Repository navigation
fix(vetted-ops): resolve standalone so the plugin copy runs - #1357
Merged
Merged
Conversation
The magpie-vetted-ops plugin ships tools/vetted-ops without the workspace root, and its [dependency-groups] dev = ["magpie-dev"] only resolves through the root's [tool.uv.sources]. uv resolves every group before running, so every documented `uv run --project <plugin>/tools/vetted-ops …` invocation failed on a marketplace install. Drop the group; the toolchain still reaches the tests through the root dev group. Adds a regression test. Generated-by: Claude Opus 5
potiuk
added
family:tools
potiuk
added a commit
that referenced
this pull request
Sep 24, 2026
Reconciles the spec-loop specs with the functionality that shipped between 5c75abd and bcd8b7f: - agent-isolation-sandbox: the hardware-key touch policy (sig cached + aut off with OpenPGP signing, aut cached with gpg.format=ssh) (#1367); touch-watcher owner is the harness (#1365); macOS overlay closes on deactivation (#1325); whole-user git hooks allowRead and dispatcher flavour (#1364, #1322, #1358); agent-guard finds the git subcommand past global flags (#1330); agent-guard plugin counts as a complete install (#1323); per-tool cooldown_days, bubblewrap 0.13.0 (#1360). - sandbox-diagnostics: ten catalogue entries (prek/uv not found, git hooks silently skipped) (#1359, #1364); doctor probes as scripts, with probes 7 and 8 (#1336, #1362, #1364); verify's 12 checks and conditional-checks.md (#1334). - vetted-command-surface: HTTP read backend with the OSV and CVE.org operations (#1326); the vetted-op-read recipe spelling (#1339); the plugin copy resolves standalone (#1357). - cve-tooling: tools/osv (contract:security-cross-ref) and the cve-org check through vetted-ops (#1297, #1326). - security-issue-lifecycle: step 2b proposes going ahead on a quiet reporter (#1340); the post-advisory security-pages update (#1355). - meta-and-quality-tooling: name: must match the skill directory (#1361); skill-evals fixture containment and grader retry (#1315, #1341); optimize-skill budgets, eval gate, rewrite and extract-code passes (#1331, #1332, #1335, #1338); diff-scoped prek CI (#1317). - marketplace-distribution: substrate plugins (#1368, #1357). - adversarial-review (new): the tool and substrate plugin as shipped (#1368), with its known gaps. Generated-by: Claude Opus 5
potiuk
added
substrate:framework-dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
magpie-vetted-opsplugin cannot run from where it is installed. Every documented invocation — the README'ssandbox.excludedCommands/allowentries,isolated-setup-install, and the skills'uv run --project <framework>/tools/vetted-ops vetted-op-read …recipes — fails on a marketplace install withmagpie-dev was not found in the package registry … vetted-ops:dev's requirements are unsatisfiable.tools/vetted-ops, whosepyproject.tomldeclares[dependency-groups] dev = ["magpie-dev"].magpie-devonly resolves through the workspace root's[tool.uv.sources], which the plugin does not ship, and uv resolves every group before running anything (--no-devdoes not help).devgroup fromtools/vetted-ops(with a comment saying why), and add a regression test that the project declares nothing workspace-only. The toolchain still reaches its tests: CI'suv sync --all-packages --group devand the workspace checks both use the rootdevgroup, which namesmagpie-dev.tools/dev/README.mdrecords the exception to the "every member namesmagpie-dev" convention.Type of change
tools/*/withpyproject.toml)docs/,README.md,CONTRIBUTING.md)Test plan
uv run --project ~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/<ver>/tools/vetted-ops vetted-op-read …→ unsatisfiablemagpie-dev; same with--no-dev.tools/vetted-ops(outside the workspace, as the plugin ships it):uv run --project <copy> vetted-op-read --caller x list-opsresolves and runs.uv sync --all-packages --group devthenuv run --directory tools/vetted-ops pytest→ 146 passed (incl. the new test).test_project_resolves_outside_the_workspacefails against the unfixedpyproject.tomland passes with the fix.uv lockrefreshed (drops the vetted-ops dev-group entries).prek run --fileson the changed files passes. One earlier run reportedpytest failed for: agent-isolation; it did not reproduce on re-run, and that suite passes on its own (256 passed) — looks unrelated and flaky.Linked issues
Refs #1310 (added the
uv run --projectexclusion this invocation is meant to hit).Notes for reviewers (optional)
Alternative considered: keep the dev group and switch every documented invocation to
uvx --from <plugin>/tools/vetted-ops vetted-op-read …(a wheel build ignores dependency groups — verified working). Rejected as the larger change: ~20 call sites across skills, docs,.claude/settings.jsonandsandbox-lint/expected.json, and a second excludedCommands shape to keep in sync. Adopters who already added auvx --fromexclusion as a workaround can drop it after upgrading.🤖 Generated with Claude Code