AgentSys 6.1.0 installs every plugin at the exact commit its marketplace pins

AgentSys 6.1 makes every install land on the commit the marketplace pins. Until now, Claude Code read a different key, and the npm installer skipped the pin. Now Claude Code, OpenCode, Codex, Cursor and Kiro all get the same plugin code. Here's what changed, and one thing to check before you upgrade.

Slide text

agentsys 6.1.0

release

Every plugin now installs at the commit its pin names

Claude Code OpenCode Codex Cursor Kiro

Claude Code's url plugin source reads url, ref and sha, and ignores the commit key the pins lived in. So every entry now carries sha, set to the same commit. Before, Claude Code installed the ref tag for 9 entries and the default branch for the other 15.

"prepare-delivery" source:
{
  "source": "url",
  "url": "…/agent-sh/prepare-delivery.git",
  "commit": "5df28a4b76aa…",
  "sha":    "5df28a4b76aa…",  "ref": "v0.3.0"
}

The npm installer, which fetches plugins for OpenCode, Codex, Cursor and Kiro, skipped the pin and tried a version tag, then main. So 14 of the 24 plugins arrived at another commit. Now it fetches the pinned commit and checks the archive came from it. A pin GitHub doesn't serve stops the install with an error.

A first install of a plugin on OpenCode, Codex, Cursor or Kiro fetched it, then replaced the whole agentsys folder, which deleted the plugin. The install still reported success. Now the local install is set up first, a failed fetch stops with an error, and installed.json keeps your earlier records.

On those same platforms, the installer copied only the skill file, so skills from consult, debate, deslop and others lost their references and scripts. Now the whole directory is copied. And Codex installs plugin skills as well as commands, so skill-only plugins like mojo and ada-spark reach it.

├── SKILL.md
├── references/└── scripts/

Each skill folder agentsys installs gets a marker file with the plugin's name and version. A marked folder is replaced, and so is an old one holding only files the skill ships, so upgrading needs no manual step. Any other folder, or a symlink, is skipped with a warning. Before, Cursor and Kiro deleted it.

├── .agentsys-skill├── SKILL.md
├── references/
└── scripts/

On Codex, a command file named dot dot md resolved to the skills directory itself, and the install deleted every skill in it. Odd names are now skipped with a warning. On Windows, with delayed expansion on, a name between exclamation marks in an argument became that variable's value. Shims now turn delayed expansion off.

The pins also move to each plugin's current main. banthis goes from 0.3.1 to 0.6.0. Its ban triggers fire only when you explicitly ask, and it writes a rule only after you confirm the wording. ship, next-task, deslop and drift-detect move too. The orientation plugin is removed, because its lookups returned missing or stale history.

One check before you upgrade. If your own skill shares a plugin skill's name and holds only a skill file, OpenCode, Cursor, Kiro and Codex command skills still replace it, since it looks like an older agentsys install. Add any other file and it stays. Then install with the npm line from the README, and every plugin lands at the commit its pin names.

$ npm install -g agentsys && agentsys