fix(check-manifests): skip remote-sourced plugins in local path check

## Why
The hook was treating all source values as local directory paths. Remote
sources (github/git/npm objects) have no local directory — the jq -r of
a JSON object produced garbage, causing the hook to fail on push after
adding the mattpocock-skills remote plugin.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -30,7 +30,15 @@
       "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
       "name": "core",
       "source": "./plugins/core"
+    },
+    {
+      "description": "Skills for Real Engineers \u2014 planning, TDD, architecture, and debugging workflows from Matt Pocock's .claude directory.",
+      "name": "mattpocock-skills",
+      "source": {
+        "repo": "mattpocock/skills",
+        "source": "github"
+      }
     }
   ],
-  "version": "0.1.1"
+  "version": "0.2.0"
 }

.github/plugin/marketplace.json

@@ -30,7 +30,15 @@
       "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
       "name": "core",
       "source": "./plugins/core"
+    },
+    {
+      "description": "Skills for Real Engineers \u2014 planning, TDD, architecture, and debugging workflows from Matt Pocock's .claude directory.",
+      "name": "mattpocock-skills",
+      "source": {
+        "repo": "mattpocock/skills",
+        "source": "github"
+      }
     }
   ],
-  "version": "0.1.1"
+  "version": "0.2.0"
 }

plugins/kyberforge/.claude-plugin/plugin.json

@@ -8,5 +8,5 @@
   "keywords": [],
   "license": "MIT",
   "name": "kyberforge",
-  "version": "1.0.2"
+  "version": "1.0.6"
 }

plugins/kyberforge/plugin.json

@@ -13,5 +13,5 @@
   "skills": [
     "skills/"
   ],
-  "version": "1.0.2"
+  "version": "1.0.6"
 }

plugins/kyberforge/skills/agent-author/README.md

@@ -4,7 +4,7 @@ Creates and improves agent definition files for Claude Code and GitHub Copilot C
 
 ## What it does
 
-Scaffolds and fills in agent definition files (`.md` for Claude Code, `.agent.md` for Copilot CLI) at plugin, project, or user scope. Always generates both provider files in one pass. Also applies improvement signals — grill output, inline feedback, session context — to existing agent files.
+Scaffolds and fills in agent definition files (`.md` for Claude Code, `.agent.md` for Copilot CLI) at plugin, project, or user scope. Always generates both provider files in one pass. Also applies improvement signals — grill output, inline feedback, session context — to existing agent files. Bumps the plugin version in both manifests after every change (minor for new agents, patch for improvements).
 
 ## Before you start
 

plugins/kyberforge/skills/agent-author/SKILL.md

@@ -26,6 +26,7 @@ metadata:
 
 ## Gotchas
 
+- If the agent lives inside a plugin (its path contains a `plugin.json`), bump the plugin version after every change — in both `plugin.json` and `.claude-plugin/plugin.json` in the same edit pass. Convention: new agent → minor bump; improvement or fix → patch bump. Plugin consumers compare this version to detect updates; skipping it makes the change invisible.
 - Plugin agents silently ignore `hooks`, `mcpServers`, and `permissionMode` — these fields have no effect and produce no warning. They only work in `.claude/agents/` or `~/.claude/agents/`.
 - `AskUserQuestion`, `EnterPlanMode`, `ExitPlanMode`, and `ScheduleWakeup` are never available to any subagent regardless of the `tools` field.
 - Duplicate `name` values in the same scope: Claude Code silently discards one without warning. Always verify uniqueness before shipping.
@@ -145,6 +146,8 @@ If no research sources are in context, delete `agents/sources.md`.
 - [ ] No Claude Code-only fields (`maxTurns`, `isolation`, `memory`, `permissionMode`, `effort`)
 - [ ] System prompt body present and non-empty
 
+If the destination is inside a plugin directory, apply a **minor bump** to the `version` field in both `plugin.json` and `.claude-plugin/plugin.json` at the plugin root in the same edit pass (e.g. `1.0.4` → `1.1.0`).
+
 ## Improving an existing agent
 
 ### Step 1 — Verify inputs
@@ -179,3 +182,5 @@ Edit any file the signals point to. Generalize the fix — find the underlying g
 ### Step 5 — Validate and close
 
 Re-run the validation checklist from the create flow's Step 5 on any edited file.
+
+If the agent lives inside a plugin directory, apply a **patch bump** to the `version` field in both `plugin.json` and `.claude-plugin/plugin.json` at the plugin root in the same edit pass (e.g. `1.0.4` → `1.0.5`).

plugins/kyberforge/skills/marketplace-author/README.md

@@ -4,7 +4,7 @@ Adds, removes, and updates plugin entries in the holocron marketplace manifest.
 
 ## What it does
 
-Manages entries in the `plugins[]` array of `marketplace.json`. Always updates both `.claude-plugin/marketplace.json` and `.github/plugin/marketplace.json` in the same edit pass — never one without the other. Routes automatically to add, remove, update, or create-from-scratch based on whether the files exist and whether the named plugin is already in the catalog. Runs `claude plugin validate .` after every mutating operation.
+Manages entries in the `plugins[]` array of `marketplace.json`. Always updates both `.claude-plugin/marketplace.json` and `.github/plugin/marketplace.json` in the same edit pass — never one without the other. Routes automatically to add, remove, update, or create-from-scratch based on whether the files exist and whether the named plugin is already in the catalog. Bumps the catalog version on every mutation (minor for ADD/REMOVE, patch for UPDATE). Runs `claude plugin validate .` after every mutating operation.
 
 ## Before you start
 

plugins/kyberforge/skills/marketplace-author/SKILL.md

@@ -25,6 +25,7 @@ metadata:
 ## Gotchas
 
 - Both marketplace files must be identical after every operation — never update one without the other in the same edit pass.
+- Every catalog mutation (ADD, REMOVE, UPDATE) requires a catalog `version` bump in both files in the same edit pass. Clients cache the catalog and use the version to detect changes — skipping the bump means the new state is invisible until a forced refresh. Convention: ADD and REMOVE → minor bump (e.g. `0.1.1` → `0.2.0`); UPDATE → patch bump (e.g. `0.2.0` → `0.2.1`). The `version` field may be at the top level or nested inside `metadata` — bump whichever form is present.
 - `source` for local plugins is a relative path from the marketplace root, not the plugin directory name alone (e.g. `"./plugins/kyberforge"`, not `"kyberforge"`).
 - The `{ "source": "github", ... }` object form is only for GitHub. For GitLab, Gitea, or any other git host, use `{ "source": "git", "url": "https://..." }` with a full URL.
 
@@ -161,7 +162,11 @@ Append the new entry to the end of the `plugins[]` array in `.claude-plugin/mark
 
 Apply the identical addition to `.github/plugin/marketplace.json` in the same edit pass.
 
-### Step 4 — Validate
+### Step 4 — Bump catalog version
+
+Apply a **minor bump** to the `version` field in both files in the same edit pass (e.g. `0.1.1` → `0.2.0`). Find the field at the top level or inside `metadata` — bump whichever form is present.
+
+### Step 5 — Validate
 
 Follow the **VALIDATE** flow.
 
@@ -189,7 +194,11 @@ Remove the entry from `plugins[]` in `.claude-plugin/marketplace.json`.
 
 Apply the identical removal to `.github/plugin/marketplace.json` in the same edit pass.
 
-### Step 4 — Validate
+### Step 4 — Bump catalog version
+
+Apply a **minor bump** to the `version` field in both files in the same edit pass (e.g. `0.1.1` → `0.2.0`). Find the field at the top level or inside `metadata` — bump whichever form is present.
+
+### Step 5 — Validate
 
 Follow the **VALIDATE** flow.
 
@@ -211,7 +220,11 @@ State which fields will change and to what values, then edit `.claude-plugin/mar
 
 Apply the identical change to `.github/plugin/marketplace.json` in the same edit pass.
 
-### Step 3 — Validate
+### Step 3 — Bump catalog version
+
+Apply a **patch bump** to the `version` field in both files in the same edit pass (e.g. `0.2.0` → `0.2.1`). Find the field at the top level or inside `metadata` — bump whichever form is present.
+
+### Step 4 — Validate
 
 Follow the **VALIDATE** flow.
 

plugins/kyberforge/skills/plugin-author/SKILL.md

@@ -25,6 +25,7 @@ metadata:
 ## Gotchas
 
 - Both manifests must carry identical `version` values — version parity is a hard invariant (ADR-0016). Never update version in one manifest without updating the other in the same edit pass.
+- Every UPDATE to non-version fields (description, keywords, author, etc.) requires a patch bump to `version` in both manifests in the same edit pass. Consumers cache plugin metadata and use the version to detect changes — skipping the bump makes the update invisible until a forced refresh.
 - `author.email` is placed in the Copilot manifest by convention; `author.url` is placed in the CC manifest by convention. Both fields are supported by both platforms — do not add them to the other manifest without a deliberate reason.
 - `claude plugin tag --push` is irreversible: it creates a git tag and pushes it to remote. Always present the HITL gate and wait for explicit confirmation before running it.
 - `claude plugin tag --push` requires a clean working tree and will fail if there are uncommitted changes. Commit or stash all changes before running it.
@@ -135,7 +136,11 @@ If the target field is not listed in the classification table, read `references/
 
 State which fields change and which files are affected. Then apply. For `version` changes not part of a release, bump both manifests in the same edit.
 
-### Step 4 — Validate
+### Step 4 — Bump version
+
+If the change did not explicitly target the `version` field, apply a **patch bump** to `version` in both manifests in the same edit pass (e.g. `1.2.3` → `1.2.4`). Skip this step only when the user has explicitly set the version themselves in Step 3.
+
+### Step 5 — Validate
 
 Re-run the validation checklist from CREATE flow Step 3 on both files.
 

plugins/kyberforge/skills/skill-author/README.md

@@ -4,7 +4,7 @@ Author and refine skills conforming to the [agentskills.io](https://agentskills.
 
 ## What it does
 
-Routes to one of two flows based on context: if no skill directory exists at the target path, it scaffolds the directory from annotated templates, fills in `SKILL.md` and supporting files, and validates the result. If an existing skill directory and improvement signals are both present, it groups those signals by root cause and applies targeted edits, then re-validates.
+Routes to one of two flows based on context: if no skill directory exists at the target path, it scaffolds the directory from annotated templates, fills in `SKILL.md` and supporting files, and validates the result. If an existing skill directory and improvement signals are both present, it groups those signals by root cause and applies targeted edits, then re-validates. In both flows, if the skill lives inside a plugin directory, bumps the plugin version in both manifests.
 
 ## Before you start
 

scripts/check-manifests.sh

@@ -23,6 +23,13 @@ plugin_count=$(jq '.plugins | length' "$MARKETPLACE")
 
 for ((i = 0; i < plugin_count; i++)); do
   name=$(jq -r ".plugins[$i].name" "$MARKETPLACE")
+  source_type=$(jq -r ".plugins[$i].source | type" "$MARKETPLACE")
+
+  # Remote sources (github, git, npm objects) have no local directory to check
+  if [[ "$source_type" != "string" ]]; then
+    continue
+  fi
+
   source=$(jq -r ".plugins[$i].source" "$MARKETPLACE")
   source="${source#./}"
   plugin_dir="$REPO_ROOT/$source"