From 3f871778b82913f238b9d83b672a127e4b4baf68 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 16:23:13 +0000 Subject: [PATCH] Version Packages --- .changeset/gitignore-seed-only.md | 14 ------- .../prevent-default-marketplace-name.md | 30 --------------- packages/cli/CHANGELOG.md | 33 ++++++++++++++++ packages/cli/package.json | 2 +- packages/core/CHANGELOG.md | 38 +++++++++++++++++++ packages/core/package.json | 2 +- 6 files changed, 73 insertions(+), 46 deletions(-) delete mode 100644 .changeset/gitignore-seed-only.md delete mode 100644 .changeset/prevent-default-marketplace-name.md diff --git a/.changeset/gitignore-seed-only.md b/.changeset/gitignore-seed-only.md deleted file mode 100644 index c7c01a7..0000000 --- a/.changeset/gitignore-seed-only.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -'@ai-plugin-marketplace/core': minor ---- - -`aipm init` now seeds a comprehensive `.gitignore` and stops refresh-managing it. - -- **Safety fix:** a fresh `aipm init` previously wrote only a 4-line `.gitignore`, so a brand-new - scaffold could easily commit secrets. The seeded `.gitignore` now ignores `.env*`, `*.log`, - `coverage`, common caches, and `scratch/` (while retaining `node_modules/`, `*.tsbuildinfo`, - `*.local.*`, and `.DS_Store`). Build output (`dist/`) is deliberately still tracked. -- **No more perpetual refresh conflict:** `.gitignore` is now **seed-only** — written by `init` and - owned by the user thereafter. It has been removed from the `aipm init --refresh` managed set - (`.aipm/scaffold.json` now tracks only `.github/workflows/ci.yml`), so user additions to - `.gitignore` are never clobbered or perpetually flagged as conflicts. diff --git a/.changeset/prevent-default-marketplace-name.md b/.changeset/prevent-default-marketplace-name.md deleted file mode 100644 index f498df2..0000000 --- a/.changeset/prevent-default-marketplace-name.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -'@ai-plugin-marketplace/core': minor -'@ai-plugin-marketplace/cli': minor ---- - -Guard against duplicate marketplace names that collide on install, and give `aipm init` a distinct -marketplace name by default. - -Two marketplaces registered under the same `name` collide on install: the later one shadows and -strands the earlier one's plugins. The template historically shipped `marketplace.name = -"ai-plugin-marketplace"` (the upstream's own name), so forks that never renamed it collided with -upstream. These two changes make that failure mode hard to fall into. - -- **`aipm validate` warns on a default/placeholder marketplace name.** A new soft (warning-only) - `default-marketplace-name` finding fires when the repo's effective marketplace `name` is a known - placeholder (`ai-plugin-marketplace`, `my-ai-plugins`) or its `owner.name` is a placeholder - (`AI Plugin Marketplace Template`, `Your Name`). The effective identity is read from - `aipm.workspace.ts` when present, otherwise from a committed repo-root registry's top-level - `name`/`owner.name`; when no marketplace metadata is declared, nothing is emitted. The finding is - always soft — it never fails `aipm validate` — and includes a hint to rename to a unique value - (convention `"-ai-plugins"`). - -- **`aipm init --name ` and a distinct default marketplace name.** `aipm init` now writes a - named marketplace into both repo-root registries - (`{ "name", "owner": { "name" }, "plugins": [] }`) instead of a nameless `{ "plugins": [] }`. The - marketplace name defaults to `${USER}-ai-plugins` (falling back to the `my-ai-plugins` placeholder - when `$USER` is unset, which `aipm validate` then flags as a nudge to set a real name) and can be - overridden with `aipm init --name `. A new `InitOptions.marketplaceName` carries the - resolved name; the default is resolved at the I/O boundary so the file-templating layer stays a - pure function of its inputs. diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 080c1d6..664e486 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,38 @@ # @ai-plugin-marketplace/cli +## 0.3.0 + +### Minor Changes + +- [#22](https://github.com/ai-plugin-marketplace/tools/pull/22) [`5795854`](https://github.com/ai-plugin-marketplace/tools/commit/57958544cd2684690bd680c2014fde27bca4f7e9) Thanks [@mike-north](https://github.com/mike-north)! - Guard against duplicate marketplace names that collide on install, and give `aipm init` a distinct + marketplace name by default. + + Two marketplaces registered under the same `name` collide on install: the later one shadows and + strands the earlier one's plugins. The template historically shipped `marketplace.name = +"ai-plugin-marketplace"` (the upstream's own name), so forks that never renamed it collided with + upstream. These two changes make that failure mode hard to fall into. + - **`aipm validate` warns on a default/placeholder marketplace name.** A new soft (warning-only) + `default-marketplace-name` finding fires when the repo's effective marketplace `name` is a known + placeholder (`ai-plugin-marketplace`, `my-ai-plugins`) or its `owner.name` is a placeholder + (`AI Plugin Marketplace Template`, `Your Name`). The effective identity is read from + `aipm.workspace.ts` when present, otherwise from a committed repo-root registry's top-level + `name`/`owner.name`; when no marketplace metadata is declared, nothing is emitted. The finding is + always soft — it never fails `aipm validate` — and includes a hint to rename to a unique value + (convention `"-ai-plugins"`). + - **`aipm init --name ` and a distinct default marketplace name.** `aipm init` now writes a + named marketplace into both repo-root registries + (`{ "name", "owner": { "name" }, "plugins": [] }`) instead of a nameless `{ "plugins": [] }`. The + marketplace name defaults to `${USER}-ai-plugins` (falling back to the `my-ai-plugins` placeholder + when `$USER` is unset, which `aipm validate` then flags as a nudge to set a real name) and can be + overridden with `aipm init --name `. A new `InitOptions.marketplaceName` carries the + resolved name; the default is resolved at the I/O boundary so the file-templating layer stays a + pure function of its inputs. + +### Patch Changes + +- Updated dependencies [[`bbaeaed`](https://github.com/ai-plugin-marketplace/tools/commit/bbaeaedf6c087c325b696863778216b648ef1ddf), [`5795854`](https://github.com/ai-plugin-marketplace/tools/commit/57958544cd2684690bd680c2014fde27bca4f7e9)]: + - @ai-plugin-marketplace/core@0.4.0 + ## 0.2.0 ### Minor Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index ab8ab12..52c1fae 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@ai-plugin-marketplace/cli", - "version": "0.2.0", + "version": "0.3.0", "description": "Command-line interface for the AI plugin marketplace toolkit. Provides the `aipm` binary.", "type": "module", "author": "Mike North ", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 03ee631..4df5342 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,43 @@ # @ai-plugin-marketplace/core +## 0.4.0 + +### Minor Changes + +- [#20](https://github.com/ai-plugin-marketplace/tools/pull/20) [`bbaeaed`](https://github.com/ai-plugin-marketplace/tools/commit/bbaeaedf6c087c325b696863778216b648ef1ddf) Thanks [@mike-north](https://github.com/mike-north)! - `aipm init` now seeds a comprehensive `.gitignore` and stops refresh-managing it. + - **Safety fix:** a fresh `aipm init` previously wrote only a 4-line `.gitignore`, so a brand-new + scaffold could easily commit secrets. The seeded `.gitignore` now ignores `.env*`, `*.log`, + `coverage`, common caches, and `scratch/` (while retaining `node_modules/`, `*.tsbuildinfo`, + `*.local.*`, and `.DS_Store`). Build output (`dist/`) is deliberately still tracked. + - **No more perpetual refresh conflict:** `.gitignore` is now **seed-only** — written by `init` and + owned by the user thereafter. It has been removed from the `aipm init --refresh` managed set + (`.aipm/scaffold.json` now tracks only `.github/workflows/ci.yml`), so user additions to + `.gitignore` are never clobbered or perpetually flagged as conflicts. + +- [#22](https://github.com/ai-plugin-marketplace/tools/pull/22) [`5795854`](https://github.com/ai-plugin-marketplace/tools/commit/57958544cd2684690bd680c2014fde27bca4f7e9) Thanks [@mike-north](https://github.com/mike-north)! - Guard against duplicate marketplace names that collide on install, and give `aipm init` a distinct + marketplace name by default. + + Two marketplaces registered under the same `name` collide on install: the later one shadows and + strands the earlier one's plugins. The template historically shipped `marketplace.name = +"ai-plugin-marketplace"` (the upstream's own name), so forks that never renamed it collided with + upstream. These two changes make that failure mode hard to fall into. + - **`aipm validate` warns on a default/placeholder marketplace name.** A new soft (warning-only) + `default-marketplace-name` finding fires when the repo's effective marketplace `name` is a known + placeholder (`ai-plugin-marketplace`, `my-ai-plugins`) or its `owner.name` is a placeholder + (`AI Plugin Marketplace Template`, `Your Name`). The effective identity is read from + `aipm.workspace.ts` when present, otherwise from a committed repo-root registry's top-level + `name`/`owner.name`; when no marketplace metadata is declared, nothing is emitted. The finding is + always soft — it never fails `aipm validate` — and includes a hint to rename to a unique value + (convention `"-ai-plugins"`). + - **`aipm init --name ` and a distinct default marketplace name.** `aipm init` now writes a + named marketplace into both repo-root registries + (`{ "name", "owner": { "name" }, "plugins": [] }`) instead of a nameless `{ "plugins": [] }`. The + marketplace name defaults to `${USER}-ai-plugins` (falling back to the `my-ai-plugins` placeholder + when `$USER` is unset, which `aipm validate` then flags as a nudge to set a real name) and can be + overridden with `aipm init --name `. A new `InitOptions.marketplaceName` carries the + resolved name; the default is resolved at the I/O boundary so the file-templating layer stays a + pure function of its inputs. + ## 0.3.0 ### Minor Changes diff --git a/packages/core/package.json b/packages/core/package.json index 0b5fd88..288b3fe 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@ai-plugin-marketplace/core", - "version": "0.3.0", + "version": "0.4.0", "description": "Core build pipeline, validation, and scaffolding for the AI plugin marketplace toolkit.", "type": "module", "author": "Mike North ",