[voltagent-qa-sec] Plugin fails to load on v1.1.0 — manifest references 2 agent files that don't exist in the pack

[Sweetcompanionai]

Summary

The voltagent-qa-sec plugin fails to load with Status: ✘ failed to load on the current main branch (commit 6f804f0, version 1.1.0). The plugin manifest declares 18 agents, but only 16 are present in the pack directory. Two agent files referenced in the manifest do not exist on disk:

• cost-accounting-performance-reviewer.md
• performance-roi-translator.md

This blocks all 16 working agents in the pack from being loaded, including security-auditor, code-reviewer, debugger, qa-expert, penetration-tester, etc.

Reproduction

claude plugin marketplace add VoltAgent/awesome-claude-code-subagents
claude plugin install voltagent-qa-sec@voltagent-subagents --scope user
claude plugin list

Output:

voltagent-qa-sec@voltagent-subagents
Version: 1.1.0
Scope: user
Status: ✘ failed to load
Error: Path not found: ~/.claude/plugins/cache/voltagent-subagents/voltagent-qa-sec/1.1.0/cost-accounting-performance-reviewer.md (agents)
Error: Path not found: ~/.claude/plugins/cache/voltagent-subagents/voltagent-qa-sec/1.1.0/performance-roi-translator.md (agents)

Root cause

The bug is a manifest-vs-files desync that is recurrent across versions:

Commit	Date	Version	Manifest references missing files?
c3f2bf4	2026-04-08	1.1.0 (initial)	❌ YES — bug introduced
8fa4445	2026-04-19	1.0.3	✅ NO — clean manifest
ed47c29	2026-04-20	1.1.0 (re-merged)	❌ YES — bug re-introduced
6f804f0 (HEAD)	2026-04-29	1.1.0	❌ YES — still broken

The manifest was clean at 8fa4445 but a later merge re-introduced references to two files (cost-accounting-performance-reviewer.md, performance-roi-translator.md) without committing the actual files.

Suggested fix

Two options:

Option A — Remove the dead references (fast):
Edit categories/04-quality-security/.claude-plugin/plugin.json and remove the two entries pointing to cost-accounting-performance-reviewer.md and performance-roi-translator.md.

Option B — Add the missing agent files (if those agents are intended to ship):
Commit the two missing .md files referenced by the manifest.

Preventive recommendation

A simple CI check would prevent this class of bug from recurring:

# Pseudo-code for CI
for plugin_json in $(find categories -name 'plugin.json'); do
  plugin_dir=$(dirname $(dirname "$plugin_json"))
  for agent in $(jq -r '.agents[]' "$plugin_json"); do
    test -f "$plugin_dir/$agent" || { echo "MISSING: $plugin_dir/$agent"; exit 1; }
  done
done

Adding this as a GitHub Action on PRs would catch manifest/files desyncs before merge.

Environment

• Claude Code: 2.1.121
• macOS
• Plugin: voltagent-qa-sec v1.1.0
• Marketplace cloned from: VoltAgent/awesome-claude-code-subagents main branch

Impact

This pack is high-value (security-auditor, penetration-tester, compliance-auditor, etc.) and many users are likely waiting on a fix. Happy to test a patch when ready.

Thanks for the great work on this marketplace overall.

[DND202021]

Confirming this bug still reproduces today (2026-05-14) on a fresh voltagent-qa-sec@1.1.0 install — plugin.json in both the marketplace and the cached plugin still references cost-accounting-performance-reviewer.md and performance-roi-translator.md, neither of which ship with the pack.

PR #239 (the orphan-entry removal) appears to still be open and not yet merged. Would be great to get it landed — the 16 working agents in this pack are blocked behind the manifest error.