plugin-publish

A release guide for publishing Zhin.js plugins to npm, the JavaScript package registry, and to the Zhin plugin marketplace. It covers package metadata, versioning, release checks, and submission requirements.

In plain words
What is it for?
Use it to prepare a plugin for release, verify package.json and published files, manage versions, and submit the plugin to npm and the Zhin marketplace.
Why use it?
It reduces the chance that a plugin is rejected or published with missing files, incorrect metadata, or incompatible framework information. It also provides checks before sharing the package with other developers.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/zhinjs/zhin/plugin-publish
Any agent
npx skills add zhinjs/zhin --skill plugin-publish
Clone the repo
git clone --depth 1 https://github.com/zhinjs/zhin

Made for: Claude Code, Codex.

Per session 58 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,030 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00058 $0.02030
Opus 5 $0.00029 $0.01015
Sonnet 5 $0.00012 $0.00406
Haiku 4.5 $0.00006 $0.00203

Measured 3d ago against content hash c04d68558d58, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

plugin-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/toolkit/create-zhin/template/skills/plugin-publish/SKILL.md · 222 lines

How it starts

The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Zhin 插件发布

引导将 Zhin.js 插件发布到 npm 和 Zhin 插件市场,确保包结构、元数据和质量符合社区标准。

适用场景

  • 用户说"发布插件"、"提交到插件市场"、"准备发版"
  • 插件开发完成需要分享给社区
  • 需要检查插件是否满足发布条件

发布前检查清单

第 1 步:包元数据检查

验证 package.json 必需字段:

{
  "name": "zhin.js-{name}",          // ✅ 社区前缀
  "version": "0.1.0",                 // ✅ 语义化版本
  "type": "module",                    // ✅ ESM
  "description": "插件简介",           // ✅ 非空描述
  "main": "./lib/index.js",           // ✅ 入口指向编译产物
  "types": "./lib/index.d.ts",        // ✅ 类型声明
  "exports": {
    ".": {
      "types": "./lib/index.d.ts",
      "development": "./src/index.ts", // ✅ 开发条件导出
      "import": "./lib/index.js"
    },
    "./package.json": "./package.json"
  },
  "files": [                           // ✅ 发布文件白名单
    "src", "lib", "client", "dist",
    "skills", "tools",
    "README.md", "CHANGELOG.md"
  ],
  "keywords": ["zhin.js", "plugin"],   // ✅ 包含 zhin.js 关键词
  "peerDependencies": {
    "zhin.js": ">=x.x.x"              // ✅ 声明框架兼容版本
  },
  "license": "MIT",                    // ✅ 开源协议
  "repository": { "url": "..." },      // 推荐:仓库地址
  "homepage": "...",                    // 推荐:文档地址
  "author": "..."                       // 推荐:作者信息
}

插件市场识别条件:

  • namezhin.js- 开头(社区)或 @zhin.js/ 开头(官方)
  • keywords 包含 zhin.js
  • peerDependencies 包含 zhin.js

第 2 步:代码质量检查

# 1. 类型检查
pnpm build            # 确保 tsc 编译通过,无类型错误

# 2. 运行测试
pnpm test             # 确保所有测试通过

# 3. 覆盖率检查
pnpm test:coverage    # 确保覆盖率达标

质量底线:

  • tsc 编译零错误
  • 所有测试通过
  • 语句覆盖率 ≥ 60%
  • any 类型滥用
  • 无未处理的 TODO/FIXME 阻塞发布

第 3 步:文档检查

README.md 必须包含:

  • 插件功能简介
  • 安装步骤(pnpm add zhin.js-{name}
  • 配置说明(配置项及默认值)
  • 命令列表(如有)
  • AI 工具说明(如有)
  • 使用示例

CHANGELOG.md 必须包含:

关键词:skills/ 目录时,确认 SKILL.md 的 description 准确描述插件能力。

第 4 步:构建产物检查

# 确保 lib/ 目录存在且完整
ls lib/

# 检查将要发布的文件
npm pack --dry-run

确认 npm pack 输出的文件列表:

  • ✅ 包含 lib/(编译后的 JS + d.ts)
  • ✅ 包含 src/(源码,供开发模式使用)
  • ✅ 包含 skills/(AI 技能描述)
  • ✅ 包含 README.mdCHANGELOG.md
  • ❌ 不包含 node_modules/tests/.env
  • ❌ 不包含 coverage/.DS_Store

Read the full file on GitHub · 222 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 222 lines · 58 tokens per session scan A c04d68558d58

Subscribe to this mod's changes

plugin-publish is a skill published in the GitHub repository zhinjs/zhin (135 stars, last pushed 6d ago), licensed MIT. It adds 58 tokens to every session and 2,030 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.