agentbundle 0.44.0__tar.gz → 0.46.1__tar.gz

{agentbundle-0.44.0/agentbundle.egg-info → agentbundle-0.46.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.44.0
+Version: 0.46.1
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License-Expression: Apache-2.0 OR MIT
@@ -34,7 +34,74 @@ python -m pip install agentbundle
 
 Requires Python 3.11+. Runs on macOS, Linux, and Windows.
 
-## What's new in 0.44.0
+## What's new in 0.46.1
+
+`catalogue init` no longer stages its writes under a name another local user
+can predict. The temporary file now has a random name, is created
+exclusively, and keeps the permissions your umask would give it. A symlink
+left in the target directory can no longer redirect the write — which
+matters if you initialise a catalogue somewhere you do not exclusively
+control, such as a shared or world-writable directory.
+
+## What's new in 0.46.0
+
+`catalogue init --preset self-hosted` now records the recipe it used and
+reuses its identity fields plus pack and profile selections on a later run.
+Running the same command again therefore recreates the recorded catalogue
+without deriving a new name or widening the selected pack set. Explicit flags
+still take precedence.
+
+The recorded state now has schema 3 and carries the available source pin.
+Because `--source` accepts a local path, its revision and archive digest are
+null. Values written into the generated `catalogue.toml` are escaped for TOML.
+
+## What's new in 0.45.0
+
+`agentbundle` can now work out where to send your work-loop telemetry.
+`agentbundle.telemetry_layout.resolve()` reads the `[telemetry]` section of the
+`agentbundle-layout.toml` in your repository and the one in your user layout
+directory, and returns the arguments for the separately installed
+`jsonl-otlp-exporter` sender. Nothing is sent unless you configure an endpoint
+and install that sender: they are two separate consents.
+
+Repository settings win per setting, because sending data off the machine is a
+team decision rather than a personal one. Both files are read through the
+catalogue's confinement helper and bounded at 64 KiB, and a `[telemetry]`
+setting the sender has no route for is refused — naming the file it came from —
+rather than silently ignored.
+
+`catalogue lint` also reports `CAT-L032` when a pack declares an optional
+runtime dependency you do not have installed. It names the package and exits 0.
+It never invokes a package manager and never installs anything.
+
+## What's new in 0.44.3
+
+Repository maintenance only: this release changes `make build-check`, which
+runs against a source checkout. Nothing an installed `agentbundle` does
+changes.
+
+The check that keeps `agentbundle/_data/` in step with its core-pack sources
+now fails on a copy that is missing, not only on one that has drifted. It also
+derives which copies are needed from the sources themselves, so a bundled
+script that loads a helper nobody bundled is reported instead of shipping an
+import that cannot resolve.
+
+## What's new in 0.44.2
+
+A catalogue you derive with `catalogue init --preset self-hosted` now keeps a
+working drift check on its vendored `credbroker` code. Selecting the
+`credential-brokers` pack copies the package source alongside it, so the check
+that compares the vendored copy against that source has something to compare.
+Previously the source was left behind and the check passed by finding nothing:
+the vendored copy was frozen, and an edit to it went unreported.
+
+`--attribution white-label` also no longer records the upstream catalogue's
+name in `.agentbundle/self-host-state.json`. That file is written after the
+identity scan runs, so the name reached a file you commit and ship. It now
+records your own catalogue's name. `--attribution attributed` is unchanged and
+still records the upstream name.
+
+## What's new in 0.44.1
 
 Installing a pack now adds its default output location to an
 `agentbundle-layout.toml` you already keep. That step has existed for several
@@ -149,6 +216,7 @@ Claude Code fields Kiro cannot read (`permissionMode`, `memory`, `maxTurns`, …
 and IDE-only keys that make the CLI loader drop an agent (`hooks`) are dropped,
 each with a `kiro: dropping … agent field` line on stderr. If you relied on the
 previous pass-through, check your build log after upgrading.
+
 ## What's new in 0.39.3
 
 The bundled workspace-status engine now recognizes reviewed legacy work-intake

{agentbundle-0.44.0 → agentbundle-0.46.1}/README-pypi.md

@@ -14,7 +14,74 @@ python -m pip install agentbundle
 
 Requires Python 3.11+. Runs on macOS, Linux, and Windows.
 
-## What's new in 0.44.0
+## What's new in 0.46.1
+
+`catalogue init` no longer stages its writes under a name another local user
+can predict. The temporary file now has a random name, is created
+exclusively, and keeps the permissions your umask would give it. A symlink
+left in the target directory can no longer redirect the write — which
+matters if you initialise a catalogue somewhere you do not exclusively
+control, such as a shared or world-writable directory.
+
+## What's new in 0.46.0
+
+`catalogue init --preset self-hosted` now records the recipe it used and
+reuses its identity fields plus pack and profile selections on a later run.
+Running the same command again therefore recreates the recorded catalogue
+without deriving a new name or widening the selected pack set. Explicit flags
+still take precedence.
+
+The recorded state now has schema 3 and carries the available source pin.
+Because `--source` accepts a local path, its revision and archive digest are
+null. Values written into the generated `catalogue.toml` are escaped for TOML.
+
+## What's new in 0.45.0
+
+`agentbundle` can now work out where to send your work-loop telemetry.
+`agentbundle.telemetry_layout.resolve()` reads the `[telemetry]` section of the
+`agentbundle-layout.toml` in your repository and the one in your user layout
+directory, and returns the arguments for the separately installed
+`jsonl-otlp-exporter` sender. Nothing is sent unless you configure an endpoint
+and install that sender: they are two separate consents.
+
+Repository settings win per setting, because sending data off the machine is a
+team decision rather than a personal one. Both files are read through the
+catalogue's confinement helper and bounded at 64 KiB, and a `[telemetry]`
+setting the sender has no route for is refused — naming the file it came from —
+rather than silently ignored.
+
+`catalogue lint` also reports `CAT-L032` when a pack declares an optional
+runtime dependency you do not have installed. It names the package and exits 0.
+It never invokes a package manager and never installs anything.
+
+## What's new in 0.44.3
+
+Repository maintenance only: this release changes `make build-check`, which
+runs against a source checkout. Nothing an installed `agentbundle` does
+changes.
+
+The check that keeps `agentbundle/_data/` in step with its core-pack sources
+now fails on a copy that is missing, not only on one that has drifted. It also
+derives which copies are needed from the sources themselves, so a bundled
+script that loads a helper nobody bundled is reported instead of shipping an
+import that cannot resolve.
+
+## What's new in 0.44.2
+
+A catalogue you derive with `catalogue init --preset self-hosted` now keeps a
+working drift check on its vendored `credbroker` code. Selecting the
+`credential-brokers` pack copies the package source alongside it, so the check
+that compares the vendored copy against that source has something to compare.
+Previously the source was left behind and the check passed by finding nothing:
+the vendored copy was frozen, and an edit to it went unreported.
+
+`--attribution white-label` also no longer records the upstream catalogue's
+name in `.agentbundle/self-host-state.json`. That file is written after the
+identity scan runs, so the name reached a file you commit and ship. It now
+records your own catalogue's name. `--attribution attributed` is unchanged and
+still records the upstream name.
+
+## What's new in 0.44.1
 
 Installing a pack now adds its default output location to an
 `agentbundle-layout.toml` you already keep. That step has existed for several
@@ -129,6 +196,7 @@ Claude Code fields Kiro cannot read (`permissionMode`, `memory`, `maxTurns`, …
 and IDE-only keys that make the CLI loader drop an agent (`hooks`) are dropped,
 each with a `kiro: dropping … agent field` line on stderr. If you relied on the
 previous pass-through, check your build log after upgrading.
+
 ## What's new in 0.39.3
 
 The bundled workspace-status engine now recognizes reviewed legacy work-intake

{agentbundle-0.44.0 → agentbundle-0.46.1}/agentbundle/_data/workspace_status_engine.py

@@ -297,6 +297,16 @@ class LegacyWorkspaceMembership:
     entry_index: int = 0
 
 
+@dataclasses.dataclass(frozen=True)
+class ParseBlockedWorkspaceMembership:
+    """One target-like entry whose safe artifact identity survived parsing."""
+
+    canonical_artifact_path: str
+    ini_slug: str
+    collection: str
+    entry_index: int
+
+
 @dataclasses.dataclass(frozen=True)
 class MigrationSelection:
     """Closed human-selected binding from one legacy finding to one target."""
@@ -2481,12 +2491,12 @@ def _extract_canonical_memberships(
     list[WorkspaceMembership],
     list[LegacyWorkspaceMembership],
     list[RoutingFinding],
-    dict[str, int],
+    list[ParseBlockedWorkspaceMembership],
 ]:
     memberships: list[WorkspaceMembership] = []
     legacy_memberships: list[LegacyWorkspaceMembership] = []
     findings: list[RoutingFinding] = []
-    parse_blocked_path_counts: dict[str, int] = {}
+    parse_blocked_memberships: list[ParseBlockedWorkspaceMembership] = []
     for section_name, top_level_names in _TOP_LEVEL_ENTRY_COLLECTIONS.items():
         section = workspace.get(section_name, {})
         if not isinstance(section, dict):
@@ -2514,8 +2524,13 @@ def _extract_canonical_memberships(
                         dataclasses.replace(legacy_membership, entry_index=entry_index)
                     )
                 if blocked_path is not None:
-                    parse_blocked_path_counts[blocked_path] = (
-                        parse_blocked_path_counts.get(blocked_path, 0) + 1
+                    parse_blocked_memberships.append(
+                        ParseBlockedWorkspaceMembership(
+                            canonical_artifact_path=blocked_path,
+                            ini_slug="",
+                            collection=collection,
+                            entry_index=entry_index,
+                        )
                     )
                 findings.extend(entry_findings)
     for raw_ini_slug, section in workspace.items():
@@ -2569,11 +2584,16 @@ def _extract_canonical_memberships(
                             dataclasses.replace(legacy_membership, entry_index=entry_index)
                         )
                     if blocked_path is not None:
-                        parse_blocked_path_counts[blocked_path] = (
-                            parse_blocked_path_counts.get(blocked_path, 0) + 1
+                        parse_blocked_memberships.append(
+                            ParseBlockedWorkspaceMembership(
+                                canonical_artifact_path=blocked_path,
+                                ini_slug=ini_slug,
+                                collection=collection,
+                                entry_index=entry_index,
+                            )
                         )
                     findings.extend(entry_findings)
-    return memberships, legacy_memberships, findings, parse_blocked_path_counts
+    return memberships, legacy_memberships, findings, parse_blocked_memberships
 
 
 def _membership_status(membership: WorkspaceMembership) -> str | None:
@@ -2856,6 +2876,129 @@ def _legacy_canonical_alias(entry: LegacyWorkspaceEntry) -> str | None:
     return None
 
 
+_SELECTED_SPEC_COLLECTIONS = frozenset(
+    {"backlog.open", "work.queue", "work.active", "work.shipped"}
+)
+
+
+def resolve_selected_memberships(
+    workspace: dict, selected_artifact_paths: list[str]
+) -> dict[str, list[dict]]:
+    """Resolve selected occurrences from already-parsed workspace state."""
+    (
+        memberships,
+        legacy_memberships,
+        findings,
+        parse_blocked_memberships,
+    ) = _extract_canonical_memberships(workspace)
+    if any(finding.code == "invalid_workspace" for finding in findings):
+        raise ValueError("invalid workspace")
+
+    occurrences_by_path: dict[str, list[dict]] = {
+        path: [] for path in selected_artifact_paths
+    }
+    for membership in memberships:
+        path = membership.entry.path
+        if (
+            membership.entry.kind != "spec"
+            or membership.collection not in _SELECTED_SPEC_COLLECTIONS
+            or path not in occurrences_by_path
+        ):
+            continue
+        occurrences_by_path[path].append(
+            {
+                "canonical_artifact_path": path,
+                "initiative": membership.ini_slug or None,
+                "collection": membership.collection,
+                "entry_index": membership.entry_index,
+                "form": "canonical",
+            }
+        )
+    for legacy_membership in legacy_memberships:
+        path = _legacy_canonical_alias(legacy_membership.entry)
+        if (
+            legacy_membership.collection not in _SELECTED_SPEC_COLLECTIONS
+            or path not in occurrences_by_path
+        ):
+            continue
+        occurrences_by_path[path].append(
+            {
+                "canonical_artifact_path": path,
+                "initiative": legacy_membership.ini_slug or None,
+                "collection": legacy_membership.collection,
+                "entry_index": legacy_membership.entry_index,
+                "form": "legacy",
+            }
+        )
+    for blocked_membership in parse_blocked_memberships:
+        path = blocked_membership.canonical_artifact_path
+        if (
+            blocked_membership.collection not in _SELECTED_SPEC_COLLECTIONS
+            or path not in occurrences_by_path
+        ):
+            continue
+        occurrences_by_path[path].append(
+            {
+                "canonical_artifact_path": path,
+                "initiative": blocked_membership.ini_slug or None,
+                "collection": blocked_membership.collection,
+                "entry_index": blocked_membership.entry_index,
+                "form": "parse-blocked",
+            }
+        )
+    return occurrences_by_path
+
+
+def selected_membership_status(root: Path, selectors: list[str]) -> dict[str, object]:
+    """Return membership occurrences for an explicit ordered spec selection.
+
+    The selected spec artifacts need not exist. Only ``workspace.toml`` is read;
+    matching is performed on canonical repository-relative artifact identities.
+    """
+    if not selectors:
+        return {"error": {"code": "empty_selection"}}
+
+    selected_artifact_paths: list[str] = []
+    for selector in selectors:
+        artifact_path = f"{selector}/spec.md" if isinstance(selector, str) else ""
+        if (
+            not _is_canonical_spec_artifact_path(artifact_path)
+            or _confined_artifact_path(root, selector) is None
+        ):
+            return {"error": {"code": "invalid_selector"}}
+        selected_artifact_paths.append(artifact_path)
+
+    workspace_path = _confined_artifact_path(root, "workspace.toml")
+    if workspace_path is None:
+        return {"error": {"code": "invalid_workspace"}}
+    try:
+        workspace = parse_workspace(workspace_path)
+    except tomllib.TOMLDecodeError:
+        return {"error": {"code": "malformed_toml"}}
+    except OSError:
+        return {"error": {"code": "invalid_workspace"}}
+    try:
+        # The pure seam calls _extract_canonical_memberships(...) and
+        # _legacy_canonical_alias(...) for selected identity resolution.
+        occurrences_by_path = resolve_selected_memberships(
+            workspace, selected_artifact_paths
+        )
+    except ValueError:
+        return {"error": {"code": "invalid_workspace"}}
+
+    return {
+        "results": [
+            {
+                "selected_directory": selector,
+                "canonical_artifact_path": artifact_path,
+                "membership_present": bool(occurrences_by_path[artifact_path]),
+                "occurrences": occurrences_by_path[artifact_path],
+            }
+            for selector, artifact_path in zip(selectors, selected_artifact_paths, strict=True)
+        ]
+    }
+
+
 def _legacy_membership_is_cooled(
     membership: LegacyWorkspaceMembership,
     root: Path | None,
@@ -3421,8 +3564,12 @@ def run_canonical_reconciliation(
         memberships,
         legacy_memberships,
         parse_findings,
-        parse_blocked_path_counts,
+        parse_blocked_memberships,
     ) = _extract_canonical_memberships(workspace)
+    parse_blocked_path_counts: dict[str, int] = {}
+    for blocked in parse_blocked_memberships:
+        path = blocked.canonical_artifact_path
+        parse_blocked_path_counts[path] = parse_blocked_path_counts.get(path, 0) + 1
     # Cooling is applied at evaluation and emission, never here. Every fact
     # derived below — by_path, duplicate_paths, cycle_paths, legacy_alias_counts
     # and the structural loop — must see a cooled artifact as *cooled*, not as