feat: add Batuta to marketplace by franciscpd · Pull Request #432 · compozy/compozy

franciscpd · 2026-08-19T01:59:43Z

What & why

Add Batuta v0.1.0-beta.3 as a curated community extension.
Vendor its resource-only agent, skill, and Loop for review and pin a deterministic archive digest.
Let operators discover and install Batuta through the Marketplace without the unverified GitHub-install consent flow.

The vendored Markdown and YAML are normalized with the repository formatter; the manifest and functional resource content remain aligned with the published Batuta release.

How you verified it

go run ./cmd/compozy-catalog validate ./catalog — production installer validation passed.
go test ./cmd/compozy-catalog ./internal/marketplace — 160 tests passed.
make gate with Go 1.26.4 and an ephemeral tag.gpgsign=false test override — full gate passed, including 23,288 Go tests with 3 platform skips.

No new test file is needed: the existing catalog validator installs every pinned local artifact, verifies its digest, loads the extension manifest, and checks the feed version.

Impact

Marketplace extension catalog only. No CLI, HTTP/UDS, configuration, or web contract changes. After merge and catalog refresh, Batuta installs from the curated community tier and still requires explicit enablement before publishing its resources.

Prepared with Codex and verified against the complete repository gate.

make gate passes locally (make gate-full before review on larger changes)
New or changed behavior is covered by tests, or I explained above why not
If an agent wrote or co-wrote this, I named it above and verified the result myself

Summary by CodeRabbit

Documentation
- Added an MIT License with copyright attribution, permission terms, and warranty and liability disclaimers.

vercel · 2026-08-19T01:59:48Z

@franciscpd is attempting to deploy a commit to the Compozy Team on Vercel.

A member of the Team first needs to authorize it.

coderabbitai · 2026-08-19T02:01:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3dab9440-b106-4a0d-b249-ce4c7dbdc8f7

📥 Commits

Reviewing files that changed from the base of the PR and between afb1b96 and 5fe00b7.

⛔ Files ignored due to path filters (6)

catalog/artifacts/batuta-v0.1.0-beta.3.tar.gz is excluded by !**/*.gz, !**/*.gz
catalog/extensions.json is excluded by !**/*.json
catalog/packages/batuta/agents/batuta/AGENT.md is excluded by !**/*.md
catalog/packages/batuta/extension.toml is excluded by !**/*.toml
catalog/packages/batuta/loops/batuta-deliver/loop.yaml is excluded by !**/*.yaml
catalog/packages/batuta/resources/skills/batuta-routing/SKILL.md is excluded by !**/*.md

📒 Files selected for processing (1)

catalog/packages/batuta/LICENSE

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Added an MIT License file for the Batuta package. The file includes a 2026 copyright notice, permission terms, attribution requirements, and warranty and liability disclaimers.

Changes

Batuta licensing

Layer / File(s)	Summary
Add MIT License terms `catalog/packages/batuta/LICENSE`	Adds the complete MIT License text and copyright attribution for Francisross Soares de Oliveira.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🔵 Low · up to 5fe00

The PR adds a vendored Batuta marketplace extension, but copyright ownership and notice requirements for the included release still need confirmation before merge. This is a bounded legal/compliance risk that is mergeable with explicit owner follow-up.

Suggested reviewers: pedronauck

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Batuta as a Marketplace extension.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-08-19T02:02:48Z

Greptile Summary

Adds Batuta v0.1.0-beta.3 as a curated community marketplace extension with a pinned artifact and vendored agent, routing skill, and delivery loop.

Registers the Batuta package and deterministic archive in the extension catalog.
Adds an orchestration agent and cost-based runtime-routing guidance.
Adds a delivery loop that imports tasks, runs implementation, performs review, and returns terminal status to an originating session.

Confidence Score: 3/5

The PR should not merge until terminal notifications are cryptographically or structurally bound to the initiating session instead of accepting an arbitrary same-workspace destination.

The new loop exposes origin_session_id on direct start paths and later uses it under daemon authority, allowing one workspace session to inject a run-inspection prompt into another session and trigger reporting of workspace-visible run metadata.

Files Needing Attention: catalog/packages/batuta/loops/batuta-deliver/loop.yaml

Security Review

The delivery loop accepts an unbound session ID and uses it as the destination for daemon-issued terminal prompts. A direct submitter can therefore inject operational instructions into another session in the same workspace and cause it to inspect workspace-visible run metadata.

Important Files Changed

Filename	Overview
catalog/extensions.json	Registers the Batuta community release and its pinned artifact metadata; no catalog-entry defect was established.
catalog/packages/batuta/agents/batuta/AGENT.md	Defines the Batuta conductor workflow, including the intended originating-session handoff and delivery controls.
catalog/packages/batuta/loops/batuta-deliver/loop.yaml	Adds the implementation-and-review loop, but its terminal callback trusts a caller-selected session destination.
catalog/packages/batuta/resources/skills/batuta-routing/SKILL.md	Documents catalog-derived cost and complexity routing with stored workspace overrides.
catalog/packages/batuta/extension.toml	Declares the extension version, compatibility floor, and resource directories without an established defect.

_{Reviews (1): Last reviewed commit: "feat: add Batuta to marketplace" | Re-trigger Greptile}

greptile-apps · 2026-08-19T02:02:51Z

+    - &return_to_origin
+      tool: compozy__session_prompt
+      with:
+        session_id: "{{ .inputs.origin_session_id }}"


Unbound terminal prompt destination

When a direct submission supplies another same-workspace session as origin_session_id, every terminal handler sends that session a daemon-authorized prompt instructing it to inspect and report child-run IDs, commits, and blockers. The prompt handler and loop_status enforce only workspace scope, so this permits cross-session instruction injection and run-metadata disclosure. How this was verified: The supplied destination survives daemon dispatch binding, the prompt handler checks only workspace membership, and loop-status lookup permits any session in that workspace to read the referenced run.

feat: add Batuta to marketplace

5fe00b7

franciscpd requested a review from pedronauck as a code owner August 19, 2026 01:59

greptile-apps Bot reviewed Aug 19, 2026

View reviewed changes

coderabbitai Bot approved these changes Aug 19, 2026

View reviewed changes

pedronauck merged commit 616df7c into compozy:main Aug 19, 2026
30 of 32 checks passed

This was referenced Aug 19, 2026

build: release v0.3.0 #429

Merged

build: release v0.3.0 #443

Merged

build: release v0.3.0 #450

Merged

build: release v0.3.0 #458

Merged

This was referenced Aug 27, 2026

build: release v0.3.0 #496

Merged

build: release v0.3.0 #524

Merged

This was referenced Sep 7, 2026

build: release v0.3.0 #558

Merged

build: release v0.3.0 #584

Merged

build: release v0.3.0 #612

Merged

This was referenced Sep 15, 2026

build: release v0.3.0 #642

Merged

build: release v0.3.0 #650

Merged

This was referenced Sep 27, 2026

build: release v0.3.0 #680

Merged

build: release v0.3.0 #688

Merged

This was referenced Oct 6, 2026

build: release v0.3.0 #700

Merged

build: release v0.3.0 #704

Merged

build: release v0.3.0 #712

Merged

build: release v0.3.0 #732

Open

Navigation Menu

Repository navigation

feat: add Batuta to marketplace - #432

feat: add Batuta to marketplace#432
pedronauck merged 1 commit into
compozy:mainfrom
franciscpd:feat/add-batuta-marketplace

franciscpd commented Aug 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 19, 2026

Uh oh!

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 19, 2026

Greptile Summary

Security Review

Important Files Changed

Uh oh!

greptile-apps Bot Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

franciscpd commented Aug 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What & why

How you verified it

Impact

Summary by CodeRabbit

Uh oh!

vercel Bot commented Aug 19, 2026

Uh oh!

coderabbitai Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

greptile-apps Bot commented Aug 19, 2026

Greptile Summary

Confidence Score: 3/5

Security Review

Important Files Changed

Uh oh!

greptile-apps Bot Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

franciscpd commented Aug 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading