fix(plugin): enable EverMind by default and complete host manifests

.codebuddy-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "name": "skillcorpus",
+  "description": "SkillCorpus plugins marketplace.",
+  "owner": {
+    "name": "EverMind AI",
+    "url": "https://evermind.ai"
+  },
+  "plugins": [
+    {
+      "name": "skillsearch",
+      "description": "Per-turn skill retrieval for WorkBuddy.",
+      "source": "./skillcorpus_plugin/plugin-workbuddy",
+      "version": "0.2.0",
+      "category": "skill"
+    }
+  ]
+}

.github/workflows/plugin-ci.yml

@@ -4,11 +4,13 @@ on:
   pull_request:
     paths:
       - "skillcorpus_plugin/**"
+      - ".codebuddy-plugin/**"
       - ".github/workflows/plugin-ci.yml"
   push:
     branches: [main]
     paths:
       - "skillcorpus_plugin/**"
+      - ".codebuddy-plugin/**"
       - ".github/workflows/plugin-ci.yml"
 
 permissions:
@@ -86,6 +88,10 @@ jobs:
         working-directory: skillcorpus_plugin/${{ matrix.directory }}
       - run: npm run ci
         working-directory: skillcorpus_plugin/${{ matrix.directory }}
+      - name: Verify checked-in WorkBuddy runtime is current
+        if: matrix.directory == 'plugin-workbuddy'
+        run: git diff --exit-code -- dist/hook.mjs
+        working-directory: skillcorpus_plugin/plugin-workbuddy
       - run: node ../scripts/verify_npm_package.mjs .
         working-directory: skillcorpus_plugin/${{ matrix.directory }}
 

.gitignore

@@ -5,6 +5,8 @@ __pycache__/
 *.egg-info/
 build/
 dist/
+!skillcorpus_plugin/plugin-workbuddy/dist/
+!skillcorpus_plugin/plugin-workbuddy/dist/hook.mjs
 
 # top-level inputs/artifacts (private / generated)
 configs/sources.full.yaml

skillcorpus_plugin/.gitignore

@@ -10,3 +10,5 @@ node_modules/
 lib/
 *.tsbuildinfo
 dist/
+!plugin-workbuddy/dist/
+!plugin-workbuddy/dist/hook.mjs

skillcorpus_plugin/CHANGELOG.md

@@ -4,7 +4,17 @@
 
 ### Added
 
-- **Default multi-source retrieval** now searches local skills, EverMind when configured, ClawHub, and skillhub.cn concurrently. Each source contributes at most two candidates; suspicious or malicious entries are rejected, bundles are safely cached, source failures are isolated, and the final gate still selects 0–2 skills. ClawHub and skillhub.cn can each be disabled with an empty endpoint.
+- **A root WorkBuddy marketplace manifest** lets WorkBuddy discover and install
+  Skill Search through its standard marketplace flow. The checked-in
+  `dist/hook.mjs` is part of that marketplace source so GitHub git/ZIP installs
+  contain the command declared by `hooks/hooks.json`. CI rebuilds the bundle
+  and fails if the checked-in runtime is stale.
+
+- **Default multi-source retrieval** now searches local skills, EverMind, ClawHub,
+  and skillhub.cn concurrently. Each source contributes at most two candidates;
+  suspicious or malicious entries are rejected, bundles are safely cached,
+  source failures are isolated, and the final gate still selects 0–2 skills.
+  EverMind, ClawHub, and skillhub.cn can each be disabled with an empty endpoint.
 
 - **PathGuard placeholder resolution** — both engines resolve
   `{{SKILL_DIR}}`, `{{SKILL_DIR:<name>}}`, `{{AGENT_STATE_DIR}}`,
@@ -293,3 +303,14 @@
   the corpus paper's citation; per-implementation READMEs document the new
   configuration keys, and the cross-implementation equality claim now
   points at the parity suite that enforces it.
+
+## 0.1.0 — 2026-08-25
+
+Initial public release of SkillCorpus Plugins.
+
+- Added the shared Python retrieval engine.
+- Added initial Hermes and Raven adapters.
+- Added TypeScript retrieval support for DeepSeek Harness.
+- Added OpenClaw and WorkBuddy plugin integrations.
+- Added local and SkillHub retrieval, ranking, model gating, and safe bundle
+  extraction.

skillcorpus_plugin/INSTALL.agent.md

@@ -32,13 +32,14 @@ several pass, ask the user.
 | DeepSeek Harness | the workspace you are in has a `cordis.yml` and a `packages/` tree |
 | Raven | `~/.raven/` exists, or `raven` CLI is present |
 
-Also note where this repository is checked out (clone it if the user gave
-you only the URL): every path below is relative to the repository root.
+Note where this repository is checked out (clone it if the user gave you only
+the URL), then change into its `skillcorpus_plugin/` directory. Every relative
+path and command below starts there.
 
 ## WorkBuddy
 
-WorkBuddy installs are file-level marketplace surgery with their own
-playbook: follow [`plugin-workbuddy/INSTALL.agent.md`](plugin-workbuddy/INSTALL.agent.md)
+WorkBuddy installs through its standard plugin marketplace. Its own playbook
+covers discovery and restart verification: follow [`plugin-workbuddy/INSTALL.agent.md`](plugin-workbuddy/INSTALL.agent.md)
 step by step — do not improvise a WorkBuddy install from this file. The
 same rules apply there, plus two stricter ones it states: report each step
 as you finish it, and never route around a failed step.
@@ -140,16 +141,16 @@ report this state and move to verification only for the import check:
 python -c "import skillsearch, skillsearch_raven; print('import ok')"
 ```
 
-## Optional capabilities — ask, don't assume
+## Network and optional model configuration
 
 - **A model for the rewriter and gate**: better selection, two small model
   calls per retrieving turn. Ask the user which model/route to use; leave
   empty if they don't care.
-- **The remote catalog** (`hub_endpoint` / `hubEndpoint`, e.g.
-  `https://skillhub.evermind.ai`): gives the agent 96k community skills, but
-  **sends the retrieval query to that service on every retrieving turn and
-  downloads third-party skill content to disk**. State this plainly and let
-  the user opt in; never enable it silently.
+- **Remote sources are enabled by default**: EverMind SkillHub
+  (`https://skillhub.evermind.ai`), ClawHub, and skillhub.cn each receive the
+  retrieval query and may download candidate skill content to disk. State this
+  plainly during installation. The user can set any endpoint to an empty
+  string to disable that source, or clear all three for local-only operation.
 
 ## Verification — definition of done
 

skillcorpus_plugin/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh.md)
 
-**The official agent-host plugins for [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus): your agent, automatically briefed with the right skills — every turn.** SkillCorpus Plugins watches what the user just asked, retrieves the matching `SKILL.md` skills from a local directory and an optional remote catalog, and puts their bodies in front of the model before it answers. No tool call, no skill name the model has to already know.
+**The official agent-host plugins for [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus): your agent, automatically briefed with the right skills — every turn.** SkillCorpus Plugins watches what the user just asked, retrieves matching `SKILL.md` skills from local directories and three remote sources enabled by default, and puts their bodies in front of the model before it answers. No tool call, no skill name the model has to already know.
 
 A real turn, on WorkBuddy: ask *“帮我生成一个二维码，内容是 https://evermind.ai，存到桌面”*. No QR skill exists on the machine — but the catalog has one, so before the model answers, its context gains:
 
@@ -19,7 +19,7 @@ this directory — use the absolute form for read_file / exec.
 
 The skill's bundled script is already extracted next to it; the model runs it and the QR code lands on the desktop. Without retrieval, the model improvises — `pip install qrcode` and hope.
 
-Works with a directory of your own skills, with [SkillHub](https://evermind.ai/skillhub) — the hosted endpoint over [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus)'s 114,190 vetted, permissively-licensed skills, where that QR skill came from — or both fused into one ranking.
+Works with your own skill directories and with EverMind SkillHub, ClawHub, and skillhub.cn, fused into one ranking. The QR skill above came from [SkillHub](https://evermind.ai/skillhub), the hosted endpoint over [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus).
 
 ## Install — paste this to your agent
 
@@ -39,7 +39,7 @@ The playbook it follows is [`INSTALL.agent.md`](INSTALL.agent.md) — human-read
 
 | Your host | Do this | Details |
 | --- | --- | --- |
-| **WorkBuddy** | build `plugin-workbuddy`, register it as a marketplace, enable — file-level steps an agent does well: paste the prompt in its README | [plugin-workbuddy](plugin-workbuddy#install--paste-this-to-workbuddy) |
+| **WorkBuddy** | add `EverMind-AI/SkillCorpus` in the standard plugin marketplace, install **Skill Search**, then restart | [plugin-workbuddy](plugin-workbuddy#install) |
 | **Hermes** | `pip install ./engine-python && cp -r plugin-hermes "$HERMES_HOME/plugins/skillsearch" && hermes memory setup` | [plugin-hermes](plugin-hermes#install) |
 | **OpenClaw** | `npm install --prefix plugin-openclaw && npm run --prefix plugin-openclaw build`, then two keys in `openclaw.json` | [plugin-openclaw](plugin-openclaw#install) |
 | **DeepSeek Harness** | copy `engine-typescript/` to `packages/skill/skill-search/`, add a `cordis.yml` row | [engine-typescript](engine-typescript#where-this-goes) |
@@ -106,7 +106,7 @@ Full per-host tables live in each plugin's README; these seven decide behaviour
 | Setting | Default | What it decides |
 | --- | --- | --- |
 | `skills_dir` / `skillsDirs` | the host's own skills directory | Where local skills are scanned. Missing directory = the source simply doesn't exist. |
-| `hub_endpoint` / `hubEndpoint` | *(empty)* | EverMind-compatible catalog. Empty disables only this source. |
+| `hub_endpoint` / `hubEndpoint` | `https://skillhub.evermind.ai` | EverMind SkillHub; empty disables only this source. |
 | `clawhub_endpoint` / `clawhubEndpoint` | `https://clawhub.ai` | ClawHub search; empty disables it. |
 | `skillhub_cn_endpoint` / `skillhubCnEndpoint` | `https://api.skillhub.cn` | skillhub.cn search; empty disables it. |
 | `model` (+ host-specific route) | *(empty)* | Enables the query rewriter and the gate. Empty = retrieval runs unfiltered, ranked by keywords. |
@@ -133,8 +133,8 @@ Nothing is added to durable history — the injection is rebuilt per turn and di
 Honest accounting, because retrieval runs on your conversation:
 
 - **Local-only setup (after explicitly disabling the three remote endpoints)** — nothing. Scanning, ranking and injection are all in-process.
-- **Default installation** — ClawHub and skillhub.cn are enabled; the retrieval query is sent to both services. Set their endpoint fields to an empty string to disable either one. With no `model`, no LLM gate runs: only the marketplaces’ own trust flags and the lexical relevance guard apply.
-- **With `hub_endpoint` set** — the retrieval query (your message, or its model-cleaned rewrite) is sent to that catalog on every retrieving turn; selected skills' bodies and bundles are downloaded from it. Bundles are unzipped with path-traversal rejection, an extension allowlist, and 8 MiB/file, 64 MiB/archive caps, into a cache directory outside every scanned skills dir (`~/.workbuddy-ai/skillsearch-bundles`, `~/.skillsearch/hub`, `~/.openclaw/skillsearch-bundles`, or `~/.dsh/skillsearch-bundles` by default).
+- **Default installation** — EverMind SkillHub, ClawHub, and skillhub.cn are enabled; the retrieval query is sent to all three services. Set any endpoint field to an empty string to disable that source. With no `model`, no LLM gate runs: source safety checks and the EverMind lexical relevance guard still apply.
+- **EverMind SkillHub** — selected skills' bodies and bundles are downloaded from it. Bundles are unzipped with path-traversal rejection, an extension allowlist, and 8 MiB/file, 64 MiB/archive caps, into a cache directory outside every scanned skills dir (`~/.workbuddy-ai/skillsearch-bundles`, `~/.skillsearch/hub`, `~/.openclaw/skillsearch-bundles`, or `~/.dsh/skillsearch-bundles` by default).
 - **Marketplace body fetches** — up to two candidates per enabled marketplace are downloaded and safely extracted before the optional LLM gate, because those APIs expose the skill body through the bundle. A rejected candidate may therefore remain in the cache, but the plugin never executes it automatically.
 - **With `model` set** — the rewriter sees your message (truncated to 2,000 chars); the gate sees your message plus candidate names, descriptions and 300-char body excerpts. Both go to the model *you* configured, through the host's own provider where the host offers one.
 

skillcorpus_plugin/README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-**[SkillCorpus](https://github.com/EverMind-AI/SkillCorpus) 的官方宿主插件集：让你的 agent 每一轮都自动带上对的技能。** SkillCorpus Plugins 盯着用户刚说的话，从本地目录和可选的远程技能库里检索匹配的 `SKILL.md` 技能，在模型作答之前把技能正文放到它面前——不需要工具调用，模型也不需要事先知道任何技能的名字。
+**[SkillCorpus](https://github.com/EverMind-AI/SkillCorpus) 的官方宿主插件集：让你的 agent 每一轮都自动带上对的技能。** SkillCorpus Plugins 盯着用户刚说的话，从本地目录以及默认开启的三个远程来源中检索匹配的 `SKILL.md` 技能，在模型作答之前把技能正文放到它面前——不需要工具调用，模型也不需要事先知道任何技能的名字。
 
 一个真实轮次，发生在 WorkBuddy 上：问 *"帮我生成一个二维码，内容是 https://evermind.ai，存到桌面"*。这台机器上没有任何二维码技能——但语料库里有，于是模型作答前，它的上下文多出：
 
@@ -19,7 +19,7 @@ this directory — use the absolute form for read_file / exec.
 
 技能自带的脚本已经解包在旁边；模型直接运行它，二维码落到桌面。没有检索的话，模型只能即兴发挥——`pip install qrcode`，然后碰运气。
 
-技能来源可以是你自己的技能目录、[SkillHub](https://evermind.ai/skillhub)（[SkillCorpus](https://github.com/EverMind-AI/SkillCorpus) 的托管端点，114,190 条经审核、许可宽松的社区技能——上面那条二维码技能就来自这里），或两者融合进同一个排序。
+技能来源可以是你自己的技能目录，也可以是默认开启的 EverMind SkillHub、ClawHub 和 skillhub.cn，所有来源融合进同一个排序。上面的二维码技能来自 [SkillHub](https://evermind.ai/skillhub)，即 [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus) 的托管端点。
 
 ## 安装——把这段话粘给你的 agent
 
@@ -33,7 +33,7 @@ this directory — use the absolute form for read_file / exec.
 
 | 你的宿主 | 操作 | 详情 |
 | --- | --- | --- |
-| **WorkBuddy** | 构建 `plugin-workbuddy`、注册为 marketplace、启用——文件级步骤，agent 干最合适：把它 README 里的 prompt 粘给 WorkBuddy | [plugin-workbuddy](https://github.com/EverMind-AI/SkillCorpus/blob/main/skillcorpus_plugin/plugin-workbuddy/README.md#install--paste-this-to-workbuddy) |
+| **WorkBuddy** | 在标准插件市场添加 `EverMind-AI/SkillCorpus`，安装 **Skill Search**，然后重启 | [plugin-workbuddy](https://github.com/EverMind-AI/SkillCorpus/blob/main/skillcorpus_plugin/plugin-workbuddy/README.md#install) |
 | **Hermes** | `pip install ./engine-python && cp -r plugin-hermes "$HERMES_HOME/plugins/skillsearch" && hermes memory setup` | [plugin-hermes](https://github.com/EverMind-AI/SkillCorpus/blob/main/skillcorpus_plugin/plugin-hermes/README.md#install) |
 | **OpenClaw** | `npm install --prefix plugin-openclaw && npm run --prefix plugin-openclaw build`，再往 `openclaw.json` 加两个键 | [plugin-openclaw](https://github.com/EverMind-AI/SkillCorpus/blob/main/skillcorpus_plugin/plugin-openclaw/README.md#install) |
 | **DeepSeek Harness** | 把 `engine-typescript/` 拷到 `packages/skill/skill-search/`，`cordis.yml` 加一行 | [engine-typescript](https://github.com/EverMind-AI/SkillCorpus/blob/main/skillcorpus_plugin/engine-typescript/README.md#where-this-goes) |
@@ -82,7 +82,7 @@ EOF
 | 配置 | 默认 | 决定什么 |
 | --- | --- | --- |
 | `skills_dir` / `skillsDirs` | 宿主自己的技能目录 | 本地技能扫哪里。目录不存在 = 这个源就不存在。 |
-| `hub_endpoint` / `hubEndpoint` | *(空)* | EverMind 兼容目录；空值只关闭这个来源。 |
+| `hub_endpoint` / `hubEndpoint` | `https://skillhub.evermind.ai` | EverMind SkillHub；空值只关闭这个来源。 |
 | `clawhub_endpoint` / `clawhubEndpoint` | `https://clawhub.ai` | ClawHub 检索；空值关闭。 |
 | `skillhub_cn_endpoint` / `skillhubCnEndpoint` | `https://api.skillhub.cn` | skillhub.cn 检索；空值关闭。 |
 | `model`（+ 宿主自己的路由字段） | *(空)* | 启用查询改写器和 gate。空 = 检索裸跑，按关键词排序注入。 |
@@ -109,8 +109,8 @@ EOF
 如实交代，因为检索跑在你的对话上：
 
 - **显式清空三个远程 endpoint 后的纯本地模式**——什么都不出去。扫描、排序、注入全在进程内。
-- **默认安装**——ClawHub 与 skillhub.cn 默认开启，检索查询会发送给这两个服务；将对应 endpoint 设为空字符串可分别关闭。未配置 `model` 时不会运行 LLM gate，只依赖 marketplace 自带的信任标记和关键词相关性过滤。
-- **配了 `hub_endpoint`**——每个检索轮次，检索查询（你的消息，或模型清洗后的改写）会发给那个目录服务；选中技能的正文和 bundle 会从它下载。zip 解包有路径穿越拒绝、扩展名白名单、单文件 8 MiB / 整包 64 MiB 上限，缓存目录在所有被扫描技能目录之外（默认 `~/.workbuddy-ai/skillsearch-bundles`、`~/.skillsearch/hub`、`~/.openclaw/skillsearch-bundles` 或 `~/.dsh/skillsearch-bundles`）。
+- **默认安装**——EverMind SkillHub、ClawHub 与 skillhub.cn 默认开启，检索查询会发送给三个服务；将任一 endpoint 设为空字符串可单独关闭。未配置 `model` 时不会运行 LLM gate，但仍执行来源安全检查和 EverMind 关键词相关性过滤。
+- **EverMind SkillHub**——选中技能的正文和 bundle 会从它下载。zip 解包有路径穿越拒绝、扩展名白名单、单文件 8 MiB / 整包 64 MiB 上限，缓存目录在所有被扫描技能目录之外（默认 `~/.workbuddy-ai/skillsearch-bundles`、`~/.skillsearch/hub`、`~/.openclaw/skillsearch-bundles` 或 `~/.dsh/skillsearch-bundles`）。
 - **Marketplace 正文获取**——每个启用的 marketplace 最多会有两个候选在可选 LLM gate 之前下载并安全解包，因为这两个 API 通过 bundle 提供技能正文。被 gate 拒绝的候选可能仍留在缓存里，但插件不会自动执行它。
 - **配了 `model`**——改写器看到你的消息（截断到 2,000 字符）；gate 看到你的消息加候选技能的名字、描述和 300 字符正文摘录。两者都发给**你自己配置的**模型，宿主有 provider 通道的走宿主通道。
 

skillcorpus_plugin/engine-python/README.md

@@ -6,8 +6,8 @@ An agent host wants to answer one question before every turn: *given what
 the user just said, which skills should the model see?* This package
 answers it — searching a local skills directory, a remote catalog such as
 [SkillHub](https://evermind.ai/skillhub) (the hosted endpoint over
-[SkillCorpus](https://github.com/EverMind-AI/SkillCorpus)'s 96,401 vetted
-skills), and the agent's own accumulated skills, fusing the results,
+[SkillCorpus](https://github.com/EverMind-AI/SkillCorpus)), and the agent's
+own accumulated skills, fusing the results,
 narrowing them with a model, and returning the text to inject.
 
 ```python
@@ -87,9 +87,8 @@ without filtering it first.
 `GET /openapi/v1/skills?q=`, `/skills/{id}`, `/skills/{id}/download`, each
 answering `{error, requestId, status, result}` with `status == 0` for
 success. [SkillHub](https://evermind.ai/skillhub) is a public one, serving
-the [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus) corpus —
-96,401 skills, each carrying its upstream license, retrieval quality
-measured in the [corpus paper](https://arxiv.org/abs/2607.15557) — or run
+the [SkillCorpus](https://github.com/EverMind-AI/SkillCorpus) corpus. Each
+skill carries its upstream license, with retrieval quality measured in the [corpus paper](https://arxiv.org/abs/2607.15557) — or run
 your own. Leave it unset and everything else works against a local
 directory.