Defame1297
9e612fd183
reinject_mcp_servers copied .mcp.json's mcpServers into the compiled Copilot
manifest verbatim via jq. apm's own path does not: collect_mcp_servers runs
_sanitize_mcp_servers(), which drops env/headers/authorization and redacts
secret-shaped keys, because copying them into a committed manifest exfiltrates
them into the distributed artefact. The re-injection was the only route around
that sanitizer, and it wrote to a tracked, marketplace-distributed file.
Both host schemas document mcpServers as "string or object -- config path or
inline definitions", so the pointer form is valid and carries no resolved
content. It also preserves the ${VAR} indirection the sanitizer strips.
Also in this pass:
- mktemp+mv left the manifest at 0600 while --check compared content only, so
a real sync silently demoted a mode the gate could not see
- --check --all exited 0 when the marketplace yielded zero plugins, including
on unparseable JSON: the one gate whose work list comes from a generated file
could be silenced by regenerating its own input
- sync_dir took an unguarded $target_dir despite a comment claiming otherwise
- basename '.'/'..' escaped $SCRATCH_ROOT and made bundle selection arbitrary
- path_manifest compared only the exec bit, so check and sync disagreed
- sync-marketplace-mirror.sh fell back to pwd outside a worktree and reported
no drift on a tree it never identified
Mode comparison is deliberately files-only: directory modes come from umask on
one side and checkout on the other and git tracks neither, so comparing them
reports the runner's umask rather than a property of the mirror.
Tests: 44 -> 67 and 15 -> 19 assertions, each verified to fail under the
mutation it exists to catch.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
71 lines
3.3 KiB
Bash
Executable File
71 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# .claude-plugin/marketplace.json is apm's compiled Claude marketplace output (see
|
|
# apm.yml's marketplace.outputs.claude). GitHub Copilot CLI's manifest lookup accepts
|
|
# that same file at .claude-plugin/marketplace.json directly, but also has a legacy
|
|
# convention path at .github/plugin/marketplace.json (see
|
|
# plugins/kyberforge/docs/research/docs/github-copilot-plugins/marketplace.md) -- and
|
|
# CONTEXT.md documents that path as a mirror of the Claude output, not a separate apm
|
|
# output profile (apm only ships "claude" and "codex" mappers; codex writes a
|
|
# differently-shaped file to .agents/plugins/marketplace.json, not this path). This
|
|
# script keeps that legacy mirror byte-identical to .claude-plugin/marketplace.json
|
|
# instead of letting it silently drift (see issue #90 comment thread).
|
|
|
|
# Hard error, not a `|| pwd` fallback. Every path this script touches hangs off
|
|
# REPO_ROOT, and both of its exits-0 paths are "the files agree" or "neither file
|
|
# exists" -- so a REPO_ROOT pointing somewhere that is not this repo reports "no
|
|
# drift" over a tree it never looked at. Run `--check` from an empty directory
|
|
# outside any worktree and the fallback made that the literal outcome: rev-parse
|
|
# failed, REPO_ROOT became $PWD, neither file was there, exit 0. Refusing to guess
|
|
# is the only answer that cannot be silently wrong; the `-f "$DST"` branch below
|
|
# covers a genuinely stale mirror, which is a different condition.
|
|
if ! REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || [[ -z "$REPO_ROOT" ]]; then
|
|
echo "Error: not inside a git worktree -- cannot locate the repository root, and guessing \$PWD would let --check report \"no drift\" over a tree it never inspected. Run this from within the repository." >&2
|
|
exit 1
|
|
fi
|
|
SRC="$REPO_ROOT/.claude-plugin/marketplace.json"
|
|
DST="$REPO_ROOT/.github/plugin/marketplace.json"
|
|
|
|
usage() {
|
|
echo "Usage: $0 [--check]" >&2
|
|
exit 1
|
|
}
|
|
|
|
CHECK=0
|
|
if [[ "${1:-}" == "--check" ]]; then
|
|
CHECK=1
|
|
shift
|
|
fi
|
|
[[ $# -eq 0 ]] || usage
|
|
|
|
if [[ ! -f "$SRC" ]]; then
|
|
# A missing source with a surviving mirror is drift, not absence: the mirror
|
|
# can only be stale (nothing is left for it to be byte-identical to), which is
|
|
# precisely the silent divergence this script exists to prevent. Exiting 0
|
|
# here would report "no drift" over a mirror of a file that no longer exists.
|
|
# (An unresolvable REPO_ROOT is handled above and is a hard error; this branch
|
|
# is only about a source file that is genuinely gone from a real worktree.)
|
|
# scripts/sync-plugin-content.sh --check --all already errors on the same
|
|
# condition ("requires .../marketplace.json"); this matches it.
|
|
# Neither file present stays a genuine no-op: nothing to mirror, nothing stale.
|
|
if [[ "$CHECK" -eq 1 && -f "$DST" ]]; then
|
|
echo "DRIFT $DST: mirror exists but .claude-plugin/marketplace.json does not" >&2
|
|
echo "Fix: restore .claude-plugin/marketplace.json (apm's compiled Claude marketplace output), or delete $DST" >&2
|
|
exit 1
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$CHECK" -eq 1 ]]; then
|
|
if [[ ! -f "$DST" ]] || ! diff -q "$SRC" "$DST" >/dev/null 2>&1; then
|
|
echo "DRIFT $DST: out of sync with .claude-plugin/marketplace.json" >&2
|
|
echo "Fix: bash scripts/sync-marketplace-mirror.sh" >&2
|
|
exit 1
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
mkdir -p "$(dirname "$DST")"
|
|
cp "$SRC" "$DST"
|