Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -24,8 +24,8 @@
       "repo": "https://github.com/Yeachan-Heo/oh-my-codex.git",
       "ref": "main",
       "adapter": "codex-plugin",
-      "commit": "2da36489cfa07ef1df802f01865e7d959d36f236",
+      "commit": "afc3980e024cb31c74ad32e91ed4ac55051f16e9",
-      "syncedAt": "2026-09-03T09:20:38Z"
+      "syncedAt": "2026-09-06T15:59:59Z"
     },
     {
       "id": "ui-ux-pro-max",
@@ -33,8 +33,8 @@
       "repo": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "f3ac195224eac1eb0dfe1a3059c2a6add78ffbe3",
+      "commit": "4aad0584d92131626b16d4ff4d77f0455385013c",
-      "syncedAt": "2026-09-03T16:00:00Z"
+      "syncedAt": "2026-09-06T15:59:59Z"
     },
     {
       "id": "caveman",
@@ -60,8 +60,8 @@
       "repo": "https://github.com/shadcn-ui/ui.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "7c9eaba1c0a6404c990c144a654792e3313c650d",
+      "commit": "5c7072da672b0048bc6771e3204063a2537df91a",
-      "syncedAt": "2026-09-04T16:00:00Z"
+      "syncedAt": "2026-09-06T15:59:59Z"
     },
     {
       "id": "frontend-slides",
@@ -132,8 +132,8 @@
       "repo": "https://github.com/vercel/next.js.git",
       "ref": "canary",
       "adapter": "skill-collection",
-      "commit": "6685283fe8533a469ee1a9455e2bc4047c7453cb",
+      "commit": "4fed8eaf197aaa60fd85371352482199a4c2107f",
-      "syncedAt": "2026-09-05T16:00:00Z"
+      "syncedAt": "2026-09-06T15:59:59Z"
     },
     {
       "id": "shuorenhua",

plugins/codex/plugins/mcp-playwright/MCP_SOURCE.json

@@ -3,5 +3,5 @@
   "name": "playwright浏览器自动化操作",
   "version": "20260605",
   "keySource": "none",
-  "syncedAt": "2026-09-05T16:02:05Z"
+  "syncedAt": "2026-09-06T16:01:58Z"
 }

plugins/codex/plugins/next-skills/THIRD_PARTY_SOURCE.json

@@ -2,8 +2,8 @@
   "sourceId": "next-skills",
   "repo": "https://github.com/vercel/next.js.git",
   "ref": "canary",
-  "commit": "6685283fe8533a469ee1a9455e2bc4047c7453cb",
+  "commit": "4fed8eaf197aaa60fd85371352482199a4c2107f",
   "adapter": "skill-collection",
   "sourcePath": "skills",
-  "syncedAt": "2026-09-05T16:00:00Z"
+  "syncedAt": "2026-09-06T15:59:59Z"
 }

plugins/codex/plugins/oh-my-codex/THIRD_PARTY_SOURCE.json

@@ -2,8 +2,8 @@
   "sourceId": "oh-my-codex",
   "repo": "https://github.com/Yeachan-Heo/oh-my-codex.git",
   "ref": "main",
-  "commit": "2da36489cfa07ef1df802f01865e7d959d36f236",
+  "commit": "afc3980e024cb31c74ad32e91ed4ac55051f16e9",
   "adapter": "codex-plugin",
   "sourcePath": "plugins/oh-my-codex",
-  "syncedAt": "2026-09-03T09:20:38Z"
+  "syncedAt": "2026-09-06T15:59:59Z"
 }

plugins/codex/plugins/shadcn/THIRD_PARTY_SOURCE.json

@@ -2,8 +2,8 @@
   "sourceId": "shadcn",
   "repo": "https://github.com/shadcn-ui/ui.git",
   "ref": "main",
-  "commit": "7c9eaba1c0a6404c990c144a654792e3313c650d",
+  "commit": "5c7072da672b0048bc6771e3204063a2537df91a",
   "adapter": "claude-skill",
   "sourcePath": "skills/shadcn",
-  "syncedAt": "2026-09-04T16:00:00Z"
+  "syncedAt": "2026-09-06T15:59:59Z"
 }

plugins/codex/plugins/ui-ux-pro-max/README.md

@@ -280,6 +280,7 @@ uipro versions              # List available versions
 uipro update                # Refresh skill files from installed CLI package
 uipro update --global       # Refresh global skill files from installed CLI package
 uipro init --offline        # Compatibility flag; installs bundled templates
+uipro init --dry-run        # Preview install actions without writing files
 uipro uninstall             # Remove skill (auto-detect platform)
 uipro uninstall --ai claude # Remove specific platform
 uipro uninstall --global    # Remove from global install
@@ -483,6 +484,7 @@ npm run typecheck
 # `npm run build` uses Bun when available and falls back to TypeScript compiler output after `npm ci`.
 npm run build
 node dist/index.js init --ai claude --offline  # Test in a temp folder
+node dist/index.js init --ai claude --dry-run  # Preview install actions (no writes)
 
 # 6. Create PR (never push directly to main)
 git checkout -b feat/your-feature

plugins/codex/plugins/ui-ux-pro-max/THIRD_PARTY_SOURCE.json

@@ -2,8 +2,8 @@
   "sourceId": "ui-ux-pro-max",
   "repo": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git",
   "ref": "main",
-  "commit": "f3ac195224eac1eb0dfe1a3059c2a6add78ffbe3",
+  "commit": "4aad0584d92131626b16d4ff4d77f0455385013c",
   "adapter": "claude-skill",
   "sourcePath": ".claude/skills/ui-ux-pro-max",
-  "syncedAt": "2026-09-03T16:00:00Z"
+  "syncedAt": "2026-09-06T15:59:59Z"
 }

plugins/codex/plugins/ui-ux-pro-max/skills/ui-ux-pro-max/scripts/search.py

@@ -120,6 +120,12 @@ if __name__ == "__main__":
 
     # Design system takes priority
     if args.design_system:
+        if args.stack:
+            print(
+                f"note: --stack {args.stack} is ignored in --design-system mode; "
+                "run a separate --stack query for stack-specific guidelines",
+                file=sys.stderr,
+            )
         result = generate_design_system(
             args.query,
             args.project_name,

plugins/codex/plugins/ui-ux-pro-max/skills/ui-ux-pro-max/scripts/tests/test_design_system_stack.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Regression tests for the dropped --stack flag in --design-system mode (issue #484).
+
+`search.py "<query>" --design-system --stack nextjs` used to exit successfully
+without any indication that the stack was never applied, so a caller following
+SKILL.md's "never assume a stack" guidance could believe stack guidance was
+part of the generated design system. The combination must stay valid, but it
+must say that --stack was ignored.
+
+Stdlib-only (unittest, not pytest) to match test_core.py -- this project ships
+with zero external dependencies.
+
+Run with:
+    python -m unittest discover -s scripts/tests -v
+or directly:
+    python scripts/tests/test_design_system_stack.py
+"""
+
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+
+SCRIPTS_DIR = Path(__file__).resolve().parent.parent
+SEARCH = SCRIPTS_DIR / "search.py"
+
+
+class TestStackFlagWithDesignSystem(unittest.TestCase):
+    def run_search(self, *args):
+        # The child forces UTF-8 on its streams (search.py), so decode as UTF-8
+        # regardless of the parent's locale on Windows.
+        return subprocess.run(
+            [sys.executable, str(SEARCH), *map(str, args)],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            check=False,
+        )
+
+    def test_design_system_with_stack_succeeds_and_says_stack_is_ignored(self):
+        proc = self.run_search("platform engineer dashboard", "--design-system", "--stack", "nextjs")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertIn("--stack", proc.stderr)
+        self.assertIn("ignored", proc.stderr.lower())
+
+    def test_design_system_without_stack_stays_quiet(self):
+        proc = self.run_search("platform engineer dashboard", "--design-system")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertNotIn("ignored", proc.stderr.lower())
+
+    def test_stack_search_alone_never_warns(self):
+        proc = self.run_search("dashboard table density", "--stack", "nextjs")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertNotIn("ignored", proc.stderr.lower())
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)