feat(claude): support marketplace source matrix

.changeset/bright-taxis-source.md

@@ -0,0 +1,5 @@
+---
+"agent-bundle": minor
+---
+
+Support the documented Claude marketplace plugin source matrix, including pinned git, npm, archive, and command copy/link sources.

packages/agent-bundle/src/adapters/capabilities/claude-2.1.250.json

@@ -320,6 +320,18 @@
       ],
       "entryRelevanceSignals": ["cli", "cwd", "filesRead", "hosts", "manifestDeps"],
       "generatedSourceForms": ["relative"],
+      "sourceMatrix": {
+        "archiveIntegrity": "sha256-64-hex",
+        "authoredForms": ["relative", "github", "url", "git-subdir", "npm", "archive", "command"],
+        "generatedDefault": "relative",
+        "gitPinFields": ["ref", "sha"],
+        "shaOverridesRef": true,
+        "versionGates": {
+          "archive": "2.1.224",
+          "command": "2.1.229",
+          "pluginRootBareName": "2.1.239"
+        }
+      },
       "renames": true,
       "topLevelFields": [
         "$schema",
@@ -437,13 +449,19 @@
       "2026-09-01: https://code.claude.com/docs/en/plugin-dependencies exposes dependency-unsatisfied, range-conflict, dependency-version-unsatisfied, and no-matching-tag in `claude plugin list --json` errors.",
       "2026-09-01: Local host proof against the observed Claude Code 2.1.257 binary (newer than the pinned 2.1.250 table): `claude plugin validate --strict` accepts an emitted plugin manifest declaring one bare dependency and one `{name, version}` dependency object and prints \"Validation passed\" (host-adapters.native.test.ts).",
       "2026-09-02 (retrieved 2026-09-02): https://code.claude.com/docs/en/plugin-marketplaces documents required top-level marketplace name, owner, and plugins plus optional $schema, description, version, metadata.pluginRoot, allowCrossMarketplaceDependenciesOn, and renames; owner requires name and optionally accepts email and url.",
-      "2026-09-02 (retrieved 2026-09-02): https://code.claude.com/docs/en/plugin-marketplaces documents plugin-entry name and source plus standard metadata, category, tags, strict, relevance, defaultEnabled, component configuration, headers, and headersHelper. This slice authors catalog metadata, relevance, and authentication fields while retaining the generated relative `./` source; github, git URL, git-subdir, npm, archive, and command source variants remain the source-matrix follow-up.",
+      "2026-09-02 (retrieved 2026-09-02): https://code.claude.com/docs/en/plugin-marketplaces documents plugin-entry name and source plus standard metadata, category, tags, strict, relevance, defaultEnabled, component configuration, headers, and headersHelper. Agent Bundle keeps generated `./` as the default and lets the authored plugin overlay record a distributed relative, github, git URL, git-subdir, npm, archive, or command source.",
+      "retrieved 2026-09-02: https://code.claude.com/docs/en/plugin-marketplaces documents relative ./ paths, bare names under metadata.pluginRoot, github owner/repo, HTTPS or git@ URL sources, git-subdir repository plus required path, npm package/version/registry, HTTPS archive, and command copy/link as the complete plugin source matrix.",
+      "retrieved 2026-09-02: https://code.claude.com/docs/en/plugin-marketplaces documents ref and full 40-character sha pins for github, url, and git-subdir sources; when both are present sha is the effective pin.",
+      "retrieved 2026-09-02: https://code.claude.com/docs/en/plugin-marketplaces documents archive sha256 as a case-insensitive 64-hex integrity pin whose mismatch fails installation and whose digest supplies the plugin version when neither the entry nor plugin manifest declares one.",
+      "retrieved 2026-09-02: https://code.claude.com/docs/en/plugin-marketplaces gates archive sources at Claude Code v2.1.224+, command sources at v2.1.229+, and bare relative names under metadata.pluginRoot at v2.1.239+.",
       "2026-09-02 (retrieved 2026-09-02): https://code.claude.com/docs/en/plugin-relevance defines relevance topic (maximum 64 characters) and nonempty signals from cwd, cli, hosts, filesRead, and manifestDeps, including the documented item and character limits and bare-hostname rule.",
       "2026-09-02 (retrieved 2026-09-02): https://code.claude.com/docs/en/plugins-reference confirms marketplace-entry metadata and plugin manifest metadata/component field shapes; marketplace entries may carry plugin manifest fields in addition to marketplace-specific source, category, tags, strict, relevance, headers, and headersHelper.",
       "2026-09-02 (retrieved 2026-09-02): https://code.claude.com/docs/en/plugin-dependencies requires cross-marketplace dependency targets in the root marketplace's allowCrossMarketplaceDependenciesOn array; only the root allowlist is consulted and trust does not chain.",
       "2026-09-02: Claude Code 2.1.257 `claude plugin validate --strict` accepts the generated relative-source marketplace enriched with owner contacts, metadata.pluginRoot, version, renames, allowCrossMarketplaceDependenciesOn, plugin metadata, relevance, tags, and strict mode.",
+      "2026-09-02: Claude Code 2.1.257 `claude plugin validate --strict` accepts emitted github with ref+sha, HTTPS git URL with ref+sha, git-subdir shorthand with path+ref+sha, npm with version+registry, archive with sha256+headers+headersHelper under strict:false, and command sources in copy and link modes.",
+      "2026-09-02: Claude Code 2.1.257 strict marketplace validation rejects a short git sha, an http archive URL, and an unknown command mode. It does not fetch a lexically valid unreachable HTTPS archive or execute a failing command while validating, so reachability, downloaded integrity, and command runtime behavior remain install-time checks.",
       "2026-09-02: Claude Code 2.1.257 strict validation accepts an empty string inside allowCrossMarketplaceDependenciesOn without naming the field, so Agent Bundle's kebab-case/nonempty/unique validation is the pre-distribution allowlist guard.",
-      "2026-09-02: Claude Code 2.1.257 recognizes headers and headersHelper but warns that they have no effect on the generated relative source; --strict promotes that warning to failure. The pinned schema retains the documented fields, but the authored overlay rejects them with claude.marketplace.plugin.headers.inapplicable and claude.marketplace.plugin.headersHelper.inapplicable so the compiler never emits a strict-failing manifest; archive and other URL-capable sources remain the source-matrix follow-up.",
+      "2026-09-02: Claude Code 2.1.257 recognizes headers and headersHelper but warns that they have no effect on non-archive sources; --strict promotes that warning to failure. The authored overlay accepts both only with an archive source and additionally requires strict:false beside headersHelper.",
       "2026-09-01: https://code.claude.com/docs/en/plugins-reference documents `displayName` as the human-readable UI name that falls back to `name`, `metadata` as a free-form object Claude Code does not read, and `defaultEnabled` as the boolean fallback enabled state whose default is true. The same metadata table documents `$schema`, version, description, author, homepage, repository, license, and keywords.",
       "2026-09-01: https://code.claude.com/docs/en/plugins-reference documents that an existing `enabledPlugins` user setting and an active dependency requirement both take precedence over plugin.json `defaultEnabled`, while a marketplace entry's `defaultEnabled` takes precedence over the plugin manifest value.",
       "2026-09-01: https://code.claude.com/docs/en/plugins-reference documents that wrong types make most manifest fields fail plugin loading, but non-object `experimental` and `metadata` values are ignored with a `claude plugin validate` warning; `--strict` promotes warnings to failure. Before v2.1.222, `metadata` was treated as unrecognized.",