[sama Pyb (Pybsama)]

Description

Installing my-plugin@marketplace fails when the catalog points at a versioned directory produced by apm pack, such as plugins/my-plugin-1.2.3. Shorthand parsing mistakes the dotted suffix for an unsupported file extension.

Use the existing explicit Git/path reference when the marketplace already identifies the repository and path. Keep that interpreted identity through selective installation and dry-run planning using the existing package-selection module instead of reparsing an ambiguous display string. GitHub/GHE Contents API success requires a directory listing, not merely HTTP 200. The Git fallback requires an actual tree entry, so file, symbolic-link, and submodule responses cannot bypass directory validation.

Supported individual files, package-content validation, containment checks, bundle naming, and local marketplace behavior retain their existing contracts.

Issue and approved scope

Fixes #3078.

Human scope approval: #3078 (comment)

This completes the bounded versioned-directory installation repair; it does not change the bundle layout from #2432.

Type of change

• Bug fix
• Documentation

Testing

• Tested locally
• Added regression tests

The hermetic lifecycle test runs apm pack, commits the generated bundle to a local Git repository, previews installation without changing the consumer, verifies the first install deploys the expected skill, and replays the lockfile. Semver, calendar versions, and the local-marketplace control are covered. Negative cases reject unknown files, version-named blobs, malformed package content, and traversal without writing the consumer manifest or lockfile; real Git tree probes also reject symbolic links.

The GitHub catalog fetch is substituted at the transport boundary with the existing Git fetcher against the committed local fixture. Source classification, resolution, download, validation, deployment, and lock replay run normally with external network access denied. This is not a live GitHub API integration test.

Focused validation:

• Affected API/downloader/selection tests: 191 passed, including 44 API-response cases and ten real Git cases. GitHub/GHE directory arrays (including empty arrays), non-directory responses, malformed JSON, explicit-ref fallback, and default-ref validation are covered.
• Authentication, anonymous-first, and throttling contracts: 90 passed.
• Selector/install-phase/dry-run and architecture contracts: 266 passed.
• Marketplace classification and round-trip cases: 16 passed.
• Hermetic pack/marketplace/install lifecycle: 8 passed.

These focused runs overlap; their counts are not a whole-suite total.

The six CI test-quality/architecture-ratchet modules also pass locally: 91 passed. Full-source Ruff lint/format, pylint duplication checks, architecture/auth boundaries, YAML I/O/file-length/portable-path guards, and git diff --check pass.

A broader earlier run had 4,791 passes and 25 failures: one introduced module-length violation was fixed by the shared selection helper and passes in the final checks; 24 Unix installer fixture failures came from writing the Chinese checkout's Python path as ASCII. The same encoding failure was reproduced using an unchanged HEAD fixture. The full suite is therefore not claimed green, and Windows was not tested locally.

Spec conformance (OpenAPM v0.1)

No normative requirement changes. This repairs consumption of existing explicit Git/path coordinates and preserves path validation, package-content checks, and lockfile identity; it introduces no new manifest syntax or bundle format.

[Copilot]

Copilot review overview

🟡 Changes recommended

The Contents API path can still accept non-directory entries before the stricter Git tree check runs.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Ensure 200 responses represent directories before bypassing tree checks · New
• Add the required return annotation to the test · New

What changed in this PR

Fixes installation of versioned marketplace package directories while preserving structured Git/path references.

Changes:

• Resolves dotted marketplace directories as explicit Git/path dependencies.
• Preserves structured identities during selective installs and dry runs.
• Adds Git tree validation and regression coverage.

File	Description
.apm/​architecture/​owners/​install-deployment.json	Registers package-selection ownership.
scripts/​architecture_linter/​checks/​install_dry_run_plan.py	Guards structured selector usage.
src/​apm_cli/​deps/​github_downloader_validation.py	Tightens Git tree probing.
src/​apm_cli/​install/​dry_run_plan.py	Preserves interpreted dependency identities.
src/​apm_cli/​install/​package_selection.py	Centralizes selector identity resolution.
src/​apm_cli/​install/​phases/​resolve.py	Uses structured references during filtering.
src/​apm_cli/​marketplace/​resolver.py	Handles dotted marketplace directory paths.
tests/​integration/​test_architecture_owner_rule_mutations.py	Tests architecture guard enforcement.
tests/​integration/​test_marketplace_versioned_directory_lifecycle.py	Covers the complete install lifecycle.
tests/​unit/​deps/​test_github_downloader_validation.py	Updates expected Git tree output.
tests/​unit/​deps/​test_versioned_directory_probe.py	Tests tree, blob, symlink, and gitlink probes.
tests/​unit/​install/​phases/​test_resolve_selective_update_plan.py	Tests selective filtering and descendants.
tests/​unit/​install/​test_dry_run_render.py	Tests dry-run identity preservation.
tests/​unit/​marketplace/​test_versioned_directory_resolution.py	Tests classification and traversal rejection.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Daniel Meppiel (danielmeppiel)]

Versioned marketplace directory recovery: ready for parent validation

Current-head recommendation: ship_now for 904a02ff5319a999168a7ed2d0268e54d20df808. Current main is 4d35e74f1801b1ed2424569f55c927da0d18eccd. The retained matrix blocker has actually passed, and the final strict merge tree equals the tested head. This is based on current functional and technical CI evidence, not an eligibility badge or historical green checks.

Faithful integration and review

The approved scope is unchanged: consume versioned directories produced by apm pack, preserving supported files, containment, package validation and local marketplace behavior. No new discovery route, bundle layout, target or policy change was introduced.

After the first validated integration, main advanced with the separately delivered nested-hook metadata work. The second text-only preview again identified only CHANGELOG; the repository's union driver masks that conflict. Both pending entries remain under Unreleased, and the dated 0.34.0 section is byte-identical to current main.

Apart from CHANGELOG, all PR-specific files are unchanged by the final integration, including the full mutation matrix. Original sama Pyb (@Pybsama) commits remain ancestors. The genuine prior full/delta reviews carry forward through this proof; no broad panel was restarted and no fresh panel was invented. Prior Sequence, changelog and explicit Git/path guidance follow-ups remain folded.

Both author-addressed Copilot threads remain resolved: directory-shaped Contents API responses and the test return annotation. Complete paginated discussion was refreshed without new substantive feedback. The Starlight marketplace guide and bundled usage resources remain consistent with the executed lifecycle; README is untouched.

Final-head validation

• 565 tests passed, zero failures/errors/skips, including all 462 architecture-matrix checks, matrix equality and the restored Build ID mutation.
• Coverage includes pack/register/preview/install/lock replay, API/Git rejection controls, structured selection, existing req-mf-008 coverage, and the newly delivered nested-hook metadata overlap.
• All eight canonical CI lint steps passed, including authentication and architecture boundaries.
• Strict completion schema and required owner-v2 semantic verification passed: three actually executed functional mappings cover both detected owners.
• The earlier 770-pass run remains retained at 6c441f848f; it is not relabelled as a final-head run. Its six intentional static-guard failures and six restored passes carry through verified unchanged guard/regression functions. Earlier production/CLI mutation evidence is likewise retained.
• Orphan check aligned 129 requirements; conformance regeneration was unchanged. The actual Mode B detector used its existing-marker path without a waiver.

Actual standard technical workflows

All six completed successfully for the final published head, with actual job results verified:

• CI: Linux shards, lifecycle, architecture and Windows gates
• Spec conformance
• CodeQL
• NOTICE Drift Check
• Docs: PR build passed; deployment correctly skipped
• Aggregate technical gate

Both CodeQL analyses match current synthetic merge 432fdb2d59319d82851619d3fc026d9319c8f28b, with zero open alerts.

Publication and landing boundary

The previous published head was 6c441f848f7cb2838143b449a58721c86460db5d. The final fast-forward push preserved history and used this explicit lease:

git push --force-with-lease=refs/heads/codex/fix-versioned-marketplace-dirs:6c441f848f7cb2838143b449a58721c86460db5d https://github.com/Pybsama/apm.git HEAD:refs/heads/codex/fix-versioned-marketplace-dirs

GitHub reports MERGEABLE / BLOCKED, with all effective checks passed or correctly skipped. Parent validation and the explicitly authorized admin-bypass decision remain separate. This worker has not merged, queued, enabled auto-merge, requested reviewers, assigned anyone, changed policy or changed either item's open state.

Counters are 4/4 outer iterations, 2/2 Copilot rounds, 1/3 CI recoveries, without reset. No unresolved in-scope findings or deferred items remain.

---

Generated by autopilot-pr-merge-worker. This comment is AI-generated and may contain errors.