@vellumai/assistant 0.12.2-staging.1 → 0.12.2-staging.3

package/src/cli/lib/__tests__/list-installed-plugins.test.ts

@@ -93,6 +93,46 @@ describe("listInstalledPlugins", () => {
     expect(result[0]!.packageJson?.icon).toBe("🚀");
   });
 
+  test("lists metadata from a standard-only plugin.json", () => {
+    mkdirSync(join(pluginsDir, "standard"));
+    writeFileSync(
+      join(pluginsDir, "standard", "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "standard",
+        version: "3.0.0",
+        description: "standard plugin",
+      }),
+    );
+
+    const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
+
+    expect(result[0]!.packageJson).toEqual({
+      name: "standard",
+      version: "3.0.0",
+      description: "standard plugin",
+      peerDependencies: undefined,
+    });
+    expect(result[0]!.issues).toEqual([]);
+  });
+
+  test("does not validate an unselected plugin.json beside package.json", () => {
+    mkdirSync(join(pluginsDir, "legacy"));
+    writeFileSync(
+      join(pluginsDir, "legacy", "package.json"),
+      JSON.stringify({ name: "legacy", version: "1.0.0" }),
+    );
+    writeFileSync(
+      join(pluginsDir, "legacy", "plugin.json"),
+      "{ foreign and malformed }",
+    );
+
+    const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
+
+    expect(result[0]!.packageJson?.version).toBe("1.0.0");
+    expect(result[0]!.issues).toEqual([]);
+  });
+
   test.each([
     ["missing vellum block", { name: "p", version: "1.0.0" }],
     ["non-string icon", { name: "p", version: "1.0.0", vellum: { icon: 42 } }],
@@ -120,7 +160,9 @@ describe("listInstalledPlugins", () => {
     const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
     expect(result).toHaveLength(1);
     expect(result[0]!.packageJson).toBeNull();
-    expect(result[0]!.issues).toEqual(["missing package.json"]);
+    expect(result[0]!.issues[0]).toContain(
+      "missing package.json and plugin.json",
+    );
   });
 
   test("reports malformed JSON as an issue rather than failing", () => {
@@ -130,7 +172,7 @@ describe("listInstalledPlugins", () => {
     const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
     expect(result).toHaveLength(1);
     expect(result[0]!.packageJson).toBeNull();
-    expect(result[0]!.issues[0]).toMatch(/invalid JSON/);
+    expect(result[0]!.issues[0]).toContain("could not be read or parsed");
   });
 
   test("reports non-object package.json as an issue", () => {
@@ -143,7 +185,7 @@ describe("listInstalledPlugins", () => {
     const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
     expect(result).toHaveLength(1);
     expect(result[0]!.packageJson).toBeNull();
-    expect(result[0]!.issues).toContain("package.json is not an object");
+    expect(result[0]!.issues[0]).toContain("failed schema validation");
   });
 
   test("skips hidden entries and non-directories", () => {

package/src/cli/lib/__tests__/plugin-details.test.ts

@@ -302,6 +302,32 @@ describe("getPluginDetails (bundled catalog, offline)", () => {
     expect(details.icon).toBeNull();
   });
 
+  test("reads metadata from an installed standard-only plugin.json", async () => {
+    const target = join(workspace, "caveman");
+    mkdirSync(target, { recursive: true });
+    writeFileSync(
+      join(target, "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "caveman",
+        version: "4.0.0",
+        description: "Installed standard plugin",
+        homepage: "https://example.com/plugin",
+        license: "MIT",
+      }),
+    );
+
+    const details = await getPluginDetails(
+      { name: "caveman" },
+      { fetch: makeFetch({}), workspacePluginsDir: workspace },
+    );
+
+    expect(details.version).toBe("4.0.0");
+    expect(details.description).toBe("Installed standard plugin");
+    expect(details.homepage).toBe("https://example.com/plugin");
+    expect(details.license).toBe("MIT");
+  });
+
   test("surfaces the installed copy's vellum.icon", async () => {
     // GIVEN an installed copy whose package.json declares vellum.icon
     const target = join(workspace, "caveman");

package/src/cli/lib/__tests__/uninstall-plugin.test.ts

@@ -21,15 +21,34 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  mock,
+  test,
+} from "bun:test";
+
+const deletePluginMcpOAuthCredentials = jest.fn(async () => ({
+  ok: true,
+  unreachable: false,
+  matchedKeys: [] as string[],
+  failedKeys: [] as string[],
+}));
+
+mock.module("../../../mcp/mcp-oauth-provider.js", () => ({
+  deletePluginMcpOAuthCredentials,
+}));
 
 import { resetHookCacheForTests } from "../../../hooks/hook-loader.js";
 import { getWorkspacePluginsDir } from "../../../util/platform.js";
 import { InvalidPluginNameError } from "../install-from-github.js";
-import {
-  PluginNotInstalledError,
-  uninstallPlugin,
-} from "../uninstall-plugin.js";
+const { PluginNotInstalledError, uninstallPlugin } =
+  await import("../uninstall-plugin.js");
+const { PLUGIN_UNINSTALL_WARNING_KEYS } =
+  await import("../uninstall-plugin.js");
 
 let pluginsDir: string;
 
@@ -38,6 +57,13 @@ beforeEach(() => {
   rmSync(pluginsDir, { recursive: true, force: true });
   mkdirSync(pluginsDir, { recursive: true });
   resetHookCacheForTests();
+  deletePluginMcpOAuthCredentials.mockReset();
+  deletePluginMcpOAuthCredentials.mockImplementation(async () => ({
+    ok: true,
+    unreachable: false,
+    matchedKeys: [],
+    failedKeys: [],
+  }));
 });
 
 afterEach(() => {
@@ -164,6 +190,97 @@ describe("uninstallPlugin", () => {
     expect(existsSync(marker)).toBe(false);
   });
 
+  test("preserves the plugin when credential deletion fails", async () => {
+    const target = writePlugin("cleanup-fails");
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: false,
+      matchedKeys: ["mcp-plugin/v1/key"],
+      failedKeys: ["mcp-plugin/v1/key"],
+    }));
+
+    await expect(
+      uninstallPlugin({
+        name: "cleanup-fails",
+        workspacePluginsDir: pluginsDir,
+      }),
+    ).rejects.toThrow("MCP OAuth credentials could not be deleted");
+    expect(existsSync(target)).toBe(true);
+  });
+
+  test("preserves an MCP plugin when credential storage is unavailable", async () => {
+    const target = writePlugin("offline-mcp");
+    writeFileSync(join(target, "mcp.json"), JSON.stringify({ mcpServers: {} }));
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: true,
+      matchedKeys: [],
+      failedKeys: [],
+    }));
+
+    await expect(
+      uninstallPlugin({
+        name: "offline-mcp",
+        workspacePluginsDir: pluginsDir,
+      }),
+    ).rejects.toThrow("credential storage is unavailable");
+    expect(existsSync(target)).toBe(true);
+  });
+
+  test("uses the install fingerprint as MCP evidence when the file was removed", async () => {
+    const target = writePlugin("recorded-mcp");
+    writeFileSync(
+      join(target, "install-meta.json"),
+      JSON.stringify({
+        name: "recorded-mcp",
+        source: {
+          kind: "github",
+          owner: "example",
+          repo: "plugin",
+          ref: "main",
+        },
+        fingerprint: {
+          algorithm: "sha256",
+          files: { "mcp.json": "digest" },
+        },
+      }),
+    );
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: true,
+      matchedKeys: [],
+      failedKeys: [],
+    }));
+
+    await expect(
+      uninstallPlugin({
+        name: "recorded-mcp",
+        workspacePluginsDir: pluginsDir,
+      }),
+    ).rejects.toThrow("credential storage is unavailable");
+    expect(existsSync(target)).toBe(true);
+  });
+
+  test("removes a non-MCP plugin offline and returns a visible warning", async () => {
+    const target = writePlugin("offline-simple");
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: true,
+      matchedKeys: [],
+      failedKeys: [],
+    }));
+
+    const result = await uninstallPlugin({
+      name: "offline-simple",
+      workspacePluginsDir: pluginsDir,
+    });
+
+    expect(existsSync(target)).toBe(false);
+    expect(result.warnings).toEqual([
+      PLUGIN_UNINSTALL_WARNING_KEYS.MCP_OAUTH_CREDENTIALS_UNCHECKED,
+    ]);
+  });
+
   test.each([
     ["../escape"],
     ["/abs/path"],

package/src/cli/lib/bundled-marketplace.json

@@ -135,6 +135,19 @@
       "homepage": "https://github.com/topoteretes/cognee-integrations/tree/main/integrations/vellum-assistant",
       "icon": "\ud83d\udd78\ufe0f"
     },
+    {
+      "name": "contractor-voice-invoicer",
+      "description": "Converts 20-second truck voice memos and job photos into itemized client invoices with custom labor rates, material markups, and one-click accounting staging.",
+      "category": "commerce",
+      "icon": "🔧",
+      "license": "MIT",
+      "homepage": "https://github.com/ZeebBoyBlue/contractor-voice-invoicer",
+      "source": {
+        "source": "github",
+        "repo": "ZeebBoyBlue/contractor-voice-invoicer",
+        "ref": "31e21ea1aa90b3ba462ed7208988931411226daa"
+      }
+    },
     {
       "name": "creatorland",
       "source": {

package/src/cli/lib/install-from-github.ts

@@ -52,6 +52,10 @@ import {
   getWorkspacePluginsDir,
   isWindows,
 } from "../../util/platform.js";
+import {
+  getPluginManifestInstallAction,
+  readPluginManifest,
+} from "../../util/plugin-manifest.js";
 import type { FetchLike } from "./fetch-like.js";
 import {
   type DependencyInstaller,
@@ -860,16 +864,18 @@ export async function materializePluginTree(
   // stub for it, overlay the stub and run its transform so the materialized
   // tree is a valid Vellum plugin. Raw clones (no stub) are left untouched,
   // except for a minimal package.json synthesis when the upstream repo shipped
-  // none — the Vellum loader hard-requires one and would silently skip the
-  // plugin without it. The synthesis is deterministic (name + fixed version +
-  // fixed peer-dep range), so it produces the same bytes on initial install
+  // no recognized manifest. The synthesis is deterministic (name + fixed
+  // version + fixed peer-dep range), so it produces the same bytes on initial install
   // and upgrade re-materialization; the fingerprint is computed after
   // materialization, so the synthesized file is present in both baselines and
   // the comparison stays clean.
   if (cloned.fileCount > 0 && opts.stubRef !== null) {
     await applyAdapterStub(opts.name, opts.stubRef, opts.destDir, deps);
   }
-  if (cloned.fileCount > 0 && !existsSync(join(opts.destDir, "package.json"))) {
+  if (
+    cloned.fileCount > 0 &&
+    getPluginManifestInstallAction(opts.destDir) === "synthesize-legacy"
+  ) {
     synthesizeMinimalPackageJson(opts.name, opts.destDir);
   }
   return cloned;
@@ -1557,22 +1563,15 @@ interface WriteInstallMetaParams {
 }
 
 /**
- * Read the `version` field from a staged plugin's `package.json`. Lenient — a
- * missing or malformed manifest simply yields `undefined` so provenance is
+ * Read the `version` field from a staged plugin's selected manifest. A
+ * missing or malformed manifest yields `undefined` so provenance is
  * recorded without it rather than failing the install.
  */
-function readStagedPackageVersion(stagingDir: string): string | undefined {
-  const pkgPath = join(stagingDir, "package.json");
-  if (!existsSync(pkgPath)) {
-    return undefined;
-  }
+function readStagedManifestVersion(stagingDir: string): string | undefined {
   try {
-    const parsed: unknown = JSON.parse(readFileSync(pkgPath, "utf8"));
-    if (typeof parsed === "object" && parsed !== null) {
-      const version = (parsed as Record<string, unknown>).version;
-      if (typeof version === "string" && version.length > 0) {
-        return version;
-      }
+    const version = readPluginManifest(stagingDir).version;
+    if (version && version.length > 0) {
+      return version;
     }
   } catch {
     // fall through to undefined
@@ -1602,7 +1601,7 @@ function writeInstallMeta(
   const meta: InstallMeta = {
     origin: "vellum",
     installedAt: new Date().toISOString(),
-    version: readStagedPackageVersion(stagingDir),
+    version: readStagedManifestVersion(stagingDir),
     sourceRepo: `${source.owner}/${source.repo}`,
     contentHash,
     author: "user",

package/src/cli/lib/install-from-platform.ts

@@ -8,9 +8,9 @@
  * and extracts it into the plugin's install directory — it does NOT clone the
  * plugin from GitHub itself, and it does NOT emit `plugin_installed` telemetry
  * (hitting this endpoint *is* the recorded install; the server rejects that
- * event type on the usual ingest path). A tarball that ships no
- * `package.json` gets the same synthesized manifest the GitHub clone path
- * writes, so the loader still registers the plugin's skills.
+ * event type on the usual ingest path). A tarball that ships neither supported
+ * manifest gets the same synthesized manifest the GitHub clone path writes, so
+ * the loader still registers the plugin's skills.
  *
  *     GET {PLATFORM_BASE_URL}/v1/plugins/{name}/install/
  *
@@ -36,6 +36,7 @@ import {
 import { getPlatformBaseUrl } from "../../config/env.js";
 import { getExistingDeviceId } from "../../util/device-id.js";
 import { getWorkspacePluginsDir } from "../../util/platform.js";
+import { getPluginManifestInstallAction } from "../../util/plugin-manifest.js";
 import { APP_VERSION } from "../../version.js";
 import type { FetchLike } from "./fetch-like.js";
 import {
@@ -205,12 +206,16 @@ export async function installPluginFromPlatform(
     throw new PluginNotFoundError(name, meta.ref ?? "", meta.repo ?? name);
   }
 
-  // Same default as the GitHub clone path: a marketplace tarball that
-  // ships skills/mcp.json but no Vellum package.json still has to load.
-  // The loader skips a directory with no manifest, so synthesize one
-  // before the fingerprint and swap.
-  if (!existsSync(join(stagingDir, "package.json"))) {
-    synthesizeMinimalPackageJson(name, stagingDir);
+  // Same default as the GitHub clone path: a marketplace tarball without a
+  // recognized manifest still has to load. A claimed standard manifest is
+  // validated before the fingerprint and swap.
+  try {
+    if (getPluginManifestInstallAction(stagingDir) === "synthesize-legacy") {
+      synthesizeMinimalPackageJson(name, stagingDir);
+    }
+  } catch (err) {
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw err;
   }
 
   await confirmStagedOrAbort(name, stagingDir, deps.confirmStaged);

package/src/cli/lib/list-installed-plugins.ts

@@ -17,6 +17,10 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { getWorkspacePluginsDir } from "../../util/platform.js";
+import {
+  LEGACY_PLUGIN_MANIFEST,
+  readPluginManifest,
+} from "../../util/plugin-manifest.js";
 import { parsePluginIcon } from "./plugin-artifact.js";
 import { readValidatedPluginIcon } from "./plugin-icon-file.js";
 
@@ -51,10 +55,13 @@ export interface InstalledPluginInfo {
   readonly name: string;
   /** Absolute path to the plugin directory. */
   readonly target: string;
-  /** Parsed `package.json` content, when present and parseable. */
+  /**
+   * Metadata from the selected manifest. The API exposes this field as
+   * `packageJson`.
+   */
   readonly packageJson: PluginPackageMetadata | null;
   /**
-   * Non-fatal issues with this entry (missing `package.json`, malformed
+   * Non-fatal issues with this entry (missing or malformed selected manifest,
    * JSON, unexpected type, etc.). Empty when the entry parses cleanly.
    */
   readonly issues: readonly string[];
@@ -143,51 +150,30 @@ function readPluginEntry(
   name: string,
 ): InstalledPluginInfo {
   const target = join(pluginsDir, name);
-  const pkgJsonPath = join(target, "package.json");
   const issues: string[] = [];
 
   // Icon validation is independent of package.json parsing, so resolve it
   // once and attach to every return below (including error paths).
   const iconFields = pluginIconFields(target);
 
-  if (!existsSync(pkgJsonPath)) {
-    issues.push("missing package.json");
-    return { name, target, packageJson: null, issues, ...iconFields };
-  }
-
-  let raw: string;
-  try {
-    raw = readFileSync(pkgJsonPath, "utf8");
-  } catch (err) {
-    issues.push(
-      `package.json unreadable: ${err instanceof Error ? err.message : String(err)}`,
-    );
-    return { name, target, packageJson: null, issues, ...iconFields };
-  }
-
-  let parsed: unknown;
+  let manifest: ReturnType<typeof readPluginManifest>;
   try {
-    parsed = JSON.parse(raw);
+    manifest = readPluginManifest(target);
   } catch (err) {
-    issues.push(
-      `package.json invalid JSON: ${err instanceof Error ? err.message : String(err)}`,
-    );
+    issues.push(err instanceof Error ? err.message : String(err));
     return { name, target, packageJson: null, issues, ...iconFields };
   }
-
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    issues.push("package.json is not an object");
-    return { name, target, packageJson: null, issues, ...iconFields };
-  }
-
-  const meta = parsed as Record<string, unknown>;
-  const icon = parsePluginIcon(meta);
+  const meta = manifest.raw;
+  const icon =
+    manifest.source === LEGACY_PLUGIN_MANIFEST
+      ? parsePluginIcon(meta)
+      : undefined;
   const packageJson: PluginPackageMetadata = {
-    name: typeof meta.name === "string" ? meta.name : undefined,
-    version: typeof meta.version === "string" ? meta.version : undefined,
-    description:
-      typeof meta.description === "string" ? meta.description : undefined,
+    name: manifest.name,
+    version: manifest.version,
+    description: manifest.description,
     peerDependencies:
+      manifest.source === LEGACY_PLUGIN_MANIFEST &&
       typeof meta.peerDependencies === "object" &&
       meta.peerDependencies !== null &&
       !Array.isArray(meta.peerDependencies)

package/src/cli/lib/plugin-details.ts

@@ -33,6 +33,7 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getWorkspacePluginsDir } from "../../util/platform.js";
+import { readPluginManifest } from "../../util/plugin-manifest.js";
 import type { FetchLike } from "./fetch-like.js";
 import { sanitizePluginName } from "./install-from-github.js";
 import {
@@ -230,22 +231,34 @@ interface LocalPlugin {
   readonly readme: string | null;
 }
 
-/** Read an installed copy's `package.json` + README off disk, if present. */
+/** Read an installed copy's selected manifest and README off disk, if present. */
 function readLocalPlugin(pluginsDir: string, name: string): LocalPlugin {
   const target = join(pluginsDir, name);
   if (!existsSync(target)) {
     return { installed: false, manifest: emptyManifest(), readme: null };
   }
 
-  const pkgPath = join(target, "package.json");
   let manifest = emptyManifest();
-  if (existsSync(pkgPath)) {
-    try {
-      manifest = parseManifest(readFileSync(pkgPath, "utf8"));
-    } catch {
-      // A malformed local manifest degrades to empty fields — the entry is
-      // still "installed", we just have nothing extra to surface from it.
+  try {
+    const packagePath = join(target, "package.json");
+    if (existsSync(packagePath)) {
+      // Detail metadata is intentionally lenient. An installed legacy package
+      // may omit the loader-required name while still carrying useful fields.
+      manifest = parseManifest(readFileSync(packagePath, "utf8"));
+    } else {
+      const selected = readPluginManifest(target);
+      manifest = {
+        version: selected.version ?? null,
+        description: selected.description ?? null,
+        homepage: selected.homepage ?? null,
+        license: normalizeLicense(selected.license),
+        artifact: null,
+        icon: null,
+      };
     }
+  } catch {
+    // A malformed local manifest degrades to empty fields. The entry is still
+    // installed, but it has no manifest metadata to surface.
   }
 
   return { installed: true, manifest, readme: readLocalReadme(target) };

package/src/cli/lib/uninstall-plugin.ts

@@ -15,10 +15,13 @@ import { existsSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import { runShutdownHook } from "../../hooks/hook-loader.js";
+import { MESSAGE_KEYS, t } from "../../i18n/index.js";
 import { isPluginDisabled } from "../../plugins/disabled-state.js";
+import { PLUGIN_MCP_MANIFEST } from "../../plugins/mcp-servers.js";
 import { getWorkspacePluginsDir } from "../../util/platform.js";
 import {
   InvalidPluginNameError,
+  readInstallMeta,
   sanitizePluginName,
 } from "./install-from-github.js";
 
@@ -40,11 +43,27 @@ export interface UninstallPluginOptions {
   readonly workspacePluginsDir?: string;
 }
 
+export const PLUGIN_UNINSTALL_WARNING_KEYS = {
+  MCP_OAUTH_CREDENTIALS_UNCHECKED:
+    MESSAGE_KEYS.PLUGIN_MCP_OAUTH_CREDENTIALS_UNCHECKED,
+} as const;
+
+export type PluginUninstallWarningKey =
+  (typeof PLUGIN_UNINSTALL_WARNING_KEYS)[keyof typeof PLUGIN_UNINSTALL_WARNING_KEYS];
+
+export function resolvePluginUninstallWarning(
+  key: PluginUninstallWarningKey,
+): string {
+  return t(key);
+}
+
 /** Result of a successful uninstall. */
 export interface UninstallPluginResult {
   readonly name: string;
   /** Absolute path that was removed. */
   readonly target: string;
+  /** Stable keys for non-fatal cleanup limitations. */
+  readonly warnings?: PluginUninstallWarningKey[];
 }
 
 /**
@@ -87,6 +106,41 @@ export async function uninstallPlugin(
     throw new PluginNotInstalledError(name, target);
   }
 
+  const hasCurrentMcpManifest = existsSync(join(target, PLUGIN_MCP_MANIFEST));
+  const recordedFiles = readInstallMeta(target)?.fingerprint?.files;
+  const hasRecordedMcpManifest =
+    recordedFiles !== undefined &&
+    Object.hasOwn(recordedFiles, PLUGIN_MCP_MANIFEST);
+  const warnings: PluginUninstallWarningKey[] = [];
+  const { deletePluginMcpOAuthCredentials } =
+    await import("../../mcp/mcp-oauth-provider.js");
+  let credentialsReachable = true;
+  let cleanup:
+    | Awaited<ReturnType<typeof deletePluginMcpOAuthCredentials>>
+    | undefined;
+  try {
+    cleanup = await deletePluginMcpOAuthCredentials(name);
+    credentialsReachable = !cleanup.unreachable;
+  } catch {
+    credentialsReachable = false;
+  }
+  if (cleanup && !cleanup.unreachable && !cleanup.ok) {
+    throw new Error(
+      `Plugin "${name}" was not removed because its MCP OAuth credentials could not be deleted.`,
+    );
+  }
+
+  if (!credentialsReachable) {
+    if (hasCurrentMcpManifest || hasRecordedMcpManifest) {
+      throw new Error(
+        `Plugin "${name}" was not removed because credential storage is unavailable and its MCP OAuth credentials could not be checked.`,
+      );
+    }
+    warnings.push(
+      PLUGIN_UNINSTALL_WARNING_KEYS.MCP_OAUTH_CREDENTIALS_UNCHECKED,
+    );
+  }
+
   // Skip the shutdown hook when the plugin is disabled. A `.disabled` plugin
   // is never loaded — no hooks, tools, or init — so its shutdown was never
   // paired with an init. Running it on uninstall would be the first and only
@@ -98,7 +152,11 @@ export async function uninstallPlugin(
   }
 
   rmSync(target, { recursive: true, force: true });
-  return { name, target };
+  return {
+    name,
+    target,
+    ...(warnings.length > 0 && { warnings }),
+  };
 }
 
 export { InvalidPluginNameError };

package/src/config/__tests__/plugin-resident-skill-discovery.test.ts

@@ -94,6 +94,27 @@ describe("discoverPluginResidentSkills (via loadSkillCatalog)", () => {
     expect(skill!.owner).toEqual({ kind: "plugin", id: "demo-matched" });
   });
 
+  test("surfaces a skill from a standard-only plugin", () => {
+    const pluginDir = join(getWorkspacePluginsDir(), "standard-plugin");
+    const skillDir = join(pluginDir, "skills", "qa-standard-skill");
+    mkdirSync(skillDir, { recursive: true });
+    writeFileSync(
+      join(pluginDir, "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "standard-plugin",
+      }),
+    );
+    writeFileSync(
+      join(skillDir, "SKILL.md"),
+      "---\nname: qa-standard-skill\ndescription: Standard skill.\n---\n\nBody.\n",
+    );
+
+    const skill = skillById("qa-standard-skill");
+
+    expect(skill?.owner).toEqual({ kind: "plugin", id: "standard-plugin" });
+  });
+
   test("skips a plugin directory that has no package.json", () => {
     writePlugin(
       "no-manifest",