universal-plugin 0.5.0 → 0.7.0

package/governances/plugin-design.md

@@ -245,6 +245,20 @@ ln -sf .mcp.json mcp.json
 
 If the repo needs explicit symlink tracking: `mcp.json symlink` in `.gitattributes`. MCP server startup failures are non-fatal.
 
+### Pinning a self-published server to the plugin version
+
+A plugin whose MCP server is its own npm package writes an unpinned invocation — `{"command": "npx", "args": ["-y", "my-server", "mcp"]}` — and a consumer on plugin 1.4.0 then gets 1.4.0's skills alongside whatever `npx` resolves as latest for the server. Mark the entry and `build` stamps the version on:
+
+```json
+{ "command": "npx", "args": ["-y", "my-server", "mcp"], "pinToPluginVersion": true }
+```
+
+- **The marker is required.** `build` never name-matches — a plugin may publish its server under a package name that is not the plugin's, and an unrelated `npx -y widget-cli` must never be stamped with this plugin's version.
+- **The marker never reaches a runtime.** It is a build directive, not part of any vendor's schema, so `build` strips it from every derived manifest and derived `mcp.json`. The authored files are left as written.
+- An already-pinned specifier is **overwritten** with the manifest version, and the build warns naming the version it replaced. Do not hand-pin a marked entry.
+- A marked entry the build cannot pin — the `command` is not `npx`/`upx`, the manifest declares no `version`, or `args` carry no package specifier — is warned about and left alone; the build stays green.
+- `copilot-cli` reads the canonical manifest directly, so it has no derived manifest to receive the pin; the build warns rather than pretending otherwise.
+
 ## Environment Variable Mapping
 
 | Canonical | Claude Code | Cursor | Codex | Copilot CLI |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",
@@ -30,9 +30,11 @@
     "dist",
     "governances",
     "plugin.json",
+    "schema",
     ".claude-plugin",
     ".cursor-plugin",
     ".codex-plugin",
+    "com.github.copilot",
     "skills",
     "agents"
   ],
@@ -44,6 +46,7 @@
   "devDependencies": {
     "@types/node": "^24.10.1",
     "@types/semver": "^7.7.1",
+    "ajv": "^8.20.0",
     "knip": "^6.14.1",
     "tsdown": "^0.22.0",
     "tsx": "^4.22.3",

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.5.0",
+	"version": "0.7.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/readme.md

@@ -79,8 +79,12 @@ keep their previous version.
 
 ```sh
 npx universal-plugin marketplace init --codex --root .
+npx universal-plugin marketplace validate --root .
 ```
 
+`validate` checks each catalog against the schema its runtime loads and names the key at fault, so a
+catalog that would be refused at install time is caught in the repository.
+
 Codex caches a local plugin install by its marketplace entry version. After you change packaged
 plugin files: update the canonical `plugin.json` version, regenerate the catalog (add `--force` to
 replace an existing one), reinstall the plugin, then start a new Codex session. The installed copy

package/schema/README.md

@@ -0,0 +1,10 @@
+# Vendored schemas
+
+`claude-code-marketplace.json` is the official Claude Code marketplace schema, fetched verbatim from
+<https://json.schemastore.org/claude-code-marketplace.json> (the copy generated 2026-04-23) on
+2026-08-19.
+
+It ships nowhere: `package.json` `files` does not list this directory. It exists so
+`src/marketplace/validation.schema.test.ts` can hold this project's catalog rules against the
+runtime's own schema without reaching the network in a test, and so a re-fetch is a reviewable diff.
+Re-fetch it when Claude Code's catalog shape moves, then run the tests.