Agent Plugins v0.5.0

Agent Plugins v0.5.0

This release introduces a version-aware Agent Plugins conformance architecture while retaining published Agent Plugins 1.0.0 as the default target.

Highlights

• Separates portable client loading, strict authoring, Goose extensions, and release policy.
• Adds a local schema registry and immutable Agent Plugins 1.1.0 draft snapshot; 1.1.0 remains inactive pending publication.
• Adds filesystem-resolved containment and strict symlink-safe packaging.
• Implements fixed portable Skill and mcp.json discovery with component-level failure isolation.
• Adds secure MCP stdio, HTTP, header, environment, placeholder, runtime, and PLUGIN_DATA validation.
• Migrates Goose hooks to extensions/io.github.block.goose/hooks.json with transaction-safe writes and legacy diagnostics.
• Adds a dry-run-first plugin migration workflow with explicit approval and backups.
• Adds an immutable conformance fixture matrix and adversarial security coverage.

Validation

• agent-creator: 12/12 tests
• hook-creator: 13/13 tests
• plugin-creator: 75 passed, 1 platform-specific skip
• skill-creator: 35/35 tests
• Distribution and offline bundle smoke tests passed
• Source-bound integration: current 11/11 versus v0.4.1 baseline 4/11 (+63.64 percentage points)
• Four current component receipts passed
• Release gates and human review passed
• Archive integrity: 978 canonical files

Archive

agent-plugins.zip SHA-256:

d2183c8fb4d917461066b4e557dd583fdecc0422fbdd0db5ced9311834979519

v0.4.1

Agent Plugins v0.4.1

This patch release makes creator evaluations autonomous, executable, and reproducible.

Highlights

• Replaces ambiguous prompts such as “this Skill” or “this plugin” with explicit structured targets and real fixture paths.
• Adds immutable evaluation fixture libraries for Skill, agent, hook, and plugin creators.
• Adds durable eval sets for agent-creator and hook-creator, and rewrites the plugin-creator and skill-creator sets.
• Introduces explicit scenario metadata: subject, language, target, execution level, preconditions, capabilities, budget, assertions, and coverage tags.
• Distinguishes explain, dry-run, execute, and resume scenarios so graders cannot require hidden execution.
• Prohibits hidden grading criteria and requires newly discovered criteria to be added in a later paired iteration.
• Adds source/baseline provenance and realistic turn/timeout budget guidance.
• Makes the agent evaluation runner stage declared fixtures in isolated temporary projects and preserve scenario context in metadata.
• Adds cross-creator distribution tests and verifies evaluation assets in offline and standalone packages.

Fixtures

The release includes known valid and invalid examples for:

• Agent Skill frontmatter errors and current/baseline Skill comparisons;
• supported and unsupported Goose custom-agent definitions;
• safe and unsafe blocking hooks with inert allow/block payloads;
• schema-minimal, package-ready, partial, and multi-component Open Plugins;
• partial and complete evaluation workspaces.

Validation

• agent-creator: 12/12 tests
• hook-creator: 9/9 tests
• plugin-creator: 25/25 tests
• skill-creator: 35/35 tests
• distribution: 11/11 tests
• all four evaluation designs: pass, zero warnings
• all four component behavior gates: 100%, non-regression vs v0.4.0
• deterministic integration: 100% current vs 0% v0.4.0 baseline
• offline bundle and archive integrity: pass, 913 canonical files

Asset

agent-plugins-v0.4.1.zip is the self-contained plugin archive.

SHA-256: e61217a91ba81a90b3d23d278168db30efa05ea289ce0ee5951c72bac39d0617

v0.4.0

Agent Plugins v0.4.0

This release strengthens creator routing, Agent Skill authoring quality, and reproducible evaluation workflows.

Highlights

• Reworks skill-creator into a concise progressive-disclosure router with focused references for authoring, auditing, evaluation design, prompt engineering, improvement, and release.
• Adds deterministic audit, design-evals, analyze, and resumable full-eval workflows with stable machine-readable results.
• Adds rule-rich domain coverage: rule-space matrices, automation boundaries, coverage-tagged scenarios, bounded semantic residuals, and breadth-first delivery.
• Adds resumable plugin-level full-eval orchestration with source-bound component receipts and integration gates.
• Improves concise, intent-oriented descriptions and routing boundaries across all four creator Skills.
• Makes AGENTS.md the sole repository instruction convention and removes host-specific instruction/configuration files.
• Hardens packaging against repository-local hidden metadata while retaining portable maintained content.

Evaluation

All release gates passed with explicit human-review approval:

Component	Current	Baseline	Delta
agent-creator	88.9%	77.8%	+11.1 points
hook-creator	88.9%	55.6%	+33.3 points
plugin-creator	100.0%	50.0%	+50.0 points
skill-creator	100.0%	63.9%	+36.1 points
Cross-component integration	93.8%	81.3%	+12.5 points

Trigger-evaluation F1 scores range from 0.833 to 1.000 with sibling near-misses included.

Validation

• All four creator builds passed.
• All creator and distribution tests passed.
• Agent Plugins 1.0.0 schema and Goose operational validation passed.
• Source-bound component, integration, archive, regression, and human-review gates passed.
• Offline archive smoke and integrity checks passed with 851 canonical files.

Asset

agent-plugins-v0.4.0.zip is the self-contained plugin archive.

SHA-256: d5addbefb1b05e00a6b1cec47cc07c5d5e7acbf7a2e0759b0f22af9d48701561

v0.3.0

Agent Plugins v0.3.0

This release turns the creator collection into an offline-ready, release-gated Agent Plugins distribution.

Highlights

• Renames the plugin identity and namespace to agent-plugins and adds the canonical Agent Plugins 1.0.0 schema declaration.
• Ships unified CLIs and compiled TypeScript runtimes for skill, agent, hook, and plugin creation.
• Vendors production dependencies so installed creators work without network access.
• Adds deterministic schema, package, archive-integrity, evaluation-receipt, and release-gate verification.
• Adds paired behavioral-evaluation contracts, benchmark aggregation, and static review viewers.
• Hardens packaging against path traversal, symbolic links, stale receipts, stale benchmark provenance, and incomplete offline bundles.
• Refines unfinished-placeholder detection to catch contextual TODO/FIXME/TBD markers without flagging documentation or detector code.

Validation

• All four creator builds passed.
• All creator and distribution tests passed.
• Agent Plugins schema and Goose operational validation passed.
• Offline installation/package smoke test passed with 832 packaged files.

Asset

agent-plugins-v0.3.0.zip is the self-contained plugin archive.

SHA-256: a207c581ca832a669934edf2ab53bfcc9a2c8e57cc31b7b3870f26c82c08fc05

v0.2.1

Open Agent Creators plugin v0.2.1.

Changes since v0.2.0

• Explicit skill-to-skill dependency contracts. Each of the 4 creators
  (plugin-creator, skill-creator, hook-creator, agent-creator) now declares,
  in its own SKILL.md, exactly when it depends on another creator, why, and
  what must be true before handing work back — modeled on product-design's
  router pattern. plugin-creator's former informal 'Component routing' note
  is now a when/why/success-criteria table; the other three each gained a
  'Plugin Dependency' section clarifying their standalone-vs-plugin-bundled
  behavior (hook-creator, uniquely, has no standalone mode at all).
• Backlog tracking (Beads) initialized for this plugin, recording two
  known trigger-quality issues surfaced by running a structured eval for
  the first time: hook-creator under-triggers on its own core use cases
  (open-agent-creators-nm3), and skill-creator has both false negatives and
  false positives, a more serious pattern (open-agent-creators-dgl).

No functional script changes since v0.2.0 (still the TypeScript migration
completed there) — this release is documentation and process only.

Archive contains plugin runtime content (dist/ + production-only
node_modules/ per creator) — development-only files (root/per-skill
AGENTS.md, .vscode/, tests/, .beads/, .claude/, .codex/, TypeScript
devDependencies) are excluded. Verified offline: extracted and validated
with an isolated $HOME simulating a fresh machine.

v0.2.0

Open Agent Creators plugin v0.2.0 — Python to TypeScript migration.

Why

A user reported ModuleNotFoundError: no module named encoding running this plugin's Python
scripts on another machine. Root cause: the only external dependency across all 4 creators was
PyYAML (used in 2 files for simple frontmatter parsing), and it wasn't guaranteed to be present
or installable (no network) on every machine.

What changed

Every script in hook-creator, agent-creator, plugin-creator, and skill-creator is
rewritten from Python to TypeScript, compiled to plain JavaScript. Runtime dependencies
(js-yaml, adm-zip) are vendored as production-only node_modules directly in this
release archive — no npm install, no network access, no PyYAML required on the target
machine. Verified end-to-end: extracted this exact archive and ran every script with an
isolated $HOME (simulating a machine with no prior Node/npm config) — everything works offline.

• node_modules is relocatable by design (unlike a Python venv's absolute shebangs), so this
  archive can be copied anywhere and still resolves its dependencies correctly.
• js-yaml and adm-zip are pure JavaScript — no native/platform-specific binaries, unlike
  PyYAML's optional libyaml C extension.
• All 23 existing tests (ported from Python's unittest to Node's built-in node --test,
  which runs .ts natively on Node 22+) pass. plugin-creator's validator output is verified
  byte-for-byte identical to the old Python version on both this plugin and product-design.
  generate_report's HTML output is verified byte-for-byte identical to Python on test fixtures.

Requirements

Node.js 22+ only. Python is no longer required to use this plugin.

Release archive contains plugin runtime content plus vendored dist/ and production-only
node_modules/ per creator — development-only files (root AGENTS.md, .vscode/, tests/,
per-skill AGENTS.md, TypeScript devDependencies) are excluded.

⚠️ Superseded by v0.2.1 — this release predates the explicit skill-dependency documentation and backlog tracking. Use v0.2.1 or later.

v0.1.1

Open Agent Creators plugin v0.1.1.

Fix: restore plugin-qualified skill references (open-agent-creators:skill-creator, etc.) in
documentation and cross-skill routing prose. Goose automatically prefixes every skill in an
installed plugin with the plugin name (<plugin-name>:<skill-name>) — this must be
anticipated in prose that references a skill by its runtime-loadable name. Skill directory
names and SKILL.md frontmatter name: fields remain unqualified, per the Agent Skills
specification; only the runtime-loadable name is plugin-qualified.

Release archive contains only plugin runtime content (plugin.json, README.md, LICENSE,
skills/) — development-only files (AGENTS.md, .vscode/, tests/, pycache/) are excluded.

⚠️ Superseded by v0.2.0 — this release still used Python scripts with a PyYAML dependency that could fail on machines without network access to install it. Use v0.2.0 or later (TypeScript, no Python required).

v0.1.0

Open Agent Creators plugin v0.1.0.

Includes: skill-creator, agent-creator, hook-creator, plugin-creator.

Release archive contains only plugin runtime content (plugin.json, README.md, LICENSE, skills/) — development-only files (AGENTS.md, .vscode/, tests/, pycache/) are excluded.

⚠️ Superseded by v0.1.1 — this release used unqualified skill names in documentation, which do not match how Goose actually loads plugin skills (auto-prefixed with the plugin name). Use v0.1.1 or later.