dsh-agent-plugins-market 0.6.0 → 0.6.2

package/schemas/qoder/spec.md

@@ -0,0 +1,111 @@
+# Qoder CLI plugin and marketplace specification
+
+Reference contract for Qoder CLI plugin repositories. Machine-readable companions: [plugin.schema.json](plugin.schema.json) and [marketplace.schema.json](marketplace.schema.json).
+
+- **Verified:** 2026-09-08 against `@qoder-ai/qodercli@1.1.47`.
+- **Evidence:** official reference pages [`docs.qoder.com/cli/plugins-reference`](https://docs.qoder.com/cli/plugins-reference), [`/cli/plugins`](https://docs.qoder.com/cli/plugins), `/cli/settings-reference`, `/cli/config-scope`; the compiled Zod schemas and path-resolution code inside the shipped `bundle/qodercli.js`; the first-party manifest `bundle/vendor/qoder-security/.qoder-plugin/plugin.json`; third-party catalogs (`apify/apify-qoder-plugin`, `qoder-plugins/oh-my-qoder`, `HarmonyOS-AI/HarmonyOS-Plugins`, `superbasedapp/plugins`).
+- **Upstream JSON Schema:** none. Neither Zod schema declares `$schema`, and every probed schema URL returns 404. Qoder's interop mechanism is Claude Code compatibility, not agent-plugins.org.
+- **Official marketplace repository:** `QoderAI/qoder-plugins-official` exists but is empty (no branches, no commits).
+
+## Manifest locations and precedence
+
+| Artifact | Lookup order | Evidence |
+| --- | --- | --- |
+| Plugin manifest | `.qoder-plugin/plugin.json` → `.claude-plugin/plugin.json` | CLI resolver array `[".qoder-plugin", ".claude-plugin"]`; the `.claude-plugin` fallback is undocumented. There is no root-level fallback. |
+| Marketplace manifest | `.qoder-plugin/marketplace.json` → `.claude-plugin/marketplace.json` → `marketplace.json` → the supplied path as a JSON file | CLI `Fdr()`; a second cache-write path checks only the first and third, so a marketplace shipping only `.claude-plugin/marketplace.json` installs but is not cached. |
+| MCP configuration | `.mcp.json` → `mcp.json` | Documented and implemented; never merged. |
+| Hooks configuration | `hooks/hooks.json`, needing the `{"hooks": {…}}` wrapper | Docs. |
+
+The plugin manifest is optional; without it the CLI uses the directory name and the literal version `"local"`.
+
+## Plugin manifest (`plugin.json`)
+
+Required: `name` (non-empty, no spaces). Every component path must begin with `./`.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `name` | string | Unique identifier. |
+| `version` | string | Defaults to `"local"` at install time. |
+| `displayName`, `description` | string |  |
+| `author` | `{name, email?, url?}` | `name` required. |
+| `homepage` | string | Must be a valid URL. |
+| `repository`, `license` | string | `license` is an SPDX id. |
+| `keywords` | string[] |  |
+| `dependencies` | (string \| `{name, marketplace?}`)[] | Bare names resolve against the declaring plugin's own marketplace. |
+| `commands` | string \| string[] \| object | Object form maps a name to `{source?, content?, description?, argumentHint?, model?, allowedTools?, context?: 'inline'\|'fork', arguments?, effort?, agent?}`; `source` and `content` are mutually exclusive. |
+| `agents` | string \| string[] | Paths must end in `.md`. |
+| `skills` | string \| string[] |  |
+| `outputStyles` | string \| string[] | Overrides the `output-styles/` directory. |
+| `workflowsPath` / `workflowsPaths` | string / string[] |  |
+| `hooks` | string \| object \| array | A string must end in `.json`. |
+| `mcpServers` | string \| object \| array | A string must end in `.json`; an object is keyed by server name. |
+| `userConfig` | object | Keys `^[A-Za-z_]\w*$`; values are strict: `{type: 'string'\|'number'\|'boolean'\|'directory'\|'file', title, description, required?, default?, multiple?, sensitive?, min?, max?}`. |
+| `settings` | object | Only the allowlisted key `agent` is kept. |
+| `lspServers`, `channels` | any | Recognized but not implemented; warned and ignored. |
+
+Unknown keys are stripped (the manifest schema is non-strict).
+
+## Marketplace manifest (`marketplace.json`)
+
+Required: `name`, `owner`, `plugins`.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `name` | string | 1–100 chars, `^[a-z0-9][-a-z0-9._]*$` case-insensitive, no spaces or non-ASCII. Reserved names and `qoder-*` prefixes are rejected. |
+| `owner` | `{name, email?, url?}` |  |
+| `plugins` | array |  |
+| `forceRemoveDeletedPlugins` | boolean | Uninstalls plugins removed from the marketplace. |
+| `metadata` | `{pluginRoot?, version?, description?}` | `pluginRoot` is declared as the base path for relative sources but has no consumer in the observed CLI. |
+| `allowCrossMarketplaceDependenciesOn` | string[] |  |
+
+Plugin entries are the plugin-manifest schema made optional, plus:
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `name` | string | Required; must match the plugin manifest name. |
+| `source` | string \| object | Required. |
+| `category`, `tags` | string, string[] |  |
+| `strict` | boolean | Default `true`. When `false`, the marketplace entry provides the manifest. |
+| inherited manifest fields | — | `description`, `version`, `author`, `homepage`, `repository`, `license`, `keywords`, `dependencies`, and every component field are accepted on the entry. |
+
+Top-level `description`/`version` are not in the schema and are silently dropped — use `metadata.*`.
+
+## Plugin sources
+
+| Form                                                   | Notes                             |
+| ------------------------------------------------------ | --------------------------------- |
+| `"./plugins/foo"`                                      | Relative to the marketplace root. |
+| `{source: 'npm'\|'pip', package, version?, registry?}` |                                   |
+| `{source: 'url', url, ref?, sha?}`                     |                                   |
+| `{source: 'github', repo, ref?, sha?}`                 |                                   |
+| `{source: 'git-subdir', url, path, ref?, sha?}`        |                                   |
+
+`sha` must be a full 40-character lowercase hex commit. Marketplace registration (`qoder plugins marketplace add`) classifies `user@host:path`, git URLs, `github.com/owner/repo`, other HTTP(S) URLs, local `.json` files, existing directories, and `owner/repo[#ref]`.
+
+## Directory layout
+
+```text
+plugin-name/
+├── .qoder-plugin/plugin.json   # manifest (optional; must not be in the plugin root)
+├── commands/                   # .md, nested directories allowed
+├── agents/                     # .md
+├── skills/<name>/SKILL.md
+├── hooks/hooks.json
+├── output-styles/
+├── workflows/
+├── bin/                        # added to PATH
+└── .mcp.json                   # mcp.json is a fallback only
+```
+
+Marketplace repositories place the catalog at the repository root (`.qoder-plugin/marketplace.json`) with plugin directories beside it. On-disk state lives under `$QODER_PLUGIN_CACHE_DIR` or `<configDir>/plugins`, where `configDir` is `$QODER_CONFIG_DIR` or `~/.qoder`: `marketplaces/<name>.json`, `known_marketplaces.json`, `installed_plugins.json`, `installed_plugins_v2.json`, `cache/`.
+
+Hook environment: `QODER_PLUGIN_ROOT`, `QODER_PLUGIN_DATA`, and the undocumented `CLAUDE_PLUGIN_ROOT` / `CLAUDE_PLUGIN_DATA`.
+
+## Evidence gaps
+
+1. `metadata.pluginRoot` is declared but unimplemented.
+2. The `strict: false` manifest-synthesis path was not traced.
+3. `lspServers` and `channels` are typed `unknown` and explicitly ignored.
+4. Docs drift: the CLI has a `managed` install scope, both `.claude-plugin/*` fallbacks, and the settings keys `pluginConfigs`, `extraKnownMarketplaces`, `blockedMarketplaces`, `strictKnownMarketplaces`.
+5. The first-party manifest's `logo`, `category`, and `tags` are absent from the schema and unread by the CLI.
+6. Marketplace `source: 'npm'` throws "not yet implemented" even though the plugin-level npm source works.

package/schemas/skill-collection/spec.md

@@ -0,0 +1,29 @@
+# Manifest-less skill collection layout
+
+Reference contract for repositories that ship skills without any plugin manifest.
+
+- **Schema:** none, because there is no manifest to validate. The unit of validation is the `SKILL.md` frontmatter, which is parsed by `src/catalog/skills-parse.ts`.
+- **Status:** this is a discovery convention of this plugin and of the Agent Skills ecosystem, not a vendor-published plugin format.
+- **Evidence:** the shared scanning rules in `src/catalog/scan-resolvers.ts`; upstream Agent Skills documentation at https://code.claude.com/docs/en/skills and https://developers.openai.com/codex/skills.
+
+## Qualification
+
+A source directory qualifies as a manifest-less skill collection only after skill discovery finds at least one skill. It does not qualify from directory shape alone, so an unrelated repository is not scanned as a suite.
+
+## Recognized layouts
+
+| Layout                          | Meaning                                                                       |
+| ------------------------------- | ----------------------------------------------------------------------------- |
+| `<root>/SKILL.md`               | Single-skill plugin; the directory is the skill.                              |
+| `<root>/skills/<name>/SKILL.md` | Skill collection; each immediate subdirectory with a `SKILL.md` is one skill. |
+| `<root>/skills/*.md`            | Flat skill files, when the consumer supports them.                            |
+
+`SKILL.md` frontmatter carries `name` and `description`; user-invocable skills surface as `/` entries in chat, and skills may restrict manual invocation.
+
+## Surfaces
+
+Because there is no manifest, component locations are the shared scanning conventions only: files directly under `agents/*.md` and `commands/*.md`, `hooks/hooks.json` or root `hooks.json` (Claude Code command-hook subset), and MCP files (`mcp.json`, `.mcp.json`, or inline manifest `mcpServers`, which does not exist here). LSP is preview-only because there is no manifest `lspServers` to validate.
+
+## Relationship to other dialects
+
+A repository can be manifest-less and still carry the same component directories as a plugin repository. The difference is identity: without a manifest, the suite name comes from the directory basename and no version, author, or dependency metadata is available. Adding any of the manifests in this directory upgrades the same tree to that dialect without moving files.

package/schemas/universal/marketplace.schema.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/universal/marketplace.schema.json",
+  "title": "Universal .plugin/ Marketplace Manifest (observed convention)",
+  "description": "Marketplace catalog at .plugin/marketplace.json, read by the OpenHands SDK (after .plugin/, before .claude-plugin/) and by GitHub Copilot CLI (second in its lookup order). There is no cross-vendor specification for this location; this schema is the union of the two consumers' field sets. Authored; nothing upstream is vendored.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: OpenHands/software-agent-sdk openhands/sdk/plugin/format/claude_code.py (MARKETPLACE_MANIFEST_DIRS = ['.plugin', '.claude-plugin']) ; https://docs.openhands.dev/sdk/guides/plugins ; https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-plugin-reference. OpenHands requires name and owner and treats plugins and skills as separate lists; Copilot CLI requires name, owner, and plugins.",
+  "type": "object",
+  "properties": {
+    "name": { "type": "string" },
+    "owner": {
+      "type": "object",
+      "properties": { "name": { "type": "string" }, "email": { "type": "string" }, "url": { "type": "string" } },
+      "required": ["name"],
+      "additionalProperties": true
+    },
+    "description": { "type": "string" },
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "description": { "type": "string" },
+        "version": { "type": "string" },
+        "pluginRoot": { "type": "string" }
+      },
+      "additionalProperties": true
+    },
+    "plugins": { "type": "array", "items": { "$ref": "#/$defs/entry" }, "description": "Plugin entries; required by Copilot CLI, optional (default []) for OpenHands." },
+    "skills": { "type": "array", "description": "OpenHands-only skill entries.", "items": { "$ref": "#/$defs/skillEntry" } }
+  },
+  "required": ["name", "owner"],
+  "additionalProperties": true,
+  "$defs": {
+    "entry": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string", "description": "Kebab-case plugin name." },
+        "source": { "$ref": "#/$defs/source" },
+        "description": { "type": "string" },
+        "version": { "type": "string" },
+        "author": {
+          "anyOf": [
+            { "type": "string" },
+            {
+              "type": "object",
+              "properties": { "name": { "type": "string" }, "email": { "type": "string" }, "url": { "type": "string" } },
+              "additionalProperties": true
+            }
+          ]
+        },
+        "category": { "type": "string" },
+        "tags": { "type": "array", "items": { "type": "string" } },
+        "homepage": { "type": "string" },
+        "repository": { "type": "string" },
+        "license": { "type": "string" },
+        "keywords": { "type": "array", "items": { "type": "string" } },
+        "entry_command": { "type": "string", "description": "OpenHands entry command." },
+        "strict": {
+          "type": "boolean",
+          "default": true,
+          "description": "OpenHands: true requires the source to contain plugin.json; false lets this entry define the plugin inline."
+        },
+        "commands": { "anyOf": [{ "type": "string" }, { "type": "object" }] },
+        "agents": { "anyOf": [{ "type": "string" }, { "type": "object" }] },
+        "hooks": { "anyOf": [{ "type": "string" }, { "type": "object" }] },
+        "mcpServers": { "anyOf": [{ "type": "string" }, { "type": "object" }] },
+        "lspServers": { "anyOf": [{ "type": "string" }, { "type": "object" }] }
+      },
+      "required": ["name", "source"],
+      "additionalProperties": true
+    },
+    "skillEntry": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "source": { "$ref": "#/$defs/source" },
+        "description": { "type": "string" }
+      },
+      "required": ["name", "source"],
+      "additionalProperties": true
+    },
+    "source": {
+      "description": "A local path, or an object describing a GitHub or git source.",
+      "anyOf": [
+        { "type": "string" },
+        {
+          "type": "object",
+          "properties": {
+            "source": { "type": "string" },
+            "repo": { "type": "string" },
+            "url": { "type": "string" },
+            "ref": { "type": "string" },
+            "path": { "type": "string" }
+          },
+          "additionalProperties": true
+        }
+      ]
+    }
+  }
+}

package/schemas/universal/plugin.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/universal/plugin.schema.json",
+  "title": "Universal .plugin/ Plugin Manifest (observed convention)",
+  "description": "Manifest at .plugin/plugin.json. There is no cross-vendor specification for this location: it is an observed convention implemented by GitHub Copilot CLI, the OpenHands SDK, vercel/vercel-plugin, and goose. This schema is the union of the field sets those consumers accept. Authored; nothing upstream is vendored.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-plugin-reference (.plugin/plugin.json is first in Copilot's lookup order) ; OpenHands/software-agent-sdk openhands/sdk/plugin/format/claude_code.py and docs.openhands.dev/sdk/guides/plugins ; vercel/vercel-plugin/.plugin/plugin.json ; aaif-goose/goose crates/goose/src/plugins/formats/open_plugins.rs. The originating open-plugin specification is not public (vercel-labs/plugins returns 404), so fields beyond name/version/description are unverified for any single consumer. The agent-plugins.org standard is the real cross-vendor format but mandates a root plugin.json, not .plugin/.",
+  "type": "object",
+  "properties": {
+    "name": { "type": "string", "description": "Plugin identifier." },
+    "version": { "type": "string", "description": "Required by the vercel-plugin validator; the only real .plugin/plugin.json file declares it." },
+    "description": { "type": "string", "description": "Required by the vercel-plugin validator." },
+    "author": {
+      "anyOf": [
+        { "type": "string" },
+        {
+          "type": "object",
+          "properties": { "name": { "type": "string" }, "email": { "type": "string" }, "url": { "type": "string" } },
+          "additionalProperties": true
+        }
+      ]
+    },
+    "homepage": { "type": "string" },
+    "repository": { "type": "string" },
+    "license": { "type": "string" },
+    "keywords": { "type": "array", "items": { "type": "string" } },
+    "category": { "type": "string" },
+    "tags": { "type": "array", "items": { "type": "string" } },
+    "agents": { "$ref": "#/$defs/pathList", "description": "Copilot CLI: path(s) to agent directories containing .agent.md files; default agents/." },
+    "skills": { "$ref": "#/$defs/pathList", "description": "Path(s) to skill directories containing SKILL.md; default skills/." },
+    "commands": { "$ref": "#/$defs/pathList", "description": "Path(s) to command directories." },
+    "hooks": { "anyOf": [{ "type": "string" }, { "type": "object" }], "description": "Copilot CLI reads hooks.json or hooks/hooks.json; other consumers use hooks/hooks.json." },
+    "extensions": {
+      "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }, { "type": "object" }],
+      "description": "Copilot CLI extension directories, or { paths: [...], exclusive: true }."
+    },
+    "mcpServers": {
+      "anyOf": [{ "type": "string" }, { "type": "object" }],
+      "description": "Copilot CLI and the other .plugin/ consumers read .mcp.json; the agent-plugins.org standard uses mcp.json instead."
+    },
+    "lspServers": { "anyOf": [{ "type": "string" }, { "type": "object" }], "description": "Copilot CLI: path to an LSP configuration file, or inline server definitions." }
+  },
+  "required": ["name"],
+  "additionalProperties": true,
+  "$defs": {
+    "pathList": {
+      "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
+    }
+  }
+}

package/schemas/universal/spec.md

@@ -0,0 +1,53 @@
+# Universal `.plugin/` layout specification (observed convention)
+
+Reference contract for repositories using `.plugin/plugin.json`. Machine-readable companions: [plugin.schema.json](plugin.schema.json) and [marketplace.schema.json](marketplace.schema.json).
+
+- **Verified:** 2026-09-08.
+- **Upstream specification:** **none.** `.plugin/plugin.json` is an observed convention with several independent implementers, not a published format. The originating open-plugin specification is not public (`vercel-labs/plugins` returns 404). The real cross-vendor format exists but mandates a root `plugin.json` — see [../agent-plugins/spec.md](../agent-plugins/spec.md).
+- **Evidence:** GitHub Copilot CLI official docs (`.plugin/plugin.json` is first in its lookup order); `OpenHands/software-agent-sdk` (`openhands/sdk/plugin/format/claude_code.py`, docs at `docs.openhands.dev/sdk/guides/plugins`); [`vercel/vercel-plugin`](https://github.com/vercel/vercel-plugin) (the only real `.plugin/plugin.json`, 682 bytes, with no component declaration fields); `aaif-goose/goose` (`crates/goose/src/plugins/formats/open_plugins.rs`).
+
+## Implementers and precedence
+
+| Implementer          | Lookup order                                                                                                     |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| GitHub Copilot CLI   | `.plugin/plugin.json` → `plugin.json` → `.github/plugin/plugin.json` → `.claude-plugin/plugin.json`              |
+| OpenHands SDK        | `.plugin/plugin.json` → `.claude-plugin/plugin.json`; falls back to inferring a manifest from the directory name |
+| goose                | `.goose-plugin/plugin.json` → `.plugin/plugin.json` → `plugin.json`                                              |
+| vercel/vercel-plugin | Ships `.plugin/plugin.json` only                                                                                 |
+
+Marketplace manifests: OpenHands checks `.plugin/marketplace.json` then `.claude-plugin/marketplace.json`; Copilot CLI checks `marketplace.json`, `.plugin/marketplace.json`, `.github/plugin/marketplace.json`, `.claude-plugin/marketplace.json`.
+
+## Plugin manifest fields
+
+There is no authoritative field list, so this schema is the union of the consumers. `vercel/vercel-plugin`'s validator requires `name`, `version`, and `description`; the only real file declares exactly those plus `author`, `repository`, `license`, and `keywords`, and **no component declaration fields at all** — components are discovered from directories.
+
+When Copilot CLI reads `.plugin/plugin.json`, its own manifest schema applies: `name` (required, kebab-case, max 64), `description` (max 1024), `version`, `author`, `homepage`, `repository`, `license`, `keywords`, `category`, `tags`, `agents`, `skills`, `commands`, `hooks`, `extensions`, `mcpServers`, `lspServers`.
+
+| Item | Copilot CLI | OpenHands | vercel-plugin | Agent Plugins (for contrast) |
+| --- | --- | --- | --- | --- |
+| Skills | `skills/` | `skills/<name>/SKILL.md`, flat `skills/*.md`, root `SKILL.md` | `skills/` | `skills/` (fixed) |
+| Agents | `agents/` | `agents/*.md` | `agents/` | not defined |
+| Commands | `commands/` | `commands/*.md` | `commands/` | not defined |
+| Hooks | `hooks.json` or `hooks/hooks.json` | `hooks/hooks.json` | `hooks/hooks.json` | not defined |
+| MCP | `.mcp.json`, `.github/mcp.json` | `.mcp.json` | `.mcp.json` | `mcp.json` (no dot) |
+| LSP | `lspServers`, `lsp.json`, `.github/lsp.json`, `lsp-config/servers.json` | marketplace entries only | — | not defined |
+
+## Marketplace manifest fields
+
+The two consumers require different sets:
+
+| Level | Field | OpenHands | Copilot CLI |
+| --- | --- | --- | --- |
+| top | `name` | required | required |
+| top | `owner` | required | required |
+| top | `plugins` | optional (default `[]`) | required |
+| top | `skills` | optional skill entries | — |
+| top | `description`, `metadata` | optional | optional |
+| entry | `name`, `source` | required | required |
+| entry | `strict` | default `true`; `false` lets the entry define the plugin inline | default `true` |
+| entry | component fields (`commands`, `agents`, `hooks`, `mcpServers`, `lspServers`) | declared on the entry | declared on the entry |
+| entry | metadata (`description`, `version`, `author`, `category`, `homepage`, `entry_command`, `license`, `keywords`, `tags`, `repository`) | accepted | accepted |
+
+## Status
+
+`.plugin/plugin.json` is not covered by any cross-vendor specification. Treat it as a compatibility layout: repositories that ship it are readable by Copilot CLI and OpenHands, but nothing guarantees field semantics beyond `name`. The portable standard is [agent-plugins.org v1](../agent-plugins/spec.md).

package/schemas/zcode/marketplace.schema.json

@@ -0,0 +1,161 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/zcode/marketplace.schema.json",
+  "title": "ZCode Marketplace Manifest",
+  "description": "Marketplace catalog read by ZCode at .claude-plugin/marketplace.json or a repository-root marketplace.json (there is no .zcode-plugin/marketplace.json). Authored from the official authoring page, the official marketplace repository, and the shipped runtime; ZCode publishes no JSON Schema.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: https://zcode.z.ai/en/docs/plugin ; https://github.com/zai-org/zcode-plugins (marketplace.json, scripts/validate.py, docs/distribution.md) ; ZCode 3.11.2 runtime (marketplace lookup order, plugin-entry normalizer). The official marketplace validator additionally requires owner and description_i18n; the runtime also accepts plugins as an object map keyed by plugin name.",
+  "type": "object",
+  "properties": {
+    "name": { "type": "string", "description": "Marketplace identifier." },
+    "description": { "type": "string" },
+    "description_i18n": {
+      "type": "object",
+      "additionalProperties": { "type": "string" }
+    },
+    "owner": {
+      "type": "object",
+      "description": "Marketplace maintainer. Required by the official marketplace validator; not listed in the docs field table.",
+      "properties": {
+        "name": { "type": "string" },
+        "email": { "type": "string" },
+        "url": { "type": "string" }
+      },
+      "required": ["name"],
+      "additionalProperties": true
+    },
+    "version": { "description": "Seen in the wild as a number (for example 1) in per-plugin payload manifests." },
+    "pluginRoot": {
+      "type": "string",
+      "description": "Base directory for resolving relative plugin sources. Documented at the top level; the observed runtime reads metadata.pluginRoot and only surfaces a top-level value on already-normalized manifests."
+    },
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "description": { "type": "string" },
+        "pluginRoot": { "type": "string" },
+        "version": { "type": "string" }
+      },
+      "additionalProperties": true
+    },
+    "featured": { "type": "array", "items": { "type": "string" }, "description": "Read by the runtime normalizer; not documented." },
+    "allowCrossMarketplaceDependenciesOn": { "type": "array", "items": { "type": "string" } },
+    "plugins": {
+      "description": "Plugin entries. Documented as an array; the observed runtime also accepts an object map keyed by plugin name.",
+      "anyOf": [
+        { "type": "array", "items": { "$ref": "#/$defs/entry" } },
+        { "type": "object", "additionalProperties": { "$ref": "#/$defs/entry" } }
+      ]
+    }
+  },
+  "required": ["name", "plugins"],
+  "additionalProperties": true,
+  "$defs": {
+    "entry": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string", "description": "Must match the plugin manifest name." },
+        "source": { "$ref": "#/$defs/source" },
+        "description": { "type": "string" },
+        "description_i18n": { "type": "object", "additionalProperties": { "type": "string" } },
+        "displayName": { "type": "string" },
+        "displayName_i18n": { "type": "object", "additionalProperties": { "type": "string" } },
+        "version": { "type": "string", "description": "Drives update checks; the installed version comes from the plugin's own manifest. Bump both." },
+        "author": {
+          "anyOf": [
+            { "type": "string" },
+            {
+              "type": "object",
+              "properties": { "name": { "type": "string" }, "url": { "type": "string" } },
+              "additionalProperties": true
+            }
+          ]
+        },
+        "category": {
+          "description": "Discovery category. The official marketplace validator restricts this to developer-tools, productivity, utilities, guides, finance, template, other.",
+          "type": "string"
+        },
+        "tags": { "type": "array", "items": { "type": "string" } },
+        "keywords": { "type": "array", "items": { "type": "string" } },
+        "icon": { "type": "string" },
+        "homepage": { "type": "string" },
+        "privacyPolicy": { "type": "string" },
+        "termsOfService": { "type": "string" },
+        "heroImage": { "type": "string" },
+        "examplePrompts": { "type": "array", "items": { "type": "string" } },
+        "examplePrompts_i18n": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } },
+        "requiresPaidPlan": { "type": "boolean" },
+        "dependencies": { "type": "array", "items": { "type": "string" } },
+        "strict": { "type": "boolean", "description": "When false, ZCode synthesizes a plugin manifest from this entry if the plugin ships none." },
+        "cachePath": { "type": "string", "description": "Absolute cached plugin path; used with source \"filesystem\" in bundled marketplace manifests." },
+        "_artifact": {
+          "type": "object",
+          "description": "ZCode distribution extension: where the immutable zip artifact lives under the marketplace base URL.",
+          "properties": {
+            "path": { "type": "string" },
+            "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+            "size": { "type": "number" }
+          },
+          "additionalProperties": true
+        }
+      },
+      "required": ["name", "source"],
+      "additionalProperties": true
+    },
+    "source": {
+      "description": "Where the plugin lives. Documented forms plus runtime-observed forms.",
+      "anyOf": [
+        { "type": "string", "description": "Relative subdirectory such as ./plugins/hello, or the runtime-only literal \"filesystem\" / \"sea\"." },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "directory" }, "path": { "type": "string" } },
+          "required": ["source", "path"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "github" }, "repo": { "type": "string" }, "path": { "type": "string" }, "ref": { "type": "string" } },
+          "required": ["source", "repo"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "git" }, "url": { "type": "string" }, "path": { "type": "string" }, "ref": { "type": "string" } },
+          "required": ["source", "url"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "git-subdir" }, "url": { "type": "string" }, "path": { "type": "string" }, "ref": { "type": "string" } },
+          "required": ["source", "url", "path"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "file" }, "path": { "type": "string" } },
+          "required": ["source", "path"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": {
+            "source": { "const": "url" },
+            "url": { "type": "string" },
+            "type": { "enum": ["git", "zip"] },
+            "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+            "path": { "type": "string" },
+            "stripRoot": { "type": "boolean" },
+            "headers": { "type": "object", "additionalProperties": { "type": "string" } }
+          },
+          "required": ["source", "url"],
+          "additionalProperties": true
+        },
+        {
+          "type": "object",
+          "properties": { "source": { "const": "npm" }, "package": { "type": "string" }, "version": { "type": "string" } },
+          "required": ["source", "package"],
+          "additionalProperties": true
+        }
+      ]
+    }
+  }
+}

package/schemas/zcode/plugin.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sivan757.github.io/dsh-agent-plugins-market/schemas/zcode/plugin.schema.json",
+  "title": "ZCode Plugin Manifest",
+  "description": "Plugin manifest accepted by ZCode (Z.ai) at .zcode-plugin/plugin.json, .claude-plugin/plugin.json, or .codex-plugin/plugin.json. Authored from the official authoring page and the shipped runtime; ZCode publishes no JSON Schema. Unknown properties are ignored by the client, so this schema is open.",
+  "$comment": "Provenance: authored (not upstream-vendored) 2026-09-08. Sources: https://zcode.z.ai/en/docs/plugin ; https://github.com/zai-org/zcode-plugins (docs/distribution.md, docs/PLUGIN_DEVELOPMENT.md, scripts/validate.py, plugins/example-plugin) ; ZCode 3.11.2 runtime constants (manifest candidate order). Fields channels/lspServers/outputStyles/settings are registered but diagnostic-only in the observed runtime.",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9._-]{0,127}$",
+      "description": "Plugin identifier; 1-128 characters, lowercase."
+    },
+    "version": {
+      "type": "string",
+      "description": "Semantic version. The runtime defaults to \"0.0.0\" when absent. The official marketplace validator requires this to equal the marketplace entry version."
+    },
+    "description": {
+      "type": "string",
+      "description": "One-line description shown in the plugin manager."
+    },
+    "description_i18n": {
+      "type": "object",
+      "description": "Localized descriptions keyed by BCP-47 locale. Required for community submissions by the official marketplace validator (en and zh-CN), which also requires it to match the marketplace entry.",
+      "additionalProperties": { "type": "string" }
+    },
+    "author": {
+      "description": "Author as a bare name or a structured record.",
+      "anyOf": [
+        { "type": "string" },
+        {
+          "type": "object",
+          "properties": {
+            "name": { "type": "string" },
+            "email": { "type": "string" },
+            "url": { "type": "string" }
+          },
+          "additionalProperties": true
+        }
+      ]
+    },
+    "homepage": { "type": "string" },
+    "repository": { "type": "string" },
+    "license": { "type": "string", "description": "SPDX identifier, e.g. MIT." },
+    "keywords": { "type": "array", "items": { "type": "string" } },
+    "commands": { "$ref": "#/$defs/component" },
+    "skills": { "$ref": "#/$defs/component" },
+    "agents": { "$ref": "#/$defs/component" },
+    "hooks": { "$ref": "#/$defs/component" },
+    "mcpServers": {
+      "description": "MCP servers: a path to a JSON file, an array of such paths, or an inline server map. Inline entries override same-named servers from .mcp.json.",
+      "$ref": "#/$defs/component"
+    },
+    "dependencies": {
+      "type": "array",
+      "description": "Other plugins required at enable time. A bare name resolves inside the declaring marketplace; use name@marketplace for another marketplace.",
+      "items": { "type": "string" }
+    },
+    "userConfig": {
+      "type": "object",
+      "description": "User-configurable options prompted when the plugin is enabled. Values are referenced as ${user_config.<key>} in MCP declarations and hooks.",
+      "additionalProperties": { "$ref": "#/$defs/userConfigOption" }
+    },
+    "channels": { "description": "Registered but diagnostic-only in the observed ZCode runtime; not executed." },
+    "lspServers": { "description": "Registered but diagnostic-only in the observed ZCode runtime; not executed." },
+    "outputStyles": { "description": "Registered but diagnostic-only in the observed ZCode runtime; not executed." },
+    "settings": { "description": "Registered but diagnostic-only in the observed ZCode runtime; not executed." }
+  },
+  "required": ["name"],
+  "additionalProperties": true,
+  "$defs": {
+    "component": {
+      "description": "Component declaration: a relative path, an array of relative paths, or an inline object. ZCode resolves relative paths against the plugin root.",
+      "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }, { "type": "object" }]
+    },
+    "userConfigOption": {
+      "type": "object",
+      "properties": {
+        "type": { "enum": ["string", "number", "boolean", "directory", "file"] },
+        "title": { "type": "string" },
+        "description": { "type": "string" },
+        "default": { "type": ["string", "number", "boolean"] },
+        "required": { "type": "boolean" },
+        "sensitive": { "type": "boolean", "description": "Masked in the UI and not enterable interactively." }
+      },
+      "additionalProperties": false
+    }
+  }
+}