check_members()
-                    for _m in tf.getmembers():
-                        _dest = tmpdir / _m.name
-                        _dest.parent.mkdir(parents=True, exist_ok=True)
-                        if _m.isreg():
-                            _fobj = tf.extractfile(_m)
-                            if _fobj is not None:
-                                _dest.write_bytes(_fobj.read())
-                catalogue_root = tmpdir / prefix.rstrip("/") if prefix else tmpdir
-                from agentbundle.catalogue_tooling.verify import verify_catalogue
-                inner = verify_catalogue(catalogue_root)
-                if not inner.ok:
-                    for d in inner.diagnostics:
-                        diags.append(_err(
-                            "CAT-V-ARC-015",
-                            f"extracted archive not locally discoverable: {d.message}",
-                            path=d.path,
-                        ))
-
     return _make_result(diags, "archive")

{agentbundle-0.32.0 → agentbundle-0.33.0}/agentbundle/catalogue_tooling/config.py

@@ -240,10 +240,10 @@ def _validate_path(root: Path, p: str, field_name: str) -> None:
             f"catalogue.toml: {field_name!r} path must not traverse outside root: {p!r}"
         )
     # Resolve and check inside root (catches symlinks)
-    resolved_root = root.resolve()
     try:
+        resolved_root = root.resolve()
         resolved_path = (root / p).resolve()
-    except OSError as exc:
+    except (OSError, RuntimeError) as exc:
         raise CatalogueConfigError(
             f"catalogue.toml: {field_name!r} path cannot be resolved: {p!r}"
         ) from exc

{agentbundle-0.32.0 → agentbundle-0.33.0}/agentbundle/catalogue_tooling/lint.py

@@ -20,7 +20,12 @@ import re
 import tomllib
 from pathlib import Path
 
-from agentbundle.catalogue_tooling.config import CatalogueConfigError, load_catalogue_config
+from agentbundle.build.self_host import projects_claude_artifacts
+from agentbundle.catalogue_tooling.config import (
+    CatalogueConfig,
+    CatalogueConfigError,
+    load_catalogue_config,
+)
 from agentbundle.catalogue_tooling.diagnostics import DiagnosticCode
 from agentbundle.catalogue_tooling.results import Diagnostic, LintResult, Severity
 
@@ -967,40 +972,74 @@ def _cs_is_canonical_shim(py: Path, shim_source_dir: Path) -> bool:
 
 
 class _CatalogueRules:
-    def __init__(self, root: Path, config: object | None) -> None:
+    def __init__(self, root: Path, config: CatalogueConfig) -> None:
         self._root = root
         self._config = config
+        self._resolved_root: Path | None = None
+        self._resolved_config_paths: dict[str, Path] = {}
+        self._unsafe_config_paths: set[str] = set()
 
     def collect(self, pack_filter: str | None) -> list[Diagnostic]:
         diagnostics: list[Diagnostic] = []
+        diagnostics.extend(self._check_config_paths())
         diagnostics.extend(self._check_markers())
         diagnostics.extend(self._check_duplicate_identities())
-        diagnostics.extend(self._check_config_paths())
         diagnostics.extend(self._check_profiles())
         return diagnostics
 
-    def _packs_dir(self) -> Path:
-        if self._config is not None:
-            return self._root / self._config.paths.packs  # type: ignore[attr-defined]
-        return self._root / "packs"
+    def _configured_path(self, field: str, default: str) -> Path | None:
+        if field in self._unsafe_config_paths:
+            return None
+        if field in self._resolved_config_paths:
+            return self._resolved_config_paths[field]
+        return self._root / default
+
+    def _packs_dir(self) -> Path | None:
+        return self._configured_path("packs", "packs")
 
-    def _marketplace_path(self) -> Path:
-        if self._config is not None:
-            return self._root / self._config.paths.marketplace  # type: ignore[attr-defined]
-        return self._root / ".claude-plugin" / "marketplace.json"
+    def _marketplace_path(self) -> Path | None:
+        return self._configured_path(
+            "marketplace", ".claude-plugin/marketplace.json"
+        )
 
     def _check_markers(self) -> list[Diagnostic]:
         diags: list[Diagnostic] = []
+        root_packs = self._root / "packs"
+        root_packs_valid = root_packs.is_dir()
+        if root_packs_valid and self._resolved_root is not None:
+            try:
+                resolved_root_packs = root_packs.resolve(strict=True)
+                root_packs_valid = resolved_root_packs.is_relative_to(self._resolved_root)
+            except (OSError, RuntimeError):
+                root_packs_valid = False
+        if not root_packs_valid:
+            diags.append(_diag(
+                DiagnosticCode.CAT_L002,
+                Severity.ERROR,
+                f"literal root packs directory missing or unsafe: {root_packs}",
+                remediation="Create a literal packs directory inside the catalogue root.",
+            ))
+
         packs_dir = self._packs_dir()
-        if not packs_dir.is_dir():
+        configured_packs = self._config.paths.packs
+        if configured_packs != "packs" and packs_dir is not None and not packs_dir.is_dir():
             diags.append(_diag(
                 DiagnosticCode.CAT_L002,
                 Severity.ERROR,
-                f"packs directory missing: {packs_dir}",
-                remediation="Create the packs directory or update catalogue.toml paths.packs.",
+                f"configured packs directory missing: {packs_dir}",
+                remediation=(
+                    "Create the configured packs directory or update "
+                    "catalogue.toml paths.packs."
+                ),
             ))
+
         mp = self._marketplace_path()
-        if not mp.exists():
+        preferred_adapter = self._config.distribution.agentbundle.preferred_adapter
+        if (
+            mp is not None
+            and projects_claude_artifacts(preferred_adapter)
+            and not mp.exists()
+        ):
             diags.append(_diag(
                 DiagnosticCode.CAT_L002,
                 Severity.ERROR,
@@ -1011,7 +1050,7 @@ class _CatalogueRules:
 
     def _check_duplicate_identities(self) -> list[Diagnostic]:
         packs_dir = self._packs_dir()
-        if not packs_dir.is_dir():
+        if packs_dir is None or not packs_dir.is_dir():
             return []
         seen_names: dict[str, str] = {}
         diags: list[Diagnostic] = []
@@ -1038,18 +1077,16 @@ class _CatalogueRules:
                 seen_names[pack_name] = entry.name
         return diags
 
-    def _profiles_dir(self) -> Path:
-        if self._config is not None:
-            profiles_val = getattr(self._config.paths, "profiles", None)  # type: ignore[attr-defined]
-            if profiles_val:
-                return self._root / profiles_val
-        return self._root / "profiles"
+    def _profiles_dir(self) -> Path | None:
+        return self._configured_path("profiles", "profiles")
 
     def _check_profiles(self) -> list[Diagnostic]:
         profiles_dir = self._profiles_dir()
-        if not profiles_dir.is_dir():
+        if profiles_dir is None or not profiles_dir.is_dir():
             return []
         packs_dir = self._packs_dir()
+        if packs_dir is None:
+            return []
         packs = _profile_load_packs(packs_dir)
         diags: list[Diagnostic] = []
         for toml_path in sorted(profiles_dir.glob("*.toml")):
@@ -1074,11 +1111,21 @@ class _CatalogueRules:
         return diags
 
     def _check_config_paths(self) -> list[Diagnostic]:
-        if self._config is None:
-            return []
         diags: list[Diagnostic] = []
-        root = self._root.resolve()
-        paths_obj = self._config.paths  # type: ignore[attr-defined]
+        try:
+            root = self._root.resolve(strict=True)
+        except (OSError, RuntimeError) as exc:
+            self._unsafe_config_paths.update(
+                {"packs", "profiles", "contracts", "marketplace", "build_output"}
+            )
+            return [_diag(
+                DiagnosticCode.CAT_L021,
+                Severity.ERROR,
+                f"catalogue root cannot be resolved safely: {exc}",
+                remediation="Use a readable catalogue root without circular symlinks.",
+            )]
+        self._resolved_root = root
+        paths_obj = self._config.paths
         for field in ("packs", "profiles", "contracts", "marketplace", "build_output"):
             val = getattr(paths_obj, field, None)
             if not val:
@@ -1086,14 +1133,23 @@ class _CatalogueRules:
             try:
                 resolved = (self._root / val).resolve()
                 if not resolved.is_relative_to(root):
+                    self._unsafe_config_paths.add(field)
                     diags.append(_diag(
                         DiagnosticCode.CAT_L021,
                         Severity.ERROR,
                         f"catalogue.paths.{field} resolves outside catalogue root: {val!r}",
                         remediation="Use a relative path that stays within the catalogue root.",
                     ))
-            except OSError:
-                pass
+                else:
+                    self._resolved_config_paths[field] = resolved
+            except (OSError, RuntimeError) as exc:
+                self._unsafe_config_paths.add(field)
+                diags.append(_diag(
+                    DiagnosticCode.CAT_L021,
+                    Severity.ERROR,
+                    f"catalogue.paths.{field} cannot be resolved safely: {val!r}: {exc}",
+                    remediation="Use a relative path without circular or escaping symlinks.",
+                ))
         return diags
 
 
@@ -1791,15 +1847,32 @@ def lint_catalogue(root: Path, pack: str | None = None, *, deep: bool = False) -
             catalogue_schema_version=1,
         )
 
+    if config is None:
+        diagnostics.append(_diag(
+            DiagnosticCode.CAT_L002,
+            Severity.ERROR,
+            f"catalogue.toml missing: {root / 'catalogue.toml'}",
+            remediation="Create a valid catalogue.toml at the catalogue root.",
+        ))
+        return LintResult(
+            ok=False,
+            diagnostics=diagnostics,
+            schema_version=1,
+            command="catalogue lint",
+            operation="lint",
+            agentbundle_version=_get_agentbundle_version(),
+            catalogue_schema_version=1,
+        )
+
     # Step 2: catalogue-level rules
     cat_rules = _CatalogueRules(root, config)
     diagnostics.extend(cat_rules.collect(pack))
 
     # Step 3: determine packs dir
-    packs_dir = root / config.paths.packs if config is not None else root / "packs"
+    packs_dir = cat_rules._packs_dir()
 
     # Step 4+5: per-pack rules
-    if packs_dir.is_dir():
+    if packs_dir is not None and packs_dir.is_dir():
         for pack_dir in sorted(packs_dir.iterdir()):
             if pack_dir.name.startswith("_"):
                 continue  # reserved authoring asset

{agentbundle-0.32.0 → agentbundle-0.33.0}/agentbundle/catalogue_tooling/verify.py

@@ -70,9 +70,7 @@ def _step_config_validation(
 def _step_lint(
     root: Path, config: object | None, pack: str | None, tmpdir: Path
 ) -> list[Diagnostic]:
-    """Step 2: run catalogue lint. Skips gracefully when catalogue.toml is absent."""
-    if config is None:
-        return []
+    """Step 2: run catalogue lint, including its source-identity checks."""
     from agentbundle.catalogue_tooling.lint import lint_catalogue
     result = lint_catalogue(root, pack=pack)
     diags: list[Diagnostic] = []
@@ -587,6 +585,67 @@ def _step_marketplace(
     return []
 
 
+def _validate_marketplace_entries(
+    payload: object,
+    entry_schema: dict,
+    label: str,
+) -> list[Diagnostic]:
+    """Validate marketplace entries shared by source and archive verification."""
+    from agentbundle.build.validate import validate as validate_manifest
+
+    if not isinstance(payload, dict):
+        return [_err(
+            "CAT-V-013",
+            f"{label} must contain a JSON object",
+            path=label,
+        )]
+
+    plugin_entries = payload.get("plugins", [])
+    if not isinstance(plugin_entries, list):
+        return [_err(
+            "CAT-V-013",
+            f"{label} 'plugins' must be a JSON array",
+            path=label,
+        )]
+
+    diags: list[Diagnostic] = []
+    for plugin_entry in plugin_entries:
+        if not isinstance(plugin_entry, dict):
+            diags.append(_err(
+                "CAT-V-013",
+                "marketplace plugin entry must be a JSON object",
+                path=label,
+            ))
+            continue
+        name = plugin_entry.get("name", "unknown")
+        if "source" not in plugin_entry:
+            # WARN, not ERROR. `[pack.links].repository` is optional, the
+            # shipped scaffold pack omits it, and an external catalogue may
+            # legitimately hold packs it does not publish for marketplace
+            # install. Surface the consequence without failing the build.
+            diags.append(_warn(
+                "CAT-V-013",
+                f"marketplace entry '{name}' has no 'source' — set "
+                f"[pack.links].repository in that pack's pack.toml so the "
+                f"build can emit one, or adopters cannot install it",
+                path=label,
+            ))
+        if "hooks" in plugin_entry:
+            diags.append(_err(
+                "CAT-V-013",
+                f"plugin '{name}' contains 'hooks' — "
+                "hooks must not appear in marketplace entries",
+                path=label,
+            ))
+        for error in validate_manifest(plugin_entry, entry_schema):
+            diags.append(_err(
+                "CAT-V-013",
+                f"marketplace entry '{name}': {error}",
+                path=label,
+            ))
+    return diags
+
+
 def _step_plugin_manifests(
     root: Path, config: object | None, pack: str | None, tmpdir: Path
 ) -> list[Diagnostic]:
@@ -644,34 +703,7 @@ def _step_plugin_manifests(
             diags.append(_err("CAT-V-013", f"{label} parse error: {exc}",
                               path=label))
             return
-        for plugin_entry in payload.get("plugins", []):
-            name = plugin_entry.get("name", "unknown")
-            if "source" not in plugin_entry:
-                # WARN, not ERROR. `[pack.links].repository` is optional, the
-                # shipped scaffold pack omits it, and an external catalogue may
-                # legitimately hold packs it does not publish for marketplace
-                # install. That is a choice, not a defect — so surface the
-                # consequence and name the cause, but do not fail the build.
-                diags.append(_warn(
-                    "CAT-V-013",
-                    f"marketplace entry '{name}' has no 'source' — set "
-                    f"[pack.links].repository in that pack's pack.toml so the "
-                    f"build can emit one, or adopters cannot install it",
-                    path=label,
-                ))
-            if "hooks" in plugin_entry:
-                diags.append(_err(
-                    "CAT-V-013",
-                    f"plugin '{name}' contains 'hooks' — "
-                    "hooks must not appear in marketplace entries",
-                    path=label,
-                ))
-            for error in _validate_manifest(plugin_entry, entry_schema):
-                diags.append(_err(
-                    "CAT-V-013",
-                    f"marketplace entry '{name}': {error}",
-                    path=label,
-                ))
+        diags.extend(_validate_marketplace_entries(payload, entry_schema, label))
 
     for manifest_path in sorted(dist_dir.rglob("*.claude-plugin/plugin.json")) \
             if dist_dir.exists() else []:
@@ -991,9 +1023,20 @@ def verify_catalogue(
     Build output (step 10) goes to a temporary directory; the catalogue
     root has zero new or modified files after verify completes.
     """
-    from agentbundle.catalogue_tooling.config import load_catalogue_config
+    from agentbundle.catalogue_tooling.config import CatalogueConfigError, load_catalogue_config
 
-    config = load_catalogue_config(root)
+    try:
+        config = load_catalogue_config(root)
+    except CatalogueConfigError as exc:
+        return VerifyResult(
+            ok=False,
+            diagnostics=[_err("CAT-V-001", str(exc), path="catalogue.toml")],
+            schema_version=1,
+            command="catalogue verify",
+            operation="source-checkout",
+            agentbundle_version=_get_agentbundle_version(),
+            catalogue_schema_version=1,
+        )
     catalogue_schema_version = getattr(config, "schema", 1) if config else 1
 
     all_diags: list[Diagnostic] = []