Defame1297
874bf06b18
Output of apm pack, sync-plugin-content.sh --all and sync-marketplace-mirror.sh against this round's source changes. No file here is hand-edited. Carries the version bumps and marketplace owner.email into the compiled manifests, the disallowedTools frontmatter and doc corrections into the flat mirrors, and changes plugins/bin/.github/plugin/plugin.json's mcpServers from the inlined server object to the ".mcp.json" pointer. That last file also returns to 0644: the previous re-injection wrote it through mktemp and carried 0600 across, which no gate could see because the mode check did not cover .github/plugin/ and git tracks only the exec bit. .agents/plugins/marketplace.json is unchanged and that is correct -- apm's codex profile carries neither version nor owner keys, so nothing in this round reaches it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
2.4 KiB
source_keys
| source_keys | |||||
|---|---|---|---|---|---|
|
claude-code-fields
name description tools disallowedTools model effort maxTurns permissionMode skills mcpServers hooks memory background isolation color initialPrompt
claude-code-only-fields
maxTurns isolation memory permissionMode effort hooks mcpServers disallowedTools skills initialPrompt color background
copilot-fields
name description tools target model disable-model-invocation user-invocable mcp-servers metadata
copilot-only-fields
target disable-model-invocation user-invocable mcp-servers metadata
apm-agent-allowlist
name description model source_keys disallowedTools
Parsing note: validate.sh reads the first non-empty, non-#, non---- line under each
heading as a whitespace-separated token list, and stops there. Keep the token line immediately
below its heading; explanatory prose goes after it, as here.
Why disallowedTools is on a list that is otherwise vendor-neutral, when tools is not
(ADR-0016 and its 2026-08-14 amendment): the two are not symmetric. tools is an allowlist
whose vocabulary differs per harness — Claude Code names its own tools, Copilot CLI uses aliases
(execute/read/edit/search/agent/web) — so a value correct for one is wrong for the
other, and apm compile copies frontmatter verbatim with no per-target integrator to reconcile
them. disallowedTools is a denylist, and denying by name is safe under verbatim copy: a name
the other harness does not recognise denies nothing, so the worst case is that the fence is absent
there, never that the wrong capability is granted. Claude Code honours it for plugin subagents —
docs/research/docs/claude-code-plugins/agent-definition.md:99 names the fields plugin agents
silently ignore (hooks, mcpServers, permissionMode) and disallowedTools is not among them.
disallowedTools also appears in claude-code-only-fields above, and that stays correct: at
project/user scope it is still a Claude-only field and must not appear in a Copilot .agent.md.
The two lists answer different questions — "may this field cross the CC/Copilot file boundary" for
a real pair, versus "is this field safe under verbatim copy to every target" for a single
vendor-neutral APM file.