universal-plugin 0.10.0 → 0.11.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/dist/cli.mjs

@@ -4,8 +4,10 @@ import { fileURLToPath } from "node:url";
 import * as childProcess from "node:child_process";
 import { execFileSync } from "node:child_process";
 import * as path from "node:path";
+import { join, win32 } from "node:path";
 import * as fs from "node:fs";
 import * as os from "node:os";
+import { homedir } from "node:os";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -24,11 +26,11 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 //#region ../../node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/error.js
 var require_error = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -100,7 +102,6 @@ var require_argument = /* @__PURE__ */ __commonJSMin(((exports) => {
 				default:
 					this.required = true;
 					this._name = name;
-					break;
 			}
 			if (this._name.endsWith("...")) {
 				this.variadic = true;
@@ -1595,16 +1596,20 @@ Expecting one of '${allowedValues.join("', '")}'`);
 				const oldValue = this.getOptionValue(name);
 				if (val !== null && option.parseArg) val = this._callParseArg(option, val, oldValue, invalidValueMessage);
 				else if (val !== null && option.variadic) val = option._collectValue(val, oldValue);
-				if (val == null) if (option.negate) val = false;
-				else if (option.isBoolean() || option.optional) val = true;
-				else val = "";
+				if (val == null) {
+					if (option.negate) val = false;
+					else if (option.isBoolean() || option.optional) val = true;
+					else val = "";
+				}
 				this.setOptionValueWithSource(name, val, valueSource);
 			};
 			this.on("option:" + oname, (val) => {
-				handleOptionValue(val, `error: option '${option.flags}' argument '${val}' is invalid.`, "cli");
+				const invalidValueMessage = `error: option '${option.flags}' argument '${val}' is invalid.`;
+				handleOptionValue(val, invalidValueMessage, "cli");
 			});
 			if (option.envVar) this.on("optionEnv:" + oname, (val) => {
-				handleOptionValue(val, `error: option '${option.flags}' value '${val}' from env '${option.envVar}' is invalid.`, "env");
+				const invalidValueMessage = `error: option '${option.flags}' value '${val}' from env '${option.envVar}' is invalid.`;
+				handleOptionValue(val, invalidValueMessage, "env");
 			});
 			return this;
 		}
@@ -1995,12 +2000,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
 			}
 			launchWithNode = sourceExt.includes(path$1.extname(executableFile));
 			let proc;
-			if (process$1.platform !== "win32") if (launchWithNode) {
-				args.unshift(executableFile);
-				args = incrementNodeInspectorPort(process$1.execArgv).concat(args);
-				proc = childProcess$1.spawn(process$1.argv[0], args, { stdio: "inherit" });
-			} else proc = childProcess$1.spawn(executableFile, args, { stdio: "inherit" });
-			else {
+			if (process$1.platform !== "win32") {
+				if (launchWithNode) {
+					args.unshift(executableFile);
+					args = incrementNodeInspectorPort(process$1.execArgv).concat(args);
+					proc = childProcess$1.spawn(process$1.argv[0], args, { stdio: "inherit" });
+				} else proc = childProcess$1.spawn(executableFile, args, { stdio: "inherit" });
+			} else {
 				this._checkForMissingExecutable(executableFile, executableDir, subcommand._name);
 				args.unshift(executableFile);
 				args = incrementNodeInspectorPort(process$1.execArgv).concat(args);
@@ -2444,8 +2450,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
 						"default",
 						"config",
 						"env"
-					].includes(this.getOptionValueSource(optionKey))) if (option.required || option.optional) this.emit(`optionEnv:${option.name()}`, process$1.env[option.envVar]);
-					else this.emit(`optionEnv:${option.name()}`);
+					].includes(this.getOptionValueSource(optionKey))) {
+						if (option.required || option.optional) this.emit(`optionEnv:${option.name()}`, process$1.env[option.envVar]);
+						else this.emit(`optionEnv:${option.name()}`);
+					}
 				}
 			});
 		}
@@ -3069,7 +3077,7 @@ function resolveOwnVersion(packageJsonPath, deps = {}) {
 }
 //#endregion
 //#region src/state/state.ts
-const KNOWN_ACTION_TYPES = new Set([
+const KNOWN_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"install",
 	"upgrade",
 	"remove"
@@ -3782,14 +3790,12 @@ function output(data, view) {
 //#endregion
 //#region ../../node_modules/.pnpm/semver@7.8.1/node_modules/semver/internal/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const SEMVER_SPEC_VERSION = "2.0.0";
-	const MAX_LENGTH = 256;
-	const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER || 9007199254740991;
 	module.exports = {
-		MAX_LENGTH,
+		MAX_LENGTH: 256,
 		MAX_SAFE_COMPONENT_LENGTH: 16,
-		MAX_SAFE_BUILD_LENGTH: MAX_LENGTH - 6,
-		MAX_SAFE_INTEGER,
+		MAX_SAFE_BUILD_LENGTH: 250,
+		MAX_SAFE_INTEGER: Number.MAX_SAFE_INTEGER || 
+		/* istanbul ignore next */ 9007199254740991,
 		RELEASE_TYPES: [
 			"major",
 			"premajor",
@@ -3799,7 +3805,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			"prepatch",
 			"prerelease"
 		],
-		SEMVER_SPEC_VERSION,
+		SEMVER_SPEC_VERSION: "2.0.0",
 		FLAG_INCLUDE_PRERELEASE: 1,
 		FLAG_LOOSE: 2
 	};
@@ -3931,9 +3937,10 @@ var require_semver$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = class SemVer {
 		constructor(version, options) {
 			options = parseOptions(options);
-			if (version instanceof SemVer) if (version.loose === !!options.loose && version.includePrerelease === !!options.includePrerelease) return version;
-			else version = version.version;
-			else if (typeof version !== "string") throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);
+			if (version instanceof SemVer) {
+				if (version.loose === !!options.loose && version.includePrerelease === !!options.includePrerelease) return version;
+				else version = version.version;
+			} else if (typeof version !== "string") throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);
 			if (version.length > MAX_LENGTH) throw new TypeError(`version is longer than ${MAX_LENGTH} characters`);
 			debug("SemVer", version, options);
 			this.options = options;
@@ -4354,7 +4361,11 @@ var require_coerce = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		if (match === null) return null;
 		const major = match[2];
-		return parse(`${major}.${match[3] || "0"}.${match[4] || "0"}${options.includePrerelease && match[5] ? `-${match[5]}` : ""}${options.includePrerelease && match[6] ? `+${match[6]}` : ""}`, options);
+		const minor = match[3] || "0";
+		const patch = match[4] || "0";
+		const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
+		const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
+		return parse(`${major}.${minor}.${patch}${prerelease}${build}`, options);
 	};
 	module.exports = coerce;
 }));
@@ -4370,7 +4381,8 @@ var require_truncate = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return clonedVersion && doTruncation(clonedVersion, truncation);
 	};
 	const cloneInputVersion = (version, options) => {
-		return parse(version instanceof SemVer ? version.version : version, options);
+		const versionStringToParse = version instanceof SemVer ? version.version : version;
+		return parse(versionStringToParse, options);
 	};
 	const doTruncation = (version, truncation) => {
 		if (isPrerelease(truncation)) return version.version;
@@ -4380,9 +4392,7 @@ var require_truncate = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				version.minor = 0;
 				version.patch = 0;
 				break;
-			case "minor":
-				version.patch = 0;
-				break;
+			case "minor": version.patch = 0;
 		}
 		return version.format();
 	};
@@ -4431,8 +4441,10 @@ var require_range = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = class Range {
 		constructor(range, options) {
 			options = parseOptions(options);
-			if (range instanceof Range) if (range.loose === !!options.loose && range.includePrerelease === !!options.includePrerelease) return range;
-			else return new Range(range.raw, options);
+			if (range instanceof Range) {
+				if (range.loose === !!options.loose && range.includePrerelease === !!options.includePrerelease) return range;
+				else return new Range(range.raw, options);
+			}
 			if (range instanceof Comparator) {
 				this.raw = range.value;
 				this.set = [[range]];
@@ -4600,18 +4612,21 @@ var require_range = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			let ret;
 			if (isX(M)) ret = "";
 			else if (isX(m)) ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
-			else if (isX(p)) if (M === "0") ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
-			else ret = `>=${M}.${m}.0${z} <${+M + 1}.0.0-0`;
-			else if (pr) {
+			else if (isX(p)) {
+				if (M === "0") ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
+				else ret = `>=${M}.${m}.0${z} <${+M + 1}.0.0-0`;
+			} else if (pr) {
 				debug("replaceCaret pr", pr);
-				if (M === "0") if (m === "0") ret = `>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p + 1}-0`;
-				else ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
-				else ret = `>=${M}.${m}.${p}-${pr} <${+M + 1}.0.0-0`;
+				if (M === "0") {
+					if (m === "0") ret = `>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p + 1}-0`;
+					else ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
+				} else ret = `>=${M}.${m}.${p}-${pr} <${+M + 1}.0.0-0`;
 			} else {
 				debug("no pr");
-				if (M === "0") if (m === "0") ret = `>=${M}.${m}.${p}${z} <${M}.${m}.${+p + 1}-0`;
-				else ret = `>=${M}.${m}.${p}${z} <${M}.${+m + 1}.0-0`;
-				else ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
+				if (M === "0") {
+					if (m === "0") ret = `>=${M}.${m}.${p}${z} <${M}.${m}.${+p + 1}-0`;
+					else ret = `>=${M}.${m}.${p}${z} <${M}.${+m + 1}.0-0`;
+				} else ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
 			}
 			debug("caret return", ret);
 			return ret;
@@ -4632,9 +4647,10 @@ var require_range = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			const anyX = xp;
 			if (gtlt === "=" && anyX) gtlt = "";
 			pr = options.includePrerelease ? "-0" : "";
-			if (xM) if (gtlt === ">" || gtlt === "<") ret = "<0.0.0-0";
-			else ret = "*";
-			else if (gtlt && anyX) {
+			if (xM) {
+				if (gtlt === ">" || gtlt === "<") ret = "<0.0.0-0";
+				else ret = "*";
+			} else if (gtlt && anyX) {
 				if (xm) m = 0;
 				p = 0;
 				if (gtlt === ">") {
@@ -4708,8 +4724,10 @@ var require_comparator = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		constructor(comp, options) {
 			options = parseOptions(options);
-			if (comp instanceof Comparator) if (comp.loose === !!options.loose) return comp;
-			else comp = comp.value;
+			if (comp instanceof Comparator) {
+				if (comp.loose === !!options.loose) return comp;
+				else comp = comp.value;
+			}
 			comp = comp.trim().split(/\s+/).join(" ");
 			debug("comparator", comp, options);
 			this.options = options;
@@ -5029,11 +5047,15 @@ var require_subset = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const minimumVersion = [new Comparator(">=0.0.0")];
 	const simpleSubset = (sub, dom, options) => {
 		if (sub === dom) return true;
-		if (sub.length === 1 && sub[0].semver === ANY) if (dom.length === 1 && dom[0].semver === ANY) return true;
-		else if (options.includePrerelease) sub = minimumVersionWithPreRelease;
-		else sub = minimumVersion;
-		if (dom.length === 1 && dom[0].semver === ANY) if (options.includePrerelease) return true;
-		else dom = minimumVersion;
+		if (sub.length === 1 && sub[0].semver === ANY) {
+			if (dom.length === 1 && dom[0].semver === ANY) return true;
+			else if (options.includePrerelease) sub = minimumVersionWithPreRelease;
+			else sub = minimumVersion;
+		}
+		if (dom.length === 1 && dom[0].semver === ANY) {
+			if (options.includePrerelease) return true;
+			else dom = minimumVersion;
+		}
 		const eqSet = /* @__PURE__ */ new Set();
 		let gt, lt;
 		for (const c of sub) if (c.operator === ">" || c.operator === ">=") gt = higherGT(gt, c, options);
@@ -5167,7 +5189,7 @@ const VENDOR_READS_DEPENDENCIES = {
 };
 /** Vendors the canonical root manifest serves as-is: nothing is derived for them, so a declaration
 *  they cannot read is ignored at runtime rather than dropped from a file. */
-const CANONICAL_SERVED$1 = new Set(["copilot-cli"]);
+const CANONICAL_SERVED$1 = /* @__PURE__ */ new Set(["copilot-cli"]);
 /** What Claude Code accepts as a dependency string: a plugin name, an optional `@marketplace`, and an
 *  optional `@^…` range tail that the runtime strips before resolving. */
 const DEPENDENCY_STRING = /^[A-Za-z0-9][-A-Za-z0-9._]*(@[A-Za-z0-9][-A-Za-z0-9._]*)?(@\^[^@]*)?$/;
@@ -6230,12 +6252,12 @@ const STRING_FIELDS = [
 	"repository",
 	"license"
 ];
-const AUTHOR_FIELDS = new Set([
+const AUTHOR_FIELDS = /* @__PURE__ */ new Set([
 	"name",
 	"email",
 	"url"
 ]);
-const TOP_LEVEL_FIELDS = new Set([
+const TOP_LEVEL_FIELDS = /* @__PURE__ */ new Set([
 	"$schema",
 	"name",
 	...STRING_FIELDS,
@@ -6256,7 +6278,7 @@ function validateCanonicalManifest(manifest, opts) {
 		const uext = isObject(manifest.extensions) ? manifest.extensions[UP_NAMESPACE$2] : void 0;
 		const extension = isObject(uext) ? uext : {};
 		const harnesses = isObject(extension.harnesses) ? extension.harnesses : {};
-		const declared = [...new Set([...Array.isArray(extension.vendors) ? extension.vendors.filter((v) => typeof v === "string") : [], ...Object.keys(harnesses)])];
+		const declared = [.../* @__PURE__ */ new Set([...Array.isArray(extension.vendors) ? extension.vendors.filter((v) => typeof v === "string") : [], ...Object.keys(harnesses)])];
 		for (const vendor of declared.filter((v) => !opts.knownVendors.has(v))) {
 			const message = `Unknown vendor "${vendor}" in harnesses`;
 			warnings.push(message);
@@ -6313,18 +6335,22 @@ function schemaRuleViolations(manifest, warnings) {
 		else for (const [key, value] of Object.entries(manifest.author)) if (!AUTHOR_FIELDS.has(key)) push(`author.${key}`, "additionalProperties", "unknown author field");
 		else if (typeof value !== "string") push(`author.${key}`, "type", "must be a string");
 	}
-	if (manifest.keywords !== void 0) if (!Array.isArray(manifest.keywords)) push("keywords", "type", "must be an array of strings");
-	else manifest.keywords.forEach((keyword, index) => {
-		if (typeof keyword !== "string") push(`keywords[${index}]`, "type", "must be a string");
-	});
-	if (manifest.extensions !== void 0) if (!isObject(manifest.extensions)) push("extensions", "type", "must be an object keyed by namespace");
-	else {
-		for (const [namespace, value] of Object.entries(manifest.extensions)) if (!isObject(value)) push(`extensions.${namespace}`, "type", "must be an object");
-		const uext = manifest.extensions[UP_NAMESPACE$2];
-		if (isObject(uext)) {
-			const dependencies = validateDependencies(uext.dependencies);
-			for (const error of dependencies.errors) push(`extensions.${UP_NAMESPACE$2}.dependencies`, "dependencies", error);
-			warnings.push(...dependencies.warnings);
+	if (manifest.keywords !== void 0) {
+		if (!Array.isArray(manifest.keywords)) push("keywords", "type", "must be an array of strings");
+		else manifest.keywords.forEach((keyword, index) => {
+			if (typeof keyword !== "string") push(`keywords[${index}]`, "type", "must be a string");
+		});
+	}
+	if (manifest.extensions !== void 0) {
+		if (!isObject(manifest.extensions)) push("extensions", "type", "must be an object keyed by namespace");
+		else {
+			for (const [namespace, value] of Object.entries(manifest.extensions)) if (!isObject(value)) push(`extensions.${namespace}`, "type", "must be an object");
+			const uext = manifest.extensions[UP_NAMESPACE$2];
+			if (isObject(uext)) {
+				const dependencies = validateDependencies(uext.dependencies);
+				for (const error of dependencies.errors) push(`extensions.${UP_NAMESPACE$2}.dependencies`, "dependencies", error);
+				warnings.push(...dependencies.warnings);
+			}
 		}
 	}
 	for (const key of Object.keys(manifest)) if (!TOP_LEVEL_FIELDS.has(key)) push(key, "additionalProperties", "not an Agent Plugins 1.0.0 field; move tool-specific data under extensions");
@@ -6344,7 +6370,7 @@ const KNOWN_VENDORS$1 = new Set(Object.keys(VENDOR_OUTPUT));
 /** Vendors the canonical root manifest serves as-is. The build derives no *manifest* for these —
 *  writing one would either be shadowed by root (a lower-precedence path) or clobber root itself.
 *  Their components are a separate question: see COPILOT_NAMESPACE. */
-const CANONICAL_SERVED = new Set(["copilot-cli"]);
+const CANONICAL_SERVED = /* @__PURE__ */ new Set(["copilot-cli"]);
 /** The reverse-domain directory Copilot CLI reads its native components from once a plugin declares
 *  the canonical `$schema` (ADR-0015). It REPLACES the plugin root for these kinds — a spec-mode
 *  runtime does not read `agents/` at all — so the build derives the tree rather than relying on the
@@ -6504,11 +6530,15 @@ function buildPlugin(root, opts = {}) {
 		}
 		for (const drop of dedupeDrops(hooks?.drops ?? [])) warnings.push(`${vendor} cannot run the "${drop.type}" hook handler on ${drop.event} — dropped from the derived hooks file`);
 		const derivedHooksPath = path.join(outputDir, "hooks.json");
-		if (hooks?.changed) if (hooks.hooks) vendorManifest["hooks"] = `./${path.dirname(relPath).split(path.sep).join("/")}/hooks.json`;
-		else delete vendorManifest["hooks"];
+		if (hooks?.changed) {
+			if (hooks.hooks) vendorManifest["hooks"] = `./${path.dirname(relPath).split(path.sep).join("/")}/hooks.json`;
+			else delete vendorManifest["hooks"];
+		}
 		const derivedMcpPath = path.join(outputDir, "mcp.json");
-		if (mcp?.changed && declaredMcp) if (declaredMcp.inline) vendorManifest["mcpServers"] = mcp.servers;
-		else vendorManifest["mcpServers"] = `./${path.dirname(relPath).split(path.sep).join("/")}/mcp.json`;
+		if (mcp?.changed && declaredMcp) {
+			if (declaredMcp.inline) vendorManifest["mcpServers"] = mcp.servers;
+			else vendorManifest["mcpServers"] = `./${path.dirname(relPath).split(path.sep).join("/")}/mcp.json`;
+		}
 		if (opts.verbose) {
 			console.log(`[${vendor}] → ${outputPath}`);
 			for (const key of Object.keys(vendorFields)) console.log(`  + ${key} (from harnesses.${vendor})`);
@@ -6946,7 +6976,7 @@ function buildCommand() {
 }
 //#endregion
 //#region src/pin/fs.ts
-const TEXT_EXTENSIONS = new Set([
+const TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
 	".md",
 	".mdx",
 	".markdown",
@@ -7363,35 +7393,6 @@ function configCommand(fs = realConfigFs) {
 	return new Command("config").description("Read and write plugin-registered config in .agents/universal-plugin.json").addCommand(addCommand$1(fs)).addCommand(getCommand(fs));
 }
 //#endregion
-//#region src/governance/cli.ts
-const RETIRED = "universal-plugin governance is retired; buddy-agent-harness reference reads the same documents.\n";
-const IN_A_SKILL = "In a skill, load a document with the load-reference skill in the buddy-agent-harness plugin.\n";
-function retire(replacement) {
-	process.stderr.write(`${RETIRED}${IN_A_SKILL}→ ${replacement}\n`);
-	process.exit(1);
-}
-/** The flags `governance show` took that carried a value, so the value is not read as the name. */
-const VALUE_FLAGS = new Set(["--root", "--format"]);
-function documentName(args) {
-	for (let i = 0; i < args.length; i++) {
-		const arg = args[i];
-		if (VALUE_FLAGS.has(arg)) i++;
-		else if (!arg.startsWith("-")) return arg;
-	}
-	return "<name>";
-}
-/** Takes any argument or flag, so a caller still passing `--root` or `--format json` is told where
-*  to go instead of what it typed wrong. */
-function retiredCommand(name) {
-	return new Command(name).allowUnknownOption().allowExcessArguments().helpOption(false);
-}
-function governanceCommand() {
-	const cmd = retiredCommand("governance").description("Retired: use buddy-agent-harness reference").helpOption("-h, --help", "Show help").helpCommand(false).addHelpText("after", "\nThis command is retired. buddy-agent-harness reference show|list|search reads the same documents.\nExample:\n  $ buddy-agent-harness reference show plugin-design\n").action(() => retire("buddy-agent-harness reference list"));
-	cmd.addCommand(retiredCommand("show").action((_opts, command) => retire(`buddy-agent-harness reference show ${documentName(command.args)}`)));
-	cmd.addCommand(retiredCommand("list").action(() => retire("buddy-agent-harness reference list")));
-	return cmd;
-}
-//#endregion
 //#region src/init/fs.ts
 function git(root, args) {
 	try {
@@ -7479,7 +7480,7 @@ const UP_NAMESPACE = "org.cyberuni.universal-plugin";
 const SCAFFOLD_DIRS = [
 	"skills",
 	"agents",
-	"governances",
+	"references",
 	"commands"
 ];
 /** The closed canonical manifest init writes: `$schema` + `name`, plus the extensions namespace
@@ -7630,7 +7631,7 @@ function collect$1(value, previous) {
 }
 function initCommand$1(deps = { fs: realInitFs }) {
 	const cmd = new Command("init").description("Scaffold the canonical plugin.json (with --npm, wire an npm package to ship it)");
-	cmd.option("--name <name>", "Plugin name (default: the root directory name)").option("--vendor <id>", "Target vendor; repeatable", collect$1, []).option("--scaffold", "Create the standard skills/ agents/ governances/ commands/ directories").option("--force", "Overwrite an existing plugin.json").option("--yes", "Non-interactive (compatibility no-op; init never prompts)").option("--npm", "Wire package.json 'files' to ship the derived vendor manifests").option("--no-marketplace", "Skip the repository's local marketplace catalogs").option("--format <format>", "Output format: json or toon (default: toon)").addOption(new Option("--json").hideHelp()).addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin init --name my-plugin --scaffold\n").action((opts) => {
+	cmd.option("--name <name>", "Plugin name (default: the root directory name)").option("--vendor <id>", "Target vendor; repeatable", collect$1, []).option("--scaffold", "Create the standard skills/ agents/ references/ commands/ directories").option("--force", "Overwrite an existing plugin.json").option("--yes", "Non-interactive (compatibility no-op; init never prompts)").option("--npm", "Wire package.json 'files' to ship the derived vendor manifests").option("--no-marketplace", "Skip the repository's local marketplace catalogs").option("--format <format>", "Output format: json or toon (default: toon)").addOption(new Option("--json").hideHelp()).addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin init --name my-plugin --scaffold\n").action((opts) => {
 		try {
 			const root = resolveRoot(opts.root);
 			const plan = planInit(deps.fs.gather(root), {
@@ -7663,6 +7664,241 @@ function initCommand$1(deps = { fs: realInitFs }) {
 	return cmd;
 }
 //#endregion
+//#region ../../node_modules/.pnpm/@cyberuni+agent-harness@0.1.0/node_modules/@cyberuni/agent-harness/dist/index.js
+const harnessIds = [
+	"claude-code",
+	"cursor",
+	"codex",
+	"copilot-cli",
+	"opencode",
+	"kilo",
+	"gemini-cli",
+	"qwen-code",
+	"vscode-copilot",
+	"cline"
+];
+function resolveHarnessEnvironment(environment = {}) {
+	return {
+		env: environment.env ?? process.env,
+		homedir: environment.homedir ?? homedir(),
+		cwd: environment.cwd ?? process.cwd(),
+		platform: environment.platform ?? process.platform
+	};
+}
+/**
+* Where a harness keeps plugins at the user level. Paths are computed, not checked: a location may
+* not exist until the first plugin is installed.
+*/
+function pluginStorage(harness, environment = {}) {
+	return storages[harness](resolveHarnessEnvironment(environment));
+}
+/** `$XDG_CONFIG_HOME`, else `~/.config`, as the `xdg-basedir` package resolves it. */
+const xdgConfig = ({ env, homedir }) => env.XDG_CONFIG_HOME || join(homedir, ".config");
+/** The agent plugin folder of the stable VS Code build, per OS (E-VSC-P3). */
+function vscodeAgentPlugins({ env, homedir, platform }) {
+	if (platform === "win32") {
+		const configDir = win32.join(env.APPDATA || win32.join(homedir, "AppData", "Roaming"), "Code");
+		return {
+			configDir,
+			path: win32.join(configDir, "agentPlugins")
+		};
+	}
+	const configDir = platform === "darwin" ? join(homedir, "Library", "Application Support", "Code") : join(homedir, ".config", "Code");
+	return {
+		configDir,
+		path: join(configDir, "agentPlugins")
+	};
+}
+const storages = {
+	"claude-code": ({ env, homedir }) => {
+		const configDir = env.CLAUDE_CONFIG_DIR || join(homedir, ".claude");
+		const plugins = join(configDir, "plugins");
+		return {
+			harness: "claude-code",
+			configDir,
+			locations: [
+				{
+					kind: "plugin-cache",
+					path: join(plugins, "cache"),
+					description: "Installed plugins as <marketplace>/<plugin>/<version>/",
+					research: "E-CC-P1"
+				},
+				{
+					kind: "marketplaces",
+					path: join(plugins, "marketplaces"),
+					description: "Marketplace checkouts",
+					research: "E-CC-P1"
+				},
+				{
+					kind: "install-record",
+					path: join(plugins, "installed_plugins.json"),
+					description: "Installs keyed by plugin@marketplace, each with scope, installPath, and version",
+					research: "E-CC-P2"
+				},
+				{
+					kind: "enabled-record",
+					path: join(configDir, "settings.json"),
+					description: "User settings; enabledPlugins maps plugin@marketplace to a boolean",
+					research: "E-CC-P3"
+				}
+			]
+		};
+	},
+	cursor: ({ homedir }) => {
+		const configDir = join(homedir, ".cursor");
+		return {
+			harness: "cursor",
+			configDir,
+			locations: [{
+				kind: "local-plugins",
+				path: join(configDir, "plugins", "local"),
+				description: "Plugins under development, one folder each",
+				research: "E-CUR-P2"
+			}, {
+				kind: "marketplaces",
+				path: join(configDir, "plugins", "marketplaces"),
+				description: "Marketplace checkouts",
+				research: "E-CUR-P3"
+			}]
+		};
+	},
+	codex: ({ env, homedir }) => {
+		const configDir = env.CODEX_HOME || join(homedir, ".codex");
+		return {
+			harness: "codex",
+			configDir,
+			locations: [{
+				kind: "plugin-cache",
+				path: join(configDir, "plugins", "cache"),
+				description: "Installed plugins as <marketplace>/<plugin>/<version>/",
+				research: "E-CODEX-P3"
+			}, {
+				kind: "enabled-record",
+				path: join(configDir, "config.toml"),
+				description: "User config; [plugins.\"<plugin>@<marketplace>\"] tables carry enabled = <bool>",
+				research: "E-CODEX-P2"
+			}]
+		};
+	},
+	"copilot-cli": ({ env, homedir }) => {
+		const configDir = env.COPILOT_HOME || join(homedir, ".copilot");
+		return {
+			harness: "copilot-cli",
+			configDir,
+			locations: [
+				{
+					kind: "installed-plugins",
+					path: join(configDir, "installed-plugins"),
+					description: "Installed plugins as <marketplace>/<plugin>/, or _direct/<source-id>/ for direct installs",
+					research: "E-COPILOT-P9"
+				},
+				{
+					kind: "install-record",
+					path: join(configDir, "config.json"),
+					description: "Application state, including installedPlugins",
+					research: "E-COPILOT-P9"
+				},
+				{
+					kind: "enabled-record",
+					path: join(configDir, "settings.json"),
+					description: "User settings (JSON with comments); enabledPlugins maps plugin specs to a boolean",
+					research: "E-COPILOT-P4"
+				}
+			]
+		};
+	},
+	opencode: (environment) => {
+		const configDir = join(xdgConfig(environment), "opencode");
+		return {
+			harness: "opencode",
+			configDir,
+			locations: [{
+				kind: "local-plugins",
+				path: join(configDir, "plugins"),
+				description: "JS/TS plugin modules loaded at startup; npm plugins are named in the plugin config array",
+				research: "E-OC-P2"
+			}]
+		};
+	},
+	kilo: (environment) => {
+		const configDir = join(xdgConfig(environment), "kilo");
+		return {
+			harness: "kilo",
+			configDir,
+			locations: [{
+				kind: "local-plugins",
+				path: join(configDir, "plugin"),
+				description: "JS/TS plugin modules loaded at startup; npm plugins are named in the plugin config array",
+				research: "E-KILO-P2"
+			}]
+		};
+	},
+	"gemini-cli": ({ env, homedir }) => {
+		const configDir = join(env.GEMINI_CLI_HOME || homedir, ".gemini");
+		const extensions = join(configDir, "extensions");
+		return {
+			harness: "gemini-cli",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path: extensions,
+				description: "Installed extensions, one folder each with a gemini-extension.json manifest",
+				research: "E-GEM-P1"
+			}, {
+				kind: "enabled-record",
+				path: join(extensions, "extension-enablement.json"),
+				description: "Per-extension path-glob overrides that enable or disable it by folder, not a boolean",
+				research: "E-GEM-P3"
+			}]
+		};
+	},
+	"qwen-code": ({ env, homedir }) => {
+		const configDir = env.QWEN_HOME || join(homedir, ".qwen");
+		const extensions = join(configDir, "extensions");
+		return {
+			harness: "qwen-code",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path: extensions,
+				description: "Installed extensions, one folder each with a qwen-extension.json manifest",
+				research: "E-QWEN-P1"
+			}, {
+				kind: "enabled-record",
+				path: join(extensions, "extension-enablement.json"),
+				description: "Extension enable/disable state, inherited from Gemini CLI's format",
+				research: "E-QWEN-P2"
+			}]
+		};
+	},
+	"vscode-copilot": (environment) => {
+		const { configDir, path } = vscodeAgentPlugins(environment);
+		return {
+			harness: "vscode-copilot",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path,
+				description: "Installed agent plugins as <host>/<org>/<repo>/",
+				research: "E-VSC-P3"
+			}]
+		};
+	},
+	cline: ({ homedir }) => {
+		const configDir = join(homedir, ".cline");
+		return {
+			harness: "cline",
+			configDir,
+			locations: [{
+				kind: "installed-plugins",
+				path: join(configDir, "plugins", "_installed"),
+				description: "Installed plugins, grouped by source: npm, git, remote, or local",
+				research: "E-CLINE-P3"
+			}]
+		};
+	}
+};
+//#endregion
 //#region src/vendor-registry/vendor-registry.ts
 function lookupVendor(registry, vendorId) {
 	return registry[vendorId] ?? null;
@@ -7675,6 +7911,15 @@ function mergeRegistries(base, override) {
 	};
 	return result;
 }
+/** Fills each vendor's `localPluginDir` from `locate`, which returns the harness's `local-plugins`
+*  folder when `@cyberuni/agent-harness` knows one. A vendor it knows nothing about keeps its
+*  registry value, or `null`. */
+function withLocalPluginDirs(registry, locate) {
+	return Object.fromEntries(Object.entries(registry).map(([id, config]) => [id, {
+		...config,
+		localPluginDir: locate(id) ?? config.localPluginDir ?? null
+	}]));
+}
 //#endregion
 //#region src/vendor-registry/fs.ts
 function bundledRegistryPath() {
@@ -7684,8 +7929,15 @@ function bundledRegistryPath() {
 function userOverridePath() {
 	return path.join(os.homedir(), ".agents", "universal-plugin-vendors.json");
 }
+/** The harness's `local-plugins` folder, as `@cyberuni/agent-harness` locates it. */
+function localPluginsDir(vendorId) {
+	if (!harnessIds.includes(vendorId)) return void 0;
+	return pluginStorage(vendorId).locations.find((l) => l.kind === "local-plugins")?.path;
+}
+/** The bundled registry, with the per-harness facts `@cyberuni/agent-harness` owns filled in, then
+*  the user's override on top. */
 function loadRegistry() {
-	const bundled = JSON.parse(fs.readFileSync(bundledRegistryPath(), "utf8"));
+	const bundled = withLocalPluginDirs(JSON.parse(fs.readFileSync(bundledRegistryPath(), "utf8")), localPluginsDir);
 	try {
 		return mergeRegistries(bundled, JSON.parse(fs.readFileSync(userOverridePath(), "utf8")));
 	} catch (err) {
@@ -7740,7 +7992,7 @@ function readPluginName(manifestPath) {
 }
 /** Entries a copy never carries: the working copy's history and its installed dependencies. Neither
 *  is part of the plugin, and both dwarf it. */
-const COPY_EXCLUDED = new Set([".git", "node_modules"]);
+const COPY_EXCLUDED = /* @__PURE__ */ new Set([".git", "node_modules"]);
 /** Applies one planned write. A replace removes the destination first, so a copy never merges into
 *  what was there before. A copy dereferences symlinks — a skill linked into the tree has to travel
 *  as its content, since the destination is read on its own. */
@@ -8791,10 +9043,67 @@ function marketplaceCommand() {
 	return new Command("marketplace").description("Generate repository-local marketplace metadata").addCommand(addCommand()).addCommand(initCommand()).addCommand(validateCommand$1());
 }
 //#endregion
-//#region src/prepare/fs.ts
-function expandHome(p) {
-	return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
+//#region src/prepare/installed-plugins.ts
+/**
+* Reads Claude Code's `installed_plugins.json` (version 2): `plugins` maps `<plugin>@<marketplace>`
+* to one entry per install, each with a `scope`, `installPath`, `version`, and, for project
+* installs, `projectPath`. Global scope takes the `user` installs; project scope takes the installs
+* whose `projectPath` is the project root.
+*/
+function parseClaudeInstallRecord(raw, { scope, projectRoot }) {
+	const plugins = isRecord(raw) && isRecord(raw["plugins"]) ? raw["plugins"] : {};
+	const result = [];
+	for (const [key, entries] of Object.entries(plugins)) {
+		if (!Array.isArray(entries)) continue;
+		const entry = entries.filter(isRecord).find((e) => scope === "global" ? e["scope"] === "user" : e["projectPath"] === projectRoot);
+		if (!entry || typeof entry["installPath"] !== "string") continue;
+		result.push({
+			name: pluginName(key),
+			version: typeof entry["version"] === "string" ? entry["version"] : "unknown",
+			root: entry["installPath"]
+		});
+	}
+	return result;
 }
+/** Strips the `@<marketplace>` suffix from a `<plugin>@<marketplace>` key. */
+function pluginName(key) {
+	const at = key.lastIndexOf("@");
+	return at > 0 ? key.slice(0, at) : key;
+}
+/**
+* Picks the newest of a plugin's cached version folders. Dotted numeric versions compare
+* numerically, part by part; anything else falls back to string order.
+*/
+function latestVersion(versions) {
+	return [...versions].sort(compareVersions).at(-1);
+}
+function compareVersions(a, b) {
+	const pa = a.split(/[.+-]/);
+	const pb = b.split(/[.+-]/);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+		const x = pa[i] ?? "";
+		const y = pb[i] ?? "";
+		if (x === y) continue;
+		const nx = Number(x);
+		const ny = Number(y);
+		if (x !== "" && y !== "" && Number.isInteger(nx) && Number.isInteger(ny)) return nx - ny;
+		return x < y ? -1 : 1;
+	}
+	return 0;
+}
+/** Maps installed plugins to the name → version record `prepare` snapshots. */
+function toVersions(plugins) {
+	return Object.fromEntries(plugins.map((p) => [p.name, p.version]));
+}
+/** Maps installed plugins to name → root, with the home directory written as `~`. */
+function toRoots(plugins, home) {
+	return Object.fromEntries(plugins.map((p) => [p.name, p.root.startsWith(home) ? "~" + p.root.slice(home.length) : p.root]));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/prepare/fs.ts
 function globalStatePath$2() {
 	return path.join(os.homedir(), ".agents", "universal-plugin.json");
 }
@@ -8813,29 +9122,14 @@ function writeStateFile(filePath, state) {
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	fs.writeFileSync(filePath, JSON.stringify(state, null, 2) + "\n", "utf8");
 }
-function realPrepareFs(vendor, projectRoot) {
+/** `environment` locates the harness's plugin folders; it defaults to the current process. */
+function realPrepareFs(harness, installScope, environment = {}) {
+	const projectRoot = installScope.projectRoot;
+	let installed;
+	const readInstalled = () => installed ??= readInstalledPlugins(harness, installScope, environment);
 	return {
-		readManifest() {
-			if (!vendor.globalManifest) return {};
-			const manifestPath = expandHome(vendor.globalManifest);
-			try {
-				const raw = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-				return Object.fromEntries(Object.entries(raw).map(([k, v]) => [k, typeof v === "object" && v !== null && "version" in v ? String(v.version) : String(v)]));
-			} catch (err) {
-				if (err.code === "ENOENT") return {};
-				throw err;
-			}
-		},
-		readPluginRoots() {
-			if (!vendor.globalPluginDir) return {};
-			const pluginDir = expandHome(vendor.globalPluginDir);
-			const manifest = this.readManifest();
-			const home = os.homedir();
-			return Object.fromEntries(Object.keys(manifest).map((name) => {
-				const absPath = path.join(pluginDir, name);
-				return [name, absPath.startsWith(home) ? "~" + absPath.slice(home.length) : absPath];
-			}));
-		},
+		readManifest: () => toVersions(readInstalled()),
+		readPluginRoots: () => toRoots(readInstalled(), environment.homedir ?? os.homedir()),
 		readGlobalState: () => readStateFile(globalStatePath$2()) ?? emptyState(),
 		readProjectState: () => projectRoot ? readStateFile(projectStatePath(projectRoot)) : null,
 		writeGlobalState: (s) => writeStateFile(globalStatePath$2(), s),
@@ -8849,7 +9143,85 @@ function populateStoreFromVendorCache(pluginRoots, versions) {
 	for (const [pluginName, pluginRoot] of Object.entries(pluginRoots)) {
 		const entryPath = storeEntryPath(storePath, `npm/${pluginName}@${versions[pluginName] ?? "unknown"}`);
 		if (entryExists(entryPath)) continue;
-		populateEntry(entryPath, pluginRoot);
+		populateEntry(entryPath, expandHome(pluginRoot));
+	}
+}
+function expandHome(p) {
+	return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
+}
+/** Lists what a harness has installed, the way that harness records it: Claude Code in its install
+*  record, Copilot CLI and Codex only in the layout of their plugin folders. Cursor keeps no record
+*  of installed plugins. */
+function readInstalledPlugins(harness, installScope, environment) {
+	const storage = pluginStorage(harness, environment);
+	const location = (kind) => storage.locations.find((l) => l.kind === kind)?.path;
+	switch (harness) {
+		case "claude-code": {
+			const record = location("install-record");
+			const raw = record ? readJson(record) : null;
+			return raw === null ? [] : parseClaudeInstallRecord(raw, installScope);
+		}
+		case "copilot-cli": {
+			const dir = location("installed-plugins");
+			return dir && installScope.scope === "global" ? readCopilotInstalls(dir) : [];
+		}
+		case "codex": {
+			const dir = location("plugin-cache");
+			return dir && installScope.scope === "global" ? readCodexCache(dir) : [];
+		}
+		default: return [];
+	}
+}
+/** `<dir>/<marketplace>/<plugin>/` for marketplace installs, `<dir>/_direct/<source-id>/` for
+*  direct ones; the plugin's own manifest carries its name and version. */
+function readCopilotInstalls(dir) {
+	return subdirs(dir).flatMap((marketplace) => subdirs(path.join(dir, marketplace)).map((folder) => {
+		const root = path.join(dir, marketplace, folder);
+		const manifest = readPluginManifest(root);
+		return {
+			name: typeof manifest["name"] === "string" ? manifest["name"] : folder,
+			version: typeof manifest["version"] === "string" ? manifest["version"] : "unknown",
+			root
+		};
+	}));
+}
+/** `<dir>/<marketplace>/<plugin>/<version>/`; the newest cached version is the installed one. */
+function readCodexCache(dir) {
+	return subdirs(dir).flatMap((marketplace) => subdirs(path.join(dir, marketplace)).flatMap((name) => {
+		const version = latestVersion(subdirs(path.join(dir, marketplace, name)));
+		return version ? [{
+			name,
+			version,
+			root: path.join(dir, marketplace, name, version)
+		}] : [];
+	}));
+}
+const PLUGIN_MANIFESTS = [
+	"plugin.json",
+	".github/plugin/plugin.json",
+	".claude-plugin/plugin.json"
+];
+function readPluginManifest(root) {
+	for (const file of PLUGIN_MANIFESTS) {
+		const raw = readJson(path.join(root, file));
+		if (typeof raw === "object" && raw !== null) return raw;
+	}
+	return {};
+}
+function readJson(filePath) {
+	try {
+		return JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		throw err;
+	}
+}
+function subdirs(dir) {
+	try {
+		return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
 	}
 }
 //#endregion
@@ -8958,16 +9330,17 @@ function runPrepare(opts) {
 			version
 		});
 	}
-	if (!dryRun) if (scope === "global") prepareFs.writeGlobalState(updatedState);
-	else prepareFs.writeProjectState(updatedState);
+	if (!dryRun) {
+		if (scope === "global") prepareFs.writeGlobalState(updatedState);
+		else prepareFs.writeProjectState(updatedState);
+	}
 	return { newActionCount: actions.length };
 }
 //#endregion
 //#region src/prepare/cli.ts
 function prepareCommand() {
 	return new Command("prepare").description("Detect cross-vendor plugin sync actions").argument("<vendor-id>", "Vendor to read manifest from (e.g. claude-code)").addOption(new Option("--scope <scope>", "global or project").default("global").choices(["global", "project"])).option("--root <path>", "Project root for project-scope state file").option("--dry-run", "Print action count without writing state").action((vendorId, opts) => {
-		const vendor = lookupVendor(loadRegistry(), vendorId);
-		if (!vendor) {
+		if (!lookupVendor(loadRegistry(), vendorId) || !harnessIds.includes(vendorId)) {
 			process.stderr.write(`Unknown vendor: ${vendorId}\n`);
 			process.exit(1);
 		}
@@ -8976,12 +9349,16 @@ function prepareCommand() {
 			process.exit(1);
 		}
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const prepareFs = realPrepareFs(vendor, opts.root);
+		const scope = opts.scope;
+		const prepareFs = realPrepareFs(vendorId, {
+			scope,
+			projectRoot: opts.root ? path.resolve(opts.root) : void 0
+		});
 		const pluginRoots = prepareFs.readPluginRoots();
 		const manifest = prepareFs.readManifest();
 		const { newActionCount } = runPrepare({
 			vendorId,
-			scope: opts.scope,
+			scope,
 			fs: prepareFs,
 			now,
 			dryRun: opts.dryRun
@@ -9497,7 +9874,6 @@ function pluginCommand() {
 program.addCommand(pluginCommand());
 program.addCommand(cleanCommand());
 program.addCommand(configCommand());
-program.addCommand(governanceCommand());
 program.addCommand(marketplaceCommand());
 program.addCommand(prepareCommand());
 program.addCommand(publishCommand());

package/dist/data/vendors.json

@@ -1,10 +1,8 @@
 {
 	"claude-code": {
 		"sessionStartEvent": "SessionStart",
-		"globalManifest": "~/.claude/plugins/installed_plugins.json",
 		"projectManifest": null,
 		"hookGlob": "~/.claude/plugins/universal-plugin/hooks/hooks.json",
-		"globalPluginDir": "~/.claude/plugins/",
 		"pluginRootSuffix": ".claude-plugin/plugin.json",
 		"localPluginDir": "~/.claude/skills/",
 		"localPluginLink": true,
@@ -15,12 +13,9 @@
 	},
 	"cursor": {
 		"sessionStartEvent": "sessionStart",
-		"globalManifest": null,
 		"projectManifest": null,
 		"hookGlob": null,
-		"globalPluginDir": null,
 		"pluginRootSuffix": ".cursor-plugin/plugin.json",
-		"localPluginDir": "~/.cursor/plugins/local/",
 		"localPluginLink": false,
 		"localReload": "run Developer: Reload Window in Cursor",
 		"installCommand": null,
@@ -29,10 +24,8 @@
 	},
 	"codex": {
 		"sessionStartEvent": "SessionStart",
-		"globalManifest": null,
 		"projectManifest": null,
 		"hookGlob": null,
-		"globalPluginDir": null,
 		"pluginRootSuffix": ".codex-plugin/plugin.json",
 		"localPluginDir": null,
 		"localPluginLink": false,
@@ -43,10 +36,8 @@
 	},
 	"copilot-cli": {
 		"sessionStartEvent": "sessionStart",
-		"globalManifest": null,
 		"projectManifest": null,
 		"hookGlob": null,
-		"globalPluginDir": null,
 		"pluginRootSuffix": "plugin.json",
 		"localPluginDir": null,
 		"localPluginLink": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",
@@ -39,6 +39,7 @@
     "agents"
   ],
   "dependencies": {
+    "@cyberuni/agent-harness": "^0.1.0",
     "@repobuddy/upx": "^0.1.0",
     "@toon-format/toon": "^4.1.1",
     "commander": "^14.0.3",
@@ -49,7 +50,7 @@
     "@types/semver": "^7.7.1",
     "ajv": "^8.20.0",
     "knip": "^6.14.1",
-    "tsdown": "^0.22.0",
+    "tsdown": "^0.23.0",
     "tsx": "^4.22.3",
     "typescript": "^6.0.0",
     "vitest": "^4.1.7"

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.10.0",
+	"version": "0.11.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/readme.md

@@ -106,14 +106,12 @@ npx universal-plugin config add --key sdd-plugins --entry '{"name":"aces","handl
 `add` appends the entry, or replaces the existing entry with the same `name`. Both commands print
 TOON by default; pass `--format json` for JSON.
 
-### governance (retired)
-
-`governance list` and `governance show` are retired. They print the replacement and exit 1 for one
-release, then go away. Read the documents with `buddy-agent-harness reference show <name>`, or, from a
-skill, with the `load-reference` skill in the `buddy-agent-harness` plugin.
+### Reference documents
 
 This package ships its own documents (`plugin-design`, `slash-invocation`, `universal-plugin`) under
-`references/`, so `reference show` finds them in any project that depends on `universal-plugin`.
+`references/`. Read one with `buddy-agent-harness reference show <name>` in any project that depends
+on `universal-plugin`, or, from a skill, with the `reference` skill in the `buddy-agent-harness`
+plugin.
 
 ### Housekeeping
 

package/references/plugin-design.md

@@ -330,6 +330,6 @@ Portability rules for skill bodies: keep each `SKILL.md` body under 6,000 chars;
 
 ## References
 
-Load `skill-design`, `skill-repo-structure`, and `agent-tool-output` with the `load-reference` skill in the `buddy-agent-harness` plugin.
+Load `skill-design`, `skill-repo-structure`, and `agent-tool-output` with the `reference` skill in the `buddy-agent-harness` plugin.
 
 Spec: https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/spec.md

package/references/universal-plugin.md

@@ -1,4 +1,4 @@
 # Universal Plugin Format
 
 The rules for the universal plugin format live in `plugin-design`, which this package also ships.
-Load `plugin-design` with the `load-reference` skill in the `buddy-agent-harness` plugin.
+Load `plugin-design` with the `reference` skill in the `buddy-agent-harness` plugin.

package/skills/build-plugin/SKILL.md

@@ -117,7 +117,7 @@ Validation runs before the first write, so a failed build leaves the tree untouc
 - **Expect a build to pin skill `npx` references.** That is the release-time `plugin bundle`, not
   this step.
 - **Expect a build to copy governances into skills.** A skill loads a reference through the
-  `load-reference` skill in the `buddy-agent-harness` plugin; the build no longer copies them, and
+  `reference` skill in the `buddy-agent-harness` plugin; the build no longer copies them, and
   `--check` is gone.
 
 ## Related skills

package/skills/init-universal-plugin/SKILL.md

@@ -38,7 +38,7 @@ This skill owns the **authoring** side: the plugin a project ships. Setting a re
 
 ## Prerequisites
 
-Before any work that adds or removes components, load `plugin-design` with the `load-reference`
+Before any work that adds or removes components, load `plugin-design` with the `reference`
 skill in the `buddy-agent-harness` plugin.
 
 It is the authoritative source for which component to reach for and which anti-patterns to avoid.
@@ -233,7 +233,7 @@ This skill is not a formatter. If the project has one, run it over the written f
 
 ## References
 
-- Reference: `plugin-design`, loaded with the `load-reference` skill in the `buddy-agent-harness` plugin
+- Reference: `plugin-design`, loaded with the `reference` skill in the `buddy-agent-harness` plugin
 - Spec: https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/spec.md
 - Manifest schema (Agent Plugins Specification v1.0.0): https://agent-plugins.org/schemas/1.0.0/plugin.schema.json
 - Extension schema (the body of `extensions["org.cyberuni.universal-plugin"]`), shipped in the package at

package/skills/init-universal-plugin/references/standard.md

@@ -62,7 +62,7 @@ what each build gets. A vendor listed in `vendors` with no `harnesses` entry sti
 └── README.md
 ```
 
-`plugin init --scaffold` creates the standard `skills/`, `agents/`, `governances/`, and `commands/`
+`plugin init --scaffold` creates the standard `skills/`, `agents/`, `references/`, and `commands/`
 directories. Create the rest only when the plugin has content for them.
 
 ## Components