pftom
3b167b6921
- Introduced the `@open-design/registry-protocol` package, enabling improved interactions with plugin registries. - Updated the `typecheck` script in the daemon's `package.json` to include the new registry protocol. - Enhanced the CLI with new flags and commands for better plugin management, including `yank` and additional marketplace functionalities. - Implemented a plugin lockfile system to manage installed plugins and their versions, improving reliability during upgrades. - Added new marketplace doctor functionality to validate plugin entries and ensure compliance with registry standards. This update significantly enhances the plugin ecosystem by providing robust registry interactions and improved management capabilities.
1.9 KiB
Publishing An Open Design Plugin
Open Design registry publishing is GitHub-backed in v1. The CLI remains the canonical workflow; the product UI and agent flows wrap these commands.
1. Scaffold
od plugin scaffold --id vendor/plugin-name --title "Plugin name" --out ./plugins/community
Public registry IDs must use vendor/plugin-name. The generated
open-design.json must include plugin.repo, pointing at the canonical source
repository or subdirectory.
2. Validate And Pack
od plugin validate ./plugins/community/plugin-name
od plugin pack ./plugins/community/plugin-name --out ./dist
The registry accepts anything that validates and packs. The source repository
does not need a special layout beyond SKILL.md plus open-design.json.
3. Authenticate
od plugin login
od plugin whoami --json
These commands wrap GitHub CLI. Tokens stay in gh; Open Design does not store
GitHub credentials.
4. Publish
od plugin publish vendor/plugin-name --to open-design --repo https://github.com/vendor/plugin-name
v1 opens the GitHub registry review flow. The publish payload includes the
plugin ID, version, repo, capability summary, package digest, and registry entry
path. After merge, CI regenerates open-design-marketplace.json.
5. Install From The Registry
od marketplace refresh official
od plugin install vendor/plugin-name
od plugin info vendor/plugin-name --json
Installs preserve marketplace provenance, resolved source, manifest digest, and
archive integrity. official and trusted sources install as trusted;
restricted sources stay restricted until the user grants more trust.
6. Yank A Version
od plugin yank vendor/plugin-name@1.0.0 --reason "Security issue"
Yanking never deletes metadata or bytes. New installs refuse yanked versions; existing exact lockfile replays can still warn and proceed if the archive remains reachable and integrity matches.