slidemind 0.2.0 → 0.2.1

package/.claude-plugin/marketplace.json

@@ -0,0 +1,25 @@
+{
+  "name": "slidemind",
+  "owner": {
+    "name": "statworx",
+    "url": "https://www.statworx.com"
+  },
+  "description": "slidemind — on-brand PowerPoint decks from your coding agent, via the slidemind add-in",
+  "plugins": [
+    {
+      "name": "slidemind",
+      "source": {
+        "source": "npm",
+        "package": "slidemind"
+      },
+      "description": "Build and edit native, on-brand PowerPoint decks against the active corporate design. Ships the slidemind CLI (on PATH inside Claude Code sessions) and both skills.",
+      "author": {
+        "name": "statworx"
+      },
+      "homepage": "https://github.com/STATWORX/intern-slidemind-cli",
+      "repository": "https://github.com/STATWORX/intern-slidemind-cli",
+      "license": "UNLICENSED",
+      "category": "productivity"
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -1,11 +1,14 @@
 {
   "name": "slidemind",
-  "version": "0.0.24",
-  "description": "Connect Claude Code, Codex & opencode to the slidemind PowerPoint add-in to build and edit native, on-brand PowerPoint decks against the active corporate design.",
+  "version": "0.2.1",
+  "description": "Connect Claude Code to the slidemind PowerPoint add-in — build and edit native, on-brand PowerPoint decks against the active corporate design, from the terminal.",
   "author": {
-    "name": "statworx"
+    "name": "statworx",
+    "url": "https://www.statworx.com"
   },
   "homepage": "https://github.com/STATWORX/intern-slidemind-cli",
+  "repository": "https://github.com/STATWORX/intern-slidemind-cli",
+  "license": "UNLICENSED",
   "keywords": [
     "presentation",
     "slides",

package/.codex-plugin/plugin.json

@@ -0,0 +1,29 @@
+{
+  "name": "slidemind",
+  "version": "0.2.1",
+  "description": "Connect Codex to the slidemind PowerPoint add-in — build and edit native, on-brand PowerPoint decks against the active corporate design. Requires the slidemind CLI (npm install -g slidemind); the skills explain the install when it is missing.",
+  "author": {
+    "name": "statworx",
+    "url": "https://www.statworx.com"
+  },
+  "homepage": "https://github.com/STATWORX/intern-slidemind-cli",
+  "repository": "https://github.com/STATWORX/intern-slidemind-cli",
+  "license": "UNLICENSED",
+  "keywords": [
+    "presentation",
+    "slides",
+    "powerpoint",
+    "office-addin",
+    "slidemind"
+  ],
+  "skills": "./skills",
+  "interface": {
+    "displayName": "slidemind",
+    "shortDescription": "On-brand PowerPoint decks from Codex",
+    "developerName": "statworx",
+    "category": "Productivity",
+    "capabilities": [
+      "Skills"
+    ]
+  }
+}

package/CLAUDE.md

@@ -24,9 +24,18 @@ npm install -g slidemind
 slidemind init --for all          # claude | codex | opencode | all | none
 ```
 
-`npx slidemind <command>` runs it without a global install. `slidemind update` is a thin wrapper over `npm install -g slidemind@latest` (`--ref <version>` to pin, `--for <target>` to control the redeploy). The `files` whitelist in `package.json` controls what ships (`bin/ src/ skills/ .claude-plugin/ CLAUDE.md README.md`); `archive/`, `docs/`, `scripts/`, and `test/` are excluded.
+`npx slidemind <command>` runs it without a global install. `slidemind update` is a thin wrapper over `npm install -g slidemind@latest` (`--ref <version>` to pin, `--for <target>` to control the redeploy). The `files` whitelist in `package.json` controls what ships (`bin/ src/ skills/ .claude-plugin/ .codex-plugin/ CLAUDE.md README.md`); `archive/`, `docs/`, `scripts/`, `test/`, and `.agents/` are excluded.
 
-> The previous account-free channel (a private Azure Blob container + shared read SAS + `scripts/install.sh` curl-bootstrap) has been **retired** — see `archive/scripts/install.sh`. npm is the sole channel now.
+Both agent harnesses can also install slidemind as a **plugin** — this private repo doubles as the marketplace (a public marketplace repo can be split out later; the files move as-is). The marketplace is named `slidemind`, NOT `statworx`: the team already registers a `statworx` marketplace from `STATWORX/intern-marketplace-test`, and both harnesses allow only one marketplace per name.
+
+- **Claude Code** (one step, no `npm -g`): `/plugin marketplace add STATWORX/intern-slidemind-cli` → `/plugin install slidemind@slidemind`. The marketplace entry (`.claude-plugin/marketplace.json`) points at the **public npm package, unpinned** — Claude installs the latest tarball and the installed version comes from the tarball's `.claude-plugin/plugin.json`, so only the marketplace add needs repo access. The tarball's `bin/slidemind` + `bin/slidemind.cmd` shims land on PATH inside plugin sessions, so the plugin carries the CLI too.
+- **Codex**: `codex plugin marketplace add STATWORX/intern-slidemind-cli` → `codex plugin add slidemind@slidemind`. Codex clones the repo (marketplace file `.agents/plugins/marketplace.json`; plugin manifest `.codex-plugin/plugin.json`; plugin source = repo root) and carries the skills only — the CLI still arrives via `npm install -g slidemind`, which the skills' remediation covers.
+
+`slidemind init --for <target>` remains the universal fallback on all three harnesses; the Claude installer prints a dedup hint when it detects the plugin is also installed.
+
+**Updating a plugin-installed CLI is `/plugin`, not `slidemind update`.** The Claude plugin ships its own copy of the CLI on the session's PATH, so `npm install -g slidemind@latest` drops a second, unrelated global and the session keeps running the old binary — a user following that advice would watch the update succeed and stay blocked on the add-in's version floor. `src/install-channel.mjs` detects the channel from the running code's path (plus `CLAUDE_PLUGIN_ROOT`) and every too-old-CLI remediation ends with `updateCliInstruction()`, so the message names the updater that actually replaces this binary; the `cli_update_required` rung of the readiness ladder also flips `actor` to `user` there, because the agent cannot drive `/plugin`.
+
+> The previous account-free channel (a private Azure Blob container + shared read SAS + `scripts/install.sh` curl-bootstrap) has been **retired** — see `archive/scripts/install.sh`. npm is the sole binary channel now; the plugin marketplaces layer on top of it.
 
 ## Releasing
 
@@ -36,6 +45,8 @@ Releases are **automatic on every push to `main`**. The workflow at `.github/wor
 2. Otherwise → bumps the patch by 1, commits the bumped `package.json` back to `main`, then tags the new version. (No infinite loop: GitHub doesn't trigger workflows from commits made with the default `GITHUB_TOKEN`, and the workflow also skips if the actor is `github-actions[bot]`.)
 3. In both cases → creates a GitHub Release with auto-generated notes, then **`npm publish --access public`**.
 
+Before tagging/publishing the workflow runs `scripts/sync-plugin-manifests.mjs`, which copies `package.json`'s version into `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json` (Claude Code keys plugin updates off that version; Codex keys its plugin cache off it — the marketplace entries deliberately carry no version so they never drift). `scripts/release.mjs` runs the same sync locally, and `test/plugin-manifests.test.mjs` fails CI on drift.
+
 The publish step is gated on the `NPM_TOKEN` repo secret (an npm automation token with publish rights to `slidemind`): until it's set the workflow warns and skips publish (so tagging/releases keep working during rollout); once set, a publish failure fails the build. So most of the time you just merge to `main` and a new patch release falls out to npm.
 
 For a **minor or major** bump, run the local helper before pushing:
@@ -64,9 +75,15 @@ slidemind/
 ├── README.md                     end-user quickstart
 ├── CLAUDE.md                     this file
 ├── .claude-plugin/
-│   └── plugin.json               Claude Code plugin manifest
+│   ├── plugin.json               Claude Code plugin manifest (version release-synced to package.json)
+│   └── marketplace.json          Claude Code marketplace — serves the plugin from public npm, unpinned
+├── .codex-plugin/
+│   └── plugin.json               Codex plugin manifest (version release-synced)
+├── .agents/
+│   └── plugins/marketplace.json  Codex marketplace — serves this repo (git clone) as the plugin; NOT in the npm tarball
 ├── bin/
-│   └── slidemind.mjs             CLI dispatcher (ready, doctor, presentations, read, download-bundle, new, init, build, build-pptx, view-draft, push, ls engines, search, insert-slide, add-slide, install, pair/whoami/use/logout)
+│   ├── slidemind.mjs             CLI dispatcher (ready, doctor, presentations, read, download-bundle, new, init, build, build-pptx, view-draft, push, ls engines, search, insert-slide, add-slide, install, pair/whoami/use/logout)
+│   └── slidemind + slidemind.cmd PATH shims for Claude Code plugin sessions (npm links slidemind.mjs itself)
 ├── skills/                       canonical, installable skill payload — thin CLI workflow glue only
 │   ├── create-slides/
 │   │   └── SKILL.md              authoring skill: stage-todo bootstrap + host gate + intake/plan + create flow +
@@ -86,7 +103,7 @@ slidemind/
 ├── archive/                      retired code/assets (local exporter, icon library, brand design files) — NOT shipped
 ├── decks/                        the user's working decks; sources are slides/*.jsx, design via .bundle-ref.json
 ├── docs/slidemind-cli-connect/   the connect architecture (bridge contract, bundle, engine, phasing)
-└── test/                         node:test suites (bridge client/bundle/build-and-push/resolve-skill/lint-wrapper/packaging/engine-search/native-slides/cli-dispatch/cli-download-result)
+└── test/                         node:test suites (bridge client/bundle/build-and-push/resolve-skill/lint-wrapper/packaging/plugin-manifests/engine-search/native-slides/cli-dispatch/cli-download-result)
 ```
 
 The skills at the **root** of `skills/` are deliberate: that's the layout Claude Code, Codex (0.128+), and opencode all expect for skill auto-discovery — `<harness-root>/skills/<name>/SKILL.md`. There are **two** skills, each auto-discovered by `listSkills()` (no installer change to add one): `create-slides` (installs as `slidemind-create-slides`) owns the user-facing plan / create / edit / render workflow, and `search` (installs as `slidemind-search`) owns engine discovery + slide reuse (search → insert live / fold into a deck). Both are **brand-agnostic** — every brand rule lives in the per-CD bundle's `design.md` / `workflow/*.md`, which the skills point the agent at. (Pre-skills opencode versions used an `agent/` shim under `~/.config/opencode/`; the installer removes any leftover from those installs on every run.)

package/README.md

@@ -133,6 +133,30 @@ Run any command without installing globally:
 npx slidemind <command>
 ```
 
+### Install as a plugin (Claude Code / Codex)
+
+Both harnesses can install slidemind as a **plugin** from this repo's marketplace instead of the two-command npm flow. The repo is private, so the one-time `marketplace add` uses your existing GitHub credentials (`gh auth login`, a git credential helper, or SSH).
+
+**Claude Code — fully self-contained (no `npm install -g` needed):**
+
+```
+/plugin marketplace add STATWORX/intern-slidemind-cli
+/plugin install slidemind@slidemind
+```
+
+The plugin ships both skills *and* the CLI: under the hood Claude Code installs the public npm package and puts `slidemind` on `PATH` inside its sessions (the headless-Chrome heads-up above applies to this install too). Outside Claude Code sessions the command is not on your `PATH` — add the global install if you also want to drive the CLI by hand. Updates ship with every release; apply them via `/plugin`. If background marketplace refreshes fail against the private repo, use SSH for the marketplace add or set `CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1`.
+
+**Codex — skills via plugin, CLI via npm:**
+
+```bash
+codex plugin marketplace add STATWORX/intern-slidemind-cli
+codex plugin add slidemind@slidemind
+```
+
+Codex plugins carry the skills only — the CLI still comes from `npm install -g slidemind` (the skills walk you through it if it's missing). `slidemind init --for codex` remains the most robust path; it additionally writes an `~/.codex/AGENTS.md` pointer.
+
+> Already ran `slidemind init` and switching to a plugin? Drop the copied skills once with `slidemind uninstall --for claude` (or `--for codex`) so they don't duplicate the plugin's.
+
 ---
 
 ## Connect to PowerPoint

package/bin/slidemind

@@ -0,0 +1,7 @@
+#!/bin/sh
+# PATH shim for plugin sessions: Claude Code adds the plugin's bin/ to PATH, so
+# this makes the command literally `slidemind` (bin/slidemind.mjs would resolve
+# as `slidemind.mjs`). npm installs never use this file — npm links
+# bin/slidemind.mjs itself via package.json "bin".
+dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec node "$dir/slidemind.mjs" "$@"

package/bin/slidemind.cmd

@@ -0,0 +1,2 @@
+@ECHO OFF
+node "%~dp0slidemind.mjs" %*

package/bin/slidemind.mjs

@@ -26,6 +26,13 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+// The only eager `src/` import: node-builtins only, and the version-floor
+// ladder below is sync, so it cannot be lazily loaded like the rest.
+import {
+  isClaudePluginInstall,
+  updateCliInstruction,
+} from "../src/install-channel.mjs";
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const PACKAGE_ROOT = path.resolve(__dirname, "..");
@@ -1777,9 +1784,13 @@ function publicConnectionStatus(status, client) {
 // unmet precondition, or null when the connection is fully ready. `code` is the
 // machine-copeable reason an agent switches on; `actor` says who can clear it —
 // only `cli_update_required` is the AGENT's to fix (it can run `slidemind
-// update`), every other rung needs a human at the add-in. The `message` strings
-// are BYTE-IDENTICAL to the old connectionNextAction ladder so doctor's printed
-// output never churns (connectionNextAction is now a thin projection over this).
+// update`), every other rung needs a human at the add-in. The one exception is
+// a plugin-installed CLI: `/plugin` is the only updater that replaces the
+// binary on the session's PATH, and the agent cannot drive it, so that rung
+// hands back to the user (see src/install-channel.mjs). The `message` strings
+// are otherwise BYTE-IDENTICAL to the old connectionNextAction ladder so
+// doctor's printed output never churns (connectionNextAction is now a thin
+// projection over this).
 // `slidemind ready` layers `ambiguous_design` on top and treats `pane_suspended`
 // as non-blocking (a render-ready-but-suspended window is still a design source).
 function connectionBlocker(pub) {
@@ -1805,11 +1816,11 @@ function connectionBlocker(pub) {
   if (outdated) {
     return {
       code: "cli_update_required",
-      actor: "agent",
+      actor: isClaudePluginInstall() ? "user" : "agent",
       message:
         `This CLI is older than the minimum the '${outdated.env}' add-in supports` +
         `${outdated.minCliVersion ? ` (${outdated.minCliVersion})` : ""}. ` +
-        "Run `slidemind update` (or `npm install -g slidemind@latest`), then retry.",
+        updateCliInstruction(),
     };
   }
   if ((pub.presentations ?? []).length === 0) {
@@ -2926,6 +2937,20 @@ async function cmdUpdate(rest) {
   const ui = await loadInstallerUi();
   ui.banner(pkg.version, "update");
 
+  // A plugin-installed CLI cannot update itself this way: npm would drop a
+  // second copy into the global prefix while the plugin session keeps running
+  // its own. Say so instead of letting the user believe they are now current —
+  // the global install is still worth doing (it is what a plain terminal
+  // outside Claude Code picks up), so this warns and continues.
+  if (isClaudePluginInstall()) {
+    ui.step({
+      status: "warn",
+      label: "plugin",
+      value:
+        "this slidemind came from the Claude Code plugin — update it with `/plugin` → slidemind → update; the global install below does NOT replace it inside plugin sessions",
+    });
+  }
+
   // Upgrade the global install straight from public npm. `@latest` (or a pinned
   // version) lets npm resolve + verify the tarball — no SAS, no checksum dance.
   const spec = ref

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slidemind",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Connect Claude Code, Codex & opencode to the slidemind PowerPoint add-in — let your coding agent build and edit native, on-brand PowerPoint decks against your active corporate design, from the terminal.",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
     "src/",
     "skills/",
     ".claude-plugin/",
+    ".codex-plugin/",
     "CLAUDE.md",
     "README.md"
   ],

package/src/bridge/bundle.mjs

@@ -52,6 +52,7 @@ import {
   getDesignBundleForBrand,
   getDesignBundleForBrandAnyBackend,
 } from "./client.mjs";
+import { updateCliInstruction } from "../install-channel.mjs";
 
 // Highest bundle wire-contract version this CLI understands. The add-in stamps
 // `schemaVersion` on every bundle; a higher value means the CLI is too old.
@@ -278,7 +279,7 @@ export async function materializeBundle(
     throw new Error(
       `This corporate design needs a newer slidemind (bundle schemaVersion ` +
         `${wire.schemaVersion}; this CLI supports ${CLI_MAX_BUNDLE_SCHEMA}).\n` +
-        `  Run 'slidemind update' (or re-run the install one-liner), then retry.`,
+        `  ${updateCliInstruction()}`,
     );
   }
   const presFP = wire.presFP;

package/src/bridge/client.mjs

@@ -17,6 +17,7 @@ import {
   getSessionFor,
   readSessions,
 } from "./config.mjs";
+import { updateCliInstruction } from "../install-channel.mjs";
 
 // This CLI's own version, for the add-in's minCliVersion floor (see
 // assertCliVersionSupported). Read lazily from the package manifest so the
@@ -57,8 +58,7 @@ export function compareCliVersions(a, b) {
 function cliUpdateRequiredError(min) {
   const err = new Error(
     `slidemind CLI ${cliVersion()} is older than the minimum this add-in ` +
-      `supports (${min}). Run \`slidemind update\` (or ` +
-      "`npm install -g slidemind@latest`), then retry.",
+      `supports (${min}). ${updateCliInstruction()}`,
   );
   err.code = "cli_update_required";
   return err;

package/src/install-channel.mjs

@@ -0,0 +1,61 @@
+// Which channel installed the CLI that is running right now?
+//
+// npm (`npm install -g slidemind`, or `npx`) is the default and the one every
+// "your CLI is too old" remediation used to assume. Claude Code's plugin
+// channel breaks that assumption: the plugin ships its OWN copy of the CLI and
+// puts it on the plugin session's PATH, so `npm install -g slidemind@latest`
+// installs a second, unrelated global and the session keeps running the old
+// plugin copy. A plugin user following the npm remediation would watch the
+// update succeed and stay blocked on the add-in's version floor forever.
+//
+// Detection is by the path this file lives at — where the running code came
+// from — not by env, so it holds for any process the plugin session spawns.
+// `CLAUDE_PLUGIN_ROOT` is honoured as a secondary signal when Claude Code
+// exports it.
+//
+// Codex is deliberately NOT detected: Codex plugins carry the skills only (they
+// cannot put a bin on PATH), so a Codex-plugin session always runs the npm CLI
+// and the npm remediation is already correct there.
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PACKAGE_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..",
+);
+
+// `~/.claude/plugins/cache/<marketplace>/<plugin>/…` — a `plugins` segment
+// directly under `.claude`. Matching the pair (not either half alone) keeps a
+// user's own `~/dev/.claude/plugins`-shaped checkout from being the only thing
+// that can false-positive.
+function underClaudePlugins(root) {
+  const segs = path.resolve(root).split(/[\\/]+/);
+  for (let i = 1; i < segs.length; i += 1) {
+    if (segs[i] === "plugins" && segs[i - 1] === ".claude") return true;
+  }
+  return false;
+}
+
+export function isClaudePluginInstall(root = PACKAGE_ROOT) {
+  const resolved = path.resolve(root);
+  if (underClaudePlugins(resolved)) return true;
+  const declared = process.env.CLAUDE_PLUGIN_ROOT;
+  if (declared) {
+    const rel = path.relative(path.resolve(declared), resolved);
+    if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// The one sentence every version-floor / too-old-CLI message ends with, so the
+// remediation always names the updater that actually replaces THIS binary.
+export function updateCliInstruction() {
+  return isClaudePluginInstall()
+    ? "This CLI came from the slidemind Claude Code plugin, so update it there: " +
+        "`/plugin` → slidemind → update (a global `npm install -g slidemind@latest` " +
+        "installs a separate copy and will NOT change the `slidemind` this session runs)."
+    : "Run `slidemind update` (or `npm install -g slidemind@latest`), then retry.";
+}

package/src/installers/claude.mjs

@@ -78,6 +78,19 @@ function unregisterMcpServer() {
   return false;
 }
 
+// ~/.claude/plugins/cache/<marketplace>/slidemind/ — presence means the Claude
+// Code plugin is also installed; skills copied by `init` duplicate its skills.
+function pluginInstallDetected() {
+  const cacheRoot = path.join(claudeRoot(), "plugins", "cache");
+  try {
+    return fs
+      .readdirSync(cacheRoot)
+      .some((mp) => fs.existsSync(path.join(cacheRoot, mp, NAMESPACE)));
+  } catch {
+    return false;
+  }
+}
+
 export async function install({ packageRoot, flags }) {
   const link = isLinkMode(flags);
   const force = isForce(flags);
@@ -108,6 +121,15 @@ export async function install({ packageRoot, flags }) {
   if (unregisterMcpServer()) {
     ui.step({ status: "remove", label: "mcp server", value: "removed legacy registration (slidemind is a CLI)" });
   }
+
+  if (pluginInstallDetected()) {
+    ui.step({
+      status: "info",
+      label: "plugin",
+      value:
+        "the slidemind Claude Code plugin is also installed — these copied skills duplicate its skills; plugin users can drop them with `slidemind uninstall --for claude`",
+    });
+  }
 }
 
 export async function uninstall() {