[christso]

Changes

Fixes #603.

Align legacy marketplace component discovery with observed Copilot behavior without turning .github/ into a whole-directory copy.

• Resolve skills, commands, agents, hooks and MCP once across file installs, CLI/TUI inventories, MCP-only updates and profiles. strict is not a component allowlist.
• Honor plugin-manifest custom paths, supported inline configurations, explicit empty selections and observed conventional-source precedence. Invalid selected sources fail before mutation; personal configuration and existing ownership remain protected.
• Preserve supported GitHub assistant resources independently of native manifest membership: agents/, instructions/, prompts/, skills/, hooks/, scripts/, tools/, and copilot-instructions.md. Preserve existing GitHub-agent precedence and supporting portable hook resources.
• Keep workflows, plugin metadata and unsupported GitHub entries outside repository overlays. Retain original plugin-relative exclusions, source containment, copy-time safety and client/scope restrictions. hooks:false disables both portable and raw GitHub hooks without dropping other assistant resources.
• Separate manifest-free repository skill layout from GitHub overlay eligibility. Marketplace root skills remain authoritative over unsupported flat children.
• Update public documentation, architecture guidance, workspace schemas and behavioral regressions.

The deliberate PR #443 boundary remains: native plugin components and repository assistant overlays are different sources; repository development configuration is not implicitly distributable. Its undeclared-native-component suppression is replaced by evidence-backed discovery, not by arbitrary directory copying.

Investigation and native evidence

Original suppression: getMarketplaceFileArtifacts in 1.22.0 disabled omitted MCP for strict:false; collectMcpServers then skipped conventional MCP discovery.

Native Copilot 1.0.103 investigation: 72 isolated fixtures, 227 native CLI commands. Covered strict variants; manifest presence and combinations; custom directories/files and inline configurations; empty selections; invalid declarations; source precedence; and local-live versus cloned installs. The original omitted-root-MCP case was also verified with Codex 0.164.0.

Observed legacy precedence:

• Manifests: .plugin/plugin.json, root plugin.json, .github/plugin/plugin.json, .claude-plugin/plugin.json.
• Explicit plugin-manifest skill/command/agent paths replace conventional sources. Skill directories recurse; command/agent directories do not.
• Hooks: explicit plugin-manifest configuration or inline event map; when omitted, hooks.json, then hooks/hooks.json.
• MCP: .mcp.json, .github/mcp.json, plugin-manifest mcpServers, marketplace-entry mcpServers; alternatives, not additive sources.
• Entry-only non-MCP custom paths did not control discovery in the observed loader; put those paths in the plugin manifest.

Copilot marketplace reference, legacy file locations, and AllAgents discovery/migration documentation.

GitHub assistant roots are not synonymous with CI metadata: repository instructions, prompt files, and custom agents. Their supported-root boundary is shared in GITHUB_ASSISTANT_ENTRIES.

Native investigation did not invoke authentication, model sessions, MCP connections or hook processors. AllAgents deliberately fails closed on invalid selected configurations even where native readers fall back. No new LSP synchronization, MCP plugin-root environment/cwd substitution, unsupported hook translations, or portable Agent Plugins mcp.json schema support.

Verification on corrected implementation

Bun 1.4.0; heavy work ran in the fixed agent-verification systemd unit under agent-verification.slice.

Check	Observed result
Complete bun test, 203 files	2,524 passed, 7 skipped, 0 failed; 10,802 assertions
bun run typecheck	Passed
bun run lint	Passed with four non-null-assertion warnings in MCP synchronization
bun run build	Passed; self-contained bundle 1,879,484 bytes
Published 1.22.0 → corrected built CLI upgrades	14 cases passed across project and user scope
Fresh corrected built CLI installs	Same 14 cases passed; no workflow/plugin metadata distributed

Real publisher upgrade proof

Used task-owned copies of seven WTG.AI.Prompts plugins and their actual marketplace entries: aim, arch-prc, cargowise, org, skill-usage-metrics, vcs-workflow, and ai-evals. Separate empty HOME/project/client roots for each scope; no publisher repository edits. The baseline was the published allagents@1.22.0 bundle.

70 actual CLI commands registered the local marketplace, installed with 1.22.0, updated the same installation with the corrected dist/index.js, then installed fresh with the corrected CLI:

node <baseline-or-fixed>/dist/index.js --json plugin marketplace add <isolated-catalog> --scope <project-or-user>
node <baseline-or-fixed>/dist/index.js --json update --scope <project-or-user>

All existing supported assistant files and non-JSON portable hook resources retained their paths and SHA-256 bytes. No previously installed assistant resource disappeared or changed. Fresh installs contained no .github/workflows/, .github/plugin/, or corresponding .copilot/ metadata.

Ownership limit observed: six user-scope baseline installations had one legacy metadata file that was not removed by the update. It was not newly distributed by the corrected CLI; fresh installs omitted it. Previously untracked/user-owned files are not claimed for deletion.

Earlier publisher comparison exposed agent/instruction/prompt/script/tool losses and portable hook resource removal. The corrected regressions cover strict variants, manifest-addition updates, assistant-root filtering, excluded/unsafe sources, hook opt-out, GitHub-agent precedence and profile materialization. The full suite also exposed the overloaded GitHub/root-skill flag; separating those states restored the existing root-skill inventory contract.

Earlier built CLI evidence additionally covered four-client MCP configuration preservation, custom component replacement, invalid-source rollback, hook opt-out, plugin removal, profile install/remove and TUI skill inventory/update. Remote CI for the new commit, authenticated MCP connectivity and Windows-only runtime behavior are not claimed here.

Local evidence: /tmp/allagents-native-full-evidence.json, /tmp/allagents-full-built-evidence.json, /tmp/allagents-full-tui-evidence.json, /tmp/allagents-604-ci-smoke-evidence.json, /tmp/allagents-604-review-smoke-evidence.json, /tmp/allagents-publisher-upgrade-evidence.json, and /tmp/allagents-assistant-upgrade-fixed-evidence.json. Temporary smoke scripts, dependency installs and fixtures were removed.

Release and shipping

PR title remains feat(plugin): align legacy marketplace component discovery with Copilot. The earlier release-please 17.11.2 smoke parsed this as non-breaking feat and calculated 1.22.0 → 1.23.0 using repository configuration. No manual version, tag or CHANGELOG changes. Release Please finalizes the release through its generated PR. Nothing is merged by this task.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	f5ddd65
Status:	✅  Deploy successful!
Preview URL:	https://7ffdf47e.allagents.pages.dev
Branch Preview URL:	https://fix-marketplace-mcp-discover.allagents.pages.dev

View logs

[christso]

Dogfooded candidate 93d75c1f39ef4eca1c789596fb49feaba1f99cdd through an actual remote marketplace and plugin in isolated client homes. No regression found; no code changes were needed.

• All five expected skills installed and matched the fetched source content.
• MCP configuration used the expected endpoint and schema for Claude, Copilot, Codex, and VS Code.
• A repeated update preserved skill content, MCP configuration, and ownership tracking.
• Skill/MCP exclusions, hooks: false, uninstall, and reconciliation worked. An unrelated user-owned MCP entry and configuration markers survived and were never claimed by AllAgents.
• A separate test plugin exercised hook-resource removal while preserving assistant instructions. Unsupported workflows stayed excluded.

Detailed source revisions, private repository names, endpoints, and the original machine-readable receipt are retained in the private research archive. This anonymized summary replaces the earlier detailed comment.

No authenticated MCP calls, model sessions, or hook execution were tested. No full-suite rerun was performed.