This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryThe installer for Cowork plugins now correctly builds and uploads a plugin bundle instead of writing to a transient local manifest that is overwritten on session start.
Full changelog
v0.5.20 — 2026-04-23 — Cowork plugin install: retraction + drag-drop fix
v0.5.19 shipped a broken installer. This release retracts the
"permanent fix" framing and delivers the actual permanent fix.
What v0.5.19 claimed vs what actually happened
v0.5.19's myco-install cowork-plugin wrote a plugin tree into
<APPDATA>/Claude/local-agent-mode-sessions/<owner>/<ws>/rpm/plugin_myco/
and upserted an entry in each rpm/manifest.json. The release
changelog described this as "the permanent fix for agent onboarding
in Cowork." It is not. Cowork's [RemotePluginManager] regenerates
rpm/manifest.json from an Anthropic cloud marketplace on every
session start, and sync runs drop any plugins[] row that does not
correspond to a cloud entry — the v0.5.19 writes are wiped silently
between sessions.
Symptom (as reported on 2026-04-23): after restart and a fresh Cowork
session, the myco-substrate skill was missing from the agent's
available-skills list even though the installer exited zero a moment
earlier. Direct inspection confirmed rpm/manifest.json no longer
contained the plugin_myco row we wrote.
Root cause
The source of truth for Cowork plugins is an Anthropic cloud
marketplace (marketplace_01UDYDZqTLSQBkNqpTGCfzNM for account
uploads), not the local rpm/ directory. Claude Desktop's drag-drop
UI POSTs the bundle to
https://api.anthropic.com/api/organizations/{orgId}/marketplaces/{marketplaceId}/plugins/account-upload,
and the server-side record is what every Cowork session syncs from.
rpm/ is a cache, never a source. Reading the decompiled
app.asar:433299-433340 confirmed this end-to-end.
v0.5.20 fix
- New
src/myco/install/plugin_bundle.py: builds a
myco-<version>.pluginZIP (single top-level dirmyco/holding
.claude-plugin/plugin.json+.mcp.json+skills/myco-substrate/
— the layout Claude Desktop's upload handler validates against). - New
scripts/build_plugin.py: thin CLI wrapping the library;
the GitHub Release workflow now runs it and attaches the.plugin
as a release asset, so users can eithercurl -Lthe latest or
python scripts/build_plugin.pyfrom a repo checkout. myco-install cowork-pluginrewritten: drops therpm/writer
entirely. Default action now builds the bundle, prints exact
drag-drop instructions, and exits.--cleanup-legacyremoves
v0.5.19-era cruft (rpm/plugin_myco/dirs + manifest rows).myco-install host cowork+--all-hosts: the flow that
auto-ran the (broken) plugin install now builds the bundle and
prints upload instructions instead. Uninstall paths are silent —
removing the plugin is a user action in Claude Desktop's UI.- Legacy-function regression guard: the old
install_cowork_plugin()function now raisesRuntimeErrorwith a
migration message, so any script that still imports it gets a loud
failure rather than a silent wrong install. - Release workflow:
.github/workflows/release.ymladds a
.cowork-plugin/plugin.jsonversion check alongside the existing
four-file parity gate, builds the.plugin, and uploads it via
gh release uploadwith--clobberfor idempotency.
What did NOT change
- R1–R7 rule text. Unchanged.
- Category enum / exit-policy / exit codes. Unchanged.
- 18-verb manifest. Unchanged.
- 25 lint dimensions. Unchanged.
- Claude Code plugin bundle (
.claude-plugin/at repo root).
Unchanged — that install path works correctly and was never
affected by therpm/misunderstanding.
Break from v0.5.19
Cosmetic. The CLI still has myco-install cowork-plugin, but its
flags and behavior differ: --uninstall is gone (no CLI uninstall —
remove through Claude Desktop UI), replaced with --cleanup-legacy;
new --output controls where the .plugin file is written.
Anyone whose v0.5.19 install "succeeded" should run:
myco-install cowork-plugin --cleanup-legacy
to scrub the residue, then follow the drag-drop upload flow below.
Operator action
# 1. MCP config (write once)
myco-install host cowork
# 2. Build the .plugin bundle
myco-install cowork-plugin
# or:
curl -L -o myco.plugin https://github.com/Battam1111/Myco/releases/latest/download/myco.plugin
# 3. Drag dist/myco-<version>.plugin into Claude Desktop:
# Settings → Plugins (or Extensions) → Upload → select the file
# 4. Restart any open Cowork session
Full rationale + screenshots: docs/INSTALL.md § 1.1.
Lesson
v0.5.19 shipped a fix whose correctness I verified only by checking
the post-install filesystem state, not by checking the post-restart
filesystem state. The regression shipped because "installer wrote to
disk successfully" and "plugin persists across restarts" are
different claims and I tested only the first. Future host-axis
installers must be tested end-to-end across a session restart before
shipping a "permanent fix" label.
Breaking Changes
- Removed `--uninstall` flag from `myco-install cowork-plugin`; uninstall must be performed via Claude Desktop UI.
- Dropped legacy behavior of writing plugin entries to `rpm/manifest.json` and associated directories; installer now builds a `.plugin` bundle for drag‑drop upload.
- Renamed/removal of old `install_cowork_plugin()` function – it raises `RuntimeError` with migration guidance if still imported.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Battam1111/Myco
Agent-first cognitive substrate with 18 manifest-driven verbs (germinate / eat / assimilate / sporulate / traverse / immune / molt / …) and 25 lint dimensions enforcing contract invariants mechanically (R1–R7). Cross-session / cross-project memory via a self-validating filesystem graph — AST + markdown-link derived, not embedding-based. Provider-agnostic by design: MP1/MP2 dims forbid LLM-SDK imports in the kernel and plugin tree. Editable-default install. Works with Claude Code, Cursor, Windsurf, Zed, VS Code, and any MCP client.
Related context
Related tools
Beta — feedback welcome: [email protected]