Fix Claude plugin loading in v1.0.1

[sheepxux]

What changed

• mark the Claude marketplace entry as strict so Claude Code loads one component source instead of reporting a manifest conflict
• add a release-readiness check that fails when strict manifest loading regresses
• accept GitHub CLI source-tracking metadata when validating an installed Skill copy
• bump all package, plugin, documentation, pinned runtime, and schema references to v1.0.1

Why

The v1.0.0 manifests passed static validation, but a clean Claude Code installation reported the plugin as installed and failed to load because marketplace and plugin component declarations were merged. A real post-publish install test exposed the discrepancy.

Validation

• clean Claude Code home: plugin reports enabled
• clean Codex home: plugin reports installed, enabled
• 43 automated tests pass
• generated v1.0.1 tarball installs in an empty directory and completes a dry-run
• official Skill, Codex plugin, Claude plugin, and GitHub Skill validations pass
• npm pack/publish dry-runs pass; production dependency audit reports 0 vulnerabilities

---

Summary by cubic

Fixes Claude Code plugin load failures on clean installs by enabling strict manifest loading. Rolls the release to v1.0.1 across manifests, schemas, and docs, and adds guardrails to prevent regressions.

• Bug Fixes

  • Claude marketplace entry now sets strict: true to avoid merged component declarations and ensure the plugin loads.
  • All manifests, docs, commands, and schema $id URLs now pin to v1.0.1 for consistent installs.

• New Features

  • Validator accepts GitHub CLI source-tracking metadata in SKILL.md for installed copies.
  • doctor adds a release check to assert strict Claude manifest loading and version parity.

^{Written for commit 0094a17. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/skill-package.js">

<violation number="1" location="src/skill-package.js:125">
P2: Skills installed with `gh skill install --pin` still fail validation because GitHub CLI adds `github-pinned` alongside these four source-tracking fields. Treat that optional SHA field as valid GitHub install metadata too.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Skills installed with gh skill install --pin still fail validation because GitHub CLI adds github-pinned alongside these four source-tracking fields. Treat that optional SHA field as valid GitHub install metadata too.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/skill-package.js, line 125:

<comment>Skills installed with `gh skill install --pin` still fail validation because GitHub CLI adds `github-pinned` alongside these four source-tracking fields. Treat that optional SHA field as valid GitHub install metadata too.</comment>

<file context>
@@ -116,6 +120,13 @@ export function installCanonicalSkill({
 
+function validGitHubInstallMetadata(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const required = ["github-path", "github-ref", "github-repo", "github-tree-sha"];
+  return Object.keys(value).every((key) => required.includes(key))
+    && required.every((key) => typeof value[key] === "string" && value[key].length > 0);
</file context>

Suggested change

	const required = ["github-path", "github-ref", "github-repo", "github-tree-sha"];
	return Object.keys(value).every((key) => required.includes(key))
	&& required.every((key) => typeof value[key] === "string" && value[key].length > 0);
	const required = ["github-path", "github-ref", "github-repo", "github-tree-sha"];
	const allowed = new Set([...required, "github-pinned"]);
	return Object.keys(value).every((key) => allowed.has(key) && typeof value[key] === "string" && value[key].length > 0)
	&& required.every((key) => typeof value[key] === "string" && value[key].length > 0);