[011235813]

Motivation

• Claude directory review
  • Problem: the box-offload skill runs the CLI as npx -y @simular-ai/box@^0.2.0. A range lets npx pull a version published after review, so the directory review flags it.
  • Solution: pin the exact version, @simular-ai/box@0.2.0, and have CI keep the pin equal to cli/package.json.

Changes

• claude/skills/box-offload/SKILL.md: ^0.2.0 → 0.2.0.
• claude/.claude-plugin/plugin.json: plugin version 0.2.0 → 0.2.1 so users pick up the change.
• publish-cli.yml: new step in the plugin job that fails when any @simular-ai/box@… in claude/ differs from the version in cli/package.json.
• README.md: release steps say to bump the CLI version, the skill pin and the plugin version in the same PR, then tag right after the merge.

Wiring block diagram

cli/package.json "version" ──┐
                              ├─► CI step: equal? ─► pass / fail
claude/**  @simular-ai/box@X ─┘
claude skill ─► npx -y @simular-ai/box@X (exact, from npm)

Interactions

• A CLI release now has to update the skill pin in the same PR, or the plugin job fails. Between merge and the tag publishing to npm, the pin names a version that isn't on npm yet, so tag right after merging.
• The CLI's own printed hints (npx @simular-ai/box ... in cli/src) stay unpinned. They are CLI output, not plugin files, so the review doesn't cover them.

Tests

• CI "Validate plugin folders" passes on this PR.
• Locally: change the skill back to ^0.2.0, run the step's three lines from the repo root, and check that it prints the offending line and exits 1.
• In Claude Code, /plugin marketplace update simular-box, /plugin update box@simular-box, then /box:offload in a test repo and check that it runs npx -y @simular-ai/box@0.2.0.

🤖 Generated with Claude Code