Both skills now describe the workflow only; every API call, login, refresh,
download, OBJ transform and slicer launch goes through the published
meshy-cli@0.3.0. The bundled Python runtime and the duplicated API manuals
are removed; OpenClaw is untouched. SKILL.md frontmatter keeps only name,
description and license — the release version lives in the plugin manifests.
First-run experience:
- Runner resolution: an installed 0.3.0 `meshy`, else the pinned temporary
package `npm exec --yes --package=meshy-cli@0.3.0 -- meshy ...`.
- One browser login: `auth login --device` as a live process; the URL and
code are shown from its first stderr line, the agent turn stays alive on
that same session, and the original request resumes after `auth status`
verifies. No key, token or task ID is pasted.
- The user's requested path wins: WORKSPACE/PROJECT_ROOT resolved from the
request, ./meshy_output only as the default; the workspace boundary,
symlink and overwrite protection are unchanged.
- Previews, delivery, cost sources, waiting and follow-ups ("a 1500-face
LOD", "now as FBX") live in a shared references/delivery.md.
- Printing gains a local-only route (prepare an OBJ / open a 3MF) that
triggers no authentication, balance check or generation.
Tooling: build.py syncs setup/delivery/troubleshooting to printing;
validate_skills.py enforces the WORKSPACE placeholder, PROJECT_ROOT, no
hardcoded output root, the setup/delivery contract and the plugin manifests.
Tests run the real CLI against loopback with synthetic credentials:
19 Node tests, 0 skipped.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
## What
1. Plugin manifests for the three official install channels:
- .claude-plugin/plugin.json — repo-level plugin (auto-discovers all
skills/*/SKILL.md)
- .claude-plugin/marketplace.json — one entry per skill directory, each
sharing source "./" with an exclusive "skills" path (the documented
pattern that makes every skill directory independently installable)
- .cursor-plugin/plugin.json — auto-discovery layout
- .codex-plugin/plugin.json — explicit ./-prefixed skills list + interface
metadata (schema verified against openai/codex manifest.rs)
2. scripts/validate_skills.py + .github/workflows/validate-skills.yml run
five checks on every PR and on pushes to main:
1. frontmatter: name == directory name, semver metadata.version,
description carries a trigger phrase and a boundary note
2. version sync across all manifests, every SKILL.md, and the top
CHANGELOG.md entry
3. marketplace entries + codex skills list cover exactly the skills/
directory set
4. reference bidirectionality: every relative link in SKILL.md exists;
every non-SKILL markdown file is reachable from SKILL.md
5. no ".." path segments, so skill dirs stay independently installable
## Baseline fixes required for a green CI (overlap with ENG-1575 scope)
- meshy-openclaw frontmatter: name was "meshy-3d-agent" while the directory
is meshy-openclaw, and metadata.version was missing (CHANGELOG 0.4.0
admits the drift). Aligned to name=meshy-openclaw, version="0.4.0".
If "meshy-3d-agent" is the intended public name, the directory should be
renamed instead of relaxing check 1.
- All three skill descriptions gained one boundary sentence (check 1
requires the boundary note in the description; wording mirrors the
routing rules already present in each skill body).
- .gitignore ignored .claude-plugin/ — removed; otherwise the manifests
could never be committed.
No version bump: everything stays at 0.4.0. Releasing 0.5.0 is a
maintainer decision, and check 2 makes it a mechanical, CI-enforced edit.
## Validation
Local: all 5 checks green. Negative tests (mutate -> red -> restore):
version drift -> check 2 red; deleted referenced file -> check 4 red;
frontmatter name drift -> check 1 red; missing marketplace entry ->
check 3 red; "../" link -> check 5 red; orphan markdown -> check 4 red.
Every check fires in isolation.
ArkXiong