dsh-agent-plugins-market 0.6.0 → 0.6.2

package/schemas/github-copilot/spec.md

@@ -0,0 +1,105 @@
+# GitHub Copilot CLI plugin and marketplace specification
+
+Reference contract for GitHub Copilot CLI plugin repositories. Machine-readable companions: [plugin.schema.json](plugin.schema.json) and [marketplace.schema.json](marketplace.schema.json).
+
+- **Verified:** 2026-09-08.
+- **Evidence:** official documentation [`CLI plugin reference`](https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-plugin-reference) and [`Creating a plugin marketplace for GitHub Copilot CLI`](https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-cli/customize-copilot/plugins-marketplace), read from the raw markdown in `github/docs`.
+- **Upstream JSON Schema:** none for these manifests. Copilot CLI additionally supports the agent-plugins.org v1.0.0 schema when `plugin.json` declares its `$schema`.
+- **Note:** `.plugin/plugin.json` is first in Copilot's plugin lookup order, which is why the [universal layout](../universal/spec.md) works here.
+
+## Manifest locations and precedence
+
+| Artifact             | Lookup order                                                                                                            |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| Plugin manifest      | `.plugin/plugin.json` → `plugin.json` → `.github/plugin/plugin.json` → `.claude-plugin/plugin.json`                     |
+| Marketplace manifest | `marketplace.json` → `.plugin/marketplace.json` → `.github/plugin/marketplace.json` → `.claude-plugin/marketplace.json` |
+| Agents               | `agents/` (default, overridable)                                                                                        |
+| Skills               | `skills/` (default, overridable)                                                                                        |
+| Hooks                | `hooks.json` or `hooks/hooks.json`                                                                                      |
+| MCP                  | `.mcp.json`, `.github/mcp.json`                                                                                         |
+| LSP                  | `lsp.json` or `.github/lsp.json`                                                                                        |
+| Plugin data          | `${COPILOT_PLUGIN_DATA}` (also `${CLAUDE_PLUGIN_DATA}`)                                                                 |
+
+Installed plugins live under `~/.copilot/installed-plugins/<MARKETPLACE>/<PLUGIN>` (or `_direct/<SOURCE-ID>` for direct installs); the marketplace cache is the platform cache directory, overridable with `COPILOT_CACHE_HOME`.
+
+## Plugin manifest (`plugin.json`)
+
+Required: `name` — kebab-case, letters/numbers/hyphens only, max 64 chars. Plugins opting into Open Plugin Spec support may also use dots.
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `$schema` | string | — | Set to the agent-plugins.org v1.0.0 schema URL to opt into spec semantics, additively. |
+| `description` | string | — | Max 1024 chars. |
+| `version` | string | — | Semantic version. |
+| `author` | `{name, email?, url?}` | — | `name` required. |
+| `homepage`, `repository`, `license` | string | — |  |
+| `keywords` | string[] | — |  |
+| `category`, `tags` | string, string[] | — |  |
+| `agents` | string \| string[] | `agents/` | Directories of `.agent.md` files. |
+| `skills` | string \| string[] | `skills/` | Directories of `SKILL.md` files. |
+| `commands` | string \| string[] | — | Command directories. |
+| `hooks` | string \| object | — | Configuration path or inline hooks object. |
+| `extensions` | string \| string[] \| object | — | Extension directories, or `{paths: [...], exclusive: true}`. Different meaning in Open Plugin Spec mode. |
+| `mcpServers` | string \| object | — | Path to a JSON config file (for example `.mcp.json`), or inline servers. |
+| `lspServers` | string \| object | — | Path to an LSP config file, or inline definitions. |
+
+LSP server entries require at least one of `command`, `bash`, or `powershell` plus `fileExtensions`; optional keys are `cwd`, `args`, `env`, `rootUri`, `initializationOptions`. Use `${PLUGIN_ROOT}` for plugin-relative paths.
+
+## Marketplace manifest (`marketplace.json`)
+
+Required: `name`, `owner`, `plugins`.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `name` | string | Kebab-case, max 64 chars; dots accepted for Open Plugin Spec plugins. The marketplace's own name becomes its registration key. |
+| `owner` | `{name, email?}` |  |
+| `plugins` | array |  |
+| `metadata` | `{description?, version?, pluginRoot?}` |  |
+
+Plugin entries:
+
+| Field                                          | Type                   | Notes                                                                                     |
+| ---------------------------------------------- | ---------------------- | ----------------------------------------------------------------------------------------- |
+| `name`                                         | string                 | Required; kebab-case, max 64 chars.                                                       |
+| `source`                                       | string \| object       | Required.                                                                                 |
+| `description`                                  | string                 | Max 1024 chars.                                                                           |
+| `version`, `homepage`, `repository`, `license` | string                 |                                                                                           |
+| `author`                                       | `{name, email?, url?}` |                                                                                           |
+| `keywords`, `tags`                             | string[]               |                                                                                           |
+| `category`                                     | string                 |                                                                                           |
+| `commands`, `agents`, `skills`                 | string \| string[]     |                                                                                           |
+| `hooks`                                        | string \| object       |                                                                                           |
+| `mcpServers`                                   | string \| object       | Inline map or config path, used when the plugin source ships no MCP configuration.        |
+| `lspServers`                                   | string \| object       |                                                                                           |
+| `strict`                                       | boolean                | Default `true`; `false` enables relaxed validation for direct installs or legacy plugins. |
+
+Sources accept a relative path string, or an object `{source: 'github'|'url', repo|url, ref?, sha?, path?}`. `sha` must be a full 40-character commit SHA and pins installs against force-pushes or moved tags.
+
+## Commands
+
+`copilot plugin install SPECIFICATION` accepts `plugin@marketplace`, `OWNER/REPO`, `OWNER/REPO:PATH/TO/PLUGIN`, a Git URL, or a local path. `copilot plugin marketplace add SOURCE` accepts `owner/repo`, `owner/repo#ref`, a URL, or a local path. Built-in `copilot-plugins` and `awesome-copilot` marketplaces cannot be removed and auto-update at session start unless `autoUpdate` is false or `COPILOT_AUTO_UPDATE=false`; a user-added marketplace opts in with `autoUpdate: true` on its `extraKnownMarketplaces` entry.
+
+## Loading precedence
+
+- **Agents and skills: first-found wins.** A project-level agent or skill with the same name shadows the plugin's. Agents deduplicate by file-derived id; skills by their `SKILL.md` `name`.
+- **MCP servers: last-wins.** A plugin's definition overrides an existing server of the same name; `--additional-mcp-config` overrides everything; when two plugins declare the same name the last loaded wins and every prior plugin is named in a warning.
+- **Built-in tools and agents** cannot be overridden.
+
+## Directory layout
+
+```text
+my-plugin/
+├── .plugin/plugin.json         # or plugin.json / .github/plugin/plugin.json / .claude-plugin/plugin.json
+├── agents/                     # *.agent.md
+├── skills/<name>/SKILL.md
+├── commands/
+├── hooks.json or hooks/hooks.json
+├── .mcp.json or .github/mcp.json
+└── lsp.json or .github/lsp.json
+```
+
+## Evidence gaps
+
+1. The documentation does not state what happens when several manifest paths exist simultaneously beyond the ordered list.
+2. Open Plugin Spec mode changes the meaning of `extensions`; the exact spec-mode field set is defined upstream at agent-plugins.org.
+3. `strict: false` is described as "relaxed validation" without an enumerated relaxed rule set.

package/schemas/kimi/marketplace.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/kimi/marketplace.schema.json",
+  "title": "Kimi Code Marketplace Manifest",
+  "description": "Marketplace catalog for the current Kimi CLI (kimi-code). The default catalog is https://code.kimi.com/kimi-code/plugins/marketplace.json, overridable with the KIMI_CODE_PLUGIN_MARKETPLACE_URL environment variable or /plugins marketplace <source>. Authored from MoonshotAI's official source; Kimi publishes no JSON Schema.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: MoonshotAI/kimi-code docs/en/customization/plugins.md and packages/agent-core-v2/src/app/plugin/marketplace.ts. Relative sources resolve against the marketplace URL when remote, or against the marketplace file's directory when local. The legacy kimi-cli has no marketplace.",
+  "type": "object",
+  "properties": {
+    "version": { "type": "string", "description": "Used for update checks via semantic version comparison." },
+    "plugins": { "type": "array", "items": { "$ref": "#/$defs/entry" }, "description": "Plugin catalog entries; required." }
+  },
+  "required": ["plugins"],
+  "additionalProperties": true,
+  "$defs": {
+    "entry": {
+      "type": "object",
+      "properties": {
+        "id": { "type": "string", "description": "Registration key." },
+        "source": { "type": "string", "description": "Plugin location. Aliases url and downloadUrl are accepted; the first non-empty value wins." },
+        "url": { "type": "string", "description": "Alias of source." },
+        "downloadUrl": { "type": "string", "description": "Alias of source." },
+        "displayName": { "type": "string", "description": "Falls back to name, then id. Alias name is accepted." },
+        "name": { "type": "string", "description": "Alias of displayName." },
+        "tier": { "enum": ["official", "curated"] },
+        "version": { "type": "string", "description": "Derived from a GitHub tree, commit, or releases/tag URL when present." },
+        "description": { "type": "string", "description": "Alias shortDescription is accepted." },
+        "shortDescription": { "type": "string", "description": "Alias of description." },
+        "homepage": { "type": "string", "description": "Alias websiteURL is accepted." },
+        "websiteURL": { "type": "string", "description": "Alias of homepage." },
+        "keywords": { "type": "array", "items": { "type": "string" } },
+        "type": { "type": "string", "description": "plugin; legacy aliases managed and guide are accepted." },
+        "builtIn": { "type": "boolean", "description": "Declared in the TypeScript interface but not read by the parser." }
+      },
+      "required": ["id", "source"],
+      "additionalProperties": true
+    }
+  }
+}

package/schemas/kimi/plugin.schema.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/kimi/plugin.schema.json",
+  "title": "Kimi Code Plugin Manifest",
+  "description": "Plugin manifest for the current Kimi CLI (kimi-code), looked up as kimi.plugin.json then .kimi-plugin/plugin.json in the plugin root. Authored from MoonshotAI's official documentation and source; Kimi publishes no reachable JSON Schema (its shipped manifest declares https://kimi.com/schemas/kimi.plugin.schema.json, which serves HTML).",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: MoonshotAI/kimi-code docs/en/customization/plugins.md and packages/agent-core-v2/src/app/plugin/{manifest,types,marketplace}.ts. The legacy MoonshotAI/kimi-cli plugin system is a different format: root plugin.json with a tools array, no marketplace, no skills/agents components (see spec.md). fields listed in UNSUPPORTED_RUNTIME_FIELDS (tools, apps, inject, configFile, config_file, bootstrap) emit an info diagnostic and are ignored.",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$",
+      "description": "Plugin identifier; normalized to lowercase. The only field whose failure invalidates the manifest."
+    },
+    "version": { "type": "string", "description": "Display metadata." },
+    "description": { "type": "string" },
+    "keywords": { "type": "array", "items": { "type": "string" } },
+    "author": {
+      "description": "Author as a bare name or a structured record; a bare string is coerced to { name }.",
+      "anyOf": [
+        { "type": "string" },
+        {
+          "type": "object",
+          "properties": { "name": { "type": "string" }, "email": { "type": "string" } },
+          "additionalProperties": true
+        }
+      ]
+    },
+    "homepage": { "type": "string" },
+    "license": { "type": "string" },
+    "skills": { "$ref": "#/$defs/pathList", "description": "./-prefixed paths that must resolve inside the plugin root. Defaults to a root SKILL.md when present." },
+    "agents": { "$ref": "#/$defs/pathList", "description": "./-prefixed paths to agent files. agents/ is auto-discovered when omitted." },
+    "sessionStart": {
+      "type": "object",
+      "description": "Loads a named plugin skill at new or resumed session start.",
+      "properties": { "skill": { "type": "string" } },
+      "required": ["skill"],
+      "additionalProperties": true
+    },
+    "skillInstructions": { "type": "string", "description": "Extra instructions appended whenever a skill from this plugin loads." },
+    "systemPrompt": { "type": "string", "description": "Inline system-prompt contribution; capped at 32 KB." },
+    "systemPromptPath": { "type": "string", "description": "./ path to a UTF-8 text file appended after systemPrompt; capped at 32 KB and read at install or reload." },
+    "mcpServers": {
+      "type": "object",
+      "description": "Inline MCP server map. Kimi declares MCP only inline; there is no .mcp.json companion file. A command containing / must start with ./."
+    },
+    "hooks": { "type": "array", "description": "Inline hook definitions; there is no hooks/hooks.json convention.", "items": { "$ref": "#/$defs/hook" } },
+    "commands": { "$ref": "#/$defs/pathList", "description": "./ directories or .md files exposed as slash commands namespaced <plugin>:<command>." },
+    "interface": {
+      "type": "object",
+      "description": "Listing metadata; dropped entirely when every field is absent.",
+      "properties": {
+        "displayName": { "type": "string" },
+        "shortDescription": { "type": "string" },
+        "longDescription": { "type": "string" },
+        "developerName": { "type": "string" },
+        "websiteURL": { "type": "string" }
+      },
+      "additionalProperties": true
+    },
+    "tools": { "description": "Legacy kimi-cli field; emits an info diagnostic and is ignored by kimi-code." },
+    "apps": { "description": "Unsupported runtime field; ignored." },
+    "inject": { "description": "Unsupported runtime field; ignored." },
+    "configFile": { "description": "Unsupported runtime field; ignored." },
+    "config_file": { "description": "Unsupported runtime field; ignored." },
+    "bootstrap": { "description": "Unsupported runtime field; ignored." }
+  },
+  "required": ["name"],
+  "additionalProperties": true,
+  "$defs": {
+    "pathList": {
+      "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
+    },
+    "hook": {
+      "type": "object",
+      "properties": {
+        "event": { "type": "string" },
+        "matcher": { "type": "string" },
+        "command": { "type": "string" },
+        "timeout": { "type": "number" }
+      },
+      "additionalProperties": true
+    }
+  }
+}

package/schemas/kimi/spec.md

@@ -0,0 +1,94 @@
+# Kimi plugin and marketplace specification
+
+Reference contract for Kimi plugin repositories. Machine-readable companions: [plugin.schema.json](plugin.schema.json) and [marketplace.schema.json](marketplace.schema.json), both describing the current **kimi-code** CLI.
+
+- **Verified:** 2026-09-08.
+- **Evidence:** `MoonshotAI/kimi-code` `docs/en/customization/plugins.md` and `packages/agent-core-v2/src/app/plugin/{manifest,types,marketplace}.ts`; `MoonshotAI/kimi-cli` `docs/en/customization/plugins.md` and `src/kimi_cli/plugin/__init__.py`.
+- **Upstream JSON Schema:** none reachable. MoonshotAI's own shipped plugin declares `$schema: https://kimi.com/schemas/kimi.plugin.schema.json`, but that URL serves the Kimi homepage HTML, not a schema.
+- **Critical scoping note:** MoonshotAI ships **two non-overlapping plugin systems**. `.kimi-plugin/plugin.json` is officially documented — by `kimi-code`, not by the `kimi-cli` repository that older research cites. Their field sets are disjoint.
+
+## kimi-code (current): manifest locations
+
+| #   | Path                       | Notes                                                                          |
+| --- | -------------------------- | ------------------------------------------------------------------------------ |
+| 1   | `kimi.plugin.json`         | Wins when both exist; the other becomes `shadowedManifestPath` in diagnostics. |
+| 2   | `.kimi-plugin/plugin.json` | Compatibility layout.                                                          |
+
+When neither exists, a diagnostic reports `No manifest at kimi.plugin.json or .kimi-plugin/plugin.json`.
+
+## kimi-code plugin manifest
+
+Required: `name` (`^[a-z0-9][a-z0-9_-]{0,63}$`, normalized to lowercase). Only `name` invalidates the manifest; every other problem degrades to a diagnostic.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `version`, `description`, `homepage`, `license` | string | Display metadata. |
+| `keywords` | string[] |  |
+| `author` | string \| `{name?, email?}` | A bare string is coerced to `{name}`. |
+| `skills` | string \| string[] | `./`-prefixed paths that must resolve inside the plugin root; defaults to a root `SKILL.md` when present. |
+| `agents` | string \| string[] | `./`-prefixed agent files; `agents/` is auto-discovered when omitted. |
+| `commands` | string \| string[] | `./` directories or `.md` files exposed as `/<plugin>:<command>`. |
+| `sessionStart` | `{skill}` | Loads a named plugin skill at new or resumed session start. |
+| `skillInstructions` | string | Extra instructions appended whenever a plugin skill loads. |
+| `systemPrompt` | string | Inline system-prompt contribution; 32 KB cap. |
+| `systemPromptPath` | string | `./` path to UTF-8 text appended after `systemPrompt`; 32 KB cap; read at install or reload. |
+| `mcpServers` | object | Inline server map. A `command` containing `/` must start with `./`; `cwd` must be `./`-relative. |
+| `hooks` | array | Inline `{event, matcher, command, timeout}` entries. |
+| `interface` | object | `displayName`, `shortDescription`, `longDescription`, `developerName`, `websiteURL`; dropped entirely when all are absent. |
+| `tools`, `apps`, `inject`, `configFile`, `config_file`, `bootstrap` | — | Unsupported runtime fields; emit an `info` diagnostic and are ignored. |
+
+Kimi declares MCP **only inline** — there is no `.mcp.json` companion file — and there is no `hooks/hooks.json` convention, no LSP support, and no component declaration fields beyond the ones above.
+
+## kimi-code marketplace manifest
+
+Default catalog `https://code.kimi.com/kimi-code/plugins/marketplace.json`, overridable with `KIMI_CODE_PLUGIN_MARKETPLACE_URL` or `/plugins marketplace <source>`. `http(s)://` sources are remote, `file://` is a local path, and anything else is a local path resolved against the current directory. Relative entry sources resolve against the marketplace URL when remote, or the marketplace file's directory when local.
+
+Top level: `plugins` (required), `version` (optional, used for update checks).
+
+| Entry field   | Type     | Notes                                                                             |
+| ------------- | -------- | --------------------------------------------------------------------------------- |
+| `id`          | string   | Required registration key.                                                        |
+| `source`      | string   | Required. Aliases `url` and `downloadUrl` are accepted; the first non-empty wins. |
+| `displayName` | string   | Falls back to `name`, then `id`; alias `name` accepted.                           |
+| `tier`        | string   | `official` or `curated`.                                                          |
+| `version`     | string   | Derived from a GitHub `tree`, `commit`, or `releases/tag` URL when present.       |
+| `description` | string   | Alias `shortDescription` accepted.                                                |
+| `homepage`    | string   | Alias `websiteURL` accepted.                                                      |
+| `keywords`    | string[] |                                                                                   |
+| `type`        | string   | `plugin`; legacy aliases `managed` and `guide`.                                   |
+| `builtIn`     | boolean  | Declared in the TypeScript interface but not read by the parser.                  |
+
+## kimi-cli (legacy): a different format
+
+Root `plugin.json` is the only manifest path; there is no marketplace and no `.kimi-plugin/` support. The Pydantic model ignores unknown fields.
+
+| Field         | Type                   | Notes                                                                                                                        |
+| ------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| `name`        | string                 | Required; lowercase letters, numbers, hyphens.                                                                               |
+| `version`     | string                 | Required; semantic version.                                                                                                  |
+| `description` | string                 | Default `""`.                                                                                                                |
+| `config_file` | string                 | Credential injection target; required when `inject` is present.                                                              |
+| `inject`      | object                 | Maps `target.dotted.path` to a source variable (`api_key`, `base_url`).                                                      |
+| `tools`       | array                  | `{name, description, command: string[], parameters?}`; scripts read parameters as JSON on stdin and write results to stdout. |
+| `runtime`     | `{host, host_version}` | Host-written after install.                                                                                                  |
+
+Install location: `~/.kimi/plugins/<name>/`.
+
+## Directory layout (kimi-code)
+
+```text
+<plugin-root>/
+├── kimi.plugin.json            # or .kimi-plugin/plugin.json
+├── skills/                     # or a root SKILL.md
+├── agents/
+├── commands/
+├── hooks/                      # referenced by the inline hooks array
+└── SYSTEM.md                   # via systemPromptPath
+```
+
+## Evidence gaps
+
+1. The `$schema` URI declared by MoonshotAI's own plugin does not resolve to a schema.
+2. Whether kimi-code also reads a plain root `plugin.json` is unverified.
+3. The legacy `kimi-cli` has no marketplace.
+4. `builtIn` has no observed effect.

package/schemas/qoder/marketplace.schema.json

@@ -0,0 +1,115 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/qoder/marketplace.schema.json",
+  "title": "Qoder CLI Marketplace Manifest",
+  "description": "Marketplace catalog read by Qoder CLI at .qoder-plugin/marketplace.json, .claude-plugin/marketplace.json, or a repository-root marketplace.json. Authored from the official reference page and the Zod schema compiled into the shipped CLI; Qoder publishes no JSON Schema.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: https://docs.qoder.com/cli/plugins-reference ; @qoder-ai/qodercli@1.1.47 bundle/qodercli.js (marketplace schema Jji, plugin-entry schema jjt, source union bYa). The plugin-entry schema is the plugin manifest schema made optional plus name/source/category/tags/strict, so entries may carry any plugin-manifest field. metadata.pluginRoot is declared but has no consumer in the observed CLI.",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-zA-Z0-9][-a-zA-Z0-9._]*$",
+      "description": "Marketplace name; no spaces or non-ASCII characters. Reserved names and qoder-* prefixes are rejected by the CLI."
+    },
+    "owner": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "email": { "type": "string" },
+        "url": { "type": "string" }
+      },
+      "required": ["name"],
+      "additionalProperties": true
+    },
+    "plugins": { "type": "array", "items": { "$ref": "#/$defs/entry" } },
+    "forceRemoveDeletedPlugins": { "type": "boolean", "description": "Uninstall plugins removed from this marketplace." },
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "pluginRoot": { "type": "string", "description": "Declared as the base path for relative plugin sources; no consumer was found in the observed CLI." },
+        "version": { "type": "string" },
+        "description": { "type": "string" }
+      },
+      "additionalProperties": true
+    },
+    "allowCrossMarketplaceDependenciesOn": { "type": "array", "items": { "type": "string" } }
+  },
+  "required": ["name", "owner", "plugins"],
+  "additionalProperties": true,
+  "$defs": {
+    "entry": {
+      "type": "object",
+      "description": "A plugin entry. Extends the plugin manifest schema, so manifest fields are accepted here too.",
+      "properties": {
+        "name": { "type": "string", "minLength": 1, "description": "Unique identifier matching the plugin name." },
+        "source": { "$ref": "#/$defs/source" },
+        "category": { "type": "string" },
+        "tags": { "type": "array", "items": { "type": "string" } },
+        "strict": { "type": "boolean", "default": true, "description": "Require a plugin manifest in the plugin folder. When false, the marketplace entry provides the manifest." },
+        "version": { "type": "string" },
+        "description": { "type": "string" },
+        "author": {
+          "type": "object",
+          "properties": { "name": { "type": "string" }, "email": { "type": "string" }, "url": { "type": "string" } },
+          "required": ["name"],
+          "additionalProperties": true
+        },
+        "homepage": { "type": "string" },
+        "repository": { "type": "string" },
+        "license": { "type": "string" },
+        "keywords": { "type": "array", "items": { "type": "string" } },
+        "dependencies": { "type": "array", "items": {} },
+        "commands": {},
+        "agents": {},
+        "skills": {},
+        "outputStyles": {},
+        "workflowsPath": { "type": "string" },
+        "workflowsPaths": { "type": "array", "items": { "type": "string" } },
+        "hooks": {},
+        "mcpServers": {},
+        "userConfig": { "type": "object" },
+        "settings": { "type": "object" }
+      },
+      "required": ["name", "source"],
+      "additionalProperties": true
+    },
+    "source": {
+      "description": "Where to fetch the plugin. A relative path must start with ./ and is resolved against the marketplace install location.",
+      "anyOf": [
+        { "type": "string", "pattern": "^\\./" },
+        {
+          "type": "object",
+          "properties": { "source": { "enum": ["npm", "pip"] }, "package": { "type": "string" }, "version": { "type": "string" }, "registry": { "type": "string" } },
+          "required": ["source", "package"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "url" }, "url": { "type": "string" }, "ref": { "type": "string" }, "sha": { "type": "string", "pattern": "^[a-f0-9]{40}$" } },
+          "required": ["source", "url"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "github" }, "repo": { "type": "string" }, "ref": { "type": "string" }, "sha": { "type": "string", "pattern": "^[a-f0-9]{40}$" } },
+          "required": ["source", "repo"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": {
+            "source": { "const": "git-subdir" },
+            "url": { "type": "string" },
+            "path": { "type": "string" },
+            "ref": { "type": "string" },
+            "sha": { "type": "string", "pattern": "^[a-f0-9]{40}$" }
+          },
+          "required": ["source", "url", "path"],
+          "additionalProperties": true
+        }
+      ]
+    }
+  }
+}

package/schemas/qoder/plugin.schema.json

@@ -0,0 +1,127 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/qoder/plugin.schema.json",
+  "title": "Qoder CLI Plugin Manifest",
+  "description": "Plugin manifest accepted by Qoder CLI at .qoder-plugin/plugin.json, with an undocumented .claude-plugin/plugin.json fallback. Authored from the official reference page and the Zod schema compiled into the shipped CLI; Qoder publishes no JSON Schema. Unknown properties are stripped by the client, so this schema is open.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: https://docs.qoder.com/cli/plugins-reference ; @qoder-ai/qodercli@1.1.47 bundle/qodercli.js (compiled Zod schemas, lookup arrays). Component paths must start with ./ per the CLI schema. lspServers and channels are recognized but not implemented and are ignored with a warning.",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Unique identifier; non-empty and free of spaces. Kebab-case is recommended. The CLI defaults version to \"local\" and derives the name from the directory when the manifest is absent."
+    },
+    "version": { "type": "string", "description": "Semantic version. The CLI substitutes \"local\" at install time when absent." },
+    "displayName": { "type": "string", "description": "Human-readable name for UI surfaces." },
+    "description": { "type": "string" },
+    "author": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "email": { "type": "string" },
+        "url": { "type": "string" }
+      },
+      "required": ["name"],
+      "additionalProperties": true
+    },
+    "homepage": { "type": "string", "description": "Must be a valid URL." },
+    "repository": { "type": "string" },
+    "license": { "type": "string", "description": "SPDX identifier, e.g. MIT or Apache-2.0." },
+    "keywords": { "type": "array", "items": { "type": "string" } },
+    "dependencies": {
+      "type": "array",
+      "description": "Plugins that must be enabled for this plugin to work. A bare name resolves against the declaring plugin's own marketplace.",
+      "items": {
+        "anyOf": [
+          { "type": "string", "pattern": "^[a-z0-9][-a-z0-9._]*(@[a-z0-9][-a-z0-9._]*)?(@\\^[^@]*)?$" },
+          {
+            "type": "object",
+            "properties": { "name": { "type": "string" }, "marketplace": { "type": "string" } },
+            "required": ["name"],
+            "additionalProperties": true
+          }
+        ]
+      }
+    },
+    "commands": { "$ref": "#/$defs/commandComponent" },
+    "agents": { "$ref": "#/$defs/markdownComponent" },
+    "skills": { "$ref": "#/$defs/component" },
+    "outputStyles": { "$ref": "#/$defs/component", "description": "Overrides the conventional output-styles/ directory." },
+    "workflowsPath": { "$ref": "#/$defs/componentPath" },
+    "workflowsPaths": { "type": "array", "items": { "$ref": "#/$defs/componentPath" } },
+    "hooks": { "$ref": "#/$defs/jsonComponent" },
+    "mcpServers": { "$ref": "#/$defs/jsonComponent" },
+    "userConfig": {
+      "type": "object",
+      "description": "User-configurable values prompted at enable time. Keys must match ^[A-Za-z_]\\w*$.",
+      "propertyNames": { "pattern": "^[A-Za-z_]\\w*$" },
+      "additionalProperties": { "$ref": "#/$defs/userConfigOption" }
+    },
+    "settings": {
+      "type": "object",
+      "description": "Settings merged when the plugin is enabled. Only the allowlisted key \"agent\" is kept; other keys are ignored."
+    },
+    "lspServers": { "description": "Recognized but not implemented in the observed CLI; warned and ignored." },
+    "channels": { "description": "Recognized but not implemented in the observed CLI; warned and ignored." }
+  },
+  "required": ["name"],
+  "additionalProperties": true,
+  "$defs": {
+    "componentPath": { "type": "string", "pattern": "^\\." },
+    "component": {
+      "description": "A plugin-relative path, an array of paths, or an object map.",
+      "anyOf": [{ "$ref": "#/$defs/componentPath" }, { "type": "array", "items": { "$ref": "#/$defs/componentPath" } }, { "type": "object" }]
+    },
+    "markdownComponent": {
+      "description": "Agent definitions; every declared path must end in .md.",
+      "anyOf": [
+        { "type": "string", "pattern": "^\\..*\\.md$" },
+        { "type": "array", "items": { "type": "string", "pattern": "^\\..*\\.md$" } }
+      ]
+    },
+    "jsonComponent": {
+      "description": "Configuration declared as a plugin-relative .json path, an inline object, or an array mixing both.",
+      "anyOf": [{ "type": "string", "pattern": "^\\..*\\.json$" }, { "type": "object" }, { "type": "array" }]
+    },
+    "commandComponent": {
+      "description": "Command definitions: paths, an array of paths, or an object mapping command names to inline definitions.",
+      "anyOf": [
+        { "$ref": "#/$defs/componentPath" },
+        { "type": "array", "items": { "$ref": "#/$defs/componentPath" } },
+        { "type": "object", "additionalProperties": { "$ref": "#/$defs/commandDefinition" } }
+      ]
+    },
+    "commandDefinition": {
+      "type": "object",
+      "properties": {
+        "source": { "type": "string", "description": "Mutually exclusive with content." },
+        "content": { "type": "string", "description": "Mutually exclusive with source." },
+        "description": { "type": "string" },
+        "argumentHint": { "type": "string" },
+        "model": { "type": "string" },
+        "allowedTools": { "type": "array", "items": { "type": "string" } },
+        "context": { "enum": ["inline", "fork"] },
+        "arguments": { "type": "array", "items": { "type": "string" } },
+        "effort": { "type": "string" },
+        "agent": { "type": "string" }
+      },
+      "additionalProperties": true
+    },
+    "userConfigOption": {
+      "type": "object",
+      "properties": {
+        "type": { "enum": ["string", "number", "boolean", "directory", "file"] },
+        "title": { "type": "string" },
+        "description": { "type": "string" },
+        "required": { "type": "boolean" },
+        "default": {},
+        "multiple": { "type": "boolean" },
+        "sensitive": { "type": "boolean" },
+        "min": { "type": "number" },
+        "max": { "type": "number" }
+      },
+      "required": ["title", "description"],
+      "additionalProperties": false
+    }
+  }
+}