Hivemind turns agent traces into skills and shares with your team

Summary

Removes the two main sources of merge-conflict churn on main:

1. All 7 build-artifact directories are gitignored — bundle/, claude-code/bundle/, codex/bundle/, cursor/bundle/, hermes/bundle/, mcp/bundle/, pi/bundle/. PR #170's merge alone touched 40+ bundle files in commit d8f76bf — that class of diff disappears entirely going forward.
2. Version is synced from package.json via scripts/sync-versions.mjs — replaces the hand-rolled node -e JSON-rewriting block in release.yml (history of buggy releases: chore commits 6f1d89a, 8f911ba).

Marketplace install still works for legacy + new users — installClaude() is unchanged. marketplace.json switches from source: "./claude-code" to the git-subdir SHA-pinned form (the dominant 2026 pattern in anthropics/claude-plugins-official — used by Adobe, AWS, Apollo, Microsoft, etc.). Users doing claude plugin marketplace add activeloopai/hivemind clone main, read marketplace.json, see the pinned SHA → Claude Code clones the repo at THAT SHA (which has bundles tracked) → extracts claude-code/ → installs.

How the SHA-pin works (the 2-commit release pattern)

release.yml's bump step is now 2 commits per release:

• Commit 1: release: v<X> — npm run build runs (prebuild → sync-versions propagates version into 6 manifests; esbuild emits bundles with version baked-in); git add -fA force-tracks the gitignored bundles into THIS commit. The marketplace.json sha at HEAD will reference this commit.
• Commit 2: chore: untrack bundles, point marketplace at <commit-1-sha> — git rm --cached -r for the 7 bundle dirs (removes from index, leaves working tree intact so npm publish still ships them); updates marketplace.json's plugins[0].source.sha to commit 1's SHA.

Net effect: main HEAD always bundle-free → PR diffs always source-only → no more merge churn on regenerated bundles. The pinned SHA is reachable from main's history, so claude plugin install continues to work.

This PR itself is a 2-commit bootstrap mirroring that pattern. Marketplace SHA points at commit edb1549e20aefd9da540bde529d31869c80a6379.

End-to-end validation

Verified locally before pushing this PR:

1. scripts/sync-versions.mjs — 6/6 unit tests pass (tests/scripts/sync-versions.test.ts).
2. rm -rf all 7 bundle dirs + npm run build — all regenerate; manifests synced.
3. npm run ci && npm test — all 2733 tests pass.
4. npm pack --dry-run — tarball contains 53 files including all bundles.
5. node --check on every bundle entrypoint — clean parse.
6. End-to-end marketplace install — pushed this branch to a local bare repo, ran claude plugin marketplace add against a clone with the file:// URL, ran claude plugin install hivemind@hivemind — Claude Code resolved the SHA-pinned source, cloned the bare repo at commit edb1549e20aefd9da540bde529d31869c80a6379, extracted claude-code/, installed cleanly with full bundle content present at ~/.claude/plugins/cache/hivemind/hivemind/0.7.34/.

What's NOT in this PR (intentional)

• No installClaude() rewrite — current implementation keeps working unchanged.
• No removal of .claude-plugin/marketplace.json — marketplace path preserved.
• No migration code for legacy users — autoupdate via npm is independent of the marketplace mechanism.
• No README/docs updates — separate sister PR.
• Plugin-cache GC retention (#179) — orthogonal follow-up.

Test plan

• [ ] CI passes (green test suite + bundle smoke + no verify-bundle failure)
• [ ] After merge: confirm the auto-bump release flow produces the expected 2-commit pair on main
• [ ] After merge: confirm marketplace add activeloopai/hivemind + plugin install hivemind@hivemind works for a fresh install
• [ ] After merge: confirm an existing v0.7.30 user's autoupdate cycle picks up the new version without errors

Summary by CodeRabbit

• Bug Fixes

  • Replaced build regression detection with improved bundle validation that smoke-tests built bundles for parse errors.

• Refactor

  • Serialized release runs and moved to a two-commit release pattern to reliably track built bundles.
  • Switched plugin source references to git-subdirectory pins (commit-sha locked).

• Chores

  • Removed bundled local CLI hooks and background workers (session/auth/embedding/skillify/wiki flows).
  • Updated .gitignore to exclude bundle output directories.