From 44cb8c236fd989d93d8827e7643cf839b8a22dc4 Mon Sep 17 00:00:00 2001 From: Eldho Thomas Date: Wed, 21 Oct 2026 00:27:25 -0400 Subject: [PATCH 1/4] docs(setup): check the new pre-flight package before replacing the old one --- plugins/magpie-setup/skills/setup/upgrade.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/plugins/magpie-setup/skills/setup/upgrade.md b/plugins/magpie-setup/skills/setup/upgrade.md index d0409712c..7b65a9348 100644 --- a/plugins/magpie-setup/skills/setup/upgrade.md +++ b/plugins/magpie-setup/skills/setup/upgrade.md @@ -416,6 +416,26 @@ Copy the files, not a link to them. same package, so a plain `cp -R` from it leaves a link in the personal layer that points nowhere. Copy from the skill's directory, or follow the link with `cp -RL`. +For marketplace installs, the source is +`/magpie-setup//skills/setup/setup_preflight`. +Check the new copy before replacing the old one: + +```bash +source_dir="/setup_preflight" +personal_dir="" +target="$personal_dir/setup_preflight" + +if [ -e "$target" ] || [ -L "$target" ]; then + temp="$(mktemp -d "$personal_dir/.preflight.XXXXXX")" || exit 1 + cp -RL "$source_dir" "$temp/setup_preflight" && + PYTHONPATH="$temp" python3 -c 'import setup_preflight.cli' || + { rm -rf "$temp"; exit 1; } + mv "$target" "$temp/old" || { rm -rf "$temp"; exit 1; } + mv "$temp/setup_preflight" "$target" || + { mv "$temp/old" "$target"; exit 1; } + rm -rf "$temp" +fi +``` The fresh copy also carries the new version's isolated-setup fingerprint. When the secure-setup files changed in this upgrade, the From ff7090e6be362fe26a7e7431be02bfd10bc54285 Mon Sep 17 00:00:00 2001 From: Eldho Thomas Date: Sun, 25 Oct 2026 13:37:52 -0400 Subject: [PATCH 2/4] docs(setup): clarify safe preflight refresh in sandboxed installs --- plugins/magpie-setup/skills/setup/upgrade.md | 21 +++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/plugins/magpie-setup/skills/setup/upgrade.md b/plugins/magpie-setup/skills/setup/upgrade.md index 7b65a9348..1c457f44e 100644 --- a/plugins/magpie-setup/skills/setup/upgrade.md +++ b/plugins/magpie-setup/skills/setup/upgrade.md @@ -416,19 +416,30 @@ Copy the files, not a link to them. same package, so a plain `cp -R` from it leaves a link in the personal layer that points nowhere. Copy from the skill's directory, or follow the link with `cp -RL`. -For marketplace installs, the source is -`/magpie-setup//skills/setup/setup_preflight`. +For marketplace installs, use the `setup_preflight/` directory next +to this skill in the installed plugin. Get the destination from +`python3 -m setup_preflight.layers` as in +[`config` Step 0](config.md#step-0--pre-flight). +The marketplace cache under `~/.claude/plugins/cache/` is read-denied +to a sandboxed shell. Have the agent's file tool copy the package into +a temporary directory in the personal layer, following any symlinks. +If the file tool cannot copy the directory, ask the user to run the +following commands in their own terminal, outside the sandbox. +For a readable snapshot install, the commands can run in the sandbox. + +Set `source_dir` to that installed skill's `setup_preflight/` directory +and `personal_dir` to the directory reported by `setup_preflight.layers` +before running the commands. Use their actual paths, not placeholders. +If the file tool already staged the package, skip the `cp` command. Check the new copy before replacing the old one: ```bash -source_dir="/setup_preflight" -personal_dir="" target="$personal_dir/setup_preflight" if [ -e "$target" ] || [ -L "$target" ]; then temp="$(mktemp -d "$personal_dir/.preflight.XXXXXX")" || exit 1 cp -RL "$source_dir" "$temp/setup_preflight" && - PYTHONPATH="$temp" python3 -c 'import setup_preflight.cli' || + PYTHONPATH="$temp" python3 -P -m setup_preflight --skill magpie-setup --no-welcome || { rm -rf "$temp"; exit 1; } mv "$target" "$temp/old" || { rm -rf "$temp"; exit 1; } mv "$temp/setup_preflight" "$target" || From 0c79654792550f4b1ba7859790f22f6e158d52c9 Mon Sep 17 00:00:00 2001 From: Eldho Thomas Date: Sun, 25 Oct 2026 13:38:05 -0400 Subject: [PATCH 3/4] docs(setup): keep marketplace refresh instructions runnable --- plugins/magpie-setup/skills/setup/upgrade.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/plugins/magpie-setup/skills/setup/upgrade.md b/plugins/magpie-setup/skills/setup/upgrade.md index 1c457f44e..7488c5352 100644 --- a/plugins/magpie-setup/skills/setup/upgrade.md +++ b/plugins/magpie-setup/skills/setup/upgrade.md @@ -421,16 +421,13 @@ to this skill in the installed plugin. Get the destination from `python3 -m setup_preflight.layers` as in [`config` Step 0](config.md#step-0--pre-flight). The marketplace cache under `~/.claude/plugins/cache/` is read-denied -to a sandboxed shell. Have the agent's file tool copy the package into -a temporary directory in the personal layer, following any symlinks. -If the file tool cannot copy the directory, ask the user to run the -following commands in their own terminal, outside the sandbox. +to a sandboxed shell. For a marketplace install, ask the user to run +the following commands in their own terminal, outside the sandbox. For a readable snapshot install, the commands can run in the sandbox. Set `source_dir` to that installed skill's `setup_preflight/` directory and `personal_dir` to the directory reported by `setup_preflight.layers` before running the commands. Use their actual paths, not placeholders. -If the file tool already staged the package, skip the `cp` command. Check the new copy before replacing the old one: ```bash From ff1e256ba6624e79d7ce105443db749c82b5b64a Mon Sep 17 00:00:00 2001 From: Eldho Thomas Date: Sun, 25 Oct 2026 13:52:29 -0400 Subject: [PATCH 4/4] docs(setup): contain refresh failures in a subshell --- plugins/magpie-setup/skills/setup/upgrade.md | 26 +++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/plugins/magpie-setup/skills/setup/upgrade.md b/plugins/magpie-setup/skills/setup/upgrade.md index 7488c5352..cb275ed82 100644 --- a/plugins/magpie-setup/skills/setup/upgrade.md +++ b/plugins/magpie-setup/skills/setup/upgrade.md @@ -431,18 +431,20 @@ before running the commands. Use their actual paths, not placeholders. Check the new copy before replacing the old one: ```bash -target="$personal_dir/setup_preflight" - -if [ -e "$target" ] || [ -L "$target" ]; then - temp="$(mktemp -d "$personal_dir/.preflight.XXXXXX")" || exit 1 - cp -RL "$source_dir" "$temp/setup_preflight" && - PYTHONPATH="$temp" python3 -P -m setup_preflight --skill magpie-setup --no-welcome || - { rm -rf "$temp"; exit 1; } - mv "$target" "$temp/old" || { rm -rf "$temp"; exit 1; } - mv "$temp/setup_preflight" "$target" || - { mv "$temp/old" "$target"; exit 1; } - rm -rf "$temp" -fi +( + target="$personal_dir/setup_preflight" + + if [ -e "$target" ] || [ -L "$target" ]; then + temp="$(mktemp -d "$personal_dir/.preflight.XXXXXX")" || exit 1 + cp -RL "$source_dir" "$temp/setup_preflight" && + PYTHONPATH="$temp" python3 -P -m setup_preflight --skill magpie-setup --no-welcome || + { rm -rf "$temp"; exit 1; } + mv "$target" "$temp/old" || { rm -rf "$temp"; exit 1; } + mv "$temp/setup_preflight" "$target" || + { mv "$temp/old" "$target"; exit 1; } + rm -rf "$temp" + fi +) ``` The fresh copy also carries the new version's isolated-setup