universal-plugin 0.14.1 → 0.15.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.14.1",
+	"version": "0.15.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.14.1",
+	"version": "0.15.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.14.1",
+	"version": "0.15.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/dist/cli.mjs

@@ -6920,6 +6920,82 @@ function addEntry(config, key, entry) {
 	};
 }
 //#endregion
+//#region src/compile/invisible.ts
+/** Invisible characters in compiled output (issue #190).
+*
+*  A bundler prints a dependency's `'\u{FEFF}'` as the raw character, so a committed script holds
+*  code points a reader cannot see — the ones skill checks reject because they can hide
+*  instructions. Inside a string, template or regular-expression literal the character can be
+*  written as an escape with the same meaning; anywhere else it can only be reported. */
+/** Controls, format characters (zero-width, bidirectional, BOM, soft hyphen, tags), line and paragraph
+*  separators, and default-ignorable code points such as variation selectors. Tab, line feed and
+*  carriage return are ordinary whitespace. */
+const INVISIBLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/u;
+function isInvisible(char) {
+	return char !== "	" && char !== "\n" && char !== "\r" && INVISIBLE.test(char);
+}
+/** `\uXXXX` per UTF-16 code unit — valid in strings, templates and regular expressions, with or
+*  without the `u` flag (a surrogate pair of escapes reads as one code point under `u`). */
+function escapeChar(char) {
+	let out = "";
+	for (let i = 0; i < char.length; i++) out += `\\u${char.charCodeAt(i).toString(16).toUpperCase().padStart(4, "0")}`;
+	return out;
+}
+/** Rewrites every invisible character inside `spans` as an escape that keeps the literal's value. */
+function escapeInvisible(code, spans) {
+	const sorted = [...spans].sort((a, b) => a.start - b.start);
+	let out = "";
+	let copied = 0;
+	for (const span of sorted) {
+		if (span.start < copied) continue;
+		out += code.slice(copied, span.start);
+		out += escapeSpan(code.slice(span.start, span.end), span.kind);
+		copied = span.end;
+	}
+	return out + code.slice(copied);
+}
+function escapeSpan(text, kind) {
+	let out = "";
+	let i = 0;
+	while (i < text.length) {
+		const char = String.fromCodePoint(text.codePointAt(i));
+		if (char !== "\\") {
+			out += isInvisible(char) ? escapeChar(char) : char;
+			i += char.length;
+			continue;
+		}
+		const next = i + 1 < text.length ? String.fromCodePoint(text.codePointAt(i + 1)) : "";
+		i += 1 + next.length;
+		if (!isInvisible(next)) out += `\\${next}`;
+		else if (kind !== "regex" && (next === "\u2028" || next === "\u2029")) continue;
+		else out += escapeChar(next);
+	}
+	return out;
+}
+/** Every invisible character left in `code`, 1-based line and column, for the build to warn about. */
+function findInvisible(code) {
+	const found = [];
+	let line = 1;
+	let column = 1;
+	for (const char of code) {
+		if (char === "\n") {
+			line++;
+			column = 1;
+			continue;
+		}
+		if (isInvisible(char)) found.push({
+			line,
+			column,
+			codePoint: char.codePointAt(0)
+		});
+		column++;
+	}
+	return found;
+}
+function formatCodePoint(codePoint) {
+	return `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
+}
+//#endregion
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the
 *  library it inlines, reads it; universal-plugin depends on neither. */
@@ -6970,18 +7046,23 @@ function parseEntry(output, value) {
 		source: value
 	};
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return `scripts "${output}" must map to a source path or { source, command }`;
-	const { source, command } = value;
+	const { source, command, alias, keepNames } = value;
 	if (typeof source !== "string" || source.length === 0) return `scripts "${output}" has no source`;
 	if (command !== void 0 && (typeof command !== "string" || command.trim().length === 0)) return `scripts "${output}" has a command that is not a command path`;
-	return command === void 0 ? {
-		output: normalized,
-		source
-	} : {
+	if (alias !== void 0 && !isStringMap(alias)) return `scripts "${output}" has an alias that is not a map from import specifier to replacement`;
+	if (keepNames !== void 0 && typeof keepNames !== "boolean") return `scripts "${output}" has a keepNames that is not true or false`;
+	return {
 		output: normalized,
 		source,
-		command: command.trim().split(/\s+/).join(" ")
+		...command === void 0 ? {} : { command: command.trim().split(/\s+/).join(" ") },
+		...alias === void 0 ? {} : { alias },
+		...keepNames === void 0 ? {} : { keepNames }
 	};
 }
+function isStringMap(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.entries(value).every(([k, v]) => k.length > 0 && typeof v === "string" && v.length > 0);
+}
 /** A `/`-separated path relative to the plugin root, without `./`; `null` when it is absolute or
 *  climbs out of the root. */
 function normalizeRelative(p) {
@@ -7101,7 +7182,7 @@ async function compileScripts(root, opts, compiler) {
 				entry: entry.output,
 				commands
 			};
-			content = composeScript(await compiler.compile(sourcePath, root), entry, data);
+			content = composeScript(await compiler.compile(sourcePath, root, bundleOptions(entry)), entry, data);
 		} catch (err) {
 			warnings.push(`Failed to compile ${entry.source} → ${entry.output}: ${err instanceof Error ? err.message : String(err)}`);
 			rows.push({
@@ -7114,6 +7195,8 @@ async function compileScripts(root, opts, compiler) {
 		const bytes = Buffer.byteLength(content);
 		const overBudget = sizeWarning(entry.output, bytes, bin);
 		if (overBudget !== null) warnings.push(overBudget);
+		const hidden = findInvisible(content);
+		if (hidden.length > 0) warnings.push(invisibleWarning(entry.output, hidden));
 		const comparison = compareScript(fs$1.existsSync(outputPath) ? fs$1.readFileSync(outputPath, "utf8") : null, content);
 		if (opts.dryRun || comparison === "unchanged") {
 			rows.push({
@@ -7141,6 +7224,19 @@ async function compileScripts(root, opts, compiler) {
 		summary: summarize(rows)
 	};
 }
+/** The bundle options the entry sets, and none it does not. */
+function bundleOptions({ alias, keepNames }) {
+	return {
+		...alias === void 0 ? {} : { alias },
+		...keepNames === void 0 ? {} : { keepNames }
+	};
+}
+/** The compiler escapes invisible characters inside literals; one left elsewhere (a comment, an
+*  identifier, a tagged template) is named so the author can find it before a skill check does. */
+function invisibleWarning(output, hidden) {
+	const [first] = hidden;
+	return `${`${output}:${first?.line}:${first?.column} ${formatCodePoint(first?.codePoint ?? 0)}`}${hidden.length > 1 ? ` and ${hidden.length - 1} more` : ""}: invisible character in the compiled script that the build could not escape — skill checks reject it; write it as an escape in a string literal in the source`;
+}
 /** The `package.json` at `packagePath` (`.agents/universal-plugin.json`), which names the package and
 *  bin a script falls back to; `null` when the plugin ships to no package. Its version is never read. */
 function readPackageJson(root) {
@@ -7275,34 +7371,40 @@ function onlyEntryMain() {
 *
 *  An entry that inlines only its own source keeps readable output — in effect its types are
 *  stripped. One that inlines a dependency is minified, because that is the code the size budget is
-*  for. rolldown is loaded only when a plugin declares a script. */
-const rolldownCompiler = { async compile(sourcePath, root) {
+*  for. rolldown is loaded only when a plugin declares a script.
+*
+*  An entry's `alias` becomes `resolve.alias`, with a relative target resolved from the plugin root;
+*  its `keepNames` is passed to both outputs, so minifying keeps the names too. */
+const rolldownCompiler = { async compile(sourcePath, root, options = {}) {
 	const { rolldown } = await import("rolldown");
 	const unresolved = [];
+	const alias = resolveAlias(options, root);
+	const output = {
+		format: "esm",
+		codeSplitting: false,
+		keepNames: options.keepNames ?? false
+	};
 	const bundle = await rolldown({
 		input: sourcePath,
 		cwd: root,
 		platform: "node",
 		plugins: [onlyEntryMain()],
+		...alias === void 0 ? {} : { resolve: { alias } },
 		onLog(_level, log) {
 			if (log.code === "UNRESOLVED_IMPORT") unresolved.push(log.message);
 		}
 	});
 	try {
 		if (unresolved.length > 0) throw new Error(unresolved.join("\n"));
-		const [chunk, ...rest] = (await bundle.generate({
-			format: "esm",
-			codeSplitting: false
-		})).output;
+		const [chunk, ...rest] = (await bundle.generate(output)).output;
 		if (chunk?.type !== "chunk" || rest.some((o) => o.type === "chunk")) throw new Error("compiles to more than one file");
-		const external = [...chunk.imports, ...chunk.dynamicImports].filter((id) => !isBuiltin(id));
+		const external = [...chunk.imports, ...chunk.dynamicImports].filter((id) => !isBuiltin(id) && id !== chunk.fileName);
 		if (external.length > 0) throw new Error(`imports ${external.join(", ")}, which could not be inlined — install it where the plugin root resolves it`);
-		if (!chunk.moduleIds.some((id) => id.split(path$1.sep).includes("node_modules"))) return chunk.code;
-		return (await bundle.generate({
-			format: "esm",
-			codeSplitting: false,
+		if (!chunk.moduleIds.some((id) => id.split(path$1.sep).includes("node_modules"))) return await escapeLiterals(chunk.code);
+		return await escapeLiterals((await bundle.generate({
+			...output,
 			minify: true
-		})).output[0].code;
+		})).output[0].code);
 	} catch (error) {
 		const spec = failedExtends(error);
 		throw spec ? new Error(explainTsconfigFailure(sourcePath, root, spec), { cause: error }) : error;
@@ -7310,6 +7412,57 @@ const rolldownCompiler = { async compile(sourcePath, root) {
 		await bundle.close();
 	}
 } };
+/** The entry's alias with each relative target (`./`, `../`) made absolute from the plugin root, so it
+*  does not depend on where rolldown resolves from; `undefined` when the entry sets none. */
+function resolveAlias({ alias }, root) {
+	if (alias === void 0 || Object.keys(alias).length === 0) return void 0;
+	return Object.fromEntries(Object.entries(alias).map(([from, to]) => [from, /^\.\.?\//.test(to) ? path$1.resolve(root, to) : to]));
+}
+/** rolldown prints a dependency's escaped invisible characters raw (issue #190); this writes them back
+*  as escapes inside every string, untagged template and regular-expression literal. */
+async function escapeLiterals(code) {
+	if (![...code].some(isInvisible)) return code;
+	const { parseAst } = await import("rolldown/parseAst");
+	const spans = [];
+	collectSpans(parseAst(code), spans);
+	return escapeInvisible(code, spans);
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+function collectSpans(node, spans) {
+	if (node.type === "Literal") {
+		if (typeof node["value"] === "string") spans.push({
+			start: node.start,
+			end: node.end,
+			kind: "string"
+		});
+		else if (node["regex"] !== void 0) spans.push({
+			start: node.start,
+			end: node.end,
+			kind: "regex"
+		});
+		return;
+	}
+	if (node.type === "TaggedTemplateExpression") {
+		visit(node["tag"], spans);
+		for (const expression of node["quasi"]["expressions"]) collectSpans(expression, spans);
+		return;
+	}
+	if (node.type === "TemplateElement") {
+		spans.push({
+			start: node.start,
+			end: node.end,
+			kind: "template"
+		});
+		return;
+	}
+	for (const [key, value] of Object.entries(node)) if (key !== "parent") visit(value, spans);
+}
+function visit(value, spans) {
+	if (Array.isArray(value)) for (const item of value) visit(item, spans);
+	else if (isNode(value)) collectSpans(value, spans);
+}
 //#endregion
 //#region ../../node_modules/.pnpm/@toon-format+toon@4.1.1/node_modules/@toon-format/toon/dist/index.mjs
 const NULL_LITERAL = "null";
@@ -7897,16 +8050,17 @@ function nextStep$1(result, cwd) {
 }
 function buildCommand() {
 	const cmd = new Command("build").description("Generate vendor manifests from plugin.json");
-	cmd.option("--vendor <id>", "Build only the named vendor").option("--dry-run", "Print what would be written without writing").option("--verbose", "Print field-by-field transformation decisions").option("--clean", "Delete generated manifests before building").option("--strict-dependencies", "Fail when a refreshed catalog cannot resolve a declared dependency").option("--format <format>", "Output format: json or toon (default: toon)").addOption(new Option("--json").hideHelp()).addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin build --vendor claude-code\n").action(async (opts) => {
+	cmd.option("--vendor <id>", "Build only the named vendor").option("--dry-run", "Print what would be written without writing").option("--check", "Write nothing; exit 1 when a compiled script is missing, stale, or on another version").option("--verbose", "Print field-by-field transformation decisions").option("--clean", "Delete generated manifests before building").option("--strict-dependencies", "Fail when a refreshed catalog cannot resolve a declared dependency").option("--format <format>", "Output format: json or toon (default: toon)").addOption(new Option("--json").hideHelp()).addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin build --vendor claude-code\n").action(async (opts) => {
 		try {
 			const root = resolveRoot(opts.root);
+			const dryRun = opts.dryRun || opts.check;
 			const result = buildPlugin(root, {
 				vendor: opts.vendor,
-				dryRun: opts.dryRun,
+				dryRun,
 				verbose: opts.verbose,
 				clean: opts.clean
 			});
-			const scripts = await compileScripts(root, { dryRun: opts.dryRun }, rolldownCompiler);
+			const scripts = await compileScripts(root, { dryRun }, rolldownCompiler);
 			for (const warning of [...result.warnings, ...scripts.warnings]) process.stderr.write(`warn: ${warning}\n`);
 			const { built, skipped, failed, canonical } = result.summary;
 			const jsonResult = {
@@ -7941,6 +8095,11 @@ function buildCommand() {
 			});
 			process.stderr.write(nextStep$1(result, process.cwd()));
 			if (failed > 0 || scripts.summary.failed > 0) process.exitCode = 1;
+			if (opts.check && scripts.summary.behind > 0) {
+				const behind = scripts.rows.filter((r) => r.status === "missing" || r.status === "stale" || r.status === "version").map((r) => `${r.path} (${r.status})`);
+				process.stderr.write(`error: ${behind.length} compiled ${behind.length === 1 ? "script is" : "scripts are"} behind: ${behind.join(", ")} — run "universal-plugin plugin build" and commit the result (--check)\n`);
+				process.exitCode = 1;
+			}
 			if (opts.strictDependencies && result.dependencyIssues.length > 0) {
 				process.stderr.write(`error: ${result.dependencyIssues.length} declared ${result.dependencyIssues.length === 1 ? "dependency" : "dependencies"} cannot be resolved through the refreshed catalogs (--strict-dependencies)\n`);
 				process.exitCode = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.14.1",
+	"version": "0.15.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/skills/adopt-upx/scripts/rewrite-upx.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/rewrite-upx.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/adopt-upx/scripts/rewrite-upx.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/adopt-upx/scripts/rewrite-upx.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/skill-scripts/rewrite-upx.ts

package/skills/build-plugin/SKILL.md

@@ -47,7 +47,7 @@ node scripts/build.mjs --root <plugin-root>
 
 Resolve `scripts/build.mjs` against this skill's own directory. It runs the CLI the project installed
 (`pnpm exec universal-plugin`), else the CLI pinned to the version this skill shipped with
-(`npx universal-plugin@0.14.1`), so it works in a skill that was linked or copied on its own. `--root` defaults to the working directory and
+(`npx universal-plugin@0.15.0`), so it works in a skill that was linked or copied on its own. `--root` defaults to the working directory and
 must name the directory that holds the canonical `plugin.json`.
 
 The command never prompts, so it is safe to run unattended.
@@ -58,6 +58,7 @@ The command never prompts, so it is safe to run unattended.
 | `--vendor <id>` | Build one vendor (`claude-code`, `cursor`, `codex`, `copilot-cli`), and refresh only its catalog |
 | `--verbose` | Print each field-level decision the derivation made |
 | `--strict-dependencies` | Fail when a refreshed catalog cannot resolve a declared dependency. Use in CI |
+| `--check` | Write nothing; exit 1 when a compiled script is `missing`, `stale`, or `version`. Use in CI |
 | `--format json` | The same result as JSON, for scripts |
 
 `--clean` also exists. It deletes derived manifests before rewriting them, so reach for it only

package/skills/build-plugin/scripts/build.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/build-plugin/scripts/build.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/build-plugin/scripts/build.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/doctor-universal-plugin/SKILL.md

@@ -172,7 +172,7 @@ it does not, offer to add it — ask first, because both are the user's files:
   semantic-release bot opens.
 
 Use the locked `universal-plugin` from the repository's devDependencies when it has one; otherwise
-`npx universal-plugin@0.14.1`, pinned. This check matters most where the release tool picks the
+`npx universal-plugin@0.15.0`, pinned. This check matters most where the release tool picks the
 number, because nothing else runs between that bump and publish.
 
 ## Unreleased content

package/skills/doctor-universal-plugin/scripts/doctor.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/doctor.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/doctor-universal-plugin/scripts/doctor.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/doctor-universal-plugin/scripts/doctor.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";

package/skills/init-universal-plugin/references/create.md

@@ -43,7 +43,7 @@ node scripts/init.mjs --name <plugin-name> --vendor claude-code --vendor cursor
 ```
 
 Resolve `scripts/init.mjs` against this skill's directory; it runs the project's installed CLI, else
-the pinned `npx universal-plugin@0.14.1`. Add `--npm` when an npm package ships the plugin,
+the pinned `npx universal-plugin@0.15.0`. Add `--npm` when an npm package ships the plugin,
 which also wires that `package.json`'s `files` to carry the derived manifests, copies its `version`
 into the manifest, and, in a changesets repository, wires the root `version` script to run
 `plugin version --from-package` (SKILL.md Phase 3 asks before that rewrite).

package/skills/init-universal-plugin/scripts/init.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/init-universal-plugin/scripts/init.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/init-universal-plugin/scripts/init.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/add.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/marketplace/scripts/add.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/marketplace/scripts/add.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/install-docs.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/install-docs.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/marketplace/scripts/install-docs.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/marketplace/scripts/install-docs.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";

package/skills/marketplace/scripts/marketplace.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/marketplace/scripts/marketplace.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/marketplace/scripts/marketplace.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/validate.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/marketplace/scripts/validate.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/marketplace/scripts/validate.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/version/SKILL.md

@@ -74,7 +74,7 @@ node scripts/version.mjs --from-package
 ```
 
 Resolve that path against this skill's own directory; it runs the project's installed CLI
-(`pnpm exec universal-plugin`), else `npx universal-plugin@0.14.1` pinned to this skill's version.
+(`pnpm exec universal-plugin`), else `npx universal-plugin@0.15.0` pinned to this skill's version.
 `universal-plugin plugin version` on the `PATH` is the fallback. The command never prompts, so it is safe to run unattended once the
 source is decided.
 

package/skills/version/scripts/version.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.14.1","entry":"skills/version/scripts/version.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.15.0","entry":"skills/version/scripts/version.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the