* Add a Kimi Code plugin manifest and release 1.1.2
Kimi Code reads its own kimi.plugin.json rather than the portable
plugin.json, and it does not read mcp.json, so the manifest declares the
Neon MCP Server inline. It points at skills/ in place, so like the root
Agent Plugins package it needs no vendoring.
Wiring it into sync-versions.mjs keeps its version generated from
package.json like every other manifest, and adding it to the workflow's
path filter keeps a Kimi-only edit from skipping validate:versions. The
bump to 1.1.2 releases the accumulated skill changes along with it.
* Tell Kimi users to run /new, not /reload, after installing
Clients implementing the Agent Plugins v1 specification look for a
manifest at the plugin root, so today this repo is only installable
through the Claude and Cursor packaging under plugins/. Adding a root
plugin.json and mcp.json makes the repository itself a conforming
portable package that reads skills/ in place, with no vendoring.
The v1 manifest schema is closed, so the client fields the existing
manifests carry (skills, mcpServers, logo, displayName) cannot appear
at the top level and MCP configuration moves to its own file. The root
mcp.json therefore spells the transport "streamable-http" while
plugins/neon-postgres/mcp.json keeps Claude and Cursor's "http" for the
same endpoint; the two files are intentionally not copies.
Apart from the version bump below, the packaging under plugins/ is
untouched, so existing Claude and Cursor installs behave as before.
validate-agent-plugin.mjs gates the new files in CI, checking the closed
manifest field set, MCP transport and containment rules, and skill
discovery. It shares the frontmatter semantics skills-ref uses so the
two validators cannot disagree about the same SKILL.md. Containment is
checked all the way down a skill rather than only at its root, since a
nested symlink escaping the repo would otherwise ship to a v1 client.
A link that will not resolve is reported rather than passing as
contained on the strength of a failed realpath.
Releases this as 1.1.1, and makes package.json the single source of
truth for that number. The root manifest added a sixth place the
version is declared and nothing kept them in step, so a bump that
missed one could publish a catalog entry advertising a different
version than the plugin it installs. sync-versions.mjs generates all
six from package.json, the pre-commit hook runs it the way it already
runs sync-plugin-skills.mjs, and validate:versions is that same script
in --check mode so CI still catches a hand-edited manifest. A release
is now one edit: bump package.json and commit.
The rewrite is a surgical text replacement rather than a JSON
re-serialize, so every manifest keeps its formatting. Nothing is written
until every file re-parses to exactly the expected result.
package-lock.json declares the version twice as well, but it repeats
"version" for every dependency, which makes a text rewrite unsafe; npm
owns that file, so the script checks it and leaves it alone.
The check refuses to pass quietly on a file it did not understand: one
that exists but declares no version is an error, and so is one that
cannot be read, since reporting "in sync" for a file never opened would
defeat the point. Each failure carries its own remedy, and the
sync:versions hint is withheld from the two that command cannot repair.
The hook stages only the manifests sync-versions.mjs reports rewriting,
which it prints to stdout. Staging all six unconditionally would sweep
an in-progress edit to a description or keyword list into an unrelated
commit, since those files are hand-authored apart from the version
field. The vendored skills are still staged a directory at a time so a
deletion is staged too, which is safe because every file under
plugins/*/skills is generated. That loop skips a directory that does
not exist: an unmatched glob is passed through literally, and git add
would abort the commit with a pathspec error the first time a plugin
ships without one of the two client packaging formats.
Also adds the marketplace catalogs to the workflow path filters; editing
one previously skipped CI even though validate:plugins reads them.
Tony Dang