fips-agents-cli 0.7.0__tar.gz → 0.8.2__tar.gz

fips_agents_cli-0.8.2/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Code Owners - all PRs require approval from @rdwj
+*       @rdwj

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/.gitignore

@@ -25,6 +25,7 @@ MANIFEST
 
 # Virtual environments
 venv/
+.venv/
 env/
 ENV/
 env.bak/
@@ -88,3 +89,6 @@ tokens.txt
 
 # Project specific
 setup_structure.sh
+
+# Session handoff notes (local-only — content lives in MEMORY.md)
+NEXT_SESSION.md

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/CLAUDE.md

@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 **fips-agents-cli** is a Python-based CLI tool for scaffolding FIPS-compliant AI agent projects. It scaffolds MCP (Model Context Protocol) servers and AI agent projects from production-ready templates, customizes them for new projects, and prepares them for immediate development use.
 
-**Current Status:** `create mcp-server` and `create agent` commands implemented.
+**Current Status:** Scaffolding commands implemented: `create mcp-server`, `create agent`, `create gateway`, `create ui`, `create sandbox`, `create model-car`. Post-scaffolding commands: `generate` (tool, resource, prompt, middleware), `patch` (check, generators, core, docs, build, all), `add` (code-executor), `vendor`. Note: `create workflow` exists in code but is not yet working.
 
 ## Development Commands
 
@@ -91,18 +91,25 @@ This command will:
 
 ```bash
 # 1. Update version in both files manually or use the script:
-./scripts/release.sh <version> "<commit-message>"
+./scripts/release.sh <version> [<summary>]
 
-# Example:
+# Examples:
+./scripts/release.sh 0.1.2
 ./scripts/release.sh 0.1.2 "Add new generator features"
 
 # The script handles:
 # - Updating version.py and pyproject.toml
+# - Constructing the release commit message from the project convention
 # - Committing changes (including README.md changelog)
 # - Creating and pushing tag
 # - Triggering GitHub Actions
 ```
 
+**Release commit message convention**: `chore: Release fips-agents-cli vX.Y.Z`,
+optionally followed by ` — <summary>`. The script always constructs the message
+from the version argument; callers only supply the summary, never the full
+message. This keeps `git log --grep "Release fips-agents-cli"` reliable.
+
 **Note**: Always update the changelog in README.md before running the script.
 
 See `RELEASE_CHECKLIST.md` for detailed release procedures and troubleshooting.
@@ -141,7 +148,7 @@ Two cloning strategies exist:
 1. Clone monorepo, extract `templates/agent-loop/` subdirectory
 2. Update `pyproject.toml` name field via tomlkit
 3. String-replace `agent-template` → new name in Chart.yaml, values.yaml, AGENTS.md, Containerfile, Makefile
-4. Source directories are NOT renamed — `base_agent` is a framework component
+4. Source directories are NOT renamed — the agent-loop template ships with `src/agent.py` directly, not a project-named module
 5. Initialize fresh git repository with initial commit
 
 **Rich Console Output**: All user-facing output uses Rich library for:
@@ -272,7 +279,7 @@ def test_something(temp_dir):
 
 **Agent Template** (`fips-agents/agent-template` — monorepo, `templates/agent-loop/`):
 - `pyproject.toml` with project name (no entry point scripts)
-- `src/base_agent/` framework (NOT renamed during customization)
+- `src/agent.py` user agent subclass (lives at this path directly — no project-named module wrapper)
 - `chart/` Helm chart for OpenShift deployment
 - `agent.yaml` configuration (customized via `/plan-agent`, not during scaffolding)
 - `.claude/commands/` with agent development slash commands
@@ -325,6 +332,10 @@ Common causes:
 2. Dependencies not installed: `pip install -e .[dev]`
 3. Git not configured globally: `git config --global user.email "test@example.com"`
 
+## Release Process Notes
+
+When creating a new release, always update the changelog in README.md *before* running the release script. The changelog lives in the README under the `## Changelog` heading. Each version should have its own section with the version number and date, listing new features, fixes, and breaking changes. Forgetting the changelog entry leads to patch releases (like v0.8.1) that exist solely to backfill documentation — avoid that by treating the changelog update as a required step in every release.
+
 ## Repository-Specific Notes
 
 - The main branch is `main` (not `master`)

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fips-agents-cli
-Version: 0.7.0
+Version: 0.8.2
 Summary: CLI tool for creating and managing FIPS-compliant AI agent projects
 Project-URL: Homepage, https://github.com/fips-agents/fips-agents-cli
 Project-URL: Repository, https://github.com/fips-agents/fips-agents-cli
@@ -145,6 +145,7 @@ fips-agents add --help
 fips-agents create --help
 fips-agents generate --help
 fips-agents patch --help
+fips-agents vendor --help
 ```
 
 ---
@@ -216,6 +217,12 @@ Creates an AI agent project from the [agent-template](https://github.com/fips-ag
 
 **Options:** Same as `create mcp-server` (see shared options table above).
 
+**Additional option:**
+
+| Option | Description |
+|--------|-------------|
+| `--vendored` | Copy fipsagents source into the project instead of using PyPI dependency |
+
 **Examples:**
 
 ```bash
@@ -227,6 +234,9 @@ fips-agents create agent my-agent --github --org fips-agents
 
 # Non-interactive mode
 fips-agents create agent my-agent --yes --local
+
+# Create with vendored fipsagents source
+fips-agents create agent my-agent --vendored --local
 ```
 
 #### `create gateway`
@@ -635,6 +645,45 @@ cd my-research-agent
 fips-agents add code-executor
 ```
 
+---
+
+### Vendor Commands
+
+The `vendor` command copies the fipsagents source into your agent project, replacing the PyPI dependency. This gives you full control over the fipsagents code.
+
+#### `vendor`
+
+```bash
+fips-agents vendor [OPTIONS]
+```
+
+Copies fipsagents source into `src/fipsagents/` and rewrites `pyproject.toml` to use individual dependencies instead of the fipsagents package.
+
+**Options:**
+
+| Option | Description |
+|--------|-------------|
+| `--update` | Update an already-vendored project with the latest upstream source |
+| `--version TEXT` | Vendor a specific version tag (e.g., `fipsagents-v0.7.0`). Default: latest main |
+
+**Examples:**
+
+```bash
+# Vendor into current project
+fips-agents vendor
+
+# Vendor a specific version
+fips-agents vendor --version fipsagents-v0.7.0
+
+# Update vendored source from upstream
+fips-agents vendor --update
+```
+
+**When to use vendored vs. PyPI:**
+
+- **PyPI dependency** (default): Best for teams running multiple agents that share the same fipsagents version. Centralized updates.
+- **Vendored source**: Best for agents that need custom BaseAgent modifications, environments with no PyPI access, or when you want to read and debug the fipsagents source locally.
+
 ## Project Name Requirements
 
 Project names must follow these rules:
@@ -663,10 +712,9 @@ pytest
 
 ```bash
 cd my-research-agent
-python -m venv venv
-source venv/bin/activate
-pip install -e .[dev]
-pytest
+make install         # Create venv, install dependencies
+make run-local       # Start HTTP server on port 8080
+make test            # Run tests
 # See AGENTS.md for the /plan-agent slash command workflow
 ```
 
@@ -778,7 +826,8 @@ fips-agents-cli/
 │       │   ├── create.py   # create mcp-server, agent, gateway, ui
 │       │   ├── generate.py # generate tool/resource/prompt/middleware
 │       │   ├── model_car.py # create model-car
-│       │   └── patch.py    # patch command
+│       │   ├── patch.py    # patch command
+│       │   └── vendor.py   # vendor fipsagents source
 │       └── tools/          # Utility modules
 │           ├── filesystem.py
 │           ├── git.py
@@ -897,6 +946,29 @@ MIT License - see LICENSE file for details
 
 ## Changelog
 
+### Version 0.8.2
+
+- Test: New `TestGenerateMiddlewareRealTemplate` integration test renders the real v3.x middleware Jinja2 template against each `--hook-type` and the no-flag case, with templates committed under `tests/fixtures/middleware_template/` so the suite runs offline (#3)
+- Chore: `scripts/release.sh` now constructs the release commit message from the version argument using the project convention (`chore: Release fips-agents-cli vX.Y.Z` with optional ` — <summary>`); convention documented in CLAUDE.md (#4)
+- Docs: Drop broken `See Also` links from `.fips-agents-cli/README.md` in scaffolded MCP projects (#5, fixed in `fips-agents/mcp-server-template`)
+- Docs: Updated CLAUDE.md release section to reflect the new release-script signature
+
+### Version 0.8.1
+
+- Docs: Updated CLAUDE.md current-status line and added release-process notes
+- Chore: Repository hardening — added CODEOWNERS and enabled main branch protection
+- Chore: Black formatting drift cleanup; removed remaining "framework" language from docs in favor of "toolkit"
+- Chore: `.venv/` and `NEXT_SESSION.md` gitignored
+
+### Version 0.8.0
+
+- Feature: New `--vendored` flag on `create agent` copies fipsagents source instead of PyPI dependency
+- Feature: New `fips-agents vendor` command for post-scaffold vendoring of existing projects
+- Feature: `fips-agents vendor --update` refreshes vendored source from upstream
+- Feature: `fips-agents vendor --version` pins to a specific fipsagents release tag
+- Fix: `customize_agent_project` now removes monorepo Makefile install line (matching workflow template behavior)
+- Fix: Added `redeploy.sh` to agent project customization file list
+
 ### Version 0.7.0
 
 - Feature: New `add` command group for composable agent capabilities

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/README.md

@@ -112,6 +112,7 @@ fips-agents add --help
 fips-agents create --help
 fips-agents generate --help
 fips-agents patch --help
+fips-agents vendor --help
 ```
 
 ---
@@ -183,6 +184,12 @@ Creates an AI agent project from the [agent-template](https://github.com/fips-ag
 
 **Options:** Same as `create mcp-server` (see shared options table above).
 
+**Additional option:**
+
+| Option | Description |
+|--------|-------------|
+| `--vendored` | Copy fipsagents source into the project instead of using PyPI dependency |
+
 **Examples:**
 
 ```bash
@@ -194,6 +201,9 @@ fips-agents create agent my-agent --github --org fips-agents
 
 # Non-interactive mode
 fips-agents create agent my-agent --yes --local
+
+# Create with vendored fipsagents source
+fips-agents create agent my-agent --vendored --local
 ```
 
 #### `create gateway`
@@ -602,6 +612,45 @@ cd my-research-agent
 fips-agents add code-executor
 ```
 
+---
+
+### Vendor Commands
+
+The `vendor` command copies the fipsagents source into your agent project, replacing the PyPI dependency. This gives you full control over the fipsagents code.
+
+#### `vendor`
+
+```bash
+fips-agents vendor [OPTIONS]
+```
+
+Copies fipsagents source into `src/fipsagents/` and rewrites `pyproject.toml` to use individual dependencies instead of the fipsagents package.
+
+**Options:**
+
+| Option | Description |
+|--------|-------------|
+| `--update` | Update an already-vendored project with the latest upstream source |
+| `--version TEXT` | Vendor a specific version tag (e.g., `fipsagents-v0.7.0`). Default: latest main |
+
+**Examples:**
+
+```bash
+# Vendor into current project
+fips-agents vendor
+
+# Vendor a specific version
+fips-agents vendor --version fipsagents-v0.7.0
+
+# Update vendored source from upstream
+fips-agents vendor --update
+```
+
+**When to use vendored vs. PyPI:**
+
+- **PyPI dependency** (default): Best for teams running multiple agents that share the same fipsagents version. Centralized updates.
+- **Vendored source**: Best for agents that need custom BaseAgent modifications, environments with no PyPI access, or when you want to read and debug the fipsagents source locally.
+
 ## Project Name Requirements
 
 Project names must follow these rules:
@@ -630,10 +679,9 @@ pytest
 
 ```bash
 cd my-research-agent
-python -m venv venv
-source venv/bin/activate
-pip install -e .[dev]
-pytest
+make install         # Create venv, install dependencies
+make run-local       # Start HTTP server on port 8080
+make test            # Run tests
 # See AGENTS.md for the /plan-agent slash command workflow
 ```
 
@@ -745,7 +793,8 @@ fips-agents-cli/
 │       │   ├── create.py   # create mcp-server, agent, gateway, ui
 │       │   ├── generate.py # generate tool/resource/prompt/middleware
 │       │   ├── model_car.py # create model-car
-│       │   └── patch.py    # patch command
+│       │   ├── patch.py    # patch command
+│       │   └── vendor.py   # vendor fipsagents source
 │       └── tools/          # Utility modules
 │           ├── filesystem.py
 │           ├── git.py
@@ -864,6 +913,29 @@ MIT License - see LICENSE file for details
 
 ## Changelog
 
+### Version 0.8.2
+
+- Test: New `TestGenerateMiddlewareRealTemplate` integration test renders the real v3.x middleware Jinja2 template against each `--hook-type` and the no-flag case, with templates committed under `tests/fixtures/middleware_template/` so the suite runs offline (#3)
+- Chore: `scripts/release.sh` now constructs the release commit message from the version argument using the project convention (`chore: Release fips-agents-cli vX.Y.Z` with optional ` — <summary>`); convention documented in CLAUDE.md (#4)
+- Docs: Drop broken `See Also` links from `.fips-agents-cli/README.md` in scaffolded MCP projects (#5, fixed in `fips-agents/mcp-server-template`)
+- Docs: Updated CLAUDE.md release section to reflect the new release-script signature
+
+### Version 0.8.1
+
+- Docs: Updated CLAUDE.md current-status line and added release-process notes
+- Chore: Repository hardening — added CODEOWNERS and enabled main branch protection
+- Chore: Black formatting drift cleanup; removed remaining "framework" language from docs in favor of "toolkit"
+- Chore: `.venv/` and `NEXT_SESSION.md` gitignored
+
+### Version 0.8.0
+
+- Feature: New `--vendored` flag on `create agent` copies fipsagents source instead of PyPI dependency
+- Feature: New `fips-agents vendor` command for post-scaffold vendoring of existing projects
+- Feature: `fips-agents vendor --update` refreshes vendored source from upstream
+- Feature: `fips-agents vendor --version` pins to a specific fipsagents release tag
+- Fix: `customize_agent_project` now removes monorepo Makefile install line (matching workflow template behavior)
+- Fix: Added `redeploy.sh` to agent project customization file list
+
 ### Version 0.7.0
 
 - Feature: New `add` command group for composable agent capabilities

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "fips-agents-cli"
-version = "0.7.0"
+version = "0.8.2"
 description = "CLI tool for creating and managing FIPS-compliant AI agent projects"
 readme = "README.md"
 requires-python = ">=3.10"

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/scripts/release.sh

@@ -2,9 +2,20 @@
 #
 # release.sh - Automated release script for fips-agents-cli
 #
-# Usage: ./scripts/release.sh <version> <commit-message>
+# Usage: ./scripts/release.sh <version> [<summary>]
 #
-# Example: ./scripts/release.sh 0.1.2 "Add new feature for X"
+# The release commit message is always constructed from the version using
+# the project convention:
+#
+#     chore: Release fips-agents-cli vX.Y.Z
+#
+# If a summary is provided, it is appended after an em-dash:
+#
+#     chore: Release fips-agents-cli vX.Y.Z — <summary>
+#
+# Examples:
+#   ./scripts/release.sh 0.1.2
+#   ./scripts/release.sh 0.1.2 "Add new generator features"
 #
 
 set -e  # Exit on error
@@ -29,14 +40,16 @@ print_info() {
 }
 
 # Check arguments
-if [ $# -ne 2 ]; then
-    print_error "Usage: $0 <version> <commit-message>"
-    echo "Example: $0 0.1.2 \"Add new feature for X\""
+if [ $# -lt 1 ] || [ $# -gt 2 ]; then
+    print_error "Usage: $0 <version> [<summary>]"
+    echo "Examples:"
+    echo "  $0 0.1.2"
+    echo "  $0 0.1.2 \"Add new generator features\""
     exit 1
 fi
 
 VERSION=$1
-COMMIT_MSG=$2
+SUMMARY=${2:-}
 
 # Validate version format (x.y.z)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -45,6 +58,14 @@ if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
     exit 1
 fi
 
+# Construct the conventional release commit message.
+# Convention: "chore: Release fips-agents-cli vX.Y.Z" with optional " — <summary>".
+if [ -n "$SUMMARY" ]; then
+    COMMIT_MSG="chore: Release fips-agents-cli v${VERSION} — ${SUMMARY}"
+else
+    COMMIT_MSG="chore: Release fips-agents-cli v${VERSION}"
+fi
+
 print_info "Preparing release v$VERSION"
 echo
 

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/src/fips_agents_cli/cli.py

@@ -7,6 +7,7 @@ from fips_agents_cli.commands.add import add
 from fips_agents_cli.commands.create import create
 from fips_agents_cli.commands.generate import generate
 from fips_agents_cli.commands.patch import patch
+from fips_agents_cli.commands.vendor import vendor
 from fips_agents_cli.version import __version__
 
 console = Console()
@@ -29,6 +30,7 @@ cli.add_command(add)
 cli.add_command(create)
 cli.add_command(generate)
 cli.add_command(patch)
+cli.add_command(vendor)
 
 
 def main():

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/src/fips_agents_cli/commands/create.py

@@ -379,6 +379,12 @@ def mcp_server(
     default=False,
     help="Create GitHub repo only, don't clone locally",
 )
+@click.option(
+    "--vendored",
+    is_flag=True,
+    default=False,
+    help="Copy fipsagents source into the project instead of using PyPI dependency",
+)
 def agent(
     project_name: str,
     target_dir: str | None,
@@ -390,6 +396,7 @@ def agent(
     org: str | None,
     repo_description: str | None,
     remote_only: bool,
+    vendored: bool,
 ):
     """
     Create a new AI agent project from template.
@@ -410,6 +417,8 @@ def agent(
         fips-agents create agent my-research-agent --local
 
         fips-agents create agent my-research-agent --yes
+
+        fips-agents create agent my-research-agent --vendored --local
     """
     try:
         # Step 1: Validate options
@@ -495,8 +504,17 @@ def agent(
         ) as progress:
             progress.add_task(description="Cloning agent template...", total=None)
             try:
+                post_clone = None
+                if vendored:
+                    from fips_agents_cli.tools.project import vendor_fipsagents_from_clone
+
+                    post_clone = vendor_fipsagents_from_clone
+
                 template_commit = clone_template_subdir(
-                    AGENT_TEMPLATE_URL, target_path, AGENT_TEMPLATE_SUBDIR
+                    AGENT_TEMPLATE_URL,
+                    target_path,
+                    AGENT_TEMPLATE_SUBDIR,
+                    post_clone_fn=post_clone,
                 )
             except Exception as e:
                 console.print("\n[red]✗[/red] Failed to clone agent template")
@@ -517,6 +535,10 @@ def agent(
             try:
                 customize_agent_project(target_path, project_name, github_repo=github_repo)
                 cleanup_template_files(target_path)
+                if vendored:
+                    from fips_agents_cli.tools.project import rewrite_pyproject_for_vendored
+
+                    rewrite_pyproject_for_vendored(target_path)
                 if template_commit:
                     write_template_info(
                         target_path,
@@ -571,6 +593,8 @@ def agent(
             github_url=github_url,
             github_repo=github_repo,
         )
+        if vendored:
+            console.print("[cyan]  Framework source vendored in src/fipsagents/[/cyan]")
 
     except KeyboardInterrupt:
         console.print("\n[yellow]⚠[/yellow] Operation cancelled by user")

fips_agents_cli-0.8.2/src/fips_agents_cli/commands/vendor.py

@@ -0,0 +1,154 @@
+"""Vendor command for copying fipsagents source into an agent project."""
+
+import sys
+import tempfile
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.progress import Progress, SpinnerColumn, TextColumn
+
+console = Console()
+
+AGENT_TEMPLATE_URL = "https://github.com/fips-agents/agent-template"
+
+
+@click.command("vendor")
+@click.option(
+    "--update",
+    is_flag=True,
+    default=False,
+    help="Update an already-vendored project with the latest fipsagents source",
+)
+@click.option(
+    "--version",
+    "tag",
+    default=None,
+    help="Vendor a specific version (e.g., fipsagents-v0.7.0). Default: latest main.",
+)
+def vendor(update: bool, tag: str | None):
+    """
+    Vendor fipsagents source into the current project.
+
+    Copies the fipsagents framework source code into src/fipsagents/ so you
+    have full control over the framework. Replaces the PyPI dependency with
+    the individual packages that fipsagents depends on.
+
+    Use --update to refresh an already-vendored project with the latest
+    upstream source. Commit your changes first — update overwrites the
+    vendored source.
+
+    Examples:
+
+        fips-agents vendor
+
+        fips-agents vendor --version fipsagents-v0.7.0
+
+        fips-agents vendor --update
+    """
+    try:
+        project_path = Path.cwd()
+
+        # Verify we're in a project directory
+        pyproject_path = project_path / "pyproject.toml"
+        if not pyproject_path.exists():
+            console.print("[red]✗[/red] No pyproject.toml found. Run this from a project root.")
+            sys.exit(1)
+
+        vendored_marker = project_path / "src" / "fipsagents" / "VENDORED"
+        is_already_vendored = vendored_marker.exists()
+
+        if update and not is_already_vendored:
+            console.print(
+                "[red]✗[/red] Project is not vendored yet. "
+                "Run 'fips-agents vendor' (without --update) first."
+            )
+            sys.exit(1)
+
+        if is_already_vendored and not update:
+            # Show current version and ask if they want to update
+            console.print("[yellow]⚠[/yellow] fipsagents is already vendored in this project.")
+            console.print(f"  Marker: {vendored_marker}")
+            console.print("  Use --update to refresh from upstream.")
+            sys.exit(0)
+
+        # Warn about overwriting local changes
+        if update:
+            console.print(
+                "\n[yellow]⚠[/yellow] This will overwrite src/fipsagents/ with " "upstream source."
+            )
+            console.print(
+                "  Commit any local modifications first to preserve them in git history.\n"
+            )
+
+        console.print("[bold cyan]Vendoring fipsagents[/bold cyan]\n")
+
+        # Clone the agent-template repo
+        import git as gitmodule
+
+        with tempfile.TemporaryDirectory() as tmp:
+            tmp_path = Path(tmp) / "repo"
+
+            with Progress(
+                SpinnerColumn(),
+                TextColumn("[progress.description]{task.description}"),
+                console=console,
+            ) as progress:
+                progress.add_task(description="Cloning agent-template repo...", total=None)
+                try:
+                    repo = gitmodule.Repo.clone_from(
+                        AGENT_TEMPLATE_URL,
+                        str(tmp_path),
+                        branch="main",
+                        depth=1,
+                        single_branch=True,
+                    )
+
+                    # Checkout specific tag if requested
+                    if tag:
+                        try:
+                            repo.git.fetch("origin", f"refs/tags/{tag}:refs/tags/{tag}")
+                            repo.git.checkout(tag)
+                            console.print(f"[green]✓[/green] Checked out tag: {tag}")
+                        except gitmodule.GitCommandError:
+                            console.print(
+                                f"[red]✗[/red] Tag '{tag}' not found. "
+                                f"Available tags: fipsagents-v0.7.0, etc."
+                            )
+                            sys.exit(1)
+
+                except gitmodule.GitCommandError as e:
+                    console.print(f"[red]✗[/red] Failed to clone: {e}")
+                    sys.exit(1)
+
+            # Copy the fipsagents source
+            from fips_agents_cli.tools.project import (
+                rewrite_pyproject_for_vendored,
+                vendor_fipsagents_from_clone,
+            )
+
+            vendor_fipsagents_from_clone(tmp_path, project_path)
+
+            # Only rewrite pyproject.toml if not already vendored
+            # (on --update, deps are already rewritten)
+            if not is_already_vendored:
+                rewrite_pyproject_for_vendored(project_path)
+
+        # Success
+        console.print("\n[bold green]Vendoring complete![/bold green]\n")
+        console.print("Next steps:")
+        console.print("  1. pip install -e .          # Reinstall with vendored source")
+        console.print("  2. make test                 # Verify everything works")
+        console.print("  3. git add src/fipsagents/   # Commit the vendored source")
+        console.print("")
+        if update:
+            console.print(
+                "[dim]Tip: Use 'git diff src/fipsagents/' to review upstream changes.[/dim]"
+            )
+
+    except KeyboardInterrupt:
+        console.print("\n[yellow]Cancelled[/yellow]")
+        sys.exit(130)
+    except Exception as e:
+        console.print(f"\n[red]✗[/red] Unexpected error: {e}")
+        sys.exit(1)

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/src/fips_agents_cli/tools/git.py

@@ -1,5 +1,7 @@
 """Git operations for cloning and initializing repositories."""
 
+from __future__ import annotations
+
 import shutil
 import tempfile
 from pathlib import Path
@@ -60,7 +62,12 @@ def clone_template(repo_url: str, target_path: Path, branch: str = "main") -> st
 
 
 def clone_template_subdir(
-    repo_url: str, target_path: Path, subdir: str, branch: str = "main"
+    repo_url: str,
+    target_path: Path,
+    subdir: str,
+    branch: str = "main",
+    *,
+    post_clone_fn: callable | None = None,
 ) -> str:
     """
     Clone a monorepo and extract a subdirectory as the project root.
@@ -89,6 +96,8 @@ def clone_template_subdir(
         if not src.is_dir():
             raise FileNotFoundError(f"Subdirectory '{subdir}' not found in template repo")
         shutil.copytree(src, target_path, dirs_exist_ok=True)
+        if post_clone_fn is not None:
+            post_clone_fn(tmp_path, target_path)
         return commit_hash
 
 

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/src/fips_agents_cli/tools/project.py

@@ -206,6 +206,7 @@ def customize_agent_project(
             project_path / "Containerfile",
             project_path / "Makefile",
             project_path / "deploy.sh",
+            project_path / "redeploy.sh",
         ]
 
         for file_path in files_to_update:
@@ -213,7 +214,31 @@ def customize_agent_project(
 
         console.print("[green]✓[/green] Updated configuration files")
 
-        # 3. Replace OWNER/REPO placeholder in Containerfile image source label
+        # 3. Remove monorepo-specific base-agent install line from Makefile
+        # Cloned projects get fipsagents from PyPI, not a local path
+        makefile_path = project_path / "Makefile"
+        if makefile_path.exists():
+            text = makefile_path.read_text()
+            # Remove the monorepo install line and its comments
+            lines = text.splitlines(keepends=True)
+            filtered = []
+            skip_block = False
+            for line in lines:
+                if "In the monorepo" in line:
+                    skip_block = True
+                    continue
+                if skip_block and ("fips-agents" in line or "scaffolding step" in line):
+                    continue
+                if skip_block and ("$(PIP) install -e" in line and "packages/" in line):
+                    skip_block = False
+                    continue
+                skip_block = False
+                filtered.append(line)
+            makefile_path.write_text("".join(filtered))
+
+        console.print("[green]✓[/green] Cleaned up Makefile for standalone use")
+
+        # 4. Replace OWNER/REPO placeholder in Containerfile image source label
         repo_value = github_repo if github_repo else f"OWNER/{new_name}"
         _replace_in_file(project_path / "Containerfile", "OWNER/REPO", repo_value)
 
@@ -541,3 +566,107 @@ def write_template_info(
     except Exception as e:
         # Don't fail the entire operation if this fails
         console.print(f"[yellow]⚠[/yellow] Could not write template info: {e}")
+
+
+def vendor_fipsagents_from_clone(
+    clone_path: Path,
+    project_path: Path,
+) -> None:
+    """
+    Copy fipsagents package source from a monorepo clone into the project.
+
+    Called as a post_clone_fn callback during clone_template_subdir() when
+    --vendored is used, or directly by 'fips-agents vendor' for post-scaffold
+    vendoring.
+
+    Args:
+        clone_path: Root of the cloned agent-template monorepo
+        project_path: Root of the target project
+    """
+    pkg_src = clone_path / "packages" / "fipsagents" / "src" / "fipsagents"
+    if not pkg_src.is_dir():
+        console.print("[red]✗[/red] fipsagents package not found in template repo")
+        raise FileNotFoundError(f"Expected fipsagents source at {pkg_src}")
+
+    dest = project_path / "src" / "fipsagents"
+
+    # Remove existing vendored source if present (for --update)
+    if dest.exists():
+        shutil.rmtree(dest)
+
+    shutil.copytree(pkg_src, dest)
+    console.print("[green]✓[/green] Copied fipsagents source to src/fipsagents/")
+
+    # Copy upstream pyproject.toml as provenance record
+    upstream_toml = clone_path / "packages" / "fipsagents" / "pyproject.toml"
+    if upstream_toml.exists():
+        shutil.copy2(upstream_toml, dest / "UPSTREAM.toml")
+
+    # Read version from the vendored package
+    version = "unknown"
+    init_file = dest / "baseagent" / "__init__.py"
+    if init_file.exists():
+        for line in init_file.read_text().splitlines():
+            if line.startswith("__version__"):
+                version = line.split("=")[1].strip().strip('"').strip("'")
+                break
+
+    # Write VENDORED marker
+    marker = dest / "VENDORED"
+    marker.write_text(
+        f"version: {version}\n"
+        f"vendored: {datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M UTC')}\n"
+        f"source: https://github.com/fips-agents/agent-template\n"
+        f"\n"
+        f"This fipsagents source is vendored into the project.\n"
+        f"To update: fips-agents vendor --update\n"
+    )
+    console.print(f"[green]✓[/green] Wrote VENDORED marker (version {version})")
+
+
+def rewrite_pyproject_for_vendored(project_path: Path) -> None:
+    """
+    Rewrite pyproject.toml to replace fipsagents pip dependency with
+    the individual dependencies that fipsagents itself declares.
+
+    Args:
+        project_path: Root of the target project
+    """
+    pyproject_path = project_path / "pyproject.toml"
+    if not pyproject_path.exists():
+        return
+
+    with open(pyproject_path) as f:
+        pyproject = tomlkit.parse(f.read())
+
+    # Replace fipsagents[server] with its individual dependencies
+    vendored_deps = [
+        "litellm>=1.83.0",
+        "fastmcp>=3.0.0",
+        "pydantic>=2.0",
+        "pyyaml",
+        "httpx",
+        "python-frontmatter",
+        "fastapi>=0.110",
+        "uvicorn[standard]>=0.27",
+    ]
+
+    if "project" in pyproject and "dependencies" in pyproject["project"]:
+        old_deps = list(pyproject["project"]["dependencies"])
+        new_deps = [d for d in old_deps if "fipsagents" not in d.lower()]
+        new_deps.extend(vendored_deps)
+        pyproject["project"]["dependencies"] = new_deps
+
+    # Fix optional memory dependency too
+    if "project" in pyproject:
+        opt_deps = pyproject["project"].get("optional-dependencies", {})
+        if "memory" in opt_deps:
+            old_memory = list(opt_deps["memory"])
+            new_memory = [d for d in old_memory if "fipsagents" not in d.lower()]
+            new_memory.append("memoryhub")
+            opt_deps["memory"] = new_memory
+
+    with open(pyproject_path, "w") as f:
+        f.write(tomlkit.dumps(pyproject))
+
+    console.print("[green]✓[/green] Updated pyproject.toml (vendored dependencies)")

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/src/fips_agents_cli/version.py

@@ -1,3 +1,3 @@
 """Version information for fips-agents-cli."""
 
-__version__ = "0.7.0"
+__version__ = "0.8.2"

fips_agents_cli-0.8.2/tests/fixtures/middleware_template/component.py.j2

@@ -0,0 +1,39 @@
+"""{{ description }}"""
+
+import mcp.types as mt
+from fastmcp.server.middleware import CallNext, Middleware, MiddlewareContext
+from fastmcp.tools.tool import ToolResult
+
+from src.core.logging import get_logger
+
+log = get_logger("middleware.{{ component_name }}")
+
+
+class {{ component_name | replace('_', ' ') | title | replace(' ', '') }}Middleware(Middleware):
+    """{{ description }}
+
+    To activate, add an instance to the middleware=[] list in create_server()
+    (see src/core/server.py).
+    """
+
+    async def on_call_tool(
+        self,
+        context: MiddlewareContext[mt.CallToolRequestParams],
+        call_next: CallNext[mt.CallToolRequestParams, ToolResult],
+    ) -> ToolResult:
+        """Wrap tool execution with {{ component_name }} logic."""
+        tool_name = context.message.name
+
+        log.debug(f"{{ component_name }} middleware: before {tool_name}")
+
+        # TODO: Add pre-execution logic here
+
+        try:
+            result = await call_next(context)
+        except Exception as e:
+            log.error(f"{{ component_name }} middleware: error in {tool_name}: {e}")
+            raise
+
+        # TODO: Add post-execution logic here
+
+        return result

fips_agents_cli-0.8.2/tests/fixtures/middleware_template/test.py.j2

@@ -0,0 +1,40 @@
+"""Tests for {{ component_name }} middleware."""
+
+import pytest
+from unittest.mock import AsyncMock, MagicMock
+import mcp.types as mt
+
+from src.middleware.{{ module_path }} import {{ component_name | replace('_', ' ') | title | replace(' ', '') }}Middleware
+
+
+@pytest.mark.asyncio
+async def test_{{ component_name }}_success():
+    """Test middleware handles successful execution."""
+    middleware = {{ component_name | replace('_', ' ') | title | replace(' ', '') }}Middleware()
+
+    # Create mock context
+    context = MagicMock(spec=mt.CallToolRequestParams)
+    context.message.name = "test_tool"
+
+    # Create mock call_next
+    call_next = AsyncMock(return_value="success_result")
+
+    # Execute middleware
+    result = await middleware.on_call_tool(context, call_next)
+
+    assert result == "success_result"
+    call_next.assert_called_once_with(context)
+
+
+@pytest.mark.asyncio
+async def test_{{ component_name }}_error():
+    """Test middleware handles errors."""
+    middleware = {{ component_name | replace('_', ' ') | title | replace(' ', '') }}Middleware()
+
+    context = MagicMock(spec=mt.CallToolRequestParams)
+    context.message.name = "failing_tool"
+
+    call_next = AsyncMock(side_effect=ValueError("Test error"))
+
+    with pytest.raises(ValueError, match="Test error"):
+        await middleware.on_call_tool(context, call_next)

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/tests/test_create.py

@@ -661,7 +661,7 @@ class TestCreateAgent:
         mock_is_git_installed.return_value = True
         mock_gh_installed.return_value = False
 
-        def create_minimal_structure(url, target_path, subdir, branch=None):
+        def create_minimal_structure(url, target_path, subdir, branch=None, **kwargs):
             target_path.mkdir(parents=True, exist_ok=True)
             (target_path / "pyproject.toml").write_text('[project]\nname = "agent-template"')
 
@@ -698,7 +698,7 @@ class TestCreateAgent:
         mock_is_git_installed.return_value = True
         mock_gh_installed.return_value = False
 
-        def create_minimal_structure(url, target_path, subdir, branch=None):
+        def create_minimal_structure(url, target_path, subdir, branch=None, **kwargs):
             target_path.mkdir(parents=True, exist_ok=True)
             (target_path / "pyproject.toml").write_text('[project]\nname = "agent-template"')
 
@@ -763,7 +763,7 @@ class TestCreateAgentGitHub:
         mock_get_username.return_value = "testuser"
         mock_push.return_value = True
 
-        def create_minimal_structure(url, target_path, subdir, branch=None):
+        def create_minimal_structure(url, target_path, subdir, branch=None, **kwargs):
             target_path.mkdir(parents=True, exist_ok=True)
             (target_path / "pyproject.toml").write_text('[project]\nname = "agent-template"')
 
@@ -839,7 +839,7 @@ class TestCreateAgentGitHub:
         mock_get_username.return_value = "testuser"
         mock_push.return_value = True
 
-        def create_minimal_structure(url, target_path, subdir, branch=None):
+        def create_minimal_structure(url, target_path, subdir, branch=None, **kwargs):
             target_path.mkdir(parents=True, exist_ok=True)
             (target_path / "pyproject.toml").write_text('[project]\nname = "agent-template"')
 

{fips_agents_cli-0.7.0 → fips_agents_cli-0.8.2}/tests/test_generate.py

@@ -398,6 +398,123 @@ class TestGenerateMiddlewareCommand:
             os.chdir(original_cwd)
 
 
+@pytest.fixture
+def mock_mcp_project_with_real_middleware_template(tmp_path):
+    """Mock MCP project that uses the real middleware Jinja2 templates as fixtures.
+
+    Templates are committed under tests/fixtures/middleware_template/ so the
+    test runs offline and is not coupled to mcp-server-template's git state.
+    Refresh the fixtures when the upstream template changes meaningfully.
+    """
+    import shutil
+    from pathlib import Path
+
+    pyproject_content = """
+[project]
+name = "test-mcp-server"
+version = "0.1.0"
+dependencies = [
+    "fastmcp>=3.0.0",
+]
+"""
+    (tmp_path / "pyproject.toml").write_text(pyproject_content)
+
+    for component_dir in ["middleware"]:
+        (tmp_path / "src" / component_dir).mkdir(parents=True)
+        (tmp_path / "tests" / component_dir).mkdir(parents=True)
+
+    fixture_dir = Path(__file__).parent / "fixtures" / "middleware_template"
+    generators_dir = tmp_path / ".fips-agents-cli" / "generators" / "middleware"
+    generators_dir.mkdir(parents=True)
+    shutil.copy(fixture_dir / "component.py.j2", generators_dir / "component.py.j2")
+    shutil.copy(fixture_dir / "test.py.j2", generators_dir / "test.py.j2")
+
+    return tmp_path
+
+
+class TestGenerateMiddlewareRealTemplate:
+    """Integration tests that render the real v3.x middleware template.
+
+    These guard against regressions that would slip past the synthetic
+    `mock_mcp_project` fixture, which uses a stripped-down template that
+    doesn't exercise fastmcp imports, class structure, or the real
+    Jinja2 conditionals.
+    """
+
+    @pytest.mark.parametrize("hook_type", ["before_tool", "after_tool", "on_error"])
+    def test_real_template_renders_for_each_hook_type(
+        self, runner, mock_mcp_project_with_real_middleware_template, hook_type
+    ):
+        """Each --hook-type renders valid Python against the real v3.x template."""
+        import ast
+        import os
+
+        project = mock_mcp_project_with_real_middleware_template
+        original_cwd = os.getcwd()
+        try:
+            os.chdir(project)
+            result = runner.invoke(
+                generate,
+                [
+                    "middleware",
+                    f"{hook_type}_mw",
+                    "--description",
+                    f"{hook_type} hook middleware",
+                    "--hook-type",
+                    hook_type,
+                ],
+                catch_exceptions=False,
+            )
+            assert result.exit_code == 0, result.output
+
+            rendered = project / "src" / "middleware" / f"{hook_type}_mw.py"
+            assert rendered.exists()
+
+            source = rendered.read_text()
+            ast.parse(source)  # raises if invalid Python
+            assert "from fastmcp.server.middleware import" in source
+            assert "class " in source and "Middleware(Middleware):" in source
+            assert "async def on_call_tool" in source
+
+            test_file = project / "tests" / "middleware" / f"test_{hook_type}_mw.py"
+            assert test_file.exists()
+            ast.parse(test_file.read_text())
+        finally:
+            os.chdir(original_cwd)
+
+    def test_real_template_renders_without_hook_type(
+        self, runner, mock_mcp_project_with_real_middleware_template
+    ):
+        """Omitting --hook-type still produces a valid generic wrapper (backward compat)."""
+        import ast
+        import os
+
+        project = mock_mcp_project_with_real_middleware_template
+        original_cwd = os.getcwd()
+        try:
+            os.chdir(project)
+            result = runner.invoke(
+                generate,
+                [
+                    "middleware",
+                    "generic_mw",
+                    "--description",
+                    "generic middleware",
+                ],
+                catch_exceptions=False,
+            )
+            assert result.exit_code == 0, result.output
+
+            rendered = project / "src" / "middleware" / "generic_mw.py"
+            assert rendered.exists()
+            source = rendered.read_text()
+            ast.parse(source)
+            assert "class GenericMwMiddleware(Middleware):" in source
+            assert "async def on_call_tool" in source
+        finally:
+            os.chdir(original_cwd)
+
+
 class TestGenerateErrorCases:
     """Tests for error handling."""