v0.7.10

Releases four user-facing fixes that were sitting unreleased on main since 0.7.9. Most relevant if you installed via the plugin marketplace — those installs are pinned to the manifest version, so you were stuck on the buggy 0.7.9 until now. (Git-clone users already had these via main.)

Fixed

• Plugin manifest rejected at startup (#42) — plugin.json's repository used the npm {type, url} object form; Claude Code requires a string URL and threw a validation error on every launch. Flattened to a string.
• /plugin marketplace add failed (#36) — marketplace.json was missing the required owner object. Added it; also dropped a stale per-plugin version pin that silently froze marketplace users on an old version.
• publish aborted on modern macOS wrangler (#37) — the CLI hardcoded the legacy ~/.wrangler token path; wrangler 4.x stores it under ~/Library/Preferences/.wrangler. Now resolves the token in wrangler's own precedence, honors CLOUDFLARE_API_TOKEN/CF_API_TOKEN, and doctor reports publish_token_ok instead of falsely saying "logged in."
• Dead Cloudflare onboarding link (404) (#38) — updated to ?to=/:account/workers-and-pages everywhere it was emitted.

Engineering (no behavior change)

Manifest schema + version-drift CI guard (kills the #36/#42 bug class), supply-chain hardening (SHA-pinned actions, least-privilege, ShellCheck), SECURITY.md, CODEOWNERS, issue/PR templates, CodeQL, and Dependabot for GitHub Actions.

Full notes: CHANGELOG.md

🤖 Generated with Claude Code