Defame1297
dee56c506a
Why --- ADR-0018 left deployed skills tracking the remote default branch with nothing watching for drift. The mechanism that was supposed to cover this, scripts/git-hooks/post-push, could never have worked: git has no client-side post-push hook. install.sh copied it into .git/hooks/ so it looked installed, and it had never once fired. Issue #78 reported it as skipping the gitea plugin; it was skipping everything. Refreshing on push was also the wrong shape. Your install goes stale when someone else merges, so a push of your own is neither necessary nor sufficient for staleness to have occurred. Implementation notes -------------------- kyberforge ships a SessionStart hook (startup matcher only) that runs `apm outdated`, and when anything is behind runs `apm update --yes` and returns reloadSkills:true so the running session picks up redeployed content. It exits silently with no apm.lock.yaml present, which keeps it inert for hosts that installed this plugin natively rather than through apm. Two findings drove the wiring, both verified rather than assumed: - apm resolves ${CLAUDE_PLUGIN_ROOT} against the installed package root, and `apm pack` keeps only *.json from .apm/hooks/. A .../hooks/<script> reference therefore points into the generated mirror where the script does not exist — apm reports "Hook script not found" and deploys a hook aimed at nothing. The reference must be .apm/-relative, and a test pins it. - apm's executable-trust gate is OFF unless apm.yml carries an `executables:` block; until now every hook, bin and MCP primitive a dependency shipped would have deployed unprompted. Root apm.yml now enables it. The allow key is version-pinned by apm's design, so a kyberforge version bump silently blocks the hook until the key is bumped too — called out in the block and the ADR. Also corrects ADR-0018 and AGENTS.md, which named `apm install` as the refresh command. It is not: `apm install` deploys from apm.lock.yaml's pinned commit and does not re-resolve refs. `apm update` does. Impact ------ Session startup costs ~0.7s when current and ~10.4s when six packages are behind. Auto-refresh rewrites apm.lock.yaml, so an unexplained modification to it after opening a session is expected; the emitted notice says so. .claude/settings.json stops being exactly {"hooks": {}} once the hook lands there — the merged entry is apm's own output, and the rule that nothing repo-authored goes in that file is unchanged. .claude/hooks/ and the .claude/apm-hooks.json sidecar are gitignored install output. The hook cannot install itself: dependencies resolve from the remote, so it takes effect only after this merges and `apm update` runs once against the new default branch. scripts/git-hooks/ is now empty. install.sh's copy block is kept and test-git-hooks-install.sh synthesizes its own fixture, so the mechanism stays tested without requiring a dead hook to exist. ADR: 0019 Refs: #78 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
kyberforge
Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
Install
Claude Code:
claude plugin marketplace add <owner>/<repo>
claude plugin install kyberforge@<marketplace-name>
GitHub Copilot CLI:
copilot plugin marketplace add <owner>/<repo>
copilot plugin install kyberforge
Local (development):
# Claude Code
claude --plugin-dir ./plugins/kyberforge
# GitHub Copilot CLI
copilot plugin install ./plugins/kyberforge
Contents
Authoring source lives in .apm/. The skills/, agents/, and hooks/hooks.json paths below are the generated mirror that plugin hosts actually scan — produced by scripts/sync-plugin-content.sh, never hand-edited (ADR-0017).
| Component | Path | Description |
|---|---|---|
| Skills | .apm/skills/ → skills/ |
Slash commands available after install |
| Agents | .apm/agents/*.agent.md → agents/ |
Role-based agents; one vendor-neutral .agent.md per agent, copied verbatim to both targets (ADR-0016) |
| Hooks | .apm/hooks/ → hooks/hooks.json |
Event-triggered automation — read by Claude Code only, see below |
| MCP servers | .mcp.json |
Model Context Protocol server definitions (hand-authored at the plugin root) |
Hooks are Claude Code-only in practice. Claude Code convention-scans hooks/hooks.json at the plugin root, so that file is live. Copilot CLI has no default hooks path — agents and skills default to agents/ and skills/, but hooks defaults to nothing (docs/research/docs/github-copilot-plugins/configuration.md:47), so Copilot reads hooks only via an explicit "hooks": "hooks.json" pointer in plugin.json (docs/research/docs/github-copilot-plugins/examples.md:49). apm's manifest compiler strips pointer fields from every manifest it generates, so neither .claude-plugin/plugin.json nor .github/plugin/plugin.json carries one, and re-injecting it is the option ADR-0017 explicitly rejected. Copilot therefore loads no hooks from this plugin — and did not load them from the old root-level hooks.json either. The Copilot half of this row is aspirational, not current behaviour.
Skills
| Skill | Description |
|---|---|
forge |
Grill an unclassified "I want to add something" request, decide whether it's a skill, agent, plugin, or marketplace entry, then route to the matching author skill |
skill-author |
Create or improve a skill from scratch, audit findings, or inline feedback |
skill-audit |
Audit a skill directory against the agentskills.io spec and produce a findings report |
agent-author |
Author an agent definition file |
agent-audit |
Audit an agent definition across structure, provider safety, description and body quality, and provenance; produces a findings report |
apm-install |
Install or upgrade the apm CLI and set up the agent runtimes it drives (Copilot CLI, Codex, Gemini, generic llm) |
apm-workflow |
Author apm.yml, scaffold an apm package/marketplace, install dependencies, and compile/pack/publish/audit apm content |
Pre-commit tooling (pc-author, pc-run) lives in the git plugin, not here.
Author
Defame1297