microsoft-apm-596-609

-rw-r--r-- 1 root root   4086 Nov  5 16:21 CONTRIBUTING.md
-rw-r--r-- 1 root root   1074 Nov  5 16:20 LICENSE
-rw-r--r-- 1 root root   1577 Nov  5 16:20 MANIFESTO.md
-rw-r--r-- 1 root root   5474 Nov  5 16:21 README.md
-rw-r--r-- 1 root root    542 Nov  5 16:20 SECURITY.md
-rw-r--r-- 1 root root    548 Nov  5 16:20 
…[1345 chars omitted]…
cripts/install.sh
./scripts/setup-plan.sh
./scripts/test-auth-acceptance.sh
./scripts/test-dependency-integration.sh
./scripts/test-integration.sh
./scripts/test-release-validation.sh
./scripts/update-agent-context.sh
./SECURITY.md
./SUPPORT.md
./templates/policy-ci-workflow.yml
./tests/basic_workflow_test.py
./tests/conftest.py
./tests/manual_workflow_script.py
./tests/noninteractive_workflow_test.py

src/apm_cli/adapters/client/cursor.py
src/apm_cli/adapters/client/opencode.py
src/apm_cli/adapters/client/vscode.py
src/apm_cli/adapters/package_manager/__init__.py
src/apm_cli/adapters/package_manager/base.py
src/apm_cli/adapters/package_manager/default_manager.py
src/apm_cli/bundle/__init__.py
src/apm_cli/bundle/lockfile_enrichment.py
src/apm_cli/bundle/packer.py
src/apm_cli/bundle/plugin_exporter.py
src/apm_cli/bundle/unpacker.py
src/apm_cli/cli.py
src/apm_cli/commands
…[8629 chars omitted]…
_windows.py
tests/unit/test_safe_installer.py
tests/unit/test_script_runner.py
tests/unit/test_security_gate.py
tests/unit/test_selective_install.py
tests/unit/test_ssl_cert_hook.py
tests/unit/test_transitive_deps.py
tests/unit/test_transitive_mcp.py
tests/unit/test_uninstall_reintegration.py
tests/unit/test_uninstall_transitive_cleanup.py
tests/unit/test_unpack_security.py
tests/unit/test_unpacker.py

                        {"type": "command", "command": "./scripts/validate.sh", "timeout": 10}
                    ]
                }
            ]
        }
    }

Hook JSON format (GitHub Copilot  -- flat arrays with bash/powershell keys):
    {
        "version": 1,
        "hooks": {
            "preToolUse": [
                {"type": "command", "bash": "./scripts/validate.sh", "timeoutSec": 10}
            ]
        }
    }

Hook JSON format (Cursor  -- flat arrays w
…[8508 chars omitted]…
      source_file = (resolve_base / rel_path).resolve()
            # Reject path traversal outside the package directory
            if not source_file.is_relative_to(package_path.resolve()):
                continue
            if source_file.exists() and source_file.is_file():
                target_rel = f"{scripts_base}/{rel_path}"
                scripts_to_copy.append((source_file, target_rel))

        root_dir: Optional[str] = None,
    ) -> Tuple[Dict, List[Tuple[Path, str]]]:
        """Rewrite all command paths in a hooks JSON structure.

        Creates a deep copy and rewrites command paths for the target platform.

        Args:
            data: Parsed hook JSON data
            package_path: Root path of the source package
            package_name: Name for scripts subdirectory
            target: "vscode" or "claude"
            hook_file_dir: Directory containing the hook JSON file (for ./path resolutio
…[8629 chars omitted]…

    ) -> "HookIntegrationResult":
        """Integrate hooks for a single *target*.

        Copilot uses individual JSON files (genuinely different pattern).
        All other merge-based targets are dispatched via the
        ``_MERGE_HOOK_TARGETS`` registry.
        """
        if target.name == "copilot":
            return self.integrate_package_hooks(
                package_info, project_root,

            managed_files: Set of relative paths known to be APM-managed
            target: Optional TargetProfile for scope-resolved root_dir

        Returns:
            HookIntegrationResult: Results of the integration operation
        """
        hook_files = self.find_
…[4940 chars omitted]…
          if not isinstance(entries, list):
                    continue
                if event_name not in json_config["hooks"]:
                    json_config["hooks"][event_name] = []

                # Mark each entry with APM source for sync/cleanup
                for entry in entries:
                    if isinstance(entry, dict):
                        entry["_apm_source"] = package_name

101:                        f"The package may not contain the expected prompt file.\n"
109:        err
…[4266 chars omitted]…
       self._handle_prompt_collision(name, matches)
576:    def _discover_qualified_prompt(self, qualified_path: str) -> Optional[Path]:
577:        """Discover prompt using qualified path (owner/repo/name format).
583:            Path to discovered prompt file, or None if not found
591:        # Extract prompt name (last part)
592:        prompt_name = parts[-1]
1030 src/apm_cli/core/script_runner.py

        - Simple: "code-review" -> searches everywhere
        - Qualified: "github/awesome-copilot/code-review" -> searches specific package

        Search order for simple names:
        1. Local root: ./{name}.prompt.md
        2. Local prompts: .apm/prompts/{name}.p
…[8629 chars omitted]…
params: Parameters to substitute
1021-
1022-        Returns:
1023-            Content with parameters substituted
1024-        """
1025-        result = content
1026-        for key, value in params.items():
1027-            # Replace ${input:key} placeholders
1028-            placeholder = f"${{input:{key}}}"
1029-            result = result.replace(placeholder, str(value))
1030-        return result

        if len(parts) < 2:
            return None

        # Extract prompt name (last part)
        prompt_name = parts[-1]
        if not prompt_name.endswith(".prompt.md"):
            prompt_name = f"{prompt_name}.prompt.md"

        # Build possible package directory patterns
        # Could be: owner/repo or owner/repo-promptname (virtual packages)
        apm_modules = Path("apm_modules")
        if not apm_modules.exist
…[5475 chars omitted]…
dep_ref = DependencyReference.parse(package_ref)

            if not dep_ref.is_virtual:
                return False

            # Ensure apm_modules exists
            apm_modules = Path("apm_modules")
            apm_modules.mkdir(parents=True, exist_ok=True)

            # Use the canonical install path from the dependency reference
            target_path = dep_ref.get_install_path(apm_modules)

import tempfile
import shutil
from pathlib import Path
from unittest.mock import MagicMock

import pytest

from apm_cli.integration.hook_integrator import HookIntegrator, HookIntegrationResult
from apm_cli.models.apm_package import APMPackage, PackageInfo


def _make_package_info(install_path: Path, name: str = "test-pkg") -> PackageInfo:
    """Create a minimal PackageInfo for testing."""
    package = APMPackage(name=name, version="1.0.0")
    return PackageInfo(pa
…[8628 chars omitted]…
learning-output-style")
        integrator = HookIntegrator()

        result = integrator.integrate_package_hooks(pkg_info, temp_project)

        assert result.files_integrated == 1
        assert result.scripts_copied == 1

        # Verify rewritten paths
        target_json = temp_project / ".github" / "hooks" / "learning-output-style-hooks.json"
        data = json.loads(target_json.read_text())

    symlinks:
src/apm_cli/utils/file_ops.py:225:        Preserve symlinks instead of following them.
src/apm_cli/utils/file_ops.py:244:            symlinks=symlinks,
src/apm_cli/utils/paths.py:22:        return path.resolve().relative_to(base.resolve()).as_posix()
src/apm_cli/utils/paths.py:25:            return path.resolve().as_posix()
src/apm_cli/utils/path_security.py:13:  ``Path.is_relative_to``.

logger = logging.getLogger(__name__)
from ..models.apm_package import APMPackage
from ..deps.lockfile import LockFile


# Common primitive patterns for local discovery (with recursive search)
LOCAL_PRIMITIVE_PATTERNS: Dict[str, List[str]] = {
    'chatmode': [
        # New standard (.agent.md)
        "**/.apm/agents/*.agent.md",
        "**/.github/agents/*.agent.md",
        "**/*.agent.md",  # Generic .agent.md files
        # Legacy support (.chatmode.md)
        "**/.apm/chatmodes/*.chatmode.md",
        "**/.github/chatmodes/*.chatmode.md",
        "**/*.chat
…[8629 chars omitted]…
 check.
    
    Returns:
        bool: True if directory should be skipped, False otherwise.
    """
    skip_patterns = {
        '.git',
        'node_modules',
        '__pycache__',
        '.pytest_cache',
        '.venv',
        'venv',
        '.tox',
        'build',
        'dist',
        '.mypy_cache'
    }
    
    dir_name = os.path.basename(dir_path)
    return dir_name in skip_patterns

        collection (PrimitiveCollection): Collection to add primitives to.
        exclude_patterns (Optional[List[str]]): Pre-validated exclude patterns.
    """
    # Find and parse files for each primitive type
    for primitive_type, patterns in LOCAL_PRIMITIVE_PATTERNS.items():
        files = find_primitive_files(base_dir, patterns)
        
        # Filter out files from apm_modules to avoid conflicts with dependency scanning
        local_files = []
        base_path = Path(base_dir)
        apm_modules_path = base_path / "apm_modules"
        
        for file_path in files:
            # Only
…[8328 chars omitted]…
kill_path)
            return
        try:
            skill = parse_skill_file(skill_path, source="local")
            collection.add_primitive(skill)
        except Exception as e:
            print(f"Warning: Failed to parse SKILL.md: {e}")


def _discover_skill_in_directory(directory: Path, collection: PrimitiveCollection, source: str) -> None:
    """Discover SKILL.md in a package directory.

class PromptIntegrator(BaseIntegrator):
    """Handles integration of APM package prompts into .github/prompts/."""
    
    def find_prompt_files(self, package_path: Path) -> List[Path]:
        """Find all .prompt.md files in a package.
        
        Searches in:
        - Package root directory
        - .apm/prompts/ subdirectory
        
        Args:
            package_path: Path to the package directory
            
        Returns:
            List[Path]: List of absolute paths to .prompt.m
…[8630 chars omitted]…
 (skip stop_at itself)
        candidates: set = set()
        for p in deleted_paths:
            parent = p.parent
            while parent != stop_at and parent.resolve() != stop_resolved:
                candidates.add(parent)
                parent = parent.parent
        # Sort deepest-first for safe bottom-up removal
        for d in sorted(candidates, key=lambda p: len(p.parts), reverse=True):

from apm_cli.integration.base_integrator import BaseIntegrator, IntegrationResult
from apm_cli.utils.paths import portable_relpath

if TYPE_CHECKING:
    from apm_cli.integration.targets import TargetProfile


class AgentIntegrator(BaseIntegrator):
    """Handles integration of APM package agents into .github/agents/, .claude/agents/, and .cursor/agents/."""
    
    def find_agent_files(self, package_path: Path) -> List[Path]:
        """Find all .agent.md and .chatmode.md files in a packa
…[8629 chars omitted]…
integrator.py:991:                if target.exists() and target.is_dir():
src/apm_cli/integration/skill_integrator.py:1015:                    if sub_skill_path.is_dir() and (sub_skill_path / "SKILL.md").exists():
src/apm_cli/integration/skill_integrator.py:1028:            # Only clean if the owning target dir exists
src/apm_cli/integration/skill_integrator.py:1034:            if skills_dir.exists():

from pathlib import Path
from typing import TYPE_CHECKING, Dict, List, Optional, Set

from apm_cli.integration.base_integrator import BaseIntegrator, IntegrationResult
from apm_cli.utils.paths import portable_relpath

if TYPE_CHECKING:
    from apm_cli.integration.targets import TargetProfile


class InstructionIntegrator(BaseIntegrator):
    """Handles integration of APM package instructions.

    Deploys .instructions.md files to target-specific directories:

    * Copilot: ``.github/instructions/
…[6854 chars omitted]…
pm/memory/
        apm_memory = package_path / ".apm" / "memory"
        if apm_memory.exists():
            context_files.extend(apm_memory.glob("*.memory.md"))
        
        return context_files
    
    @staticmethod
    def _dirs_equal(dir_a: Path, dir_b: Path) -> bool:
        """Check if two directory trees have identical file contents."""
        dcmp = filecmp.dircmp(str(dir_a), str(dir_b))

74-        3. ``rel_path`` is **not** in the managed set (-> user-authored)
75-        4. ``force`` is ``False``
76-
77-        When *diagnostics* is provided the skip is recorded there;
78-        otherwise a warning is emitted via ``_rich_warning``.
79-
80-        .. note:: Callers must pre-normalize *managed_files* with
81-           forward-slash separators (see ``normalize_managed_files``).
82-        """
83-        if managed_file
…[6926 chars omitted]…
       dirs.extend(package_path / s for s in subdirs)
427-
428-        for d in dirs:
429-            if not d.exists():
430-                continue
431-            for f in sorted(d.glob(pattern)):
432-                resolved = f.resolve()
433-                if resolved not in seen:
434-                    seen.add(resolved)
435-                    results.append(f)
436-
437-        return results

tests/unit/test_unpack_security.py:123:            pytest.skip("Platform does not support symlinks")
tests/unit/test_unpack_security.py:125:        # Add the symlink to the lockfile so unpacker tries to process it
tests/unit/test_unpack_security.py:134:        # Should not raise — symlinks are skipped during scanning

    {name = "Daniel Meppiel", email = "user@example.com"}
]
classifiers = [
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.9",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
]
dependencies = [
    "click>=8.0.0",
    "colorama>=0.4.6",
    "pyyaml>=6.0.0",
    "requests>=2.28.0",
    "python-frontmatter>=1.0.0",
    "llm>=0.17.0",
    "llm-github-models>=0.1.0",
    "tomli>=1.2.0; python_version<'3.11'",
    
…[4931 chars omitted]…
X output on every platform.

    When *path* is not under *base* (or resolution fails), falls back to
    a resolved absolute POSIX path.
    """
    try:
        return path.resolve().relative_to(base.resolve()).as_posix()
    except (ValueError, OSError, RuntimeError):
        try:
            return path.resolve().as_posix()
        except (OSError, RuntimeError):
            return path.as_posix()

315-                os.chdir(tmpdir)
316-                
317-                # Create local prompt file
318:                prompt_file = Path("hello-world.prompt.md")
319:                prompt_file.write_text("Hello World!")
320-                
321:                result = self.compiler._resolve_prompt_file("hello-world.prompt.md")
322:                assert result == prompt_file
323-            finally:
324-             
…[8629 chars omitted]…
 def test_run_script_handles_install_success_but_no_prompt(self, mock_file, mock_exists,
731-                                                              mock_discover, mock_auto_install):
732-        """Test error when package installs successfully but prompt not found."""
--
763-                assert result.name == "SKILL.md"
764-            finally:
765-                os.chdir(original_dir)
766-

        
    def test_resolve_prompt_file_local_exists(self):
        """Test resolving prompt file when it exists locally."""
        with tempfile.TemporaryDirectory() as tmpdir:
            # Change to temp directory for test
            original_cwd = Path.cwd()
            try:
                import os
                os.chdir(tmpdir)
                
                # Create local prompt file
                prompt_file = Path("hello-world.prompt.m
…[8629 chars omitted]…
 = ScriptRunner()

    @patch("apm_cli.core.script_runner.subprocess.run")
    @patch("apm_cli.core.script_runner.shutil.which", return_value=r"C:\npm\copilot.cmd")
    @patch("apm_cli.core.script_runner.sys")
    def test_resolves_executable_on_windows(self, mock_sys, mock_which, mock_run):
        """On win32, the executable should be resolved via shutil.which."""
        mock_sys.platform = "win32"

docs/src/content/docs/reference/lockfile-spec.md:175:# Incorrect — backslashes are not permitted
CHANGELOG.md:262:- Windows native support (Phase 1 & 2) — cross-platform runtime management, PowerShell helpers, and CI parity — by @sergio-sisternes-epam (#227)

        managed_files = {".claude/hooks/hookify/pretooluse.py"}
        stats = integrator.sync_integration(None, temp_project, managed_files=managed_files)

        assert stats["files_removed"] == 1
        assert not (temp_project / ".claude" / "hooks").e
…[8177 chars omitted]…
ath should NOT be rewritten and no scripts copied
        assert cmd == "./../../secrets.txt"
        assert len(scripts) == 0

    def test_rewrite_bash_key(self, temp_project):
        """Test rewriting the bash key (GitHub Copilot format)."""
        pkg_dir = temp_project / "pkg"
        (pkg_dir / "scripts").mkdir(parents=True)
        (pkg_dir / "scripts" / "check.sh").write_text("#!/bin/bash")

    def test_rewrite_powershell_key(self, temp_project):
        """Test rewriting the powershell key (GitHub Copilot format)."""
        pkg_dir = temp_project / "pkg"
        (pkg_dir / "scripts").mkdir(parents=True)
        (pkg_dir / "scripts" / "check.ps1").write_text("Write-Host 'ok'")

        integrator = HookIntegrator()
        cmd, scripts = integrator._rewrite_command_for_target(
            "./scripts/check.ps1",
            pkg_dir,
            "my-pkg",
            "vscode",
        )

        assert "./" not in cmd
        asser
…[7310 chars omitted]…
bin/bash")
        (pkg_dir / "scripts" / "format-mac.sh").write_text("#!/bin/bash")

        data = {
            "hooks": {
                "PostToolUse": [
                    {
                        "type": "command",
                        "command": "./scripts/format.sh",
                        "osx": "./scripts/format-mac.sh",
                    }
                ]
            }
        }

        pkg_dir = temp_project / "pkg"
        (pkg_dir / "scripts").mkdir(parents=True)
        (pkg_dir / "scripts" / "validate.sh").write_text("#!/bin/bash")
        (pkg_dir / "scripts" / "validate-mac.sh").write_text("#!/bin/bash")

        data = {
            "hooks": {
                "PreToolUse": [
                  
…[8629 chars omitted]…
  assert hooks_json.exists()
        data = json.loads(hooks_json.read_text())
        assert "SessionStart" in data["hooks"]
        entries = data["hooks"]["SessionStart"]
        assert any(e.get("_apm_source") == "test-pkg" for e in entries)

    def test_codex_hooks_preserve_user_hooks(self):
        """Existing user hooks in .codex/hooks.json are preserved."""
        # Write existing user hooks

    def test_integrate_hooks_with_scripts_in_hooks_subdir(self, temp_project):
        """Test full integration when hook JSON and scripts are both inside hooks/ subdir."""
        pkg_dir = temp_project / "apm_modules" / "myorg" / "lint-hooks"
        hooks_dir = pkg_dir / "hooks"
        scripts_dir = hooks_dir / "scripts"
        scripts_dir.mkdir(parents=True)

        hook_data = {
            "hooks": {
                "PostToolUse": [
                    {
                        "matcher": {"tool_name": "write_to_file"}
…[6512 chars omitted]…
rewritten, _ = integrator._rewrite_hooks_data(data, pkg_dir, "test", "vscode")

        # Original should be unchanged
        assert data["hooks"]["Stop"][0]["hooks"][0]["command"] == original_cmd
        # Rewritten should be different
        assert rewritten["hooks"]["Stop"][0]["hooks"][0]["command"] != original_cmd


# --- Codex hook integration tests ---------------------------------------------

tests/unit/primitives/test_discovery_parser.
…[8629 chars omitted]…
       found_files = find_primitive_files(self.temp_dir_path, patterns)
tests/unit/primitives/test_primitives.py-719-
tests/unit/primitives/test_primitives.py-720-        # Should find the .apm file
tests/unit/primitives/test_primitives.py-721-        self.assertEqual(len(found_files), 1)
tests/unit/primitives/test_primitives.py-722-        self.assertTrue(found_files[0].name.endswith(".chatmode.md"))

125:    def test_plain_md_fallback(self):
130:    def test_stem_fallback_no_known_extension(self):
136:class TestIsContextFile(unittest.TestCase):
139:    def test_apm_memory_dir_is_context(self):
143:    def test_github_memory_dir_is_conte
…[2941 chars omitted]…
ipped(self):
825:    def test_normal_dir_not_skipped(self):
831:class TestIsUnderDirectory(unittest.TestCase):
834:    def test_file_under_directory_returns_true(self):
842:    def test_file_not_under_directory_returns_false(self):
850:class TestFindPrimitiveFilesEdgeCases(unittest.TestCase):
853:    def test_nonexistent_directory_returns_empty(self):
857:    def test_deduplicates_matched_files(self):

from .token_manager import setup_runtime_environment
from ..output.script_formatters import ScriptExecutionFormatter


class ScriptRunner:
    """Executes APM scripts with auto-compilation of .prompt.md files."""

    def __init__(self, compiler=None, use_color: bool = True):
        """Initialize script runner with optional compiler.

        Args:
            compiler: Optional prompt compiler instance
            use_color: Whether to use colored output
        """
        self.compiler = compiler or PromptCompiler()
        self.formatter = ScriptExecutionFormatter(use_color=use_color)

    def run_script(self, script_name: str, params: Dict[str, str]) -> bool:
        """Run a scr
…[5626 chars omitted]…
e to 64 chars (Claude Skills spec limit)
    return result[:64]


def validate_skill_name(name: str) -> tuple[bool, str]:
    """Validate skill name per agentskills.io spec.
    
    Skill names must:
    - Be 1-64 characters long
    - Contain only lowercase alphanumeric characters and hyphens (a-z, 0-9, -)
    - Not contain consecutive hyphens (--)
    - Not start or end with a hyphen
    
    Args:

src/apm_cli/deps/github_downloader.py:1304:            '.prompt.md': 'prompts',
src/apm_cli/deps/package_validator.py:80:        primitive_types = ['instructions', 'chatmodes', 'contexts', 'prompts']

                else:
                    sections.append(f"{key}: {value}")
            sections.append("---")
            sections.append("")
        
        # Add the content
        sections.append(content)
        sections.append("")
        
        return "\n".join(sections)
    
    def discover_prompt_files(self) -> List[Path]:
        """Discover all .prompt.md files in the project.
        
       
…[2278 chars omitted]…
b(pattern, recursive=True))
src/apm_cli/compilation/distributed_compiler.py:128:                all_files_to_scan.extend(github_agents_dir.glob("*.agent.md"))
src/apm_cli/compilation/distributed_compiler.py:130:                all_files_to_scan.extend(github_prompts_dir.glob("*.prompt.md"))
src/apm_cli/compilation/distributed_compiler.py:613:        for agents_file in self.base_dir.rglob("AGENTS.md"):

- Scope resolution now happens once via `TargetProfile.for_scope()` and `resolve_targets()` -- integrators no longer need scope-aware parameters (#562)
- Unified integration dispatch table in `dispatch.py` -- both install and uninstall import from one source of truth (#562)
- Hook merge logic deduplicated: three copy-pasted JSON-merge methods replaced with `_integrate_merged_hooks()` + config dict (#562)

### Fixed

- `apm install -g` now deploys hooks to the scope-resolved target directory (e.g. `~/.copilot/hooks/`) instead of hardcoding `.github/hooks/` (#565)
- Hook sync/cleanup now derives prefixes dyn
…[2664 chars omitted]…
t paths for the target platform
8. `apm uninstall` removes hook files and cleans up merged settings

### Optional: Target-Specific Compilation

Compilation is optional for Copilot, Claude, and Cursor, which read per-file instructions natively. For OpenCode and Codex, run `apm compile` to generate `AGENTS.md` for instructions. Also use it when targeting Gemini:

```bash
# Generate all formats (default)

        shutil.rmtree(temp_dir, ignore_errors=True)

    def test_discovers_prompts_in_github_prompts(self, temp_project):
        """Test discovery in .github/prompts/."""
        prompts_dir = temp_project / ".github" / "prompts"
        prompts_dir.mkdir(parents=True)
        (prompts_dir / "test.prompt.md").write_text("Test content")
        
        formatter = ClaudeFormatter(str(temp_project))
        files = formatter.discover_prompt_files()
        
        assert len(files) == 1
        assert "test.prompt.md" in str(
…[3073 chars omitted]…
L: Shadow Click commands to prevent namespace collision
set = builtins.set
list = builtins.list
dict = builtins.dict


# Header comment for CLAUDE.md files
CLAUDE_HEADER = "<!-- Generated by APM CLI -->"


@dataclass
class ClaudePlacement:
    """Result of CLAUDE.md placement analysis."""
    claude_path: Path
    instructions: List[Instruction]
    agents: List[Chatmode] = field(default_factory=list)

293:    def test_sync_integration_preserves_non_apm_files(self):
312:    def test_sync_integration_handles_missing_prompts_dir(self):
322:    def test_sync_integration_ignores_apm_package_param(self):
345:class TestPromptSuffixPattern:
35
…[8380 chars omitted]…

993:    def test_frontmatter_conversion_in_deployed_file(self):
1016:    def test_unconditional_rule_has_no_frontmatter(self):
1036:class TestClaudeRulesSyncIntegration:
1047:    def test_sync_removes_managed_md_files(self):
1064:    def test_sync_preserves_unmanaged_files(self):
1077:    def test_sync_legacy_fallback_preserves_user_files(self):
1092:    def test_sync_handles_missing_rules_dir(self):

63:    def test_truncates_to_64_chars(self):
70:    def test_empty_string(self):
74:    def test_numbers_preserved(self):
80:class TestSkillIntegrator:
103:    def test_should_integrate_always_returns_true(self):
111:    # ========== find_instruction_files tests ==========
113:    def test_find_instruction_files_in_apm_instructions(self):
123:        instructions = self.integrator.find_instruction_files(pac
…[5271 chars omitted]…
kill_copies_scripts_directory(self):
1078:    def test_copy_skill_copies_references_directory(self):
1104:    def test_copy_skill_copies_assets_directory(self):
1130:    def test_copy_skill_copies_all_subdirectories(self):
1168:    def test_copy_skill_validates_skill_name(self):
1186:    def test_copy_skill_normalizes_invalid_skill_name(self):
1207:    def test_copy_skill_updates_existing_skill(self):

    Returns:
        set: A set of unique MCP server names from all workflows.
    """
    # Support VSCode's .github/prompts convention with .prompt.md files
    prompt_patterns = [
        "**/.github/prompts/*.prompt.md",     # VSCode convention: .github/prompts/
        "**/*.prompt.md"                      # Generic .prompt.md files
    ]
    
    workflows = []
    for pattern in prompt_patterns:
        workflows.extend(glob.glob(pattern, recursive=True))
    
    # Remove duplicates
    workflows = list(set(workflows))
    
    all_servers = set()
    
    for workflow_file in workflows:
        try:
           
…[1247 chars omitted]…
m_both_locations(self):
tests/unit/integration/test_skill_integrator.py:2321:        """Test that sync correctly aggregates removal stats from both locations."""
tests/unit/test_deps.py:12:from apm_cli.deps.aggregator import (
tests/unit/test_deps.py:24:    """Test cases for the dependencies aggregator."""
tests/unit/test_deps.py:61:    @patch("apm_cli.deps.aggregator.scan_workflows_for_dependencies")

        # root).  Accept both POSIX and Windows separators: plugin authors
        # commonly write ${CLAUDE_PLUGIN_ROOT}\scripts\run.ps1 on Windows.
        plugin_root_pattern = r'\$\{CLAUDE_PLUGIN_ROOT\}([/\\][^\s"\']+)'
        for match in re.finditer(plugin_root_pattern, command):
            full_var = match.group(0)
            # No
…[1478 chars omitted]…
eject path traversal outside the package directory
            if not source_file.is_relative_to(package_path.resolve()):
                continue
            if source_file.exists() and source_file.is_file():
                target_rel = f"{scripts_base}/{rel_path}"
                scripts_to_copy.append((source_file, target_rel))
                new_command = new_command.replace(rel_ref, target_rel)

from .token_manager import setup_runtime_environment
from ..utils.paths import is_path_within_base, is_safe_discovered_file
from ..output.script_formatters import ScriptExecutionFormatter


def _is_safe_prompt_candidate(path: Path, *bases: Path) -> bool:
    """Return True when *path* is a regular file inside every supplied base.

    Prompt discovery walks project directories and ``apm_modules``; a symlink
    can otherwise make an external file look like a local prompt.  Every
    candidate must be a regular (non-symlink) file that resolves within the
    relevant base(s).
    """
    return all(is_safe_discovered_file(path, base) for base in bases)


class ScriptRunner:
    """Execu
…[5486 chars omitted]…
found.\n"
            f"Searched in:\n"
            + "\n".join(searched_locations)
            + f"\n\nTip: Run 'apm install' to ensure dependencies are installed."
        )

    def _substitute_parameters(self, content: str, params: Dict[str, str]) -> str:
        """Substitute parameters in content.

        Args:
            content: Content to process
            params: Parameters to substitute

        Handles:
        - ${CLAUDE_PLUGIN_ROOT}/path references (resolved from package root)
        - ./path relative references (resolved from hook file's parent directory)

        Args:
            command: Original command string
            package_path: Root path of the source package
            package_name: Name used for the scripts subdirectory
            target: "vscode" or "claude"
            hook_file_dir: Directory containing the hook JSON file (for ./path resolution)
 
…[2752 chars omitted]…
tory
            if not source_file.is_relative_to(package_path.resolve()):
                continue
            if source_file.exists() and source_file.is_file():
                target_rel = f"{scripts_base}/{rel_path}"
                scripts_to_copy.append((source_file, target_rel))
                new_command = new_command.replace(rel_ref, target_rel)

        return new_command, scripts_to_copy

    prompt_path = self._resolve_prompt_file(prompt_file)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
src/apm_cli/core/script_runner.py:1023: in _resolve_prompt_file
    for org_dir in apm_modules_dir.iterdir():
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = PosixPath('apm_modules')

    def iterdir(self):
        """Yield pat
…[2275 chars omitted]…
no 2] No such file or directory: 'apm_modules'

/usr/local/lib/python3.12/pathlib.py:1056: FileNotFoundError
=========================== short test summary info ============================
FAILED tests/unit/test_script_runner.py::TestPromptCompiler::test_compile_with_frontmatter
FAILED tests/unit/test_script_runner.py::TestPromptCompiler::test_compile_without_frontmatter
2 failed, 586 passed in 5.03s

            clean_orphaned = config.get('clean_orphaned', False)
            dry_run = config.get('dry_run', False)
            
            # Phase 0: Context Link Resolution
            # Register all context files and compile referenced ones
            self.link_resolver.register_contexts(primitives)
            
            # Build list of files to scan for context ref
…[6863 chars omitted]…
et_cache[expanded_pattern]:
src/apm_cli/compilation/distributed_compiler.py:128:                all_files_to_scan.extend(github_agents_dir.glob("*.agent.md"))
src/apm_cli/compilation/distributed_compiler.py:130:                all_files_to_scan.extend(github_prompts_dir.glob("*.prompt.md"))
src/apm_cli/compilation/distributed_compiler.py:613:        for agents_file in self.base_dir.rglob("AGENTS.md"):

FAILED tests/test_github_downloader.py::TestDownloaderCredentialFallback::test_credential_fill_used_when_no_env_token
FAILED tests/unit/test_registry_client.py::TestSimpleRegistryClient::test_find_server_by_reference_uuid_not_found
17 failed, 4177 passed, 148 skipped, 9 deselected, 3 warnings, 12 subtests passed in 100.65s (0:01:40)

            [apm_command, "install", "../packages/no-manifest"],
            cwd=consumer,
            capture_output=True,
            text=True,
            timeout=60,
        )
        # Should report the package as not accessible (validation fails)

…[1786 chars omitted]…
ages failed validation. Nothing to install.\n'.lower

tests/integration/test_local_install.py:199: AssertionError
=========================== short test summary info ============================
FAILED tests/integration/test_local_install.py::TestLocalInstall::test_install_local_package_no_manifest_fails
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
1 failed in 2.64s

**How it works:**
1. `apm install` detects `.prompt.md` files in the package
2. Converts each to Claude command format in `.claude/commands/`
3. `apm uninstall` automatically removes the package's commands

### Automatic Skills Integration

APM automatically integrates skills from installed packages into `.github/skills/`:

```bash
# Install a package with skills
apm install ComposioHQ/awesome-claude-skills/mcp-builder

# Result:
# .github/skills/mcp-builder/SKILL.md -- Skill available for agents
# .githu
…[1255 chars omitted]…
ugins-official/plugins/hookify

# VS Code result (.github/hooks/):
# .github/hooks/hookify-hooks.json            -- Hook definitions
# .github/hooks/scripts/hookify/hooks/*.py    -- Referenced scripts

# Claude result (.claude/settings.json):
# Hooks merged into .claude/settings.json hooks key
# Scripts copied to .claude/hooks/hookify/

# Cursor result (.cursor/hooks.json) — only when .cursor/ exists:

    scan_workflows_for_dependencies,
    sync_workflow_dependencies,
)
from apm_cli.deps.verifier import (
    install_missing_dependencies,
    load_apm_config,
    verify_dependencies,
)


class TestDependenciesAggregator(unittest.TestCase):
    """Test cases for the dependencies aggregator."""

    @patch("glob.glob")
    @patch("builtins.open", new_callable=mock_open)
    @patch("frontmatter.load")
    def test_scan_workflows_for_dependencies(
        self, mock_frontmatter_load, mock_file, mock_glob
    ):
        """Test scanning workflows for dependencies."""
        # Mock glob to return workflow files
        # First call returns GitHub prompts, second
…[8199 chars omitted]…
ssertEqual(set(installed), {"server1", "server3"})
124-        self.assertEqual(set(missing), {"server2"})
125-
126-        # Test with all packages installed
127-        mock_package_manager.list_installed.return_value = [
128-            "server1",
129-            "server2",
130-            "server3",
131-        ]
132-        all_installed, installed, missing = verify_dependencies(self.config_path)

--- a/src/apm_cli/integration/hook_integrator.py
+++ b/src/apm_cli/integration/hook_integrator.py
@@ -51,7 +51,7 @@ from typing import List, Dict, Tuple, Optiona
…[4992 chars omitted]…
d within *base*.
+
+    Symlinks (including symlinked parent directories that escape *base*) are
+    rejected so discovery cannot read or deploy files outside its boundary.
+    """
+    try:
+        if path.is_symlink() or not path.is_file():
+            return False
+        return path.resolve().is_relative_to(base.resolve())
+    except (OSError, RuntimeError, ValueError):
+        return False

+def _is_safe_prompt_candidate(path: Path, *bases: Path) -> bool:
+    """Return True when *path* is a regular file inside every supplied base.
+
+    Prompt discovery walks project directories and ``apm_modules``; a symlink
+    can otherwise make an external file look like a local prompt.  Every
+    candidate must be a regular (non-symlink) file that resolves within the
+    relevant base(s).
+    """
+    return all(is_s
…[8629 chars omitted]…
ut directories, symlink escapes, and unreadable files.
+    base_path = Path(base_dir)
     valid_files = []
     for file_path in unique_files:
-        if file_path.is_file() and _is_readable(file_path):
+        if (
+            is_safe_discovered_file(file_path, base_path)
+            and _is_readable(file_path)
+        ):
             valid_files.append(file_path)
     
     return valid_files

                f"Symlinks are not allowed for security reasons."
            )

        # First check if it exists in current directory (local).  A regular
        # file is returned as-is; paths that traverse a symlinked parent
        # outside the project are rejected.  Lexically-outside relative
        # paths (e.g. "../shared/foo.prompt.md") keep their historical
        # behaviour be
…[1517 chars omitted]…
 in org_dir.iterdir():
                        if (
                            repo_dir.is_dir()
                            and not repo_dir.name.startswith(".")
                            and is_path_within_base(repo_dir, apm_modules_dir)
                        ):
                            # Check in the root of the repository
                            dep_prompt_path = repo_dir / prompt_file

          {
            "type": "command",
            "command": "pwsh -File .github/hooks/scripts/p/scripts/scan.ps1"
          },
          {
            "type": "command",
            "command": "bash .github/hooks/scripts/p/scripts/check.sh"
          }
        ]
      }
    ]
  }
}
[(PosixPath('/tmp/tmp697f_epp/pkg/hooks/scripts/check.sh'), '.github/hooks/scripts/p/scripts/check.sh'), (PosixPath('/tmp/tmp697f_epp/pkg/hooks/scripts/scan.ps1'), '.github/hooks/scripts/p/scripts/scan.ps1')]

........................................................................ [ 91%]
........................................................................ [ 98%]
.................                                                        [100%]
1025 passed in 5.60s

            Full command string with runtime-specific defaults
        """
        if runtime == "copilot":
            # GitHub Copilot CLI with all recommended flags
            return f"copilot --log-level all --log-dir copilot-logs --allow-all-tools -p {prompt_file}"
        elif runtime == "codex":
            # Codex CLI with default sandbox and git repo check skip
            return f"codex -s workspace-write --skip-git-repo-check {prompt_file}"
        else:
            raise ValueError(f"
…[874 chars omitted]…
rompt_path, "r") as f:
            content = f.read()

        # Parse frontmatter and content
        if content.startswith("---"):
            # Split frontmatter and content
            parts = content.split("---", 2)
            if len(parts) >= 3:
                frontmatter = parts[1].strip()
                main_content = parts[2].strip()
            else:
                main_content = content

 
@@ -537,22 +537,36 @@ class ClaudeFormatter:
         # Search in .apm/prompts/
         apm_prompts = self.base_dir / ".apm" / "prompts"
         if apm_prompts.exists():
-            prompt_files.extend(apm_prompts.rglob("*.prompt.md"))
+            prompt_files.extend(
+              
…[8628 chars omitted]…

         # Search in .apm/memory/
         apm_memory = package_path / ".apm" / "memory"
         if apm_memory.exists():
-            context_files.extend(apm_memory.glob("*.memory.md"))
+            context_files.extend(
+                f for f in apm_memory.glob("*.memory.md")
+                if is_safe_discovered_file(f, package_path)
+            )
         
         return context_files

from typing import Dict, List, Optional, Set, Tuple
from collections import defaultdict

from ..primitives.models import Instruction, PrimitiveCollection
from ..version import get_version
from .template_builder import TemplateData, find_chatmode_by_name
from .constants import BUILD_ID_PLACEHOLDER
from .context_optimizer import ContextOptimizer
from .link_resolver import UnifiedLinkResolver
from ..output.formatters import CompilationFormatter
from ..output
…[28 chars omitted]…
sults
from ..utils.paths import portable_relpath

# CRITICAL: Shadow Click commands to prevent namespace collision
set = builtins.set
list = builtins.list
dict = builtins.dict


@dataclass
class DirectoryMap:
    """Mapping of directory structure analysis."""
    directories: Dict[Path, Set[str]]  # directory -> set of applicable file patterns
    depth_map: Dict[Path, int]  # directory -> depth level

import json

    
>           raise ConnectionError(e, request=request)
E           requests.exceptions.ConnectionError: HTTPSConnectionPool(host='api.mcp.github.com', port=443): Max retries exceeded with url: /v0/servers/search?q=123e4567-e89b-12d3-a456-426614174000 (Caused by NameResolutionError("HTTPSConnection(host='api.mcp.github.com', port=443): Failed to resolve 'api.mcp.github.com' ([Errno -3] Temporary failure in name resolution)"))

/usr/local/lib/python3.12/site-packages/requests/adapters.py:729: ConnectionError
=========================== short test summary info ============================
FAILED tests/unit/test_registry_client.py::TestSimpleRegistryClient::test_find_server_by_reference_uuid_not_found
1 failed, 3658 passed, 12 subtests passed in 22.83s

src/apm_cli/models/plugin.py:128:        hooks = list((base_dir / "hooks").rglob("*.py")) if (base_dir / "hooks").exists() else []
src/apm_cli/models/validation.py:133:        if hooks_dir.exists() and any(hooks_dir.glob("*.json")):

            return result
        
        if not apm_dir.is_dir():
            result.add_error(".apm must be a directory")
            return result
        
        # Check for primitive content
        primitive_types = ['instructions', 'chatmodes', 'contexts', 'prompts']
        has_primitives = False
        
        for primitive_type in primitive_types:
            primitive_dir = apm_dir / primitive_type
            if prim
…[3204 chars omitted]…
with_plugin_json(self, tmp_path):
tests/unit/test_plugin_parser.py:527:    def test_validate_with_component_dirs_only(self, tmp_path):
tests/unit/test_plugin_parser.py:534:    def test_validate_empty_directory(self, tmp_path):
tests/unit/test_plugin_parser.py:540:    def test_validate_readme_only(self, tmp_path):
tests/unit/test_plugin_parser.py:733:    def test_invalid_server_skipped(self, tmp_path):

        """
        # Find plugin.json using centralized helper
        from ..utils.helpers import find_plugin_json
        metadata_file = find_plugin_json(plugin_path)
        
        if metadata_file is None:
            raise FileNotFoundError(f"Plugin metadata not found in any expected location: {plugin_path}")
        
        with open(metadata_file, "r") as f:
            metadata_dict = json.load(f)
        
     
…[6624 chars omitted]…
${CLAUDE_PLUGIN_ROOT} with %s", abs_root)
    return result


def _mcp_servers_to_apm_deps(
    servers: Dict[str, Any], plugin_path: Path
) -> List[Dict[str, Any]]:
    """Convert raw MCP server configs to ``dependencies.mcp`` dicts.

    Transport inference:
    - ``command`` present -> stdio
    - ``url`` present -> http (or ``type`` if it's a valid transport)
    - Neither -> skipped with warning

        agents.mkdir()
        (agents / "real.md").write_text("# Real")

        # Create a symlink inside agents/
        external = tmp_path / "external"
        external.mkdir()
        (external / "secret.md").write_text("# Secret")
        symlink_target = agents / "linked"
        try:
            symlink_target.symlink_to(external)
        except OSError:
            pytest.skip("Symlinks not supported on this platform")

        apm_dir = plugin_dir / ".apm"
        apm_dir.mkdir()
  
…[2100 chars omitted]…
  def test_plugin_root_substitution(self, tmp_path):
        """${CLAUDE_PLUGIN_ROOT} replaced with absolute plugin path."""
        plugin_dir = tmp_path / "plugin"
        plugin_dir.mkdir()
        manifest = {
            "name": "test",
            "mcpServers": {
                "local-srv": {
                    "command": "node",
                    "args": ["${CLAUDE_PLUGIN_ROOT}/server.js"],

        )
        lockfile = Mock()
        locked_dep = Mock()
        locked_dep.resolved_commit = "abc123"
        lockfile.get_dependency = Mock(return_value=locked_dep)
    
        result = build_download_ref(dep, lockfile, update_refs=False, ref_changed=False)
        assert result.virtual_path == "dist/brain-council"
        assert result.repo_url == "org/my-skills"
>       assert result.host == "git.example.com"
E       AssertionError: assert <Mock name='mock.host' id='128366366747456'> == 'git.example.com
…[513 chars omitted]…
::test_install_local_package_no_manifest_fails
FAILED tests/integration/test_global_scope_e2e.py::TestGlobalManifestPlacement::test_auto_bootstrap_creates_user_manifest
FAILED tests/integration/test_compile_permission_denied.py::test_permission_denied_graceful
FAILED tests/test_apm_package_models.py::TestGenericHostSubdirectoryRoundTrip::test_build_download_ref_preserves_virtual_path
4 failed in 4.26s

E       AssertionError: assert <Mock name='mock.host' id='138671776896768'> == 'git.example.com'
E        +  where <Mock name='mock.host' id='138671776896768'> = DependencyReference(repo_url='org/my-skills', host=<Mock name='mock.host' id='138671776896768'>, reference='abc123', a...repo=None, is_local=False, local_path=None, artifactory_prefix=<Mock name='mock.registry_prefix' id='138671779720576'>).h
…[82 chars omitted]…
==== short test summary info ============================
FAILED tests/integration/test_local_install.py::TestLocalInstall::test_install_local_package_no_manifest_fails
FAILED tests/integration/test_compile_permission_denied.py::test_permission_denied_graceful
FAILED tests/test_apm_package_models.py::TestGenericHostSubdirectoryRoundTrip::test_build_download_ref_preserves_virtual_path
3 failed in 0.88s

src/apm_cli/integration/targets.py:297:    Includes prefixes from ``deploy_root`` overrides (e.g. ``.agents/``

tests/unit/__pycache__/test_dev_dependencies.cpython-312-pytest-9.2.0.pyc
tests/unit/__pycache__/test_install_command.cpython-312-pytest-9.2.0.pyc
tests/unit/test_plugin_synthesis.py:1:"""Unit tests for synthesize_pl
…[1311 chars omitted]…
from_apm_yml(bad)
tests/unit/test_plugin_synthesis.py:124:            synthesize_plugin_json_from_apm_yml(bad)
tests/unit/test_plugin_synthesis.py:134:        result = synthesize_plugin_json_from_apm_yml(yml)
tests/unit/test_plugin_synthesis.py:149:        result = synthesize_plugin_json_from_apm_yml(yml)
tests/unit/test_plugin_synthesis.py:163:        result = synthesize_plugin_json_from_apm_yml(yml)

class PackageValidator:
    """Validates APM package structure and content."""
    
    def __init__(self):
        """Initialize the package validator."""
        pass
    
    def validate_package(self, package_path: Path) -> ValidationResult:
        """Validate that a directory contains a valid APM package.
        
        Args:
            package_path: Path to the directory to validate
            
        Returns:
            ValidationResult: Validation results with any errors/warnings
        """
        return base_validate_apm_package(package_path)
    
    def validate_package_structure(self, package_path: Path) -> ValidationResult:
 
…[8385 chars omitted]…
ackage_path: Path) -> ValidationResult:
src/apm_cli/deps/package_validator.py:32:    def validate_package_structure(self, package_path: Path) -> ValidationResult:
src/apm_cli/deps/package_validator.py:207:        validation_result = self.validate_package(package_path)
src/apm_cli/deps/__init__.py:11:from .package_validator import PackageValidator
src/apm_cli/deps/__init__.py:21:    'PackageValidator',

        
        Returns:
            str: Canonical dependency string, or package source/name as fallback
        """
        if self
…[700 chars omitted]…
          primitive_dir = apm_dir / primitive_type
                if primitive_dir.exists() and any(primitive_dir.iterdir()):
                    return True
        
        # Also check hooks/ at package root (Claude-native convention)
        hooks_dir = self.install_path / "hooks"
        if hooks_dir.exists() and any(hooks_dir.glob("*.json")):
            return True
        
        return False

    Attributes:
        id: Unique plugin identifier (e.g., "awesome-copilot")
        name: Human-readable plugin name
        version: Semantic version string
        description: Short description of the plugin
        author: Plugin author name or organization
        repository: Repository reference (e.g., "owner/repo" or "dev.azure.com/org/project/repo")
        homepage: Optional homepage URL
        license: Optional license identifier (e.g., "MIT", "Apache-2.0")
        tags: List of tags for categorization
        dependencies: List of plugin dependencies (plugin IDs)
    """
    id: str
    name: str
    version: str
    description: str
    autho
…[2275 chars omitted]…
y
tests/unit/test_plugin_parser.py:493:        pj.write_text(json.dumps({"name": "My Plugin", "version": "1.0.0"}))
tests/unit/test_plugin_parser.py:502:        assert parsed["name"] == "My Plugin"
tests/unit/test_plugin_parser.py:806:        """Plugin with .mcp.json produces apm.yml with dependencies.mcp."""
tests/unit/test_plugin_parser.py:824:        """Plugin with inline mcpServers in manifest."""

........................................................................ [ 91%]
........................................................................ [ 98%]
.................                                                        [100%]
1025 passed in 6.68s

-rw-r--r-- 1 root root    558 Nov  3 04:16 CODE_OF_CONDUCT.md
-rw-r--r-- 1 root root   4086 Nov  3 04:17 CONTRIBUTING.md
-rw-r--r-- 1 root root   1074 Nov  3 04:16 LICENSE
-rw-r--r-- 1 root root   1577 Nov  3 04:16 MANIFESTO.md
-rw-r--r-- 1 root root   5474 Nov  3 04:17 README.md
-rw-r--r-- 1 root root    542 Nov  3 04:16 SECURITY.md
-rw-r--r-- 1 root root    548 Nov  3 
…[1829 chars omitted]…
st_console.py
tests/test_distributed_compilation.py
tests/test_empty_string_and_defaults.py
tests/test_enhanced_discovery.py
tests/test_github_downloader.py
tests/test_github_downloader_token_precedence.py
tests/test_lockfile.py
tests/test_runnable_prompts.py
tests/test_runtime_manager_token_precedence.py
tests/test_token_manager.py
tests/test_virtual_package_multi_install.py
tests/__init__.py
uv.lock

src/apm_cli/adapters/client/cursor.py
src/apm_cli/adapters/client/opencode.py
src/apm_cli/adapters/client/vscode.py
src/apm_cli/adapters/package_manager/__init__.py
src/apm_cli/adapters/package_manager/base.py
src/apm_cli/adapters/package_manager/default_manager.py
src/apm_cli/bundle/__init__.py
src/apm_cli/bundle/lockfile_enrichment.py
src/apm_cli/bundle/packer.py
src/apm_cli/bundle/plugin_exporter.py
src/apm_cli/bundle/unpacker.py
src/apm_cli/cli.py
src/apm_cli/commands
…[4499 chars omitted]…
py
src/apm_cli/utils/github_host.py
src/apm_cli/utils/helpers.py
src/apm_cli/utils/path_security.py
src/apm_cli/utils/paths.py
src/apm_cli/utils/version_checker.py
src/apm_cli/utils/yaml_io.py
src/apm_cli/version.py
src/apm_cli/workflow/__init__.py
src/apm_cli/workflow/discovery.py
src/apm_cli/workflow/parser.py
src/apm_cli/workflow/runner.py

-- grep hook/prompt --
bash: line 8: rg: command not found

                        {"type": "command", "command": "./scripts/validate.sh", "timeout": 10}
                    ]
                }
            ]
        }
    }

Hook JSON format (GitHub Copilot  -- flat arrays with bash/powershell keys):
    {
        "version": 1,
        "hooks": {
            "preToolUse": [
                {"type": "command", "bash": "./scripts/validate.sh", "timeoutSec": 10}
            ]
        }
    }

Hook JSON format (Cursor  -- flat arrays w
…[8630 chars omitted]…
olved


def safe_rmtree(path: Path, base_dir: Path) -> None:
    """Remove *path* only if it resolves within *base_dir*.

    Drop-in replacement for ``shutil.rmtree(path)`` at sites where the
    target is derived from user-controlled input.  Uses retry logic for
    transient file-lock errors (e.g. antivirus scanning on Windows).
    """
    ensure_path_within(path, base_dir)
    robust_rmtree(path)

                        {"type": "command", "command": "./scripts/validate.sh", "timeout": 10}
                    ]
                }
            ]
        }
    }

Hook JSON format (GitHub Copilot  -- flat arrays with bash/powershell keys):
    {
        "version": 1,
        "hooks": {
            "preToolUse": [
                {"type": "command", "bash": "./scripts/validate.sh", "timeoutSec": 10}
            ]
        }
    }

Hook JSON format (Cursor  -- flat arrays w
…[8630 chars omitted]…
ls back to legacy ``*-apm.prompt.md`` glob
        when *managed_files* is ``None`` (old lockfile).
        """
        prompts_dir = project_root / ".github" / "prompts"
        return self.sync_remove_files(
            project_root,
            managed_files,
            prefix=".github/prompts/",
            legacy_glob_dir=prompts_dir,
            legacy_glob_pattern="*-apm.prompt.md",
        )

src/apm_cli/integration/hook_integrator.py:378:        hook_files = self.find_hook_files(package_info.install_path)
src/apm_cli/integration/hook_integrator.py:387:        hooks_dir = project_root / root_dir / "hooks"
src/apm_cli/integration/hook_integrator.py:388:        hooks_dir.mkdir(parents=True, exist_ok=True)
src/apm_cli/integration/hook_integrator.py:391:        hooks_integrated = 0

tests/fixtures/mock-claude-plugin/skills/test-skill/SKILL.md
tests/fixtures/mock-marketplace-plugin/.github/plugin/plugin.json
tests/fixtures/mock-marketplace-plugin/agents/test-agent.agent.md
tests/fixtures/mock-marketplace-plugin/commands/test-command.md
tests/fixtures/mock-marketplace-plugin/skills/test-skill/SKILL.md
tests/fixtures/mock-plugin/.apm/agents/example.agent.md
tests/fixtures/mock-plugin/.apm/agents/helper.agent.md
tests/fixt
…[8630 chars omitted]…
li.primitives.models import Instruction
tests/unit/compilation/test_sibling_directory_coverage.py:51:        # Create instruction that matches files in sibling directories
tests/unit/core/test_scope.py:179:        assert "instructions" in KNOWN_TARGETS["cursor"].unsupported_user_primitives
tests/unit/core/test_scope.py:184:        assert "hooks" in KNOWN_TARGETS["opencode"].unsupported_user_primitives

src/apm_cli/integration/skill_integrator.py:394:    def find_prompt_files(self, package_path: Path) -> List[Path]:
src/apm_cli/primitives/discovery.py:59:def discover_primitives(
src/apm_cli/primitives/discovery.py:99:def discover_primitives_with_dependencies(

                        {"type": "command", "command": "./scripts/validate.sh", "timeout": 10}
                    ]
                }
            ]
        }
    }

Hook JSON format (GitHub Copilot  -- flat arrays with bash/powershell keys):
    {
        "version": 1,
        "hooks": {
            "preToolUse": [
                {"type": "command", "bash": "./scripts/validate.sh", "timeoutSec": 10}
            ]
        }
    }

Hook JSON format (Cursor  -- flat arrays w
…[8630 chars omitted]…
     del data["hooks"][event_name]

            if not data["hooks"]:
                del data["hooks"]

            if modified:
                with open(json_path, 'w', encoding='utf-8') as f:
                    json.dump(data, f, indent=2)
                    f.write('\n')
                stats['files_removed'] += 1
        except (json.JSONDecodeError, OSError):
            stats['errors'] += 1

   142	            package_path: Path to the package directory
   143	
   144	        Returns:
   145	            List[Path]: List of absolute paths to hook JSON files
   146	        """
   147	        hook_files = []
   148	        seen = set()
   149	
   150	        # Search in .apm/hooks/ (AP
…[8630 chars omitted]…
 673	                if not normalized.startswith(hook_prefix_tuple):
   674	                    continue
   675	                if ".." in rel_path:
   676	                    continue
   677	                target_file = project_root / rel_path
   678	                if target_file.exists() and target_file.is_file():
   679	                    try:
   680	                        target_file.unlink()

   200	        - ${CLAUDE_PLUGIN_ROOT}/path references (resolved from package root)
   201	        - ./path relative references (resolved from hook file's parent directory)
   202	
   203	        Args:
   204	            command: Original command string
   205	            package_path: Root path of the source package
   206	            package_name: Name used for the scripts subdirectory
   207	            target: "vscode" or "claude"
   208	    
…[8630 chars omitted]…
ackage_info, project_root: Path,
   585	                                      force: bool = False,
   586	                                      managed_files: set = None,
   587	                                      diagnostics=None) -> HookIntegrationResult:
   588	        """Integrate hooks into .codex/hooks.json.
   589	
   590	        .. deprecated:: Use :meth:`integrate_hooks_for_target` instead.

class PromptIntegrator(BaseIntegrator):
    """Handles integration of APM package prompts into .github/prompts/."""
    
    def find_prompt_files(self, package_path: Path) -> List[Path]:
        """Find all .prompt.md files in a package.
        
        Searches in:
        - Package root directory
        - .apm/prompts/ subdirectory
        
        Args:
            package_path: Path to the package directory
            
        Returns:
            List[Path]: List of absolute paths to .prompt.m
…[8630 chars omitted]…
 2. Transitive dependencies from apm.lock (appended after direct deps)
    
    This ensures transitive dependencies are included in primitive discovery
    and compilation, not just direct dependencies. The installed path differs for:
    - Regular packages: owner/repo (GitHub) or org/project/repo (ADO)
    - Virtual packages: owner/virtual-pkg-name (GitHub) or org/project/virtual-pkg-name (ADO)

from pathlib import Path
from typing import TYPE_CHECKING, Dict, List, Optional, Set

from apm_cli.integration.base_integrator import BaseIntegrator, IntegrationResult
from apm_cli.utils.paths import portable_relpath

if TYPE_CHECKING:
    from apm_cli.integration.targets import TargetProfile


class InstructionIntegrator(BaseIntegrator):
    """Handles integration of APM package instructions.

    Deploys .instructions.md files to target-specific directories:

    * Copilot: ``.github/instructions/
…[8630 chars omitted]…
  264	                        dependency_names.append(
   265	                            f"{repo_parts[0]}/{repo_parts[1]}/{dep.virtual_path}"
   266	                        )
   267	                    else:
   268	                        dependency_names.append(dep.virtual_path)
   269	                else:
   270	                    # Virtual file/collection packages are flattened by package name.

from apm_cli.integration.base_integrator import BaseIntegrator, IntegrationResult
from apm_cli.utils.paths import portable_relpath

if TYPE_CHECKING:
    from apm_cli.integration.targets import TargetProfile


class AgentIntegrator(BaseIntegrator):
    """Handles integration of APM package agents into .github/agents/, .claude/agents/, and .cursor/agents/."""
    
    def find_agent_files(self, package_path: Path) -> List[Path]:
        """Find all .agent.md and .chatmode.md files in a packa
…[8630 chars omitted]…
dir else f"{effective_root}/"
                if prim_name == "skills":
                    skill_prefixes.append(prefix)
                elif prim_name == "hooks":
                    hook_prefixes.append(prefix)
                else:
                    raw_key = f"{prim_name}_{target.name}"
                    bucket_key = BaseIntegrator._BUCKET_ALIASES.get(
                        raw_key, raw_key

import tempfile
import shutil
from pathlib import Path
from unittest.mock import MagicMock

import pytest

from apm_cli.integration.hook_integrator import HookIntegrator, HookIntegrationResult
from apm_cli.models.apm_package import APMPackage, PackageInfo


def _make_package_info(install_path: Path, name: str = "test-pkg") -> PackageInfo:
    """Create a minimal PackageInfo for testing."""
    package = APMPackage(name=name, version="1.0.0")
    return PackageInfo(pa
…[8630 chars omitted]…
est_auto_create_guard(self):
        """Targets with auto_create=False should not get directories created."""
        from apm_cli.integration.targets import KNOWN_TARGETS
        # All targets except copilot have auto_create=False
        for name, profile in KNOWN_TARGETS.items():
            if not profile.auto_create:
                assert name != "copilot", "copilot should have auto_create=True"

    13	from .token_manager import setup_runtime_environment
    14	from ..output.script_formatters import ScriptExecutionFormatter
    15	
    16	
    17	class ScriptRunner:
    18	    """Executes APM scripts with auto-compilation of .prompt.md files."""
    19	
    20	    def __init__(self, compiler=None, use_color: bool = True):
    21	        """Initialize script runner with optional compiler.
    22	
    23	        Args:
    24	            compiler: Optional prompt compiler instance
    25	            use_color: Whether to use colored output
    26	        """
    27	        self.compiler = compiler
…[8630 chars omitted]…
79:            # Verify _resolve_prompt_file was called
src/apm_cli/core/script_runner.py:27:        self.compiler = compiler or PromptCompiler()
src/apm_cli/core/script_runner.py:892:class PromptCompiler:
src/apm_cli/core/script_runner.py:912:        prompt_path = self._resolve_prompt_file(prompt_file)
src/apm_cli/core/script_runner.py:945:    def _resolve_prompt_file(self, prompt_file: str) -> Path:

   892	class PromptCompiler:
   893	    """Compiles .prompt.md files with parameter substitution."""
   894	
   895	    DEFAULT_COMPILED_DIR = Path(".apm/compiled")
   896	
   897	    def __init__(self):
   898	        """Initialize compiler."""
   899	        self.compiled_d
…[8630 chars omitted]…
 check.
    
    Returns:
        bool: True if directory should be skipped, False otherwise.
    """
    skip_patterns = {
        '.git',
        'node_modules',
        '__pycache__',
        '.pytest_cache',
        '.venv',
        'venv',
        '.tox',
        'build',
        'dist',
        '.mypy_cache'
    }
    
    dir_name = os.path.basename(dir_path)
    return dir_name in skip_patterns

        return prompt_files
    
    def find_context_files(self, package_path: Path) -> List[Path]:
        """Find all context/memory files in a package.
        
        Searches in:
        - .apm/context/ subdirectory
        - .apm/memory/ subdirectory
        
        Args:
            package_path: Path to the package directory
            
        Returns:

src/apm_cli/utils/path_security.py:70:def ensure_path_within(path: Path, base_dir: Path) -> Path:
src/apm_cli/utils/path_security.py:101:    ensure_path_within(path, base_dir)
src/apm_cli/workflow/discovery.py:28:        workflow_files.extend(glob.glob(os.path.join(base_dir, pattern), recursive=True))
src/apm_cli/integration/base_integrator.py:405:    def find_files_by_glob(

    13	logger = logging.getLogger(__name__)
    14	from ..models.apm_package import APMPackage
    15	from ..deps.lockfile import LockFile
    16	
    17	
    18	# Common primitive patterns for local discovery (with recursive search)
    19	LOCAL_PRIMITIVE_PATTERNS: Dict[str, List[str]] = {
    20	    'chatmode': [
    21	        # New standard (.agent.md)
    22	        "**/.apm/agents/*.agent.md",
    23	        "**/.github/agents/*.agent.md",
    24	        "**/*.agent.md",  # Gen
…[8630 chars omitted]…
r.glob("*.json")):
   163	                resolved = f.resolve()
   164	                if resolved not in seen:
   165	                    seen.add(resolved)
   166	                    hook_files.append(f)
   167	
   168	        return hook_files
   169	
   170	    def _parse_hook_json(self, hook_file: Path) -> Optional[Dict]:
   171	        """Parse a hook JSON file and return the data dict.
   172

   407	        pattern: str,
   408	        subdirs: Optional[List[str]] = None,
   409	    ) -> List[Path]:
   410	        """Search *package_path* (and optional subdirectories) for *pattern*.
   411	
   412	        Args:
   413	            package_path: Root of the installed package.
   414	            pattern: Glob pattern (e.g. ``"*.prompt.md"``).
   415	            subdirs: Extra subdirectory paths relative to *package_path*
   416	       
…[8630 chars omitted]…
1009	            f"Prompt file '{prompt_file}' not found.\n"
  1010	            f"Searched in:\n"
  1011	            + "\n".join(searched_locations)
  1012	            + f"\n\nTip: Run 'apm install' to ensure dependencies are installed."
  1013	        )
  1014	
  1015	    def _substitute_parameters(self, content: str, params: Dict[str, str]) -> str:
  1016	        """Substitute parameters in content.

   972	                "Stop": [{"_apm_source": "test", "hooks": []}]
   973	            }
   974	        }
   975	        settings_path.write_text(json.dumps(settings))
   976	
   977	        integrator = HookIntegrator()
   978	        integrator.sync_integration(None, temp_project)
   979	
   980	        upda
…[8630 chars omitted]…
ot.strip("/")
src/apm_cli/marketplace/resolver.py:154:    plugin_root: str = "",
src/apm_cli/marketplace/resolver.py:165:        plugin_root: Base path for bare-name sources (from metadata.pluginRoot).
src/apm_cli/marketplace/resolver.py:180:            source, marketplace_owner, marketplace_repo, plugin_root=plugin_root
src/apm_cli/marketplace/resolver.py:241:        plugin_root=manifest.plugin_root,

  1022	            "./scripts/check.sh",
  1023	            pkg_dir,
  1024	            "my-pkg",
  1025	            "vscode",
  1026	        )
  1027	
  1028	        assert "./" not in cmd
  1029	        assert ".github/hooks/scripts/my-pkg/scripts/check.sh" in cmd
  1030	        asser
…[8630 chars omitted]…
or primitive_type, patterns in LOCAL_PRIMITIVE_PATTERNS.items():
147:    for primitive_type, patterns in LOCAL_PRIMITIVE_PATTERNS.items():
300:def scan_directory_with_source(directory: Path, collection: PrimitiveCollection, source: str) -> None:
316:    for primitive_type, patterns in DEPENDENCY_PRIMITIVE_PATTERNS.items():
375:def find_primitive_files(base_dir: str, patterns: List[str]) -> List[Path]:

  1132	        cmd, scripts = integrator._rewrite_command_for_target(
  1133	            "./scripts/lint.sh",
  1134	            pkg_dir,
  1135	            "my-pkg",
  1136	            "vscode",
  1137	        
…[8630 chars omitted]…
         # Local should take precedence
                assert result == local_prompt
            finally:
                os.chdir(original_cwd)
    
    @patch('apm_cli.core.script_runner.Path.mkdir')
    @patch('builtins.open', new_callable=mock_open)
    def test_compile_with_dependency_resolution(self, mock_file, mock_mkdir):
        """Test compile method uses dependency resolution correctly."""

                # This matches our org-namespaced directory structure
                dependency_names.append(dep.repo_url)
        
        # Include transitive dependenc
…[8629 chars omitted]…
ne_length = 88

[tool.mypy]
python_version = "3.12"
warn_return_any = true
warn_unused_configs = true

[tool.pytest.ini_options]
addopts = "-m 'not benchmark'"
markers = [
    "integration: marks tests as integration tests that may require network access",
    "slow: marks tests as slow running tests",
    "benchmark: marks performance benchmark tests (deselected by default, run with -m benchmark)",
]

    """Test agent integration logic."""
    
    def setup_method(self):
        """Set up test fixtures."""
        self.temp_dir = tempfile.mkdtemp()
        self.project_root = Path(self.temp_dir)
        self.integrator = AgentIntegrator()
    
    def teardown_method(self):
        """Clean up after tests."""
        import shutil
        shutil.rmtree(self.temp_dir, ignore_errors=True)
    
    def test_should_integrate_always_returns_true(self):
        """Test integration is always enabled (zero-config approach)."""
        # No .github/ directory neede
…[8630 chars omitted]…
   effective_root = mapping.deploy_root or target.root_dir
        target_root = project_root / effective_root
        if not target.auto_create and not (project_root / target.root_dir).is_dir():
            return IntegrationResult(0, 0, 0, [], 0)

        prompt_files = self.find_prompt_files(package_info.install_path)
        if not prompt_files:
            return IntegrationResult(0, 0, 0, [], 0)

   277	
   278	        Args:
   279	            data: Parsed hook JSON data
   280	            package_path: Root path of the source package
   281	            package_name: Name for scripts subdirectory
   282	            target: "vscode" or "claude"
   283	            hook_file_dir: Directory containing the hook JSON file (for ./path resolution)
   284	            root_dir: Override root dire
…[8629 chars omitted]…
tructionIntegrator',
    'SkillIntegrator',
    'SkillTransformer',
    'MCPIntegrator',
    'TargetProfile',
    'PrimitiveMapping',
    'KNOWN_TARGETS',
    'get_integration_prefixes',
    'active_targets',
    'validate_skill_name',
    'normalize_skill_name',
    'to_hyphen_case',
    'copy_skill_to_target',
    'should_install_skill',
    'should_compile_instructions',
    'get_effective_type',
]

logger = logging.getLogger(__name__)

# Maximum number of ** segments allowed in a single pattern.
# Prevents exponential recursion blowup (2^N branches per ** segment).
_MAX_DOUBLE_STAR_SEGMENTS = 5


def validate_exclude_patterns(patterns: Optional[List[str]]) -> List[str]:
    """Validate and normalize exclude patterns, rejecting dangerous ones.

    Args:
        patterns: Raw patterns from apm.yml compilation.exclude.

    Returns:
        List of validated, forward-slash-normalized patterns.

    Raise
…[8629 chars omitted]…
mitives/test_primitives.py:8:from apm_cli.primitives.discovery import discover_primitives, find_primitive_files
tests/unit/primitives/test_primitives.py:583:    """Test cases for primitive discovery."""
tests/unit/primitives/test_primitives.py:606:    def test_discover_primitives_structured(self):
tests/unit/primitives/test_primitives.py:663:        collection = discover_primitives(self.temp_dir_path)

1210:        cmd, scripts = integrator._rewrite_command_for_target(
1228:        cmd, scripts = integrator._rewrite_command_for_target(
1246:        cmd, scripts = integrator._rewrite_command_for_target(
1264:        cmd, scripts = integrator._rewrite_command_for_target(

  1712	                    if logger:
  1713	                        logger.download_complete(dep_ref.local_path, ref_suffix="local")
  1714	
  1715	                    # Build minimal PackageInfo for integration
  1716	                    from apm_cli.models.apm_package import (
  1717	                        APMPackage,
  1718	    
…[4392 chars omitted]…
lugin_directory(install_path, plugin_json_path)
src/apm_cli/deps/plugin_parser.py:53:def normalize_plugin_directory(plugin_path: Path, plugin_json_path: Optional[Path] = None) -> Path:
src/apm_cli/models/validation.py:320:    from ..deps.plugin_parser import normalize_plugin_directory
src/apm_cli/models/validation.py:324:        apm_yml_path = normalize_plugin_directory(package_path, plugin_json_path)

                claude_rel = portable_relpath(claude_path, project_root)
                if not self.check_collision(claude_path, claude_rel, managed_files, force, diagnostics=diagnostics):
                    self.copy_agent(source_file, claude_path)
                    target_paths.append(claude_path)

    """Return a forward-slash relative path, resolving both sides first.

    Handles Windows 8.3 short names (e.g. ``RUNNER~1`` vs ``runneradmin``)
    and ensures consistent POSIX output on every platform.

    When *path* is not under *base* (or resolution fails), falls back to
    a resolved absolute POSIX path.
    """
    try:
        return path.resolve().relative_to(base.resolve()).as_posix()
    except (ValueError, OSError, RuntimeError):
        try:
            return path.resolve().as_posix()
        except (OSError, RuntimeError):
            return path.as_posix()

    13	
    14	import json
    15	import logging
    16	import shutil
    17	from pathlib import Path
    18	from typing import Dict, Any, List, Optional
    19	import yaml
    20	
    21	
    22	def parse_plugin_manifest(plugin_json_path: Path) -> Dict[str, Any]:
    23	    """Parse a plugin.json manifest
…[8630 chars omitted]…
t in source:
662-            if t.supports("hooks"):
663-                sm = t.primitives["hooks"]
664-                effective_root = sm.deploy_root or t.root_dir
665-                hook_prefixes.append(f"{effective_root}/hooks/")
666-        hook_prefix_tuple = tuple(hook_prefixes)
667-
668-        if managed_files is not None:
669-            # Manifest-based removal -- only remove tracked files

   137	    - ``str``  -> read that file path relative to plugin root, parse JSON,
   138	      extract ``mcpServers`` key.
   139	    - ``list`` -> read each file path, merge (last-wins on name conflict).
   140	    - ``dict`` -> use directly as inline server definitions.
   141	
   142	    When ``mcpServers`` is absent and ``.mcp.json`` (or ``.github/.mcp.json``)
   143	    exist
…[8630 chars omitted]…
leted.append(target_file)
683-                    except Exception:
684-                        stats['errors'] += 1
685-            # Batch parent cleanup -- single bottom-up pass
686-            self.cleanup_empty_parents(deleted, stop_at=project_root)
687-        else:
688-            # Legacy fallback  -- glob for old -apm suffix files
689-            hooks_dir = project_root / ".github" / "hooks"

   242	            return [_walk(item) for item in obj]
   243	        return obj
   244	
   245	    result = {name: _walk(cfg) for name, cfg in servers.items()}
   246	    if substituted:
   247	        logger.info("Substituted ${CLAUDE_PLUGIN_ROOT} with %s", abs_root)
   248	    return result
   249	
   250	
   251	def _mcp_servers_to_apm_deps(
   252	    s
…[8629 chars omitted]…
s")
447:            target_hooks = apm_dir / "hooks"
448:            if target_hooks.exists():
449:                shutil.rmtree(target_hooks)
450:            shutil.copytree(hook_sources[0], target_hooks, ignore=_ignore_symlinks)
452:                shutil.copytree(extra, target_hooks, dirs_exist_ok=True, ignore=_ignore_symlinks)
573:    for component_dir in ("agents", "commands", "skills", "hooks"):

   522	        return "\n".join(sections)
   523	    
   524	    def discover_prompt_files(self) -> List[Path]:
   525	        """Discover all .prompt.md files in the project.
   526	        
   527	        Searches in standard APM locations:
   528	        - .apm/prompts/
   529	        - .github/prompts/
   530	        - apm_modules/*/prompts/ (installed dependen
…[8629 chars omitted]…
sename.replace('.instructions.md', '')
src/apm_cli/primitives/parser.py:204:                elif basename.endswith('.agent.md'):
src/apm_cli/primitives/parser.py:205:                    return basename.replace('.agent.md', '')
src/apm_cli/primitives/parser.py:215:    elif basename.endswith('.instructions.md'):
src/apm_cli/primitives/parser.py:216:        return basename.replace('.instructions.md', '')

   342	                src = plugin_path / str(p)
   343	                if src.exists() and not src.is_symlink():
   344	                    paths.append(src)
   345	            return paths
   346	        elif isinstance(custom, str):
   347	            src = plugin_path / custom
   348	            return [src] if src.exists() and not src.is_
…[8629 chars omitted]…
root_agents = list(primitives.chatmodes)
src/apm_cli/deps/plugin_parser.py:22:def parse_plugin_manifest(plugin_json_path: Path) -> Dict[str, Any]:
src/apm_cli/deps/plugin_parser.py:75:            manifest = parse_plugin_manifest(plugin_json_path)
src/apm_cli/marketplace/models.py:110:def _parse_plugin_entry(
src/apm_cli/marketplace/models.py:219:        plugin = _parse_plugin_entry(entry, source_name)

293:        result = integrator.integrate_package_hooks(pkg_info, temp_project)
299:        target_json = temp_p
…[8630 chars omitted]…
use.py", "stop.py", "userpromptsubmit.py"]:
            (hooks_dir / script).write_text(f"#!/usr/bin/env python3\n# {script}")
#!/bin/bash

# Setup hook for mock plugin
# This hook runs during plugin installation to perform initialization tasks

echo "Setting up mock plugin..."

# Example: Create any necessary directories or files
# Example: Run initialization logic

echo "Mock plugin setup complete!"

   370	            project_root: Root directory of the project
   371	            force: If True, overwrite user-authored files on collision
   372	            managed_files: Set of relative pat
…[8628 chars omitted]…
in (merge into settings.json)."""
498:        """Test Claude integration of learning-output-style plugin."""
518:        """Test Claude integration of ralph-loop plugin."""
697:        """Test Cursor integration of hookify plugin (merge into hooks.json)."""
996:    def test_rewrite_claude_plugin_root(self, temp_project):
1143:    def test_rewrite_rejects_plugin_root_path_traversal(self, temp_project):

   482	        )
   483	        for line in subprocess_lines:
   484	            print(line)
   485	
   486	        # Show environment variables if any were extracted
   487	        if len(env_vars) > len(env):
   488	            extracted_env_vars = []
   489	            for key, value in e
…[8628 chars omitted]…
    prompt_files.extend(apm_prompts.glob("*.prompt.md"))
src/apm_cli/integration/prompt_integrator.py:208:        deployed_files).  Falls back to legacy ``*-apm.prompt.md`` glob
src/apm_cli/integration/skill_integrator.py:411:            prompt_files.extend(package_path.glob("*.prompt.md"))
src/apm_cli/integration/skill_integrator.py:416:            prompt_files.extend(apm_prompts.glob("*.prompt.md"))

@dataclass
class IntegrationResult:
    """Result of any file-level integration operation.

    The core fields (files_integrated, files_skipped, target_paths,
    links_resolved) are used by all integrators.  Hook- and skill-specific
    fields default to zero/False and are ignored by integrators that do
    not produce them.
    """

    files_integrated: int
    files_updated: int  # Kept for CLI compat, always 0 today
    files_skipped: int
    target_paths: List[Path]
    links_resolved: int = 0

    # Hook-specific
…[3029 chars omitted]…
izationStats,
    PlacementStrategy, PlacementSummary
)
from ..utils.paths import portable_relpath
from ..utils.exclude import should_exclude, validate_exclude_patterns

# CRITICAL: Shadow Click commands to prevent namespace collision
# When this module is imported during 'apm compile', Click's active context
# can cause set/list/dict to resolve to Click commands instead of builtins
set = builtins.set

  ``Path.is_relative_to``.
* ``safe_rmtree`` wraps ``robust_rmtree`` with an ``ensure_path_within``
  check so callers get a drop-in replacement.
* ``PathTraversalError`` is a ``ValueError`` subclass for clear error
  semantics and easy ``except`` targeting.
"""

from __future__ import annotations

from pathlib import Path

from .file_ops import robust_rmtree


class Pat
…[2179 chars omitted]…
olved


def safe_rmtree(path: Path, base_dir: Path) -> None:
    """Remove *path* only if it resolves within *base_dir*.

    Drop-in replacement for ``shutil.rmtree(path)`` at sites where the
    target is derived from user-controlled input.  Uses retry logic for
    transient file-lock errors (e.g. antivirus scanning on Windows).
    """
    ensure_path_within(path, base_dir)
    robust_rmtree(path)

   602	def generate_claude_commands(
   603	    base_dir: str = ".",
   604	    prompt_files: Optional[List[Path]] = None,
   605	    dry_run: bool = False
   606	) -> CommandGenerationResult:
   607	    """Convenience function to generate .claude/commands/ from prompts.
   608	    
   609	    Transforms APM .prompt.md files i
…[1369 chars omitted]…
s/unit/compilation/test_claude_formatter.py:623:        files = formatter.discover_prompt_files()
tests/unit/compilation/test_claude_formatter.py:635:        files = formatter.discover_prompt_files()
tests/unit/compilation/test_claude_formatter.py:647:        files = formatter.discover_prompt_files()
tests/unit/compilation/test_claude_formatter.py:650:        files2 = formatter.discover_prompt_files()

   592	        shutil.rmtree(temp_dir, ignore_errors=True)
   593	
   594	    def test_discovers_prompts_in_github_prompts(self, temp_project):
   595	        """Test discovery in .github/prompts/."""
   596	        prompts_dir = temp_project / ".github" / "prompts"
   597	        prompts_dir.mkdir(parents=True)
   598	        (prompts_dir / "test.prompt.md").write_text("Test content")
   599	        
   600	        formatter = ClaudeFormatter(s
…[3796 chars omitted]…
ript_runner.py:203:    """Test PromptCompiler functionality."""
tests/unit/test_script_runner.py:207:        self.compiler = PromptCompiler()
tests/unit/test_script_runner.py:301:class TestPromptCompilerDependencyDiscovery:
tests/unit/test_script_runner.py:302:    """Test PromptCompiler dependency discovery functionality."""
tests/unit/test_script_runner.py:306:        self.compiler = PromptCompiler()

   312	            original_cwd = Path.cwd()
   313	            try:
   314	                import os
   315	                os.chdir(tmpdir)
   316	                
   317	                # Create local prompt file
   318	                prompt_file = Path("hello-world.prompt.md")
   319	                prompt_file.write_text("Hello World!")
   320	          
…[7704 chars omitted]…
       assert result == local_prompt
   464	            finally:
   465	                os.chdir(original_cwd)
   466	    
   467	    @patch('apm_cli.core.script_runner.Path.mkdir')
   468	    @patch('builtins.open', new_callable=mock_open)
   469	    def test_compile_with_dependency_resolution(self, mock_file, mock_mkdir):
   470	        """Test compile method uses dependency resolution correctly."""

   520	        5. Dependencies root: apm_modules/**/{name}.prompt.md
   521	
   522	        Args:
   523	            name: Script/prompt name or qualified path (owner/repo/name)
   524	
   525	        Retu
…[8629 chars omitted]…
	    Returns:
   421	        bool: True if file is readable, False otherwise.
   422	    """
   423	    try:
   424	        with open(file_path, 'r', encoding='utf-8') as f:
   425	            # Try to read first few bytes to verify it's readable
   426	            f.read(1)
   427	        return True
   428	    except (PermissionError, UnicodeDecodeError, OSError):
   429	        return False
   430

69-        """Initialize the Claude formatter.
70-        
71-        Args:
72-            base_dir (str): Base directory for compilation.
73-        """
74-        try:
75-            self.base_dir = Path(base_dir).resolve()
76-        except (OSError, FileNotFoundError):
77-            self.base_dir = Path(base_dir).absolute()
78-        
79-        self.warnings: List[str] = []
80-        self.errors: 
…[442 chars omitted]…
    placement_map (Dict[Path, List[Instruction]]): Directory to instructions mapping.
93-            config (Optional[dict]): Configuration options.
94-        
95-        Returns:
96-            ClaudeCompilationResult: Result of the CLAUDE.md compilation.
97-        """
98-        self.warnings.clear()
99-        self.errors.clear()
100-        
101-        try:
102-            config = config or {}

from apm_cli.integration.base_integrator import BaseIntegrator


# DEPRECATED -- use IntegrationResult directly for new code.
# Kept for backward compatibility. The fields map as follows:
# skill_created -> IntegrationResult.skill_created
# sub_skills_promoted -> IntegrationResult.sub_skills_promoted
# skill_path, references_copied -> not mapped (skill-internal)
@dataclass
class SkillIntegrationResult:
    """Result of skill integration operation."""
    skill_created: bool
    skill_updated: bool
    skill_skipped: bool
    skill_path: Path | None
    references_copied: int  # Now tracks total files copied 
…[5290 chars omitted]…
 target: Target file path
        
        Returns:
            int: Number of links resolved
        """
        content = source.read_text(encoding='utf-8')
        content, links_resolved = self.resolve_links(content, source, target)
        target.write_text(content, encoding='utf-8')
        return links_resolved
    
    def get_target_filename(self, source_file: Path, package_name: str) -> str:

    13	                        {"type": "command", "command": "./scripts/validate.sh", "timeout": 10}
    14	                    ]
    15	                }
    16	            ]
    17	        }
    18	    }
    19	
    20	Hook JSON format (GitHub Copilot  -- flat arrays with bash/powershell keys):
    21	    {
    22	        "version": 1,
    23	        "hooks": {
    24	            "preTool
…[8629 chars omitted]…
s.items():
   324	            if not isinstance(matchers, list):
   325	                continue
   326	            for matcher in matchers:
   327	                if not isinstance(matcher, dict):
   328	                    continue
   329	                # Rewrite script paths in the matcher dict itself
   330	                # (GitHub Copilot flat format: bash/powershell/windows keys at this level)

        @patch('apm_cli.core.script_runner.Path.mkdir')
        @patch('apm_cli.core.script_runner.Path.exists')
        @patch('builtins.open', new_callable=mock_open)
        def test_compile_wi
…[1479 chars omitted]…
ndError: [Errno 2] No such file or directory: 'apm_modules'

/usr/local/lib/python3.12/pathlib.py:1056: FileNotFoundError
=========================== short test summary info ============================
FAILED tests/unit/test_script_runner.py::TestPromptCompiler::test_compile_with_frontmatter
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
1 failed, 251 passed in 3.23s

   237	        """Test behavior when parameter is missing."""
   238	        content = "Hello ${input:name}!"
   239	        params = {}
   240	        
   241	        result = self.compiler._substitute_parameters(content, params)
   242	        
   243	        # Should leave placeholder unchanged when parameter is missing
   244	        assert result == "Hello
…[5180 chars omitted]…
i.core.script_runner.Path.exists')
708:    def test_run_script_uses_cached_package(self, mock_file, mock_exists, mock_execute, 
711:        mock_exists.return_value = True  # apm.yml exists
728:    @patch('apm_cli.core.script_runner.Path.exists')
730:    def test_run_script_handles_install_success_but_no_prompt(self, mock_file, mock_exists,
733:        mock_exists.return_value = True  # apm.yml exists

        @patch('apm_cli.core.script_runner.Path.mkdir')
        @patch('apm_cli.core.script_runner.Path.exists')
        @patch('builtins.open', new_callable=mock_open)
        def test_compile_wi
…[6242 chars omitted]…
  Tip: Run 'apm install' to ensure dependencies are installed.

src/apm_cli/core/script_runner.py:1051: FileNotFoundError
=========================== short test summary info ============================
FAILED tests/unit/test_script_runner.py::TestPromptCompiler::test_compile_with_frontmatter
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
1 failed, 251 passed in 2.86s

@@ -943,64 +944,105 @@ class PromptCompiler:
         return str(output_path)
 
     def _resolve_prompt_file(self, prompt_file: str) -> Path:
-        """Resolve prompt file path, checking local directory first, then common directories, then dependencies.
+        """Resolve a prompt file from the project or an installed dependency.
 
-        Args:
-            prompt_file: Relative path to the .prompt.md file
-
-        Returns:
-            Path: R
…[8630 chars omitted]…
in(path: Path, base_dir: Path) -> Path:
     """Resolve *path* and assert it lives inside *base_dir*.
 
 M src/apm_cli/core/script_runner.py
 M src/apm_cli/integration/agent_integrator.py
 M src/apm_cli/integration/base_integrator.py
 M src/apm_cli/integration/hook_integrator.py
 M src/apm_cli/integration/prompt_integrator.py
 M src/apm_cli/primitives/discovery.py
 M src/apm_cli/utils/path_security.py

   342	
   343	    # Resolve source paths  -- use manifest arrays if present, else defaults.
   344	    # Custom paths may be directories OR individual files.
   345	    def _resolve_sources(component: str, default_dir: str):
   346	        """Return list of existing source paths (dirs or files) for a component."""
   347	        custom = manifest.get(component)
   348	        if isinstance(custom, list):
   349	            paths = []
   350	     
…[8629 chars omitted]…
ult["description"] = data["description"]
   576	    if data.get("author"):
   577	        result["author"] = {"name": str(data["author"])}
   578	    if data.get("license"):
   579	        result["license"] = data["license"]
   580	
   581	    return result
   582	
   583	
   584	def validate_plugin_package(plugin_path: Path) -> bool:
   585	    """Check whether a directory looks like a Claude plugin.

   520	        4. Dependencies: apm_modules/**/.apm/prompts/{name}.prompt.md
   521	        5. Dependencies root: apm_modules/**/{name}.prompt.md
   522	
   523	        Args:
   524	            name: Script/prompt name or qualified path (owner/repo/name)
   525	
   526	    
…[5219 chars omitted]…
k()
   647	                and is_path_within(subdir_path, modules_root)
   648	                and safe_candidate(skill_file, subdir_path)
   649	            ):
   650	                return skill_file
   651	
   652	        # Search within this owner's packages for .prompt.md files.
   653	        for pkg_dir in owner_dir.iterdir():
   654	            if (
   655	                not pkg_dir.is_dir()

   662	                if (
   663	                    safe_candidate(prompt_path, pkg_dir)
   664	                    and self._matches_qualified_path(prompt_path, qualified_path)
   665	                ):
   666	                    return prompt_path
   667	
   668	        return None
   669	
   670	        # For subdirectory packages (skills), check for SKILL.md first
   671	        # e.g., github/awesome
…[578 chars omitted]…
  682	                continue
   683	
   684	            # Try to find the prompt in this package
   685	            for prompt_path in pkg_dir.rglob(prompt_name):
   686	                # Verify this matches the qualified path structure
   687	                if self._matches_qualified_path(prompt_path, qualified_path):
   688	                    return prompt_path
   689	
   690	        return None

118-    Returns:
119-        Optional[Path]: Path to the plugin.json file if found, None otherwise
120-    """
121-    candidates = [
122-        plugin_path / "plugin.json",
123-        plugin_path / ".github" / "plugin" / "plugin.json",
124-        plugin_path / ".claude-plugin" / "plugin.json",
125-        plugin_path / ".cursor-plugin" / "plugin.json",
126-    ]
127-    for candidate in candidates:
128-        if candidate.exists():
129-         
…[576 chars omitted]…
 (e.g., "owner/repo" or "dev.azure.com/org/project/repo")
        homepage: Optional homepage URL
        license: Optional license identifier (e.g., "MIT", "Apache-2.0")
        tags: List of tags for categorization
        dependencies: List of plugin dependencies (plugin IDs)
    """
    id: str
    name: str
    version: str
    description: str
    author: str
    repository: Optional[str] = None

   603	        # Parse qualified path: owner/repo/name or owner/repo-name/name
   604	        parts = qualified_path.split("/")
   605	
   606	        if len(parts) < 2:
   607	            return None
   608	
   609	        # Extract prompt name (last part)
   610	        prompt_name = parts[-1]
   611	        if not prompt_name.endswith(".prompt.md"):
   612	            promp
…[2662 chars omitted]…
ture-blueprint-generator/SKILL.md
   673	        if len(parts) >= 3:
   674	            subdir_path = apm_modules.joinpath(*parts)
   675	            skill_file = subdir_path / "SKILL.md"
   676	            if skill_file.exists():
   677	                return skill_file
   678	
   679	        # Search within this owner's packages for .prompt.md files
   680	        for pkg_dir in owner_dir.iterdir():

   622	
   623	        # Try to find matching package directory
   624	        owner = parts[0]
   625	
   626	        # Check if owner directory exists within the installed dependency tree.
   627	        owner_dir = apm_modules / owner
   628	        modules_root = apm_modules.resolve()
   629	        if (
   630	            not owner_dir.is_dir()
   631	    
…[1704 chars omitted]…
   670	
   671	        return None
   672	
   673	    def _matches_qualified_path(self, prompt_path: Path, qualified_path: str) -> bool:
   674	        """Check if a prompt path matches the qualified path specification.
   675	
   676	        Args:
   677	            prompt_path: Actual path to prompt file
   678	            qualified_path: User-specified qualified path
   679	
   680	        Returns:

                if skill_subdir.is_dir():
                    skill_file = skill_subdir / "SKILL.md"
                    if skill_file.exists():
                        skills.append(skill_file)
        
        return cls(
            metadata=metadata,
            path=plugin_path,
            commands=commands,
            agents=agents,
            hooks=hooks,

def is_tool_available(tool_name):
    """Check if a command-line tool is available.
    
    Args:
        tool_name (str): Name of the tool to check.
    
    Returns:
        bool: True if the tool is available, False otherwise.
    """
    # First try using shutil.which which is more reliable across platforms
    if shutil.which(tool_name):
        return True

    system = platform.system().lower()
    
    if system == "darwin":
        return "macos"
    elif system == "linux":
        return "linux"
    elif system == "windows":
        return "windows"
    else:
        r
…[5045 chars omitted]…

   611	            return bool(manifest.get('name'))
   612	        except (json.JSONDecodeError, IOError):
   613	            pass
   614	
   615	    # Fallback: presence of any standard component directory
   616	    for component_dir in ("agents", "commands", "skills", "hooks"):
   617	        if (plugin_path / component_dir).is_dir():
   618	            return True
   619	
   620	    return False

   272	    Copies:
   273	    - SKILL.md (required)
   274	    - scripts/ (optional)
   275	    - references/ (optional)
   276	    - assets/ (optional)
   277	    - Any other subdirectories the package contains
   278	    
   279	    Args:
   280	        package_info: PackageInfo object with package metadata
   281	        source_path: Pat
…[8628 chars omitted]…
lse None,
   793	            )
   794	            all_target_paths.extend(sub_deployed)
   795	
   796	        # Record ownership in the session map so subsequent packages installed in
   797	        # the same run can detect a collision even before the lockfile is written.
   798	        if current_key is not None:
   799	            self._native_skill_session_owners[skill_name] = current_key
   800

 12 files changed, 514 insertions(+), 316 deletions(-)
diff --git a/src/apm_cli/integration/agent_integrator.py b/src/apm_cli/integration/agent_integ
…[8630 chars omitted]…
code: an escaping path (including one reached through a
+    symlink) is simply excluded instead of raising.
+    """
+    try:
+        return path.resolve().is_relative_to(base_dir.resolve())
+    except (OSError, RuntimeError, TypeError, ValueError):
+        return False
+
+
 def ensure_path_within(path: Path, base_dir: Path) -> Path:
     """Resolve *path* and assert it lives inside *base_dir*.

   107	        metadata_file = find_plugin_json(plugin_path)
   108	        
   109	        if metadata_file is None:
   110	            raise FileNotFoundError(f"Plugin metadata not found in any expected location: {plugin_path}")
   111	        
   112	        if not is_path_within(metadata_file, plugin_path):
   113	            raise FileNotFoundError(
   114	      
…[8628 chars omitted]…
c/apm_cli/integration/prompt_integrator.py |  15 +-
 src/apm_cli/integration/skill_integrator.py  | 137 ++++++------------
 src/apm_cli/models/plugin.py                 |  39 +++--
 src/apm_cli/primitives/discovery.py          |  47 ++++--
 src/apm_cli/utils/helpers.py                 |   8 +-
 src/apm_cli/utils/path_security.py           |  13 ++
 12 files changed, 514 insertions(+), 316 deletions(-)

------
* ``_is_transient_lock_error`` -- single predicate for classifying OSError.
* ``_retry_on_lock`` -- generic retry loop (not a decorator, because
  cleanup-between-retries varies per operation).
* ``robust_rmtree`` / ``robust_copytree`` / ``robust_copy2`` -- public API.
"""

from __future__ import annotations

import errno
import os
impor
…[1471 chars omitted]…
    if winerror in (32, 5):
            return True
    return getattr(exc, "errno", None) == errno.EBUSY


# ---------------------------------------------------------------------------
# Retry core
# ---------------------------------------------------------------------------


def _retry_on_lock(
    operation: Callable[[], T],
    description: str,
    *,
    max_retries: int = _DEFAULT_MAX_RETRIES,

 
+from ..utils.path_security import is_path_within
+
 
 def parse_plugin_manifest(plugin_json_path: Path) -> Dict[str, Any]:
     """Parse a plugin.json manifest file.
@@ -70,7 +72,12 @@ def normalize_plugin_directory(plugin_path: Path, plugin_json_path: Optional[Pat
     """
     mani
…[8628 chars omitted]…
127,10 @@ def find_plugin_json(plugin_path: Path) -> Optional[Path]:
         plugin_path / ".cursor-plugin" / "plugin.json",
     ]
     for candidate in candidates:
-        if candidate.exists():
+        if (
+            candidate.is_file()
+            and not candidate.is_symlink()
+            and is_path_within(candidate, plugin_path)
+        ):
             return candidate
     return None

@@ -522,47 +523,66 @@ class ClaudeFormatter:
         return "\n".join(sections)
     
     def discover_prompt_files(self) -> List[Path]:
-        """Discover all .prompt.md files in the project.
-        
-        Searches in standard APM locations:
-        - .apm/prompts/
-        - .github/prompts/
-        - apm_modules/*/
…[8630 chars omitted]…
.memory.md"))
-        
-        return context_files
+        """Find all context/memory files in a package."""
+        return self._find_package_files(
+            package_path,
+            [
+                (".apm/context", "*.context.md"),
+                (".apm/memory", "*.memory.md"),
+            ],
+        )
     
     @staticmethod
     def _dirs_equal(dir_a: Path, dir_b: Path) -> bool:

   127	            if github_agents_dir.exists():
   128	                all_files_to_scan.extend(github_agents_dir.glob("*.agent.md"))
   129
…[3034 chars omitted]…
all_files_to_scan)
185:                all_files_to_scan = []
188:                        all_files_to_scan.append(instruction.file_path)
190:                        all_files_to_scan.append(agent.file_path)
192:                referenced_contexts = self.link_resolver.get_referenced_contexts(all_files_to_scan)
59:    def register_contexts(self, primitives) -> None:
149:    def get_referenced_contexts(

   187	                    for instruction in placement.instructions:
   188	                        all_files_to_scan.append(instruction.file_path)
   189	                    for agent in placement.agents:
   190	              
…[612 chars omitted]…
es) for p in placements},
   201	                warnings=self.warnings.copy(),
   202	                errors=self.errors.copy(),
   203	                stats=stats
   204	            )
   205	            
src/apm_cli/core/script_runner.py:953:        prompt_path = self._resolve_prompt_file(prompt_file)
src/apm_cli/core/script_runner.py:986:    def _resolve_prompt_file(self, prompt_file: str) -> Path: