Directory listings for the exclip and clip-wallet plugins

.github/workflows/validate.yml

@@ -30,17 +30,23 @@ jobs:
       # One exact version, so that a new release can't change what passes. Raise it on purpose.
       - name: Install the Claude Code CLI
         run: npm install --global @anthropic-ai/claude-code@2.1.301
+      # Each plugin with --strict, so that a warning fails the run too.
       - name: Validate the marketplace and each plugin
         run: |
           claude plugin validate .
           for plugin in plugins/*/; do
-            claude plugin validate "./${plugin%/}"
+            claude plugin validate --strict "./${plugin%/}"
           done
-      # The Codex marketplace, the plugins' names in all four places, the skills' frontmatter, the fee's wording, and no
-      # fee split's terms. jq is on GitHub's Ubuntu runners.
+      # The Codex marketplace, the plugins' names in all four places, the skills' frontmatter, the fee's wording in the
+      # skill, the exclip README and its OpenAI listing, and no fee split's terms. jq is on GitHub's Ubuntu runners.
       - name: Check the manifests
         run: bash scripts/check-manifests.sh
       # Exactly the six keys: ColdAI's address in EIP-55 form, its name, the rate 875, no fee on stock swaps, and a full
       # ExClip commit.
       - name: Check ColdAI's fee settings
         run: node scripts/check-platform.mjs
+      # Each plugin's listing for Anthropic's and OpenAI's directories: plugin.json against the portable schema and
+      # OpenAI's limits, the brand colour, the icons, READMEs and licences, the files under plugins/, and pinned package
+      # launchers.
+      - name: Check the directory listings
+        run: node scripts/check-listing.mjs

.gitignore

@@ -0,0 +1,2 @@
+# scripts/pack-openai.sh writes the directory ZIPs here.
+dist/

CHANGELOG.md

@@ -18,6 +18,18 @@ All notable changes to this project are recorded here. The format follows
   rate, the fee on stock swaps (0) and the ExClip commit the skill checks out, `46ff2be`
   (`46ff2beb0ca0c4500cff133c023e79411c0a52cc`).
 - The `clip-wallet` plugin, with the skill `launch-wallet`: make your own wallet with the Clip Wallet kit's
-  `create-clip-wallet`. Pre-release: test networks only, and no external audit.
-- CI: `claude plugin validate` for the marketplace and each plugin, the Codex marketplace's fields and paths, the
-  plugins' names, and ColdAI's fee settings.
+  `create-clip-wallet`. Pre-release: test networks only, and no external audit. The skill runs `create-clip-wallet`
+  0.2.1 and no other version: it first checks on the npm registry that the package is the kit's own, built and
+  published from Clip Wallet's repository with npm provenance, and stops if it isn't. After the build, the project's
+  `pnpm verify:provenance` checks every kit package's provenance attestation.
+- Listings for Anthropic's and OpenAI's plugin directories. Each plugin folder has a README (what the plugin does and
+  needs, what it runs, fetches and sends, example prompts, support, privacy and licence), a copy of the licence, and
+  its icon. Each `.claude-plugin/plugin.json` adds `displayName`, `homepage`, `repository` and `author.url`. Each
+  `plugin.json` follows the portable Agent Plugins schema, with OpenAI's listing under
+  `extensions."com.openai".interface`. `PRIVACY.md` is the plugins' privacy policy: they send nothing to ColdAI and
+  collect no data.
+- `scripts/pack-openai.sh`, which packs each committed plugin as one ZIP for OpenAI's plugin directory, in `dist/`,
+  and checks what each ZIP holds.
+- CI: `claude plugin validate` for the marketplace, and with `--strict` for each plugin; the Codex marketplace's
+  fields and paths; the plugins' names; ColdAI's fee settings, and the fee's fixed words in the skill, the `exclip`
+  README and its OpenAI listing; and each plugin's directory listing (`scripts/check-listing.mjs`).

PRIVACY.md

@@ -0,0 +1,57 @@
+# Privacy policy
+
+This policy covers the `exclip` and `clip-wallet` plugins for coding agents, published by ColdAI LLC from
+https://github.com/ColdAI-org/coldai-plugins, wherever you install them from: this repository's marketplace,
+Anthropic's plugin directory or OpenAI's.
+
+## What the plugins are
+
+Each plugin is a set of instructions, called a skill, that your coding agent reads and follows. The `exclip` plugin
+also holds one settings file, `platform.json`, with ColdAI's fee settings. The plugins have no server, no code of
+their own that runs, and no telemetry. When you use a skill, your coding agent runs the commands it describes on your
+computer.
+
+## What ColdAI collects through them
+
+Nothing. The plugins send ColdAI no data: not your prompts, your files, your answers to the skills' questions, how you
+use them, or anything about your computer.
+
+## What the commands contact
+
+The commands the skills describe contact these services. Each one's own privacy policy covers what it receives, such
+as your IP address and what you download.
+
+- **Where you install the plugins from**: GitHub, or the plugin directory you use.
+- **GitHub**: `launch-dex` clones ExClip from it. For a Clip Wallet desktop app, installing the project's packages
+  downloads Electron from Electron's releases on GitHub.
+- **The npm registry**: both skills install packages from it, Corepack downloads pnpm from it, and `launch-wallet`
+  reads `create-clip-wallet`'s details and the kit's provenance attestations from it.
+- **Playwright's servers**: if `launch-dex` downloads Chromium for ExClip's screenshots.
+- **The services ExClip uses**: while `launch-dex` checks the fee, and once your DEX is live, ExClip's server may
+  contact the services in ExClip's
+  [architecture notes](https://github.com/ColdAI-org/exclip/blob/main/docs/architecture.md#how-the-parts-talk). On a
+  live DEX, ColdAI's fee is paid on-chain to ColdAI's address on Sonic, and like every on-chain payment, it's public.
+  Nothing else goes to ColdAI.
+- **The services your wallet uses**: set in its `clip.config.ts` and described in the
+  [Clip Wallet kit's docs](https://github.com/ColdAI-org/clip-wallet).
+
+## Your conversation
+
+What you type to your AI app, and what your coding agent reads and writes while it follows a skill, is handled by the
+app's maker under its own privacy policy. ColdAI doesn't receive it.
+
+## Retention
+
+ColdAI receives no data through the plugins, so it keeps none.
+
+## Your choices
+
+You can uninstall either plugin at any time, and decline or stop any command your coding agent runs. The `exclip`
+plugin changes nothing unless you agree to ColdAI's fee.
+
+## Contact
+
+Ask ColdAI about this policy at https://coldai.org/contact. ColdAI's privacy policy for its website and services is
+at https://coldai.org/privacy.
+
+Last changed: 2026-11-07.

README.md

@@ -95,23 +95,54 @@ Wallet kit's starter:
 1. It says that Clip Wallet is pre-release, runs on test networks only and has had no external audit.
 2. It asks for the wallet's name, reverse-DNS id, logo, accent colour and platforms (browser extension, desktop app,
    phone app), the network families you pick, the languages and the homepage.
-3. It runs the kit's documented `npx create-clip-wallet … --yes`, then the new project's checks.
-4. It points to each platform's dev command, and to what's left before shipping.
+3. It checks on the npm registry that `create-clip-wallet` 0.2.1 is the kit's own package, built and published from
+   Clip Wallet's repository with npm provenance, then runs the kit's documented
+   `npx create-clip-wallet@0.2.1 … --yes`. It runs no other version.
+4. It runs the new project's checks, then `pnpm verify:provenance`, which checks every kit package's provenance
+   attestation.
+5. It points to each platform's dev command, and to what's left before shipping.
+
+## Directory listings
+
+Each plugin folder holds what Anthropic's and OpenAI's plugin directories ask for, next to its skills:
+
+- a README for the plugin's page: what it does and needs, what it runs, fetches and sends, example prompts, support,
+  privacy and licence ([exclip](plugins/exclip/README.md), [clip-wallet](plugins/clip-wallet/README.md));
+- `LICENSE`, a copy of this repository's licence, and the plugin's icon, in `assets/`;
+- `.claude-plugin/plugin.json`, the manifest for Claude Code and Anthropic's directory, and `plugin.json`, the portable
+  Agent Plugins manifest for Codex and OpenAI's directory, with OpenAI's listing under
+  `extensions."com.openai".interface`.
+
+Both plugins send nothing to ColdAI and collect no data; [PRIVACY.md](PRIVACY.md) is their privacy policy.
+
+For Anthropic's directory (claude.ai/directory/manage), submit a plugin bundle from this repository with the paths
+`plugins/exclip` and `plugins/clip-wallet`.
+
+For OpenAI's directory, which ChatGPT and Codex share, commit first, then run
+[`bash scripts/pack-openai.sh`](scripts/pack-openai.sh). It packs each committed plugin folder as
+`dist/<name>-<version>.zip`, with `plugin.json` at the ZIP's root, lists each ZIP, and checks that it holds
+`plugin.json`, `skills/`, the icon, the README and the licence. Submit one ZIP per plugin.
 
 ## Maintaining
 
 ```text
 .claude-plugin/marketplace.json     the marketplace, for Claude Code
 .agents/plugins/marketplace.json    the marketplace, for Codex
-plugins/<name>/.claude-plugin/plugin.json   each plugin's manifest, for Claude Code
-plugins/<name>/plugin.json          each plugin's manifest, for Codex
+plugins/<name>/.claude-plugin/plugin.json   each plugin's manifest, for Claude Code and Anthropic's plugin directory
+plugins/<name>/plugin.json          each plugin's manifest, for Codex and OpenAI's plugin directory
 plugins/<name>/skills/<skill>/SKILL.md      the skills, for both
+plugins/<name>/README.md            each plugin's page in the directories
+plugins/<name>/LICENSE              a copy of LICENSE, for each plugin on its own
+plugins/<name>/assets/              each plugin's icon
 plugins/exclip/platform.json        ColdAI's fee settings and the ExClip commit
-scripts/                            the checks CI runs
+PRIVACY.md                          the plugins' privacy policy
+scripts/                            the checks CI runs, and the OpenAI packer
 ```
 
-A plugin's name is the same in all four places: both marketplaces and both of its manifests. Its version is in both
-manifests.
+A plugin's name is the same in all four places: both marketplaces and both of its manifests. Both manifests have the
+same version, description, author, homepage, repository, licence and keywords, and the same display name:
+`displayName` in `.claude-plugin/plugin.json`, and in OpenAI's listing in `plugin.json`. A plugin's `LICENSE` is a
+copy of the root `LICENSE`, byte for byte.
 
 ### Bump the ExClip commit
 
@@ -128,21 +159,32 @@ manifests.
 [`.github/workflows/validate.yml`](.github/workflows/validate.yml) runs on every push to `main` and every pull
 request:
 
-- `claude plugin validate` on the marketplace and on each plugin, with the Claude Code CLI pinned to one version;
+- `claude plugin validate` on the marketplace, and `claude plugin validate --strict` on each plugin, with the Claude
+  Code CLI pinned to one version;
 - [`scripts/check-manifests.sh`](scripts/check-manifests.sh): the Codex marketplace's fields and paths, that each
   plugin's name agrees in both marketplaces and both manifests, each skill's frontmatter, that the `exclip` plugin
-  states ColdAI's fee wherever it describes itself and in the skill's fixed words, and that no description,
-  `launch-dex`'s skill or this README describes a fee split;
+  states ColdAI's fee wherever it describes itself and in the fee's fixed words in its skill, its README and its
+  OpenAI listing, and that no description, listing text, `launch-dex`'s skill, README or `PRIVACY.md` describes a fee
+  split;
 - [`scripts/check-platform.mjs`](scripts/check-platform.mjs): that `platform.json` has exactly its six keys, with
-  ColdAI's address in EIP-55 form, its name, the rate 875, no fee on stock swaps, and a full ExClip commit.
-
-Locally: `claude plugin validate .`, `bash scripts/check-manifests.sh` (needs `jq`) and
-`node scripts/check-platform.mjs`.
+  ColdAI's address in EIP-55 form, its name, the rate 875, no fee on stock swaps, and a full ExClip commit;
+- [`scripts/check-listing.mjs`](scripts/check-listing.mjs): each plugin's directory listing. Its `plugin.json` has the
+  portable schema's keys, OpenAI's listing within its limits, three different example prompts, `https://` links and
+  a brand colour with at least 2:1 contrast against white, and the same shared fields and display name as its
+  `.claude-plugin/plugin.json`. Its icon is a square SVG of at least 48 px. Its README has at least 40 words, the
+  listing's prompts first under "Example prompts", the support and privacy links, and the icon only as a Markdown
+  image. Its `LICENSE` is the root's. No file under `plugins/` is a link or a system file, images are SVG or PNG,
+  other files are under 256 KiB, and every package launcher names one exact version.
+
+Locally: `claude plugin validate .`, `claude plugin validate --strict ./plugins/<name>`,
+`bash scripts/check-manifests.sh` (needs `jq`), `node scripts/check-platform.mjs` and
+`node scripts/check-listing.mjs`.
 
 ## Security
 
 Report a vulnerability privately, as [SECURITY.md](SECURITY.md) says.
 
 ## Licence
 
-These plugins are licensed under the [Apache License 2.0](LICENSE), © 2026 ColdAI LLC.
+These plugins are licensed under the [Apache License 2.0](LICENSE), © 2026 ColdAI LLC. "ExClip", "Clip Wallet" and
+their marks are ColdAI trademarks and aren't licensed under it: section 6 of the licence grants no trademark rights.

plugins/clip-wallet/.claude-plugin/plugin.json

@@ -1,10 +1,14 @@
 {
   "name": "clip-wallet",
+  "displayName": "Clip Wallet",
   "version": "0.1.0",
   "description": "Launch your own non-custodial wallet with the Clip Wallet kit: a browser extension, a desktop app and a phone app under your own name, ids and logo, made with create-clip-wallet. Pre-release: test networks only, and no external audit.",
   "author": {
-    "name": "ColdAI LLC"
+    "name": "ColdAI LLC",
+    "url": "https://coldai.org"
   },
+  "homepage": "https://github.com/ColdAI-org/clip-wallet",
+  "repository": "https://github.com/ColdAI-org/coldai-plugins",
   "license": "Apache-2.0",
   "keywords": ["wallet", "clip-wallet", "create-clip-wallet", "browser-extension", "desktop", "mobile"]
 }