harness-alchemist 0.1.8 → 0.1.10

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "harness-alchemist",
   "displayName": "Harness Alchemist",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-alchemist",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang",

package/README.md

@@ -28,7 +28,7 @@
 
 ---
 
-Harness Alchemist scaffolds one TypeScript plugin repository that installs natively into **Claude Code**, **Codex/ChatGPT**, **OpenCode**, **Google Antigravity**, and **DeepSeek Harness/Cordis**. Product skills ship behavioral `.mjs`/`.py` script twins; every harness entrypoint is a thin adapter that delegates to them.
+Harness Alchemist scaffolds one TypeScript plugin repository that installs natively into **Claude Code**, **Codex/ChatGPT**, **OpenCode**, **Google Antigravity**, and **DeepSeek Harness/Cordis**. Each product skill declares its fixed executable and portable tool schema in `skill-runtime.json`; host entrypoints delegate through `@lunarmoon26/agent-skill-runtime`.
 
 ## Install
 
@@ -38,7 +38,7 @@ npm install -g harness-alchemist
 npx harness-alchemist@latest create my-plugin --help
 ```
 
-Requires Node.js 22.20+ (Bun 1.2+ also supported). Zero runtime dependencies.
+Requires Node.js 22.20+ (Bun 1.2+ also supported).
 
 ## Quick start
 
@@ -78,10 +78,10 @@ retains the strict generated single-package layout.
 
 The optional `runtime` field selects what the adapted package must contain:
 
-- `"npm"` (default) — the full generated contract: npm metadata, OpenCode and
-  Cordis adapters, Cordis patch, and `.mjs`/`.py` script twins.
-- `"skills"` — skills and harness manifests only. No npm package, adapters, or
-  Cordis patch are required, and single-language scripts are allowed, so
+- `"npm"` (default) — the full generated contract: npm metadata, portable
+  runtime manifests, OpenCode and Cordis adapters, and the Cordis patch.
+- `"skills"` — skills, portable runtime manifests, and harness manifests only.
+  No npm package, adapters, or Cordis patch are required, and single-language scripts are allowed, so
   Python, Go, Rust, Java, C#, or Swift repositories can expose their workflows
   to Claude Code, Codex, Antigravity, and DeepSeek's filesystem skill roots
   without adopting a JavaScript runtime.
@@ -95,10 +95,10 @@ version.
 
 | Surface | Purpose |
 | --- | --- |
-| `skills/<name>/` | Agent Skills spec skill with `.mjs`/`.py` script twins under `scripts/` and a tool-contract reference |
-| `src/opencode.ts` | OpenCode plugin registering tools that spawn the skill scripts |
-| `src/deepseek.ts` + `cordis.patch.yml` | Cordis function plugin providing a service over the same scripts |
-| `.claude-plugin/`, `.codex-plugin/`, `.agents/plugins/`, `plugin.json` | Native manifests for Claude Code, Codex, and Antigravity marketplaces |
+| `skills/<name>/` | Agent Skills workflow, portable `skill-runtime.json`, fixed executable, optional tested twin, and tool-contract reference |
+| `src/opencode.ts` | OpenCode plugin projecting the portable runtime manifest as native tools |
+| `src/deepseek.ts` + `cordis.patch.yml` | Cordis function plugin registering the same portable tools |
+| `.claude-plugin/`, `.codex-plugin/`, `.agents/plugins/`, `plugin.json`, `mcp.json` | Native and Agent Plugins manifests for Claude Code, Codex, Antigravity, and MCP hosts |
 | `.agents/skills/develop-<name>/` | Repository-maintenance skill so agents can develop the project recursively |
 | `.github/workflows/` | CI plus tag-triggered publish (`vX.Y.Z` → verify → npm provenance) |
 
@@ -112,12 +112,16 @@ Install paths below are verified against real CLIs before shipping in the templa
 | Codex/ChatGPT | bundled natively | — | `codex plugin add <name>@<marketplace>` |
 | OpenCode | via `~/.agents/skills/` | npm package hooks | `"plugin": ["<package>"]` in `opencode.json` |
 | Google Antigravity | nested bundle | — | `agy plugin validate . && agy plugin install .` |
-| DeepSeek Harness | profile filesystem roots | Cordis service plugin | `dsh plugin --profile demo add <package-or-path>` |
+| DeepSeek Harness | profile filesystem roots | Cordis tool plugin | `dsh plugin --profile demo add <package-or-path>` |
 
 ## Skill script contract
 
 Product skills own their logic; adapters never do.
 
+`skills/<name>/skill-runtime.json` declares the model-facing schema and selects
+one author-controlled entrypoint. Hosts validate the same manifest and never
+accept an executable path from model input.
+
 ```bash
 echo '{"request": "hello"}' | node skills/<name>/scripts/main.mjs
 # {"ok":true,"plugin":"my-plugin","echo":{"request":"hello"}}
@@ -125,7 +129,8 @@ echo '{"request": "hello"}' | node skills/<name>/scripts/main.mjs
 
 - One JSON object on stdin, one JSON result plus newline on stdout.
 - Non-zero exit with a stderr diagnostic on failure.
-- `scripts/main.py` is a stdlib-only behavioral twin of `scripts/main.mjs`.
+- `scripts/main.py` is a stdlib-only behavioral twin for direct compatibility
+  testing; the starter manifest selects `scripts/main.mjs` for host tools.
 
 ## Install-level verification
 
@@ -152,14 +157,20 @@ and the DeepSeek Cordis check require npm mode with built adapters
 
 ## Validation tiers
 
-`npm run validate` always enforces Agent Skills frontmatter compliance, SKILL.md reference resolution, and twin parity. With the optional `pyodide` devDependency installed, Python entrypoints are additionally compiled and smoke-executed inside a WebAssembly CPython sandbox — no native Python required.
+`npm run validate` always enforces Agent Skills frontmatter compliance, SKILL.md reference resolution, runtime-manifest validation, fixed contained entrypoints, and npm-mode twin parity. With the optional `pyodide` devDependency installed, Python twins are additionally compiled and smoke-executed inside a WebAssembly CPython sandbox; Pyodide is validation-only, not a version 1 execution engine.
 
 ## Release automation
 
+The npm package trusts GitHub Actions workflow `npm-publish.yml` in
+`lunarmoon26/harness-alchemist`. The workflow uses OIDC instead of an
+`NPM_TOKEN`, requires the tag to match the committed package version, and
+accepts only commits contained in `main`.
+
 ```bash
 # bump package.json version, then:
 npm run sync && npm run verify && git commit -am "Release vX.Y.Z" && git push
-git tag vX.Y.Z && git push origin vX.Y.Z   # publishes automatically
+# after the release commit is merged to main:
+git tag vX.Y.Z && git push origin vX.Y.Z   # publishes through npm Trusted Publishing
 ```
 
 ## License

package/alchemy.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://unpkg.com/harness-alchemist/alchemy.schema.json",
+  "runtime": "npm",
+  "template": "v0.1.0",
+  "generator": "harness-alchemist",
+  "generatorVersion": "0.1.10",
+  "createdAt": "2026-08-24T00:00:00.000Z"
+}

package/alchemy.schema.json

@@ -13,7 +13,7 @@
     "runtime": {
       "enum": ["npm", "skills"],
       "default": "npm",
-      "description": "'npm' requires the full generated contract (npm package, OpenCode and Cordis adapters, Cordis patch, .mjs/.py script twins). 'skills' requires skills and harness manifests only and allows single-language scripts."
+      "description": "'npm' requires the full generated contract (npm package, portable runtime manifests, OpenCode and Cordis adapters, and Cordis patch). 'skills' requires skills, portable runtime manifests, and harness manifests only and allows single-language scripts."
     },
     "pluginRoot": {
       "type": "string",

package/dist/deepseek.d.ts

@@ -1,5 +1,5 @@
 import type { Context } from "@deepseek-ai/cordis";
 export declare const name = "harness-alchemist";
-export declare function runSkillScript(script: string, payload: string): unknown;
-export declare function apply(context: Context): void;
+export declare const inject: string[];
+export declare function apply(context: Context): Promise<void>;
 //# sourceMappingURL=deepseek.d.ts.map

package/dist/deepseek.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deepseek.d.ts","sourceRoot":"","sources":["../src/deepseek.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,IAAI,sBAAsB,CAAA;AAQvC,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAcvE;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK5C"}
+{"version":3,"file":"deepseek.d.ts","sourceRoot":"","sources":["../src/deepseek.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,eAAO,MAAM,IAAI,sBAAsB,CAAA;AACvC,eAAO,MAAM,MAAM,UAAY,CAAA;AAI/B,wBAAsB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D"}

package/dist/deepseek.js

@@ -1,26 +1,13 @@
-import { spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { registerDeepSeekTools } from "@lunarmoon26/agent-skill-runtime/deepseek";
 export const name = "harness-alchemist";
-const scriptsDirectory = join(dirname(fileURLToPath(import.meta.url)), "..", "skills/harness-alchemist/scripts");
-export function runSkillScript(script, payload) {
-    const runtime = script.endsWith(".py") ? "python3" : process.execPath;
-    const result = spawnSync(runtime, [join(scriptsDirectory, script)], {
-        input: payload,
-        encoding: "utf8",
-    });
-    if (result.error) {
-        throw new Error(`Could not run ${script} via ${runtime}: ${result.error.message}`);
-    }
-    if (result.status !== 0) {
-        const diagnostic = result.stderr.trim() || `${script} exited with code ${result.status}`;
-        throw new Error(diagnostic);
-    }
-    return JSON.parse(result.stdout);
-}
-export function apply(context) {
-    context.provide(name, {
-        run: (payload, runtime = "node") => runSkillScript(runtime === "python" ? "main.py" : "main.mjs", payload),
+export const inject = ["tools"];
+const pluginRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+export async function apply(context) {
+    await registerDeepSeekTools(context, {
+        pluginRoot,
+        manifestPaths: ["skills/harness-alchemist/skill-runtime.json"],
     });
 }
 //# sourceMappingURL=deepseek.js.map

package/dist/deepseek.js.map

@@ -1 +1 @@
-{"version":3,"file":"deepseek.js","sourceRoot":"","sources":["../src/deepseek.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAIxC,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAA;AAEvC,MAAM,gBAAgB,GAAG,IAAI,CAC3B,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,kCAAkC,CACnC,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAe;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,EAAE;QAClE,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,qBAAqB,MAAM,CAAC,MAAM,EAAE,CAAA;QACxF,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAgB;IACpC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;QACpB,GAAG,EAAE,CAAC,OAAe,EAAE,UAA6B,MAAM,EAAE,EAAE,CAC5D,cAAc,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"deepseek.js","sourceRoot":"","sources":["../src/deepseek.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAA;AAEjF,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAA;AACvC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAEtE,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB;IAC1C,MAAM,qBAAqB,CAAC,OAAO,EAAE;QACnC,UAAU;QACV,aAAa,EAAE,CAAC,6CAA6C,CAAC;KAC/D,CAAC,CAAA;AACJ,CAAC"}

package/dist/opencode.d.ts

@@ -1,21 +1,4 @@
-export declare function runSkillScript(script: string, payload: string): Promise<string>;
-declare const plugin: () => Promise<{
-    tool: {
-        harness_alchemist_run: {
-            description: string;
-            args: {
-                input: import("zod").ZodString;
-                runtime: import("zod").ZodOptional<import("zod").ZodEnum<{
-                    node: "node";
-                    python: "python";
-                }>>;
-            };
-            execute(args: {
-                input: string;
-                runtime?: "node" | "python" | undefined;
-            }, context: import("@opencode-ai/plugin").ToolContext): Promise<import("@opencode-ai/plugin").ToolResult>;
-        };
-    };
-}>;
+import type { Plugin } from "@opencode-ai/plugin";
+declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=opencode.d.ts.map

package/dist/opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../src/opencode.ts"],"names":[],"mappings":"AAaA,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B/E;AAED,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;EAuBO,CAAA;AAEnB,eAAe,MAAM,CAAA"}
+{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../src/opencode.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAKjD,QAAA,MAAM,MAAM,EAAE,MAGZ,CAAA;AAEF,eAAe,MAAM,CAAA"}

package/dist/opencode.js

@@ -1,58 +1,10 @@
-import { spawn } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { tool } from "@opencode-ai/plugin";
-const scriptsDirectory = join(dirname(fileURLToPath(import.meta.url)), "..", "skills/harness-alchemist/scripts");
-export function runSkillScript(script, payload) {
-    return new Promise((resolveResult, rejectResult) => {
-        const runtime = script.endsWith(".py") ? "python3" : process.execPath;
-        const child = spawn(runtime, [join(scriptsDirectory, script)], {
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (chunk) => {
-            stdout += chunk;
-        });
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk;
-        });
-        child.on("error", (error) => {
-            rejectResult(new Error(`Could not run ${script} via ${runtime}: ${error.message}`));
-        });
-        child.on("close", (code) => {
-            if (code !== 0) {
-                rejectResult(new Error(stderr.trim() || `${script} exited with code ${code}`));
-            }
-            else {
-                resolveResult(stdout);
-            }
-        });
-        child.stdin.end(payload);
-    });
-}
-const plugin = (async () => {
-    return {
-        tool: {
-            harness_alchemist_run: tool({
-                description: "Run the Harness Alchemist shared-skill workflow. Delegates to skills/harness-alchemist/scripts.",
-                args: {
-                    input: tool.schema
-                        .string()
-                        .describe("JSON object passed on stdin to the skill entrypoint"),
-                    runtime: tool.schema
-                        .enum(["node", "python"])
-                        .optional()
-                        .describe("Entrypoint runtime; defaults to node"),
-                },
-                execute: async (args) => {
-                    const script = args.runtime === "python" ? "main.py" : "main.mjs";
-                    const output = await runSkillScript(script, args.input);
-                    return JSON.stringify(JSON.parse(output));
-                },
-            }),
-        },
-    };
+import { createOpenCodePlugin } from "@lunarmoon26/agent-skill-runtime/opencode";
+const pluginRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+const plugin = createOpenCodePlugin({
+    pluginRoot,
+    manifestPaths: ["skills/harness-alchemist/skill-runtime.json"],
 });
 export default plugin;
 //# sourceMappingURL=opencode.js.map

package/dist/opencode.js.map

@@ -1 +1 @@
-{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../src/opencode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAG1C,MAAM,gBAAgB,GAAG,IAAI,CAC3B,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,kCAAkC,CACnC,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAe;IAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,EAAE;YAC7D,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAA;QACF,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,KAAK,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,KAAK,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,IAAI,KAAK,CAAC,iBAAiB,MAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;YAChF,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,MAAM,CAAC,CAAA;YACvB,CAAC;QACH,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;IACzB,OAAO;QACL,IAAI,EAAE;YACJ,qBAAqB,EAAE,IAAI,CAAC;gBAC1B,WAAW,EACT,iGAAiG;gBACnG,IAAI,EAAE;oBACJ,KAAK,EAAE,IAAI,CAAC,MAAM;yBACf,MAAM,EAAE;yBACR,QAAQ,CAAC,qDAAqD,CAAC;oBAClE,OAAO,EAAE,IAAI,CAAC,MAAM;yBACjB,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;yBACxB,QAAQ,EAAE;yBACV,QAAQ,CAAC,sCAAsC,CAAC;iBACpD;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;oBACjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;oBACvD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC3C,CAAC;aACF,CAAC;SACH;KACF,CAAA;AACH,CAAC,CAAkB,CAAA;AAEnB,eAAe,MAAM,CAAA"}
+{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../src/opencode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAEhF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAEtE,MAAM,MAAM,GAAW,oBAAoB,CAAC;IAC1C,UAAU;IACV,aAAa,EAAE,CAAC,6CAA6C,CAAC;CAC/D,CAAC,CAAA;AAEF,eAAe,MAAM,CAAA"}

package/lib/create.mjs

@@ -247,6 +247,8 @@ export async function runCreate(argv) {
   const tokens = {
     NAME: options.name,
     NAME_JSON: JSON.stringify(options.name),
+    TOOL_NAME: `${options.name.replaceAll("-", "_")}_run`,
+    TOOL_NAME_JSON: JSON.stringify(`${options.name.replaceAll("-", "_")}_run`),
     DISPLAY_NAME: options.displayName,
     DISPLAY_NAME_JSON: JSON.stringify(options.displayName),
     DESCRIPTION: options.description,

package/lib/validate.mjs

@@ -2,10 +2,17 @@
 
 import { existsSync } from "node:fs"
 import { readdir, readFile, realpath } from "node:fs/promises"
-import { basename, dirname, join, resolve, sep } from "node:path"
+import { basename, dirname, join, relative, resolve, sep } from "node:path"
 import { fileURLToPath } from "node:url"
 import { spawnSync } from "node:child_process"
 
+import { discoverSkillTools } from "@lunarmoon26/agent-skill-runtime"
+
+const AGENT_PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json"
+const AGENT_PLUGIN_MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json"
+const SKILL_RUNTIME_PACKAGE = "@lunarmoon26/agent-skill-runtime"
+const SKILL_RUNTIME_VERSION = "0.1.0"
+
 const PROJECT_REQUIRED_FILES = [
   ".agents/plugins/marketplace.json",
   ".claude-plugin/marketplace.json",
@@ -18,6 +25,7 @@ const PROJECT_REQUIRED_FILES = [
 const PLUGIN_REQUIRED_FILES = [
   ".claude-plugin/plugin.json",
   ".codex-plugin/plugin.json",
+  "mcp.json",
   "plugin.json",
 ]
 
@@ -38,10 +46,10 @@ Validates a universal Claude, Codex, OpenCode, Antigravity, and DeepSeek
 plugin scaffold. By default the project is resolved from the current working
 directory or from the script's containing generated project.
 
-Product skills are checked against the Agent Skills specification and their
-scripts against the shared tool contract. When the optional 'pyodide'
-devDependency is installed, Python entrypoints are also syntax-checked and
-smoke-executed in a WebAssembly CPython sandbox.
+Product skills are checked against the Agent Skills specification and the
+portable skill runtime manifest. When the optional 'pyodide' devDependency is
+installed, Python twin entrypoints are also syntax-checked and smoke-executed
+in a WebAssembly CPython sandbox.
 
 Options:
   --external  Run installed platform validators, currently Claude Code.
@@ -245,6 +253,12 @@ function exportTarget(exports, key, field = "import") {
   return undefined
 }
 
+function sameValues(actual, expected) {
+  return Array.isArray(actual)
+    && actual.length === expected.length
+    && expected.every((value, index) => actual[index] === value)
+}
+
 const PYTHON_SMOKE_PROGRAM = `
 import contextlib
 import io
@@ -289,7 +303,7 @@ async function smokePythonScripts(scripts, errors, warnings, execSmoke = true) {
     let output
     try {
       if (execSmoke) {
-        instance.globals.set("__ha_payload__", "{}")
+        instance.globals.set("__ha_payload__", '{"request":"validation"}')
         output = instance.runPython(PYTHON_SMOKE_PROGRAM)
       } else {
         instance.runPython('compile(__ha_source__, "<skill>", "exec")\nNone')
@@ -466,7 +480,8 @@ export async function validateProject(projectRoot, options = {}) {
     join(root, ".agents/plugins/marketplace.json"),
     errors,
   )
-  const antigravityPlugin = await readJson(join(pluginRoot, "plugin.json"), errors)
+  const agentPlugin = await readJson(join(pluginRoot, "plugin.json"), errors)
+  const agentPluginMcp = await readJson(join(pluginRoot, "mcp.json"), errors)
 
   if (errors.length > 0) return { root, errors, warnings }
 
@@ -482,11 +497,36 @@ export async function validateProject(projectRoot, options = {}) {
 
   for (const [label, value] of [
     ["Codex plugin", codexPlugin.name],
-    ["Antigravity plugin", antigravityPlugin.name],
+    ["Agent plugin", agentPlugin.name],
   ]) {
     if (value !== pluginName) errors.push(`${label} name '${value}' does not match '${pluginName}'`)
   }
 
+  if (agentPlugin.$schema !== AGENT_PLUGIN_SCHEMA) {
+    errors.push(`plugin.json $schema must be '${AGENT_PLUGIN_SCHEMA}'`)
+  }
+  if (agentPluginMcp.$schema !== AGENT_PLUGIN_MCP_SCHEMA) {
+    errors.push(`mcp.json $schema must be '${AGENT_PLUGIN_MCP_SCHEMA}'`)
+  }
+  const expectedMcpArgs = [
+    "-y",
+    `${SKILL_RUNTIME_PACKAGE}@${SKILL_RUNTIME_VERSION}`,
+    "mcp",
+    "--root",
+    "${PLUGIN_ROOT}",
+    "--manifest",
+    `skills/${pluginName}/skill-runtime.json`,
+  ]
+  const mcpServer = agentPluginMcp.mcpServers?.[pluginName]
+  if (
+    mcpServer?.type !== "stdio" ||
+    mcpServer.command !== "npx" ||
+    mcpServer.cwd !== "${PLUGIN_ROOT}" ||
+    !sameValues(mcpServer.args, expectedMcpArgs)
+  ) {
+    errors.push(`mcp.json must configure '${pluginName}' through ${SKILL_RUNTIME_PACKAGE}@${SKILL_RUNTIME_VERSION}`)
+  }
+
   if (runtime === "skills") {
     for (const [label, manifest] of [["Codex plugin", codexPlugin]]) {
       if (manifest.version !== claudePlugin.version) {
@@ -496,8 +536,11 @@ export async function validateProject(projectRoot, options = {}) {
         errors.push(`${label} description does not match the Claude plugin`)
       }
     }
-    if (antigravityPlugin.description !== claudePlugin.description) {
-      errors.push("Antigravity description does not match the Claude plugin")
+    if (agentPlugin.version !== claudePlugin.version) {
+      errors.push("Agent plugin version does not match the Claude plugin")
+    }
+    if (agentPlugin.description !== claudePlugin.description) {
+      errors.push("Agent plugin description does not match the Claude plugin")
     }
   } else {
     const packageJson = await readJson(join(pluginRoot, "package.json"), errors)
@@ -519,11 +562,20 @@ export async function validateProject(projectRoot, options = {}) {
         errors.push(`${label} description does not match package.json`)
       }
     }
-    if (antigravityPlugin.description !== packageJson.description) {
-      errors.push("Antigravity description does not match package.json")
+    if (agentPlugin.version !== packageJson.version) {
+      errors.push("Agent plugin version does not match package.json")
+    }
+    if (agentPlugin.description !== packageJson.description) {
+      errors.push("Agent plugin description does not match package.json")
+    }
+    if (agentPlugin.license !== packageJson.license) {
+      errors.push("Agent plugin license does not match package.json")
     }
 
     if (packageJson.type !== "module") errors.push("package.json type must be 'module'")
+    if (packageJson.dependencies?.[SKILL_RUNTIME_PACKAGE] !== SKILL_RUNTIME_VERSION) {
+      errors.push(`package.json dependencies must pin '${SKILL_RUNTIME_PACKAGE}' to '${SKILL_RUNTIME_VERSION}'`)
+    }
     if (opencodeExport === "." && packageJson.engines?.node !== ">=22.20.0") {
       errors.push("package.json engines.node must be '>=22.20.0'")
     }
@@ -547,6 +599,7 @@ export async function validateProject(projectRoot, options = {}) {
       "cordis.patch.yml",
       ".claude-plugin/plugin.json",
       ".codex-plugin/plugin.json",
+      "mcp.json",
       "plugin.json",
     ]) {
       if (!packageJson.files?.includes(entry)) errors.push(`package.json files is missing '${entry}'`)
@@ -599,6 +652,7 @@ export async function validateProject(projectRoot, options = {}) {
   if (skillFiles.length < 2) errors.push("Expected a shared skill and a project development skill")
 
   const pythonScripts = new Set()
+  const runtimeManifestPaths = []
   for (const skillFile of skillFiles) {
     const content = await readFile(skillFile, "utf8")
     const frontmatter = parseFrontmatter(content)
@@ -613,11 +667,31 @@ export async function validateProject(projectRoot, options = {}) {
         errors.push(`${skillFile}: invalid Agent Skill name`)
       }
       if (productSkillFiles.includes(skillFile)) {
+        const manifestPath = join(dirname(skillFile), "skill-runtime.json")
+        if (!existsSync(manifestPath)) {
+          errors.push(`${skillFile}: missing skill-runtime.json`)
+        } else {
+          runtimeManifestPaths.push(relative(pluginRoot, manifestPath))
+        }
         await checkProductSkillRuntime(skillFile, content, frontmatter, errors, pythonScripts, runtime)
       }
     }
   }
 
+  if (runtimeManifestPaths.length === productSkillFiles.length && runtimeManifestPaths.length > 0) {
+    try {
+      const tools = await discoverSkillTools({ pluginRoot, manifestPaths: runtimeManifestPaths })
+      for (const tool of tools) {
+        const directoryName = basename(tool.skillRoot)
+        if (tool.manifestName !== directoryName) {
+          errors.push(`${tool.manifestPath}: manifest name must match skill directory '${directoryName}'`)
+        }
+      }
+    } catch (error) {
+      errors.push(`Skill runtime validation failed: ${error instanceof Error ? error.message : String(error)}`)
+    }
+  }
+
   if (pythonScripts.size > 0) {
     await smokePythonScripts([...pythonScripts], errors, warnings, runtime === "npm")
   }

package/mcp.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "harness-alchemist": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "-y",
+        "@lunarmoon26/agent-skill-runtime@0.1.0",
+        "mcp",
+        "--root",
+        "${PLUGIN_ROOT}",
+        "--manifest",
+        "skills/harness-alchemist/skill-runtime.json"
+      ],
+      "cwd": "${PLUGIN_ROOT}"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-alchemist",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "type": "module",
   "bin": {
@@ -25,10 +25,12 @@
     "lib",
     "templates",
     "skills",
+    "alchemy.json",
     "alchemy.schema.json",
     "cordis.patch.yml",
     ".claude-plugin/plugin.json",
     ".codex-plugin/plugin.json",
+    "mcp.json",
     "plugin.json",
     "README.md",
     "LICENSE"
@@ -56,6 +58,9 @@
     "opencode",
     "scaffolding"
   ],
+  "dependencies": {
+    "@lunarmoon26/agent-skill-runtime": "0.1.0"
+  },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@opencode-ai/plugin": "^1.18.21"

package/plugin.json

@@ -1,5 +1,19 @@
 {
-  "$schema": "https://antigravity.google/schemas/v1/plugin.json",
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-alchemist",
-  "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness."
+  "version": "0.1.10",
+  "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
+  "author": {
+    "name": "Haochuan Zhang"
+  },
+  "homepage": "git+https://github.com/lunarmoon26/harness-alchemist.git",
+  "repository": "git+https://github.com/lunarmoon26/harness-alchemist.git",
+  "license": "MIT",
+  "keywords": [
+    "agent-skill",
+    "scaffolding",
+    "mcp",
+    "opencode",
+    "deepseek"
+  ]
 }

package/skills/harness-alchemist/SKILL.md

@@ -63,9 +63,9 @@ Static validation is structural evidence, not proof that remote services or host
 
 ## Skill Runtime
 
-`scripts/main.mjs` (Node/Bun) and `scripts/main.py` (CPython 3.10+) are
-behavioral twins demonstrating this repository's own tool contract: one JSON
-object on stdin, one JSON result plus newline on stdout, non-zero exit with a
-stderr diagnostic on failure. The `src/` adapters delegate to them; keep any
-contract change mirrored in both twins and in
+`skill-runtime.json` declares the fixed `scripts/main.mjs` entrypoint and the
+portable tool schema used by MCP, OpenCode, and DeepSeek. `scripts/main.py`
+(CPython 3.10+) is a direct-test behavioral twin. Both scripts accept one JSON
+object on stdin, return one JSON result plus newline on stdout, and exit non-zero
+with a stderr diagnostic on failure. Keep protocol changes synchronized with
 [references/compatibility.md](references/compatibility.md).

package/skills/harness-alchemist/references/antigravity.md

@@ -4,13 +4,13 @@
 
 ```text
 plugin.json
+mcp.json
 skills/<name>/SKILL.md
 rules/<name>.md
 hooks.json
-mcp_config.json
 ```
 
-Only `plugin.json` is required. The CLI manifest schema accepts a machine-readable name and optional description. Keep the root manifest separate from Claude and Codex manifests.
+`plugin.json` follows Agent Plugins 1.0 and remains separate from the Claude and Codex manifests. `mcp.json` exposes the same executable skill tools to Agent Plugins hosts; current Antigravity CLI releases ignore that file and continue to load the bundled skill.
 
 Current Antigravity Agent Skills use the open Agent Skills directory format with nested `<name>/SKILL.md`. This is also the documented plugin skill shape.