setup-isolated-setup-install

Name: setup-isolated-setup-install
Author: apache

68stars52forks

How to install setup-isolated-setup-install?

apache/magpie/setup-isolated-setup-install

$npx -y skills add apache/magpie --skill setup-isolated-setup-install

Installs into the current project.

Summary

Guide an adopter through the first-time install of the framework's secure agent setup (bubblewrap + socat + claude-code, sandbox/permissions/clean-env layers). Walks every step interactively; never auto-runs sudo, shell-rc edits, or settings overwrites.

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md -->
5
6	# setup-isolated-setup-install
7
8	This skill is the on-ramp for adopters who do not yet have the
9	secure setup running. It is a thin walkthrough wrapper around the
10	canonical install path documented in
11	[`docs/setup/secure-agent-setup.md`](../../docs/setup/secure-agent-setup.md). The
12	authoritative content lives there; this skill exists so an adopter
13	can say "set up the secure agent setup" in a fresh session and
14	land in the right step-by-step flow without first reading the
15	document.
16
17	## Adopter overrides
18
19	Before running the default behaviour documented
20	below, this skill consults
21	[`.apache-magpie-local/setup-isolated-setup-install.md`](../../docs/setup/agentic-overrides.md) (personal, gitignored) and [`.apache-magpie-overrides/setup-isolated-setup-install.md`](../../docs/setup/agentic-overrides.md) (committed, project-wide)
22	in the adopter repo if it exists, and applies any
23	agent-readable overrides it finds. See
24	[`docs/setup/agentic-overrides.md`](../../docs/setup/agentic-overrides.md)
25	for the contract — what overrides may contain, hard
26	rules, the reconciliation flow on framework upgrade,
27	upstreaming guidance.
28
29	Hard rule: agents NEVER modify the snapshot under
30	`<adopter-repo>/.apache-magpie/`. Local modifications
31	go in the override file. Framework changes go via PR
32	to `apache/magpie`.
33
34	---
35
36	## Snapshot drift
37
38	Also at the top of every run, this skill compares the
39	gitignored `.apache-magpie.local.lock` (per-machine
40	fetch) against the committed `.apache-magpie.lock`
41	(the project pin). On mismatch the skill surfaces the
42	gap and proposes
43	[`/magpie-setup upgrade`](../setup/upgrade.md).
44	The proposal is non-blocking — the user may defer if
45	they want to run with the local snapshot for now. See
46	[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection)
47	for the full flow.
48
49	Drift severity:
50
51	- method or URL differ → ✗ full re-install needed.
52	- ref differs (project bumped tag, or `git-branch`
53	local is behind upstream tip) → ⚠ sync needed.
54	- **`svn-zip` SHA-512 mismatches the committed
55	anchor** → ✗ security-flagged; investigate before
56	upgrading.
57
58	---
59	## Golden rules
60
61	- Do not auto-run privilege-elevating commands. Anything that
62	needs `sudo` (apt / dnf installs, system-wide writes) is printed
63	for the user to copy-paste into their own terminal. The skill
64	never invokes `sudo` itself.
65	- Do not edit shell rc files without approval. `~/.bashrc` /
66	`~/.zshrc` modifications (sourcing `agent-iso.sh`, the optional
67	`alias claude='claude-iso'`) are surfaced as the exact line to
68	add; the user pastes it themselves. The skill confirms the rc
69	file path with the user first; it does not assume.
70	- Do not overwrite an existing settings file silently. If the
71	user already has a project `.claude/settings.json` or a
72	user-scope `~/.claude/settings.json`, the skill diffs the
73	desired merge against the existing file and asks for explicit
74	approval before writing. Re-installs / partial-state recoveries
75	are common — the skill must not blow away an unrelated
76	pre-existing hook or `permissions.ask` rule. The desired merge
77	includes the agent-guard `hooks.PreToolUse` entry (matcher
78	`Bash`, command running the user-scope `~/.claude/scripts/agent-guard.py`)
79	— the deterministic guard from
80	[`tools/agent-guard`](../../tools/agent-guard/README.md). Install
81	the script as `~/.claude/scripts/agent-guard.py` and populate
82	`~/.claude/scripts/guards.d/` from both the engine's bundled
83	`guards.d/*.py` and every skill-owned `skill

People who liked this also viewed

6 picks

Type

setup-isolated-setup-install

68stars52forks

View on GitHub

How to install setup-isolated-setup-install?

apache/magpie/setup-isolated-setup-install

$npx -y skills add apache/magpie --skill setup-isolated-setup-install

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
2	<project-config> → adopting project's `.apache-magpie/` directory
3	<tracker> → value of `tracker_repo:` in <project-config>/project.md
4	<upstream> → value of `upstream_repo:` in <project-config>/project.md -->
5
6	# setup-isolated-setup-install
7
8	This skill is the on-ramp for adopters who do not yet have the
9	secure setup running. It is a thin walkthrough wrapper around the
10	canonical install path documented in
11	[`docs/setup/secure-agent-setup.md`](../../docs/setup/secure-agent-setup.md). The
12	authoritative content lives there; this skill exists so an adopter
13	can say "set up the secure agent setup" in a fresh session and
14	land in the right step-by-step flow without first reading the
15	document.
16
17	## Adopter overrides
18
19	Before running the default behaviour documented
20	below, this skill consults
21	[`.apache-magpie-local/setup-isolated-setup-install.md`](../../docs/setup/agentic-overrides.md) (personal, gitignored) and [`.apache-magpie-overrides/setup-isolated-setup-install.md`](../../docs/setup/agentic-overrides.md) (committed, project-wide)
22	in the adopter repo if it exists, and applies any
23	agent-readable overrides it finds. See
24	[`docs/setup/agentic-overrides.md`](../../docs/setup/agentic-overrides.md)
25	for the contract — what overrides may contain, hard
26	rules, the reconciliation flow on framework upgrade,
27	upstreaming guidance.
28
29	Hard rule: agents NEVER modify the snapshot under
30	`<adopter-repo>/.apache-magpie/`. Local modifications
31	go in the override file. Framework changes go via PR
32	to `apache/magpie`.
33
34	---
35
36	## Snapshot drift
37
38	Also at the top of every run, this skill compares the
39	gitignored `.apache-magpie.local.lock` (per-machine
40	fetch) against the committed `.apache-magpie.lock`
41	(the project pin). On mismatch the skill surfaces the
42	gap and proposes
43	[`/magpie-setup upgrade`](../setup/upgrade.md).
44	The proposal is non-blocking — the user may defer if
45	they want to run with the local snapshot for now. See
46	[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection)
47	for the full flow.
48
49	Drift severity:
50
51	- method or URL differ → ✗ full re-install needed.
52	- ref differs (project bumped tag, or `git-branch`
53	local is behind upstream tip) → ⚠ sync needed.
54	- **`svn-zip` SHA-512 mismatches the committed
55	anchor** → ✗ security-flagged; investigate before
56	upgrading.
57
58	---
59	## Golden rules
60
61	- Do not auto-run privilege-elevating commands. Anything that
62	needs `sudo` (apt / dnf installs, system-wide writes) is printed
63	for the user to copy-paste into their own terminal. The skill
64	never invokes `sudo` itself.
65	- Do not edit shell rc files without approval. `~/.bashrc` /
66	`~/.zshrc` modifications (sourcing `agent-iso.sh`, the optional
67	`alias claude='claude-iso'`) are surfaced as the exact line to
68	add; the user pastes it themselves. The skill confirms the rc
69	file path with the user first; it does not assume.
70	- Do not overwrite an existing settings file silently. If the
71	user already has a project `.claude/settings.json` or a
72	user-scope `~/.claude/settings.json`, the skill diffs the
73	desired merge against the existing file and asks for explicit
74	approval before writing. Re-installs / partial-state recoveries
75	are common — the skill must not blow away an unrelated
76	pre-existing hook or `permissions.ask` rule. The desired merge
77	includes the agent-guard `hooks.PreToolUse` entry (matcher
78	`Bash`, command running the user-scope `~/.claude/scripts/agent-guard.py`)
79	— the deterministic guard from
80	[`tools/agent-guard`](../../tools/agent-guard/README.md). Install
81	the script as `~/.claude/scripts/agent-guard.py` and populate
82	`~/.claude/scripts/guards.d/` from both the engine's bundled
83	`guards.d/*.py` and every skill-owned `skill

People who liked this also viewed

6 picks

Type