Plugin CLI cheatsheet — plugin/references/cli-cheatsheet.md

A Claude Code plugin skill cannot always shell out to cyberine guide before it needs the answer (a skill's own description budget is paid whether or not it ever runs a command), so the same src/core/commandRegistry.ts table is also rendered to a checked-in file every plugin skill can Read directly: skills name it as ${CLAUDE_PLUGIN_ROOT}/references/cli-cheatsheet.md, which Claude Code substitutes with the installed plugin root at load (k9hq0; shipped skills cite CLI output and this file, never the repository's source or docs, and scripts/plugin-check.sh enforces it). It groups every top-level cyberine <command> by the same intent labels as the guide, tags each row with its cost class, and names which /cyberine:<skill> (if any) already wraps that intent.

npm run docs:plugin-cheatsheet         # regenerate plugin/references/cli-cheatsheet.md from source
npm run docs:plugin-cheatsheet:check   # exit non-zero on drift; writes nothing (CI-safe)

The check catches three distinct kinds of drift, not just regeneration staleness: a top-level subcommand src/cyberine.ts actually dispatches that COMMAND_REGISTRY does not declare (or the reverse), a --flag named in the registry that appears nowhere else under src/ (the cheap, high-recall signal for a typo'd or removed flag), and a slash-command name in the cheatsheet's per-intent coverage table whose plugin/skills/ directory no longer exists. It runs in the code-only docs CI job (.github/workflows/ci.yml) alongside docs:catalog:check.

Known Limitations and Deferred Work. The file is a point-in-time snapshot, not a live view — cyberine guide [<keyword>] is authoritative if the two ever disagree (they cannot disagree for long: the check above fails CI the moment someone forgets to regenerate). The per-intent slash-command coverage table (INTENT_SLASH_COMMANDS in scripts/gen-plugin-cheatsheet.ts) is hand-kept editorial judgment, not derived from the registry — only the skill NAMES in it are checked against plugin/skills/ on disk, not whether the mapping is still the right call. The flag-drift check is a substring search, not a parser: a flag that is real but spelled only inside a longer token elsewhere in src/ could pass when it should not, and it does not check flags against fleet/provider subcommand grammars beyond src/cyberine.ts's top level. autopilot and run do not yet link the cheatsheet from their own SKILL.md — both are mid-rewrite on a separate task, which owns adding the link there.