Switch in-repo plugins to per-subdirectory layout with sync script

[shinpr]

Summary

• Each in-repo plugin (dev-workflows, dev-workflows-frontend, dev-skills) now lives in its own subdirectory at the repo root, populated from the canonical top-level agents/ and skills/ directories by scripts/sync-plugins.mjs
• A lefthook pre-commit hook keeps the subdirectories in sync and runs claude plugin validate locally; a GitHub Actions workflow guards drift in PRs
• This is an explicit workaround for two open Claude Code regressions and is intended to be reverted once either is fixed upstream

Why

The previous flatten layout (#117, source: "./") sidestepped a v2.1.117 installer regression that drops symlinked content (anthropics/claude-code#53948), but exposed a separate latent bug: the agents / skills filter arrays in marketplace.json are silently ignored by the loader (anthropics/claude-code#13344). As a result dev-skills was loading every agent and recipe-* skill at the repo root, instead of only the 9 knowledge skills it declares.

Per-subdirectory sources sidestep both bugs by giving the loader a directory that physically contains only the intended subset. The agents / skills arrays in marketplace.json are kept and used as the spec for sync-plugins.mjs, so when upstream filtering is fixed we can collapse back to a single-source layout without re-deriving the per-plugin curation.

What changed

• scripts/sync-plugins.mjs — reads marketplace.json, copies the listed agents/skills into each <plugin-name>/ subdirectory, and generates <plugin-name>/.claude-plugin/plugin.json. --check mode does the same in a temp directory and exits non-zero on drift. Cross-platform (no shell utilities); rejects path traversal, source typos that would overwrite canonical directories, and any symlink in the source tree
• package.json + pnpm-lock.yaml + .nvmrc — Node >=22, pnpm, single dev dependency on lefthook
• lefthook.yml — pre-commit runs pnpm sync (re-stages the generated subdirectories) and then claude plugin validate for marketplace + each plugin
• .github/workflows/sync-check.yml — runs pnpm sync:check on PRs; SHA-pinned third-party actions, least-privilege contents: read
• .claude-plugin/marketplace.json — source switched to ./<plugin-name>, strict restored to true, version bumped to 0.16.16
• dev-workflows/, dev-workflows-frontend/, dev-skills/ — generated bundles
• CONTRIBUTING.md — short note on the editing workflow

Verification

Verified with a clean install in an isolated HOME on macOS (Claude Code 2.1.123):

Plugin	agents	skills	Expected
dev-workflows	20	20	20 / 20
dev-workflows-frontend	20	18	20 / 18
dev-skills	0	9	0 / 9 (no agent or recipe leakage)

claude plugin validate passes for marketplace.json and all three subdirectories. pnpm sync:check reports clean. Drift detection, malicious-path rejection, and internal-symlink rejection were all confirmed against synthetic inputs.

Test plan

• CI sync-check workflow passes
• Local install from this branch into a fresh HOME reports the expected agent/skill counts above
• Editing a file under agents/ or skills/ and committing causes the lefthook hook to run pnpm sync and re-stage the generated subdirectory