feat(security): run every security skill without project adoption

.agents/plugins/marketplace.json

@@ -103,6 +103,17 @@
         "installation": "AVAILABLE"
       }
     },
+    {
+      "name": "magpie-security-tools",
+      "source": {
+        "source": "local",
+        "path": "./plugins/magpie-security-tools"
+      },
+      "category": "maintenance",
+      "policy": {
+        "installation": "AVAILABLE"
+      }
+    },
     {
       "name": "magpie-setup",
       "source": {

.claude-plugin/marketplace.json

@@ -18,6 +18,12 @@
       "version": "0.9.0.dev202610241347",
       "description": "Apache Magpie \u2014 deterministic pre-execution command guard: a PreToolUse hook that denies shell commands which would break a hard framework rule. Runs from the installed plugin, so no repository or worktree needs a local copy."
     },
+    {
+      "name": "magpie-security-tools",
+      "source": "./plugins/magpie-security-tools",
+      "version": "0.9.0.dev202610241347",
+      "description": "Apache Magpie \u2014 the tools the security skills run (tracker field and rollup edits, CVE JSON, the privacy gate, the scan importer), shipped so a marketplace install needs no framework checkout."
+    },
     {
       "name": "magpie-vetted-ops",
       "source": "./plugins/magpie-vetted-ops",

.claude/settings.json

@@ -100,6 +100,9 @@
       "Edit(tools/agent-isolation/claude-settings.local.template.json)",
       "Edit(plugins/magpie-setup/skills/setup/family-mcp-allows.json)",
       "Edit(.apache-magpie-overrides/tools/vetted-ops/**)",
+      "Edit(//**/.git/**/apache-magpie/tools/vetted-ops/**)",
+      "Edit(//**/.svn/apache-magpie/tools/vetted-ops/**)",
+      "Edit(//**/.apache-magpie-local/tools/vetted-ops/**)",
       "Edit(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
       "Edit(~/.claude/magpie/**)",
       "Edit(~/.config/uv/**)",

.github/labeler.yml

@@ -406,6 +406,7 @@ family:tools:
           - any-glob-to-any-file:
               - 'plugins/magpie-adversarial-review/**'
               - 'plugins/magpie-agent-guard/**'
+              - 'plugins/magpie-security-tools/**'
               - 'plugins/magpie-vetted-ops/**'
       - changed-files:
           - all-globs-to-any-file:

.pre-commit-config.yaml

@@ -342,7 +342,7 @@ repos:
         name: check-family-plugins (marketplace plugins vs frontmatter)
         language: system
         entry: python3 tools/dev/check-family-plugins.py --fix
-        files: ^(tools/(agent-guard/src/.*|vetted-ops/(src/.*|hooks/.*|pyproject\.toml|README\.md))|tools/dev/check-family-plugins\.py|\.pre-commit-config\.yaml|skills/.*/SKILL\.md|plugins/.*|\.claude-plugin/(marketplace|plugin)\.json|\.codex-plugin/plugin\.json|\.agents/plugins/marketplace\.json|(plugin|marketplace)\.json|gemini-extension\.json|apm\.yml|pyproject\.toml)$
+        files: ^(tools/(agent-guard/src/.*|vetted-ops/(src/.*|hooks/.*|pyproject\.toml|README\.md))|tools/(jira|local-tracker|security-management|github-body-field|github-rollup|vcs|cve-tool-vulnogram/(generate-cve-json|oauth-api)|privacy-llm/checker|asf-security-dash|gmail/oauth-draft)/(src/.*|hooks/.*|pyproject\.toml|README\.md)|tools/forwarder-relay/README\.md|tools/gmail/asf-relay\.md|tools/security-tracker-stats-dashboard/[^/]+|tools/security-tracker-stats-dashboard/src/.*|tools/dev/check-family-plugins\.py|\.pre-commit-config\.yaml|skills/.*/SKILL\.md|plugins/.*|\.claude-plugin/(marketplace|plugin)\.json|\.codex-plugin/plugin\.json|\.agents/plugins/marketplace\.json|(plugin|marketplace)\.json|gemini-extension\.json|apm\.yml|pyproject\.toml)$
         pass_filenames: false
   # Claude Code mods — `claude plugin validate --strict` and `claude plugin
   # test` on every plugin whose `hooks/hooks.json` declares `modules`

AGENTS.md

@@ -402,7 +402,7 @@ configuration before executing any command:
 | `<PROJECT>` | The project's **display name**, as written in prose, headings, and reporter-facing copy (example: `Apache Foo`). Upper-case throughout. Not interchangeable with `<project>` — see the note below the table. | `<project-config>/project.md` → `project_name` |
 | `<project>` | The project's **infrastructure slug**, as it appears inside mailing-list addresses, roster URLs, and svn / dist paths (example: `foo` in `dev@foo.apache.org`, `svn.apache.org/repos/asf/foo/site`, `dist.apache.org/repos/dist/dev/foo`). Lower-case throughout. Not interchangeable with `<PROJECT>` — see the note below the table. | `<project-config>/project.md` → `short_name`, lowercased — equivalently the name half of `upstream_repo` |
 | `<project-config>` | The adopting project's config directory in its tracker repo (alongside the gitignored `.apache-magpie/` snapshot, not inside it). Bootstrapped from `projects/_template/`. | Filesystem convention. |
-| `<framework>` | The framework root — `.apache-magpie/` (the gitignored snapshot) in adopting projects, `.` in framework standalone. Used in `uv run` and other invocations that address the framework's `tools/<name>/` subtrees. | Filesystem convention. |
+| `<framework>` | The framework root — `.` in framework standalone, `.apache-magpie/` (the gitignored snapshot) on a pinned-snapshot install, and `~/.cache/apache-magpie/framework/current` on a marketplace install: a writable copy of the shipped tools that the `magpie-security-tools` plugin's session hook materialises for the installed version. Used in `uv run` and other invocations that address the framework's `tools/<name>/` subtrees; on every install `uv run --project <framework>/tools/<tool> …` works as written. | Filesystem convention. |
 | `<tracker>` | GitHub slug of the (security) tracker repo (example: `airflow-s/airflow-s`). | `<project-config>/project.md` → `tracker_repo` |
 | `<upstream>` | GitHub slug of the upstream codebase the fixes land in (example: `apache/airflow`). | `<project-config>/project.md` → `upstream_repo` |
 | `<security-list>` | The project's security mailing list (example: `security@airflow.apache.org`). | `<project-config>/project.md` → `security_list` (under **Mailing lists**) |

docs/setup/marketplace.md

@@ -143,6 +143,14 @@ hard framework rule) and `magpie-vetted-ops` (a dispatcher for fixed,
 policy-scoped forge operations, so a session needs one allowlist entry instead
 of a dozen wildcard `ask` rules).
 Both run from the installed plugin, so no repository or worktree needs a local copy.
+A third, `magpie-security-tools`, goes with the `magpie-security` family: it carries
+the framework tools the security skills run (tracker field and rollup edits, CVE
+JSON, the privacy gate, the scan importer). Its session hook materialises a copy of
+them once per installed version under `~/.cache/apache-magpie/framework/` and points
+`~/.cache/apache-magpie/framework/current` at it, which is what `<framework>` means on a marketplace
+install. The plugin cache is read-only to a sandboxed command; the copy is not, so the
+skills' `uv run --project <framework>/tools/<tool> …` works unchanged (and so does
+`uvx --from`). The tools run sandboxed, so the writable copy grants nothing new.
 Grok Build can consume the existing Claude-compatible `magpie-agent-guard` plugin hook.
 The dispatcher selects the Grok protocol from the incoming hook payload shape.
 Neither substrate plugin adds always-on skill context. Pick based on the trade-off between install simplicity and

docs/setup/secure-agent-setup.md

@@ -732,6 +732,9 @@ The full block below is the two merged, annotated.
       "Edit(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
       "Edit(~/.claude/magpie/**)",
       "Edit(.apache-magpie-overrides/tools/vetted-ops/**)",
+      "Edit(//**/.git/**/apache-magpie/tools/vetted-ops/**)",
+      "Edit(//**/.svn/apache-magpie/tools/vetted-ops/**)",
+      "Edit(//**/.apache-magpie-local/tools/vetted-ops/**)",
       // The adversarial-review tool runs unsandboxed (excludedCommands above), so
       // the code it runs must not be editable by the agent that calls it.
       "Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)"
@@ -894,8 +897,9 @@ a second, independent layer for free: the plugin cache sits outside
 every `sandbox.filesystem.allowWrite` root, so a sandboxed `Bash`
 call cannot write it either. The **policy TOML** lives inside the
 adopter repo, which is sandbox-writable by design. Under Claude Code its
-`Edit(.apache-magpie-overrides/tools/vetted-ops/**)` deny is also merged
-into the sandbox's write-deny list, so a Bash-level write (`sed -i`, a
+`Edit(.apache-magpie-overrides/tools/vetted-ops/**)` deny — and the
+personal-layer ones for a maintainer whose project has not adopted
+Magpie — is also merged into the sandbox's write-deny list, so a Bash-level write (`sed -i`, a
 heredoc redirect) is refused as well. Harnesses without that merge have
 only the tool-level deny, and must deny writes to that path in their
 sandbox configuration explicitly.
@@ -966,7 +970,8 @@ Codex is the exception that proves the rule: its execpolicy cannot match `~`, so
 4. `permissions.deny` carries all three tamper-protection rules:
    - `Edit(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)` — the operation catalogue;
    - `Edit(~/.claude/magpie/**)` — the fixed path the rules name;
-   - `Edit(.apache-magpie-overrides/tools/vetted-ops/**)` — the policy.
+   - `Edit(.apache-magpie-overrides/tools/vetted-ops/**)` — the policy;
+   - `Edit(//**/.git/**/apache-magpie/tools/vetted-ops/**)`, `Edit(//**/.svn/apache-magpie/tools/vetted-ops/**)` and `Edit(//**/.apache-magpie-local/tools/vetted-ops/**)` — the same policy kept in a maintainer's personal layer, for a project that has not adopted Magpie.
 
    They are what makes an unprompted read safe to allow: the `allow` rests on the catalogue's shape, so the agent that calls the dispatcher must not be able to edit it.
    A missing rule is a must-fix.
@@ -991,7 +996,10 @@ Codex is the exception that proves the rule: its execpolicy cannot match `~`, so
   "deny": [
     "Edit(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
     "Edit(~/.claude/magpie/**)",
-    "Edit(.apache-magpie-overrides/tools/vetted-ops/**)"
+    "Edit(.apache-magpie-overrides/tools/vetted-ops/**)",
+    "Edit(//**/.git/**/apache-magpie/tools/vetted-ops/**)",
+    "Edit(//**/.svn/apache-magpie/tools/vetted-ops/**)",
+    "Edit(//**/.apache-magpie-local/tools/vetted-ops/**)"
   ]
   // and: no ask rule matching vetted-op-read,
   // no "blockReadsOutsideWorkingDirectories": true in any scope
@@ -3532,7 +3540,10 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
      `~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**`
      (the catalogue), `~/.claude/magpie/**` (the fixed path the
      rules name) and
-     `.apache-magpie-overrides/tools/vetted-ops/**` (the policy).
+     `.apache-magpie-overrides/tools/vetted-ops/**` (the policy), and
+     the personal-layer copies `//**/.git/**/apache-magpie/tools/vetted-ops/**`,
+     `//**/.svn/apache-magpie/tools/vetted-ops/**` and
+     `//**/.apache-magpie-local/tools/vetted-ops/**`.
    - No `vetted-op` rule names the versioned plugin-cache path with
      a `*`; the rules name `~/.claude/magpie/vetted-ops`.
      One `Edit` rule per surface is the whole coverage — it binds

plugins/magpie-repo-health/skills/workflow-optimization/SKILL.md

@@ -18,16 +18,16 @@ argument-hint: "--repo owner/name"
 capability: capability:triage
 surface_hash: sha256:bbfe83b236640f9e
 license: Apache-2.0
-measured_tokens: 3037
+measured_tokens: 3048
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
      https://www.apache.org/licenses/LICENSE-2.0 -->
 
 <!-- Placeholder convention (see ../../../../AGENTS.md#placeholder-convention-used-in-skill-files):
      <upstream>  → adopter's public source repo (`owner/repo`)
-     <framework> → `.apache-magpie/apache-magpie` in adopters; `.` in
-                   the framework standalone -->
+     <framework> → `.` standalone, `.apache-magpie/apache-magpie` (snapshot),
+                   `~/.cache/apache-magpie/framework/current` (marketplace) -->
 
 # workflow-optimization
 

plugins/magpie-security-tools/.claude-plugin/plugin.json

@@ -0,0 +1,12 @@
+{
+  "name": "magpie-security-tools",
+  "description": "Apache Magpie \u2014 the tools the security skills run (tracker field and rollup edits, CVE JSON, the privacy gate, the scan importer), shipped so a marketplace install needs no framework checkout.",
+  "version": "0.9.0.dev202610241347",
+  "author": {
+    "name": "Apache Magpie",
+    "url": "https://magpie.apache.org/"
+  },
+  "homepage": "https://magpie.apache.org/",
+  "repository": "https://github.com/apache/magpie",
+  "license": "Apache-2.0"
+}

plugins/magpie-security-tools/hooks/hooks.json

@@ -0,0 +1,16 @@
+{
+  "description": "Apache Magpie security tools",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/tools/security-management/hooks/link-framework-path.sh\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}