@carllee1983/dbcli 1.39.1 → 1.41.0

package/dist/core.d.ts

@@ -86,6 +86,8 @@ export interface ColumnSchema {
 export interface TableSchema {
 	/** Table name */
 	name: string;
+	/** Exact database schema/catalog namespace, when reliably available */
+	schema?: string;
 	/** Array of columns in the table */
 	columns: ColumnSchema[];
 	/** Approximate row count (if available) */
@@ -98,6 +100,7 @@ export interface TableSchema {
 	foreignKeys?: Array<{
 		name: string;
 		columns: string[];
+		refSchema?: string;
 		refTable: string;
 		refColumns: string[];
 	}>;

package/dist/core.mjs

@@ -13434,6 +13434,7 @@ var COMMAND_CAPABILITY_KEYS = Object.freeze([
   "schemaSingle",
   "schemaFullScan",
   "query",
+  "lint",
   "queryOutput",
   "queryLimitGuard",
   "q",
@@ -13482,6 +13483,7 @@ var SQL_BASE = {
   schemaSingle: cap("supported", "readonly", "Reads a single table schema."),
   schemaFullScan: cap("supported", "readonly", "Full scan, refresh, and reset are supported."),
   query: cap("supported", "readonly", "Runs SQL through permission and blacklist guards."),
+  lint: cap("supported", "readonly", "Statically analyzes SQL without connecting to the database."),
   queryOutput: cap("supported", "readonly", "table/json/csv output is supported."),
   queryLimitGuard: cap("supported", "readonly", "Query-only auto-limit and size guard are supported."),
   q: cap("supported", "readonly", "Saved SQL snippets allow SELECT/WITH only."),
@@ -13511,6 +13513,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
   mariadb: Object.freeze(SQL_BASE),
   mongodb: Object.freeze({
     ...SQL_BASE,
+    lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
     schemaSingle: cap("limited", "readonly", "MongoDB schema is sampled from documents."),
     schemaFullScan: cap("limited", "readonly", "Full scan is sampled and document-oriented."),
     query: cap("limited", "readonly", "Uses JSON filter or aggregation syntax, not SQL."),
@@ -13529,6 +13532,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
   }),
   redis: Object.freeze({
     ...SQL_BASE,
+    lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
     schemaSingle: cap("limited", "readonly", "Per-key synthetic schema only."),
     schemaFullScan: cap("unsupported", "none", "Redis has no full schema cache scan."),
     query: cap("limited", "readonly", "Runs allow-listed Redis commands."),
@@ -13547,6 +13551,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
   }),
   elasticsearch: Object.freeze({
     ...SQL_BASE,
+    lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
     schemaSingle: cap("limited", "readonly", "Schema flattens index mappings."),
     schemaFullScan: cap("supported", "readonly", "Full scan iterates non-system indices."),
     query: cap("limited", "readonly", "Uses JSON DSL or Lucene query strings with an index."),
@@ -14437,6 +14442,10 @@ function fixDoubleEncodedUtf8(str) {
 }
 
 // src/adapters/postgresql-adapter.ts
+function quoteIdentifier(identifier) {
+  return `"${identifier.replaceAll('"', '""')}"`;
+}
+
 class PostgreSQLAdapter {
   pool = null;
   client = null;
@@ -14522,6 +14531,7 @@ class PostgreSQLAdapter {
     try {
       const query = `
         SELECT
+          n.nspname as schema_name,
           c.relname as table_name,
           c.reltuples::bigint as estimated_rows,
           CASE c.relkind
@@ -14541,6 +14551,7 @@ class PostgreSQLAdapter {
       const result = await this.execute(query);
       return result.rows.map((row) => ({
         name: row.table_name,
+        schema: row.schema_name,
         columns: [],
         columnCount: row.column_count,
         rowCount: Math.max(0, row.estimated_rows || 0),
@@ -14569,9 +14580,15 @@ class PostgreSQLAdapter {
             SELECT EXISTS(
               SELECT 1 FROM information_schema.table_constraints tc
               JOIN information_schema.key_column_usage kcu
-                ON tc.constraint_name = kcu.constraint_name
-              WHERE tc.table_name = $1
-                AND tc.table_schema = 'public'
+                ON tc.constraint_catalog = kcu.constraint_catalog
+                AND tc.constraint_schema = kcu.constraint_schema
+                AND tc.constraint_name = kcu.constraint_name
+              WHERE tc.table_catalog = c.table_catalog
+                AND tc.table_schema = c.table_schema
+                AND tc.table_name = c.table_name
+                AND kcu.table_catalog = c.table_catalog
+                AND kcu.table_schema = c.table_schema
+                AND kcu.table_name = c.table_name
                 AND tc.constraint_type = 'PRIMARY KEY'
                 AND kcu.column_name = c.column_name
             )
@@ -14594,8 +14611,12 @@ class PostgreSQLAdapter {
           c.column_name as name,
           array_agg(e.enumlabel ORDER BY e.enumsortorder) as enum_values
         FROM information_schema.columns c
-        JOIN pg_type t ON t.typname = c.udt_name
-        JOIN pg_enum e ON e.enumtypid = t.oid
+        JOIN pg_catalog.pg_type AS enum_type
+          ON enum_type.typname = c.udt_name
+        JOIN pg_catalog.pg_namespace AS enum_schema
+          ON enum_schema.oid = enum_type.typnamespace
+          AND enum_schema.nspname = c.udt_schema
+        JOIN pg_catalog.pg_enum AS e ON e.enumtypid = enum_type.oid
         WHERE c.table_name = $1
           AND c.table_schema = 'public'
         GROUP BY c.column_name
@@ -14608,17 +14629,40 @@ class PostgreSQLAdapter {
       }
       const fkQuery = `
         SELECT
-          tc.constraint_name as name,
-          array_agg(kcu.column_name) as columns,
-          ccu.table_name as ref_table,
-          array_agg(ccu.column_name) as ref_columns
-        FROM information_schema.table_constraints AS tc
-        JOIN information_schema.key_column_usage AS kcu
-          ON tc.table_name = kcu.table_name AND tc.constraint_name = kcu.constraint_name
-        JOIN information_schema.constraint_column_usage AS ccu
-          ON ccu.constraint_name = tc.constraint_name
-        WHERE tc.table_name = $1 AND tc.constraint_type = 'FOREIGN KEY'
-        GROUP BY tc.constraint_name, ccu.table_name
+          constraint_info.conname as name,
+          array_agg(source_column.attname ORDER BY source_key.ordinality) as columns,
+          referenced_schema.nspname as ref_schema,
+          referenced_table.relname as ref_table,
+          array_agg(referenced_column.attname ORDER BY source_key.ordinality) as ref_columns
+        FROM pg_catalog.pg_constraint AS constraint_info
+        JOIN pg_catalog.pg_class AS source_table
+          ON source_table.oid = constraint_info.conrelid
+        JOIN pg_catalog.pg_namespace AS source_schema
+          ON source_schema.oid = source_table.relnamespace
+        JOIN pg_catalog.pg_class AS referenced_table
+          ON referenced_table.oid = constraint_info.confrelid
+        JOIN pg_catalog.pg_namespace AS referenced_schema
+          ON referenced_schema.oid = referenced_table.relnamespace
+        JOIN LATERAL unnest(constraint_info.conkey) WITH ORDINALITY
+          AS source_key(attnum, ordinality) ON TRUE
+        JOIN LATERAL unnest(constraint_info.confkey) WITH ORDINALITY
+          AS referenced_key(attnum, ordinality)
+          ON referenced_key.ordinality = source_key.ordinality
+        JOIN pg_catalog.pg_attribute AS source_column
+          ON source_column.attrelid = constraint_info.conrelid
+          AND source_column.attnum = source_key.attnum
+        JOIN pg_catalog.pg_attribute AS referenced_column
+          ON referenced_column.attrelid = constraint_info.confrelid
+          AND referenced_column.attnum = referenced_key.attnum
+        WHERE constraint_info.contype = 'f'
+          AND source_table.relname = $1
+          AND source_schema.nspname = 'public'
+        GROUP BY
+          constraint_info.oid,
+          constraint_info.conname,
+          referenced_schema.nspname,
+          referenced_table.relname
+        ORDER BY constraint_info.oid
       `;
       const fkResult = await this.execute(fkQuery, [tableName]);
       const fkResults = fkResult.rows;
@@ -14646,36 +14690,49 @@ class PostgreSQLAdapter {
       const indexResult = await this.execute(indexQuery, [tableName]);
       const indexResults = indexResult.rows;
       const estimateQuery = `
-        SELECT reltuples::bigint as estimated_rows
-        FROM pg_class
-        WHERE relname = $1
+        SELECT source_table.reltuples::bigint as estimated_rows
+        FROM pg_catalog.pg_class AS source_table
+        JOIN pg_catalog.pg_namespace AS source_schema
+          ON source_schema.oid = source_table.relnamespace
+        WHERE source_table.relname = $1
+          AND source_schema.nspname = 'public'
       `;
       const estimateResult = await this.execute(estimateQuery, [
         tableName
       ]);
       const estimateResults = estimateResult.rows;
       const pkQuery = `
-        SELECT array_agg(a.attname) as columns
-        FROM (
-          SELECT a.attname
-          FROM pg_index i
-          JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = ANY(i.indkey)
-          WHERE i.indisprimary AND i.indrelid = $1::regclass
-          ORDER BY a.attnum
-        ) a
+        SELECT
+          array_agg(primary_key_column.attname ORDER BY primary_key.ordinality) as columns
+        FROM pg_catalog.pg_index AS index_info
+        JOIN pg_catalog.pg_class AS source_table
+          ON source_table.oid = index_info.indrelid
+        JOIN pg_catalog.pg_namespace AS source_schema
+          ON source_schema.oid = source_table.relnamespace
+        JOIN LATERAL unnest(index_info.indkey) WITH ORDINALITY
+          AS primary_key(attnum, ordinality) ON TRUE
+        JOIN pg_catalog.pg_attribute AS primary_key_column
+          ON primary_key_column.attrelid = source_table.oid
+          AND primary_key_column.attnum = primary_key.attnum
+        WHERE index_info.indisprimary
+          AND source_table.relname = $1
+          AND source_schema.nspname = 'public'
       `;
       const pkResult = await this.execute(pkQuery, [tableName]);
       const pkResults = pkResult.rows;
-      const countResult = await this.execute(`SELECT COUNT(*) as count FROM "${tableName}"`);
+      const qualifiedTableName = `${quoteIdentifier("public")}.${quoteIdentifier(tableName)}`;
+      const countResult = await this.execute(`SELECT COUNT(*) as count FROM ${qualifiedTableName}`);
       const primaryKeyArray = Array.isArray(pkResults[0]?.columns) ? pkResults[0].columns : [];
       const safeForeignKeys = fkResults.map((fk) => ({
         name: fk.name,
         columns: Array.isArray(fk.columns) ? fk.columns : [],
+        refSchema: fk.ref_schema,
         refTable: fk.ref_table,
         refColumns: Array.isArray(fk.ref_columns) ? fk.ref_columns : []
       }));
       const schema = {
         name: tableName,
+        schema: "public",
         columns: columns.map((col) => ({
           name: col.name,
           type: col.type,
@@ -17423,6 +17480,7 @@ class SessionIdService {
 
 // src/core/config-binding.ts
 import { createHash } from "crypto";
+import { mkdir as mkdir4, unlink } from "fs/promises";
 import { homedir } from "os";
 import { basename, join as join3, resolve } from "path";
 var BINDING_FILE_NAME = "config.json";
@@ -17467,8 +17525,8 @@ async function writeProjectBinding(projectPath, storagePath = getProjectStorageP
       createdAt: new Date().toISOString()
     }
   };
-  await Bun.$`mkdir -p ${projectPath}`;
-  await Bun.$`mkdir -p ${storagePath}`;
+  await mkdir4(projectPath, { recursive: true });
+  await mkdir4(storagePath, { recursive: true });
   await Bun.file(join3(projectPath, BINDING_FILE_NAME)).write(JSON.stringify(binding, null, 2));
   return binding;
 }
@@ -21624,6 +21682,7 @@ async function loadEnvFile(filePath) {
 
 // src/core/config-v2.ts
 import { join as join4 } from "path";
+import { mkdir as mkdir5, rename as rename3 } from "fs/promises";
 function detectConfigVersion(raw) {
   if (typeof raw === "object" && raw !== null && "version" in raw && raw.version === 2 && "connections" in raw) {
     return 2;
@@ -21667,10 +21726,10 @@ async function writeV2Config(path, config) {
   const storagePath = await resolveConfigStoragePath(path);
   const configPath = join4(storagePath, "config.json");
   const tmpPath = `${configPath}.tmp`;
-  await Bun.$`mkdir -p ${storagePath}`;
+  await mkdir5(storagePath, { recursive: true });
   const json = JSON.stringify(config, null, 2);
   await Bun.write(tmpPath, json);
-  await Bun.$`mv -f ${tmpPath} ${configPath}`;
+  await rename3(tmpPath, configPath);
 }
 function listConnections(config) {
   return Object.entries(config.connections).map(([name, conn]) => {
@@ -21689,6 +21748,7 @@ function listConnections(config) {
 
 // src/core/config.ts
 import { join as join9 } from "path";
+import { mkdir as mkdir6 } from "fs/promises";
 var _globalConnectionName;
 function getGlobalConnectionName() {
   return _globalConnectionName;
@@ -21754,7 +21814,7 @@ function parseEnvPassword(content) {
   return match?.[1] != null ? match[1].trim() : null;
 }
 var configModule = {
-  async read(path, connectionName) {
+  async read(path, connectionName, options = {}) {
     const effectiveConnectionName = connectionName ?? _globalConnectionName;
     try {
       const binding = await readProjectBinding(path);
@@ -21798,23 +21858,27 @@ var configModule = {
               resolvedConnection.password = legacyPassword;
             }
             let schema = (v2Config.schemas ?? {})[resolved.name] ?? v2Config.schema;
-            try {
-              const { SchemaLayeredLoader: SchemaLayeredLoader2 } = await Promise.resolve().then(() => (init_schema_loader(), exports_schema_loader));
-              const loader = new SchemaLayeredLoader2(storagePath, { connectionName: resolved.name });
-              const { cache, index } = await loader.initialize();
-              if (index && Object.keys(index.tables).length > 0) {
-                const layeredSchema = {};
-                for (const tableName of Object.keys(index.tables)) {
-                  const s = await cache.getTableSchema(tableName);
-                  if (s)
-                    layeredSchema[tableName] = s;
-                }
-                if (Object.keys(layeredSchema).length > 0) {
-                  schema = layeredSchema;
+            if (options.loadLayeredSchema !== false) {
+              try {
+                const { SchemaLayeredLoader: SchemaLayeredLoader2 } = await Promise.resolve().then(() => (init_schema_loader(), exports_schema_loader));
+                const loader = new SchemaLayeredLoader2(storagePath, {
+                  connectionName: resolved.name
+                });
+                const { cache, index } = await loader.initialize();
+                if (index && Object.keys(index.tables).length > 0) {
+                  const layeredSchema = {};
+                  for (const tableName of Object.keys(index.tables)) {
+                    const s = await cache.getTableSchema(tableName);
+                    if (s)
+                      layeredSchema[tableName] = s;
+                  }
+                  if (Object.keys(layeredSchema).length > 0) {
+                    schema = layeredSchema;
+                  }
                 }
+              } catch {
+                console.warn("Warning: Failed to load layered schema cache, falling back to config.json");
               }
-            } catch {
-              console.warn("Warning: Failed to load layered schema cache, falling back to config.json");
             }
             return DbcliConfigSchema.parse({
               connection: resolvedConnection,
@@ -21898,7 +21962,7 @@ var configModule = {
         isDirectory = false;
       }
       if (isDirectory || path.endsWith(".dbcli") || path === storagePath && isDirectory) {
-        await Bun.$`mkdir -p ${storagePath}`;
+        await mkdir6(storagePath, { recursive: true });
         const hasEnvReferences = isEnvReference(config.connection.password);
         if (hasEnvReferences) {
           const configPath = join9(storagePath, "config.json");
@@ -21940,7 +22004,7 @@ DBCLI_PASSWORD=${password}
 };
 
 // src/utils/redaction.ts
-var SQL_SUBCOMMANDS = new Set(["query", "export"]);
+var SQL_SUBCOMMANDS = new Set(["query", "export", "lint"]);
 var REDACTED_VALUE_FLAGS = new Set([
   "--where",
   "--set",
@@ -21951,21 +22015,101 @@ var REDACTED_VALUE_FLAGS = new Set([
   "--use",
   "--password",
   "--token",
-  "--secret"
+  "--secret",
+  "--bulk"
+]);
+var KEEP_VALUE_FLAGS = new Set([
+  "--format",
+  "--conn-name",
+  "--min-severity",
+  "--output",
+  "--limit",
+  "--collection",
+  "--index"
 ]);
-var KEEP_VALUE_FLAGS = new Set(["--format", "--conn-name"]);
+var LINT_BOOLEAN_FLAGS = new Set(["--no-schema", "--recovery"]);
+function optionParts(token) {
+  const equals = token.indexOf("=");
+  return equals === -1 ? { name: token, inlineValue: undefined } : { name: token.slice(0, equals), inlineValue: token.slice(equals + 1) };
+}
+function findSensitiveSubcommand(argv) {
+  for (let index = 1;index < argv.length; index++) {
+    const token = argv[index];
+    if (token.startsWith("--")) {
+      const { name, inlineValue } = optionParts(token);
+      if (inlineValue === undefined && (REDACTED_VALUE_FLAGS.has(name) || KEEP_VALUE_FLAGS.has(name))) {
+        index++;
+      }
+      continue;
+    }
+    if (SQL_SUBCOMMANDS.has(token))
+      return { index, command: token };
+  }
+  return null;
+}
+function sensitiveArgvValues(argv) {
+  const sensitiveCommand = findSensitiveSubcommand(argv);
+  const values = new Set;
+  let capturedSingleSql = false;
+  let afterEndOfOptions = false;
+  for (let index = 0;index < argv.length; index++) {
+    const token = argv[index];
+    if (!afterEndOfOptions && token === "--") {
+      afterEndOfOptions = true;
+      continue;
+    }
+    if (!afterEndOfOptions && token.startsWith("--")) {
+      const { name, inlineValue } = optionParts(token);
+      if (REDACTED_VALUE_FLAGS.has(name)) {
+        const value = inlineValue ?? argv[index + 1];
+        if (value) {
+          values.add(value);
+          if (name === "--bulk") {
+            for (const item of value.split(",")) {
+              values.add(item);
+              if (item.startsWith("@") && item.length > 1) {
+                values.add(item.slice(1));
+              }
+            }
+          }
+        }
+        if (inlineValue === undefined)
+          index++;
+      } else if (inlineValue === undefined && KEEP_VALUE_FLAGS.has(name)) {
+        index++;
+      } else if (sensitiveCommand?.command === "lint" && LINT_BOOLEAN_FLAGS.has(name)) {
+        continue;
+      } else if (!sensitiveCommand || index < sensitiveCommand.index) {
+        continue;
+      } else {
+        values.add(token);
+        capturedSingleSql = true;
+      }
+      continue;
+    }
+    if (sensitiveCommand && index > sensitiveCommand.index && (sensitiveCommand.command === "lint" || !capturedSingleSql)) {
+      values.add(token);
+      capturedSingleSql = true;
+    }
+  }
+  return Array.from(values).sort((left, right) => right.length - left.length);
+}
 function redactArgv(argv) {
   if (argv.length === 0)
     return "<unknown>";
-  const out = [argv[0]];
-  if (argv.length === 1)
-    return out.join(" ");
-  const sub = argv[1];
-  out.push(sub);
-  for (let i = 2;i < argv.length; i++) {
+  const sensitiveCommand = findSensitiveSubcommand(argv);
+  const out = [];
+  let redactedSingleSql = false;
+  let afterEndOfOptions = false;
+  for (let i = 0;i < argv.length; i++) {
     const tok = argv[i];
-    if (tok.startsWith("--")) {
-      const [name, inlineValue] = tok.split("=");
+    if (!afterEndOfOptions && tok === "--") {
+      out.push(tok);
+      afterEndOfOptions = true;
+      continue;
+    }
+    if (!afterEndOfOptions && tok.startsWith("--")) {
+      const { name, inlineValue } = optionParts(tok);
       if (REDACTED_VALUE_FLAGS.has(name)) {
         out.push(`${name} <redacted>`);
         if (inlineValue === undefined)
@@ -21977,23 +22121,37 @@ function redactArgv(argv) {
           out.push(tok);
         } else {
           out.push(name);
-          if (i + 1 < argv.length && !argv[i + 1].startsWith("--")) {
+          if (i + 1 < argv.length) {
             out.push(argv[++i]);
           }
         }
         continue;
       }
-      out.push(tok);
-      continue;
+      if (sensitiveCommand?.command === "lint" && LINT_BOOLEAN_FLAGS.has(name)) {
+        out.push(tok);
+        continue;
+      }
+      if (!sensitiveCommand || i < sensitiveCommand.index) {
+        out.push(tok);
+        continue;
+      }
     }
-    if (i === 2 && SQL_SUBCOMMANDS.has(sub)) {
+    if (sensitiveCommand && i > sensitiveCommand.index && (sensitiveCommand.command === "lint" || !redactedSingleSql)) {
       out.push("<sql>");
+      redactedSingleSql = true;
       continue;
     }
     out.push(tok);
   }
   return out.join(" ");
 }
+function redactArgvSensitiveText(text, argv) {
+  let redacted = text;
+  for (const value of sensitiveArgvValues(argv)) {
+    redacted = redacted.split(value).join("<redacted>");
+  }
+  return redacted;
+}
 function redactSensitive(text) {
   return text.replace(/\b(password|token|apiKey|secret|key|token|auth|credential|pass|pwd|sid)([:=]|\s+)([^\s"';,]+)/gi, "$1$2<redacted>");
 }
@@ -22039,6 +22197,7 @@ async function writeAuditEntry(config, commandName, options, outcome) {
     if (outcome.error) {
       errorMessage = outcome.error instanceof Error ? outcome.error.message : String(outcome.error);
       errorMessage = redactSensitive(errorMessage);
+      errorMessage = redactArgvSensitiveText(errorMessage, process.argv);
     }
     const entry = {
       engine,

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "1.37.1",
+  "version": "1.41.0",
   "description": "Database CLI skill and command reference for AI agents.",
   "contextFileName": "AGENTS.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "1.39.1",
+  "version": "1.41.0",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {

package/plugins/dbcli-agent/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "1.31.0",
+  "version": "1.41.0",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",

package/plugins/dbcli-agent/INSTALL.md

@@ -78,8 +78,13 @@ used by Gemini/Antigravity-style agents.
 
 ## Cursor
 
-Cursor can install plugins from Cursor Agent chat when the plugin is available
-in Cursor's plugin marketplace:
+> **Current status: manual install.** `dbcli-agent` is not yet indexed in
+> Cursor's plugin marketplace, so `/add-plugin dbcli-agent` in Cursor Agent chat
+> will not find it. Use one of the manual fallbacks below. The `/add-plugin`
+> command only works once the plugin has been indexed (see the submission steps
+> that follow).
+
+Once the plugin is indexed, Cursor can install it from Cursor Agent chat:
 
 ```text
 /add-plugin dbcli-agent
@@ -93,18 +98,22 @@ This repository includes Cursor plugin metadata at:
 .cursor-plugin/plugin.json
 ```
 
-For Cursor marketplace review/indexing:
+To get `/add-plugin` working, submit the repo for Cursor marketplace
+review/indexing:
 
 1. Push this repository to GitHub and keep it public.
 2. Keep the single-plugin layout at the repository root:
    `.cursor-plugin/plugin.json` plus `skills/dbcli/`.
-3. Confirm the manifest name is lowercase kebab-case (`dbcli-agent`) and that
-   `category`, `tags`, `homepage`, `repository`, and `skills` are present.
-4. Submit the repository URL to the Cursor plugin team for review/indexing.
-   The Cursor plugin template currently points submitters to the Cursor
-   community Slack or `kniparko@anysphere.com`.
-5. After indexing, users can install from Cursor Agent chat with
-   `/add-plugin dbcli-agent` or by searching the Cursor plugin marketplace.
+3. Confirm the manifest name is lowercase kebab-case (`dbcli-agent`), the skill
+   files carry YAML frontmatter, `README.md` exists at the repo root, and all
+   manifest paths are relative with no `..` or absolute paths.
+4. Submit the repository at <https://cursor.com/marketplace/publish>. This is the
+   current channel — the marketplace launched with Cursor 2.5 (2026-02-17) and
+   every plugin is manually reviewed and must be open source. Do **not** email
+   `kniparko@anysphere.com`; that address came from an older plugin template and
+   is not the submission path.
+5. After the plugin is reviewed and listed, users can install from Cursor Agent
+   chat with `/add-plugin dbcli-agent` or by searching the Cursor marketplace.
 
 The repo also keeps an instruction-file fallback for projects that want to
 vendor the dbcli rule and reference directly.