feat(cli): make appa own Claude Code initialization

.claude-plugin/marketplace.json

@@ -1,13 +1,14 @@
 {
   "name": "appa",
+  "description": "OpenAPPA protection and policy tooling for agent harnesses.",
   "owner": {
     "name": "Archestra"
   },
   "plugins": [
     {
       "name": "appa-runtime",
       "source": "./integrations/claude-code/plugin",
-      "description": "Gates a Claude Code session's flows through the appa-runtime process: every prompt, tool call, tool result, and child return is checked before it proceeds. Hooks fail closed - the runtime process must be running first. Only sessions launched with APPA_GATE=1 are gated; they start the installed runtime on demand, and an ungated session offers the runtime install as a prompted task."
+      "description": "Gates a Claude Code session's flows through the appa-runtime process: every prompt, tool call, tool result, and child return is checked before it proceeds. Hooks fail closed - the runtime process must be running first. Only sessions launched with APPA_GATE=1 are gated; they start the runtime installed by appa init claude-code on demand."
     }
   ]
 }

.github/release-please/release-please-config.json

@@ -65,14 +65,21 @@
   "packages": {
     ".": {
       "component": "OpenAPPA",
-      "release-type": "simple",
+      "release-type": "rust",
       "initial-version": "0.1.0",
       "bump-minor-pre-major": true,
       "include-component-in-tag": false,
       "draft": true,
-      "force-tag-creation": true
+      "force-tag-creation": true,
+      "extra-files": [
+        {
+          "type": "json",
+          "path": "integrations/claude-code/plugin/.claude-plugin/plugin.json",
+          "jsonpath": "$.version"
+        }
+      ]
     }
   },
-  "plugins": [],
+  "plugins": ["cargo-workspace"],
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
 }

.github/workflows/build-appa-runtime-binaries.yml

@@ -1,4 +1,4 @@
-name: Build appa-runtime binaries
+name: Build appa binaries
 
 on:
   workflow_call:
@@ -37,44 +37,44 @@ jobs:
             os: Linux
             arch: amd64
             target: x86_64-unknown-linux-gnu
-            executable: appa-runtime
-            asset: appa-runtime-x86_64-unknown-linux-gnu
-            archive: appa-runtime-x86_64-unknown-linux-gnu.tar.gz
+            executable: appa
+            asset: appa-x86_64-unknown-linux-gnu
+            archive: appa-x86_64-unknown-linux-gnu.tar.gz
           - runner: ubuntu-22.04-arm
             os: Linux
             arch: arm64
             target: aarch64-unknown-linux-gnu
-            executable: appa-runtime
-            asset: appa-runtime-aarch64-unknown-linux-gnu
-            archive: appa-runtime-aarch64-unknown-linux-gnu.tar.gz
+            executable: appa
+            asset: appa-aarch64-unknown-linux-gnu
+            archive: appa-aarch64-unknown-linux-gnu.tar.gz
           - runner: macos-15-intel
             os: macOS
             arch: amd64
             target: x86_64-apple-darwin
-            executable: appa-runtime
-            asset: appa-runtime-x86_64-apple-darwin
-            archive: appa-runtime-x86_64-apple-darwin.tar.gz
+            executable: appa
+            asset: appa-x86_64-apple-darwin
+            archive: appa-x86_64-apple-darwin.tar.gz
           - runner: macos-15
             os: macOS
             arch: arm64
             target: aarch64-apple-darwin
-            executable: appa-runtime
-            asset: appa-runtime-aarch64-apple-darwin
-            archive: appa-runtime-aarch64-apple-darwin.tar.gz
+            executable: appa
+            asset: appa-aarch64-apple-darwin
+            archive: appa-aarch64-apple-darwin.tar.gz
           - runner: windows-latest
             os: Windows
             arch: amd64
             target: x86_64-pc-windows-msvc
-            executable: appa-runtime.exe
-            asset: appa-runtime-x86_64-pc-windows-msvc
-            archive: appa-runtime-x86_64-pc-windows-msvc.zip
+            executable: appa.exe
+            asset: appa-x86_64-pc-windows-msvc
+            archive: appa-x86_64-pc-windows-msvc.zip
           - runner: windows-11-arm
             os: Windows
             arch: arm64
             target: aarch64-pc-windows-msvc
-            executable: appa-runtime.exe
-            asset: appa-runtime-aarch64-pc-windows-msvc
-            archive: appa-runtime-aarch64-pc-windows-msvc.zip
+            executable: appa.exe
+            asset: appa-aarch64-pc-windows-msvc
+            archive: appa-aarch64-pc-windows-msvc.zip
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
     defaults:
@@ -94,7 +94,7 @@ jobs:
         env:
           RUSTFLAGS: ${{ runner.os == 'Windows' && '-C target-feature=+crt-static' || '' }}
           TARGET: ${{ matrix.target }}
-        run: cargo build --release --locked --package appa-runtime --target "$TARGET"
+        run: cargo build --release --locked --package appa --target "$TARGET"
 
       - name: Verify release version
         if: inputs.expected_version != ''
@@ -104,7 +104,7 @@ jobs:
           TARGET: ${{ matrix.target }}
         run: |
           actual_version=$("./target/${TARGET}/release/${EXECUTABLE}" --version)
-          test "$actual_version" = "appa-runtime ${EXPECTED_VERSION}"
+          test "$actual_version" = "appa ${EXPECTED_VERSION}"
 
       - name: Verify Linux glibc baseline
         if: runner.os == 'Linux'
@@ -133,6 +133,9 @@ jobs:
           mkdir -p "dist/${ASSET}"
           cp "target/${TARGET}/release/${EXECUTABLE}" "dist/${ASSET}/${EXECUTABLE}"
           cp -R integrations/claude-code "dist/${ASSET}/claude-code"
+          cp -R batteries "dist/${ASSET}/claude-code/batteries"
+          mkdir -p "dist/${ASSET}/claude-code/website/content/docs"
+          cp website/content/docs/contracts.md "dist/${ASSET}/claude-code/website/content/docs/contracts.md"
           if [[ "$RUNNER_OS" != "Windows" ]]; then
             chmod 755 "dist/${ASSET}/${EXECUTABLE}"
             chmod 755 "dist/${ASSET}/claude-code/plugin/statusline.sh"
@@ -162,7 +165,9 @@ jobs:
           mkdir verify
           tar -xzf "dist/${ARCHIVE}" -C verify
           cd verify
-          "./${EXECUTABLE}" >runtime.stdout.log 2>runtime.stderr.log &
+          test -x appa
+          ./appa init claude-code --help >/dev/null
+          "./${EXECUTABLE}" runtime >runtime.stdout.log 2>runtime.stderr.log &
           runtime_pid=$!
           cleanup() {
             kill "$runtime_pid" 2>/dev/null || true
@@ -179,7 +184,8 @@ jobs:
               test -f claude-code/plugin/hooks/hooks.json
               test -f claude-code/plugin/hooks/session-context.md
               test -f claude-code/plugin/skills/appa-guide/SKILL.md
-              test -f claude-code/plugin/skills/appa-setup/SKILL.md
+              test -d claude-code/batteries
+              test -f claude-code/website/content/docs/contracts.md
               test -x claude-code/plugin/statusline.sh
               exit 0
             fi
@@ -203,6 +209,7 @@ jobs:
           $stderr = Join-Path $package "runtime.stderr.log"
           $start = @{
             FilePath = Join-Path $package $env:EXECUTABLE
+            ArgumentList = @("runtime")
             WorkingDirectory = $package
             PassThru = $true
             RedirectStandardOutput = $stdout
@@ -231,6 +238,14 @@ jobs:
             if (-not (Test-Path (Join-Path $package "appa.toml"))) {
               throw "Extracted runtime did not create appa.toml"
             }
+            $cli = Join-Path $package "appa.exe"
+            if (-not (Test-Path $cli)) {
+              throw "Extracted package does not contain appa.exe"
+            }
+            & $cli init claude-code --help | Out-Null
+            if ($LASTEXITCODE -ne 0) {
+              throw "Extracted appa.exe does not expose init claude-code"
+            }
             if (-not (Test-Path (Join-Path $package "claude-code/.claude-plugin/marketplace.json"))) {
               throw "Extracted package does not contain the Claude Code marketplace"
             }
@@ -258,8 +273,11 @@ jobs:
             if (-not (Test-Path (Join-Path $package "claude-code/plugin/skills/appa-guide/SKILL.md"))) {
               throw "Extracted package does not contain the Claude Code appa-guide skill"
             }
-            if (-not (Test-Path (Join-Path $package "claude-code/plugin/skills/appa-setup/SKILL.md"))) {
-              throw "Extracted package does not contain the Claude Code appa-setup skill"
+            if (-not (Test-Path (Join-Path $package "claude-code/batteries"))) {
+              throw "Extracted package does not contain batteries for appa-guide"
+            }
+            if (-not (Test-Path (Join-Path $package "claude-code/website/content/docs/contracts.md"))) {
+              throw "Extracted package does not contain the contract guide for appa-guide"
             }
           } finally {
             $process.Refresh()

.github/workflows/ci.yml

@@ -30,9 +30,7 @@ jobs:
             integrations/claude-code/plugin/statusline.sh
 
       - name: Lint plugin shell scripts
-        run: |
-          shellcheck -s sh integrations/claude-code/plugin/hooks/ensure-runtime.sh
-          shellcheck -s sh integrations/claude-code/plugin/report-install.sh
+        run: shellcheck -s sh integrations/claude-code/plugin/hooks/ensure-runtime.sh
 
       - name: Validate plugin JSON
         run: |

.github/workflows/release.yml

@@ -133,31 +133,14 @@ jobs:
       actions: read # Required to download archives from the reusable build jobs.
       contents: write # Required to upload assets and publish the draft release.
     steps:
-      - name: Checkout release tooling
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          fetch-depth: 1
-
-      - name: Checkout released version
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ needs.release-please.outputs.tag_name }}
-          path: release-source
-          persist-credentials: false
-          fetch-depth: 1
-
       - name: Download release archives
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
-          pattern: appa-runtime-*
+          pattern: appa-*
           merge-multiple: true
           skip-decompress: true
 
-      - name: Stage version
-        run: cp release-source/version.txt dist/
-
       - name: Verify release assets and write checksums
         working-directory: dist
         env:
@@ -166,12 +149,12 @@ jobs:
         run: |
           test "$TAG_NAME" = "v${EXPECTED_VERSION}"
           expected_archives=(
-            appa-runtime-x86_64-unknown-linux-gnu.tar.gz
-            appa-runtime-aarch64-unknown-linux-gnu.tar.gz
-            appa-runtime-x86_64-apple-darwin.tar.gz
-            appa-runtime-aarch64-apple-darwin.tar.gz
-            appa-runtime-x86_64-pc-windows-msvc.zip
-            appa-runtime-aarch64-pc-windows-msvc.zip
+            appa-x86_64-unknown-linux-gnu.tar.gz
+            appa-aarch64-unknown-linux-gnu.tar.gz
+            appa-x86_64-apple-darwin.tar.gz
+            appa-aarch64-apple-darwin.tar.gz
+            appa-x86_64-pc-windows-msvc.zip
+            appa-aarch64-pc-windows-msvc.zip
           )
           for archive in "${expected_archives[@]}"; do
             test -f "$archive" || {
@@ -180,12 +163,12 @@ jobs:
             }
           done
           shopt -s nullglob
-          actual_archives=(appa-runtime-*.tar.gz appa-runtime-*.zip)
+          actual_archives=(appa-*.tar.gz appa-*.zip)
           if [ "${#actual_archives[@]}" -ne "${#expected_archives[@]}" ]; then
             echo "::error::expected exactly 6 release archives, found ${#actual_archives[@]}"
             exit 1
           fi
-          sha256sum "${expected_archives[@]}" version.txt > SHA256SUMS
+          sha256sum "${expected_archives[@]}" > SHA256SUMS
 
       - name: Read release state
         id: release-state