universal-plugin 0.6.0 → 0.8.0

package/governances/plugin-design.md

@@ -245,6 +245,20 @@ ln -sf .mcp.json mcp.json
 
 If the repo needs explicit symlink tracking: `mcp.json symlink` in `.gitattributes`. MCP server startup failures are non-fatal.
 
+### Pinning a self-published server to the plugin version
+
+A plugin whose MCP server is its own npm package writes an unpinned invocation — `{"command": "npx", "args": ["-y", "my-server", "mcp"]}` — and a consumer on plugin 1.4.0 then gets 1.4.0's skills alongside whatever `npx` resolves as latest for the server. Mark the entry and `build` stamps the version on:
+
+```json
+{ "command": "npx", "args": ["-y", "my-server", "mcp"], "pinToPluginVersion": true }
+```
+
+- **The marker is required.** `build` never name-matches — a plugin may publish its server under a package name that is not the plugin's, and an unrelated `npx -y widget-cli` must never be stamped with this plugin's version.
+- **The marker never reaches a runtime.** It is a build directive, not part of any vendor's schema, so `build` strips it from every derived manifest and derived `mcp.json`. The authored files are left as written.
+- An already-pinned specifier is **overwritten** with the manifest version, and the build warns naming the version it replaced. Do not hand-pin a marked entry.
+- A marked entry the build cannot pin — the `command` is not `npx`/`upx`, the manifest declares no `version`, or `args` carry no package specifier — is warned about and left alone; the build stays green.
+- `copilot-cli` reads the canonical manifest directly, so it has no derived manifest to receive the pin; the build warns rather than pretending otherwise.
+
 ## Environment Variable Mapping
 
 | Canonical | Claude Code | Cursor | Codex | Copilot CLI |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-plugin",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Universal AI agent plugin build tool",
   "keywords": [
     "agent-plugin",
@@ -30,13 +30,16 @@
     "dist",
     "governances",
     "plugin.json",
+    "schema",
     ".claude-plugin",
     ".cursor-plugin",
     ".codex-plugin",
+    "com.github.copilot",
     "skills",
     "agents"
   ],
   "dependencies": {
+    "@repobuddy/upx": "^0.1.0",
     "@toon-format/toon": "^4.1.1",
     "commander": "^14.0.3",
     "semver": "^7.8.1"

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "universal-plugin",
-	"version": "0.6.0",
+	"version": "0.8.0",
 	"description": "Research and design toolkit for building universal AI coding agent plugins that work across Claude Code, Cursor, Codex, and GitHub Copilot CLI.",
 	"author": {
 		"name": "unional"

package/readme.md

@@ -120,21 +120,28 @@ npx universal-plugin self-update <version>            # update the version pin i
 
 ## upx, the fast package runner
 
-`npm i -g universal-plugin` puts a second bin, `upx`, on PATH.
+`upx` now ships as its own package, [`@repobuddy/upx`](https://www.npmjs.com/package/@repobuddy/upx).
 
 `upx <pkg>@^<major>` looks for an already-installed version satisfying the range, checking local
 `node_modules` first and then global. It spawns that binary directly, skipping the resolve step that
-costs `npx` roughly 1s per call. When nothing installed matches, it falls back to `npx`.
+costs `npx` a registry round-trip on every call. When nothing installed matches, it falls back to
+`npx`. See [its measurements](https://repobuddy.github.io/upx/concepts/measurements/) for what that
+is worth on current npm.
 
 ```sh
-npm i -g universal-plugin
+npm i -g @repobuddy/upx
 upx cyber-skills@^2 audit validate
 ```
 
 Use a caret range on the major rather than an exact pin, so one global install serves every caller.
+`plugin bundle --runner upx` emits references in this form.
 
-`upx` only works once `universal-plugin` is installed globally. `npx` ships with npm, so keep `npx`
-as the default anywhere you cannot guarantee that install.
+`upx` only works once it is installed globally. `npx` ships with npm, so keep `npx` as the default
+anywhere you cannot guarantee that install.
+
+> **Deprecated:** `universal-plugin` still installs a `upx` bin that re-exports `@repobuddy/upx`, so
+> existing global installs keep working. It will be removed in the next major — install
+> `@repobuddy/upx` directly.
 
 ## Related
 

package/schema/README.md

@@ -0,0 +1,10 @@
+# Vendored schemas
+
+`claude-code-marketplace.json` is the official Claude Code marketplace schema, fetched verbatim from
+<https://json.schemastore.org/claude-code-marketplace.json> (the copy generated 2026-04-23) on
+2026-08-19.
+
+It ships nowhere: `package.json` `files` does not list this directory. It exists so
+`src/marketplace/validation.schema.test.ts` can hold this project's catalog rules against the
+runtime's own schema without reaching the network in a test, and so a re-fetch is a reviewable diff.
+Re-fetch it when Claude Code's catalog shape moves, then run the tests.