96 Commits

Author SHA1 Message Date
ndesv21 56ba12c138 fix: update agent and skill counts in marketplace metadata
Added 1 agent (social-publisher) and 1 skill (social-publishing),
so counts go from 191→192 agents and 155→156 skills.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 10:27:02 +02:00
ndesv21 10d1e67f9a fix: bump plugin count to 84 and clarify 13 platforms breakdown
- Update marketplace metadata: 83 → 84 marketplace plugins
- Explicitly list LinkedIn (Profile + Page) and Instagram
  (Business + Standalone) variants so the 13-platform count
  is unambiguous

Addresses CodeRabbit review feedback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 10:17:05 +02:00
ndesv21 af541c8955 feat: add social-publishing plugin via SocialClaw
Adds the social-publishing plugin — an agent + skill for scheduling and
publishing posts across 13 social media platforms via the SocialClaw API.

Platforms: X, LinkedIn, Instagram, Facebook Pages, TikTok, Discord,
Telegram, YouTube, Reddit, WordPress, Pinterest.

Install: npx skills add ndesv21/socialclaw
Source: https://github.com/ndesv21/socialclaw

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25 21:20:13 -04:00
Seth Hobson 9834a5f38d Add Pensyve external integration (#552)
* feat: add Pensyve external integration

* docs: fix skill plugin count
2026-05-24 17:35:47 -04:00
Seth Hobson be57c0b2e3 feat: multi-harness plugin marketplace (Codex, Cursor, OpenCode, Gemini) (#541)
* feat(adapters): multi-harness framework + harness_portability eval dimension

Turn this Claude Code plugin marketplace into a generic agentic-harness
marketplace. Adapters under tools/adapters/ emit harness-native artifacts
for OpenAI Codex CLI, Cursor, OpenCode, and Gemini CLI from a single
Markdown source. Source-of-truth stays under plugins/ — Claude Code is
unchanged.

Framework (tools/adapters/):
- base.py — PluginSource parser, HarnessAdapter ABC, write/mirror helpers
  (path-traversal guard, UTF-8-safe), inline-list + block-list + block-scalar
  YAML-ish parser, _utf8_safe_cut, _split_inline_list, _normalize_author
- capabilities.py — per-harness capability matrix, TOOL_NAME_MAPS,
  MODEL_ALIASES, resolve_model() with explicit warnings
- codex.py — emits .codex/{skills,agents}/ + AGENTS.md (≤150-line
  table-of-contents). Fence-aware body splitter, _utf8_safe_cut for
  multibyte safety, _yaml_scalar with reserved-word + special-char quoting.
  Skill/command name collision detection (and second-order __cmd fallback).
- cursor.py — emits .cursor-plugin/{plugin,marketplace}.json + curated
  .cursor/rules/*.mdc. _validate_mdc_frontmatter handles YAML block scalars
  (no false positives on colons in description body). _normalize_author
  handles dict, npm-style strings, and author lists.
- opencode.py — transpiles agents to .opencode/agents/<id>.md with
  mode:subagent + permission: deny-everything-else block (skill/task always
  allowed as base capabilities — Claude's implicit defaults).
- gemini.py — emits native skills/, agents/, and commands/ at extension
  root (April 2026 spec). Tool-allowlist remapped via TOOL_NAME_MAPS.

CLI + tooling:
- tools/generate.py — unified `make generate HARNESS=<x> [PLUGIN=<y>]`,
  with --clean (containment-guarded; case-insensitive on Darwin/Win32),
  --prune (orphan removal across all per-harness output trees), --strict
  (warnings fail), per-plugin error aggregation, refuses --clean --plugin
  (would silently wipe other plugins' artifacts).
- tools/validate_generated.py — structural validation across all four
  harness outputs. Codex 8KB cap → error. _extract_permission_block
  correctly handles nested permission keys (column-0 only).
- tools/doc_gardener.py — recurring drift detection per OpenAI harness-
  engineering principle. STALE_ARTIFACT (info), DEAD_LINK (error),
  MARKETPLACE_ORPHAN (error), SKILL_OVER_CODEX_CAP (warning), grouped
  output sorted by severity.

plugin-eval (extends existing framework):
- New harness_portability dimension (6% weight, rebalanced from existing
  static sub-scores). Surfaces non-portable patterns with concrete
  remediation hints: SKILL_OVER_CODEX_CAP, CLAUDE_TOOL_REFS,
  CLAUDE_TOOL_PROSE, AGENT_NAME_COLLISION, BARE_MODEL_ALIAS.
- _CAMEL_TOOL_PATTERN requires Claude-tool context (no false positives
  on Rust's `Task` etc.). _TOOL_PROSE_PATTERN case-sensitive on tool
  names, case-insensitive on the leading article.
- Findings do NOT also feed anti_pattern_penalty (no double-counting).

Documentation:
- Top-level guides: CODEX.md, CURSOR.md, OPENCODE.md (≤150 lines each,
  table-of-contents pattern per OpenAI harness-engineering post)
- docs/harnesses.md — capability matrix, graceful-degradation table,
  generated output paths
- docs/authoring.md — portable-content style guide (tools, models,
  collision rules, fence-respect)
- docs/round-trip-results.md — real-CLI verification recipes (OpenCode
  discovers 193 subagents, Gemini extensions validate passes, Codex
  TOMLs all parse)
- CONTRIBUTING.md — new file pointing at docs/authoring.md
- README.md — rewritten for multi-harness (145 lines, was 460)
- CLAUDE.md — trimmed to 60-line table-of-contents
- GEMINI.md — trimmed from 1500 to 500 tokens (3× over budget previously)

Tests: 181 passing (103 plugin-eval + 78 tools/tests). Real-CLI round-trip
verified for OpenCode, Gemini, and Codex (TOML parses).

Replaces tools/generate_gemini_commands.py with the unified CLI.

* refactor(skills): extract detail to references/details.md (~75 skills)

Apply Anthropic's canonical SKILL.md progressive-disclosure pattern across
the marketplace: SKILL.md body becomes a navigation tier (trigger phrasing
+ quick start), detailed templates and worked examples move to
references/details.md (loaded on demand by the agent).

Motivation: OpenAI Codex CLI hard-truncates skills at 8 KB. Before this
change, ~90 skills exceeded that cap and would silently break on Codex.
The progressive-disclosure pattern is also Anthropic's documented
recommendation for token efficiency — Claude Code reads references/ files
on demand when the body navigation says to.

What's extracted, by pattern:
- Pass 1 (## Templates section): 19 skills — full template libraries
  moved to references/details.md
- Pass 2 (## Implementation Patterns / ## Advanced Patterns): 13 skills
- Pass 3 (everything between nav-tier and wrap-tier headings): 53 skills
- Conservative re-extraction for 8 skills that got over-reduced — kept
  ~6-7 KB inline (most of the quick-start tier) plus references/ overflow

What stays inline (SKILL.md navigation tier):
- description: frontmatter (triggering — unchanged for all skills)
- ## When to Use This Skill / ## Core Concepts / ## Quick Start
- ## Best Practices / ## Troubleshooting / ## See Also wrap-ups
- A pointer note ("see references/details.md") so the agent knows where
  to look for detail

What goes to references/details.md (detail tier, on-demand load):
- ## Templates (full code template libraries)
- ## Implementation Patterns / ## Advanced Patterns (deep examples)
- Mid-skill walkthroughs that exceed the inline budget

Also in this commit:
- plugins/brand-landingpage description trimmed from 958→543 chars
  (preserves trigger phrasing, drops verbose example-quote list)

Net effect:
- SKILL_OVER_CODEX_CAP findings: 90 → 10 (88% reduction)
- All triggers unchanged — discovery behavior identical across harnesses
- 75 new references/details.md files with the extracted content
- Same depth of guidance, loaded progressively

Remaining 10 oversized skills are complex multi-section docs (e.g.
postgresql, code-review-excellence, evaluation-methodology) that need
per-skill manual judgment — flagged by `make garden` for future work.

* chore: bump all plugin versions (multi-harness release)

Patch-bump every local plugin (81) in both .claude-plugin/marketplace.json
entries and each plugins/<name>/.claude-plugin/plugin.json. Minor-bump the
top-level marketplace metadata.version (1.6.0 → 1.7.0) to signal the
multi-harness adapter framework addition.

The external git-subdir entry (qa-orchestra) is unaffected — its version
is governed by its upstream repo.

* fix(opencode): preserve explicit tools:[] + word-boundary subtask match

Addresses two Codex review findings on PR #541.

## P1 — `tools: []` silently upgraded to permissive (privilege escalation)

Before: `_build_permission_block` returned `{}` for any empty list, which
omits the `permission:` block entirely from the emitted agent. An author
who explicitly wrote `tools: []` to lock down an advisory-only agent got
an UNRESTRICTED agent in OpenCode. Affected agent in this tree:
`plugins/arm-cortex-microcontrollers/agents/arm-cortex-expert.md`.

Fix: `_build_permission_block` now takes a `has_tools_field` flag so the
caller can distinguish "tools: key missing" (Claude default permissive)
from "tools: []" (explicit lock-down). The lock-down case emits a
deny-everything block that allows ONLY the base capabilities (skill, task)
that Claude Code always grants implicitly. Verified against the real
arm-cortex-expert agent — now emits read/edit/write/bash/grep/glob/list:
deny, task/skill: allow.

## P2 — `"agent" in cmd.body.lower()` false-positives on substrings

Before: a command body containing `PerformanceReviewAgent` (class name
in a code snippet) or `useragent` triggered `subtask: true`, changing
runtime behavior based on incidental text.

Fix: switch to a compiled word-boundary regex `\b(agent|subagent)s?\b`
(case-insensitive). Tests confirm the substring `PerformanceReviewAgent`
no longer fires, while a real "spawn a subagent" sentence still does.

## Tests

3 new regression tests in tools/tests/test_adapters.py:
- `test_explicit_empty_tools_yields_locked_permission_block` (P1)
- `test_missing_tools_field_yields_no_permission_block` (P1 boundary)
- `test_subtask_inference_word_boundary` (P2)

184 total tests pass (was 181). OpenCode round-trip still discovers all
193 subagents; arm-cortex-expert agent is now properly locked down.

* test: behavioral verification + CI gates for multi-harness pipeline

Adds three layers of automated verification that pure-Python parser tests
miss, plus the CI jobs that turn them into hard gates. Catches the kinds
of issues that previously only surfaced when a real user installed the
marketplace and tried to use it.

## test_real_world.py — real-source structural tests

Runs against the actual `plugins/` tree (not synthetic fixtures). Catches
issues that only appear on real content:

- every marketplace entry resolves to a plugins/<name>/ dir
- every local plugin dir appears in marketplace.json
- marketplace.json version == per-plugin plugin.json version (catches drift)
- every plugin loads via load_plugin() without error
- no plugin name contains `__` (adapter namespace separator)
- every agent has name + description; every skill has a trigger phrase
  (same regex plugin_eval's MISSING_TRIGGER check uses)
- no agent name collides with Codex built-ins
- every refactored skill (with `references/details.md`) has:
  - meaningful detail content (>=500 B in details.md)
  - a pointer to references/ in the SKILL.md body
  - a navigation-tier heading preserved (When to Use, Overview, etc.)
  - body >= 600 B (not a stub)
- every plugin.json has name + version matching the dir

This test pass found and fixed three real defects before commit:
- ship-mate/skills/scan: description had no trigger phrase ("Use when…")
- reverse-engineering/skills/memory-forensics: nav-tier section lost
  during extraction
- reverse-engineering/skills/binary-analysis-patterns: same

All three are now fixed (preserved trigger phrasing, added When-to-Use
sections back to the skills my extraction over-trimmed).

## test_round_trip.py — generate→parse→verify

CI runs this AFTER `make generate-all`. Catches generation-time regressions:

- OpenCode/Codex/Gemini agent counts match source agent count (no skips)
- every Codex SKILL.md under 8 KB (the cap that would silently truncate)
- every Codex agent TOML has required fields + valid sandbox_mode
- every OpenCode agent has mode in {primary,subagent,all} and
  provider-prefixed model
- locked agents (source `tools: []`) emit proper deny-everything permission
  block with skill/task allow (regression guard for PR-541 P1)
- every Gemini @{path} injection resolves to a real source file
- every Gemini command TOML has prompt + {{args}} placeholder
- every context file (CLAUDE.md, AGENTS.md, GEMINI.md, etc.) within
  150-line cap
- Cursor marketplace + per-plugin manifests cover all local plugins
- .cursor/rules/*.mdc only use the 3 documented frontmatter keys

## test_cli_smoke.py — real-CLI subprocess tests

Invokes the actual harness binaries (OpenCode, Gemini, Codex, Claude Code)
against the generated artifacts. Catches CLI-level issues pure-Python
parsing can't see: schema-loader drift, plugin-discovery bugs, version
incompatibilities.

- `opencode agent list` — must succeed AND discover every source agent
  (currently 191 + 2 OpenCode built-ins)
- `gemini extensions validate <repo>` — must return success
- `codex doctor` — must report healthy install
- every Codex agent TOML must parse with stdlib `tomllib`
- `claude --version` — sanity check the Claude Code CLI loads
- marketplace.json must have owner + metadata.version for Claude Code's loader

Per-CLI tests skip gracefully when the binary isn't on PATH, so local
devs only exercise what they have installed. CI installs OpenCode +
Gemini and turns those skips into hard gates.

## Makefile + CI

- `make test` — full pytest suite (plugin-eval + tools/tests/)
- `make smoke-test` — generates if needed, then runs real-CLI smoke tests
- `.github/workflows/validate.yml` extended with:
  - `tools-tests` job — runs pytest tools/tests/
  - `multi-harness-generate` job — `make generate-all && make validate
    STRICT=1 && make garden`, uploads generated artifacts on every run
  - `cli-smoke-test` job — installs OpenCode + Gemini, runs test_cli_smoke.py

## Test counts

- Before: 184 tests
- After: 386 tests (parameterized real-source tests over all 82 plugins)
- All passing locally on OpenCode 1.15.7 + Gemini 0.42.0 + Codex 0.133.0
  + Claude Code 2.1.148
2026-05-22 08:18:21 -04:00
jau123 4bb47e9eeb meigen-ai-design: bump to 1.0.8, pin npm to meigen@1.3.2 (#538) 2026-05-21 16:01:37 -04:00
jau123 86bad08ba7 meigen-ai-design: bump to 1.0.7, pin npm to meigen@1.3.1 (#527)
Supersedes #525 (1.0.6 / meigen@1.3.0).

What's new in npm meigen@1.3.1:

- Veo 3.1 capability expansion: fast/pro tiers + 4/6/8s durations +
  720p/1080p/4K resolutions at the same price per tier+duration.
- Seedance 2.0 reference-video continuation: new `referenceVideo` +
  `referenceVideoDuration` paired params for semantic continuation
  of a previous clip.

No schema breaking changes — every new field is optional. Existing
1.3.0 calls continue to work unchanged.

Release notes: https://github.com/jau123/MeiGen-AI-Design-MCP/releases/tag/v1.3.1
2026-05-14 08:44:23 -04:00
Pranay Yadav 34632bcbea feat: add ship-mate plugin (#505) 2026-05-11 19:29:31 -04:00
Seth Hobson 9f9ba32370 docs: synchronize plugin/agent/skill counts (closes #517) (#522)
* docs: synchronize plugin/agent/skill counts (closes #517)

Live counts are 80 local plugins (81 incl. external git-subdir),
185 agents, 153 skills, 100 commands. Six docs were stale:

- marketplace.json metadata.description: 79/184/150 -> 80/185/153
- docs/plugins.md: 78 plugins (77 local) -> 81 plugins (80 local)
- docs/agents.md: 184 agents -> 185
- docs/agent-skills.md: 150 skills / 37 plugins -> 153 skills / 40 plugins
- docs/architecture.md: 79 plugins, 99 agents, 150 skills -> 81/185/153
- docs/usage.md: 150 skills, 79 plugins -> 153 skills, 80 plugins

Companion to 159ce68 which fixed README.md and CLAUDE.md.

* docs: fix model distribution sums + plugins.md framing

CodeRabbit follow-up on PR #522:

- docs/agents.md model distribution table summed to 99 (42+39+18) but
  the header now says 185 agents. Recounted from frontmatter:
  opus 54, sonnet 62, haiku 20, inherit 49 = 185. Added the missing
  Inherit row.
- docs/architecture.md model distribution table had the same stale
  42/39/18 sum; updated to 54/62/20/49 and renamed "Two-Tier" to
  "Four-Tier" since Inherit is now load-bearing.
- docs/architecture.md "average plugin size: 3.4 components" → 5.5,
  matching (185 + 153 + 100) / 80.
- docs/plugins.md headline reframed from "81 ... 80 local + 1 external"
  to "80 ... plus 1 externally-hosted" to match the GEMINI.md
  path-based rule (catalog headline counts local plugins).
2026-05-09 11:16:26 -04:00
Travis 51d8a2dd54 feat: add brand-landingpage plugin (Stitch-backed landing page workflow) (#509) 2026-05-02 17:14:47 -04:00
jau123 7d17c7552d meigen-ai-design: bump to 1.0.5, pin npm to meigen@1.2.13 (#510)
Co-authored-by: jau123 <quaasparrotte@gmail.com>
2026-05-02 17:14:31 -04:00
tommylauren cb381c47d1 fix: address @wshobson review feedback on #495
Three blocking items + one non-blocking clarification from the review:

1. marketplace.json unicode regression FIXED. Reset the file to upstream
   HEAD, then inserted ONLY the review-agent-governance entry with a
   string-based append that preserves every existing UTF-8 character
   byte-for-byte. No entries other than the new one are modified.
   `grep -c '\\u' marketplace.json` returns 0 escape sequences.

2. approve-review.md $1 → $ARGUMENTS. The marketplace slash-command
   convention (per plugins/codebase-cleanup/commands/deps-audit.md from
   PR #490) is $ARGUMENTS, which captures the full argument including
   spaces. $1 only captured the first word. Also JSON-escape the reason
   before embedding in the approval record (via python3 json.dumps) so
   quotes, backslashes, and newlines do not break the JSON body. This
   resolves the non-blocking JSON-escape note too.

3. README honesty on the approval log. Previously claimed the chain
   "records exactly which actions were human-gated and when," which was
   overstating: approval log entries under ./review-receipts/approvals/
   are plain JSON, not signed. Rewrote that paragraph to explicitly
   separate the signed PostToolUse chain (covered by
   @veritasacta/verify) from the operator-trust approval log. Points
   users at protect-mcp sign directly if they need signed approval
   records for regulated environments.

4. Added an explicit note on what the signed chain covers when the
   approval flag is present: PreToolUse short-circuits without calling
   Cedar, so the downstream PostToolUse receipt has decision:allow but
   no policy_digest. Auditors walking the chain should expect this.
   Resolves the "document the short-circuit" non-blocking item.

Not addressed (pending Seth's follow-up):
- marketplace.json conflict with #496 will be resolved by rebase order
  (whichever merges first; the other rebases)

Tests:
- python3 -m json.tool validates marketplace.json, plugin.json, hooks.json
- grep -c '\\u' on marketplace.json = 0
2026-04-26 19:52:50 -04:00
tommylauren 7e1aa0f977 feat: add review-agent-governance plugin (closes review-bot failure class)
Second inhabitant of the `governance` category. Addresses the failure mode
where an AI agent posts PR reviews, comments, merges, or edits CI config
without a human gate. Directly inspired by the Hermes-style incident
pattern where review-bot hallucinations produce account-linked damage.

Components
──────────
- plugin.json, README.md, skills/review-agent-setup/SKILL.md
- agents/review-policy-author.md (sonnet) — Cedar author specialized in
  review-surface gating across GitHub / GitLab / protected branches /
  CI paths / notification surfaces
- commands/approve-review.md — opens an approval window via ./.review-approved
  flag file, records the reason in ./review-receipts/approvals/
- commands/list-pending.md — walks the receipt chain to show recent denials
  (the set of actions the agent tried that were blocked)
- hooks/hooks.json — PreToolUse gate + PostToolUse sign
- policies/review-agent-governance.cedar — default Cedar policy with five
  forbid rules covering gh/glab review actions, protected-branch pushes,
  CI config paths, and WebFetch POSTs to hooks.slack.com / api.github.com

Behavior
────────
By default, the plugin forbids:
  - gh pr review|comment|merge|close|edit, gh issue comment|close|edit,
    gh release create|edit, gh api repos
  - GitLab and Bitbucket equivalents
  - git push to main|master|release|production
  - Writes to .github/workflows/, .gitlab-ci.yml, .circleci/config.yml,
    .github/CODEOWNERS
  - WebFetch POSTs to api.github.com / api.gitlab.com / hooks.slack.com /
    discord.com

Non-review actions pass through unchanged. Composes with protect-mcp for
general policy enforcement; configure separate receipt directories to
keep the chains distinct.

Approval pattern
────────────────
Human opens an approval window by creating ./.review-approved (or via
/approve-review "<reason>"). The PreToolUse hook short-circuits to
permit while the flag is present. Every action, approved or denied,
still produces an Ed25519 receipt, so the chain records exactly what
happened and under what approval.

Marketplace entry
─────────────────
Added under category: "governance" with seven discovery keywords. The
governance category now has two inhabitants (protect-mcp + this one),
which turns it from a vanity category into a real shelf.

Standards
─────────
- Ed25519 (RFC 8032), JCS (RFC 8785), Cedar (AWS)
- IETF draft-farley-acta-signed-receipts
- Uses protect-mcp as its evaluation/signing runtime
2026-04-26 19:52:50 -04:00
Seth Hobson adde832d8f fix: add missing frontmatter to service-mesh-expert and monorepo-architect
Both agent files were missing YAML frontmatter entirely, leaving them
unloadable as plugin agents. Adds name/description/model frontmatter
matching the conventions used by sibling architecture agents in each
plugin (opus tier, description sourced from existing intro line).

Bumps cloud-infrastructure to 1.3.1 and developer-essentials to 1.0.3.

Reported in #500.
2026-04-26 16:42:31 -04:00
jau123 d2abf70891 meigen-ai-design: bump to 1.0.2 (meigen@1.2.10, supersedes 1.2.9)
Updates to match upstream MeiGen MCP release 1.2.10.

- Bump pinned MCP server: meigen@1.2.8 → meigen@1.2.10
- Bump plugin version and marketplace entry: 1.0.1 → 1.0.2

Why skip 1.2.9:
meigen@1.2.9 was deprecated on npm earlier today because of a pricing
regression. It set GPT Image 2.0 as the new default model but left the
server-side `resolution` fallback at 2K, silently doubling credit cost
for users who did not pass `resolution` explicitly. 1.2.10 defaults
gpt-image-2 to 1K (10 credits, matching the platform product default).

What changed in meigen@1.2.10:
- gpt-image-2* defaults to 1K/medium = 10 credits
- New generate_image parameters: `resolution` (1K / 2K / 4K) and
  `quality` (low / medium) for opt-in upgrades or cost savings
- list_models now surfaces each model's supported resolutions and
  quality tiers (via extra_config) so the host LLM can make
  informed cost / detail tradeoffs
- SERVER_INSTRUCTIONS gains a "GPT Image 2.0 resolution / quality"
  section guiding the LLM to stay on 1K unless the use case
  (poster/print/wallpaper) justifies the cost

No behavioral change to agents, commands, or required env vars.

Upstream release: https://github.com/jau123/MeiGen-AI-Design-MCP/releases/tag/v1.2.10
npm deprecation note: https://www.npmjs.com/package/meigen/v/1.2.9
2026-04-23 19:17:30 +08:00
tommylauren 34b0c54227 fix: address @wshobson review feedback on #496
1. marketplace.json unicode regression FIXED. Same fix as #495: reset
   the file to upstream HEAD and did a string-based append of only the
   new signed-audit-trails entry. No other entries are touched. Verified
   with grep on \\u escape sequences returning 0.

2. refs.arewm.com/agent-commit/v0.2 link verified. curl -sIL returns
   HTTP 200; the page is live and correct.

Non-blocking thought (standalone plugin vs skill under protect-mcp)
acknowledged; keeping as standalone for v0.1 since the user-evaluation
path ('read before commit to infrastructure') works better without
requiring protect-mcp install first. Happy to restructure if the
maintainer prefers the nested-skill shape.

Strict-form --fail-on-missing-policy true production example deferred
to a follow-up SKILL revision. Not in this fix since it would be new
content rather than a bug fix.
2026-04-17 13:52:54 -04:00
tommylauren 7d7fb736be feat: add signed-audit-trails teaching plugin
Companion to the existing protect-mcp and review-agent-governance plugins
in the governance category. This one is a teaching skill, not a runtime
hook: a cookbook-style walkthrough for explaining, evaluating, or
demonstrating the signed-audit-trails pattern before committing to the
protect-mcp infrastructure.

Contents
────────
- plugin.json, README.md (explains this is a teaching skill, not runtime)
- skills/signed-audit-trails-recipe/SKILL.md (~1600 words) walking through:
    1. Hook configuration in .claude/settings.json
    2. Cedar policy authoring (four permit/forbid rules)
    3. Using Claude Code normally with hooks active
    4. Inspecting a produced receipt
    5. Verifying the chain with @veritasacta/verify
    6. Demonstrating tamper detection live
  Plus: three-invariant cryptographic model (JCS + Ed25519 + hash chain),
  cross-implementation interop table (4 implementations), CI/CD YAML
  snippet, SLSA composition via ResourceDescriptor byproduct, common
  pitfalls, references.

Marketplace entry
─────────────────
Added under category: "governance" immediately after protect-mcp. Keywords
emphasize the tutorial/cookbook nature ("tutorial", "skill", "recipe") to
distinguish from the runtime plugins.

Why this is useful alongside the two existing plugins
─────────────────────────────────────────────────────
protect-mcp is runtime. review-agent-governance is runtime (with human-
approval pattern). signed-audit-trails is education. A user evaluating
whether to adopt receipts can invoke the skill to get the concept and a
reproducible demo in-session, then install the runtime plugin if they
decide to proceed. Pairs naturally with /audit-chain and /verify-receipt
slash commands shipped in protect-mcp.

No new dependencies. Same IETF draft + @veritasacta/verify references as
the other governance plugins.
2026-04-17 12:48:11 -04:00
Seth Hobson f374e5a353 chore: remove pensyve from marketplace
Pensyve is now distributed exclusively from its own marketplace at
major7apps/pensyve. Removing the git-subdir entry from this marketplace
to avoid version drift (plugin.json in the subtree was stale vs the
source repo).

- Drop pensyve entry from .claude-plugin/marketplace.json
- Update plugin counts: 79 → 78, AI & ML 5 → 4
- Update docs/plugins.md and README.md accordingly
2026-04-16 13:37:09 -04:00
Seth Hobson 20605a6ce9 docs: bump OpenAI references from GPT-5.2 to GPT-5.4
Covers all 18 occurrences across 9 files: marketplace.json description,
llm-application-dev plugin.json / README / agents / commands / skills
references, agent-orchestration multi-agent-optimize, and
performance-testing-review ai-review. No GPT-5.3 references existed.

JSON validated; pytest unaffected.
2026-04-16 13:19:42 -04:00
Seth Hobson 6625d1ead4 docs: refresh counts for protect-mcp + qa-orchestra; add CI validation
- Counts now reflect 79 plugins (77 local + 2 external via git-subdir),
  184 agents, 150 skills, 98 commands across 25 categories
- README/docs: add Governance category (protect-mcp), bump Testing to 2
  (adds qa-orchestra), expand Security table to include reverse-engineering
  and block-no-verify, add Protect MCP skills section, surface pensyve in
  AI & ML
- marketplace.json: bump metadata to 1.6.0, bump pensyve to 1.2.0
- Add .github/workflows/validate.yml to gate PRs on:
  - marketplace.json + every plugin.json + hooks.json parse as JSON
  - every ./plugins/<name> source resolves on disk with a plugin.json
  - plugin-eval pytest suite (would have caught the #482 sdk.stream bug class)
2026-04-16 13:10:31 -04:00
tommylauren e88aa6fb91 Move protect-mcp to new 'governance' category; add discovery keywords
Per review feedback on #484: introducing a new governance category for
better discoverability. This is the first governance-focused plugin in
the marketplace; existing low-count categories (testing, payments,
gaming, finance, blockchain, accessibility) show that niche categories
are acceptable once they have a clear inhabitant.

Also adds a keywords array for searchability.

No changes to plugin contents — this is a marketplace-entry-only update.
2026-04-16 12:58:55 -04:00
tommylauren d3f25db226 feat: add protect-mcp plugin for Cedar policy enforcement + signed receipts
Addresses #471. Adds the first cryptographic governance plugin to the
marketplace: every Claude Code tool call is evaluated against a Cedar
policy before running, and every decision produces an Ed25519-signed
receipt that anyone can verify offline.

Contents of plugins/protect-mcp/:
- skills/protect-mcp-setup/SKILL.md — full setup + hook config guide
- agents/policy-enforcer.md — Cedar policy author (opus) with example
  policies for research, development, and production contexts
- agents/receipt-verifier.md — verifier/chain expert (sonnet) that
  diagnoses signature mismatches, chain breaks, and malformed receipts
- commands/verify-receipt.md — /verify-receipt <path>
- commands/audit-chain.md — /audit-chain [--last N]
- hooks/hooks.json — PreToolUse (Cedar evaluate) + PostToolUse (sign)
- README.md + plugin.json

The plugin depends on two published npm packages:
- protect-mcp (10K+ monthly downloads) — the hooks runtime
- @veritasacta/verify — offline receipt verification CLI

Receipts follow IETF draft-farley-acta-signed-receipts, use RFC 8032
Ed25519 signatures, and RFC 8785 JCS canonicalization. Cedar is AWS's
formally-verified authorization engine (the WASM bindings were
upstreamed in cedar-policy/cedar-for-agents#64).

Marketplace entry added under category "security". Category
"governance" does not exist in the marketplace today; happy to propose
one in a follow-up if the maintainer prefers.
2026-04-16 12:58:55 -04:00
Seth Hobson 8861878dc1 Merge pull request #480 from Anasss/add-qa-orchestra
Add QA Orchestra plugin (testing category)
2026-04-16 12:56:46 -04:00
Seth Hobson d5f55ed6ca Merge pull request #483 from jau123/update-meigen-1.2.8
meigen-ai-design: bump to 1.0.1 (pin meigen@1.2.8)
2026-04-16 12:53:49 -04:00
Seth Hobson ddb61351ee chore: bump pensyve plugin to v1.1.0 (intelligent memory capture) 2026-04-15 14:47:34 -04:00
jau123 38dc0c93e7 Update meigen-ai-design to 1.0.1
- Bump pinned MCP server to meigen@1.2.8
- image-generator agent: omit aspectRatio by default (server now auto-infers)
- Bump plugin version 1.0.0 -> 1.0.1
2026-04-15 18:25:12 +08:00
Anass Rach 8919525e41 Add QA Orchestra plugin to marketplace 2026-04-13 22:49:41 +02:00
Seth Hobson 0a9441b7ba Merge pull request #459 from cskwork/feat/issue-456-block-no-verify-hook
feat: add block-no-verify plugin to prevent skipping git hooks
2026-04-08 17:19:42 -04:00
Seth Hobson 0546fddc66 Merge pull request #458 from catcam/add-hads-documentation-standard
add: documentation-standards plugin with HADS skill
2026-04-08 17:19:38 -04:00
cskwork 77adba15c3 fix: address review feedback - remove dead links, update attribution 2026-04-05 23:44:58 +09:00
cskwork 5873f97752 feat: add block-no-verify hook to prevent skipping git hooks 2026-04-05 23:44:58 +09:00
root 1925457552 fix: add marketplace.json entry, remove phantom validator reference
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-04 00:14:21 +02:00
Seth Hobson 70444e5b1f fix(pensyve): use git-subdir source for subdirectory plugin
Changed from "github" source (clones entire repo) to "git-subdir"
(sparse-clones only integrations/claude-code). This makes Claude Code
treat the subdirectory as the plugin root, finding .claude-plugin/plugin.json,
hooks/, skills/, and agents/ at the correct paths.
2026-04-03 17:05:56 -04:00
Seth Hobson e323a367d9 chore: add Pensyve plugin, update counts, remove stale specs
- Add Pensyve memory plugin to marketplace via external GitHub source
- Update plugin/agent/skill/command counts across marketplace.json, CLAUDE.md, and README.md (75 plugins, 182 agents, 147 skills, 95 commands)
- Remove outdated PluginEval design spec and plan from docs/superpowers
- Bump marketplace version to 1.5.7
2026-04-03 13:32:59 -04:00
Seth Hobson 4ccf9424a4 fix(plugin-eval): address code review findings
- Fix _beta_cdf Simpson's rule lower bound (was 0.001, now 0.0 for a>=1)
- Fix parse_agent crash on YAML-list tools: field (list vs string)
- Replace hardcoded absolute paths with ${CLAUDE_PLUGIN_ROOT}
- Register plugin-eval in marketplace.json
2026-03-26 00:54:01 -04:00
Seth Hobson 1ad2f007d5 Merge pull request #452 from Djelibeybi/add-oci-awareness
feat: Add OCI awareness across agents and skills
2026-03-17 11:00:12 -04:00
Avi Miller 358af5c98d refactor: update based on review feedback
Signed-off-by: Avi Miller <me@dje.li>
2026-03-18 01:52:01 +11:00
Seth Hobson 88c28fa2d4 Merge pull request #446 from jau123/add-meigen-ai-design
Add meigen-ai-design plugin
2026-03-17 10:39:37 -04:00
jau123 2566f79d5c Address review feedback: restructure plugin for marketplace conventions
- Remove .mcp.json (not used in marketplace, add README instead)
- Add marketplace.json entry for plugin discovery
- Add README.md with MCP server setup guide, provider config, and troubleshooting
- Add tools: declaration to image-generator agent (functional fix)
- Move <example> blocks from YAML frontmatter to markdown body
- Remove unused tools: Read, Grep, Glob from prompt-crafter agent
- Remove redundant name: field from command frontmatter
- Use full MCP tool prefix (mcp__meigen__*) in commands
- Rewrite plugin.json description to factual style
- Pin npm version to meigen@1.2.5

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-08 01:49:29 +08:00
Seth Hobson a6f0f457c4 chore: bump marketplace to v1.5.6 and patch 28 affected plugins
Patch version bumps for all plugins that had phantom resource
references removed in the previous commit.
2026-03-07 10:57:55 -05:00
Seth Hobson ade0c7a211 fix(ui-design): update TabView examples to iOS 18 Tab API (#438)
Replace deprecated .tabItem modifier pattern with modern Tab struct
across mobile-ios-design skill and navigation reference docs.
2026-02-21 07:47:50 -05:00
Seth Hobson 5140d20204 chore: bump conductor to v1.2.1 and marketplace to v1.5.4 2026-02-20 20:10:41 -05:00
Seth Hobson 682abfcdeb fix: remove stale code-review-ai plugin (#134, #135)
Plugin had inconsistent content (OpenAI references, CI/CD workflow baked
into review command). Replaced by official pr-review-toolkit and
comprehensive-review plugins. Also answered discussions #138, #421, #422.
2026-02-19 14:21:59 -05:00
Seth Hobson 086557180a chore: update model references to Claude 4.6 and GPT-5.2
- Claude Opus 4.5 → Opus 4.6, Claude Sonnet 4.5 → Sonnet 4.6 (Haiku stays 4.5)
- Update claude-sonnet-4-5 model IDs to claude-sonnet-4-6 in code examples
- Update SWE-bench stat from 80.9% to 80.8% for Opus 4.6
- Update GPT refs: GPT-5 → GPT-5.2, GPT-4o → gpt-5.2, GPT-4o-mini → GPT-5-mini
- Fix GPT-5.2-mini → GPT-5-mini (correct model name per OpenAI)
- Bump marketplace to v1.5.2 and affected plugin versions
2026-02-19 14:03:46 -05:00
Seth Hobson 089740f185 chore: bump marketplace to v1.5.1 and sync plugin versions
Sync marketplace.json versions with plugin.json for all 14 touched
plugins. Fix plugin.json versions for llm-application-dev (2.0.3),
startup-business-analyst (1.0.4), and ui-design (1.0.2) to match
marketplace lineage. Add dotnet-contribution to marketplace.
2026-02-06 19:36:28 -05:00
Seth Hobson 4820385a31 chore: modernize all plugins to new format with per-plugin plugin.json
Add .claude-plugin/plugin.json to all 67 remaining plugins and simplify
marketplace.json entries by removing redundant fields (keywords, strict,
commands, agents, skills, repository) that are now auto-discovered.
Bump marketplace version to 1.5.0.
2026-02-05 22:02:17 -05:00
Seth Hobson a5ab5d8f31 chore(agent-teams): bump to v1.0.2 2026-02-05 17:42:30 -05:00
Seth Hobson 598ea85e7f fix(agent-teams): simplify plugin.json and marketplace entry to match conductor patterns
Strip plugin.json to minimal fields (name, version, description, author, license).
Remove commands/agents/skills arrays, keywords, repository, and strict from marketplace entry.
2026-02-05 17:41:00 -05:00
Seth Hobson fb9eba62b2 fix(agent-teams): remove Context7 MCP dependency, align frontmatter with conductor patterns, bump to v1.0.1
Remove .mcp.json to eliminate external MCP dependency that likely caused plugin load failure.
Add tools: field to all agents, version: field to all skills, matching conductor plugin patterns.
2026-02-05 17:30:35 -05:00
Seth Hobson 81d53eb5d6 chore: bump marketplace to v1.4.0 (73 plugins, 112 agents, 146 skills) 2026-02-05 17:11:08 -05:00