dealdesk-plugin 0.0.0-stage → 0.1.0

package/commands/dealdesk-craft-quote.md

@@ -0,0 +1,15 @@
+---
+name: dealdesk-craft-quote
+description: Craft or refine a classic DealDesk quote — clone a past quote, draft fresh, or use portfolio-evaluated pricing when asked.
+---
+
+# Craft an excellent classic quote
+
+Follow the `dealdesk-craft-quote` skill (classic-first).
+
+1. Confirm company, contact, and what the quote is about.
+2. Ask clone vs copy-a-liked-quote vs create fresh.
+3. Consult the published portfolio; confirm groups / selection / optional / `quantityEditable`.
+4. Create or clone, then refine with `replace_quote_items`.
+5. Use portfolio CPQ create/update only when asked for evaluated pricing (`quoteLayout` when useful).
+6. Offer share link or PDF. Never delete through MCP.

package/commands/dealdesk-create-card.md

@@ -0,0 +1,14 @@
+---
+name: dealdesk-create-card
+description: Create or update a DealDesk desk card. Soft-close with a stage change. Never delete.
+---
+
+# Create or update a desk card
+
+Follow the `dealdesk-create-card` skill.
+
+1. Read the current card with `dealdesk.get_card` when a card id is known; otherwise search with `dealdesk.list_cards`.
+2. Create with `dealdesk.create_card` or update with `dealdesk.patch_card`.
+3. Put the main body in `description`. Use `deskDescription` only for a desk-local note. Use `dealdesk.add_card_note` for structured notes, not for email.
+4. Link Customer Directory with `companyId` / `contactId` on create or patch (`null` clears). Clearing company clears contact. Linked case and quote customers are updated automatically.
+5. Soft-close by setting a closed stage. Do not delete.

package/commands/dealdesk-directory-activity.md

@@ -0,0 +1,12 @@
+---
+name: dealdesk-directory-activity
+description: Read a company or contact commercial summary and add or patch structured directory notes.
+---
+
+# Directory notes and commercial summary
+
+Follow the `dealdesk-directory-activity` skill.
+
+1. Resolve the company or contact.
+2. Call `dealdesk.get_company_commercial_summary` or `dealdesk.get_contact_commercial_summary` before advising on pipeline.
+3. Add or patch notes with title and body. Never store email as a directory note; never delete notes through MCP.

package/commands/dealdesk-evaluate-configuration.md

@@ -0,0 +1,10 @@
+---
+name: dealdesk-evaluate-configuration
+description: Evaluate a DealDesk configuration without creating a quote.
+---
+
+# Evaluate a configuration
+
+Follow the `dealdesk-evaluate-configuration` skill.
+
+Call `dealdesk.portfolio_evaluate`. Report blockers, totals, and the rule trace from the tool result. Do not create a quote unless the user asks for one.

package/commands/dealdesk-export-analysis.md

@@ -0,0 +1,10 @@
+---
+name: dealdesk-export-analysis
+description: Export DealDesk data for analysis. Do not page through unbounded lists.
+---
+
+# Export for analysis
+
+Follow the `dealdesk-export-analysis` skill.
+
+Call `dealdesk.export_intelligence`. Do not walk `list_cards` or `list_quotes` in a loop to build a workbook.

package/commands/dealdesk-find-or-create-customer.md

@@ -0,0 +1,12 @@
+---
+name: dealdesk-find-or-create-customer
+description: Find a DealDesk company or contact, and create one only when no match exists.
+---
+
+# Find or create a customer
+
+Follow the `dealdesk-find-or-create-customer` skill.
+
+1. Search with `dealdesk.list_companies` or `dealdesk.list_contacts`.
+2. Create only when no suitable match exists.
+3. Companies use `legalName` (or `name`). Contacts use `displayName` (or `name`). Leave `externalId` empty unless the user supplied one.

package/commands/dealdesk-help.md

@@ -0,0 +1,62 @@
+---
+name: dealdesk-help
+description: Explain what DealDesk can do in this host. Use when the user asks for help, capabilities, available commands, or how to use the DealDesk plugin.
+---
+
+# DealDesk help
+
+Help the user use DealDesk. Prefer live discovery over memory.
+
+## First steps
+
+1. Call `dealdesk.list_skills` and summarize the returned skills in plain language.
+2. If important tools are missing from the current tool list, call `dealdesk.discover` (omit `domain` for the domain list, or pass a domain such as `desk`, `quotes`, `portfolio`, `directory`, `export`, or `portfolio-authoring`).
+3. Then answer with the command map below and the live skill list.
+
+If MCP is not connected yet, still explain the command map and say which auth path to use.
+
+## Slash commands
+
+| Command | What it does |
+| --- | --- |
+| `/dealdesk-help` | This overview |
+| `/dealdesk-create-card` | Create or update a desk card (including company/contact link) |
+| `/dealdesk-log-card-activity` | Log inbound or outbound email on a card timeline |
+| `/dealdesk-craft-quote` | Craft or refine a classic quote (clone or fresh draft) |
+| `/dealdesk-quote-from-portfolio` | Evaluate a configuration and create a quote from the portfolio |
+| `/dealdesk-evaluate-configuration` | Evaluate a configuration without creating a quote |
+| `/dealdesk-directory-activity` | Company/contact commercial summary and notes |
+| `/dealdesk-find-or-create-customer` | Find or create a company or contact |
+| `/dealdesk-share-quote` | Quote status and customer share links (classic + rich) |
+| `/dealdesk-export-analysis` | Bounded Deal Intelligence export |
+| `/dealdesk-publish-portfolio` | Preview then confirm portfolio publish |
+
+Hosts may prefix commands with the plugin name (for example `/dealdesk:dealdesk-help`).
+
+## Status updates and email
+
+- Email: use `dealdesk.log_email` (or `/dealdesk-log-card-activity`). Never put email in `add_card_note`.
+- Other timeline work: use `dealdesk.create_status_update` for `comment`, `task`, and touchpoints (`phone_call`, `meeting`, `email_incoming`, `email_outgoing`, `misc`).
+- Read the timeline with `dealdesk.list_status_updates`. Update with `dealdesk.patch_status_update`.
+- Structured desk notes: `dealdesk.add_card_note` / `dealdesk.patch_card_note`.
+
+## Quotes and shares
+
+- Status and acceptance: `dealdesk.get_quote` (also returns existing shares).
+- Line items without enrichment: `dealdesk.get_quote_summary`.
+- Customer links: `create_quote_share` → `classicUrl` (standard) and `experienceUrl` (rich experience). Soft-close with `patch_quote_share` `isOpen=false`.
+
+## Hard limits
+
+- Delete is not available through MCP. Soft-close cards by changing stage; soft-close shares with `isOpen=false`.
+- Portfolio publish needs preview, then `portfolio_publish` with `confirm=true`.
+- Do not invent prices. Prefer portfolio evaluation and published revision ids.
+- Prefer `/dealdesk-export-analysis` over paging through large lists forever.
+- Skill-gated tools need `dealdesk.discover` with the matching domain first (for example `orders`, `portfolio`, `portfolio-authoring`).
+- Remind the user that DealDesk tool results may disclose customer data to the AI host and other tools in the conversation, and that they remain responsible for that data.
+
+## Auth
+
+- Sign-in is OAuth. The user signs in on the agenthouse page, chooses the project, and grants DealDesk access.
+- Remote URL: `https://api.agenthouse.org/mcp/dealdesk` (ChatGPT, Claude, Codex, Cursor).
+- The Cursor plugin and the local connector open that same page. An API key is only for automation that cannot open a browser (`AGENTHOUSE_API_KEY`, and `AGENTHOUSE_PROJECT_ID` when the account has more than one project).

package/commands/dealdesk-log-card-activity.md

@@ -0,0 +1,13 @@
+---
+name: dealdesk-log-card-activity
+description: Log inbound or outbound email on a DealDesk card timeline. Never store email as a card note.
+---
+
+# Log email on a card
+
+Follow the `dealdesk-log-card-activity` skill.
+
+1. Resolve the desk card (`dealdesk.list_cards` / `dealdesk.get_card`).
+2. Call `dealdesk.log_email` with `direction` (`incoming` or `outgoing`), `from`, `to`, `subject`, `text`, and `cardId`.
+3. Do not call `dealdesk.add_card_note` for email. That tool is for internal structured notes only.
+4. For a comment, task, call, or meeting, use `dealdesk.create_status_update` instead.

package/commands/dealdesk-publish-portfolio.md

@@ -0,0 +1,13 @@
+---
+name: dealdesk-publish-portfolio
+description: Preview a DealDesk portfolio publish, then confirm only when blockers are clear.
+---
+
+# Publish the portfolio
+
+Follow the `dealdesk-publish-portfolio` skill.
+
+1. Call `dealdesk.discover` with domain `portfolio-authoring` if publish tools are not listed yet.
+2. Call `dealdesk.initialize_portfolio_draft` only when no draft exists.
+3. Call `dealdesk.portfolio_publish_preview` and show blockers.
+4. Call `dealdesk.portfolio_publish` with `confirm=true` only when blockers are clear and the user has confirmed. Never publish without that flag.

package/commands/dealdesk-quote-from-portfolio.md

@@ -0,0 +1,12 @@
+---
+name: dealdesk-quote-from-portfolio
+description: Create a DealDesk quote from the published portfolio after a side-effect free evaluation.
+---
+
+# Quote from the published portfolio
+
+Follow the `dealdesk-quote-from-portfolio` skill.
+
+1. Confirm a published revision with `dealdesk.portfolio_summary` when needed.
+2. Evaluate with `dealdesk.portfolio_evaluate`. Do not invent prices.
+3. Create or update with `dealdesk.create_quote_from_configuration` / `dealdesk.update_quote_from_configuration` using the published revision ids and the same configuration.

package/commands/dealdesk-share-quote.md

@@ -0,0 +1,13 @@
+---
+name: dealdesk-share-quote
+description: Get a DealDesk quote status or customer share links (classic and rich experience). Soft-close with isOpen=false.
+---
+
+# Quote status and share links
+
+Follow the `dealdesk-share-quote` skill.
+
+1. Call `dealdesk.get_quote` for status, acceptance, and existing shares.
+2. Call `dealdesk.create_quote_share` when a new customer link is needed.
+3. Prefer `classicUrl` for the standard share and `experienceUrl` for the rich experience Desk.
+4. Soft-close with `dealdesk.patch_quote_share` and `isOpen=false`. Never delete shares through MCP.

package/mcp.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "dealdesk": {
+      "type": "streamable-http",
+      "url": "https://api.agenthouse.org/mcp/dealdesk"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,59 @@
-{
-  "name": "dealdesk-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "dealdesk-plugin",
+  "version": "0.1.0",
+  "description": "DealDesk plugin for agenthouse — marketplace-installable skills and MCP tools for ChatGPT, Claude, Cursor, and Codex",
+  "license": "MIT",
+  "homepage": "https://github.com/agenthouse-org/dealdesk-plugin",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agenthouse-org/dealdesk-plugin.git"
+  },
+  "bugs": {
+    "url": "https://github.com/agenthouse-org/dealdesk-plugin/issues"
+  },
+  "keywords": [
+    "agenthouse",
+    "dealdesk",
+    "plugin",
+    "mcp",
+    "model-context-protocol",
+    "cursor",
+    "claude",
+    "chatgpt",
+    "codex"
+  ],
+  "bin": {
+    "dealdesk-plugin": "./bin/dealdesk-plugin.js",
+    "dealdesk-mcp": "./bin/dealdesk-plugin.js"
+  },
+  "files": [
+    "bin",
+    "skills",
+    "commands",
+    "scripts",
+    "assets",
+    "plugin.json",
+    "mcp.json",
+    ".mcp.json",
+    ".codex-plugin",
+    ".claude-plugin",
+    ".cursor-plugin",
+    ".agents",
+    "README.md",
+    "LICENSE",
+    "AGENTS.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "start": "node bin/dealdesk-plugin.js",
+    "test": "node scripts/validate-skills.js && node scripts/test-project-scope.js && node scripts/package-plugin-zip.js",
+    "package:zip": "node scripts/package-plugin-zip.js",
+    "version:bump": "node scripts/bump-version.js"
+  }
+}

package/plugin.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "dealdesk",
+  "version": "0.1.0",
+  "description": "DealDesk skills and MCP tools for desk cards, email logs, quotes, customers, and portfolio publish.",
+  "author": {
+    "name": "agenthouse",
+    "url": "https://agenthouse.org"
+  },
+  "homepage": "https://agenthouse.org",
+  "repository": "https://github.com/agenthouse-org/dealdesk-plugin",
+  "license": "MIT",
+  "keywords": ["agenthouse", "dealdesk", "mcp", "quotes", "crm"],
+  "logo": "assets/logo.svg",
+  "extensions": {
+    "com.openai": {
+      "interface": {
+        "displayName": "DealDesk",
+        "shortDescription": "Desk cards, quotes, customers",
+        "logo": "./assets/logo.svg",
+        "composerIcon": "./assets/logo.svg",
+        "longDescription": "Operate DealDesk from ChatGPT or Codex: create and update desk cards, log email on the card timeline, evaluate configurations, create quotes from the published portfolio, find or create customers, export for analysis, and publish a portfolio only after preview and confirm. Tools run on the agenthouse MCP endpoint. Delete is not available.",
+        "developerName": "agenthouse",
+        "category": "Productivity",
+        "capabilities": ["Read", "Write"],
+        "websiteURL": "https://agenthouse.org",
+        "privacyPolicyURL": "https://agenthouse.org/privacy/",
+        "defaultPrompt": [
+          "List open DealDesk cards for my project.",
+          "Log this inbound email on the matching desk card.",
+          "Create a quote from the published portfolio for this configuration."
+        ]
+      }
+    }
+  }
+}

package/scripts/bump-version.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const versionFiles = require('./version-files');
+
+const kind = process.argv[2];
+if (!['patch', 'minor', 'major'].includes(kind)) {
+  process.stderr.write('Usage: node scripts/bump-version.js <patch|minor|major>\n');
+  process.exit(1);
+}
+
+const root = path.join(__dirname, '..');
+
+function readVersion(rel) {
+  const text = fs.readFileSync(path.join(root, rel), 'utf8');
+  const match = text.match(/"version"\s*:\s*"(\d+\.\d+\.\d+)"/);
+  if (!match) throw new Error(`No semantic version in ${rel}`);
+  return { text, version: match[1], token: match[0] };
+}
+
+function bump(version, level) {
+  const parts = version.split('.').map((part) => Number(part));
+  if (parts.some((part) => !Number.isInteger(part))) {
+    throw new Error(`Invalid version ${version}`);
+  }
+  if (level === 'major') return `${parts[0] + 1}.0.0`;
+  if (level === 'minor') return `${parts[0]}.${parts[1] + 1}.0`;
+  return `${parts[0]}.${parts[1]}.${parts[2] + 1}`;
+}
+
+const current = readVersion(versionFiles[0]);
+for (const rel of versionFiles.slice(1)) {
+  const found = readVersion(rel);
+  if (found.version !== current.version) {
+    throw new Error(`${rel} is ${found.version}; expected ${current.version}`);
+  }
+}
+
+const next = bump(current.version, kind);
+for (const rel of versionFiles) {
+  const found = readVersion(rel);
+  const updated = found.text.replace(found.token, `"version": "${next}"`);
+  if (updated === found.text) throw new Error(`Version was not replaced in ${rel}`);
+  fs.writeFileSync(path.join(root, rel), updated);
+}
+
+if (process.env.GITHUB_OUTPUT) {
+  fs.appendFileSync(
+    process.env.GITHUB_OUTPUT,
+    `version=${next}\nprevious=${current.version}\n`,
+  );
+}
+
+process.stdout.write(`${current.version} -> ${next}\n`);

package/scripts/package-plugin-zip.js

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const versionFiles = require('./version-files');
+const { createZip, readZip } = require('./zip-archive');
+
+const root = path.join(__dirname, '..');
+const MCP_URL = 'https://api.agenthouse.org/mcp/dealdesk';
+
+const INCLUDE = [
+  'plugin.json',
+  'mcp.json',
+  '.mcp.json',
+  'README.md',
+  'LICENSE',
+  'AGENTS.md',
+  'bin',
+  'assets',
+  'skills',
+  'commands',
+  '.codex-plugin',
+  '.claude-plugin',
+  '.cursor-plugin',
+  '.agents',
+];
+
+function readJson(rel) {
+  return JSON.parse(fs.readFileSync(path.join(root, rel), 'utf8'));
+}
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function zipPath(rel) {
+  return rel.split(path.sep).join('/');
+}
+
+function walk(rel) {
+  const abs = path.join(root, rel);
+  const stat = fs.statSync(abs);
+  if (stat.isFile()) return [zipPath(rel)];
+  const names = [];
+  for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
+    if (entry.name === '.DS_Store') continue;
+    names.push(...walk(path.join(rel, entry.name)));
+  }
+  return names;
+}
+
+function assertVersions(version) {
+  for (const rel of versionFiles) {
+    const found = readJson(rel).version;
+    if (found !== version) fail(`${rel} version is ${found}; expected ${version}`);
+  }
+}
+
+function assertSkills() {
+  const skillsRoot = path.join(root, 'skills');
+  const dirs = fs.readdirSync(skillsRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory());
+  if (dirs.length === 0) fail('No skills to package');
+  for (const dir of dirs) {
+    const rel = `skills/${dir.name}/SKILL.md`;
+    const text = fs.readFileSync(path.join(root, rel), 'utf8');
+    const front = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!front) fail(`${rel} is missing YAML front matter`);
+    const skillName = (front[1].match(/^name:\s*(.+)\s*$/m) || [])[1];
+    const description = (front[1].match(/^description:\s*(.+)\s*$/m) || [])[1];
+    if (skillName !== dir.name) fail(`${rel} name must match its folder`);
+    if (!description) fail(`${rel} is missing a description`);
+    if (description.length > 1024) fail(`${rel} description is longer than 1024 characters`);
+    if (`dealdesk:${dir.name}`.length > 64) fail(`dealdesk:${dir.name} is longer than 64 characters`);
+    if (!text.slice(front[0].length).trim()) fail(`${rel} has no instructions`);
+  }
+}
+
+function main() {
+  const pkg = readJson('package.json');
+  assertVersions(pkg.version);
+  assertSkills();
+
+  const manifest = readJson('plugin.json');
+  if (manifest.name !== 'dealdesk') fail(`plugin name must be dealdesk, found ${manifest.name}`);
+  if (manifest.version !== pkg.version) fail('plugin.json version does not match package.json');
+
+  const mcp = readJson('mcp.json');
+  const server = mcp.mcpServers && mcp.mcpServers.dealdesk;
+  if (!server || server.type !== 'streamable-http' || server.url !== MCP_URL) {
+    fail(`mcp.json must declare dealdesk as streamable-http at ${MCP_URL}`);
+  }
+
+  const logo = fs.readFileSync(path.join(root, 'assets', 'logo.svg'), 'utf8');
+  if (!/viewBox="0 0 128 128"/.test(logo)) fail('assets/logo.svg must be a square 128×128 SVG');
+
+  const names = INCLUDE.flatMap((rel) => walk(rel)).sort();
+  const files = names.map((name) => ({
+    name,
+    data: fs.readFileSync(path.join(root, ...name.split('/'))),
+  }));
+
+  const zip = createZip(files);
+  const outDir = path.join(root, 'dist');
+  fs.mkdirSync(outDir, { recursive: true });
+  const outName = `dealdesk-plugin-${pkg.version}.zip`;
+  fs.writeFileSync(path.join(outDir, outName), zip);
+
+  const packed = readZip(zip).map((entry) => entry.name).sort();
+  if (packed.join('\n') !== names.join('\n')) fail('ZIP entries diverged from the plugin package');
+  for (const required of ['plugin.json', 'mcp.json', '.mcp.json', 'bin/dealdesk-plugin.js', 'assets/logo.svg']) {
+    if (!packed.includes(required)) fail(`ZIP is missing ${required}`);
+  }
+  if (!packed.some((name) => name.startsWith('skills/') && name.endsWith('/SKILL.md'))) {
+    fail('ZIP is missing skills');
+  }
+  if (packed.some((name) => name.includes('\\') || name.split('/').includes('..'))) {
+    fail('ZIP contains an unsafe path');
+  }
+
+  process.stdout.write(`${outName}\n${packed.map((name) => `  ${name}`).join('\n')}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exit(1);
+}

package/scripts/test-project-scope.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const assert = require('assert');
+const { pickProjectId } = require('../bin/dealdesk-plugin');
+
+const many = pickProjectId({
+    projectId: 'AGENTHOUSE01',
+    projectIds: ['AGENTHOUSE01', 'NERI001']
+});
+assert.strictEqual(many.ambiguous, true);
+assert.deepStrictEqual(many.ids, ['AGENTHOUSE01', 'NERI001']);
+
+const snake = pickProjectId({
+    project_id: 'AGENTHOUSE01',
+    project_ids: ['AGENTHOUSE01', 'NERI001']
+});
+assert.strictEqual(snake.ambiguous, true);
+
+const single = pickProjectId({
+    projectId: 'DEMO01',
+    projectIds: ['DEMO01']
+});
+assert.strictEqual(single.id, 'DEMO01');
+assert.ok(!single.ambiguous);
+
+const primaryOnly = pickProjectId({ projectId: 'DEMO01' });
+assert.strictEqual(primaryOnly.id, 'DEMO01');
+
+console.log('ok - pickProjectId treats multiple projectIds as ambiguous');

package/scripts/validate-npm-release.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const fs = require('fs');
+const assert = require('assert');
+
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+assert.equal(pkg.name, 'dealdesk-plugin', 'Unexpected npm package name');
+assert.equal(pkg.publishConfig && pkg.publishConfig.access, 'public');
+assert.equal(pkg.publishConfig && pkg.publishConfig.registry, 'https://registry.npmjs.org/');
+assert.match(pkg.version, /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/, 'Invalid release version');
+
+if (process.env.GITHUB_EVENT_NAME === 'release') {
+  assert.equal(process.env.RELEASE_TAG, `v${pkg.version}`, 'Release tag must match package.json version');
+  assert.equal(
+    process.env.RELEASE_PRERELEASE === 'true',
+    pkg.version.includes('-'),
+    'GitHub prerelease flag must match the npm prerelease version',
+  );
+} else {
+  assert.equal(process.env.GITHUB_EVENT_NAME, 'workflow_dispatch', 'Unsupported publishing event');
+}
+
+process.stdout.write(`Validated ${pkg.name}@${pkg.version}\n`);

package/scripts/validate-skills.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * SKILL.md consumability check:
+ * - each skill must be <= 100 lines, OR
+ * - contain a "## Contents" section (for longer progressive-disclosure skills)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const skillsRoot = path.join(__dirname, '..', 'skills');
+const dirs = fs.readdirSync(skillsRoot, { withFileTypes: true }).filter((d) => d.isDirectory());
+
+let failed = 0;
+const rows = [];
+
+for (const dir of dirs) {
+  const skillPath = path.join(skillsRoot, dir.name, 'SKILL.md');
+  if (!fs.existsSync(skillPath)) {
+    rows.push({ skill: dir.name, ok: false, reason: 'missing SKILL.md' });
+    failed += 1;
+    continue;
+  }
+  if (!/^dealdesk-[a-z0-9-]{1,54}$/.test(dir.name)) {
+    rows.push({ skill: dir.name, ok: false, reason: 'folder must be dealdesk-<name>' });
+    failed += 1;
+    continue;
+  }
+  const text = fs.readFileSync(skillPath, 'utf8');
+  const name = (text.match(/^name:\s*(.+)\s*$/m) || [])[1];
+  if (name !== dir.name) {
+    rows.push({ skill: dir.name, ok: false, reason: `frontmatter name ${name || '(missing)'} != folder` });
+    failed += 1;
+    continue;
+  }
+  const lines = text.split(/\r?\n/).length;
+  const hasContents = /^## Contents\s*$/m.test(text);
+  const ok = lines <= 100 || hasContents;
+  const reason = lines <= 100
+    ? `<=100 lines (${lines})`
+    : hasContents
+      ? `has ## Contents (${lines} lines)`
+      : `FAIL: ${lines} lines, no ## Contents`;
+  if (!ok) failed += 1;
+  rows.push({ skill: dir.name, ok, reason });
+}
+
+for (const row of rows) {
+  const mark = row.ok ? 'PASS' : 'FAIL';
+  process.stdout.write(`${mark}\t${row.skill}\t${row.reason}\n`);
+}
+
+process.stdout.write(`\n${rows.length - failed} passed, ${failed} failed\n`);
+process.exit(failed ? 1 : 0);

package/scripts/version-files.js

@@ -0,0 +1,10 @@
+'use strict';
+
+/** Manifests that must share one semantic version. */
+module.exports = [
+  'package.json',
+  'plugin.json',
+  '.codex-plugin/plugin.json',
+  '.claude-plugin/plugin.json',
+  '.cursor-plugin/plugin.json',
+];