chore(external): bump rayfin plugin to 0.4.0

[chcaru]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Version bump for the already-listed rayfin external plugin, approved in #2836. No new listing.

• version: 0.3.0 to 0.4.0
• source.ref: plugin-v0.3.0 to plugin-v0.4.0

The new tag points at 0b06bcf on microsoft/rayfin's default branch.

Two user-facing fixes ship in 0.4.0, both reported by a reviewer against the listed 0.3.0:

1. The getting-started skill now sources its default template from the microsoft/awesome-rayfin gallery instead of a personal repository, so the template it points users at is governed and carries its own license.
2. The documented scaffold command is back on a single line. It previously used a trailing \ line continuation, which is a bash construct that PowerShell does not honor: the line fails to parse with Missing expression after unary operator '--', so the command died before npx ran for anyone on Windows.

The bundled getting-started skill also moves 0.1.0 to 0.2.0, since its documented behavior changed.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

plugins/external.json is the only hand-edited file. .github/plugin/marketplace.json is regenerated output from npm run build, not a manual edit.

npm run plugin:validate passes: external.json is valid (50 external plugins), All 99 plugins and the external catalog are valid.

The diff is four lines, two per file, all within the rayfin entry. Worth noting for review that "version": "0.3.0" appears three times in external.json across unrelated listings, so the edit was scoped to the rayfin entry rather than applied as a file-wide replacement.

plugin-v0.4.0 is a lightweight tag on a commit, matching how plugin-v0.3.0 was cut.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

✅ External plugin PR checks passed

• Changed entries detected: 1
• Workflow state label: ready-for-review
• Status legend: ✅ pass · ⚠️ warning · 🛑 fail

Per-plugin quality summary

Plugin	spec compliance (non-blocking)	vally lint	install smoke test	version match	ref/sha consistency	canvas structure	overall	source tree
rayfin	✅ pass	✅ pass	✅ pass	✅ pass	⚪ not_run	⚪ not_run	✅ pass	plugin-v0.4.0

Gate output details

rayfin - spec compliance (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

rayfin - vally lint (✅ pass)

✅ rayfin-getting-started (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

rayfin - install smoke test (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-aiXAEH/copilot-home/.copilot/installed-plugins/external-plugin-intake/rayfin/plugin.json.

rayfin - version match (pass)

- plugin-v0.4.0: matched version "0.4.0" at "plugin.json".

rayfin - ref/sha consistency (not_run)

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

rayfin - canvas structure (not_run)

Canvas structure gate skipped because plugin is not tagged with "canvas".

- rayfin: spec=pass, vally-lint=pass, install-smoke=pass, version-match=pass, ref-sha-consistency=not_run, canvas-structure=not_run, overall=pass

[Copilot]

🟢 Approval recommended

The version and supported immutable tag are updated consistently across canonical and generated metadata.

Pull request overview

Updates the Rayfin external plugin listing to version 0.4.0 and refreshes generated marketplace metadata.

Changes:

• Bumps Rayfin from 0.3.0 to 0.4.0.
• Updates the source tag to plugin-v0.4.0.

File summaries

File	Description
plugins/external.json	Updates canonical Rayfin metadata.
.github/plugin/marketplace.json	Updates generated marketplace metadata.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aaronpowell]

/approve

[aaronpowell]

D'oh, I thought the slash commands worked on PRs too 🤣