monkeyscode-cli 1.1.10 → 1.1.12

package/README.md

@@ -28,6 +28,46 @@ install script) as aliases. A Homebrew formula template lives in
 
 ## Usage
 
+### Core Skills onboarding
+
+```bash
+mc plugin core-skills                 # stage MonkeysCode/core-skills from the signed catalog
+mc plugin bootstrap                   # alias for core-skills
+mc plugin enable core-skills          # review capabilities, confirm version trust, then enable
+mc plugin core-skills --enable        # explicitly combine installation and normal enable review
+```
+
+Installation alone displays the capability report but does not enable skills or
+change existing profiles. `--enable`, `--scope user|project` and `--yes` use the
+existing plugin trust policy; `--yes` never bypasses managed approval. This is
+the same native pipeline as `mc plugin install MonkeysCode/core-skills`, for
+catalog-managed updates, not another injection of shared legacy app content.
+The packaged 24-definition library is declarative application content, not a
+signed plugin or a trust root. Catalog/API unavailability or verification failure
+fails closed: no unsigned local, packaged or git fallback. No automatic onboarding
+runs at CLI startup.
+
+### Public plugin discovery
+
+```bash
+mc plugin search [query] [--category <category>] [--app <app>] [--json]
+mc plugin info <author/name>
+mc plugin outdated [--json]
+mc plugin update <name>
+mc plugin update --all
+# Interactive: /plugins browse [query] [--category <category>] [--app <app>]
+```
+
+Discovery uses https://marketplace.monkeyscode.com by default; set
+`MONKEYSCODE_CATALOG_ORIGIN` to another public HTTPS origin, or to an empty
+value to turn discovery off.
+It sends no account credentials. Metadata is not package trust. Signing pins
+are provisioned independently with `MONKEYSCODE_PLUGIN_SIGNING_KEYS`; never
+accept keys learned from discovery as trust roots. Bulk updates do not treat
+`--yes` as approval for expanded capabilities; each expansion needs review.
+Managed-policy pending trust must be resolved before enabling.
+
+
 ```bash
 # Interactive REPL (optionally with a first prompt)
 mc
@@ -386,7 +426,7 @@ The 54 visible built-ins below follow the default registry and its full
 | `/terminal-setup` | `/terminal-setup` | Configure Shift+Enter and Option-as-Meta |
 | `/shells` | `/shells [id \| kill <id\|all>]` | List, inspect or stop background shells |
 | `/mcp` | `/mcp [tools\|approve\|reconnect\|disable\|enable] [server]` | Inspect/control session MCP servers |
-| `/plugin` | `/plugin [list \| info <name> \| reload \| enable <name> \| disable <name>]` | Inspect and manage plugins |
+| `/plugins` | `/plugins [list \| browse [query] \| install <author>/<name>[@version] [--enable] \| info <name> \| enable <name> \| disable <name> \| update <name> \| rollback <name> \| remove <name> \| reload]` | Find, install, review, enable, update and remove plugins without leaving the session. `enable` on a new plugin shows its capabilities and asks before trusting it; `disable` is session-only |
 
 ### Project & Memory
 
@@ -437,21 +477,37 @@ not additional built-ins.
 | `skill` | `/skills` |
 | `hooks` | `/hook` |
 | `shells` | `/bashes`, `/bg` |
-| `plugin` | `/plugins` |
+| `plugins` | `/plugin` (legacy alias until the next release) |
 | `bug` | `/feedback` |
 | `config` | `/settings` |
 | `update` | `/upgrade` |
 | `help` | `/h`, `/?` |
 <!-- END SLASH COMMANDS -->
 
-Aliases (for example `/h`, `/quit`, `/ctx`, `/models`, `/skills`, `/plugins`)
+Aliases (for example `/h`, `/quit`, `/ctx`, `/models`, `/skills`, `/plugin`)
 resolve to their primary commands, not additional built-ins. Project/user
 Markdown commands, enabled plugins and connected MCP prompts can add dynamic
 entries; `/help` shows their sources and name conflicts (built-ins win).
-Use `/commands reload` after editing command files and `/plugin reload` to
+Use `/commands reload` after editing command files and `/plugins reload` to
 refresh extensions. Custom command shell expansions and their tool scopes
 remain permission-gated; enabling a plugin does not bypass MCP trust or tool rules.
 
+`/plugins` defaults to `list`; `browse` searches the configured public catalog
+(default app: `cli`; `--app` accepts `ide`, `agent` or `cli`).
+`info <name>` shows capabilities and version trust,
+and `reload` refreshes extensions. `enable <name>` and `disable <name>` change
+only the current session, never persistent settings or trust. Install and review
+version-pinned trust explicitly with `mc plugin install` and `mc plugin enable`;
+no slash command automatically grants trust. `/plugin` is the legacy Markdown
+command alias until the next release; migrate examples to `/plugins`.
+
+Local authoring commands are `mc plugin init [dir]`, `mc plugin validate [dir]`
+and `mc plugin migrate-skills <from> <to>` (copies skills without changing
+originals or granting trust). `mc plugin remove <name>` also accepts
+`mc plugin uninstall <name>`. Catalog discovery uses https://marketplace.monkeyscode.com unless
+`MONKEYSCODE_CATALOG_ORIGIN` overrides it; an empty value reports
+unavailability rather than sending a remote request. Plugin publishing remains unavailable until Phase 6.
+
 **Two different kinds of fork:** `/fork "task"` starts an isolated background
 task without inheriting conversation history. `mc sessions fork <id>` copies
 a saved conversation to a new id. `mc -r <id> --fork-session` (or
@@ -474,11 +530,13 @@ and context size, and Enter switches to the highlighted one.
 | Ctrl+] | Next tab (works in every terminal) |
 
 The ⌥ keys work with your terminal's default settings (Terminal.app, iTerm2,
-VS Code, kitty, WezTerm, Ghostty, Windows Terminal). On Diff and Code Review
-you can also click a tab and scroll with the wheel; hold Shift (⌥ in iTerm2
-and Terminal.app) while dragging to select text there. Set `mouse` to `all`
-to click the Chat footer as well (the wheel then stops scrolling the chat
-history), or to `off` to turn the mouse off.
+VS Code, kitty, WezTerm, Ghostty, Windows Terminal). You can click a tab and
+scroll with the wheel in every tab: the wheel scrolls whichever pane is under
+the pointer (chat history, the Changes column, Diff, Code Review). Hold Shift
+(⌥ in iTerm2 and Terminal.app) while dragging to select text, or use `/copy`
+for the last answer. Set `mouse` to `tabs` to keep the mouse to Diff / Code
+Review (plain drag selects in Chat, but the wheel no longer scrolls it), or to
+`off` to turn the mouse off.
 
 **In-app chat scrolling:** The chat viewport is internally scrollable — the
 composer and status line stay fixed while you navigate history. Use the mouse
@@ -486,6 +544,11 @@ wheel, PageUp/PageDown, or Ctrl+G to jump to the latest. Scrolling anchors
 survive streaming, tab switches, and terminal resizes. A "new output"
 indicator appears when you're scrolled up during a run.
 
+**Changes column:** on terminals 120 columns or wider, the chat shows the
+session's changed files and their diffs on the right. Ctrl+F focuses it (←/→
+file, ↑/↓ or the wheel to scroll), Ctrl+Y hides or shows it, and
+`changesPane: false` starts without it. `/diff` opens the full Diff tab.
+
 **Multi-line input:** Press **Shift+Enter** for a newline (or **Alt+Enter**,
 or end a line with `\`). Enter sends the message. Run `mc setup` to configure
 your terminal for distinguishable Shift+Enter if it isn't already.