[DeusData]

What this does

Makes this repository a Claude Code plugin marketplace, so Claude Code users can
find and add the server from inside Claude Code:

claude plugin marketplace add DeusData/codebase-memory-mcp
claude plugin install codebase-memory@codebase-memory

This is slice 1 of #1188: discovery only, about seventy hand-written lines and
no C. The direction was decided on #1188 (discovery is the real barrier; the
plugin is a second route to the same product, not a second product).

What slice 1 is:

• .claude-plugin/marketplace.json - the marketplace, with one plugin sourced
  from ./plugin.
• plugin/.claude-plugin/plugin.json - the plugin manifest, version 0.12.1.
• plugin/.mcp.json - one stdio server, npx -y codebase-memory-mcp@0.12.1.
• .gitignore - the root .mcp.json stays ignored; plugin/.mcp.json is
  published.
• README - an "Install via Claude Code plugin" section.
• tests/test_version_metadata_contract.sh - both plugin files are
  release-tracking surfaces.

What slice 1 is not: the plugin registers the MCP server and nothing else. The
skill, the three graph agents and the context hooks are not in it; they still come
from codebase-memory-mcp install. The emitter, the PR-time drift gate (slice 2)
and the agents and hooks (slice 3) stay open on #1188, which remains the umbrella.

Why the version is pinned (in both files)

• plugin.json carries "version": "0.12.1". Without a pinned version, Claude
  Code treats every commit to main as a new plugin version for installed users.
• .mcp.json launches codebase-memory-mcp@0.12.1, not the bare package name, so
  main never advertises a server version that npm does not have, and a user
  runs exactly the release the plugin names. 0.12.1 is the newest stable tag and
  what server.json and pkg/npm/package.json state; npm view confirms it is
  published.
• The version-metadata contract now holds both files to the newest release. It
  gained one claim form, the npm package spec codebase-memory-mcp@X.Y.Z, because
  .mcp.json has no version keyword next to its pin and the contract's
  anti-vacuity check would otherwise read it as a surface with no claim. Its sweep
  for unregistered surfaces now also covers plugin/ and .claude-plugin/, so a
  later plugin file that pins the package (a hook command, say) has to be
  registered. All of this makes the gate stricter; nothing is exempted.
• So the post-release sync that bumps server.json has to bump these two pins in
  the same PR, or the contract goes red there. That is the intended coupling.

Use one or the other

install already registers the same server for Claude Code. With both the plugin
and install, Claude Code runs the server twice, under two tool namespaces
(mcp__codebase-memory-mcp__* and
mcp__plugin_codebase-memory_codebase-memory-mcp__*). The README says so: choose
install for the full setup (skill, agents, hooks), choose the plugin to add just
the server without running an installer.

Proof

Run on macOS (arm64), main at 28a6905.

1. Version contract, red and green:
   • Both files registered, before the new claim form existed: FAIL,
     plugin/.mcp.json is registered as a version surface but states no version
     (the anti-vacuity check).
   • .mcp.json pinned to 0.12.0: FAIL (newest release is 0.12.1; the surfaces
     disagree).
   • plugin.json at 0.12.0: FAIL (same two violations).
   • An unregistered plugin/hooks/hooks.json carrying codebase-memory-mcp@0.12.1:
     FAIL (unregistered surface).
   • Both at 0.12.1: Version-metadata contract passed (13 surfaces, 11 tracking v0.12.1, 13 value(s) checked).
2. Language-count contract: passed (7 surfaces, 7 distinct value(s) checked, 162 grammars vendored). No language count appears anywhere in the plugin
   metadata.
3. claude plugin validate --strict (Claude Code 2.1.304) passes for the
   marketplace at the repository root and for plugin/.
4. End to end, in a scratch Claude Code configuration (separate config
   directory and HOME, isolated cbm runtime and cache directories, fresh npm cache,
   no model session):
   • claude plugin marketplace add <checkout> and
     claude plugin install codebase-memory@codebase-memory succeed; claude plugin list shows version 0.12.1, enabled.
   • claude mcp list reports
     plugin:codebase-memory:codebase-memory-mcp: npx -y codebase-memory-mcp@0.12.1 - Connected.
     The first, cold start took 10.9 s, including the npx download of the package
     and its 0.12.1 binary; a warm check took 1.1 s.
   • The binary that ran reports codebase-memory-mcp 0.12.1.
5. Shell line-ending contract and shellcheck pass on the touched script; the three
   JSON files parse.

Not verified: Windows. No Windows run was done for this slice. Claude Code's
documentation has asked native-Windows users to wrap npx-launched stdio servers in
cmd /c. If that still applies, the plugin's server would not start on native
Windows, and Windows users should use codebase-memory-mcp install until a later
slice handles it.

What this commits us to: the repository path, the marketplace name
codebase-memory and the plugin/ location become a public install endpoint.
Moving any of them later breaks installed users.

Credit

This slice is distilled from @Geek0x0's work on #1188, and the commit carries
their co-author credit. From their branch: the layout (a root
.claude-plugin/marketplace.json listing a ./plugin tree), the shape of the two
plugin manifests, the single npx stdio server in plugin/.mcp.json, un-ignoring
that one file, the README install section, and pinning the npx launch to an exact
release (their follow-up in 5072d4d). We cut it down to the discovery slice agreed
on #1188 and adapted it to current main: the current release pin, no language
count, and the version-contract registration. Their emitter, drift gate, skill,
agents and hooks are untouched here and stay on #1188 for the next slices. Thank
you, @Geek0x0, for the care that went into all of it.

Refs #1188