Make win-dev-skills a catalog of Windows dev plugins: winui and winappcli from microsoft/winappCli

[Nikola Metulev (nmetulev)]

What changed

win-dev-skills now hosts agent plugins for Windows app development under plugins/<name>/ and also lists plugins maintained in other repos, pinned to a release. Both kinds are first-class, as in dotnet/skills. This PR moves winui to microsoft/winappCli, where it is now maintained, and adds winappcli from the same repo.

Plugin	Source	Pin
winui (unchanged for users: 0.7.1, same name, agent, and 8 skills)	microsoft/winappCli plugins/winui	commit 5a064a42, the merge of microsoft/winappCli#976. All 24 blob SHAs match v0.7.1
winappcli (new, 0.7.1, 12 skills + agent)	microsoft/winappCli plugins/winapp	tag v0.7.1 = commit e3cd0b94 (a lightweight tag)

Note

OpenClaw users must reinstall winui once. OpenClaw rejects the whole .claude-plugin/marketplace.json once any entry points to another repo, so after this PR both --marketplace microsoft/win-dev-skills and openclaw plugins update fail for existing OpenClaw users. They reinstall with openclaw plugins install winui --marketplace microsoft/winappCli (available since microsoft/winappCli#1007). README and CHANGELOG say this.

OpenClaw and winappcli: openclaw plugins install winappcli --marketplace microsoft/winappCli should install plugins/winapp as a Claude-format skills-only bundle, loading its 12 skills but not the agent. Evidence:

• In openclaw v2026.9.8, src/plugins/marketplace.ts accepts winappCli's catalog because both of its entries are relative paths inside that repo.
• src/plugins/bundle-manifest.ts detects .claude-plugin/plugin.json as a claude bundle, and skills/ is loaded by default. The agents path is ignored without error.
• docs.openclaw.ai/plugins/bundles agrees.

This is source-only; there was no live install. The openclaw package is blocked by the npm feed policy here (403), and the public registry isn't reachable. The README footnotes it.

Catalogs. The Copilot and Claude catalog name win-dev-skills is unchanged. The Codex catalog is renamed from microsoft-winui to win-dev-skills, so <plugin>@win-dev-skills works on every host (see the Codex rename section below). Codex's displayName is now "Windows app development". Catalog check now requires the same catalog name in all three files.

Host	File	Source form
Copilot	.github/plugin/marketplace.json	{"source":"github","repo":"microsoft/winappCli","path":…,"ref"?,"sha":…} (ref is optional; winui has only a sha, winappcli has a tag and a sha)
Claude Code	.claude-plugin/marketplace.json	{"source":"git-subdir","url":"https://github.com/microsoft/winappCli.git","path":…,"ref"?,"sha":…}
Codex	.agents/plugins/marketplace.json	Same git-subdir form (openai/codex codex-rs/core-plugins/src/marketplace.rs)

Codex decision: winappcli is in the Codex catalog. plugins/winapp at v0.7.1 has no .codex-plugin/plugin.json. Codex finds the plugin through its root plugin.json instead, which declares the Agent Plugins $schema. Codex checks that location first; see codex-rs/utils/plugins/src/plugin_namespace.rs. A real install worked, so no subset allowlist was needed.

Deleted:

• plugins/winui/**
• scripts/tests/*.ps1, scripts/open-release-pr.ps1, .github/skills/pr-review/ (all WinUI-specific; winappCli has its own)
• release-policy.yml and the staging gates
• the hotfix back-merge reminder

CI:

• Catalog check (scripts/check-catalogs.mjs):
  • Every entry resolves: repo, commit, path, and the host's manifest exist, using each host's lookup order. The manifest's name and version must match the catalog.
  • A ref must resolve to the pinned sha, which catches a moved tag.
  • All three catalogs list the same plugins at the same repo, sha, and ref.
• Local plugin lint (vally) lints every plugin hosted under plugins/. This PR adds none, so it passes trivially for now. The job also runs scripts/tests/test-catalog-tools.mjs on a fixture under scripts/tests/fixtures/local-plugin. The fixture proves that a local plugins/<name>/ entry gets checked and linted, and that a version mismatch, catalogs that disagree, and an invalid skill all fail.
• Also tested locally: a ref that doesn't match the sha fails, as do the earlier negative cases (version mismatch, different pins, missing path, renamed plugin, catalog version drift, nonexistent sha).
• auto-tag tags vX.Y.Z only when metadata.version changes. This PR keeps 0.7.1, so it creates no tag.
• codeql, dependency-review, and stale-issues are untouched.

Docs and ownership:

• README leads with "Agents and skills for Windows app development". The plugin table (name, purpose, where it's maintained, supported hosts) is the only place plugin names appear. Each host section shows one generic command, e.g. copilot plugin install <plugin>@win-dev-skills, so adding a plugin only needs a new table row. Host caveats stay short: Codex, OpenClaw and OpenCode load skills but not agents, and OpenClaw is footnoted. It warns not to install the same plugin from two catalogs. OpenClaw uses openclaw plugins install <plugin> --marketplace microsoft/winappCli; OpenCode links a skills folder from a clone.

• CONTRIBUTING describes two ways to add a plugin:

  • (a) add a plugin here under plugins/<name>/ (Agent Plugins layout, plus a Claude manifest)
  • (b) pin a plugin maintained in another repo to a tag + sha

  It sets a bar for inclusion: Windows app development; small and curated; skill descriptions of 300 characters or fewer with "Use when… Not for…"; no overlap with winappcli, winui, or dotnet/skills' dotnet-diag, dotnet-winforms, and dotnet-maui; two or more owners. It also covers who reviews and how pins get bumped.

• CODEOWNERS (new): catalog files, CI, and scripts are owned by Nikola Metulev (@nmetulev) Alexandre Zollinger Chohfi (@azchohfi) Niels Laute (@niels9001). There's a template for /plugins/<name>/ entries.

• RELEASING, CHANGELOG, SUPPORT, and the issue and PR templates are updated. Issues and PRs for winui and winappcli content go to winappCli.

Codex catalog rename: test and decision

I tested Codex 0.159.1 in an isolated CODEX_HOME against a throwaway test/codex-rename branch, since deleted. I registered the branch as microsoft-winui and installed winui and winappcli, then fast-forwarded the branch to a commit that renames the catalog to win-dev-skills:

Step	Result
codex plugin marketplace upgrade [microsoft-winui]	❌ Clear error, exit 1: upgraded marketplace name win-dev-skills does not match configured marketplace microsoft-winui. The snapshot stays at the old commit.
Existing installs	✅ Keep working (installed, enabled), but frozen: they won't get updates until migrated
Displayed registration name	Unchanged (microsoft-winui); no duplicate registration
codex plugin add winui@win-dev-skills before migrating	❌ plugin winui was not found in marketplace win-dev-skills
codex plugin marketplace add microsoft/win-dev-skills again	No-op: already added as microsoft-winui (it de-duplicates by URL)
Removing the marketplace first	Leaves [plugins."winui@microsoft-winui"] enabled = true orphaned in config.toml. codex plugin remove still cleans it up.
Migration: plugin remove <p>@microsoft-winui → marketplace remove microsoft-winui → marketplace add microsoft/win-dev-skills → plugin add <p>@win-dev-skills	✅ Both plugins installed under win-dev-skills, files byte-identical (8 and 12 skills); a later marketplace upgrade succeeds

Choice: rename, with a documented one-time migration. The migration commands are in the README Codex section and the CHANGELOG. Codex does not follow the rename on its own. An explicit upgrade fails with a clear message naming both catalogs, and nothing breaks. One caveat: users who never run marketplace upgrade don't see the error; their plugins just stop updating. The CHANGELOG and README note is how they'll find out. A fresh install from this branch as win-dev-skills was verified as well.

Test matrix

Real installs from the GitHub-hosted catalog (microsoft/win-dev-skills#nmetulev-flip-to-winappcli-catalog). Each host ran in an isolated home under %TEMP% with other COPILOT_* vars stripped. Hosts: Copilot CLI 1.0.87, Claude Code 2.1.285 via npx, Codex 0.159.1 via npx. "Identical" means the installed skill and agent files match the pinned commit's git blobs.

Host	winui fresh	winappcli fresh (installed alongside winui)	Upgrade, winui version unchanged (main → this catalog)	Upgrade, winui fake 0.7.2 bump
Copilot	✅ 8 skills + agent, 15/15 identical	✅ "Installed 12 skills", 14/14 identical (12 + 8 loaded together)	✅ re-fetched from winappCli, identical	✅ v0.7.1 → v0.7.2
Claude Code	✅ 8 skills + agent, 15/15 identical	✅ 12 skills + agent, 14/14 identical, plugin validate passes	⚠️ "already at the latest version"; keeps the old, byte-identical copy	✅ 0.7.1 → 0.7.2, source = winappCli
Codex	✅ 8 skills, 15/15 identical	✅ 12 skills, 14/14 identical; source shows ref v0.7.1 + sha	✅ re-materialized from winappCli, identical	✅ cache moved to 0.7.2, source = winappCli

For Claude and Codex, skill loading was verified by the files on disk and the plugin list. A model session wasn't run because the isolated homes have no auth. The fake bump used throwaway test/* branches here and in winappCli, and both are deleted. Takeaway: the next real winui version bump moves every Copilot, Claude, and Codex user to winappCli.

Rulesets / admin follow-ups

• Required checks: none. main has only the org ruleset (PR review, no force-push/delete), so the renamed jobs break nothing.
• CODEOWNERS now matters: the org ruleset has require_code_owner_review: true, so PRs to main will need a review from one of the three owners. Confirm the owner list.
• Delete the staging ruleset (id 16382425) and the staging branch after the staging PRs below are handled. staging has no content beyond main.
• awesome-copilot: it lists winui (pinned to win-dev-skills v0.7.1, which still works because tags keep the content) and winappcli. Repoint winui to winappCli at the next release.
• Next winappCli release: move winui to the release tag + sha, and bump both plugins together.

Open PRs targeting staging

PR	Suggested destination
#191 UWP skill-value benchmark (niels9001)	winappCli, with the WinUI tests and benchmarks
#186 skill benchmarking guide (niels9001)	winappCli
#185 opt-in unpackaged WinUI run guidance (nmetulev)	winappCli (plugins/winui)
#172 sync client manifest versions (nightcityblade)	Obsolete. The release machinery it fixes is removed; close
#171 ETW diagnostics skill (dotMorten)	Possible new debugging/diagnostics plugin listed in this catalog (check overlap with dotnet-diag)
#167 marketplace distribution doc (niels9001)	Re-evaluate here against main (catalog docs)
#148 OpenCode winui-dev orchestrator agent (Zhanyuanium)	winappCli (plugins/winui)
#147 OpenCode support in winui-session-report (Zhanyuanium)	winappCli (plugins/winui)
#140 winui-analyzer driver + rules (qiutongMS)	winappCli src/winapp-Analyzer (local analyzer already removed)
#134 winui-uwp-migration skill (qiutongMS)	winappCli (plugins/winui); overlaps #88
#95 dependabot Microsoft.CodeAnalysis.CSharp bump	Obsolete (src/tools is gone); close
#93 WinUI layout skill (wangdiandao)	winappCli (plugins/winui)
#88 winui-uwp-migration skill (niels9001)	winappCli (plugins/winui); overlaps #134