Create a local Codewhale plugin bundle with a versioned manifest and Skills named with the plugin prefix. Validate its structure and present review results so a person can decide whether to trust and enable it.
中文简介正在准备中。当前显示英语简介。
Scaffold a local Codewhale plugin bundle with a versioned manifest, namespaced Skills, and an explicit trust review.
安装前可以查看交给 AI 代理的指令内容。
Use this skill when a user wants a local Codewhale plugin bundle. Trusted and
enabled bundles may add declarative Skills, commands, agents, hooks, and MCP
servers (stdio and remote) through the existing engines. LSP, filesystem
roots, and lifecycle mutation are inventory-only. Native extensions (host
code) are inventory-only unless the user has turned on the experimental
[features] extension_host flag.
~/.codewhale/plugins/<plugin-name>/<workspace>/.codewhale/plugins/<plugin-name>/plugin.json (Agent Plugins v1.0.0; a legacy plugin.toml stays
readable, but new bundles use plugin.json):{
"$schema": "https://agent-plugins.org/schemas/plugin.json",
"name": "my-plugin",
"version": "0.1.0",
"description": "What this bundle provides"
}
skills/<skill-name>/SKILL.md; Codewhale finds
skills/ automatically and exposes each as my-plugin:<skill-name>,
never as an unqualified command.mcp.json only when the bundle needs an
existing MCP engine. Keep stdio commands and paths inside the bundle. Map local
environment values only as exact ${SOURCE_ENV} references. For remote MCP,
use HTTPS (or loopback HTTP), forbid URL user information/query/fragment,
use only environment-backed headers or bearer tokens, and declare the exact
normalized endpoint host set in capabilities.network_hosts under
extensions["net.codewhale"]. Never place credentials in the manifest.commands/*.md), agents (agents/*.toml), and hooks
(hooks/*.toml), declared under extensions["net.codewhale"], activate
under the current policy — workspace bundles win same-name collisions over
user and built-in bundles. LSP, filesystem roots, and lifecycle mutation
are inventory-only: declare them only when inventorying future work. A
native entry runs only under the experimental extension host; there it
must be one .mjs, .js or .mts ES module file, /plugin validate rejects
anything else, and its tools always use Required approval, never a
plugin's read-only hint. Full Access, Bypass, or an exact session grant
for the reviewed build can satisfy that gate without a prompt. A bundle
that declares only unsupported surfaces cannot be enabled./plugin validate <plugin-name>/plugin show <plugin-name>/plugin enable <plugin-name>
to open the content/capability review, reviews it, runs the exact
/plugin trust ... confirmation shown, then enables the bundle/skills inspect reports plugin provenance and /plugin list
reports the expected trust and activation state. Trust stages the reviewed
content but does not activate it. After enablement, follow the host's
reload notice: use /reload or a new session to apply changes to a live
session's pinned skills and tools.Every user and workspace bundle starts untrusted and disabled. Reuse the
existing /plugin marketplace, install, update, review and reload surfaces;
do not add a parallel installer, registry or automatic trust flow. Catalog
membership alone never installs, trusts or enables a plugin.
Only scaffold host code when the person explicitly uses the experimental
extension-host feature. Start from the tested hello-extension example and
docs/EXTENSIONS.md in the Codewhale repository. A typed .mts entry may use
Node's erasable TypeScript syntax; bundle dependencies locally. Register tools
with a plugin-specific prefix and an object input schema, propagate
exec.signal, and use ctx.effect for bounded asynchronous cleanup. The
current execution context exposes signal, callId and args; it does not
expose the calling workspace path. Do not change the shared process cwd.
Stop after install, validate and show; never automate the trust token. A
person reviews, trusts and enables the bundle. /plugin show <name> reports
owner state, live tools and recent attributed diagnostics. Recovery may create
fresh registrations, but never replays an interrupted tool call. Explain the
shared-process and current platform sandbox limits without claiming isolation.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Split a large goal into clearly bounded tasks that can run in parallel. Coordinate existing agent and worktree tools, then combine and verify the results. The skill starts only when explicitly requested.
中文简介正在准备中。当前显示英语简介。
Generate independent options for design, implementation, explanations, or debugging, then compare them using one shared rubric. Code candidates use separate working copies and undergo independent verification before a winner is presented for review.
中文简介正在准备中。当前显示英语简介。
Check Codewhale release readiness through ordered tests, builds, version checks, and manual terminal checks. Record command results and observed behavior, including responsiveness, route isolation, and follow-up input handling, while explicitly identifying any skipped checks.
中文简介正在准备中。当前显示英语简介。
Operate desktop apps and isolated browsers on registered computers by inspecting interface controls, entering information, and checking results. The skill also covers screenshots and recording, with separate routing for the user's signed-in Chrome through Chromewhale.
中文简介正在准备中。当前显示英语简介。
Check a local Codewhale checkout before contributing: inspect branch and sync status, build the CLI, and run the repository’s CI checks. Present recent commits and changelog entries from local files, with clear status for each step.
中文简介正在准备中。当前显示英语简介。
Builds and installs Codewhale with a source revision identifier, then verifies the installed version in a fresh shell. It guides hands-on runtime checks for interface behavior, routing, approvals, and other changes that automated tests may miss.
中文简介正在准备中。当前显示英语简介。