universal-plugin 0.12.2 → 0.13.0

package/skills/init-universal-plugin/SKILL.md

@@ -116,6 +116,16 @@ no approval; report those rather than asking.
 One case needs asking even when nothing is overwritten: two vendor manifests that disagree on a
 shared field. A silent pick there is a silent behavior change for one runtime.
 
+An npm-shipped plugin (`--npm`) in a changesets repository gets one more plan line. When the
+repository root carries `.changeset/` and its `package.json` `version` script is exactly
+`changeset version`, `plugin init --npm` rewrites that script to
+`changeset version && universal-plugin plugin version --from-package --root <plugin-root>` and adds
+`universal-plugin` to the root `devDependencies`. Without it the first Version Packages PR moves
+`package.json` and leaves the plugin version behind. Show the new script and the devDependency in the
+plan, and ask before running init: it rewrites the user's root `package.json`. If the user declines,
+run init without `--npm` and wire `files` by hand. A custom `version` script is never rewritten;
+init prints the line to append, so relay it and let the user place it.
+
 ## 4. Apply
 
 Route by what Phase 2 found. Read exactly the reference for the work at hand — do not load all six.
@@ -130,7 +140,7 @@ Three asks leave this skill rather than routing inside it. Hand them over instea
 route: **`doctor-universal-plugin`** reports what is declared, built, stale, or drifting; **`version`** moves the
 number; **`remove-plugin`** deletes derived manifests or the plugin itself.
 
-Every route ends in the same two commands. Scaffold with the CLI that shipped beside this skill:
+Every route ends in the same two commands. Scaffold with this skill's launcher, which runs the project's installed CLI or the pinned `npx` one:
 
 ```bash
 node scripts/init.mjs --name <plugin-name> --vendor claude-code --vendor cursor
@@ -163,7 +173,8 @@ marketplace name, the owner, and every other entry alone, so it is safe over a c
 edited. Generating catalogs for a repository that already holds several plugins, and writing the
 README install section, is the `marketplace` skill's job.
 
-`plugin init` writes a **minimal** manifest — `$schema`, `name`, and the vendor list. It never reads
+`plugin init` writes a **minimal** manifest — `$schema`, `name`, the vendor list, and, with `--npm`,
+the package's `version`. It never reads
 an existing vendor manifest, so shared metadata and per-vendor overrides are carried in by hand
 afterwards, per the reference you routed to.
 

package/skills/init-universal-plugin/references/create.md

@@ -42,11 +42,14 @@ for. The universal minimum is `skills/<name>/SKILL.md` plus `.mcp.json`.
 node scripts/init.mjs --name <plugin-name> --vendor claude-code --vendor cursor --scaffold
 ```
 
-Resolve `scripts/init.mjs` against this skill's directory; it runs the CLI that shipped beside it.
-`npx universal-plugin plugin init` is the fallback. Add `--npm` when an npm package ships the plugin,
-which also wires that `package.json`'s `files` to carry the derived manifests.
-
-`init` writes a minimal manifest — `$schema`, `name`, and the vendor list. Fill in the Step 1
+Resolve `scripts/init.mjs` against this skill's directory; it runs the project's installed CLI, else
+the pinned `npx universal-plugin@0.13.0`. Add `--npm` when an npm package ships the plugin,
+which also wires that `package.json`'s `files` to carry the derived manifests, copies its `version`
+into the manifest, and, in a changesets repository, wires the root `version` script to run
+`plugin version --from-package` (SKILL.md Phase 3 asks before that rewrite).
+
+`init` writes a minimal manifest — `$schema`, `name`, the vendor list, and the package `version`
+under `--npm`. Fill in the Step 1
 metadata and the `harnesses` overrides by hand afterwards; [`standard.md`](./standard.md) shows the
 finished shape.
 

package/skills/init-universal-plugin/references/vendors/copilot-cli.md

@@ -146,13 +146,13 @@ The namespace **replaces** the root rather than supplementing it, and an explici
 the manifest does **not** opt back into root loading. The move landed in **1.0.80-0** and the
 runtime's own changelog labels it breaking. Evidence and its confidence, including which kinds were
 proven by experiment:
-[`.research/copilot-spec-mode-namespace/`](../../../../../../.research/copilot-spec-mode-namespace/conclusion.md).
+[`.research/copilot-spec-mode-namespace/`](https://github.com/cyberuni/universal-plugin/blob/main/.research/copilot-spec-mode-namespace/conclusion.md).
 The published CLI plugin reference still says spec support is "additive on top of standard plugin
 loading" and documents only the root layout — it is stale; do not build against it.
 
 ### What the build derives
 
-`plugin build` derives the tree ([ADR-0015](../../../../.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)),
+`plugin build` derives the tree ([ADR-0015](https://github.com/cyberuni/universal-plugin/blob/main/packages/universal-plugin/.agents/spec/design/decisions/0015-copilot-spec-mode-namespace.md)),
 so **authoring stays at the canonical locations**:
 
 - `agents`, `commands` and `rules` are copied, resolved through the same `pathValue` contract

package/skills/init-universal-plugin/scripts/init.mjs

@@ -1,11 +1,52 @@
 #!/usr/bin/env node
-// Runs `universal-plugin plugin init` from the CLI that ships beside this skill, so a scaffold
-// never depends on a network fetch or on which version `npx` happens to resolve.
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// <package>/skills/<skill>/scripts/init.mjs: four levels up is the package root.
-const packageRoot = dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url)))))
-
-process.argv.splice(2, 0, 'plugin', 'init')
-await import(join(packageRoot, 'bin', 'universal-plugin.mjs'))
+// Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.13.0","entry":"skills/init-universal-plugin/scripts/init.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+import { spawnSync } from "node:child_process";
+//#region src/compile/scripts.ts
+/** The global the header assigns the script data to. Framework-neutral: a script's own code, or the
+*  library it inlines, reads it; universal-plugin depends on neither. */
+const SCRIPT_GLOBAL = "__SKILL_SCRIPT__";
+//#endregion
+//#region src/skill-scripts/cli-runner.ts
+/** The data `plugin build` embedded in this compiled script. */
+function skillScript() {
+	const data = globalThis[SCRIPT_GLOBAL];
+	if (data === void 0) throw new Error("this script runs only as compiled by `plugin build`");
+	return data;
+}
+/** Runs the universal-plugin CLI. A skill may be copied away from its package, so it never reaches
+*  for a CLI beside it: the project's installed CLI first, then the one pinned to this script's
+*  version, which `plugin version` stamps. */
+function runCli(args, options = {}) {
+	const { bin, package: pkg, version } = skillScript();
+	const name = bin ?? "universal-plugin";
+	if (spawnSync("pnpm", [
+		"exec",
+		name,
+		"--version"
+	], { encoding: "utf8" }).status === 0) return spawnSync("pnpm", [
+		"exec",
+		name,
+		...args
+	], {
+		encoding: "utf8",
+		...options
+	});
+	const pinned = `${pkg ?? "universal-plugin"}@${version ?? "latest"}`;
+	return spawnSync("npx", [pinned, ...args], {
+		encoding: "utf8",
+		...options
+	});
+}
+//#endregion
+//#region src/skill-scripts/run-cli.ts
+const script = skillScript();
+const command = Object.entries(script.commands).find(([, entry]) => entry === script.entry)?.[0];
+if (command === void 0) {
+	process.stderr.write(`${script.entry} declares no command in the scripts map\n`);
+	process.exit(1);
+}
+const result = runCli([...command.split(" "), ...process.argv.slice(2)], { stdio: "inherit" });
+process.exit(result.status ?? 1);
+//#endregion
+export {};

package/skills/marketplace/scripts/add.mjs

@@ -1,11 +1,52 @@
 #!/usr/bin/env node
-// Runs `universal-plugin marketplace add` from the CLI that ships beside this skill, so listing a
-// plugin never depends on a network fetch or on which version `npx` happens to resolve.
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// <package>/skills/<skill>/scripts/add.mjs: four levels up is the package root.
-const packageRoot = dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url)))))
-
-process.argv.splice(2, 0, 'marketplace', 'add')
-await import(join(packageRoot, 'bin', 'universal-plugin.mjs'))
+// Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.13.0","entry":"skills/marketplace/scripts/add.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+import { spawnSync } from "node:child_process";
+//#region src/compile/scripts.ts
+/** The global the header assigns the script data to. Framework-neutral: a script's own code, or the
+*  library it inlines, reads it; universal-plugin depends on neither. */
+const SCRIPT_GLOBAL = "__SKILL_SCRIPT__";
+//#endregion
+//#region src/skill-scripts/cli-runner.ts
+/** The data `plugin build` embedded in this compiled script. */
+function skillScript() {
+	const data = globalThis[SCRIPT_GLOBAL];
+	if (data === void 0) throw new Error("this script runs only as compiled by `plugin build`");
+	return data;
+}
+/** Runs the universal-plugin CLI. A skill may be copied away from its package, so it never reaches
+*  for a CLI beside it: the project's installed CLI first, then the one pinned to this script's
+*  version, which `plugin version` stamps. */
+function runCli(args, options = {}) {
+	const { bin, package: pkg, version } = skillScript();
+	const name = bin ?? "universal-plugin";
+	if (spawnSync("pnpm", [
+		"exec",
+		name,
+		"--version"
+	], { encoding: "utf8" }).status === 0) return spawnSync("pnpm", [
+		"exec",
+		name,
+		...args
+	], {
+		encoding: "utf8",
+		...options
+	});
+	const pinned = `${pkg ?? "universal-plugin"}@${version ?? "latest"}`;
+	return spawnSync("npx", [pinned, ...args], {
+		encoding: "utf8",
+		...options
+	});
+}
+//#endregion
+//#region src/skill-scripts/run-cli.ts
+const script = skillScript();
+const command = Object.entries(script.commands).find(([, entry]) => entry === script.entry)?.[0];
+if (command === void 0) {
+	process.stderr.write(`${script.entry} declares no command in the scripts map\n`);
+	process.exit(1);
+}
+const result = runCli([...command.split(" "), ...process.argv.slice(2)], { stdio: "inherit" });
+process.exit(result.status ?? 1);
+//#endregion
+export {};

package/skills/marketplace/scripts/install-docs.mjs

@@ -1,115 +1,119 @@
 #!/usr/bin/env node
-// Derives README install instructions from the marketplace catalogs a repository already carries.
-// Every command emitted here is traceable to vendor documentation; see
-// .research/local-marketplaces/evidence.md. Do not add a command without an evidence row.
-import { execFileSync } from 'node:child_process'
-import * as fs from 'node:fs'
-import * as path from 'node:path'
-
-const argv = process.argv.slice(2)
-const rootFlag = argv.indexOf('--root')
-const root = path.resolve(rootFlag === -1 ? process.cwd() : (argv[rootFlag + 1] ?? process.cwd()))
-const slugFlag = argv.indexOf('--repo')
-
+// Compiled by `universal-plugin plugin build` from src/skill-scripts/install-docs.ts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.13.0","entry":"skills/marketplace/scripts/install-docs.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+//#region src/skill-scripts/install-docs.ts
+const argv = process.argv.slice(2);
+const rootFlag = argv.indexOf("--root");
+const root = path.resolve(rootFlag === -1 ? process.cwd() : argv[rootFlag + 1] ?? process.cwd());
+const slugFlag = argv.indexOf("--repo");
 const readJson = (file) => {
 	try {
-		return JSON.parse(fs.readFileSync(file, 'utf8'))
+		return JSON.parse(fs.readFileSync(file, "utf8"));
 	} catch {
-		return null
+		return null;
 	}
-}
-
+};
 /** owner/repo, from the flag, the manifest's repository field, or the git remote. */
 function resolveSlug() {
-	if (slugFlag !== -1 && argv[slugFlag + 1]) return argv[slugFlag + 1]
-	const manifest = readJson(path.join(root, 'plugin.json'))
-	const repo = typeof manifest?.repository === 'string' ? manifest.repository : manifest?.repository?.url
-	const fromManifest = repo?.match(/github\.com[/:]([^/]+\/[^/.]+)/)?.[1]
-	if (fromManifest) return fromManifest
+	if (slugFlag !== -1 && argv[slugFlag + 1]) return argv[slugFlag + 1];
+	const manifest = readJson(path.join(root, "plugin.json"));
+	const fromManifest = (typeof manifest?.repository === "string" ? manifest.repository : manifest?.repository?.url)?.match(/github\.com[/:]([^/]+\/[^/.]+)/)?.[1];
+	if (fromManifest) return fromManifest;
 	try {
-		const remote = execFileSync('git', ['-C', root, 'remote', 'get-url', 'origin'], {
-			encoding: 'utf8',
-			stdio: ['ignore', 'pipe', 'ignore'],
-		})
-		return remote.match(/github\.com[/:]([^/]+\/[^/.\s]+)/)?.[1] ?? null
+		return execFileSync("git", [
+			"-C",
+			root,
+			"remote",
+			"get-url",
+			"origin"
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).match(/github\.com[/:]([^/]+\/[^/.\s]+)/)?.[1] ?? null;
 	} catch {
-		return null
+		return null;
 	}
 }
-
-const slug = resolveSlug()
-const repoRef = slug ?? '<owner>/<repo>'
-
-const claude = readJson(path.join(root, '.claude-plugin/marketplace.json'))
-const copilot = readJson(path.join(root, '.github/plugin/marketplace.json'))
-// Codex reads its own catalog and the Claude one. Either makes a repository installable from Codex;
-// prefer its own when both exist. See references/runtimes.md (E-CODEX-M10).
-const codexOwn = readJson(path.join(root, '.agents/plugins/marketplace.json'))
-const codex = codexOwn ?? claude
-const cursor = readJson(path.join(root, '.cursor-plugin/marketplace.json'))
-
-const targets = []
-const sections = []
-
-const pluginNames = (catalog) => (catalog?.plugins ?? []).map((p) => p.name).filter(Boolean)
-
+const slug = resolveSlug();
+const repoRef = slug ?? "<owner>/<repo>";
+const claude = readJson(path.join(root, ".claude-plugin/marketplace.json"));
+const copilot = readJson(path.join(root, ".github/plugin/marketplace.json"));
+const codex = readJson(path.join(root, ".agents/plugins/marketplace.json")) ?? claude;
+const cursor = readJson(path.join(root, ".cursor-plugin/marketplace.json"));
+const targets = [];
+const sections = [];
+const pluginNames = (catalog) => (catalog?.plugins ?? []).map((p) => p.name).filter(Boolean);
 if (claude) {
-	const names = pluginNames(claude)
-	const installs = (names.length > 0 ? names : ['<plugin>']).map((n) => `/plugin install ${n}@${claude.name}`)
-	targets.push('claude-code')
-	sections.push(['**Claude Code**', '', '```', `/plugin marketplace add ${repoRef}`, ...installs, '```'].join('\n'))
+	const names = pluginNames(claude);
+	const installs = (names.length > 0 ? names : ["<plugin>"]).map((n) => `/plugin install ${n}@${claude.name}`);
+	targets.push("claude-code");
+	sections.push([
+		"**Claude Code**",
+		"",
+		"```",
+		`/plugin marketplace add ${repoRef}`,
+		...installs,
+		"```"
+	].join("\n"));
 }
-
 if (copilot) {
-	const names = pluginNames(copilot)
-	const installs = (names.length > 0 ? names : ['<plugin>']).map((n) => `copilot plugin install ${n}@${copilot.name}`)
-	targets.push('copilot-cli')
-	sections.push(
-		['**GitHub Copilot CLI**', '', '```', `copilot plugin marketplace add ${repoRef}`, ...installs, '```'].join('\n'),
-	)
+	const names = pluginNames(copilot);
+	const installs = (names.length > 0 ? names : ["<plugin>"]).map((n) => `copilot plugin install ${n}@${copilot.name}`);
+	targets.push("copilot-cli");
+	sections.push([
+		"**GitHub Copilot CLI**",
+		"",
+		"```",
+		`copilot plugin marketplace add ${repoRef}`,
+		...installs,
+		"```"
+	].join("\n"));
 }
-
 if (codex) {
-	const names = pluginNames(codex)
-	// Codex installs with `plugin add`; Copilot CLI installs with `plugin install`. Not interchangeable.
-	const installs = (names.length > 0 ? names : ['<plugin>']).map((n) => `codex plugin add ${n}@${codex.name}`)
-	targets.push('codex')
-	sections.push(
-		[
-			'**Codex**',
-			'',
-			'```',
-			`codex plugin marketplace add ${repoRef}`,
-			...installs,
-			'```',
-			'',
-			'Start a new session before using the plugin.',
-		].join('\n'),
-	)
+	const names = pluginNames(codex);
+	const installs = (names.length > 0 ? names : ["<plugin>"]).map((n) => `codex plugin add ${n}@${codex.name}`);
+	targets.push("codex");
+	sections.push([
+		"**Codex**",
+		"",
+		"```",
+		`codex plugin marketplace add ${repoRef}`,
+		...installs,
+		"```",
+		"",
+		"Start a new session before using the plugin."
+	].join("\n"));
 }
-
 if (cursor) {
-	targets.push('cursor')
-	sections.push(
-		[
-			'**Cursor**',
-			'',
-			'This repository carries a Cursor catalog, but Cursor has no command that adds it from a',
-			'local path: a team admin imports the repository from the Cursor dashboard. To try the plugin',
-			'before then, run `npx universal-plugin plugin install --vendor cursor` in a clone, then',
-			'reload the window.',
-		].join('\n'),
-	)
+	targets.push("cursor");
+	sections.push([
+		"**Cursor**",
+		"",
+		"This repository carries a Cursor catalog, but Cursor has no command that adds it from a",
+		"local path: a team admin imports the repository from the Cursor dashboard. To try the plugin",
+		"before then, run `npx universal-plugin plugin install --vendor cursor` in a clone, then",
+		"reload the window."
+	].join("\n"));
 }
-
-const markdown = sections.length === 0 ? '' : ['## Install', '', sections.join('\n\n'), ''].join('\n')
-
-process.stdout.write(
-	`${JSON.stringify({
-		root,
-		repo: slug,
-		repoResolved: slug !== null,
-		targets,
-		markdown,
-	})}\n`,
-)
+const markdown = sections.length === 0 ? "" : [
+	"## Install",
+	"",
+	sections.join("\n\n"),
+	""
+].join("\n");
+process.stdout.write(`${JSON.stringify({
+	root,
+	repo: slug,
+	repoResolved: slug !== null,
+	targets,
+	markdown
+})}\n`);
+//#endregion
+export {};

package/skills/marketplace/scripts/marketplace.mjs

@@ -1,11 +1,52 @@
 #!/usr/bin/env node
-// Runs `universal-plugin marketplace init` from the CLI that ships beside this skill, so catalog
-// generation never depends on a network fetch or on which version `npx` happens to resolve.
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// <package>/skills/<skill>/scripts/marketplace.mjs: four levels up is the package root.
-const packageRoot = dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url)))))
-
-process.argv.splice(2, 0, 'marketplace', 'init')
-await import(join(packageRoot, 'bin', 'universal-plugin.mjs'))
+// Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.13.0","entry":"skills/marketplace/scripts/marketplace.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+import { spawnSync } from "node:child_process";
+//#region src/compile/scripts.ts
+/** The global the header assigns the script data to. Framework-neutral: a script's own code, or the
+*  library it inlines, reads it; universal-plugin depends on neither. */
+const SCRIPT_GLOBAL = "__SKILL_SCRIPT__";
+//#endregion
+//#region src/skill-scripts/cli-runner.ts
+/** The data `plugin build` embedded in this compiled script. */
+function skillScript() {
+	const data = globalThis[SCRIPT_GLOBAL];
+	if (data === void 0) throw new Error("this script runs only as compiled by `plugin build`");
+	return data;
+}
+/** Runs the universal-plugin CLI. A skill may be copied away from its package, so it never reaches
+*  for a CLI beside it: the project's installed CLI first, then the one pinned to this script's
+*  version, which `plugin version` stamps. */
+function runCli(args, options = {}) {
+	const { bin, package: pkg, version } = skillScript();
+	const name = bin ?? "universal-plugin";
+	if (spawnSync("pnpm", [
+		"exec",
+		name,
+		"--version"
+	], { encoding: "utf8" }).status === 0) return spawnSync("pnpm", [
+		"exec",
+		name,
+		...args
+	], {
+		encoding: "utf8",
+		...options
+	});
+	const pinned = `${pkg ?? "universal-plugin"}@${version ?? "latest"}`;
+	return spawnSync("npx", [pinned, ...args], {
+		encoding: "utf8",
+		...options
+	});
+}
+//#endregion
+//#region src/skill-scripts/run-cli.ts
+const script = skillScript();
+const command = Object.entries(script.commands).find(([, entry]) => entry === script.entry)?.[0];
+if (command === void 0) {
+	process.stderr.write(`${script.entry} declares no command in the scripts map\n`);
+	process.exit(1);
+}
+const result = runCli([...command.split(" "), ...process.argv.slice(2)], { stdio: "inherit" });
+process.exit(result.status ?? 1);
+//#endregion
+export {};

package/skills/marketplace/scripts/validate.mjs

@@ -1,11 +1,52 @@
 #!/usr/bin/env node
-// Runs `universal-plugin marketplace validate` from the CLI that ships beside this skill, so the
-// check never depends on a network fetch or on which version `npx` happens to resolve.
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// <package>/skills/<skill>/scripts/validate.mjs: four levels up is the package root.
-const packageRoot = dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url)))))
-
-process.argv.splice(2, 0, 'marketplace', 'validate')
-await import(join(packageRoot, 'bin', 'universal-plugin.mjs'))
+// Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.13.0","entry":"skills/marketplace/scripts/validate.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+import { spawnSync } from "node:child_process";
+//#region src/compile/scripts.ts
+/** The global the header assigns the script data to. Framework-neutral: a script's own code, or the
+*  library it inlines, reads it; universal-plugin depends on neither. */
+const SCRIPT_GLOBAL = "__SKILL_SCRIPT__";
+//#endregion
+//#region src/skill-scripts/cli-runner.ts
+/** The data `plugin build` embedded in this compiled script. */
+function skillScript() {
+	const data = globalThis[SCRIPT_GLOBAL];
+	if (data === void 0) throw new Error("this script runs only as compiled by `plugin build`");
+	return data;
+}
+/** Runs the universal-plugin CLI. A skill may be copied away from its package, so it never reaches
+*  for a CLI beside it: the project's installed CLI first, then the one pinned to this script's
+*  version, which `plugin version` stamps. */
+function runCli(args, options = {}) {
+	const { bin, package: pkg, version } = skillScript();
+	const name = bin ?? "universal-plugin";
+	if (spawnSync("pnpm", [
+		"exec",
+		name,
+		"--version"
+	], { encoding: "utf8" }).status === 0) return spawnSync("pnpm", [
+		"exec",
+		name,
+		...args
+	], {
+		encoding: "utf8",
+		...options
+	});
+	const pinned = `${pkg ?? "universal-plugin"}@${version ?? "latest"}`;
+	return spawnSync("npx", [pinned, ...args], {
+		encoding: "utf8",
+		...options
+	});
+}
+//#endregion
+//#region src/skill-scripts/run-cli.ts
+const script = skillScript();
+const command = Object.entries(script.commands).find(([, entry]) => entry === script.entry)?.[0];
+if (command === void 0) {
+	process.stderr.write(`${script.entry} declares no command in the scripts map\n`);
+	process.exit(1);
+}
+const result = runCli([...command.split(" "), ...process.argv.slice(2)], { stdio: "inherit" });
+process.exit(result.status ?? 1);
+//#endregion
+export {};

package/skills/migrate-plugin/SKILL.md

@@ -174,7 +174,7 @@ as a follow-up instead of doing it inside this migration.
 Point every version and build step at the new plugin root:
 
 - Set the manifest extension's `packagePath` to `"."`.
-- `universal-plugin publish sync-version --root <pkg>` reads `packagePath` from
+- `universal-plugin plugin version --from-package --root <pkg>` reads `packagePath` from
   `<pkg>/.agents/universal-plugin.json`, not from the manifest extension. With
   no `packagePath` it reads `<pkg>/package.json`, so a package that holds its
   own plugin needs no config file for it. If the repository instead runs its

package/skills/upgrade-plugin/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: upgrade-plugin
 description: Use this skill when upgrading pinned `npx universal-plugin@<version>` calls across a project to a newer version.
+metadata:
+  pin-exempt: true
 ---
 
 # Upgrade Universal Plugin