0.14.1 — Claude marketplace sources from the native registry

0.14.1 — Claude marketplace sources from the native registry

An endpoint scan found the marketplace source of an installed Claude plugin
only when Claude settings declared that marketplace. Most marketplaces are
added with /plugin marketplace add, which records them in Claude's own
registry, not in settings. So most installed plugins had no source. This
release reads that registry too.

Highlights

• Installed Claude plugins get their marketplace source from
  plugins/known_marketplaces.json. In endpoint mode, a marketplace that
  settings do not declare is looked up by its exact key in that file, under
  the selected Claude configuration root. A registration in settings still
  takes precedence, also when it is malformed or unsupported. A missing,
  invalid, credential-bearing or ref-qualified source stays unmatched. The
  scanner never infers a source from a marketplace name. On one maintainer
  endpoint, 17 of 17 installed plugins now carry
  openaca:marketplace_source_digest, against 4 of 17 in 0.14.0.

Install

uv tool install openaca==0.14.1 or pip install openaca==0.14.1.

Compatibility

Pre-V0 — no back-compatibility hedging.

• More Claude plugins match a marketplace source. An admission entry that
  names a marketplace source now also matches a plugin from a marketplace that
  only Claude's registry records. Before, such a plugin fell to the default.
• A malformed known_marketplaces.json is a scan warning. The plugin then
  has no source. The scan continues.
• Repository mode, Cursor, Codex and Devin are unchanged.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.