pm-skills entry in plugins/external.json uses fully-qualified ref, breaking plugin install

[dfrysinger]

Summary

The pm-skills entry in plugins/external.json uses a fully-qualified git ref (refs/tags/v2.1.0) in its source.ref field. This causes plugin installation to fail in Copilot CLI because the CLI passes this value verbatim to git clone --depth 1 --branch, which rejects fully-qualified refs.

Affected entry

plugins/external.json:

{
  "name": "pm-skills",
  ...
  "source": {
    "source": "github",
    "repo": "Avyayalaya/pm-skills-arsenal",
    "ref": "refs/tags/v2.1.0"
  }
}

Symptom

/plugin install pm-skills@awesome-copilot

fails with:

fatal: Remote branch refs/tags/v2.1.0 not found in upstream origin

Why this fails

git clone --depth 1 --branch <ref> only accepts short names (e.g. v2.1.0), not fully-qualified names (refs/tags/v2.1.0). The shallow upload-pack protocol does not advertise fully-qualified names.

Reproduction:

# fails
git clone --depth 1 --branch refs/tags/v2.1.0 https://github.com/Avyayalaya/pm-skills-arsenal.git

# succeeds
git clone --depth 1 --branch v2.1.0 https://github.com/Avyayalaya/pm-skills-arsenal.git

Suggested fix

Change "ref": "refs/tags/v2.1.0" to "ref": "v2.1.0" in the pm-skills entry.

Scope check: I audited all 18 entries in plugins/external.json; pm-skills is the only entry using a refs/tags/ or refs/heads/ prefix. Everywhere else, the convention is short ref names.

Related

The CLI side of this same issue is tracked at github/copilot-cli#3437 — the CLI should also be hardened to strip the prefix and not blow up on this input. Both fixes are independently valuable; fixing this entry unblocks pm-skills users immediately.

[dfrysinger]

Cross-reference: github/copilot-cli#3437 tracks the corresponding CLI-side fix (the CLI should not blow up on fully-qualified refs even when marketplace entries supply them).

[aaronpowell]

Thanks @dfrysinger - looks like I had a few false assumptions about how CLI was handling this. I'll track that issue and associated PR as I'm not 100% sure if there's anything we can fix on this end at the moment.