universal-plugin 0.12.1 → 0.12.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.12.1",
+	"version": "0.12.2",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.12.1",
+	"version": "0.12.2",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.12.1",
+	"version": "0.12.2",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/agents/agentskills-specialist.md

@@ -9,7 +9,6 @@ description: >
   mention AgentSkills explicitly.
 tools: Read, TaskCreate, TaskGet, TaskList, TaskStop, TaskUpdate, WebFetch, WebSearch, Edit, NotebookEdit, Write, Bash
 model: opus
-memory: project
 ---
 
 # AgentSkills Specialist
@@ -46,7 +45,7 @@ A `SKILL.md` must include:
 
 When asked to audit `agent-skills:*` skills:
 1. List all installed skills by scanning `skills/` and `.agents/skills/`.
-2. For each skill, check: completeness of SKILL.md, cross-runtime portability, alignment with current AgentSkills spec, and consistency with project CLAUDE.md rules.
+2. For each skill, check: completeness of SKILL.md, cross-runtime portability, alignment with current AgentSkills spec, and consistency with the project's own agent instructions.
 3. Produce a prioritized improvement list (see Output format).
 4. Propose concrete edits or new content — do not just describe problems.
 
@@ -69,25 +68,15 @@ For skill creation or edits, write the full `SKILL.md` content directly — no p
 
 ## Human-in-the-loop Rules
 
-- Do not commit changes without explicit user confirmation.
+- Do not commit changes unless the user asks.
 - Do not write files outside `skills/` or `.agents/skills/` without user approval.
 - If a skill change affects cross-runtime compatibility, surface the impact before applying it.
 
 ## Key Research Context
 
-- No universal plugin manifest exists — rely on `skills/<name>/SKILL.md` + MCP servers as the true universal minimum.
+- A root `plugin.json` on Agent Plugins Spec 1.0.0 is the universal manifest; `skills/<name>/SKILL.md` is the universal skill entry point.
 - Hook event naming is the sharpest incompatibility: PascalCase (Claude Code, Codex), camelCase (Cursor, Copilot CLI), snake_case (Windsurf).
 - Only Claude Code and Cursor publish machine-readable JSON Schemas.
-- open-plugin-spec v1.0.0 is the closest standard but has no confirmed universal search path.
-
-## Commit Discipline
-
-Follow project commit rules:
-- Commit each completed skill or improvement as its own unit.
-- Use `feat:`, `fix:`, `refactor:`, or `docs:` prefixes.
-- Never use `git add .` or `git add -A`.
-- Run validation before committing.
-- Use the `commit-work` skill for staging and message writing.
 
 ## Out of Scope
 
@@ -102,7 +91,6 @@ Before declaring any skill complete:
 - [ ] No runtime-specific assumptions are baked into the universal layer.
 - [ ] Project-level `.agents/skills/<name>/SKILL.md` extension is merged, not duplicated.
 - [ ] Examples are concrete and runnable.
-- [ ] Improvement is committed per commit discipline rules.
 
 ## Self-Verification
 
@@ -115,7 +103,7 @@ After producing any skill definition or audit report, ask yourself:
 
 **Create a skill:**
 > "I need to create a commit-work skill for this project"
-→ Scaffold `skills/commit-work/SKILL.md` with correct structure, run quality gates, commit.
+→ Scaffold `skills/commit-work/SKILL.md` with correct structure, run quality gates.
 
 **Audit agent-skills:**
 > "Let's see what we can improve on the agent-skills we're using"

package/com.github.copilot/agents/agentskills-specialist.agent.md

@@ -9,7 +9,6 @@ description: >
   mention AgentSkills explicitly.
 tools: Read, TaskCreate, TaskGet, TaskList, TaskStop, TaskUpdate, WebFetch, WebSearch, Edit, NotebookEdit, Write, Bash
 model: opus
-memory: project
 ---
 
 # AgentSkills Specialist
@@ -46,7 +45,7 @@ A `SKILL.md` must include:
 
 When asked to audit `agent-skills:*` skills:
 1. List all installed skills by scanning `skills/` and `.agents/skills/`.
-2. For each skill, check: completeness of SKILL.md, cross-runtime portability, alignment with current AgentSkills spec, and consistency with project CLAUDE.md rules.
+2. For each skill, check: completeness of SKILL.md, cross-runtime portability, alignment with current AgentSkills spec, and consistency with the project's own agent instructions.
 3. Produce a prioritized improvement list (see Output format).
 4. Propose concrete edits or new content — do not just describe problems.
 
@@ -69,25 +68,15 @@ For skill creation or edits, write the full `SKILL.md` content directly — no p
 
 ## Human-in-the-loop Rules
 
-- Do not commit changes without explicit user confirmation.
+- Do not commit changes unless the user asks.
 - Do not write files outside `skills/` or `.agents/skills/` without user approval.
 - If a skill change affects cross-runtime compatibility, surface the impact before applying it.
 
 ## Key Research Context
 
-- No universal plugin manifest exists — rely on `skills/<name>/SKILL.md` + MCP servers as the true universal minimum.
+- A root `plugin.json` on Agent Plugins Spec 1.0.0 is the universal manifest; `skills/<name>/SKILL.md` is the universal skill entry point.
 - Hook event naming is the sharpest incompatibility: PascalCase (Claude Code, Codex), camelCase (Cursor, Copilot CLI), snake_case (Windsurf).
 - Only Claude Code and Cursor publish machine-readable JSON Schemas.
-- open-plugin-spec v1.0.0 is the closest standard but has no confirmed universal search path.
-
-## Commit Discipline
-
-Follow project commit rules:
-- Commit each completed skill or improvement as its own unit.
-- Use `feat:`, `fix:`, `refactor:`, or `docs:` prefixes.
-- Never use `git add .` or `git add -A`.
-- Run validation before committing.
-- Use the `commit-work` skill for staging and message writing.
 
 ## Out of Scope
 
@@ -102,7 +91,6 @@ Before declaring any skill complete:
 - [ ] No runtime-specific assumptions are baked into the universal layer.
 - [ ] Project-level `.agents/skills/<name>/SKILL.md` extension is merged, not duplicated.
 - [ ] Examples are concrete and runnable.
-- [ ] Improvement is committed per commit discipline rules.
 
 ## Self-Verification
 
@@ -115,7 +103,7 @@ After producing any skill definition or audit report, ask yourself:
 
 **Create a skill:**
 > "I need to create a commit-work skill for this project"
-→ Scaffold `skills/commit-work/SKILL.md` with correct structure, run quality gates, commit.
+→ Scaffold `skills/commit-work/SKILL.md` with correct structure, run quality gates.
 
 **Audit agent-skills:**
 > "Let's see what we can improve on the agent-skills we're using"

package/dist/cli.mjs

@@ -14709,7 +14709,7 @@ const storages = {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@cyberuni+agent-harness@0.5.0_typescript@6.0.3/node_modules/@cyberuni/agent-harness/dist/index.js
+//#region ../../node_modules/.pnpm/@cyberuni+agent-harness@0.6.0_typescript@6.0.3/node_modules/@cyberuni/agent-harness/dist/index.js
 const harnessIds = [
 	"claude-code",
 	"cursor",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",
@@ -39,7 +39,7 @@
     "agents"
   ],
   "dependencies": {
-    "@cyberuni/agent-harness": "^0.5.0",
+    "@cyberuni/agent-harness": "^0.6.0",
     "@repobuddy/upx": "^0.2.0",
     "@toon-format/toon": "^4.1.1",
     "commander": "^15.0.0",

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.12.1",
+	"version": "0.12.2",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/skills/build-plugin/SKILL.md

@@ -111,7 +111,7 @@ Validation runs before the first write, so a failed build leaves the tree untouc
 | a missing `plugin.json` | `--root` is not the plugin root | point `--root` at the directory holding the canonical manifest |
 | codex requires `description` / `version` | Codex rejects a manifest without them | add them to `plugin.json` through `init-universal-plugin`, or `version` for the number |
 | a `--vendor` not among the targets | the manifest does not declare that vendor | declare it through `init-universal-plugin`, or drop the flag |
-| `vendorExtensions` or `.plugin/plugin.json` | a pre-0.6 layout this CLI no longer reads | run `doctor-universal-plugin`, which names the migration |
+| `vendorExtensions` or `.plugin/plugin.json` | a layout this CLI does not read | run `doctor-universal-plugin`, which names the migration |
 
 ## Do not
 
@@ -123,8 +123,8 @@ Validation runs before the first write, so a failed build leaves the tree untouc
 - **Expect a build to pin skill `npx` references.** That is the release-time `plugin bundle`, not
   this step.
 - **Expect a build to copy governances into skills.** A skill loads a reference through the
-  `reference` skill in the `cyber-agent-harness` plugin; the build no longer copies them, and
-  `--check` is gone.
+  `reference` skill in the `cyber-agent-harness` plugin; the build does not copy them and has no
+  `--check` flag.
 
 ## Related skills
 

package/skills/doctor-universal-plugin/SKILL.md

@@ -58,7 +58,7 @@ to derive. Never report it as a fault.
 A plugin that **does** declare those reports `copilot-cli` as `built` at `com.github.copilot/`
 instead. Declaring the canonical `$schema` moves them there: Copilot CLI stops reading them from the
 plugin root entirely, so a root-only layout loads none of them and says nothing
-([ADR-0015](../../.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)). That is what
+([ADR-0015](https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)). That is what
 `copilot-root-components` reports.
 
 If `node` is unavailable, read `scripts/doctor.mjs` and apply the same checks by hand: it composes
@@ -85,7 +85,7 @@ Each `code` below is what the script emits.
 | `copilot-root-components` | agents, commands, rules, hooks, or LSP servers sit at the plugin root with no copy under `com.github.copilot/` — Copilot CLI reads them only from there in spec mode, so it loads none of them, silently | `/universal-plugin:build-plugin` |
 | `stale-github-plugin` | a leftover `.github/plugin/plugin.json` from an older build — shadowed by root and no longer generated | `/universal-plugin:remove-plugin` |
 | `shadowing-manifest` | a `.plugin/plugin.json` exists — it outranks root in Copilot CLI's search order and silently shadows the canonical manifest | `/universal-plugin:remove-plugin` |
-| `no-vendors` | no vendor is declared, so the build writes nothing and no runtime reads the plugin. On a repository still on the pre-0.6 layout the build stops rather than reporting an empty result, and the detail says so — read it beside `legacy-manifest` and `shadowing-manifest`, which name the signals | `/universal-plugin:init-universal-plugin`, adopt route on the pre-0.6 layout, else update route |
+| `no-vendors` | no vendor is declared, so the build writes nothing and no runtime reads the plugin. When the repository carries `vendorExtensions` or a `.plugin/plugin.json`, the build stops rather than reporting an empty result, and the detail says so — read it beside `legacy-manifest` and `shadowing-manifest`, which name the signals | `/universal-plugin:init-universal-plugin`, adopt route when `vendorExtensions` or `.plugin/plugin.json` is present, else update route |
 | `package-path-missing` | `packagePath` names a directory with no readable `package.json` | fix `packagePath`, or create the package |
 | `package-path-unknown` | the CLI could not report `packagePath` (a version too old to read it), so `version-drift` and `unreleased-content` were skipped rather than guessed | upgrade universal-plugin |
 | `misplaced-package-path` | `plugin.json` declares `packagePath` under `extensions["org.cyberuni.universal-plugin"]`, where the CLI never reads it — the plugin is silently treated as not shipping to npm | move it to `.agents/universal-plugin.json`, relative to the plugin root |
@@ -150,7 +150,7 @@ other.
 A runtime keys its plugin cache on the version, not on content: Claude Code resolves the version,
 finds it unchanged, and reports *"already at the latest version"* without re-extracting. So content
 pushed without a bump reaches nobody who already installed the plugin, and neither side is told
-([ADR-0010](../../.agents/spec/design/decisions/0010-version-policy.md) §6).
+([ADR-0010](https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/design/decisions/0010-version-policy.md) §6).
 
 The script compares the shipped paths — the canonical manifest, the skills directory, `agents/`,
 `governances/`, `references/`, `mcp.json` — against the commit that set the version the manifest carries now, and
@@ -158,7 +158,7 @@ emits `unreleased-content` for anything committed since. Uncommitted work is not
 shipped.
 
 Two cases are deliberately silent. A plugin that declares `packagePath` is skipped, because there the
-release picks the number (ADR-0010 §2) and content waiting ahead of the last released version is the
+release picks the number ([ADR-0010](https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/design/decisions/0010-version-policy.md) §2) and content waiting ahead of the last released version is the
 normal state of a branch. A tree with no git history is skipped rather than guessed at.
 
 The repair is the bump, and it belongs to `/universal-plugin:version`. Judge first whether the change

package/skills/init-universal-plugin/SKILL.md

@@ -18,7 +18,7 @@ That asymmetry does not extend to components. Declaring the canonical `$schema`
 Open Plugin Spec mode, and Copilot CLI then reads its **native** components — agents, commands,
 rules, hooks, LSP servers — from a `com.github.copilot/` directory rather than the plugin root.
 Authoring still happens at the canonical locations: `plugin build` derives that directory
-([ADR-0015](../../.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)), so do not tell
+([ADR-0015](https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)), so do not tell
 an author to move `agents/` into it — the root copy is what the other three vendors derive from. See
 [`references/vendors/copilot-cli.md`](./references/vendors/copilot-cli.md).
 
@@ -30,7 +30,7 @@ runtime you are enabling, and only those.
 | Claude Code | `.claude-plugin/plugin.json` | none | `references/vendors/claude-code.md` |
 | Cursor | `.cursor-plugin/plugin.json` | none | `references/vendors/cursor.md` |
 | Codex | `.codex-plugin/plugin.json` | `version`, `description` | `references/vendors/codex.md` |
-| GitHub Copilot CLI | none — reads root `plugin.json` | native components derived under `com.github.copilot/` ([ADR-0015](../../.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)) | `references/vendors/copilot-cli.md` |
+| GitHub Copilot CLI | none — reads root `plugin.json` | native components derived under `com.github.copilot/` ([ADR-0015](https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)) | `references/vendors/copilot-cli.md` |
 
 This skill owns the **authoring** side: the plugin a project ships. Setting a repository up to
 *consume* skills — the `.agents/skills/` layout, `AGENTS.md`, per-harness bridges — is
@@ -127,7 +127,7 @@ Route by what Phase 2 found. Read exactly the reference for the work at hand —
 | canonical, and a vendor or component changes | edit `extensions`, then rebuild | [`references/update.md`](./references/update.md) |
 
 Three asks leave this skill rather than routing inside it. Hand them over instead of improvising a
-route: **`doctor`** reports what is declared, built, stale, or drifting; **`version`** moves the
+route: **`doctor-universal-plugin`** reports what is declared, built, stale, or drifting; **`version`** moves the
 number; **`remove-plugin`** deletes derived manifests or the plugin itself.
 
 Every route ends in the same two commands. Scaffold with the CLI that shipped beside this skill:
@@ -193,7 +193,7 @@ that vendor's `harnesses` entry, or to the drop list you reported in Phase 3, be
 
 Audit each skill the plugin ships, per [`references/create.md`](./references/create.md) Step 6.
 Report what was created, adopted, derived, and left alone. For a fuller read of the plugin's state
-than this phase gives — drift, version skew, shadowing manifests — hand off to `doctor`.
+than this phase gives — drift, version skew, shadowing manifests — hand off to `doctor-universal-plugin`.
 
 This skill is not a formatter. If the project has one, run it over the written files and say so.
 
@@ -221,7 +221,7 @@ This skill is not a formatter. If the project has one, run it over the written f
 
 | Task | Skill |
 |------|-------|
-| Diagnose a plugin — what is declared, built, stale, or drifting | `doctor` |
+| Diagnose a plugin — what is declared, built, stale, or drifting | `doctor-universal-plugin` |
 | Make the repository installable, and document how | `marketplace` |
 | Move the plugin's version, or reconcile one that drifted | `version` |
 | Delete derived manifests, or the whole plugin | `remove-plugin` |

package/skills/marketplace/SKILL.md

@@ -85,7 +85,7 @@ Copilot CLI. The reverse does not hold: Claude Code rejects the Codex catalog fo
 | Task | Skill |
 |------|-------|
 | Create or change the plugin being listed | `init-universal-plugin` |
-| Check that the plugin's own manifests are current | `doctor` |
+| Check that the plugin's own manifests are current | `doctor-universal-plugin` |
 | Move the version users will install | `version` |
 | Submit to the shared marketplace repository instead | `publish-plugin` |
 

package/skills/remove-plugin/SKILL.md

@@ -83,5 +83,5 @@ this skill does.
 | Task | Skill |
 |------|-------|
 | Remove a vendor from what the plugin declares | `init-universal-plugin`, update route |
-| Confirm what is stale, shadowing, or unbuilt before deleting | `doctor` |
+| Confirm what is stale, shadowing, or unbuilt before deleting | `doctor-universal-plugin` |
 | Take a published plugin out of a marketplace listing | `publish-plugin` |

package/skills/version/SKILL.md

@@ -115,7 +115,7 @@ Every guard resolves before the first write, so a failed run leaves the tree unt
 |------|-------|
 | Create, adopt, or change what the plugin declares | `init-universal-plugin` |
 | Re-derive the vendor manifests by hand | `build-plugin` |
-| Check whether the two authored versions agree | `doctor` |
+| Check whether the two authored versions agree | `doctor-universal-plugin` |
 | Add a changeset for the change being released | `add-changeset` |
 | Refresh the repository's own marketplace catalogs after a bump | `marketplace` |
 | List the released plugin in the shared marketplace | `publish-plugin` |