[External Plugin]: version-sentinel

[KSEGIT]

Plugin name

version-sentinel

Short description

Version Sentinel hard-blocks dependency additions, bumps, and downgrades in agent sessions until a fresh, source-cited version check against the upstream registry is recorded. It stops hallucinated versions, stale training-data pins, and silent downgrades from reaching manifests across npm, pip (Poetry/uv), Cargo, and NuGet.

GitHub repository

KSEGIT/Version-Sentinel

Plugin path inside the repository

No response

Ref to review

version-sentinel-v0.4.1

Commit SHA to review

f3d5349685f22c96069383a559ed741b42bed508

Version

0.4.1

License identifier

MIT

Author name

Daniel Kiska

Author URL

https://github.com/KSEGIT

Homepage URL

https://github.com/KSEGIT/Version-Sentinel#readme

Keywords

dependencies, packages, versions, guardrails, hooks, supply-chain-security

Additional notes for reviewers

The plugin ships PreToolUse hooks that block dependency-manifest edits and install commands until the agent verifies the target version against the upstream registry and records the check (.version-sentinel/checks.json, 24h freshness window), plus /vs-record and /check-versions commands, a version-reviewer agent, and a version-sentinel skill. Intentional pins are supported via intentional:<reason> records, and VS_DISABLE=1 is a documented escape hatch.

I ran this repository's eng/external-plugin-quality-gates.mjs locally against this exact payload before submitting: vally lint, install smoke test (Copilot CLI 1.0.78), version match, and ref/sha consistency all pass. The only non-fatal spec-compliance warnings are about the extra top-level fields in plugin.json (skills, agents, commands, userConfig) and the missing $schema — those fields are required by the plugin's multi-platform support (Claude Code and derivatives), and removing them would break those hosts.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

⚠️ External plugin intake passed with spec warnings

This submission passed blocking quality checks and is ready for maintainer review, but it has non-blocking Agent Plugins spec compliance warnings.

• Plugin: version-sentinel
• Repository: https://github.com/KSEGIT/Version-Sentinel
• Ref: version-sentinel-v0.4.1
• SHA: f3d5349685f22c96069383a559ed741b42bed508

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	⚠️ warning
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

• spec compliance: warning
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: pass
• canvas structure: not_run
• overall: pass

spec compliance output (⚠️ warning)

Agent Plugins v1.0.0 manifest warnings:
- $schema should be "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json"
- top-level field "skills" is not part of Agent Plugins v1.0.0
- top-level field "agents" is not part of Agent Plugins v1.0.0
- top-level field "commands" is not part of Agent Plugins v1.0.0
- schema validation: manifest must have required property '$schema'
- schema validation: manifest must NOT have additional properties
- schema validation: manifest must NOT have additional properties
- schema validation: manifest must NOT have additional properties

vally lint output (✅ pass)

✅ version-sentinel (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-ogkd2J/copilot-home/.copilot/installed-plugins/external-plugin-intake/version-sentinel/plugin.json.

Version match output

- version-sentinel-v0.4.1: matched version "0.4.1" at "plugin.json".
- f3d5349685f22c96069383a559ed741b42bed508: matched version "0.4.1" at "plugin.json".

Ref/SHA consistency output

source.ref "version-sentinel-v0.4.1" resolves to the same commit as source.sha "f3d5349685f22c96069383a559ed741b42bed508".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "version-sentinel",
  "description": "Version Sentinel hard-blocks dependency additions, bumps, and downgrades in agent sessions until a fresh, source-cited version check against the upstream registry is recorded. It stops hallucinated versions, stale training-data pins, and silent downgrades from reaching manifests across npm, pip (Poetry/uv), Cargo, and NuGet.",
  "version": "0.4.1",
  "author": {
    "name": "Daniel Kiska",
    "url": "https://github.com/KSEGIT"
  },
  "repository": "https://github.com/KSEGIT/Version-Sentinel",
  "homepage": "https://github.com/KSEGIT/Version-Sentinel#readme",
  "license": "MIT",
  "keywords": [
    "dependencies",
    "packages",
    "versions",
    "guardrails",
    "hooks",
    "supply-chain-security"
  ],
  "source": {
    "source": "github",
    "repo": "KSEGIT/Version-Sentinel",
    "ref": "version-sentinel-v0.4.1",
    "sha": "f3d5349685f22c96069383a559ed741b42bed508"
  }
}

View workflow run

[KSEGIT]

/rerun-intake