Skip to content

[DOCS + FEATURE] Cross-marketplace plugin dependencies: docs cite an allowlist but never define it #49620

Description

@chrisvaillancourt

Summary

plugin.json dependencies can include a marketplace field to reference
a plugin in another marketplace. The docs say an allowlist gates this
feature but never document it. Users cannot declare cross-marketplace
dependencies.

The documentation gap

From plugin-dependencies.md,
the marketplace field reads:

A different marketplace to resolve name in. Cross-marketplace
dependencies are blocked unless the target marketplace is allowlisted
in the root marketplace's marketplace.json.

Neither plugin-marketplaces.md
nor the plugins reference
specifies:

  • The allowlist's JSON field name in marketplace.json
  • The allowlist entry schema (bare name? owner/repo? source object?)
  • A worked example
  • Whether the mechanism is implemented, stubbed, or admin-only

strictKnownMarketplaces is managed-settings-only and controls which
marketplaces users can add — unrelated to dependency resolution.

Real-world impact

I maintain a private curated marketplace. One of its embedded plugins
needed to extend agents from pr-review-toolkit in
anthropics/claude-plugins-official. Declaring
{"name": "pr-review-toolkit"} failed with
pr-review-toolkit@<my-marketplace> not installed — the resolver
scoped to my own marketplace. I found no documented way to declare a
cross-marketplace dependency.

Workaround: I copied the agent files verbatim under Apache-2.0
attribution, with per-file blob-SHA tracking and drift-detection tooling.
A usable marketplace field would eliminate this overhead.

Requested resolution

One or both of:

  1. DOCS: Specify the allowlist's field name, schema, and an example
    on plugin-marketplaces.md, linked from plugin-dependencies.md.
  2. FEATURE: If the allowlist is not production-ready, add a
    requiredMarketplaces field to marketplace.json that prompts users
    to add any missing companion marketplace at install time.

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    duplicateThis issue or pull request already exists

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions