chore(deps): update dependency universal-plugin to ^0.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
universal-plugin (source)	^0.7.0 → ^0.9.0

---

Release Notes

cyberuni/universal-plugin (universal-plugin)

v0.9.0

Compare Source

Minor Changes

• 8fde5f7: plugin build copies each governance into the skills that use it, so a skill reads its rule sets from disk instead of running npx <pkg> governance show <name> at run time — no registry lookup per read, and no network while the skill works. The .md files already in <skill>/references/governances/ declare which governances that skill uses; the build rewrites each from the package that owns it, copies the governances those reference, transitively, and rewrites every governance show <other> pointer inside a copy into an instruction to load the sibling copy. The build fails when a declared file names no governance, when a referenced one has no copy to point at, or when SKILL.md does not list a copy under References. Commit the copies — a git-sourced install has no build step — and run the new plugin build --check in CI, which writes nothing and exits non-zero naming each copy that differs from its source.
• 7836787: Rename the doctor skill to doctor-universal-plugin. Other plugins ship their own doctor skill, and the bare name collided when more than one was installed — buddy-agent-harness already resolved this by namespacing its own as doctor-buddy-agent-harness. Invoke it as /universal-plugin:doctor-universal-plugin; the CLI's own next-step hints now name that too.

v0.8.0

Compare Source

Minor Changes

• cbda7c2: config get --key packagePath now reads packagePath instead of rejecting it. --format json prints the declared path as a JSON string, relative to the plugin root, or null when no npm package is declared. plugin version, publish sync-version, and config get share one reader, so they cannot disagree about a declaration. config add --key packagePath is still rejected: the key is a string, not a plugin-registered array.

• 1eab810: Move the upx runner into its own package, @repobuddy/upx.

  A generic package runner is broader than this package's build/derivation charter — a placement note
  in the spec has said so since it landed. It also made the wrong trade for upx itself: the runner's
  value is install once globally, use everywhere, and that install should be small, so requiring
  npm i -g universal-plugin to get a runner word worked against it.

  Nothing about upx's behavior changed, and the emitter side stays here: plugin bundle --runner upx,
  the adopt-upx skill, and upgrade-plugin's runner-word handling all still live in this package.
  Their coupling was always to the word upx, never to its code.

  Install @repobuddy/upx directly — npm i -g @repobuddy/upx. The upx bin on this package now
  re-exports it so existing global installs keep working, and prints a deprecation notice on --help
  (never on a normal call — upx is a transparent exec wrapper). It will be removed in the next major.

• 49f1036: Add universal-plugin plugin validate, which checks the root plugin.json without building anything. It reports every problem in one pass, in two groups:

  • Schema violations against the Agent Plugins 1.0.0 schema: $schema and name are required, name must match the schema's pattern, fields must have the right types, and top-level keys the standard does not define are rejected.
  • Vendor violations: for example, Codex requires description and version. --vendor <id> limits these checks to one vendor.

  An unknown vendor key in harnesses is a warning, and --strict makes it a violation. Output is TOON by default, with --format json and --full available. Running universal-plugin plugin with no subcommand now validates the current project and lists its declared harnesses, instead of printing help.

  A manifest without $schema now fails plugin validate. plugin build does not check $schema and still accepts it. plugin init already writes $schema.

Patch Changes

• a40d5b0: doctor now reads packagePath only from .agents/universal-plugin.json, resolved from the plugin root — the same file and base plugin version and publish sync-version use. It no longer falls back to extensions["org.cyberuni.universal-plugin"].packagePath, which the CLI never honored, so doctor could pass a plugin that version still treated as not shipping to npm. A packagePath declared in the manifest extension is now reported as misplaced-package-path.

• f0be1fa: doctor now accepts a repeatable --marketplace-root <path> flag to also validate a separately-cloned shared marketplace repository (e.g. a local clone of cyberuni/marketplace) — previously only the plugin's own repository root was checked, so a bad entry that reached the shared catalog another way went unnoticed. A named --marketplace-root that does not exist is reported as marketplace-root-missing instead of being silently skipped.

• 0211cae: State the CLI's dependency bundling explicitly in the build config.

  dist/cli.mjs already shipped with its runtime dependencies inlined, and that is what lets the
  shipped skill launchers run from an installed plugin directory at all — those directories are copies
  of a source checkout, so their node_modules is absent or incomplete. The build now declares that
  intent through an explicit deps.alwaysBundle block rather than relying on it incidentally, so a
  dependency added later cannot quietly become external and break the launchers.

  @repobuddy/upx is deliberately excluded. It is reachable only from the separate bin/upx.mjs shim,
  which is not a build entry, so the upx bin still resolves it at runtime from an installed tree.

• becd7ef: Fix plugin build ending with a next-step hint for universal-plugin plugin validate, a command that does not exist yet. A build that refreshed a marketplace catalog now points at universal-plugin marketplace validate (with --root for that repository), and any other successful build points at /universal-plugin:doctor.

• 2469986: Fix universal-plugin --version (and -V) always printing 0.0.0 instead of the installed package's actual version.

• c6304c5: migrate-plugin now bundles the package's CLI with tsdown as part of the migration, so the CLI runs from an installed plugin directory that has no node_modules. It splits tsdown.config.ts into a library config that keeps dependencies external and a CLI config that inlines them through deps.alwaysBundle. It then proves the result by running the CLI from an extracted tarball.

  The skill also covers plugins that live in a sibling workspace member such as plugins/<name>/, merges a colliding readme instead of overwriting it, and notes that publish sync-version reads packagePath from .agents/universal-plugin.json, not from the manifest. It also repoints lint excludes, marketplace sources, and spec paths.

• 1f82ccd: schema/extension.schema.json and the init-universal-plugin standard reference no longer advertise packagePath under extensions["org.cyberuni.universal-plugin"]. The CLI never read it there, so a plugin that declared it where the schema said silently fell back to the author-picks release model. packagePath lives in .agents/universal-plugin.json beside plugin.json, as a path relative to the plugin root; a namespace packagePath now fails schema validation.

• 4161472: The doctor and publish-plugin skills now ask the CLI for packagePath (config get --key packagePath) instead of reading .agents/universal-plugin.json themselves, so they cannot drift from plugin version. When the CLI is too old to answer, doctor reports package-path-unknown and skips version-drift and unreleased-content rather than guessing.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e98e36b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR