* Add a Kimi Code plugin manifest and release 1.1.2
Kimi Code reads its own kimi.plugin.json rather than the portable
plugin.json, and it does not read mcp.json, so the manifest declares the
Neon MCP Server inline. It points at skills/ in place, so like the root
Agent Plugins package it needs no vendoring.
Wiring it into sync-versions.mjs keeps its version generated from
package.json like every other manifest, and adding it to the workflow's
path filter keeps a Kimi-only edit from skipping validate:versions. The
bump to 1.1.2 releases the accumulated skill changes along with it.
* Tell Kimi users to run /new, not /reload, after installing
Clients implementing the Agent Plugins v1 specification look for a
manifest at the plugin root, so today this repo is only installable
through the Claude and Cursor packaging under plugins/. Adding a root
plugin.json and mcp.json makes the repository itself a conforming
portable package that reads skills/ in place, with no vendoring.
The v1 manifest schema is closed, so the client fields the existing
manifests carry (skills, mcpServers, logo, displayName) cannot appear
at the top level and MCP configuration moves to its own file. The root
mcp.json therefore spells the transport "streamable-http" while
plugins/neon-postgres/mcp.json keeps Claude and Cursor's "http" for the
same endpoint; the two files are intentionally not copies.
Apart from the version bump below, the packaging under plugins/ is
untouched, so existing Claude and Cursor installs behave as before.
validate-agent-plugin.mjs gates the new files in CI, checking the closed
manifest field set, MCP transport and containment rules, and skill
discovery. It shares the frontmatter semantics skills-ref uses so the
two validators cannot disagree about the same SKILL.md. Containment is
checked all the way down a skill rather than only at its root, since a
nested symlink escaping the repo would otherwise ship to a v1 client.
A link that will not resolve is reported rather than passing as
contained on the strength of a failed realpath.
Releases this as 1.1.1, and makes package.json the single source of
truth for that number. The root manifest added a sixth place the
version is declared and nothing kept them in step, so a bump that
missed one could publish a catalog entry advertising a different
version than the plugin it installs. sync-versions.mjs generates all
six from package.json, the pre-commit hook runs it the way it already
runs sync-plugin-skills.mjs, and validate:versions is that same script
in --check mode so CI still catches a hand-edited manifest. A release
is now one edit: bump package.json and commit.
The rewrite is a surgical text replacement rather than a JSON
re-serialize, so every manifest keeps its formatting. Nothing is written
until every file re-parses to exactly the expected result.
package-lock.json declares the version twice as well, but it repeats
"version" for every dependency, which makes a text rewrite unsafe; npm
owns that file, so the script checks it and leaves it alone.
The check refuses to pass quietly on a file it did not understand: one
that exists but declares no version is an error, and so is one that
cannot be read, since reporting "in sync" for a file never opened would
defeat the point. Each failure carries its own remedy, and the
sync:versions hint is withheld from the two that command cannot repair.
The hook stages only the manifests sync-versions.mjs reports rewriting,
which it prints to stdout. Staging all six unconditionally would sweep
an in-progress edit to a description or keyword list into an unrelated
commit, since those files are hand-authored apart from the version
field. The vendored skills are still staged a directory at a time so a
deletion is staged too, which is safe because every file under
plugins/*/skills is generated. That loop skips a directory that does
not exist: an unmatched glob is passed through literally, and git add
would abort the commit with a pathspec error the first time a plugin
ships without one of the two client packaging formats.
Also adds the marketplace catalogs to the workflow path filters; editing
one previously skipped CI even though validate:plugins reads them.
The neon-postgres plugin exposed its skills via symlinks pointing outside
the plugin root (../../../skills/*). Cursor and Claude silently drop
out-of-root symlinks when installing a plugin from git, so the plugin
shipped its MCP server but none of its skills.
Replace the symlinks with committed real copies of every skill, generated
from the top-level skills/ source of truth by a one-way sync script
(scripts/sync-plugin-skills.mjs, driven by an in-script PLUGIN_SKILLS map;
"*" vendors all skills). A pre-commit hook wired via the prepare script
runs the sync automatically, and validate:plugin-skills (in validate:ci)
plus the cursor/claude plugin validators fail on drift or any in-plugin
symlink so this cannot silently regress.
Adopt the same improved check both repos should share: ignore node_modules/.git,
treat directory links (e.g. scripts/) as valid rather than broken, only fail on
missing *markdown* references, and summarize ignored non-markdown files by count.
No behavior change for the current skills (all still pass).
Every markdown reference file in a skill must be reachable from its SKILL.md by
following the link graph (SKILL.md → references, and references → each other).
Links may be relative paths, full neon.com URLs, or GitHub blob URLs into this
repo. Fails when a link points at a missing file, or when a markdown file is
never reached from SKILL.md (orphan). Non-markdown files (scripts, etc.) are
reported but not required to be linked. Wired into validate:ci.
Replace validate-plugins.yml with a single Validate workflow that runs
`npm run validate:ci` (validate:plugins && validate:skills), keeping this
repo's plugin-manifest checks. Add path filters and document the shared,
hardened CI shape plus the intentional per-repo differences with
neon-for-agent-platforms in AGENTS.md.
Add package-lock.json, pin skills-ref@0.1.5 as a devDependency, and switch
the Validate Plugins workflow from npm install to npm ci --ignore-scripts so
CI installs are integrity-checked. Add Dependabot for github-actions and npm.
Restructure plugin packaging into per-plugin folders so Claude and Cursor manifests, MCP config, and branding are co-located while shared skills are symlinked from top-level skills. Add plugin-manager guidance and CI validation scripts/workflow to prevent marketplace and manifest path regressions as additional plugins are added.
Co-authored-by: Cursor <cursoragent@cursor.com>
Tony Dang