Skip to content

🤖 Plugin install methods: follow-ups (Claude bodies, command folders, skills CLI removal, argument-hint) #7123

Open
Open
🤖 Plugin install methods: follow-ups (Claude bodies, command folders, skills CLI removal, argument-hint)#7123

Description

@ThomasK33
ThomasK33
opened on Oct 21, 2026

Follow-ups from the plugin install-method stack (Claude Code plugins, Claude Code marketplaces, plain skills repos and the skills CLI in Settings → Plugins). Each item is out of that stack's scope and is not fixed there.

  1. ${CLAUDE_PLUGIN_ROOT} in Markdown bodies. Claude Code replaces it in skill, command and agent bodies. Xum replaces it only in .mcp.json.
  2. Command subfolders. Claude Code namespaces commands/<group>/<name>.md. Xum ignores subfolders.
  3. Skills installed by the skills CLI. Xum has no remove action for them, and it does not check before a run whether ~/.agents/skills/<name> already exists (the CLI may overwrite it). Decide: warn, refuse, or add a remove action that uses the CLI lock file.
  4. Update review of agent and command bodies. Confirm that the update review shows body changes of plugin agents and Claude commands, not only their names.
  5. Unquoted argument-hint: [x] in a plugin SKILL.md. YAML reads it as a list and the skill fails to load. The stack fixed this only for Claude command files; SKILL.md goes through the shared skill parser.
  6. Claude manifest extras. userConfig, lspServers, outputStyles, bin/ and inline mcpServers objects are listed as ignored.
  7. End-to-end check of github and git-subdir marketplace sources against real repositories (unit tests cover their resolution).

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Activity

  1. ThomasK33 commented on Oct 21, 2026

    @ThomasK33
    ThomasK33
    on Oct 21, 2026
    MemberAuthor

    More follow-ups from review round 1 of the stack (#7129–#7134). None of them is fixed there.

    1. Skills provenance after an upstream manifest takes over. Keeping it needs a persisted receipt field. Today the update fails with a message that names the methods that fit and says to uninstall and reinstall. Trigger: a user reports an update that stays stuck after the upstream manifest went away.
    2. Skills CLI choice by the pinned CLI's discovery rules (manifest-declared paths, recursive fallback). Today the choice lists only skills that Xum found itself.
    3. Remote marketplace entries that list components but have no manifest. Today Xum refuses them. Generating the entry manifest for them needs the marketplace data at update time.
    4. Per-file filter for Claude agents lists. Today Xum loads no agents from a folder that holds an agent file the list does not name.
    5. Downgrade limit. Builds from before contributes existed (🤖 feat: make provider requests a pure function of the session log + sandboxed plugin hooks #3872, behind the experimental flag) ignore it, so they read skills/ and mcp.json from a generated install.

    Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

  2. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    More follow-ups from review round 4 of the plugin-install stack (#7135). Round 4 fixes blockers only, so these are deferred, not fixed. Trigger for each: a user report, or the next change to the named code.

    1. Explicit Claude skills key (🤖 feat: install Claude Code plugins (commands as user skills, hooks never run) #7130, discovery.ts). An explicit but empty or unusable skills key, with no skills/ folder, still exposes a root SKILL.md. The preview shows it. Fix: track key presence separately and skip the root fallback when the key exists.
    2. Nested Claude agents (🤖 feat: install Claude Code plugins (commands as user skills, hooks never run) #7130, discovery.ts). Xum reads only the top level of agents/, so agents/review/security.md is not offered. Fix: recurse with Claude's subfolder naming, or warn about skipped files.
    3. Invalid root SKILL.md hides root children (🤖 feat: install methods and plain skills repositories as managed plugins #7131, installMethods.ts). Direct children such as foo/SKILL.md are skipped in that case. Fix: walk root children without treating the invalid root as a skill.
    4. Note next to the shown Skills CLI command (🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, skillsCli.ts). When Node is not usable, Xum shows the npx skills add command for the user's terminal, where the user's global Git hooks and filters apply. Fix: add a short note about that next to the command.
    5. Keyboard shortcuts for plugin install actions (🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, PluginInstallMethods.tsx). Install, Update, Remove and the Skills CLI Run button have no shortcuts. Fix: one scoped shortcut set, hints hidden at mobile widths.
    6. Marketplace listing counts (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, installService.ts). The row count is synthesized from the entry and can disagree with the preview, which is authoritative. Fix: derive the row from entryInstallMethods().
    7. .. in marketplace entry names (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, agentPluginName.ts). Xum refuses names like tool..v2, which Claude allows. Fix: drop the extra check and rely on toPluginName().

  3. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    More follow-ups from review round 5 of the plugin-install stack (#7135). Rounds 4-6 fix blockers only, so these are deferred, not fixed. Each one fails closed or affects only the user's own disk. Trigger: a user report, or the next change to the named code.

    1. .git source path (🤖 feat: install methods and plain skills repositories as managed plugins #7131, installMethods.ts repositoryName). A source naming /repo/.git gets an empty name and Xum refuses it. Fix: strip .git before trimming separators.
    2. Root skill with a dotted repository name (🤖 feat: install methods and plain skills repositories as managed plugins #7131). The preview lists no skills and offers an empty plugin. Fix: refuse the Skills method for that layout, or map to a valid skill ID.
    3. .xum/skills container (🤖 feat: install methods and plain skills repositories as managed plugins #7131, installMethods.ts). The list mirrors skills@1.7.4 and lacks Xum's canonical .xum/skills. Fix: add it first for the generated-manifest method, via the central compat helper.
    4. Child skill whose frontmatter name differs from its folder (🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, installService.ts). Left out of the Skills CLI choice. Fix: keep a per-path map from Xum identity to CLI identity.
    5. GIT_SSL_CAINFO/GIT_SSL_CAPATH for the CLI run (🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, skillsCli.ts). Self-hosted HTTPS with a custom CA fails at Run. Fix: pass the TLS variables under the preview's policy.
    6. CLI temp clone outside the disposable folder (🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, skillsCli.ts). No byte watchdog; a killed run leaves the clone in the OS temp folder. Fix: set the child's TMPDIR to the disposable folder and apply the clone quota.
    7. Focus when no marketplace entry is installable (🤖 feat: pick a Claude Code marketplace plugin in Settings → Plugins #7134, PluginMarketplaceListing.tsx). Fix: focus the first row or Back.

  4. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    More follow-ups from review round 6 of the plugin-install stack (#7135). Deferred, not fixed. Each one makes Xum load fewer components, never more.

    1. Command name reserved before the command parses (🤖 feat: install Claude Code plugins (commands as user skills, hooks never run) #7130, discovery.ts). Two declared commands with the same basename: if the first cannot load, neither loads. Fix: reserve the name after the parse.
    2. Component cap counts unusable entries (🤖 feat: install Claude Code plugins (commands as user skills, hooks never run) #7130, claudeManifest.ts). Invalid or duplicate entries can use up the cap. Fix: count only distinct usable paths.

  5. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    Follow-up from review round 7 of the plugin-install stack (#7135). Deferred, not fixed.

    1. Claude ${CLAUDE_PLUGIN_DATA} and ${CLAUDE_PROJECT_DIR} in skill and command bodies (🤖 feat: install Claude Code plugins (commands as user skills, hooks never run) #7130, agentSkillsService.ts). Xum leaves them literal. ${CLAUDE_PROJECT_DIR} is a plain substitution. ${CLAUDE_PLUGIN_DATA} needs a persistent per-plugin data folder, which is a new mechanism.
    2. In-app Skills CLI run (removed in 🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, round 8). Xum now only shows the npx skills add command. A pin to the previewed commit is not fail closed in skills 1.7.4 (--branch <sha> is tried first, so a branch named after the SHA wins). Bringing back an in-app run needs a run from a Xum-checked local clone, or a CLI version that fetches an exact commit.

  6. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    Follow-ups from review round 8 of the plugin-install stack (#7135), deferred by maintainer decision. None is a security flaw or data loss.

    1. Invalid skill folder names offer the Skills method (🤖 feat: install methods and plain skills repositories as managed plugins #7131, installMethods.ts). skills/My Skill/ gives a zero-skill preview. Fix: check SkillNameSchema on the folder before it counts, and require at least one collected skill.
    2. Marketplace entry identity after upstream manifest changes (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, installService.ts). Same class as item 1. Fix: store the entry identity in the install receipt.
    3. Focus after "Install the repository as Skills" from the marketplace list (🤖 feat: pick a Claude Code marketplace plugin in Settings → Plugins #7134, PluginsSettingsSection.tsx). Fix: focus Back whenever the preview came from the marketplace list.

  7. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    Follow-up from the final review of the plugin-install stack (#7135). Not a blocker: a probe found no way to run anything.

    1. Add -- before the URL in cloneRef (installService.ts), and refuse dash-leading remote URLs from marketplace entries (claudeMarketplace.ts entryGitUrl). This is cheap hardening, so git can never read a source URL as an option.

  8. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor
    1. Isolate the shown Skills CLI command from a local node_modules (🤖 feat: install skills with the pinned skills CLI from Settings → Plugins #7132, skillsCli.ts). npx --yes skills@1.7.4 prefers a matching local package in the working folder, so running the copied command inside an attacker-controlled checkout runs the planted copy. Fix: show cd ~ && npx … and a line telling the user to run it from a folder without node_modules. Owner: the plugin-install stack author. Trigger: right after #7135 lands.

  9. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    Picked up by the issue coordinator desk (lane: Menu builder), as a "fix next" item from the 10-22 triage. Scope here is item 5 only (unquoted argument-hint: [x] in a plugin SKILL.md). Items 1-4 and 6-35 wait on the plugin-install stack (#7129-#7134). First step: reproduce it on current main with a failing test, then a plan to the desk before any edit.

    Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

  10. ThomasK33
    added 3 commits that reference this issue on Oct 22, 2026

    🤖 tests: an unquoted argument-hint in SKILL.md keeps its text (red, #…

    de7288c

    🤖 tests: an unquoted argument-hint in SKILL.md keeps its text (red, #…

    47c131b

    🤖 tests: an unquoted argument-hint in SKILL.md keeps its text (red, #…

    2eff03f

  11. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor
    1. Missing folder for a relative marketplace entry without skills (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, installService.ts). The row looks installable, and the preview refuses it. Fix: check containment for every relative entry before the skill count.
    2. github marketplace entries always use HTTPS (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, claudeMarketplace.ts). Private repositories that only SSH reaches fail to preview. Fix: expand through normalizeRepoUrlForClone.

  12. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor
    1. Focus after a failed marketplace entry preview (🤖 feat: pick a Claude Code marketplace plugin in Settings → Plugins #7134, PluginMarketplaceListing.tsx). The pressed button is disabled while it fetches, so focus is lost if the fetch fails. Fix: keep it focusable, or restore focus after the failure.

  13. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor
    1. owner/repo shorthand in url marketplace sources (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, claudeMarketplace.ts entryGitUrl). Claude allows the shorthand only for git-subdir. Fix: refuse it for url.
    2. ref dropped when an entry also pins sha (🤖 feat: read Claude Code marketplaces in the plugin installer #7133, sourceRef). Hosts that refuse direct SHA fetches (AWS CodeCommit) cannot preview such entries. Fix: keep the ref, fall back to cloning it, and verify that HEAD equals the SHA.
  14. asm
    added 6 commits that reference this issue on Oct 22, 2026

    🤖 feat: a declared plugin skills path can name one skill folder; read…

    91f6502

    🤖 feat: install Claude Code plugins (commands as user skills, hooks n…

    0d4f43c

    🤖 feat: install methods and plain skills repositories as managed plug…

    0d2d05a

    🤖 feat: install skills with the pinned skills CLI from Settings → Plu…

    f5cdd02

    🤖 fix: keep an unquoted bracketed argument-hint in SKILL.md as text (c…

    2a9c274

    🤖 fix: start the shown skills CLI command in the home folder (coder#7168

    ec9674c

  15. ThomasK33 commented on Oct 22, 2026

    @ThomasK33
    ThomasK33
    on Oct 22, 2026
    MemberAuthor

    Item 35 is done: #7168 (merged as ec9674c) starts the shown Skills CLI command with cd ~ && on macOS and Linux, and on Windows Settings asks the user to run it from the home folder.

  16. azaj01
    added 2 commits that reference this issue on Oct 25, 2026

    🤖 feat: read Claude Code marketplaces in the plugin installer (coder#…

    1473b07

    🤖 feat: pick a Claude Code marketplace plugin in Settings → Plugins (c…

    5ac795b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions