Matt Pocock skills
Source analysis: the tiny version script behind Matt Pocock skills releases
Trace sync-plugin-version.mjs through no-op, read-only check, guarded update and nested-field failure using six executed disposable fixtures.
What you will learn
- Follow the reads before the write
- Use adversarial fixtures, not only the happy path
- Understand what this evidence cannot establish
Before you start
- Basic repository, issue-tracker and test concepts
- An understanding that instructions and permission are different
Choose an adoption model and trace its files, authority boundaries and verification evidence.
Key takeaways
- Check mode is read-only even when versions disagree.
- The first textual match is guarded by a top-level JSON validation.
- Local version consistency does not establish distribution or deployment.
Follow the reads before the write
The maintenance script locates its repository relative to its own file, reads package.json and .claude-plugin/plugin.json, and parses both as JSON. package.json supplies the desired version. If the values already agree, it exits successfully without rewriting the plugin file. The check flag returns failure on a mismatch while leaving the original bytes alone.
In update mode, the implementation uses a regular expression to replace the first textual version field, then parses the candidate output and verifies its top-level version. Only a successful check reaches the final write. This preserves the existing layout for the expected manifest structure, but it is not a general-purpose structural JSON editing library.
Use adversarial fixtures, not only the happy path
The editorial probe verified the upstream script’s Git blob ID against the pinned source before copying it into six fresh local fixture directories. Equal versions passed without a write; check mode rejected a mismatch without a write; update mode changed only the expected version text; a second equal-version run remained unchanged. No package installation or release command was needed.
Two additional fixtures tested boundaries. A missing version field was rejected without altering the file. A nested version field appearing before the top-level field caused the first textual replacement to hit the nested field; the later top-level check then failed, again before writing. This is an observed limitation with a protective guard, not proof that arbitrary manifest structures are supported.
Understand what this evidence cannot establish
The test observes exit status and exact file bytes, using independently specified expected documents. It does not merely re-run the replacement expression to derive its own expected result. That makes the mismatch and nested-field cases capable of exposing a regression in the behavior being described. The source and probe results are retained with this series.
A successful local synchronization does not publish a package, move a marketplace pin or update a user’s installation. The script also does not provide an atomic multi-file release transaction. Keep release orchestration and distribution verification separate from this small file-consistency check; the next chapter explains how to measure the larger workflow without inventing results.
Implementation steps
- 1
Pin and verify the exact maintenance script.
- 2
Prepare independent expected files for no-op, mismatch and update cases.
- 3
Add missing-field and nested-first-field cases.
- 4
Assert exit codes and exact bytes without running a real release.
Copy-ready example
{
"executedScript": "scripts/sync-plugin-version.mjs",
"fixtureCases": 6,
"mismatchCheck": {"exitCode": 1, "fileChanged": false},
"nestedFirstVersion": {"exitCode": 1, "fileChanged": false},
"packagePublished": false,
"marketplaceUpdated": false
}Frequently asked questions
Why not simply parse and rewrite the whole JSON object?
The inspected implementation preserves the original file formatting by changing one textual field. That choice also creates the first-match limitation exercised by the fixture.
Was the actual upstream script executed?
Yes, after source-hash verification, against six disposable local fixtures. Skills, installers, releases and issue-tracker operations were not executed.
Sources
- package.jsonSource checked 2026-09-08
- .claude-plugin/plugin.jsonSource checked 2026-09-08
- scripts/sync-plugin-version.mjsSource checked 2026-09-08