Defame1297
b4f5881973
plugins/bin/.mcp.json declared the obsidian server as `npx @bitbonsai/mcpvault@latest`, so an unpinned third-party npm package was fetched and executed at every session start. The apm-consumed install promoted that string to committed repo-root content in .mcp.json, giving every clone the same unpinned execution. Pinned to 0.15.0, the version `latest` currently resolves to. bin 1.1.2 -> 1.1.3 and marketplace 0.4.0 -> 0.4.1, following the mappingbb9158destablishes and3bfdf58confirms: the marketplace takes the same bump severity as the highest-severity package bump. kyberforge is not bumped here, so executables.allow's `kyberforge#1.5.0` key is untouched. The pin is not live for this working copy until this lands on the remote and `apm update` re-resolves — apm.lock.yaml still records 1.1.2 and `@latest`, because the six dependencies resolve from the remote rather than from the tree beside them. Correct for a fresh clone immediately. .gitignore gains /.claude-plugin/plugin.json: a bare `apm pack` emits a root-package manifest there that has never been tracked on any branch. Scoped to the file, since the sibling marketplace.json is compiled output that is committed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
45 lines
1.7 KiB
Markdown
45 lines
1.7 KiB
Markdown
# bin
|
|
|
|
A place for things to be binned
|
|
|
|
## Install
|
|
|
|
**Claude Code:**
|
|
|
|
```bash
|
|
claude plugin marketplace add <owner>/<repo>
|
|
claude plugin install bin@<marketplace-name>
|
|
```
|
|
|
|
**GitHub Copilot CLI:**
|
|
|
|
```bash
|
|
copilot plugin marketplace add <owner>/<repo>
|
|
copilot plugin install bin
|
|
```
|
|
|
|
**Local (development):**
|
|
|
|
```bash
|
|
# Claude Code
|
|
claude --plugin-dir ./plugins/bin
|
|
|
|
# GitHub Copilot CLI
|
|
copilot plugin install ./plugins/bin
|
|
```
|
|
|
|
## Contents
|
|
|
|
| Component | Path | Description |
|
|
|---|---|---|
|
|
| Skills | `.apm/skills/` → `skills/` | Slash commands available after install |
|
|
| MCP servers | `.mcp.json` | The `obsidian` server (`npx @bitbonsai/mcpvault@0.15.0 docs/`), hand-authored at the plugin root |
|
|
|
|
`.apm/` is the authoring source; `skills/` is the generated mirror plugin hosts scan (ADR-0017). This plugin ships no agents. It is the only plugin here with a non-empty `.mcp.json`, which is why its compiled manifests are the only ones carrying an `mcpServers` block.
|
|
|
|
The two compiled manifests get that block by different routes. `.claude-plugin/plugin.json` gets it from apm itself: `build_plugin_manifest`'s Claude branch calls `collect_mcp_servers`, which reads `.mcp.json`, sanitizes it, and inlines the resulting server objects. `.github/plugin/plugin.json` gets nothing from apm — the Copilot branch drops the field — so `scripts/sync-plugin-content.sh`'s `reinject_mcp_servers()` puts it back, as the **string `".mcp.json"`** rather than the resolved objects. Copilot's manifest schema types the field as "string or object — MCP server config path or inline definitions", and a path reference cannot carry a credential into a committed manifest. See ADR-0017's `mcpServers` amendment.
|
|
|
|
## Author
|
|
|
|
Defame1297
|