universal-plugin 0.10.0 → 0.11.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/dist/cli.mjs

@@ -4,8 +4,10 @@ import { fileURLToPath } from "node:url";
 import * as childProcess from "node:child_process";
 import { execFileSync } from "node:child_process";
 import * as path from "node:path";
+import { join, win32 } from "node:path";
 import * as fs from "node:fs";
 import * as os from "node:os";
+import { homedir } from "node:os";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -7363,35 +7365,6 @@ function configCommand(fs = realConfigFs) {
 	return new Command("config").description("Read and write plugin-registered config in .agents/universal-plugin.json").addCommand(addCommand$1(fs)).addCommand(getCommand(fs));
 }
 //#endregion
-//#region src/governance/cli.ts
-const RETIRED = "universal-plugin governance is retired; buddy-agent-harness reference reads the same documents.\n";
-const IN_A_SKILL = "In a skill, load a document with the load-reference skill in the buddy-agent-harness plugin.\n";
-function retire(replacement) {
-	process.stderr.write(`${RETIRED}${IN_A_SKILL}→ ${replacement}\n`);
-	process.exit(1);
-}
-/** The flags `governance show` took that carried a value, so the value is not read as the name. */
-const VALUE_FLAGS = new Set(["--root", "--format"]);
-function documentName(args) {
-	for (let i = 0; i < args.length; i++) {
-		const arg = args[i];
-		if (VALUE_FLAGS.has(arg)) i++;
-		else if (!arg.startsWith("-")) return arg;
-	}
-	return "<name>";
-}
-/** Takes any argument or flag, so a caller still passing `--root` or `--format json` is told where
-*  to go instead of what it typed wrong. */
-function retiredCommand(name) {
-	return new Command(name).allowUnknownOption().allowExcessArguments().helpOption(false);
-}
-function governanceCommand() {
-	const cmd = retiredCommand("governance").description("Retired: use buddy-agent-harness reference").helpOption("-h, --help", "Show help").helpCommand(false).addHelpText("after", "\nThis command is retired. buddy-agent-harness reference show|list|search reads the same documents.\nExample:\n  $ buddy-agent-harness reference show plugin-design\n").action(() => retire("buddy-agent-harness reference list"));
-	cmd.addCommand(retiredCommand("show").action((_opts, command) => retire(`buddy-agent-harness reference show ${documentName(command.args)}`)));
-	cmd.addCommand(retiredCommand("list").action(() => retire("buddy-agent-harness reference list")));
-	return cmd;
-}
-//#endregion
 //#region src/init/fs.ts
 function git(root, args) {
 	try {
@@ -7479,7 +7452,7 @@ const UP_NAMESPACE = "org.cyberuni.universal-plugin";
 const SCAFFOLD_DIRS = [
 	"skills",
 	"agents",
-	"governances",
+	"references",
 	"commands"
 ];
 /** The closed canonical manifest init writes: `$schema` + `name`, plus the extensions namespace
@@ -7630,7 +7603,7 @@ function collect$1(value, previous) {
 }
 function initCommand$1(deps = { fs: realInitFs }) {
 	const cmd = new Command("init").description("Scaffold the canonical plugin.json (with --npm, wire an npm package to ship it)");
-	cmd.option("--name <name>", "Plugin name (default: the root directory name)").option("--vendor <id>", "Target vendor; repeatable", collect$1, []).option("--scaffold", "Create the standard skills/ agents/ governances/ commands/ directories").option("--force", "Overwrite an existing plugin.json").option("--yes", "Non-interactive (compatibility no-op; init never prompts)").option("--npm", "Wire package.json 'files' to ship the derived vendor manifests").option("--no-marketplace", "Skip the repository's local marketplace catalogs").option("--format <format>", "Output format: json or toon (default: toon)").addOption(new Option("--json").hideHelp()).addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin init --name my-plugin --scaffold\n").action((opts) => {
+	cmd.option("--name <name>", "Plugin name (default: the root directory name)").option("--vendor <id>", "Target vendor; repeatable", collect$1, []).option("--scaffold", "Create the standard skills/ agents/ references/ commands/ directories").option("--force", "Overwrite an existing plugin.json").option("--yes", "Non-interactive (compatibility no-op; init never prompts)").option("--npm", "Wire package.json 'files' to ship the derived vendor manifests").option("--no-marketplace", "Skip the repository's local marketplace catalogs").option("--format <format>", "Output format: json or toon (default: toon)").addOption(new Option("--json").hideHelp()).addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin init --name my-plugin --scaffold\n").action((opts) => {
 		try {
 			const root = resolveRoot(opts.root);
 			const plan = planInit(deps.fs.gather(root), {
@@ -7663,6 +7636,241 @@ function initCommand$1(deps = { fs: realInitFs }) {
 	return cmd;
 }
 //#endregion
+//#region ../../node_modules/.pnpm/@cyberuni+agent-harness@0.1.0/node_modules/@cyberuni/agent-harness/dist/index.js
+const harnessIds = [
+	"claude-code",
+	"cursor",
+	"codex",
+	"copilot-cli",
+	"opencode",
+	"kilo",
+	"gemini-cli",
+	"qwen-code",
+	"vscode-copilot",
+	"cline"
+];
+function resolveHarnessEnvironment(environment = {}) {
+	return {
+		env: environment.env ?? process.env,
+		homedir: environment.homedir ?? homedir(),
+		cwd: environment.cwd ?? process.cwd(),
+		platform: environment.platform ?? process.platform
+	};
+}
+/**
+* Where a harness keeps plugins at the user level. Paths are computed, not checked: a location may
+* not exist until the first plugin is installed.
+*/
+function pluginStorage(harness, environment = {}) {
+	return storages[harness](resolveHarnessEnvironment(environment));
+}
+/** `$XDG_CONFIG_HOME`, else `~/.config`, as the `xdg-basedir` package resolves it. */
+const xdgConfig = ({ env, homedir }) => env.XDG_CONFIG_HOME || join(homedir, ".config");
+/** The agent plugin folder of the stable VS Code build, per OS (E-VSC-P3). */
+function vscodeAgentPlugins({ env, homedir, platform }) {
+	if (platform === "win32") {
+		const configDir = win32.join(env.APPDATA || win32.join(homedir, "AppData", "Roaming"), "Code");
+		return {
+			configDir,
+			path: win32.join(configDir, "agentPlugins")
+		};
+	}
+	const configDir = platform === "darwin" ? join(homedir, "Library", "Application Support", "Code") : join(homedir, ".config", "Code");
+	return {
+		configDir,
+		path: join(configDir, "agentPlugins")
+	};
+}
+const storages = {
+	"claude-code": ({ env, homedir }) => {
+		const configDir = env.CLAUDE_CONFIG_DIR || join(homedir, ".claude");
+		const plugins = join(configDir, "plugins");
+		return {
+			harness: "claude-code",
+			configDir,
+			locations: [
+				{
+					kind: "plugin-cache",
+					path: join(plugins, "cache"),
+					description: "Installed plugins as <marketplace>/<plugin>/<version>/",
+					research: "E-CC-P1"
+				},
+				{
+					kind: "marketplaces",
+					path: join(plugins, "marketplaces"),
+					description: "Marketplace checkouts",
+					research: "E-CC-P1"
+				},
+				{
+					kind: "install-record",
+					path: join(plugins, "installed_plugins.json"),
+					description: "Installs keyed by plugin@marketplace, each with scope, installPath, and version",
+					research: "E-CC-P2"
+				},
+				{
+					kind: "enabled-record",
+					path: join(configDir, "settings.json"),
+					description: "User settings; enabledPlugins maps plugin@marketplace to a boolean",
+					research: "E-CC-P3"
+				}
+			]
+		};
+	},
+	cursor: ({ homedir }) => {
+		const configDir = join(homedir, ".cursor");
+		return {
+			harness: "cursor",
+			configDir,
+			locations: [{
+				kind: "local-plugins",
+				path: join(configDir, "plugins", "local"),
+				description: "Plugins under development, one folder each",
+				research: "E-CUR-P2"
+			}, {
+				kind: "marketplaces",
+				path: join(configDir, "plugins", "marketplaces"),
+				description: "Marketplace checkouts",
+				research: "E-CUR-P3"
+			}]
+		};
+	},
+	codex: ({ env, homedir }) => {
+		const configDir = env.CODEX_HOME || join(homedir, ".codex");
+		return {
+			harness: "codex",
+			configDir,
+			locations: [{
+				kind: "plugin-cache",
+				path: join(configDir, "plugins", "cache"),
+				description: "Installed plugins as <marketplace>/<plugin>/<version>/",
+				research: "E-CODEX-P3"
+			}, {
+				kind: "enabled-record",
+				path: join(configDir, "config.toml"),
+				description: "User config; [plugins.\"<plugin>@<marketplace>\"] tables carry enabled = <bool>",
+				research: "E-CODEX-P2"
+			}]
+		};
+	},
+	"copilot-cli": ({ env, homedir }) => {
+		const configDir = env.COPILOT_HOME || join(homedir, ".copilot");
+		return {
+			harness: "copilot-cli",
+			configDir,
+			locations: [
+				{
+					kind: "installed-plugins",
+					path: join(configDir, "installed-plugins"),
+					description: "Installed plugins as <marketplace>/<plugin>/, or _direct/<source-id>/ for direct installs",
+					research: "E-COPILOT-P9"
+				},
+				{
+					kind: "install-record",
+					path: join(configDir, "config.json"),
+					description: "Application state, including installedPlugins",
+					research: "E-COPILOT-P9"
+				},
+				{
+					kind: "enabled-record",
+					path: join(configDir, "settings.json"),
+					description: "User settings (JSON with comments); enabledPlugins maps plugin specs to a boolean",
+					research: "E-COPILOT-P4"
+				}
+			]
+		};
+	},
+	opencode: (environment) => {
+		const configDir = join(xdgConfig(environment), "opencode");
+		return {
+			harness: "opencode",
+			configDir,
+			locations: [{
+				kind: "local-plugins",
+				path: join(configDir, "plugins"),
+				description: "JS/TS plugin modules loaded at startup; npm plugins are named in the plugin config array",
+				research: "E-OC-P2"
+			}]
+		};
+	},
+	kilo: (environment) => {
+		const configDir = join(xdgConfig(environment), "kilo");
+		return {
+			harness: "kilo",
+			configDir,
+			locations: [{
+				kind: "local-plugins",
+				path: join(configDir, "plugin"),
+				description: "JS/TS plugin modules loaded at startup; npm plugins are named in the plugin config array",
+				research: "E-KILO-P2"
+			}]
+		};
+	},
+	"gemini-cli": ({ env, homedir }) => {
+		const configDir = join(env.GEMINI_CLI_HOME || homedir, ".gemini");
+		const extensions = join(configDir, "extensions");
+		return {
+			harness: "gemini-cli",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path: extensions,
+				description: "Installed extensions, one folder each with a gemini-extension.json manifest",
+				research: "E-GEM-P1"
+			}, {
+				kind: "enabled-record",
+				path: join(extensions, "extension-enablement.json"),
+				description: "Per-extension path-glob overrides that enable or disable it by folder, not a boolean",
+				research: "E-GEM-P3"
+			}]
+		};
+	},
+	"qwen-code": ({ env, homedir }) => {
+		const configDir = env.QWEN_HOME || join(homedir, ".qwen");
+		const extensions = join(configDir, "extensions");
+		return {
+			harness: "qwen-code",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path: extensions,
+				description: "Installed extensions, one folder each with a qwen-extension.json manifest",
+				research: "E-QWEN-P1"
+			}, {
+				kind: "enabled-record",
+				path: join(extensions, "extension-enablement.json"),
+				description: "Extension enable/disable state, inherited from Gemini CLI's format",
+				research: "E-QWEN-P2"
+			}]
+		};
+	},
+	"vscode-copilot": (environment) => {
+		const { configDir, path } = vscodeAgentPlugins(environment);
+		return {
+			harness: "vscode-copilot",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path,
+				description: "Installed agent plugins as <host>/<org>/<repo>/",
+				research: "E-VSC-P3"
+			}]
+		};
+	},
+	cline: ({ homedir }) => {
+		const configDir = join(homedir, ".cline");
+		return {
+			harness: "cline",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path: join(configDir, "plugins", "_installed"),
+				description: "Installed plugins, grouped by source: npm, git, remote, or local",
+				research: "E-CLINE-P3"
+			}]
+		};
+	}
+};
+//#endregion
 //#region src/vendor-registry/vendor-registry.ts
 function lookupVendor(registry, vendorId) {
 	return registry[vendorId] ?? null;
@@ -7675,6 +7883,15 @@ function mergeRegistries(base, override) {
 	};
 	return result;
 }
+/** Fills each vendor's `localPluginDir` from `locate`, which returns the harness's `local-plugins`
+*  folder when `@cyberuni/agent-harness` knows one. A vendor it knows nothing about keeps its
+*  registry value, or `null`. */
+function withLocalPluginDirs(registry, locate) {
+	return Object.fromEntries(Object.entries(registry).map(([id, config]) => [id, {
+		...config,
+		localPluginDir: locate(id) ?? config.localPluginDir ?? null
+	}]));
+}
 //#endregion
 //#region src/vendor-registry/fs.ts
 function bundledRegistryPath() {
@@ -7684,8 +7901,15 @@ function bundledRegistryPath() {
 function userOverridePath() {
 	return path.join(os.homedir(), ".agents", "universal-plugin-vendors.json");
 }
+/** The harness's `local-plugins` folder, as `@cyberuni/agent-harness` locates it. */
+function localPluginsDir(vendorId) {
+	if (!harnessIds.includes(vendorId)) return void 0;
+	return pluginStorage(vendorId).locations.find((l) => l.kind === "local-plugins")?.path;
+}
+/** The bundled registry, with the per-harness facts `@cyberuni/agent-harness` owns filled in, then
+*  the user's override on top. */
 function loadRegistry() {
-	const bundled = JSON.parse(fs.readFileSync(bundledRegistryPath(), "utf8"));
+	const bundled = withLocalPluginDirs(JSON.parse(fs.readFileSync(bundledRegistryPath(), "utf8")), localPluginsDir);
 	try {
 		return mergeRegistries(bundled, JSON.parse(fs.readFileSync(userOverridePath(), "utf8")));
 	} catch (err) {
@@ -8791,10 +9015,67 @@ function marketplaceCommand() {
 	return new Command("marketplace").description("Generate repository-local marketplace metadata").addCommand(addCommand()).addCommand(initCommand()).addCommand(validateCommand$1());
 }
 //#endregion
-//#region src/prepare/fs.ts
-function expandHome(p) {
-	return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
+//#region src/prepare/installed-plugins.ts
+/**
+* Reads Claude Code's `installed_plugins.json` (version 2): `plugins` maps `<plugin>@<marketplace>`
+* to one entry per install, each with a `scope`, `installPath`, `version`, and, for project
+* installs, `projectPath`. Global scope takes the `user` installs; project scope takes the installs
+* whose `projectPath` is the project root.
+*/
+function parseClaudeInstallRecord(raw, { scope, projectRoot }) {
+	const plugins = isRecord(raw) && isRecord(raw["plugins"]) ? raw["plugins"] : {};
+	const result = [];
+	for (const [key, entries] of Object.entries(plugins)) {
+		if (!Array.isArray(entries)) continue;
+		const entry = entries.filter(isRecord).find((e) => scope === "global" ? e["scope"] === "user" : e["projectPath"] === projectRoot);
+		if (!entry || typeof entry["installPath"] !== "string") continue;
+		result.push({
+			name: pluginName(key),
+			version: typeof entry["version"] === "string" ? entry["version"] : "unknown",
+			root: entry["installPath"]
+		});
+	}
+	return result;
 }
+/** Strips the `@<marketplace>` suffix from a `<plugin>@<marketplace>` key. */
+function pluginName(key) {
+	const at = key.lastIndexOf("@");
+	return at > 0 ? key.slice(0, at) : key;
+}
+/**
+* Picks the newest of a plugin's cached version folders. Dotted numeric versions compare
+* numerically, part by part; anything else falls back to string order.
+*/
+function latestVersion(versions) {
+	return [...versions].sort(compareVersions).at(-1);
+}
+function compareVersions(a, b) {
+	const pa = a.split(/[.+-]/);
+	const pb = b.split(/[.+-]/);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+		const x = pa[i] ?? "";
+		const y = pb[i] ?? "";
+		if (x === y) continue;
+		const nx = Number(x);
+		const ny = Number(y);
+		if (x !== "" && y !== "" && Number.isInteger(nx) && Number.isInteger(ny)) return nx - ny;
+		return x < y ? -1 : 1;
+	}
+	return 0;
+}
+/** Maps installed plugins to the name → version record `prepare` snapshots. */
+function toVersions(plugins) {
+	return Object.fromEntries(plugins.map((p) => [p.name, p.version]));
+}
+/** Maps installed plugins to name → root, with the home directory written as `~`. */
+function toRoots(plugins, home) {
+	return Object.fromEntries(plugins.map((p) => [p.name, p.root.startsWith(home) ? "~" + p.root.slice(home.length) : p.root]));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/prepare/fs.ts
 function globalStatePath$2() {
 	return path.join(os.homedir(), ".agents", "universal-plugin.json");
 }
@@ -8813,29 +9094,14 @@ function writeStateFile(filePath, state) {
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	fs.writeFileSync(filePath, JSON.stringify(state, null, 2) + "\n", "utf8");
 }
-function realPrepareFs(vendor, projectRoot) {
+/** `environment` locates the harness's plugin folders; it defaults to the current process. */
+function realPrepareFs(harness, installScope, environment = {}) {
+	const projectRoot = installScope.projectRoot;
+	let installed;
+	const readInstalled = () => installed ??= readInstalledPlugins(harness, installScope, environment);
 	return {
-		readManifest() {
-			if (!vendor.globalManifest) return {};
-			const manifestPath = expandHome(vendor.globalManifest);
-			try {
-				const raw = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-				return Object.fromEntries(Object.entries(raw).map(([k, v]) => [k, typeof v === "object" && v !== null && "version" in v ? String(v.version) : String(v)]));
-			} catch (err) {
-				if (err.code === "ENOENT") return {};
-				throw err;
-			}
-		},
-		readPluginRoots() {
-			if (!vendor.globalPluginDir) return {};
-			const pluginDir = expandHome(vendor.globalPluginDir);
-			const manifest = this.readManifest();
-			const home = os.homedir();
-			return Object.fromEntries(Object.keys(manifest).map((name) => {
-				const absPath = path.join(pluginDir, name);
-				return [name, absPath.startsWith(home) ? "~" + absPath.slice(home.length) : absPath];
-			}));
-		},
+		readManifest: () => toVersions(readInstalled()),
+		readPluginRoots: () => toRoots(readInstalled(), environment.homedir ?? os.homedir()),
 		readGlobalState: () => readStateFile(globalStatePath$2()) ?? emptyState(),
 		readProjectState: () => projectRoot ? readStateFile(projectStatePath(projectRoot)) : null,
 		writeGlobalState: (s) => writeStateFile(globalStatePath$2(), s),
@@ -8849,7 +9115,85 @@ function populateStoreFromVendorCache(pluginRoots, versions) {
 	for (const [pluginName, pluginRoot] of Object.entries(pluginRoots)) {
 		const entryPath = storeEntryPath(storePath, `npm/${pluginName}@${versions[pluginName] ?? "unknown"}`);
 		if (entryExists(entryPath)) continue;
-		populateEntry(entryPath, pluginRoot);
+		populateEntry(entryPath, expandHome(pluginRoot));
+	}
+}
+function expandHome(p) {
+	return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
+}
+/** Lists what a harness has installed, the way that harness records it: Claude Code in its install
+*  record, Copilot CLI and Codex only in the layout of their plugin folders. Cursor keeps no record
+*  of installed plugins. */
+function readInstalledPlugins(harness, installScope, environment) {
+	const storage = pluginStorage(harness, environment);
+	const location = (kind) => storage.locations.find((l) => l.kind === kind)?.path;
+	switch (harness) {
+		case "claude-code": {
+			const record = location("install-record");
+			const raw = record ? readJson(record) : null;
+			return raw === null ? [] : parseClaudeInstallRecord(raw, installScope);
+		}
+		case "copilot-cli": {
+			const dir = location("installed-plugins");
+			return dir && installScope.scope === "global" ? readCopilotInstalls(dir) : [];
+		}
+		case "codex": {
+			const dir = location("plugin-cache");
+			return dir && installScope.scope === "global" ? readCodexCache(dir) : [];
+		}
+		default: return [];
+	}
+}
+/** `<dir>/<marketplace>/<plugin>/` for marketplace installs, `<dir>/_direct/<source-id>/` for
+*  direct ones; the plugin's own manifest carries its name and version. */
+function readCopilotInstalls(dir) {
+	return subdirs(dir).flatMap((marketplace) => subdirs(path.join(dir, marketplace)).map((folder) => {
+		const root = path.join(dir, marketplace, folder);
+		const manifest = readPluginManifest(root);
+		return {
+			name: typeof manifest["name"] === "string" ? manifest["name"] : folder,
+			version: typeof manifest["version"] === "string" ? manifest["version"] : "unknown",
+			root
+		};
+	}));
+}
+/** `<dir>/<marketplace>/<plugin>/<version>/`; the newest cached version is the installed one. */
+function readCodexCache(dir) {
+	return subdirs(dir).flatMap((marketplace) => subdirs(path.join(dir, marketplace)).flatMap((name) => {
+		const version = latestVersion(subdirs(path.join(dir, marketplace, name)));
+		return version ? [{
+			name,
+			version,
+			root: path.join(dir, marketplace, name, version)
+		}] : [];
+	}));
+}
+const PLUGIN_MANIFESTS = [
+	"plugin.json",
+	".github/plugin/plugin.json",
+	".claude-plugin/plugin.json"
+];
+function readPluginManifest(root) {
+	for (const file of PLUGIN_MANIFESTS) {
+		const raw = readJson(path.join(root, file));
+		if (typeof raw === "object" && raw !== null) return raw;
+	}
+	return {};
+}
+function readJson(filePath) {
+	try {
+		return JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		throw err;
+	}
+}
+function subdirs(dir) {
+	try {
+		return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
 	}
 }
 //#endregion
@@ -8966,8 +9310,7 @@ function runPrepare(opts) {
 //#region src/prepare/cli.ts
 function prepareCommand() {
 	return new Command("prepare").description("Detect cross-vendor plugin sync actions").argument("<vendor-id>", "Vendor to read manifest from (e.g. claude-code)").addOption(new Option("--scope <scope>", "global or project").default("global").choices(["global", "project"])).option("--root <path>", "Project root for project-scope state file").option("--dry-run", "Print action count without writing state").action((vendorId, opts) => {
-		const vendor = lookupVendor(loadRegistry(), vendorId);
-		if (!vendor) {
+		if (!lookupVendor(loadRegistry(), vendorId) || !harnessIds.includes(vendorId)) {
 			process.stderr.write(`Unknown vendor: ${vendorId}\n`);
 			process.exit(1);
 		}
@@ -8976,12 +9319,16 @@ function prepareCommand() {
 			process.exit(1);
 		}
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const prepareFs = realPrepareFs(vendor, opts.root);
+		const scope = opts.scope;
+		const prepareFs = realPrepareFs(vendorId, {
+			scope,
+			projectRoot: opts.root ? path.resolve(opts.root) : void 0
+		});
 		const pluginRoots = prepareFs.readPluginRoots();
 		const manifest = prepareFs.readManifest();
 		const { newActionCount } = runPrepare({
 			vendorId,
-			scope: opts.scope,
+			scope,
 			fs: prepareFs,
 			now,
 			dryRun: opts.dryRun
@@ -9497,7 +9844,6 @@ function pluginCommand() {
 program.addCommand(pluginCommand());
 program.addCommand(cleanCommand());
 program.addCommand(configCommand());
-program.addCommand(governanceCommand());
 program.addCommand(marketplaceCommand());
 program.addCommand(prepareCommand());
 program.addCommand(publishCommand());

package/dist/data/vendors.json

@@ -1,10 +1,8 @@
 {
 	"claude-code": {
 		"sessionStartEvent": "SessionStart",
-		"globalManifest": "~/.claude/plugins/installed_plugins.json",
 		"projectManifest": null,
 		"hookGlob": "~/.claude/plugins/universal-plugin/hooks/hooks.json",
-		"globalPluginDir": "~/.claude/plugins/",
 		"pluginRootSuffix": ".claude-plugin/plugin.json",
 		"localPluginDir": "~/.claude/skills/",
 		"localPluginLink": true,
@@ -15,12 +13,9 @@
 	},
 	"cursor": {
 		"sessionStartEvent": "sessionStart",
-		"globalManifest": null,
 		"projectManifest": null,
 		"hookGlob": null,
-		"globalPluginDir": null,
 		"pluginRootSuffix": ".cursor-plugin/plugin.json",
-		"localPluginDir": "~/.cursor/plugins/local/",
 		"localPluginLink": false,
 		"localReload": "run Developer: Reload Window in Cursor",
 		"installCommand": null,
@@ -29,10 +24,8 @@
 	},
 	"codex": {
 		"sessionStartEvent": "SessionStart",
-		"globalManifest": null,
 		"projectManifest": null,
 		"hookGlob": null,
-		"globalPluginDir": null,
 		"pluginRootSuffix": ".codex-plugin/plugin.json",
 		"localPluginDir": null,
 		"localPluginLink": false,
@@ -43,10 +36,8 @@
 	},
 	"copilot-cli": {
 		"sessionStartEvent": "sessionStart",
-		"globalManifest": null,
 		"projectManifest": null,
 		"hookGlob": null,
-		"globalPluginDir": null,
 		"pluginRootSuffix": "plugin.json",
 		"localPluginDir": null,
 		"localPluginLink": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",
@@ -39,6 +39,7 @@
     "agents"
   ],
   "dependencies": {
+    "@cyberuni/agent-harness": "^0.1.0",
     "@repobuddy/upx": "^0.1.0",
     "@toon-format/toon": "^4.1.1",
     "commander": "^14.0.3",

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/readme.md

@@ -106,14 +106,12 @@ npx universal-plugin config add --key sdd-plugins --entry '{"name":"aces","handl
 `add` appends the entry, or replaces the existing entry with the same `name`. Both commands print
 TOON by default; pass `--format json` for JSON.
 
-### governance (retired)
-
-`governance list` and `governance show` are retired. They print the replacement and exit 1 for one
-release, then go away. Read the documents with `buddy-agent-harness reference show <name>`, or, from a
-skill, with the `load-reference` skill in the `buddy-agent-harness` plugin.
+### Reference documents
 
 This package ships its own documents (`plugin-design`, `slash-invocation`, `universal-plugin`) under
-`references/`, so `reference show` finds them in any project that depends on `universal-plugin`.
+`references/`. Read one with `buddy-agent-harness reference show <name>` in any project that depends
+on `universal-plugin`, or, from a skill, with the `load-reference` skill in the `buddy-agent-harness`
+plugin.
 
 ### Housekeeping
 

package/skills/init-universal-plugin/references/standard.md

@@ -62,7 +62,7 @@ what each build gets. A vendor listed in `vendors` with no `harnesses` entry sti
 └── README.md
 ```
 
-`plugin init --scaffold` creates the standard `skills/`, `agents/`, `governances/`, and `commands/`
+`plugin init --scaffold` creates the standard `skills/`, `agents/`, `references/`, and `commands/`
 directories. Create the rest only when the plugin has content for them.
 
 ## Components