Repository navigation
Conversation
…its provenance launch-wallet ran whichever create-clip-wallet npm served. It now runs 0.2.1 and no other version. Before it does, `npm view create-clip-wallet@0.2.1 name version repository.url dist.attestations.provenance.predicateType` must show the kit's package, at that version, from Clip Wallet's repository, with an SLSA provenance attestation (https://slsa.dev/provenance/v1). If anything differs or is missing, the skill stops without running it. After the build, the skill runs the project's `pnpm verify:provenance`, which reads each kit package's attestation from the npm registry and checks that Clip Wallet's CI built it and that npm serves that build. A failure is reported, never worked around by changing the kit's versions. The root README and the changelog say the same. Signed-off-by: Shayan Salehi <shayan.salehis@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each plugin folder now holds what Anthropic's and OpenAI's plugin directories ask for. A README says what the plugin does and needs, everything its skill runs, fetches and sends, that the plugin itself sends nothing to ColdAI, three example prompts, and where to get support, the privacy policy and the licence. The exclip README states ColdAI's fee in the skill's fixed words; the clip-wallet README says it is pre-release, on test networks only, with no external audit. Each folder also has a copy of the licence and the product mark as its icon. The Claude Code manifests add displayName, homepage, repository and author.url. The portable plugin.json files follow the Agent Plugins schema, with the same shared fields, and carry OpenAI's listing under extensions."com.openai".interface, whose long description for exclip carries the fee in its fixed words. PRIVACY.md is the plugins' privacy policy, and the root README says how to submit the folders. Signed-off-by: Shayan Salehi <shayan.salehis@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…penAI scripts/check-listing.mjs checks what the directories ask of each plugin: its plugin.json against the portable schema's keys and OpenAI's interface limits, the same shared fields and display name as .claude-plugin/plugin.json, three different example prompts, https links, and a brand colour with at least 2:1 contrast against white. It checks that each icon is a square SVG of at least 48 px, that each README has the listing's prompts, the support and privacy links and the icon only as a Markdown image, and that each LICENSE is the root's. It checks that nothing under plugins/ is a link, a system file, an image other than SVG or PNG, or another file of 256 KiB or more, and that every package launcher names one exact version. scripts/check-manifests.sh also looks for the fee's fixed words in the exclip README and its OpenAI listing, and for a fee split's terms in the plugin READMEs, PRIVACY.md and the listing text. CI validates each plugin with --strict and runs check-listing.mjs. scripts/pack-openai.sh packs each committed plugin as one ZIP for OpenAI's directory, in dist/, which Git ignores, and checks what each ZIP holds. Signed-off-by: Shayan Salehi <shayan.salehis@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Shayan Salehi <shayan.salehis@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Shayan Salehi <shayan.salehis@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gets
exclipandclip-walletready for Anthropic's plugin directory (one submission per plugin folder) and OpenAI's (one ZIP per plugin).Each plugin folder
README.md: what the plugin runs, fetches and sends; that it sends ColdAI nothing; a one-line install; three example prompts; support, privacy and licence. The exclip README states the fee in its fixed words. The clip-wallet README carries the pre-release notice.LICENSEandassets/icon.svg: byte-for-byte copies of the root licence and the product mark..claude-plugin/plugin.json: addsdisplayName,homepage,repositoryandauthor.url.plugin.json: the portable Agent Plugins manifest, with OpenAI'sinterface. Short descriptions are "Launch your own DEX" and "Launch your own wallet". Brand colours are#2563EB(5.17:1 against white) and#FF3C00(3.56:1).Skills
launch-walletrunscreate-clip-wallet@0.2.1only, and only afternpm viewshows an SLSA provenance attestation. It addspnpm verify:provenanceto its checks.Repository
PRIVACY.md: the plugins' privacy notice.scripts/check-listing.mjs: checks both manifests against the schema and OpenAI's limits, the colour contrast, icons, READMEs, licences, no symlinks or.DS_Store, and pinned launchers.scripts/pack-openai.sh: buildsdist/<name>-<version>.zipfrom tracked files.claude plugin validate --stricton each plugin, then the listing check.check-manifests.shalso checks the fee words in the exclip README and its OpenAI listing.Checks run locally
claude plugin validate .(and--strict)claude plugin validate --stricton each plugin (Claude Code 2.1.301, as CI pins)bash scripts/check-manifests.shnode scripts/check-platform.mjs0x9029…f313, rate 875, ExClip46ff2benode scripts/check-listing.mjsbash scripts/pack-openai.shplugin.json,skills/,assets/icon.svg,README.md,LICENSEMerge order
Merge only after
create-clip-wallet@0.2.1is on npm with a provenance attestation. Until then the pinned launcher points at a version that doesn't exist.🤖 Generated with Claude Code