Vendor diffbot-python db CLI + Cowork bundling tooling

Bundle the db CLI and its pure-Python dependency tree under vendor/ so the
skills can run with no pip install at runtime (Cowork's sandbox blocks PyPI).
The set is pinned to a Python 3.9-compatible resolution (macOS system floor);
diffbot-python's >=3.10 metadata is conservative and its code runs on 3.9.

- scripts/vendor-db.sh   regenerates vendor/ (3.9-targeted, deterministic)
- scripts/db-launcher.py  portable launcher (resolves vendor/, guards version)
- scripts/build-bundle.sh packages a Cowork-installable zip (incl. vendor/)

Cowork-only: main keeps the normal PyPI bootstrap.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: shixish

.gitignore

@@ -2,3 +2,5 @@ __pycache__/
 *.pyc
 *.pyo
 .cursor/
+dist/
+.DS_Store

scripts/build-bundle.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+#
+# Build a Cowork-installable zip of the diffbot plugin.
+#
+# Produces dist/<name>.zip containing a single top-level <name>/ folder with
+# only the files the plugin needs: the per-tool manifests, the skills/ tree,
+# and README/LICENSE. Internal dev files (docs/, PLAN.md, CLAUDE.md, .git) are
+# left out so the bundle stays lean.
+#
+# Re-run after editing a skill, then re-upload the same dist/<name>.zip in
+# Cowork via Customize > Plugins.
+#
+# Usage:
+#   scripts/build-bundle.sh            # -> dist/diffbot.zip
+#   scripts/build-bundle.sh --version  # -> dist/diffbot-<version>.zip as well
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+manifest=".claude-plugin/plugin.json"
+[ -f "$manifest" ] || { echo "error: $manifest not found" >&2; exit 1; }
+
+name="$(jq -r '.name' "$manifest")"
+version="$(jq -r '.version' "$manifest")"
+[ -n "$name" ] && [ "$name" != "null" ] || { echo "error: could not read .name from $manifest" >&2; exit 1; }
+
+# Files/dirs to include in the bundle (everything the host tools read).
+include=(
+  ".claude-plugin"
+  ".cortex-plugin"
+  ".factory-plugin"
+  ".github"
+  "skills"
+  "vendor"
+  "README.md"
+  "LICENSE"
+)
+
+dist="$repo_root/dist"
+mkdir -p "$dist"
+
+# Stage into a temp dir under the plugin name so the zip wraps everything in a
+# single <name>/ folder (the layout Cowork's zip upload expects).
+stage="$(mktemp -d)"
+trap 'rm -rf "$stage"' EXIT
+pkg="$stage/$name"
+mkdir -p "$pkg"
+
+for item in "${include[@]}"; do
+  if [ -e "$item" ]; then
+    # --no-D and excludes keep cruft out of the copy.
+    rsync -a --exclude='.DS_Store' --exclude='__pycache__' --exclude='*.pyc' \
+      "$item" "$pkg/"
+  else
+    echo "warning: skipping missing path '$item'" >&2
+  fi
+done
+
+out="$dist/$name.zip"
+rm -f "$out"
+# Zip from the stage root so paths are <name>/...
+( cd "$stage" && zip -rq "$out" "$name" -x '*.DS_Store' )
+
+echo "Built $out  (plugin '$name' v$version)"
+
+if [ "${1:-}" = "--version" ]; then
+  versioned="$dist/$name-$version.zip"
+  cp "$out" "$versioned"
+  echo "Built $versioned"
+fi

scripts/db-launcher.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""
+Portable launcher for the vendored Diffbot `db` CLI.
+
+Source of truth for vendor/bin/db — scripts/vendor-db.sh copies this file into
+the bundle. It adds the vendored dependency tree (vendor/) to sys.path and
+dispatches to diffbot.cli:main, so the CLI runs straight from the package with
+no virtualenv and no pip install.
+
+The vendored bundle is pinned to a Python 3.9-compatible dependency set (3.9 is
+the macOS system interpreter). diffbot-python's own metadata says >=3.10, but its
+code and all deps compile and run on 3.9 (verified), so 3.9 is the real floor. If
+we are launched under something older still, we re-exec under a newer interpreter
+when one is available, and otherwise exit with a clear message rather than a deep
+ImportError/SyntaxError.
+"""
+import os
+import sys
+
+_MIN = (3, 9)
+
+
+def _ensure_modern_python():
+    if sys.version_info >= _MIN:
+        return
+    import shutil
+
+    for candidate in ("python3.13", "python3.12", "python3.11", "python3.10", "python3.9"):
+        path = shutil.which(candidate)
+        if path:
+            os.execv(path, [path, os.path.abspath(__file__), *sys.argv[1:]])
+    sys.exit(
+        "diffbot db requires Python >= {}.{}, but {}.{} was found and no newer "
+        "interpreter is on PATH. Install Python {}.{}+ and retry.".format(
+            *_MIN, sys.version_info[0], sys.version_info[1], *_MIN
+        )
+    )
+
+
+_ensure_modern_python()
+
+_VENDOR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _VENDOR not in sys.path:
+    sys.path.insert(0, _VENDOR)
+
+from diffbot.cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/vendor-db.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+#
+# Regenerate vendor/ — the self-contained Diffbot `db` CLI plus its pure-Python
+# dependency tree — so the skills run with no pip install at runtime.
+#
+# Network is needed only here, at build time. The produced vendor/ needs none.
+#
+# The bundle targets Python 3.9 (the macOS system interpreter). diffbot-python's
+# metadata declares >=3.10, but its code and every dependency run fine on 3.9, so
+# we bypass only diffbot-python's own gate and resolve the deps against 3.9 wheels
+# (--python-version 3.9). Any builder Python works; the output is 3.9-compatible.
+#
+# Usage:
+#   scripts/vendor-db.sh                       # vendor latest diffbot-python
+#   scripts/vendor-db.sh diffbot-python==0.2.1 # pin a specific version
+
+set -euo pipefail
+
+spec="${1:-diffbot-python}"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+vendor="$root/vendor"
+target_py="3.9"
+
+py=""
+for cand in python3.13 python3.12 python3.11 python3.10 python3.9 python3; do
+  if command -v "$cand" >/dev/null 2>&1; then py="$(command -v "$cand")"; break; fi
+done
+[ -n "$py" ] || { echo "error: need a python3 on PATH to build the vendor bundle" >&2; exit 1; }
+
+echo "Building vendor/ for '$spec' (targeting Python $target_py) with $("$py" --version)…"
+rm -rf "$vendor"
+# Step 1: diffbot-python itself, no deps, bypassing only its conservative >=3.10 gate.
+"$py" -m pip install --target "$vendor" --quiet --no-deps --ignore-requires-python "$spec"
+# Step 2: its declared deps, resolved against 3.9 wheels (honors each dep's own floor).
+"$py" -m pip install --target "$vendor" --quiet \
+  --python-version "$target_py" --only-binary=:all: \
+  'click>=8.1.0' 'httpx>=0.27.0' 'rich>=13.0.0'
+
+# pip writes machine-specific console scripts into bin/; replace them with our
+# portable launcher (resolves vendor/ relative to itself, guards Python version).
+rm -rf "$vendor/bin"
+mkdir -p "$vendor/bin"
+cp "$root/scripts/db-launcher.py" "$vendor/bin/db"
+chmod +x "$vendor/bin/db"
+
+# Drop build cruft so the committed bundle stays lean and deterministic.
+find "$vendor" -name '__pycache__' -type d -prune -exec rm -rf {} +
+find "$vendor" -type f -name '*.pyc' -delete
+
+size="$(du -sh "$vendor" | awk '{print $1}')"
+echo "Vendored '$spec' into vendor/ ($size)."

vendor/anyio-4.12.1.dist-info/INSTALLER

@@ -0,0 +1 @@
+pip

vendor/anyio-4.12.1.dist-info/METADATA

@@ -0,0 +1,96 @@
+Metadata-Version: 2.4
+Name: anyio
+Version: 4.12.1
+Summary: High-level concurrency and networking framework on top of asyncio or Trio
+Author-email: Alex Grönholm <alex.gronholm@nextday.fi>
+License-Expression: MIT
+Project-URL: Documentation, https://anyio.readthedocs.io/en/latest/
+Project-URL: Changelog, https://anyio.readthedocs.io/en/stable/versionhistory.html
+Project-URL: Source code, https://github.com/agronholm/anyio
+Project-URL: Issue tracker, https://github.com/agronholm/anyio/issues
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Framework :: AnyIO
+Classifier: Typing :: Typed
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.9
+Description-Content-Type: text/x-rst
+License-File: LICENSE
+Requires-Dist: exceptiongroup>=1.0.2; python_version < "3.11"
+Requires-Dist: idna>=2.8
+Requires-Dist: typing_extensions>=4.5; python_version < "3.13"
+Provides-Extra: trio
+Requires-Dist: trio>=0.32.0; python_version >= "3.10" and extra == "trio"
+Requires-Dist: trio>=0.31.0; python_version < "3.10" and extra == "trio"
+Dynamic: license-file
+
+.. image:: https://github.com/agronholm/anyio/actions/workflows/test.yml/badge.svg
+  :target: https://github.com/agronholm/anyio/actions/workflows/test.yml
+  :alt: Build Status
+.. image:: https://coveralls.io/repos/github/agronholm/anyio/badge.svg?branch=master
+  :target: https://coveralls.io/github/agronholm/anyio?branch=master
+  :alt: Code Coverage
+.. image:: https://readthedocs.org/projects/anyio/badge/?version=latest
+  :target: https://anyio.readthedocs.io/en/latest/?badge=latest
+  :alt: Documentation
+.. image:: https://badges.gitter.im/gitterHQ/gitter.svg
+  :target: https://gitter.im/python-trio/AnyIO
+  :alt: Gitter chat
+
+AnyIO is an asynchronous networking and concurrency library that works on top of either asyncio_ or
+Trio_. It implements Trio-like `structured concurrency`_ (SC) on top of asyncio and works in harmony
+with the native SC of Trio itself.
+
+Applications and libraries written against AnyIO's API will run unmodified on either asyncio_ or
+Trio_. AnyIO can also be adopted into a library or application incrementally – bit by bit, no full
+refactoring necessary. It will blend in with the native libraries of your chosen backend.
+
+To find out why you might want to use AnyIO's APIs instead of asyncio's, you can read about it
+`here <https://anyio.readthedocs.io/en/stable/why.html>`_.
+
+Documentation
+-------------
+
+View full documentation at: https://anyio.readthedocs.io/
+
+Features
+--------
+
+AnyIO offers the following functionality:
+
+* Task groups (nurseries_ in trio terminology)
+* High-level networking (TCP, UDP and UNIX sockets)
+
+  * `Happy eyeballs`_ algorithm for TCP connections (more robust than that of asyncio on Python
+    3.8)
+  * async/await style UDP sockets (unlike asyncio where you still have to use Transports and
+    Protocols)
+
+* A versatile API for byte streams and object streams
+* Inter-task synchronization and communication (locks, conditions, events, semaphores, object
+  streams)
+* Worker threads
+* Subprocesses
+* Subinterpreter support for code parallelization (on Python 3.13 and later)
+* Asynchronous file I/O (using worker threads)
+* Signal handling
+* Asynchronous version of the functools_ module
+
+AnyIO also comes with its own pytest_ plugin which also supports asynchronous fixtures.
+It even works with the popular Hypothesis_ library.
+
+.. _asyncio: https://docs.python.org/3/library/asyncio.html
+.. _Trio: https://github.com/python-trio/trio
+.. _structured concurrency: https://en.wikipedia.org/wiki/Structured_concurrency
+.. _nurseries: https://trio.readthedocs.io/en/stable/reference-core.html#nurseries-and-spawning
+.. _Happy eyeballs: https://en.wikipedia.org/wiki/Happy_Eyeballs
+.. _pytest: https://docs.pytest.org/en/latest/
+.. _functools: https://docs.python.org/3/library/functools.html
+.. _Hypothesis: https://hypothesis.works/

vendor/anyio-4.12.1.dist-info/RECORD

@@ -0,0 +1,92 @@
+anyio-4.12.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+anyio-4.12.1.dist-info/METADATA,sha256=DfiDab9Tmmcfy802lOLTMEHJQShkOSbopCwqCYbLuJk,4277
+anyio-4.12.1.dist-info/RECORD,,
+anyio-4.12.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+anyio-4.12.1.dist-info/entry_points.txt,sha256=_d6Yu6uiaZmNe0CydowirE9Cmg7zUL2g08tQpoS3Qvc,39
+anyio-4.12.1.dist-info/licenses/LICENSE,sha256=U2GsncWPLvX9LpsJxoKXwX8ElQkJu8gCO9uC6s8iwrA,1081
+anyio-4.12.1.dist-info/top_level.txt,sha256=QglSMiWX8_5dpoVAEIHdEYzvqFMdSYWmCj6tYw2ITkQ,6
+anyio/__init__.py,sha256=7iDVqMUprUuKNY91FuoKqayAhR-OY136YDPI6P78HHk,6170
+anyio/__pycache__/__init__.cpython-311.pyc,,
+anyio/__pycache__/from_thread.cpython-311.pyc,,
+anyio/__pycache__/functools.cpython-311.pyc,,
+anyio/__pycache__/lowlevel.cpython-311.pyc,,
+anyio/__pycache__/pytest_plugin.cpython-311.pyc,,
+anyio/__pycache__/to_interpreter.cpython-311.pyc,,
+anyio/__pycache__/to_process.cpython-311.pyc,,
+anyio/__pycache__/to_thread.cpython-311.pyc,,
+anyio/_backends/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+anyio/_backends/__pycache__/__init__.cpython-311.pyc,,
+anyio/_backends/__pycache__/_asyncio.cpython-311.pyc,,
+anyio/_backends/__pycache__/_trio.cpython-311.pyc,,
+anyio/_backends/_asyncio.py,sha256=xG6qv60mgGnL0mK82dxjH2b8hlkMlJ-x2BqIq3qv70Y,98863
+anyio/_backends/_trio.py,sha256=30Rctb7lm8g63ZHljVPVnj5aH-uK6oQvphjwUBoAzuI,41456
+anyio/_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+anyio/_core/__pycache__/__init__.cpython-311.pyc,,
+anyio/_core/__pycache__/_asyncio_selector_thread.cpython-311.pyc,,
+anyio/_core/__pycache__/_contextmanagers.cpython-311.pyc,,
+anyio/_core/__pycache__/_eventloop.cpython-311.pyc,,
+anyio/_core/__pycache__/_exceptions.cpython-311.pyc,,
+anyio/_core/__pycache__/_fileio.cpython-311.pyc,,
+anyio/_core/__pycache__/_resources.cpython-311.pyc,,
+anyio/_core/__pycache__/_signals.cpython-311.pyc,,
+anyio/_core/__pycache__/_sockets.cpython-311.pyc,,
+anyio/_core/__pycache__/_streams.cpython-311.pyc,,
+anyio/_core/__pycache__/_subprocesses.cpython-311.pyc,,
+anyio/_core/__pycache__/_synchronization.cpython-311.pyc,,
+anyio/_core/__pycache__/_tasks.cpython-311.pyc,,
+anyio/_core/__pycache__/_tempfile.cpython-311.pyc,,
+anyio/_core/__pycache__/_testing.cpython-311.pyc,,
+anyio/_core/__pycache__/_typedattr.cpython-311.pyc,,
+anyio/_core/_asyncio_selector_thread.py,sha256=2PdxFM3cs02Kp6BSppbvmRT7q7asreTW5FgBxEsflBo,5626
+anyio/_core/_contextmanagers.py,sha256=YInBCabiEeS-UaP_Jdxa1CaFC71ETPW8HZTHIM8Rsc8,7215
+anyio/_core/_eventloop.py,sha256=c2EdcBX-xnKwxPcC4Pjn3_qG9I-x4IWFO2R9RqCGjM4,6448
+anyio/_core/_exceptions.py,sha256=Y3aq-Wxd7Q2HqwSg7nZPvRsHEuGazv_qeet6gqEBdPk,4407
+anyio/_core/_fileio.py,sha256=uc7t10Vb-If7GbdWM_zFf-ajUe6uek63fSt7IBLlZW0,25731
+anyio/_core/_resources.py,sha256=NbmU5O5UX3xEyACnkmYX28Fmwdl-f-ny0tHym26e0w0,435
+anyio/_core/_signals.py,sha256=mjTBB2hTKNPRlU0IhnijeQedpWOGERDiMjSlJQsFrug,1016
+anyio/_core/_sockets.py,sha256=RBXHcUqZt5gg_-OOfgHVv8uq2FSKk1uVUzTdpjBoI1o,34977
+anyio/_core/_streams.py,sha256=FczFwIgDpnkK0bODWJXMpsUJYdvAD04kaUaGzJU8DK0,1806
+anyio/_core/_subprocesses.py,sha256=EXm5igL7dj55iYkPlbYVAqtbqxJxjU-6OndSTIx9SRg,8047
+anyio/_core/_synchronization.py,sha256=MgVVqFzvt580tHC31LiOcq1G6aryut--xRG4Ff8KwxQ,20869
+anyio/_core/_tasks.py,sha256=pVB7K6AAulzUM8YgXAeqNZG44nSyZ1bYJjH8GznC00I,5435
+anyio/_core/_tempfile.py,sha256=lHb7CW4FyIlpkf5ADAf4VmLHCKwEHF9nxqNyBCFFUiA,19697
+anyio/_core/_testing.py,sha256=u7MPqGXwpTxqI7hclSdNA30z2GH1Nw258uwKvy_RfBg,2340
+anyio/_core/_typedattr.py,sha256=P4ozZikn3-DbpoYcvyghS_FOYAgbmUxeoU8-L_07pZM,2508
+anyio/abc/__init__.py,sha256=6mWhcl_pGXhrgZVHP_TCfMvIXIOp9mroEFM90fYCU_U,2869
+anyio/abc/__pycache__/__init__.cpython-311.pyc,,
+anyio/abc/__pycache__/_eventloop.cpython-311.pyc,,
+anyio/abc/__pycache__/_resources.cpython-311.pyc,,
+anyio/abc/__pycache__/_sockets.cpython-311.pyc,,
+anyio/abc/__pycache__/_streams.cpython-311.pyc,,
+anyio/abc/__pycache__/_subprocesses.cpython-311.pyc,,
+anyio/abc/__pycache__/_tasks.cpython-311.pyc,,
+anyio/abc/__pycache__/_testing.cpython-311.pyc,,
+anyio/abc/_eventloop.py,sha256=GlzgB3UJGgG6Kr7olpjOZ-o00PghecXuofVDQ_5611Q,10749
+anyio/abc/_resources.py,sha256=DrYvkNN1hH6Uvv5_5uKySvDsnknGVDe8FCKfko0VtN8,783
+anyio/abc/_sockets.py,sha256=ECTY0jLEF18gryANHR3vFzXzGdZ-xPwELq1QdgOb0Jo,13258
+anyio/abc/_streams.py,sha256=005GKSCXGprxnhucILboSqc2JFovECZk9m3p-qqxXVc,7640
+anyio/abc/_subprocesses.py,sha256=cumAPJTktOQtw63IqG0lDpyZqu_l1EElvQHMiwJgL08,2067
+anyio/abc/_tasks.py,sha256=KC7wrciE48AINOI-AhPutnFhe1ewfP7QnamFlDzqesQ,3721
+anyio/abc/_testing.py,sha256=tBJUzkSfOXJw23fe8qSJ03kJlShOYjjaEyFB6k6MYT8,1821
+anyio/from_thread.py,sha256=L-0w1HxJ6BSb-KuVi57k5Tkc3yzQrx3QK5tAxMPcY-0,19141
+anyio/functools.py,sha256=HWj7GBEmc0Z-mZg3uok7Z7ZJn0rEC_0Pzbt0nYUDaTQ,10973
+anyio/lowlevel.py,sha256=AyKLVK3LaWSoK39LkCKxE4_GDMLKZBNqTrLUgk63y80,5158
+anyio/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+anyio/pytest_plugin.py,sha256=3jAFQn0jv_pyoWE2GBBlHaj9sqXj4e8vob0_hgrsXE8,10244
+anyio/streams/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+anyio/streams/__pycache__/__init__.cpython-311.pyc,,
+anyio/streams/__pycache__/buffered.cpython-311.pyc,,
+anyio/streams/__pycache__/file.cpython-311.pyc,,
+anyio/streams/__pycache__/memory.cpython-311.pyc,,
+anyio/streams/__pycache__/stapled.cpython-311.pyc,,
+anyio/streams/__pycache__/text.cpython-311.pyc,,
+anyio/streams/__pycache__/tls.cpython-311.pyc,,
+anyio/streams/buffered.py,sha256=2R3PeJhe4EXrdYqz44Y6-Eg9R6DrmlsYrP36Ir43-po,6263
+anyio/streams/file.py,sha256=4WZ7XGz5WNu39FQHvqbe__TQ0HDP9OOhgO1mk9iVpVU,4470
+anyio/streams/memory.py,sha256=F0zwzvFJKAhX_LRZGoKzzqDC2oMM-f-yyTBrEYEGOaU,10740
+anyio/streams/stapled.py,sha256=T8Xqwf8K6EgURPxbt1N4i7A8BAk-gScv-GRhjLXIf_o,4390
+anyio/streams/text.py,sha256=BcVAGJw1VRvtIqnv-o0Rb0pwH7p8vwlvl21xHq522ag,5765
+anyio/streams/tls.py,sha256=Jpxy0Mfbcp1BxHCwE-YjSSFaLnIBbnnwur-excYThs4,15368
+anyio/to_interpreter.py,sha256=_mLngrMy97TMR6VbW4Y6YzDUk9ZuPcQMPlkuyRh3C9k,7100
+anyio/to_process.py,sha256=J7gAA_YOuoHqnpDAf5fm1Qu6kOmTzdFbiDNvnV755vk,9798
+anyio/to_thread.py,sha256=menEgXYmUV7Fjg_9WqCV95P9MAtQS8BzPGGcWB_QnfQ,2687

vendor/anyio-4.12.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (80.9.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

vendor/anyio-4.12.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[pytest11]
+anyio = anyio.pytest_plugin