@aiwg/cli 2026.8.2 → 2026.8.4

package/dist/src/storage/backends/fortemi.js

@@ -37,6 +37,58 @@
  * @issue #972
  */
 const DEFAULT_MCP_SERVER = 'fortemi';
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function resolveMcpRequestHeaders(server, environment = process.env) {
+    const headers = { ...(server.headers ?? {}) };
+    for (const [header, envName] of Object.entries(server.headerEnv ?? {})) {
+        if (!ENV_NAME.test(envName)) {
+            throw new Error(`storage(fortemi): invalid environment variable reference "${envName}"`);
+        }
+        const value = environment[envName];
+        if (!value) {
+            throw new Error(`storage(fortemi): required credential environment variable "${envName}" is not set`);
+        }
+        headers[header] = header.toLowerCase() === 'authorization' ? `Bearer ${value}` : value;
+    }
+    return headers;
+}
+export function validateRemoteMcpUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`storage(fortemi): invalid MCP server URL "${raw}"`);
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
+        throw new Error('storage(fortemi): remote MCP URLs must use HTTPS; HTTP is allowed only for loopback development');
+    }
+    return url;
+}
+export function unwrapMcpToolResult(result) {
+    if (!result || typeof result !== 'object')
+        return result;
+    const envelope = result;
+    if (envelope.isError) {
+        const detail = envelope.content
+            ?.filter((item) => item.type === 'text' && typeof item.text === 'string')
+            .map((item) => item.text)
+            .join('; ');
+        throw new Error(`storage(fortemi): MCP tool failed${detail ? `: ${detail}` : ''}`);
+    }
+    if (envelope.structuredContent !== undefined)
+        return envelope.structuredContent;
+    const text = envelope.content?.find((item) => item.type === 'text' && typeof item.text === 'string')?.text;
+    if (text === undefined)
+        return result;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { content: text };
+    }
+}
 export class FortemiAdapter {
     subsystem;
     mcpServer;
@@ -194,30 +246,60 @@ export class FortemiAdapter {
  * Implemented as a lazy import so tests that inject a stub never load
  * the SDK or touch the registry.
  */
-export const createDefaultMcpClient = async (serverName) => {
+export const createDefaultMcpClient = async (serverName, registryOverride, environment = process.env) => {
     const { McpServerRegistry } = await import('../../mcp/registry.js');
-    const registry = new McpServerRegistry();
+    const registry = registryOverride ?? new McpServerRegistry();
     const server = await registry.get(serverName);
     if (!server) {
         throw new Error(`storage(fortemi): MCP server "${serverName}" is not registered. ` +
             `Add it via "aiwg mcp add ${serverName} --command <cmd>" before using the fortemi backend.`);
     }
-    if (server.type !== 'stdio') {
-        throw new Error(`storage(fortemi): only stdio MCP servers are supported (got "${server.type}" for "${serverName}")`);
-    }
-    // Lazy import the SDK so tests that inject a stub don't pay the cost
+    // Lazy imports keep unit tests that inject a stub isolated from transports.
     const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
-    const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
-    const transport = new StdioClientTransport({
-        command: server.command ?? '',
-        args: server.args ?? [],
-        env: server.env,
-    });
+    let transport;
+    if (server.type === 'stdio') {
+        const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
+        transport = new StdioClientTransport({
+            command: server.command ?? '',
+            args: server.args ?? [],
+            env: server.env,
+        });
+    }
+    else {
+        if (!server.url) {
+            throw new Error(`storage(fortemi): MCP server "${serverName}" has no URL`);
+        }
+        const url = validateRemoteMcpUrl(server.url);
+        const headers = resolveMcpRequestHeaders(server, environment);
+        if (server.type === 'http') {
+            const { StreamableHTTPClientTransport } = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
+            transport = new StreamableHTTPClientTransport(url, {
+                requestInit: { headers },
+            });
+        }
+        else if (server.type === 'sse') {
+            const { SSEClientTransport } = await import('@modelcontextprotocol/sdk/client/sse.js');
+            transport = new SSEClientTransport(url, {
+                requestInit: { headers },
+                eventSourceInit: {
+                    fetch: async (input, init) => {
+                        const merged = new Headers(init?.headers);
+                        for (const [name, value] of Object.entries(headers))
+                            merged.set(name, value);
+                        return fetch(input, { ...init, headers: merged });
+                    },
+                },
+            });
+        }
+        else {
+            throw new Error(`storage(fortemi): unsupported MCP transport "${String(server.type)}"`);
+        }
+    }
     const client = new Client({ name: 'aiwg-storage-fortemi-adapter', version: '1.0.0' }, { capabilities: {} });
     await client.connect(transport);
     return {
         async callTool(name, args) {
-            return client.callTool({ name, arguments: args });
+            return unwrapMcpToolResult(await client.callTool({ name, arguments: args }));
         },
         async close() {
             await client.close();

package/dist/src/storage/cli.js

@@ -7,6 +7,7 @@
  *   test <subsystem>   — round-trip read/write/list/delete through the
  *                        configured backend
  *   migrate <subsystem> — copy entries from one backend to another
+ *   import-corpus       — ingest the local research corpus through a storage backend
  *
  * @design @.aiwg/architecture/storage-design.md (§7)
  * @issue #934
@@ -16,13 +17,13 @@
 import { randomUUID } from 'crypto';
 import { existsSync } from 'fs';
 import { mkdir, readFile, writeFile, appendFile } from 'fs/promises';
-import { dirname, join, resolve as resolvePath } from 'path';
+import { dirname, extname, join, resolve as resolvePath } from 'path';
+import { parseFrontmatter } from '../artifacts/index-builder.js';
 import { BACKEND_TYPES, FilesystemAdapter, ObsidianAdapter, LogseqAdapter, FortemiAdapter, SUBSYSTEM_KEYS, getLoadedConfig, initStorage, resolveStorage, resolveSubsystemRoot, storageConfigPath, } from './index.js';
 import { projectAiwgPath, resolveProjectAiwgDir } from '../config/project-artifacts.js';
-export async function main(args) {
+export async function main(args, projectRoot = process.cwd()) {
     const subcommand = args[0];
     const subArgs = args.slice(1);
-    const projectRoot = process.cwd();
     switch (subcommand) {
         case 'show':
             await handleShow(projectRoot);
@@ -36,6 +37,9 @@ export async function main(args) {
         case 'migrate':
             await handleMigrate(projectRoot, subArgs);
             break;
+        case 'import-corpus':
+            await handleImportCorpus(projectRoot, subArgs);
+            break;
         default:
             printUsage();
             if (subcommand) {
@@ -166,7 +170,7 @@ async function handleMigrate(projectRoot, args) {
     }
     if (source.init)
         await source.init();
-    if (destination.init)
+    if (!opts.dryRun && destination.init)
         await destination.init();
     console.log(`storage migrate (${opts.dryRun ? 'DRY RUN' : 'live'})`);
     console.log(`  subsystem: ${opts.subsystem}`);
@@ -184,7 +188,13 @@ async function handleMigrate(projectRoot, args) {
     let copied = 0;
     let skipped = 0;
     let errored = 0;
+    let unsupported = 0;
     for (const entry of entries) {
+        if (opts.textOnly && !isTextCorpusEntry(entry.path)) {
+            unsupported++;
+            console.log(`  · ${entry.path} (non-text attachment skipped)`);
+            continue;
+        }
         if (completed.has(entry.path)) {
             skipped++;
             console.log(`  ✓ ${entry.path} (already migrated, skipped)`);
@@ -202,7 +212,7 @@ async function handleMigrate(projectRoot, args) {
                 console.log(`  ✗ ${entry.path} (read returned null)`);
                 continue;
             }
-            await destination.write(entry.path, content);
+            await destination.write(entry.path, content, migrationMetadata(entry.path, content));
             await recordCompletion(migrationLogPath, entry.path);
             copied++;
             console.log(`  ✓ ${entry.path}`);
@@ -217,7 +227,8 @@ async function handleMigrate(projectRoot, args) {
     if (destination.close)
         await destination.close();
     console.log('');
-    console.log(`Summary: copied=${copied} skipped=${skipped} errored=${errored} total=${entries.length}`);
+    console.log(`Summary: copied=${copied} skipped=${skipped} unsupported=${unsupported} ` +
+        `errored=${errored} total=${entries.length}`);
     if (!opts.dryRun) {
         console.log(`Migration log: ${migrationLogPath}`);
     }
@@ -232,6 +243,7 @@ function parseMigrateArgs(args) {
     let fromFolder;
     let toFolder;
     let dryRun = false;
+    let textOnly = false;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if (a === '--from')
@@ -244,6 +256,8 @@ function parseMigrateArgs(args) {
             toFolder = args[++i];
         else if (a === '--dry-run')
             dryRun = true;
+        else if (a === '--text-only')
+            textOnly = true;
         else if (!a.startsWith('--') && !subsystem)
             subsystem = a;
         else
@@ -261,8 +275,73 @@ function parseMigrateArgs(args) {
         from: { ...parseSpec(from), ...(fromFolder ? { folder: fromFolder } : {}) },
         to: { ...parseSpec(to), ...(toFolder ? { folder: toFolder } : {}) },
         dryRun,
+        textOnly,
     };
 }
+const TEXT_CORPUS_EXTENSIONS = new Set([
+    '.bib',
+    '.csv',
+    '.htm',
+    '.html',
+    '.json',
+    '.md',
+    '.ris',
+    '.txt',
+    '.xml',
+    '.yaml',
+    '.yml',
+]);
+export function isTextCorpusEntry(entryPath) {
+    return TEXT_CORPUS_EXTENSIONS.has(extname(entryPath).toLowerCase());
+}
+function migrationMetadata(entryPath, content) {
+    const extension = extname(entryPath).toLowerCase();
+    const contentType = extension === '.md' ? 'text/markdown' : 'text/plain';
+    if (extension !== '.md')
+        return { contentType };
+    return { contentType, frontmatter: parseFrontmatter(content).data };
+}
+async function handleImportCorpus(projectRoot, args) {
+    let server = 'fortemi';
+    let destination;
+    let serverSelected = false;
+    let dryRun = false;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === '--server') {
+            server = args[++index] ?? '';
+            serverSelected = true;
+            if (!server)
+                throw new Error('storage import-corpus: --server requires a name');
+        }
+        else if (arg === '--to') {
+            destination = args[++index] ?? '';
+            if (!destination)
+                throw new Error('storage import-corpus: --to requires a backend spec');
+        }
+        else if (arg === '--dry-run') {
+            dryRun = true;
+        }
+        else {
+            throw new Error(`Unknown import-corpus flag: ${arg}`);
+        }
+    }
+    if (serverSelected && destination) {
+        throw new Error('storage import-corpus: use either --server or --to, not both');
+    }
+    await initStorage(projectRoot);
+    const config = await getLoadedConfig(projectRoot);
+    const sourceRoot = resolveSubsystemRoot('research', projectRoot, config);
+    await handleMigrate(projectRoot, [
+        'research',
+        '--from',
+        `fs:${sourceRoot}`,
+        '--to',
+        destination ?? `fortemi:${server}`,
+        '--text-only',
+        ...(dryRun ? ['--dry-run'] : []),
+    ]);
+}
 function parseSpec(raw) {
     const idx = raw.indexOf(':');
     if (idx === -1) {
@@ -449,11 +528,16 @@ Subcommands:
   list-backends [--json]        Inventory of compiled-in adapters; --json emits structured output including tracking_issue URL for stubs
   test <subsystem>              Round-trip read/write/list/delete through the configured backend
   migrate <subsystem>           Copy entries from one backend to another (#955)
+  import-corpus                 Ingest local research text through a storage backend (#1508)
+    --to <type>:<location>      Provider-neutral destination backend (default: fortemi:fortemi)
+    --server <name>             MCP registry server name (default: fortemi)
+    --dry-run                   Preview corpus selection without connecting
     --from <type>:<location>    Source spec (fs:./dir, obsidian:~/vault, logseq:./graph, fortemi:server)
     --to <type>:<location>      Destination spec (same format)
     --from-folder <folder>      Optional Obsidian subfolder for source
     --to-folder <folder>        Optional Obsidian subfolder for destination
     --dry-run                   Preview operations without writing
+    --text-only                 Skip non-text attachments
 
 Subsystems: ${SUBSYSTEM_KEYS.join(', ')}
 
@@ -463,6 +547,9 @@ Examples:
   aiwg storage test activity_log
   aiwg storage migrate memory --from fs:.aiwg/memory --to obsidian:~/vault --to-folder AIWG/memory --dry-run
   aiwg storage migrate kb --from fs:.aiwg/kb --to fortemi:fortemi
+  aiwg storage import-corpus --dry-run
+  aiwg storage import-corpus --to obsidian:~/vault --dry-run
+  aiwg storage import-corpus --server fortemi-enterprise
 
 See @.aiwg/architecture/storage-design.md for the design.`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.2",
+  "version": "2026.8.4",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@fortemi/core": "2026.7.15",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "chalk": "^4.1.2",
     "chokidar": "^4.0.3",
     "commander": "^12.1.0",

package/tools/plugin/package-plugins.mjs

@@ -21,6 +21,9 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const ROOT_DIR = path.resolve(__dirname, '../..');
 const PLUGINS_DIR = path.join(ROOT_DIR, 'agentic/code/plugins');
+const RELEASE_VERSION = JSON.parse(
+  fs.readFileSync(path.join(ROOT_DIR, 'package.json'), 'utf8'),
+).version;
 
 // Plugin configurations
 const PLUGIN_CONFIGS = {
@@ -34,6 +37,16 @@ const PLUGIN_CONFIGS = {
       commands: 'agentic/code/frameworks/sdlc-complete/commands',
       skills: 'agentic/code/frameworks/sdlc-complete/skills'
     },
+    extraCopy: [
+      { from: 'tools/security/threat-assessment.mjs', to: 'tools/security/threat-assessment.mjs' }
+    ],
+    rewrites: [
+      {
+        file: 'skills/address-issues-threat-assess/scripts/assess.mjs',
+        from: '../../../../../../../tools/security/threat-assessment.mjs',
+        to: '../../../tools/security/threat-assessment.mjs'
+      }
+    ],
     readme: `# AIWG SDLC Complete
 
 Complete Software Development Lifecycle framework with 180+ specialized agents.
@@ -81,7 +94,6 @@ Key agents include:
     description: 'Marketing automation framework with 37 specialized agents for campaign management.',
     sources: {
       agents: 'agentic/code/frameworks/media-marketing-kit/agents',
-      commands: 'agentic/code/frameworks/media-marketing-kit/commands',
       skills: 'agentic/code/frameworks/media-marketing-kit/skills'
     },
     readme: `# AIWG Marketing Kit
@@ -213,7 +225,6 @@ Writing quality validation and AI pattern detection.
     description: 'Core AIWG utilities for context regeneration and workspace management.',
     sources: {
       agents: 'agentic/code/addons/aiwg-utils/agents',
-      commands: 'agentic/code/addons/aiwg-utils/commands',
       skills: 'agentic/code/addons/aiwg-utils/skills'
     },
     readme: `# AIWG Utilities
@@ -292,7 +303,6 @@ Then install in Codex via the \`/plugins\` command or the repo marketplace.
     description: 'Digital forensics and incident response framework with 14 specialized agents covering target profiling, evidence acquisition, log/memory/container/cloud analysis, IOC extraction, and reporting.',
     sources: {
       agents: 'agentic/code/frameworks/forensics-complete/agents',
-      commands: 'agentic/code/frameworks/forensics-complete/commands',
       skills: 'agentic/code/frameworks/forensics-complete/skills'
     },
     readme: `# AIWG Forensics Complete
@@ -336,7 +346,6 @@ Digital forensics and incident response framework with 14 specialized agents.
     description: 'Applied security framework for cryptographic primitive selection, chain-of-trust design, authentication factor analysis, supply-chain trust, and physical-threat modeling. Complements OWASP-style application audits.',
     sources: {
       agents: 'agentic/code/frameworks/security-engineering/agents',
-      commands: 'agentic/code/frameworks/security-engineering/commands',
       skills: 'agentic/code/frameworks/security-engineering/skills'
     },
     readme: `# AIWG Security Engineering
@@ -383,7 +392,6 @@ Applied security engineering framework for cryptographic primitive selection, ch
     description: 'Research workflow framework with 9 specialized agents for discovery, acquisition, synthesis, citation management, GRADE quality assessment, and OAIS-compliant archival.',
     sources: {
       agents: 'agentic/code/frameworks/research-complete/agents',
-      commands: 'agentic/code/frameworks/research-complete/commands',
       skills: 'agentic/code/frameworks/research-complete/skills'
     },
     readme: `# AIWG Research Complete
@@ -429,7 +437,6 @@ Research workflow framework with 9 specialized agents for academic and technical
     description: 'Media archive management framework with 7 specialized agents for source discovery, acquisition (yt-dlp / Internet Archive / Bandcamp), quality assessment, metadata tagging, and provenance tracking.',
     sources: {
       agents: 'agentic/code/frameworks/media-curator/agents',
-      commands: 'agentic/code/frameworks/media-curator/commands',
       skills: 'agentic/code/frameworks/media-curator/skills'
     },
     readme: `# AIWG Media Curator
@@ -484,7 +491,6 @@ Media archive management framework with 7 specialized agents.
     description: 'Operational infrastructure framework with 12 specialized agents covering incident response, runbook execution, fleet inventory, certificate lifecycle, and disaster recovery planning.',
     sources: {
       agents: 'agentic/code/frameworks/ops-complete/agents',
-      commands: 'agentic/code/frameworks/ops-complete/commands',
       skills: 'agentic/code/frameworks/ops-complete/skills'
     },
     readme: `# AIWG Ops Complete
@@ -603,6 +609,57 @@ Traces are written to \`.aiwg/traces/\` in JSONL format.
   }
 };
 
+// Manifest-backed Claude plugins. Keep the curated framework bundles above,
+// then expose every user-facing addon that contains a Claude-discoverable
+// component. Copying the complete addon directory is intentional: Claude Code
+// installs marketplace plugins into an isolated cache, so skills must not rely
+// on ../ paths back into the AIWG monorepo for templates, schemas, or scripts.
+const MANIFEST_PLUGIN_SOURCES = [
+  ['validation-complete', 'agentic/code/frameworks/validation-complete'],
+  ['agent-loop', 'agentic/code/addons/agent-loop'],
+  ['agent-persistence', 'agentic/code/addons/agent-persistence'],
+  ['agentic-installer', 'agentic/code/addons/agentic-installer'],
+  ['aiwg-evals', 'agentic/code/addons/aiwg-evals'],
+  ['aiwg-dev', 'agentic/code/addons/aiwg-dev'],
+  ['auto-memory', 'agentic/code/addons/auto-memory'],
+  ['browser-control', 'agentic/code/addons/browser-control'],
+  ['color-palette', 'agentic/code/addons/color-palette'],
+  ['context-curator', 'agentic/code/addons/context-curator'],
+  ['compound-memory', 'agentic/code/addons/compound-memory'],
+  ['daemon', 'agentic/code/addons/daemon'],
+  ['doc-intelligence', 'agentic/code/addons/doc-intelligence'],
+  ['droid-bridge', 'agentic/code/addons/droid-bridge'],
+  ['guided-implementation', 'agentic/code/addons/guided-implementation'],
+  ['line-memory', 'agentic/code/addons/line-memory'],
+  ['llm-wiki', 'agentic/code/addons/llm-wiki'],
+  ['nlp-prod', 'agentic/code/addons/nlp-prod'],
+  ['prose-integration', 'agentic/code/addons/prose-integration'],
+  ['rlm', 'agentic/code/addons/rlm'],
+  ['semantic-memory', 'agentic/code/addons/semantic-memory'],
+  ['skill-factory', 'agentic/code/addons/skill-factory'],
+  ['star-prompt', 'agentic/code/addons/star-prompt'],
+  ['testing-quality', 'agentic/code/addons/testing-quality'],
+  ['twelve-factor', 'agentic/code/addons/twelve-factor'],
+  ['uat-mcp', 'agentic/code/addons/uat-mcp'],
+  ['verbalized-sampling', 'agentic/code/addons/verbalized-sampling'],
+];
+
+for (const [id, sourceRoot] of MANIFEST_PLUGIN_SOURCES) {
+  if (!fs.existsSync(path.join(ROOT_DIR, sourceRoot, 'manifest.json'))) continue;
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(ROOT_DIR, sourceRoot, 'manifest.json'), 'utf8'),
+  );
+  PLUGIN_CONFIGS[id] = {
+    name: id,
+    displayName: manifest.name || id,
+    version: manifest.version || '1.0.0',
+    description: manifest.description || `${manifest.name || id} for AIWG`,
+    keywords: manifest.keywords || manifest.tags || [],
+    category: manifest.category || 'productivity',
+    sourceRoot,
+  };
+}
+
 // Parse command line arguments
 function parseArgs() {
   const args = process.argv.slice(2);
@@ -723,7 +780,7 @@ function cleanPlugin(pluginDir) {
 
   const entries = fs.readdirSync(pluginDir, { withFileTypes: true });
   for (const entry of entries) {
-    if (entry.name === '.claude-plugin') continue;
+    if (entry.name.endsWith('-plugin') || entry.name === 'clawhub.json') continue;
 
     const fullPath = path.join(pluginDir, entry.name);
     if (entry.isDirectory()) {
@@ -747,6 +804,15 @@ function packagePlugin(name, config, options) {
     }
   }
 
+  // Copy a complete manifest-backed component so cached plugins retain every
+  // referenced script/template/schema. Curated legacy bundles continue to use
+  // their explicit source maps below.
+  if (config.sourceRoot) {
+    console.log(`  📁 Copying self-contained source from ${config.sourceRoot}...`);
+    const count = copyDir(config.sourceRoot, pluginDir, options.dryRun);
+    console.log(`     ${count} files`);
+  }
+
   // Copy sources
   for (const [type, srcPath] of Object.entries(config.sources || {})) {
     const destPath = path.join(pluginDir, type);
@@ -761,10 +827,30 @@ function packagePlugin(name, config, options) {
   for (const extra of config.extraCopy || []) {
     const destPath = path.join(pluginDir, extra.to);
     console.log(`  📁 Copying ${extra.to}...`);
-    const count = copyDir(extra.from, destPath, options.dryRun);
+    const sourcePath = path.join(ROOT_DIR, extra.from);
+    let count;
+    if (fs.statSync(sourcePath).isFile()) {
+      count = 1;
+      if (!options.dryRun) {
+        fs.mkdirSync(path.dirname(destPath), { recursive: true });
+        fs.copyFileSync(sourcePath, destPath);
+      }
+    } else {
+      count = copyDir(extra.from, destPath, options.dryRun);
+    }
     console.log(`     ${count} files`);
   }
 
+  for (const rewrite of config.rewrites || []) {
+    if (options.dryRun) continue;
+    const target = path.join(pluginDir, rewrite.file);
+    const body = fs.readFileSync(target, 'utf8');
+    if (!body.includes(rewrite.from)) {
+      throw new Error(`${name}: rewrite source not found in ${rewrite.file}`);
+    }
+    fs.writeFileSync(target, body.replaceAll(rewrite.from, rewrite.to), 'utf8');
+  }
+
   // Write README
   if (config.readme && !options.dryRun) {
     const readmePath = path.join(pluginDir, 'README.md');
@@ -772,9 +858,74 @@ function packagePlugin(name, config, options) {
     console.log('  📄 Created README.md');
   }
 
+  if (!options.dryRun) {
+    const manifestDir = path.join(pluginDir, '.claude-plugin');
+    fs.mkdirSync(manifestDir, { recursive: true });
+    fs.writeFileSync(path.join(manifestDir, 'plugin.json'), `${JSON.stringify({
+      name: config.name,
+      // Claude caches pinned marketplace plugins by version. AIWG publishes
+      // these generated bundles with the repository release, so their
+      // distribution version must advance with package.json even when the
+      // canonical component's internal schema/API version does not.
+      version: RELEASE_VERSION,
+      description: config.description,
+      author: { name: 'AIWG Contributors', email: 'support@aiwg.io' },
+      homepage: 'https://aiwg.io',
+      repository: 'https://github.com/jmagly/aiwg',
+      license: 'MIT',
+      keywords: config.keywords || [],
+    }, null, 2)}\n`);
+  }
+
   console.log(`  ✅ ${config.displayName} packaged successfully`);
 }
 
+function writeClaudeMarketplaceManifest(options) {
+  const existingPath = path.join(ROOT_DIR, '.claude-plugin', 'marketplace.json');
+  const existing = JSON.parse(fs.readFileSync(existingPath, 'utf8'));
+  const external = existing.plugins
+    .filter((plugin) => typeof plugin.source !== 'string')
+    .map((plugin) => ({
+      ...plugin,
+      source: plugin.source?.type === 'github'
+        ? {
+            source: 'github',
+            repo: plugin.source.repo,
+            ...(plugin.source.branch ? { ref: plugin.source.branch } : {}),
+          }
+        : plugin.source,
+    }));
+  const local = Object.entries(PLUGIN_CONFIGS)
+    .filter(([, config]) => config.pluginType !== 'codex')
+    .map(([name, config]) => ({
+      name,
+      source: `./agentic/code/plugins/${name}`,
+      description: config.description,
+      version: RELEASE_VERSION,
+      author: { name: 'AIWG Contributors' },
+      license: 'MIT',
+      category: config.category || 'productivity',
+      keywords: config.keywords || [],
+    }));
+  const manifest = {
+    name: existing.name,
+    owner: existing.owner,
+    description: existing.metadata?.description || existing.description,
+    // The marketplace itself is a release artifact and must stay in lockstep
+    // with package.json. Preserving the previous manifest value silently
+    // leaves stale metadata after a release bump.
+    version: RELEASE_VERSION,
+    plugins: [...local, ...external],
+  };
+  if (options.dryRun) {
+    console.log(`\n[dry-run] Would write Claude marketplace: ${existingPath}`);
+    console.log(`  ${manifest.plugins.length} plugins`);
+    return;
+  }
+  fs.writeFileSync(existingPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+  console.log(`\n✓ Wrote Claude marketplace: ${existingPath} (${manifest.plugins.length} plugins)`);
+}
+
 // Package a Codex-format plugin (generates .codex-plugin/plugin.json + marketplace.json)
 async function packageCodexPlugin(name, config, options) {
   console.log(`\n📦 Packaging ${config.displayName} (Codex plugin format)...`);
@@ -974,11 +1125,11 @@ async function main() {
   // Package for each (provider, plugin) combination
   for (const provider of providersToRun) {
     for (const [name, config] of pluginsToPackage) {
-      // Respect the legacy pluginType flag when selecting defaults:
-      // if pluginType is set and provider is 'claude' (default), skip this
-      // plugin for claude and route it to its declared pluginType instead.
-      const effectiveProvider =
-        provider === 'claude' && config.pluginType ? config.pluginType : provider;
+      // Provider-specific bundles are not part of another provider's catalog.
+      if (provider === 'claude' && config.pluginType && config.pluginType !== 'claude') {
+        continue;
+      }
+      const effectiveProvider = provider;
 
       if (effectiveProvider === 'claude') {
         packagePlugin(name, config, options);
@@ -990,8 +1141,12 @@ async function main() {
       }
     }
 
+    if (provider === 'claude') {
+      writeClaudeMarketplaceManifest(options);
+    }
+
     // After packaging for Codex, also write the root marketplace.json
-    if (provider === 'codex' || (provider === 'claude' && pluginsToPackage.some(([, c]) => c.pluginType === 'codex'))) {
+    if (provider === 'codex') {
       writeCodexMarketplaceManifest(options);
     }
   }