universal-plugin 0.17.0 → 0.17.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.17.0",
+	"version": "0.17.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.17.0",
+	"version": "0.17.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "universal-plugin",
-	"version": "0.17.0",
+	"version": "0.17.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # universal-plugin
 
+## 0.17.1
+
+### Patch Changes
+
+- 7c951cc: `plugin bundle` and `publish sync-version` no longer warn that they are removed "in the next minor release", a release that has already shipped. The warning now says they have been deprecated since 0.14.0 and will be removed in a later release.
+- 621d36d: The `publish-plugin` skill's clone, fork and pull request commands now use the marketplace repo the user chose instead of always naming `cyberuni/cyberplace`.
+- 621d36d: The skill references no longer contradict each other on how the plugin is built and shipped: Copilot CLI reads the canonical `plugin.json` directly, a local install goes through `plugin install` rather than a hand-written symlink, `anthropics/claude-plugins-official` takes no pull requests, the build writes no Cursor command or Codex prompt, `packagePath` lives in `.agents/universal-plugin.json`, and `plugin build` has a `--check` flag.
+- 621d36d: The plugin references and the `agentskills-specialist` agent now say Copilot CLI hooks keep the canonical PascalCase event names, which is what the build writes, instead of camelCase.
+- 621d36d: The skills now name skills that exist: `buddy-agent-harness:init-buddy-agent-harness`, `buddy-agent-harness:doctor-buddy-agent-harness`, `buddy-changesets:changesets`, `aced:improve-skill` and its `validate.mjs` script, and the `marketplace` skill for a repository-local catalog.
+- 621d36d: The plugin references now name `mcp.json` as a plugin's MCP config, the fixed location the build reads, and drop the rule that it must be a symlink to `.mcp.json`.
+- 621d36d: The plugin references and the `agentskills-specialist` agent drop claims nothing backs: a fixed `SKILL.md` section template, a 6,000-character limit for every runtime, a `skill.json`, support for Zed, Continue.dev and Cline, `$ARGUMENTS` expanding everywhere, and dated "next minor release" wording. They also call references references, not governances.
+
 ## 0.17.0
 
 ### Minor Changes

package/agents/agentskills-specialist.md

@@ -14,7 +14,7 @@ model: opus
 # AgentSkills Specialist
 
 ## Role
-You are an expert AgentSkills engineer who designs, audits, and improves skills across Claude Code, Cursor, Codex, GitHub Copilot CLI, Windsurf, Zed, Continue.dev, and Cline runtimes.
+You are an expert AgentSkills engineer who designs, audits, and improves skills across Claude Code, Cursor, Codex, and GitHub Copilot CLI, the runtimes `plugin build` targets. Flag a skill meant for Windsurf as needing conversion, and Zed, Aider, Continue.dev, or Cline as incompatible.
 
 ## Core Responsibilities
 
@@ -32,14 +32,9 @@ skills/<name>/SKILL.md       # Universal skill definition (primary)
 .agents/skills/<name>/SKILL.md  # Project-level extension (if present)
 ```
 
-A `SKILL.md` must include:
-- **Purpose**: One sentence describing what the skill does.
-- **Trigger**: When/how this skill is invoked.
-- **Inputs**: What context or parameters the skill consumes.
-- **Outputs / Side Effects**: What the skill produces or changes.
-- **Steps**: Numbered, concrete procedural steps.
-- **Runtime Notes**: Any known incompatibilities or runtime-specific behavior.
-- **Examples**: At least one concrete invocation example.
+A `SKILL.md` should make clear what the skill does, when it is invoked, what it consumes and
+produces, and the steps it follows, plus runtime limitations and an example where they help. These
+are questions the body answers, not required section names.
 
 ## Auditing Workflow
 
@@ -75,7 +70,7 @@ For skill creation or edits, write the full `SKILL.md` content directly — no p
 ## Key Research Context
 
 - A root `plugin.json` on Agent Plugins Spec 1.0.0 is the universal manifest; `skills/<name>/SKILL.md` is the universal skill entry point.
-- Hook event naming is the sharpest incompatibility: PascalCase (Claude Code, Codex), camelCase (Cursor, Copilot CLI), snake_case (Windsurf).
+- Hook event naming is the sharpest incompatibility: PascalCase (Claude Code, Codex, Copilot CLI), camelCase (Cursor), snake_case (Windsurf).
 - Only Claude Code and Cursor publish machine-readable JSON Schemas.
 
 ## Out of Scope
@@ -87,7 +82,7 @@ For skill creation or edits, write the full `SKILL.md` content directly — no p
 ## Quality Gates
 
 Before declaring any skill complete:
-- [ ] SKILL.md is present and complete per the standard above.
+- [ ] SKILL.md is present and answers the questions above.
 - [ ] No runtime-specific assumptions are baked into the universal layer.
 - [ ] Project-level `.agents/skills/<name>/SKILL.md` extension is merged, not duplicated.
 - [ ] Examples are concrete and runnable.

package/com.github.copilot/agents/agentskills-specialist.agent.md

@@ -14,7 +14,7 @@ model: opus
 # AgentSkills Specialist
 
 ## Role
-You are an expert AgentSkills engineer who designs, audits, and improves skills across Claude Code, Cursor, Codex, GitHub Copilot CLI, Windsurf, Zed, Continue.dev, and Cline runtimes.
+You are an expert AgentSkills engineer who designs, audits, and improves skills across Claude Code, Cursor, Codex, and GitHub Copilot CLI, the runtimes `plugin build` targets. Flag a skill meant for Windsurf as needing conversion, and Zed, Aider, Continue.dev, or Cline as incompatible.
 
 ## Core Responsibilities
 
@@ -32,14 +32,9 @@ skills/<name>/SKILL.md       # Universal skill definition (primary)
 .agents/skills/<name>/SKILL.md  # Project-level extension (if present)
 ```
 
-A `SKILL.md` must include:
-- **Purpose**: One sentence describing what the skill does.
-- **Trigger**: When/how this skill is invoked.
-- **Inputs**: What context or parameters the skill consumes.
-- **Outputs / Side Effects**: What the skill produces or changes.
-- **Steps**: Numbered, concrete procedural steps.
-- **Runtime Notes**: Any known incompatibilities or runtime-specific behavior.
-- **Examples**: At least one concrete invocation example.
+A `SKILL.md` should make clear what the skill does, when it is invoked, what it consumes and
+produces, and the steps it follows, plus runtime limitations and an example where they help. These
+are questions the body answers, not required section names.
 
 ## Auditing Workflow
 
@@ -75,7 +70,7 @@ For skill creation or edits, write the full `SKILL.md` content directly — no p
 ## Key Research Context
 
 - A root `plugin.json` on Agent Plugins Spec 1.0.0 is the universal manifest; `skills/<name>/SKILL.md` is the universal skill entry point.
-- Hook event naming is the sharpest incompatibility: PascalCase (Claude Code, Codex), camelCase (Cursor, Copilot CLI), snake_case (Windsurf).
+- Hook event naming is the sharpest incompatibility: PascalCase (Claude Code, Codex, Copilot CLI), camelCase (Cursor), snake_case (Windsurf).
 - Only Claude Code and Cursor publish machine-readable JSON Schemas.
 
 ## Out of Scope
@@ -87,7 +82,7 @@ For skill creation or edits, write the full `SKILL.md` content directly — no p
 ## Quality Gates
 
 Before declaring any skill complete:
-- [ ] SKILL.md is present and complete per the standard above.
+- [ ] SKILL.md is present and answers the questions above.
 - [ ] No runtime-specific assumptions are baked into the universal layer.
 - [ ] Project-level `.agents/skills/<name>/SKILL.md` extension is merged, not duplicated.
 - [ ] Examples are concrete and runnable.

package/dist/cli.mjs

@@ -8987,7 +8987,7 @@ const NEXT_STEP$1 = "→ review and commit the pinned skills\n";
 function bundleCommand() {
 	const cmd = new Command("bundle").description("Deprecated: use `plugin version`, which stamps the skill pins");
 	cmd.option("--dry-run", "Resolve and report pins without writing them").option("--full", "Show every pins row without truncation").option("--format <format>", "Output format: json or toon (default: toon)").option("--runner <runner>", "Runner word to emit on rewritten refs: npx or upx (default: preserve each ref's runner)").addOption(ROOT_OPTION).addHelpText("after", "\nExample:\n  $ universal-plugin plugin bundle --dry-run --full\n").action((opts) => {
-		process.stderr.write("warn: plugin bundle is deprecated and will be removed in the next minor release — use plugin version, which stamps the skill pins\n");
+		process.stderr.write("warn: plugin bundle is deprecated since 0.14.0 and will be removed in a later release — use plugin version, which stamps the skill pins\n");
 		try {
 			const runner = opts.runner;
 			if (runner !== void 0 && runner !== "npx" && runner !== "upx") throw new Error(`error: unknown --runner value "${runner}" (expected npx or upx)`);
@@ -18303,7 +18303,7 @@ function stringField(value, key) {
 function publishCommand() {
 	const cmd = new Command("publish").description("Prepare plugin for publishing").helpCommand(false);
 	cmd.command("sync-version").description("Deprecated: use `plugin version --from-package`").option("--no-build", "Skip re-deriving the vendor manifests").option("--format <format>", "Output format: json or toon (default: toon)").addOption(ROOT_OPTION).action((opts) => {
-		process.stderr.write("warn: publish sync-version is deprecated and will be removed in the next minor release — use plugin version --from-package\n");
+		process.stderr.write("warn: publish sync-version is deprecated since 0.14.0 and will be removed in a later release — use plugin version --from-package\n");
 		runVersion(void 0, {
 			...opts,
 			fromPackage: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.17.0",
+	"version": "0.17.1",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/readme.md

@@ -74,7 +74,7 @@ npx universal-plugin publish check-version            # fail when any place carr
 ```
 
 `publish sync-version` and `plugin bundle` are deprecated aliases of `plugin version --from-package`
-and `plugin version`. They print a warning and are removed in the next minor release.
+and `plugin version`. They print a warning and will be removed in a later release.
 
 ### marketplace
 

package/references/plugin-design.md

@@ -1,12 +1,12 @@
 # Plugin Design
 
-Authoritative rules for creating, validating, and transforming cross-vendor agent plugins. Apply when creating, auditing, or distributing a plugin; see **skill-design** governance for standalone skill authoring rules.
+Authoritative rules for creating, validating, and transforming cross-vendor agent plugins. Apply when creating, auditing, or distributing a plugin; see the **skill-design** reference for standalone skill authoring rules.
 
 A **plugin** is the distribution unit — it bundles skills, MCP servers, hooks, commands, agents, and other extensions into a single installable package. A **skill** is the capability unit inside a plugin. Install plugins; invoke skills.
 
 ## Source of Truth: root `plugin.json`
 
-Author `plugin.json` at the plugin root as the canonical manifest — the Agent Plugins Specification v1.0.0 shape (closed field set, `additionalProperties: false`). All vendor manifests are derived from it via `build`. This file is never read directly by vendors at runtime; it is the single source that the build layer transforms into each vendor's manifest.
+Author `plugin.json` at the plugin root as the canonical manifest — the Agent Plugins Specification v1.0.0 shape (closed field set, `additionalProperties: false`). All vendor manifests are derived from it via `build`. GitHub Copilot CLI reads this file directly at runtime; every other vendor reads the manifest the build layer derives from it.
 
 Schema declaration (first field, fixed by the spec):
 
@@ -98,8 +98,7 @@ Vendor-specific extension fields:
 │
 ├── hooks/hooks.json              ← canonical hooks (PascalCase, ${PLUGIN_ROOT})
 │
-├── .mcp.json                     ← source of truth (all vendors)
-├── mcp.json -> .mcp.json         ← symlink (Cursor + open-plugin-spec)
+├── mcp.json                      ← MCP config (fixed location, all vendors)
 │
 └── README.md
 ```
@@ -141,11 +140,11 @@ Build reads root `plugin.json`, applies the rules below, writes each vendor's ou
 | Canonical field | Claude Code | Cursor | Codex | Copilot CLI |
 | --- | --- | --- | --- | --- |
 | `skills` | ✓ | ✓ | ✓ | ✓ |
-| `mcpServers` | ✓ → `./.mcp.json` | adapt → `./mcp.json` (symlink) | ✓ → `./.mcp.json` | ✓ |
+| `mcpServers` | ✓ → `./mcp.json` | ✓ → `./mcp.json` | ✓ → `./mcp.json` | ✓ |
 | `commands` | ✓ | ✓ | **omit** | ✓ |
 | `agents` | ✓ | ✓ | **omit** | ✓ |
 | `rules` | **omit** | ✓ | **omit** | **omit** |
-| `hooks` | adapt → PascalCase, `${CLAUDE_PLUGIN_ROOT}` | adapt → camelCase, pass-through env | ✓ → PascalCase, `${PLUGIN_ROOT}` native | adapt → camelCase, pass-through env |
+| `hooks` | adapt → PascalCase, `${CLAUDE_PLUGIN_ROOT}` | adapt → camelCase, pass-through env | ✓ → PascalCase, `${PLUGIN_ROOT}` native | ✓ → PascalCase (selects the Claude-compatible payload) |
 | `lspServers` | ✓ | **omit** | **omit** | **omit** |
 | `outputStyles` | ✓ | **omit** | **omit** | **omit** |
 | `dependencies` | ✓ | **drop + warn** | **drop + warn** | **drop + warn** |
@@ -193,15 +192,15 @@ Canonical hooks file uses **PascalCase** event names. Build translates per vendo
 
 | Canonical (PascalCase) | Claude Code | Cursor | Codex | Copilot CLI |
 | --- | --- | --- | --- | --- |
-| `PreToolUse` | `PreToolUse` | `preToolUse` | `PreToolUse` | `preToolUse` |
-| `PostToolUse` | `PostToolUse` | `postToolUse` | `PostToolUse` | `postToolUse` |
+| `PreToolUse` | `PreToolUse` | `preToolUse` | `PreToolUse` | `PreToolUse` |
+| `PostToolUse` | `PostToolUse` | `postToolUse` | `PostToolUse` | `PostToolUse` |
 | `PostToolUseFailure` | `PostToolUseFailure` | — (drop+warn) | — (drop+warn) | — (drop+warn) |
-| `SessionStart` | `SessionStart` | `sessionStart` | `SessionStart` | `sessionStart` |
-| `SessionEnd` | `SessionEnd` | `sessionEnd` | `SessionEnd` | `sessionEnd` |
-| `Stop` | `Stop` | — (drop+warn) | — (drop+warn) | `agentStop` |
+| `SessionStart` | `SessionStart` | `sessionStart` | `SessionStart` | `SessionStart` |
+| `SessionEnd` | `SessionEnd` | `sessionEnd` | `SessionEnd` | `SessionEnd` |
+| `Stop` | `Stop` | — (drop+warn) | — (drop+warn) | `Stop` |
 | `UserPromptSubmit` | `UserPromptSubmit` | `beforeSubmitPrompt` | — (drop+warn) | — (drop+warn) |
-| `Notification` | `Notification` | — (drop+warn) | — (drop+warn) | `notification` |
-| `PermissionRequest` | `PermissionRequest` | — (drop+warn) | — (drop+warn) | `permissionRequest` |
+| `Notification` | `Notification` | — (drop+warn) | — (drop+warn) | `Notification` |
+| `PermissionRequest` | `PermissionRequest` | — (drop+warn) | — (drop+warn) | `PermissionRequest` |
 | `SubagentStart` | — | `subagentStart` | — | — |
 | `SubagentStop` | — | `subagentStop` | — | — |
 | `PreCompact` | `PreCompact` | `preCompact` | — | — |
@@ -230,20 +229,9 @@ Events not in this table: pass through for `claude-code`; drop + warn for all ot
 
 Build generates vendor-specific versions. Do not hand-author the generated hook files.
 
-## MCP: Symlink Rule
+## MCP: `mcp.json`
 
-`.mcp.json` is the source of truth. `mcp.json` is always a symlink — never a regular file.
-
-```bash
-ln -sf .mcp.json mcp.json
-```
-
-| Runtime | Reads |
-| --- | --- |
-| Claude Code, Codex | `.mcp.json` |
-| Cursor, open-plugin-spec | `mcp.json` (via symlink) |
-
-If the repo needs explicit symlink tracking: `mcp.json symlink` in `.gitattributes`. MCP server startup failures are non-fatal.
+`mcp.json` at the plugin root is the Agent Plugins Specification's fixed MCP location, Author it as a regular file. `build` points each derived manifest at it, unless it has to change an entry for that vendor; then it writes the changed copy beside the vendor manifest. MCP server startup failures are non-fatal.
 
 ### Pinning a self-published server to the plugin version
 
@@ -271,9 +259,9 @@ A plugin whose MCP server is its own npm package writes an unpinned invocation
 
 ## Component Authoring Rules
 
-**Skills:** Author `skills/<name>/SKILL.md` following the **skill-design** governance. Within a plugin, reference MCP tools by fully qualified name: `{plugin-name}:{server-name}__{tool-name}`. Use the **slash-invocation** governance when a skill needs a user-only, model-only, or explicit both-invocation policy.
+**Skills:** Author `skills/<name>/SKILL.md` following the **skill-design** reference. Within a plugin, reference MCP tools by fully qualified name: `{plugin-name}:{server-name}__{tool-name}`. Use the **slash-invocation** reference when a skill needs a user-only, model-only, or explicit both-invocation policy.
 
-**Commands:** One `.md` file per command in `commands/`. Filename (minus extension) is the command identifier. Optional frontmatter: `description`, `argument-hint`, `allowed-tools`, `disable-model-invocation`. `$ARGUMENTS` expands to user input.
+**Commands:** One `.md` file per command in `commands/`. Filename (minus extension) is the command identifier. Optional frontmatter: `description`, `argument-hint`, `allowed-tools`, `disable-model-invocation`. `$ARGUMENTS` expands to user input on Claude Code and stays literal on other runtimes.
 
 **Agents:** One `.md` file per agent in `agents/`. Required frontmatter: `name` (1–64 lowercase alphanumeric + hyphens), `description` (≤ 1024 chars). Body is the agent system prompt.
 
@@ -306,9 +294,9 @@ A plugin whose MCP server is its own npm package writes an unpinned invocation
 
 | Scope | Claude Code | Cursor | Codex |
 | --- | --- | --- | --- |
-| **Personal** | `~/.claude/plugins/local/<name>` symlink | `~/.cursor/plugins/local/<name>` symlink + reload | `~/.agents/plugins/marketplace.json` |
+| **Personal** | `universal-plugin plugin install`, then restart | `universal-plugin plugin install` (copies), then reload the window | `~/.agents/plugins/marketplace.json` |
 | **Team** | npm private package | Cursor Teams admin import | `.agents/plugins/marketplace.json` in repo |
-| **Public** | PR to `anthropics/claude-plugins-official` | `cursor.com/marketplace/publish` | `codex plugin marketplace add` |
+| **Public** | `anthropics/claude-plugins-official` is curated and takes no pull requests; check its submission route live (`publish-plugin`, step 0c) | `cursor.com/marketplace/publish` | `codex plugin marketplace add` |
 
 Default scope: **team**.
 
@@ -318,13 +306,11 @@ Default scope: **team**.
 
 - Using `../` in any manifest-declared path
 - Hardcoding absolute paths instead of `${PLUGIN_ROOT}` or `${PLUGIN_DATA}`
-- Committing `mcp.json` as a regular file — must always be a symlink to `.mcp.json`
 - Hand-authoring vendor hook files — use canonical `hooks/hooks.json` and let build generate vendor versions
 - Relying on extended component types (commands, rules, agents, hooks) for core functionality — silently ignored on non-supporting hosts
 - Duplicating SKILL.md content in `plugin.json` — the manifest is a path index, never a content mirror
 - Using `rules/` for cross-agent always-on guidance — use AGENTS.md instead
 - Putting role- or task-scoped guidance in always-on context (`rules/` or AGENTS.md) — make it a reference loaded on demand
-- Putting install-time metadata in `plugin.json` instead of `skill.json`
 
 ## Cross-Platform Portability
 
@@ -338,7 +324,7 @@ Default scope: **team**.
 | Windsurf | Needs conversion | 6,000 char/file hard limit; 12,000 chars total |
 | Zed, Aider, Continue.dev, Cline | No | Incompatible formats |
 
-Portability rules for skill bodies: keep each `SKILL.md` body under 6,000 chars; use forward slashes in path references; declare environment requirements in `compatibility` frontmatter; do not embed vendor-specific syntax in skill bodies.
+Portability rules for skill bodies: for a skill that must load in Windsurf, keep the `SKILL.md` body under its 6,000-char limit and move detail into `references/`; use forward slashes in path references; declare environment requirements in `compatibility` frontmatter; do not embed vendor-specific syntax in skill bodies.
 
 ## References
 

package/references/slash-invocation.md

@@ -10,7 +10,7 @@ description: Deploy the application after running release checks.
 invocation-policy: user
 ---
 
-Deploy $ARGUMENTS.
+Deploy the environment the user names in the invocation.
 ```
 
 | Policy | Meaning | Default |
@@ -22,7 +22,7 @@ Deploy $ARGUMENTS.
 `plugin build` derives vendor behavior from that policy:
 
 - Claude Code uses the same `SKILL.md` and adds its native invocation flag.
-- Cursor receives a thin `.cursor/commands/<skill>.md` prompt insert for `user` and `both` skills.
+- Cursor uses the same `SKILL.md` and its native invocation flag; no per-skill command is derived.
 - Codex uses the skill itself. A user invokes it with `$skill` or `/skills`, so no command is derived. Codex custom prompts are deprecated and home-only, and `plugin build` never writes outside the plugin tree.
 - Copilot CLI receives no derived command. Its `/skill-name` form is only a prompt hint, not deterministic invocation.
 

package/skills/adopt-upx/scripts/rewrite-upx.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/rewrite-upx.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/adopt-upx/scripts/rewrite-upx.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/adopt-upx/scripts/rewrite-upx.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/skill-scripts/rewrite-upx.ts

package/skills/build-plugin/SKILL.md

@@ -47,7 +47,7 @@ node scripts/build.mjs --root <plugin-root>
 
 Resolve `scripts/build.mjs` against this skill's own directory. It runs the CLI the project installed
 (`pnpm exec universal-plugin`), else the CLI pinned to the version this skill shipped with
-(`npx universal-plugin@0.17.0`), so it works in a skill that was linked or copied on its own. `--root` defaults to the working directory and
+(`npx universal-plugin@0.17.1`), so it works in a skill that was linked or copied on its own. `--root` defaults to the working directory and
 must name the directory that holds the canonical `plugin.json`.
 
 The command never prompts, so it is safe to run unattended.
@@ -132,8 +132,7 @@ Validation runs before the first write, so a failed build leaves the tree untouc
 - **Expect a build to pin skill `npx` references or decide a version.** Build derives and copies
   whatever `plugin.json` carries. Stamping is the release-time `plugin version`, not this step.
 - **Expect a build to copy governances into skills.** A skill loads a reference through the
-  `reference` skill in the `cyber-agentkit` plugin; the build does not copy them and has no
-  `--check` flag.
+  `reference` skill in the `cyber-agentkit` plugin; the build does not copy them.
 
 ## Related skills
 

package/skills/build-plugin/scripts/build.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/build-plugin/scripts/build.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/build-plugin/scripts/build.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/doctor-universal-plugin/README.md

@@ -35,7 +35,7 @@ on purpose, so it folds into that command rather than competing with it.
 ## Boundaries
 
 Diagnoses the plugin a project ships. A repository's own agent wiring — `.agents/skills/`,
-`AGENTS.md`, per-harness bridges — is `buddy-agent-harness:doctor`.
+`AGENTS.md`, per-harness bridges — is `buddy-agent-harness:doctor-buddy-agent-harness`.
 
 ## References
 

package/skills/doctor-universal-plugin/SKILL.md

@@ -143,7 +143,7 @@ user can run, or ask before running it yourself.
 
 ## Version drift
 
-A version lives in five places. Two are authored: the canonical `plugin.json`, and the `package.json`
+A version lives in six places. Two are authored: the canonical `plugin.json`, and the `package.json`
 at the `packagePath` the CLI reports (`config get --key packagePath`), resolved from the plugin root.
 The rest are stamped from them by `plugin version`: the vendor manifests, this plugin's entry in each
 repository catalog, the `npx`/`upx <package>@<version>` pins in the skills, and each `mcpServers`
@@ -172,7 +172,7 @@ it does not, offer to add it — ask first, because both are the user's files:
   semantic-release bot opens.
 
 Use the locked `universal-plugin` from the repository's devDependencies when it has one; otherwise
-`npx universal-plugin@0.17.0`, pinned. This check matters most where the release tool picks the
+`npx universal-plugin@0.17.1`, pinned. This check matters most where the release tool picks the
 number, because nothing else runs between that bump and publish.
 
 ## Unreleased content
@@ -203,7 +203,7 @@ is meant to ship — content that is still being worked on is not a finding to a
   directly. Its **components** are a separate question — a `copilot-root-components` finding is a real
   fault, and `canonical` is only healthy for a plugin that declares none of the moved kinds.
 - Do not treat repo-private agent configuration (`.claude/skills/`, `.agents/skills/`) as part of the
-  plugin. Diagnosing a repository's own skill wiring is `buddy-agent-harness:doctor`.
+  plugin. Diagnosing a repository's own skill wiring is `buddy-agent-harness:doctor-buddy-agent-harness`.
 
 ## Related skills
 

package/skills/doctor-universal-plugin/scripts/doctor.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/doctor.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/doctor-universal-plugin/scripts/doctor.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/doctor-universal-plugin/scripts/doctor.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";

package/skills/init-universal-plugin/README.md

@@ -47,7 +47,7 @@ hold everywhere belongs in the Markdown body. See `references/frontmatter.md`, w
 ## Boundaries
 
 Plugin authoring only. Setting a repository up to *consume* skills — `AGENTS.md`, the
-`.agents/skills/` layout, per-harness bridges — is `buddy-agent-harness:init`. This skill does not
+`.agents/skills/` layout, per-harness bridges — is `buddy-agent-harness:init-buddy-agent-harness`. This skill does not
 touch CI, repository settings, or unrelated project files.
 
 ## References

package/skills/init-universal-plugin/SKILL.md

@@ -34,7 +34,7 @@ runtime you are enabling, and only those.
 
 This skill owns the **authoring** side: the plugin a project ships. Setting a repository up to
 *consume* skills — the `.agents/skills/` layout, `AGENTS.md`, per-harness bridges — is
-`buddy-agent-harness:init`, not this.
+`buddy-agent-harness:init-buddy-agent-harness`, not this.
 
 ## Prerequisites
 
@@ -240,7 +240,7 @@ This skill is not a formatter. If the project has one, run it over the written f
 | Publish a packaged plugin to the marketplace | `publish-plugin` |
 | Bump the pinned `universal-plugin@<version>` the project *calls* (not the plugin's own version) | `upgrade-plugin` |
 | Rewrite `npx` pins to the `upx` runner | `adopt-upx` |
-| Set a repository up to *consume* skills (`AGENTS.md`, `.agents/skills/`) | `buddy-agent-harness:init` |
+| Set a repository up to *consume* skills (`AGENTS.md`, `.agents/skills/`) | `buddy-agent-harness:init-buddy-agent-harness` |
 
 ## References
 

package/skills/init-universal-plugin/references/create.md

@@ -34,7 +34,7 @@ entry in both `vendors` and `harnesses` under
 
 Infer from context; ask only if ambiguous. [`standard.md`](./standard.md) has the component table and
 the layout they go in; the `plugin-design` reference decides which component a given need calls
-for. The universal minimum is `skills/<name>/SKILL.md` plus `.mcp.json`.
+for. The universal minimum is `skills/<name>/SKILL.md` plus `mcp.json`.
 
 ## Step 4 — Scaffold
 
@@ -43,7 +43,7 @@ node scripts/init.mjs --name <plugin-name> --vendor claude-code --vendor cursor
 ```
 
 Resolve `scripts/init.mjs` against this skill's directory; it runs the project's installed CLI, else
-the pinned `npx universal-plugin@0.17.0`. Add `--npm` when an npm package ships the plugin,
+the pinned `npx universal-plugin@0.17.1`. Add `--npm` when an npm package ships the plugin,
 which also wires that `package.json`'s `files` to carry the derived manifests, copies its `version`
 into the manifest, and, in a changesets repository, wires the root `version` script to run
 `plugin version --from-package` (SKILL.md Phase 3 asks before that rewrite).
@@ -83,10 +83,10 @@ delivery path at all.
 Run the mechanical validator from the aced **improve-skill** skill:
 
 ```bash
-node "<path to aced improve-skill>/scripts/validate.mts" --path skills/<skill-name>
+node "<path to aced improve-skill>/scripts/validate.mjs" --path skills/<skill-name>
 ```
 
-Fix every CRITICAL finding, then invoke the **audit-skill** skill for the full review.
+Fix every CRITICAL finding, then invoke the `aced:improve-skill` skill for the full review.
 [`frontmatter.md`](./frontmatter.md) covers what has to hold across runtimes.
 
 ## Step 7 — Build
@@ -98,8 +98,8 @@ npx universal-plugin plugin build
 Useful flags: `--dry-run` to see the plan, `--verbose` for field-by-field decisions, `--vendor <id>`
 for one target, `--clean` to delete derived manifests first.
 
-Read the warnings. An unknown vendor id, an undeliverable Copilot override, and a failed Codex prompt
-write all surface there rather than as errors.
+Read the warnings. An unknown vendor id and an undeliverable Copilot override both surface there
+rather than as errors.
 
 ## Step 8 — Install locally to test
 
@@ -113,7 +113,7 @@ restart for Claude Code, **Developer: Reload Window** for Cursor. `--list` shows
 without writing; `--vendor <id>` narrows it; `plugin uninstall` removes it again.
 
 Codex and Copilot CLI scan no local plugin directory, so they report as `unsupported`. Reach those
-through a repository-local marketplace — `publish-plugin`.
+through a repository-local marketplace — `marketplace`.
 
 Do not hand-write a symlink for this. The recipe that circulated for it named
 `~/.claude/plugins/local/`, which does not exist, and a symlink into Cursor's local directory is

package/skills/init-universal-plugin/references/detection.md

@@ -40,7 +40,7 @@ Only a skill the project *distributes* belongs to a plugin.
 | `.claude/skills/`, `.agents/skills/`, `.cursor/rules/` | **No** — repo-private tooling |
 
 If the only skills are in private locations, say nothing about adoption. A repository that configures
-its own agents is not a plugin waiting to happen; `buddy-agent-harness:init` is the skill for that
+its own agents is not a plugin waiting to happen; `buddy-agent-harness:init-buddy-agent-harness` is the skill for that
 side of the line.
 
 ## Making the adoption offer

package/skills/init-universal-plugin/references/frontmatter.md

@@ -30,7 +30,7 @@ universal-plugin reads `invocation-policy` from each `SKILL.md` and projects it
 | --- | --- | --- |
 | `both` (default) | user- and model-invocable | nothing |
 | `user` | explicit invocation only | writes `disable-model-invocation: true` into the skill's frontmatter |
-| `model` | model-invocable only, not user-facing | writes `user-invocable: false`, and emits no Codex prompt |
+| `model` | model-invocable only, not user-facing | writes `user-invocable: false` |
 
 Two consequences worth knowing before you run a build:
 

package/skills/init-universal-plugin/references/standard.md

@@ -58,7 +58,7 @@ what each build gets. A vendor listed in `vendors` with no `harnesses` entry sti
 ├── agents/<name>.md
 ├── rules/<name>.mdc         (Cursor-only guidance)
 ├── hooks/hooks.json
-├── .mcp.json
+├── mcp.json
 └── README.md
 ```
 
@@ -70,7 +70,7 @@ directories. Create the rest only when the plugin has content for them.
 | Component | Field | Directory | Reaches |
 |-----------|-------|-----------|---------|
 | Skills | `skills` | `skills/<name>/SKILL.md` | every vendor |
-| MCP servers | `mcpServers` | `.mcp.json` | every vendor |
+| MCP servers | `mcpServers` | `mcp.json` | every vendor |
 | Commands | `commands` | `commands/<name>.md` | Claude Code, Cursor, Copilot CLI |
 | Agents | `agents` | `agents/<name>.md` | Claude Code, Cursor, Copilot CLI |
 | Hooks | `hooks` | `hooks/hooks.json` | every vendor — authored PascalCase, translated per vendor by the build; handler types vary |
@@ -79,7 +79,7 @@ directories. Create the rest only when the plugin has content for them.
 | Output styles | `outputStyles` | `output-styles/` | Claude Code only |
 
 The universal minimum — reaching every runtime with no vendor manifest at all — is
-`skills/<name>/SKILL.md` plus `.mcp.json`. Reach for a narrower component only when the plugin needs
+`skills/<name>/SKILL.md` plus `mcp.json`. Reach for a narrower component only when the plugin needs
 what only that component does; the `plugin-design` reference is the authority on that choice.
 
 ## Constraints

package/skills/init-universal-plugin/references/vendors/copilot-cli.md

@@ -83,6 +83,9 @@ Do not build a delivery path for these into the plugin manifest. There is nothin
 
 ### Still open
 
+Open as of the 1.0.83 runtime examined above. Re-check against the current release before relying
+on any of these.
+
 - **Where the `unknown field (ignored)` warning surfaces.** It exists in the binary but reached no
   output on `plugin install`, `plugin list`, or `plugins list`. Likely the interactive dashboard or
   the session config-problems channel.

package/skills/init-universal-plugin/scripts/init.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/init-universal-plugin/scripts/init.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/init-universal-plugin/scripts/init.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/add.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/marketplace/scripts/add.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/marketplace/scripts/add.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/install-docs.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/install-docs.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/marketplace/scripts/install-docs.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/marketplace/scripts/install-docs.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";

package/skills/marketplace/scripts/marketplace.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/marketplace/scripts/marketplace.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/marketplace/scripts/marketplace.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/update.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/marketplace/scripts/update.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/marketplace/scripts/update.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/marketplace/scripts/validate.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/marketplace/scripts/validate.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/marketplace/scripts/validate.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the

package/skills/migrate-plugin/SKILL.md

@@ -87,7 +87,7 @@ configuration is:
 }
 ```
 
-Retain existing package entries such as `bin`, `dist`, and `governances`.
+Retain existing package entries such as `bin`, `dist`, and `references`.
 Never replace the allowlist wholesale.
 
 ## 4. Bundle the CLI with tsdown
@@ -173,7 +173,6 @@ as a follow-up instead of doing it inside this migration.
 
 Point every version and build step at the new plugin root:
 
-- Set the manifest extension's `packagePath` to `"."`.
 - `universal-plugin plugin version --from-package --root <pkg>` reads `packagePath` from
   `<pkg>/.agents/universal-plugin.json`, not from the manifest extension. With
   no `packagePath` it reads `<pkg>/package.json`, so a package that holds its

package/skills/publish-plugin/SKILL.md

@@ -34,7 +34,8 @@ is the common case.
 
 ### 0a. Identify the marketplace repo
 
-Default to `cyberuni/cyberplace` unless the user names another one.
+Default to `cyberuni/cyberplace` unless the user names another one. The commands below call it
+`<marketplace-repo>` (`<owner>/<repo>`), and its repository name `<marketplace-repo-name>`.
 
 ### 0b. Identify which repo the cwd is
 
@@ -317,15 +318,15 @@ Otherwise, the marketplace repo is elsewhere and needs a working copy. If the us
 (org member), work directly:
 
 ```bash
-gh repo clone cyberuni/cyberplace
-cd cyberplace
+gh repo clone <marketplace-repo>
+cd <marketplace-repo-name>
 ```
 
 If a fork is needed:
 
 ```bash
-gh repo fork cyberuni/cyberplace --clone --remote
-cd cyberplace
+gh repo fork <marketplace-repo> --clone --remote
+cd <marketplace-repo-name>
 git fetch upstream && git merge upstream/main
 ```
 
@@ -354,7 +355,7 @@ git push origin add-<plugin-name>
 
 ```bash
 gh pr create \
-  --repo cyberuni/cyberplace \
+  --repo <marketplace-repo> \
   --title "Add <plugin-name> v<version>" \
   --body "$(cat <<'EOF'
 ## Plugin

package/skills/version/README.md

@@ -27,8 +27,8 @@ semantic-release stamps files that exist only in the npm package unless `@semant
 commits them back. Git-sourced installs read `plugin.json` from the repository, so they need that
 commit-back.
 
-`plugin bundle` and `publish sync-version` are deprecated aliases and are removed in the next minor
-release.
+`plugin bundle` and `publish sync-version` are deprecated aliases. They have warned since 0.14.0 and will be
+removed in a later release.
 
 ## The part that is not automatable
 

package/skills/version/SKILL.md

@@ -74,7 +74,7 @@ node scripts/version.mjs --from-package
 ```
 
 Resolve that path against this skill's own directory; it runs the project's installed CLI
-(`pnpm exec universal-plugin`), else `npx universal-plugin@0.17.0` pinned to this skill's version.
+(`pnpm exec universal-plugin`), else `npx universal-plugin@0.17.1` pinned to this skill's version.
 `universal-plugin plugin version` on the `PATH` is the fallback. The command never prompts, so it is safe to run unattended once the
 source is decided.
 
@@ -138,8 +138,8 @@ Every guard resolves before the first write, so a failed run leaves the tree unt
   `plugin build`; the bump already re-derived them.
 - **Run `npm version`.** It knows only `package.json` and leaves the canonical manifest and the
   skill pins stale.
-- **Use the deprecated commands.** `plugin bundle` and `publish sync-version` print a warning and are
-  removed in the next minor release. `sync-version` now runs `plugin version --from-package`.
+- **Use the deprecated commands.** `plugin bundle` and `publish sync-version` print a deprecation
+  warning; use `plugin version` instead. `sync-version` now runs `plugin version --from-package`.
 
 ## Related skills
 
@@ -148,7 +148,7 @@ Every guard resolves before the first write, so a failed run leaves the tree unt
 | Create, adopt, or change what the plugin declares | `init-universal-plugin` |
 | Re-derive the vendor manifests by hand | `build-plugin` |
 | Check whether every place agrees (`unstamped`, `version-drift`) | `doctor-universal-plugin` |
-| Add a changeset for the change being released | `add-changeset` |
+| Add a changeset for the change being released | `buddy-changesets:changesets` |
 | Refresh the repository's own marketplace catalogs after a bump | `marketplace` |
 | List the released plugin in the shared marketplace | `publish-plugin` |
 

package/skills/version/scripts/version.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Compiled by `universal-plugin plugin build` from src/skill-scripts/run-cli.ts. Edit the source, not this file.
-globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.0","entry":"skills/version/scripts/version.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
+globalThis.__SKILL_SCRIPT__ = {"package":"universal-plugin","bin":"universal-plugin","version":"0.17.1","entry":"skills/version/scripts/version.mjs","commands":{"marketplace add":"skills/marketplace/scripts/add.mjs","marketplace init":"skills/marketplace/scripts/marketplace.mjs","marketplace update":"skills/marketplace/scripts/update.mjs","marketplace validate":"skills/marketplace/scripts/validate.mjs","plugin build":"skills/build-plugin/scripts/build.mjs","plugin init":"skills/init-universal-plugin/scripts/init.mjs","plugin version":"skills/version/scripts/version.mjs"}};
 import { spawnSync } from "node:child_process";
 //#region src/compile/scripts.ts
 /** The global the header assigns the script data to. Framework-neutral: a script's own code, or the