@orchid-labs/pluxx 0.1.6 → 0.1.8

package/dist/cli/index.js

@@ -85,7 +85,7 @@ var require_src = __commonJS({
 });
 
 // src/cli/index.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 
 // src/config/load.ts
 import { resolve, extname, dirname } from "path";
@@ -5192,6 +5192,51 @@ async function generateClaudeFamilyOutputs(args2) {
     writeInstructions(config, rootDir, options, writeFile3)
   ]);
 }
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function buildClaudeHookCommandWrapperScript(command2) {
+  const serializedCommand = shellSingleQuote(command2);
+  const exportLoader = [
+    'import { readFileSync } from "node:fs"',
+    "",
+    "const filepath = process.argv[1]",
+    "if (!filepath) process.exit(0)",
+    'const payload = JSON.parse(readFileSync(filepath, "utf8"))',
+    'const env = payload && typeof payload === "object" && payload.env && typeof payload.env === "object"',
+    "  ? payload.env",
+    "  : {}",
+    "",
+    "for (const [key, value] of Object.entries(env)) {",
+    "  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue",
+    '  console.log(`export ${key}=${JSON.stringify(String(value ?? ""))}`)',
+    "}"
+  ].join("\n");
+  return [
+    "#!/usr/bin/env bash",
+    "set -euo pipefail",
+    "",
+    'PLUXX_PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"',
+    'PLUXX_USER_CONFIG_PATH="$PLUXX_PLUGIN_ROOT/.pluxx-user.json"',
+    "",
+    'if [ -f "$PLUXX_USER_CONFIG_PATH" ]; then',
+    "  while IFS= read -r pluxx_export; do",
+    '    if [ -n "$pluxx_export" ]; then',
+    '      eval "$pluxx_export"',
+    '      if [ -n "${CLAUDE_ENV_FILE:-}" ]; then',
+    `        printf '%s\\n' "$pluxx_export" >> "$CLAUDE_ENV_FILE"`,
+    "      fi",
+    "    fi",
+    "  done < <(",
+    `    node --input-type=module -e ${shellSingleQuote(exportLoader)} "$PLUXX_USER_CONFIG_PATH"`,
+    "  )",
+    "fi",
+    "",
+    `PLUXX_HOOK_COMMAND=${serializedCommand}`,
+    'eval "$PLUXX_HOOK_COMMAND"',
+    ""
+  ].join("\n");
+}
 async function writeManifest(config, rootDir, options, writeJson) {
   const manifest = {
     name: config.name,
@@ -5269,7 +5314,9 @@ async function writeHooks(config, platform, options, writeJson, writeFile3) {
   const hooks = {};
   const mapEventName = options.mapEventName ?? defaultMapEventName;
   const usesPlatformManagedAuth = platform === "claude-code" && config.platforms?.["claude-code"]?.mcpAuth === "platform";
+  const shouldWrapClaudeHookCommands = platform === "claude-code";
   const permissionScript = buildGeneratedPermissionHookScript(config.permissions);
+  let generatedClaudeHookCommandCount = 0;
   if (permissionScript) {
     await writeFile3("hooks/pluxx-permissions.mjs", permissionScript);
     hooks.PreToolUse = [{
@@ -5299,12 +5346,21 @@ async function writeHooks(config, platform, options, writeJson, writeFile3) {
     if (commandEntries.length === 0) continue;
     hooks[mappedEvent] = [
       ...hooks[mappedEvent] ?? [],
-      ...commandEntries.map((entry) => ({
-        ...entry.matcher !== void 0 ? { matcher: entry.matcher } : {},
-        hooks: [{
-          type: "command",
-          command: entry.command.replace("${PLUGIN_ROOT}", `\${${options.pluginRootVar}}`)
-        }]
+      ...await Promise.all(commandEntries.map(async (entry) => {
+        const command2 = entry.command.replace("${PLUGIN_ROOT}", `\${${options.pluginRootVar}}`);
+        const finalCommand = shouldWrapClaudeHookCommands ? await (async () => {
+          generatedClaudeHookCommandCount += 1;
+          const relativePath = `hooks/pluxx-hook-command-${generatedClaudeHookCommandCount}.sh`;
+          await writeFile3(relativePath, buildClaudeHookCommandWrapperScript(command2));
+          return `bash "\${${options.pluginRootVar}}/${relativePath}"`;
+        })() : command2;
+        return {
+          ...entry.matcher !== void 0 ? { matcher: entry.matcher } : {},
+          hooks: [{
+            type: "command",
+            command: finalCommand
+          }]
+        };
       }))
     ];
   }
@@ -7084,14 +7140,14 @@ async function build(config, rootDir, options = {}) {
 }
 
 // src/cli/agent.ts
-import { existsSync as existsSync21, readdirSync as readdirSync7, readFileSync as readFileSync9, statSync as statSync4 } from "fs";
+import { existsSync as existsSync22, readdirSync as readdirSync7, readFileSync as readFileSync9, statSync as statSync4 } from "fs";
 import { chmod, copyFile, mkdir as mkdir3, mkdtemp, readFile as readFile3, rm as rm2 } from "fs/promises";
 import { homedir, tmpdir as tmpdir2 } from "os";
-import { relative as relative8, resolve as resolve14 } from "path";
+import { relative as relative9, resolve as resolve14 } from "path";
 import { spawn as spawn2 } from "child_process";
 
 // src/cli/lint.ts
-import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync17, lstatSync, readdirSync as readdirSync5, readFileSync as readFileSync6 } from "fs";
 import { resolve as resolve9, relative as relative6, basename as basename4, dirname as dirname3 } from "path";
 
 // src/validation/platform-rules.ts
@@ -8452,10 +8508,11 @@ function lintMcpUrls(config, issues) {
     }
   }
 }
-function lintMcpRuntimeState(config, issues) {
+function lintMcpRuntimeState(rootDir, config, issues) {
   if (!config.mcp) return;
   const claudeUsesPlatformAuth = config.targets.includes("claude-code") && config.platforms?.["claude-code"]?.mcpAuth === "platform";
   const cursorUsesPlatformAuth = config.targets.includes("cursor") && config.platforms?.cursor?.mcpAuth === "platform";
+  const passthroughDirs = (config.passthrough ?? []).map((entry) => resolveBundledPassthroughDir(rootDir, entry)).filter((entry) => Boolean(entry));
   for (const [serverName, server] of Object.entries(config.mcp)) {
     if (server.transport === "stdio") {
       pushIssue(issues, {
@@ -8465,6 +8522,17 @@ function lintMcpRuntimeState(config, issues) {
         file: "pluxx.config.ts",
         platform: "MCP"
       });
+      for (const runtimePath of findLocalStdioRuntimePaths(rootDir, server)) {
+        if (passthroughDirs.some((dir) => runtimePath === dir || runtimePath.startsWith(`${dir}/`))) continue;
+        const relativeDir = `./${relative6(rootDir, runtimePath).replace(/\\/g, "/")}/`;
+        pushIssue(issues, {
+          level: "warning",
+          code: "mcp-stdio-runtime-unbundled",
+          message: `MCP server "${serverName}" references a project-local stdio runtime under ${relativeDir}, but that directory is not included in passthrough. Installed bundles may ship the MCP config without the executable payload.`,
+          file: "pluxx.config.ts",
+          platform: "MCP"
+        });
+      }
     }
     const runtimeAuthTargets = [];
     if (server.auth?.type === "platform") {
@@ -8488,6 +8556,37 @@ function lintMcpRuntimeState(config, issues) {
     }
   }
 }
+function resolveBundledPassthroughDir(rootDir, entry) {
+  const resolvedPath = resolve9(rootDir, entry);
+  if (!existsSync17(resolvedPath)) return null;
+  try {
+    const stats = lstatSync(resolvedPath);
+    if (!stats.isDirectory()) return null;
+    return resolvedPath.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+function findLocalStdioRuntimePaths(rootDir, server) {
+  if (server.transport !== "stdio") return [];
+  const runtimeDirs = /* @__PURE__ */ new Set();
+  const candidates = [server.command, ...server.args ?? []];
+  for (const candidate of candidates) {
+    if (!isLikelyLocalRuntimePath(candidate)) continue;
+    const resolvedPath = resolve9(rootDir, candidate);
+    if (!existsSync17(resolvedPath)) continue;
+    try {
+      const stats = lstatSync(resolvedPath);
+      const runtimeDir = stats.isDirectory() ? resolvedPath : dirname3(resolvedPath);
+      runtimeDirs.add(runtimeDir.replace(/\/+$/, ""));
+    } catch {
+    }
+  }
+  return [...runtimeDirs].sort();
+}
+function isLikelyLocalRuntimePath(value) {
+  return value.startsWith("./") || value.startsWith("../") || value.startsWith(".\\") || value.startsWith("..\\");
+}
 function lintCodexHookCompatibility(config, issues) {
   if (!isCodexTargetEnabled(config) || !config.hooks) return;
   for (const hookEvent of Object.keys(config.hooks)) {
@@ -8721,15 +8820,19 @@ function lintOpenCodeAgentFrontmatter(dir, config, issues) {
   const agents = readCanonicalAgentFiles(resolve9(dir, config.agents));
   for (const agent of agents) {
     if (!("tools" in agent.frontmatter)) continue;
+    if (hasCanonicalAgentPermission(agent.frontmatter.permission)) continue;
     pushIssue(issues, {
       level: "warning",
       code: "opencode-agent-tools-deprecated",
-      message: "OpenCode agent `tools` is deprecated. Pluxx will translate legacy agent tools into permission-first OpenCode output where possible, but canonical agents should prefer `permission`.",
+      message: "OpenCode agent `tools` is deprecated. Add canonical `permission` frontmatter so Pluxx can keep the emitted OpenCode agent permission-first even when shared cross-host authoring still carries legacy tool hints.",
       file: relative6(dir, agent.filePath).replace(/\\/g, "/"),
       platform: "OpenCode"
     });
   }
 }
+function hasCanonicalAgentPermission(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
 function lintAbsolutePaths(config, issues) {
   const absolutePathPattern = /^\/[a-zA-Z]|^[A-Z]:\\/;
   if (config.hooks) {
@@ -9172,7 +9275,7 @@ async function lintProject(dir = process.cwd(), options = {}) {
   lintAgentIsolation(agentFiles, issues, frontmatterCache);
   lintOpenCodeAgentFrontmatter(dir, { ...lintConfig, agents: lintConfig.agents ?? "./agents/" }, issues);
   lintMcpUrls(lintConfig, issues);
-  lintMcpRuntimeState(lintConfig, issues);
+  lintMcpRuntimeState(dir, lintConfig, issues);
   lintBrandMetadata(lintConfig, issues);
   lintCodexOverrides(lintConfig, issues);
   lintCodexHookCompatibility(lintConfig, issues);
@@ -9256,19 +9359,30 @@ async function runLint(dir = process.cwd()) {
 }
 
 // src/cli/test.ts
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { resolve as resolve12 } from "path";
 
 // src/cli/eval.ts
-import { existsSync as existsSync18, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve11 } from "path";
 
 // src/cli/init-from-mcp.ts
+import { existsSync as existsSync18, lstatSync as lstatSync2 } from "fs";
 import { mkdir as mkdir2 } from "fs/promises";
-import { basename as basename5, resolve as resolve10 } from "path";
+import { basename as basename5, dirname as dirname4, relative as relative7, resolve as resolve10 } from "path";
 
 // src/user-config.ts
 var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var PLACEHOLDER_SECRET_PATTERNS = [
+  /\bdummy\b/i,
+  /\bplaceholder\b/i,
+  /\bexample\b/i,
+  /\bchangeme\b/i,
+  /\breplace[_ -]?me\b/i,
+  /\byour[_ -]?(api[_ -]?)?key\b/i,
+  /\bapi[_ -]?key[_ -]?here\b/i,
+  /\btoken[_ -]?here\b/i
+];
 function normalizeUserConfigKey(value) {
   return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/[._/\s]+/g, "-").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
 }
@@ -9283,6 +9397,12 @@ function extractEnvReference(value) {
   const match = value.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/);
   return match?.[1];
 }
+function isPlaceholderSecretValue(value) {
+  if (typeof value !== "string") return false;
+  const normalized = value.trim();
+  if (normalized === "") return false;
+  return PLACEHOLDER_SECRET_PATTERNS.some((pattern) => pattern.test(normalized));
+}
 function isRuntimePlatformManaged(config, target, server) {
   if (server.transport === "stdio") return false;
   if (server.auth?.type === "platform") {
@@ -9459,6 +9579,42 @@ var WORKFLOW_SKILL_DEFINITIONS = [
     title: "General Research",
     description: "Handle broad search and query workflows when there is not a more specific product surface match.",
     match: ["search", "query", "lookup", "look up", "discover", "find"]
+  },
+  {
+    key: "web-research",
+    title: "Web Research",
+    description: "Search the web, fetch pages, and synthesize public source-backed research.",
+    match: ["web", "website", "url", "page", "fetch", "crawl", "scrape", "search", "result", "source"]
+  },
+  {
+    key: "source-review",
+    title: "Source Review",
+    description: "Audit sources, citations, evidence quality, and duplicate or weak research results.",
+    match: ["source", "citation", "evidence", "audit", "review", "quality", "rank", "dedupe", "duplicate"]
+  },
+  {
+    key: "content-extraction",
+    title: "Content Extraction",
+    description: "Extract structured content, entities, and summaries from pages, documents, or search results.",
+    match: ["extract", "parse", "content", "summary", "summarize", "document", "html", "markdown"]
+  },
+  {
+    key: "knowledge-search",
+    title: "Knowledge Search",
+    description: "Search docs, knowledge bases, papers, repositories, and internal reference material.",
+    match: ["docs", "documentation", "knowledge", "paper", "papers", "repo", "repository", "api", "reference"]
+  },
+  {
+    key: "news-monitoring",
+    title: "News Monitoring",
+    description: "Find recent news, launches, announcements, and time-bounded developments.",
+    match: ["news", "recent", "latest", "launch", "announcement", "announced", "date", "published"]
+  },
+  {
+    key: "code-research",
+    title: "Code Research",
+    description: "Find implementation docs, code examples, API usage, migration notes, and troubleshooting context.",
+    match: ["code", "sdk", "api", "github", "example", "migration", "error", "troubleshoot", "implementation"]
   }
 ];
 var WORKFLOW_MATCH_MIN_SCORE = 2;
@@ -9541,6 +9697,8 @@ async function planMcpScaffold(options) {
     options.persistedSkills,
     options.toolRenames
   );
+  const skillGrouping = options.skillGrouping ?? "workflow";
+  const plannedCommands = planCommandScaffolds(plannedSkills, skillGrouping);
   const description = options.description ?? deriveScaffoldDescription({
     displayName,
     introspection: options.introspection,
@@ -9548,6 +9706,7 @@ async function planMcpScaffold(options) {
   });
   const serverName = options.serverName ?? toKebabCase(options.introspection.serverInfo.name) ?? pluginName;
   const permissions = options.permissions ?? (options.approveMcpTools ? { allow: [`MCP(${serverName}.*)`] } : void 0);
+  const passthroughPaths = inferLocalRuntimePassthroughPaths(options.rootDir, options.source);
   const runtimeAuthMode = options.runtimeAuthMode ?? (options.source.transport !== "stdio" && options.source.auth?.type === "platform" ? "platform" : "inline");
   const instructionsPath = resolve10(options.rootDir, "INSTRUCTIONS.md");
   const skillRoot = resolve10(options.rootDir, "skills");
@@ -9589,9 +9748,10 @@ async function planMcpScaffold(options) {
       userConfig,
       hooks: generatedHooks.hookEntries,
       scriptsPath: generatedHooks.scriptsPath,
+      passthroughPaths,
       runtimeAuthMode,
       permissions,
-      commandsPath: "./commands/"
+      commandsPath: plannedCommands.length > 0 ? "./commands/" : void 0
     })
   );
   await addPlannedFile(
@@ -9621,8 +9781,6 @@ async function planMcpScaffold(options) {
   for (const skill of plannedSkills) {
     const relativeSkillPath = `skills/${skill.dirName}`;
     const skillPath = resolve10(skillRoot, skill.dirName, "SKILL.md");
-    const relativeCommandPath = `commands/${skill.dirName}.md`;
-    const commandPath = resolve10(commandsRoot, `${skill.dirName}.md`);
     await addPlannedFile(
       `${relativeSkillPath}/SKILL.md`,
       wrapManagedMarkdown(
@@ -9636,6 +9794,10 @@ async function planMcpScaffold(options) {
     );
     skillDirectories.push(relativeSkillPath);
     generatedFiles.push(`${relativeSkillPath}/SKILL.md`);
+  }
+  for (const skill of plannedCommands) {
+    const relativeCommandPath = `commands/${skill.dirName}.md`;
+    const commandPath = resolve10(commandsRoot, `${skill.dirName}.md`);
     await addPlannedFile(
       relativeCommandPath,
       buildCommandContent(
@@ -9655,7 +9817,7 @@ async function planMcpScaffold(options) {
     introspection: options.introspection,
     pluginName,
     displayName,
-    skillGrouping: options.skillGrouping ?? "workflow",
+    skillGrouping,
     requestedHookMode: options.hookMode ?? "none",
     generatedHookMode: generatedHooks.mode,
     generatedHookEvents: Object.keys(generatedHooks.hookEntries ?? {}),
@@ -9882,6 +10044,19 @@ function buildCommandContent(skill, existingContent) {
     }
   );
 }
+function hasStrongCommandShape(skill, grouping) {
+  if (grouping === "tool") return true;
+  if (skill.tools.length > 1) return true;
+  if (skill.prompts.length > 0) return true;
+  if (skill.resources.length > 0 || skill.resourceTemplates.length > 0) return true;
+  const requiredFields = skill.tools.flatMap((tool) => getTopLevelSchemaFields(tool.inputSchema).filter((field) => field.required));
+  return requiredFields.length >= 2;
+}
+function planCommandScaffolds(plannedSkills, grouping) {
+  const commands = plannedSkills.filter((skill) => hasStrongCommandShape(skill, grouping));
+  if (commands.length > 0) return commands;
+  return plannedSkills.slice(0, 1);
+}
 function formatArgumentHintFrontmatter(value) {
   const trimmed = value.trim();
   if (!trimmed) return '""';
@@ -9986,6 +10161,8 @@ function buildConfigTemplate(input) {
   userConfig: ${serializeUserConfig(input.userConfig)},
 ` : "";
   const scriptsBlock = input.scriptsPath ? `  scripts: ${JSON.stringify(input.scriptsPath)},
+` : "";
+  const passthroughBlock = input.passthroughPaths && input.passthroughPaths.length > 0 ? `  passthrough: ${JSON.stringify(input.passthroughPaths)},
 ` : "";
   const commandsBlock = input.commandsPath ? `  commands: ${JSON.stringify(input.commandsPath)},
 ` : "";
@@ -10021,6 +10198,7 @@ ${commandsBlock}
   instructions: './INSTRUCTIONS.md',
 ${userConfigBlock}
 ${scriptsBlock}
+${passthroughBlock}
 
   mcp: {
 ${mcpBlock}
@@ -10037,6 +10215,29 @@ ${platformsBlock}
 })
 `;
 }
+function inferLocalRuntimePassthroughPaths(rootDir, source) {
+  if (source.transport !== "stdio") return [];
+  const passthrough = /* @__PURE__ */ new Set();
+  const candidates = [source.command, ...source.args ?? []];
+  for (const candidate of candidates) {
+    if (!isLikelyLocalRuntimePath2(candidate)) continue;
+    const resolvedPath = resolve10(rootDir, candidate);
+    if (!existsSync18(resolvedPath)) continue;
+    const stats = lstatSync2(resolvedPath);
+    const runtimeDir = stats.isDirectory() ? resolvedPath : dirname4(resolvedPath);
+    const normalized = normalizePassthroughDir(rootDir, runtimeDir);
+    if (normalized) passthrough.add(normalized);
+  }
+  return [...passthrough].sort();
+}
+function isLikelyLocalRuntimePath2(value) {
+  return value.startsWith("./") || value.startsWith("../") || value.startsWith(".\\") || value.startsWith("..\\");
+}
+function normalizePassthroughDir(rootDir, dirPath) {
+  const relativePath = relative7(rootDir, dirPath).replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!relativePath || relativePath === ".") return null;
+  return `./${relativePath}/`;
+}
 function buildMcpBlock(serverName, source) {
   if (source.transport === "stdio") {
     const argsLine = source.args && source.args.length > 0 ? `,
@@ -11076,7 +11277,7 @@ function summarizeChecks(checks) {
 }
 async function loadMcpScaffoldMetadata(rootDir) {
   const metadataPath = resolve11(rootDir, MCP_SCAFFOLD_METADATA_PATH);
-  if (!existsSync18(metadataPath)) {
+  if (!existsSync19(metadataPath)) {
     return null;
   }
   const parsed = JSON.parse(readFileSync7(metadataPath, "utf-8"));
@@ -11107,7 +11308,7 @@ function collectSkillPromptLabels(skill) {
 function evaluateInstructions(rootDir, metadata, checks) {
   const relativePath = "INSTRUCTIONS.md";
   const filePath = resolve11(rootDir, relativePath);
-  if (!existsSync18(filePath)) {
+  if (!existsSync19(filePath)) {
     addCheck(checks, {
       level: "error",
       code: "instructions-missing",
@@ -11153,7 +11354,7 @@ function evaluateSkills(rootDir, metadata, checks) {
   for (const skill of metadata.skills) {
     const relativePath = `skills/${skill.dirName}/SKILL.md`;
     const filePath = resolve11(rootDir, relativePath);
-    if (!existsSync18(filePath)) {
+    if (!existsSync19(filePath)) {
       failures.push({ path: relativePath, missing: ["skill file"] });
       continue;
     }
@@ -11196,6 +11397,11 @@ function evaluateSkills(rootDir, metadata, checks) {
 function hasManagedCommands(metadata) {
   return metadata.managedFiles.some((file) => file.startsWith("commands/"));
 }
+function managedCommandSkillNames(metadata) {
+  return new Set(
+    metadata.managedFiles.filter((file) => file.startsWith("commands/") && file.endsWith(".md")).map((file) => file.replace(/^commands\//, "").replace(/\.md$/, ""))
+  );
+}
 function evaluateCommands(rootDir, metadata, checks) {
   if (!hasManagedCommands(metadata)) {
     addCheck(checks, {
@@ -11208,10 +11414,11 @@ function evaluateCommands(rootDir, metadata, checks) {
     return;
   }
   const failures = [];
-  for (const skill of metadata.skills) {
+  const commandSkillNames = managedCommandSkillNames(metadata);
+  for (const skill of metadata.skills.filter((entry) => commandSkillNames.has(entry.dirName))) {
     const relativePath = `commands/${skill.dirName}.md`;
     const filePath = resolve11(rootDir, relativePath);
-    if (!existsSync18(filePath)) {
+    if (!existsSync19(filePath)) {
       failures.push({ path: relativePath, missing: ["command file"] });
       continue;
     }
@@ -11256,10 +11463,36 @@ function evaluateCommands(rootDir, metadata, checks) {
     level: "success",
     code: "command-quality-contract",
     title: "Command scaffolds expose expected routing guidance and related surfaces",
-    detail: `Checked ${metadata.skills.length} generated command file(s) for argument hints, tool routing, and related discovery surfaces.`,
+    detail: `Checked ${commandSkillNames.size} generated command file(s) for argument hints, tool routing, and related discovery surfaces.`,
     fix: "No action needed."
   });
 }
+function evaluateScaffoldArchitecture(metadata, checks) {
+  const commandSkillNames = managedCommandSkillNames(metadata);
+  if (metadata.tools.length === 0 || commandSkillNames.size === 0) return;
+  const singletonSkills = metadata.skills.filter((skill) => (skill.toolNames?.length ?? 0) === 1);
+  const commandBackedSingletons = singletonSkills.filter((skill) => commandSkillNames.has(skill.dirName));
+  const commandPerTool = commandSkillNames.size >= metadata.tools.length && commandBackedSingletons.length >= Math.ceil(commandSkillNames.size * 0.8);
+  if (commandPerTool) {
+    addCheck(checks, {
+      level: "warning",
+      code: "scaffold-command-per-tool-shape",
+      title: "Scaffold looks like command-per-tool output",
+      detail: `This scaffold exposes ${commandSkillNames.size} command(s) for ${metadata.tools.length} MCP tool(s), with most commands wrapping a single tool.`,
+      fix: "Prefer workflow-level commands and keep singleton raw tool wrappers as skills only unless the tool has a strong user-facing workflow or required arguments."
+    });
+  }
+  const singletonRatio = singletonSkills.length / Math.max(metadata.skills.length, 1);
+  if (metadata.skills.length >= 6 && singletonRatio >= 0.75) {
+    addCheck(checks, {
+      level: "warning",
+      code: "scaffold-singleton-heavy-taxonomy",
+      title: "Scaffold taxonomy is singleton-heavy",
+      detail: `${singletonSkills.length} of ${metadata.skills.length} skill(s) wrap a single MCP tool, which usually means the plugin is still shaped like an API surface rather than user workflows.`,
+      fix: "Run `pluxx agent run taxonomy` or `pluxx autopilot --mode standard` to merge raw tools into product workflows before shipping."
+    });
+  }
+}
 function evaluateAgentContext(contextContent, metadata, checks) {
   const missing = [];
   if (((metadata.resources?.length ?? 0) > 0 || (metadata.resourceTemplates?.length ?? 0) > 0 || (metadata.prompts?.length ?? 0) > 0) && !contextContent.includes("## MCP Discovery Surfaces")) {
@@ -11399,6 +11632,7 @@ async function runEvalSuite(options = {}) {
       evaluateInstructions(rootDir, metadata, checks);
       evaluateSkills(rootDir, metadata, checks);
       evaluateCommands(rootDir, metadata, checks);
+      evaluateScaffoldArchitecture(metadata, checks);
     }
     evaluateAgentContext(contextContent, metadata, checks);
     for (const kind of AGENT_PROMPT_KINDS) {
@@ -11463,7 +11697,7 @@ async function runTestSuite(options = {}) {
     const evalReport = await runEvalSuite({ rootDir });
     const checks = targets.map((platform) => {
       const requiredPath = SMOKE_PATHS[platform];
-      const ok = existsSync19(resolve12(rootDir, config.outDir, platform, requiredPath));
+      const ok = existsSync20(resolve12(rootDir, config.outDir, platform, requiredPath));
       return { platform, requiredPath, ok };
     });
     return {
@@ -11520,8 +11754,8 @@ function printTestResult(result) {
 }
 
 // src/cli/sync-from-mcp.ts
-import { cpSync as cpSync2, existsSync as existsSync20, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync2, readdirSync as readdirSync6, rmdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname4, isAbsolute, relative as relative7, resolve as resolve13 } from "path";
+import { cpSync as cpSync2, existsSync as existsSync21, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync2, readdirSync as readdirSync6, rmdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname5, isAbsolute, relative as relative8, resolve as resolve13 } from "path";
 import { tmpdir } from "os";
 
 // src/mcp/introspect.ts
@@ -11803,10 +12037,10 @@ async function createSseClient(server) {
   let resolveEndpoint;
   let rejectEndpoint;
   let endpointSettled = false;
-  const endpointReady = new Promise((resolve24, reject) => {
+  const endpointReady = new Promise((resolve25, reject) => {
     resolveEndpoint = (value) => {
       endpointSettled = true;
-      resolve24(value);
+      resolve25(value);
     };
     rejectEndpoint = (error) => {
       endpointSettled = true;
@@ -11943,7 +12177,7 @@ async function createSseClient(server) {
     async request(method, params) {
       const requestId = nextRequestId();
       const endpoint = endpointUrl ?? await endpointReady;
-      const resultPromise = new Promise((resolve24, reject) => {
+      const resultPromise = new Promise((resolve25, reject) => {
         const timeout = setTimeout(() => {
           pending.delete(requestId);
           reject(new McpIntrospectionError(`Timed out waiting for MCP SSE response to ${method}.`));
@@ -11951,7 +12185,7 @@ async function createSseClient(server) {
         pending.set(requestId, {
           resolve: (value) => {
             clearTimeout(timeout);
-            resolve24(value);
+            resolve25(value);
           },
           reject: (error) => {
             clearTimeout(timeout);
@@ -12104,7 +12338,7 @@ async function createStdioClient(server) {
         method,
         ...params ? { params } : {}
       });
-      return new Promise((resolve24, reject) => {
+      return new Promise((resolve25, reject) => {
         const timeout = setTimeout(() => {
           pending.delete(id);
           reject(new McpIntrospectionError(`Timed out waiting for MCP stdio response to ${method}.`));
@@ -12112,7 +12346,7 @@ async function createStdioClient(server) {
         pending.set(id, {
           resolve: (value) => {
             clearTimeout(timeout);
-            resolve24(value);
+            resolve25(value);
           },
           reject: (error) => {
             clearTimeout(timeout);
@@ -12290,7 +12524,7 @@ function nextRequestId() {
 // src/cli/sync-from-mcp.ts
 async function readMcpScaffoldMetadata(rootDir) {
   const filepath = resolveWithinRoot(rootDir, MCP_SCAFFOLD_METADATA_PATH);
-  if (!existsSync20(filepath)) {
+  if (!existsSync21(filepath)) {
     throw new Error(
       `No MCP scaffold metadata found at ${MCP_SCAFFOLD_METADATA_PATH}. Run "pluxx init --from-mcp" first.`
     );
@@ -12325,14 +12559,14 @@ async function syncFromMcp(options) {
   const skillRenames = detectSkillRenames(metadata.skills, newMetadata.skills, toolRenames);
   for (const [oldSkillDir, newSkillDir] of skillRenames) {
     const oldSkillPath = resolveWithinRoot(options.rootDir, `skills/${oldSkillDir}/SKILL.md`);
-    if (!existsSync20(oldSkillPath)) continue;
+    if (!existsSync21(oldSkillPath)) continue;
     const oldContent = readFileSync8(oldSkillPath, "utf-8");
     const extracted = extractMixedMarkdownContent(oldContent, "");
     if (!hasMeaningfulCustomContent(oldContent)) continue;
     const newSkill = newMetadata.skills.find((s) => s.dirName === newSkillDir);
     if (!newSkill) continue;
     const newSkillPath = resolveWithinRoot(options.rootDir, `skills/${newSkill.dirName}/SKILL.md`);
-    if (!existsSync20(newSkillPath)) continue;
+    if (!existsSync21(newSkillPath)) continue;
     const currentContent = readFileSync8(newSkillPath, "utf-8");
     const updatedContent = injectCustomContent(currentContent, extracted.customContent);
     writeFileSync3(newSkillPath, updatedContent, "utf-8");
@@ -12375,7 +12609,7 @@ async function syncFromMcp(options) {
     if (!beforeManaged.has(file)) return false;
     const before = beforeContents.get(file);
     const currentPath = resolveWithinRoot(options.rootDir, file);
-    if (!existsSync20(currentPath)) return false;
+    if (!existsSync21(currentPath)) return false;
     const after = readFileSync8(currentPath, "utf-8");
     return before !== after;
   });
@@ -12464,7 +12698,7 @@ async function planSyncFromMcp(options) {
 }
 function readPersistedSkills(rootDir, metadata) {
   const taxonomyPath = resolveWithinRoot(rootDir, MCP_TAXONOMY_PATH);
-  if (existsSync20(taxonomyPath)) {
+  if (existsSync21(taxonomyPath)) {
     return JSON.parse(readFileSync8(taxonomyPath, "utf-8"));
   }
   return metadata.skills.map((skill) => ({
@@ -12477,12 +12711,12 @@ function readPersistedSkills(rootDir, metadata) {
 function preserveCustomContentForRenames(rootDir, renames, pathForName) {
   for (const [oldName, newName] of renames) {
     const oldPath = resolveWithinRoot(rootDir, pathForName(oldName));
-    if (!existsSync20(oldPath)) continue;
+    if (!existsSync21(oldPath)) continue;
     const oldContent = readFileSync8(oldPath, "utf-8");
     const extracted = extractMixedMarkdownContent(oldContent, "");
     if (!hasMeaningfulCustomContent(oldContent)) continue;
     const newPath = resolveWithinRoot(rootDir, pathForName(newName));
-    if (!existsSync20(newPath)) continue;
+    if (!existsSync21(newPath)) continue;
     const currentContent = readFileSync8(newPath, "utf-8");
     const updatedContent = injectCustomContent(currentContent, extracted.customContent);
     writeFileSync3(newPath, updatedContent, "utf-8");
@@ -12492,21 +12726,21 @@ function snapshotManagedFiles(rootDir, files) {
   const contents = /* @__PURE__ */ new Map();
   for (const file of files) {
     const filepath = resolveWithinRoot(rootDir, file);
-    if (!existsSync20(filepath)) continue;
+    if (!existsSync21(filepath)) continue;
     contents.set(file, readFileSync8(filepath, "utf-8"));
   }
   return contents;
 }
 function removeManagedFile(rootDir, relativePath) {
   const filepath = resolveWithinRoot(rootDir, relativePath);
-  if (!existsSync20(filepath)) return;
+  if (!existsSync21(filepath)) return;
   rmSync2(filepath, { force: true });
-  pruneEmptyDirectories(rootDir, dirname4(filepath));
+  pruneEmptyDirectories(rootDir, dirname5(filepath));
 }
 function shouldPreserveManagedFile(rootDir, relativePath) {
   if (!relativePath.endsWith(".md")) return false;
   const filepath = resolveWithinRoot(rootDir, relativePath);
-  if (!existsSync20(filepath)) return false;
+  if (!existsSync21(filepath)) return false;
   return hasMeaningfulCustomContent(readFileSync8(filepath, "utf-8"));
 }
 function pruneEmptyDirectories(rootDir, startDir) {
@@ -12516,7 +12750,7 @@ function pruneEmptyDirectories(rootDir, startDir) {
     const entries = readdirSync6(current);
     if (entries.length > 0) return;
     rmdirSync(current);
-    current = dirname4(current);
+    current = dirname5(current);
   }
 }
 var AGENT_PACK_FILES = [
@@ -12680,7 +12914,7 @@ function computeSkillRenameScore(oldSkill, newSkill, toolRenames) {
 function resolveWithinRoot(rootDir, relativePath) {
   const rootPath = resolve13(rootDir);
   const filepath = resolve13(rootPath, relativePath);
-  const relativePathFromRoot = relative7(rootPath, filepath);
+  const relativePathFromRoot = relative8(rootPath, filepath);
   if (relativePathFromRoot === "" || !relativePathFromRoot.startsWith("..") && !isAbsolute(relativePathFromRoot)) {
     return filepath;
   }
@@ -12696,13 +12930,13 @@ function formatSyncSummary(result, rootDir) {
     result.renamedFiles.forEach((rename) => lines.push(`  \u2192 ${rename.from} \u2192 ${rename.to}`));
   }
   lines.push(`Added: ${result.addedFiles.length}`);
-  result.addedFiles.forEach((file) => lines.push(`  + ${relative7(rootDir, resolve13(rootDir, file))}`));
+  result.addedFiles.forEach((file) => lines.push(`  + ${relative8(rootDir, resolve13(rootDir, file))}`));
   lines.push(`Updated: ${result.updatedFiles.length}`);
-  result.updatedFiles.forEach((file) => lines.push(`  ~ ${relative7(rootDir, resolve13(rootDir, file))}`));
+  result.updatedFiles.forEach((file) => lines.push(`  ~ ${relative8(rootDir, resolve13(rootDir, file))}`));
   lines.push(`Removed: ${result.removedFiles.length}`);
-  result.removedFiles.forEach((file) => lines.push(`  - ${relative7(rootDir, resolve13(rootDir, file))}`));
+  result.removedFiles.forEach((file) => lines.push(`  - ${relative8(rootDir, resolve13(rootDir, file))}`));
   lines.push(`Preserved: ${result.preservedFiles.length}`);
-  result.preservedFiles.forEach((file) => lines.push(`  ! ${relative7(rootDir, resolve13(rootDir, file))}`));
+  result.preservedFiles.forEach((file) => lines.push(`  ! ${relative8(rootDir, resolve13(rootDir, file))}`));
   return lines;
 }
 
@@ -12791,7 +13025,7 @@ async function planAgentPrompt(rootDir, kind, options = {}) {
   const project = await loadAgentProjectModel(rootDir, config);
   const overrides = await loadAgentOverrides(rootDir);
   const contextPath = resolve14(rootDir, AGENT_CONTEXT_PATH);
-  if (!options.allowMissingContext && !existsSync21(contextPath)) {
+  if (!options.allowMissingContext && !existsSync22(contextPath)) {
     throw new Error(`No agent context found at ${AGENT_CONTEXT_PATH}. Run "pluxx agent prepare" first.`);
   }
   if (project.sourceKind !== "mcp-derived" && kind !== "review") {
@@ -12803,7 +13037,7 @@ async function planAgentPrompt(rootDir, kind, options = {}) {
     displayName: project.displayName,
     skillPaths: project.skills.map((skill) => skill.path),
     commandPaths: project.commands.map((command2) => command2.path),
-    extraContextPaths: [AGENT_SOURCES_PATH, AGENT_DOCS_CONTEXT_PATH].filter((path) => existsSync21(resolve14(rootDir, path))),
+    extraContextPaths: [AGENT_SOURCES_PATH, AGENT_DOCS_CONTEXT_PATH].filter((path) => existsSync22(resolve14(rootDir, path))),
     sourceKind: project.sourceKind,
     taxonomyPath: project.taxonomyPath,
     overrides
@@ -12971,7 +13205,7 @@ function buildProtectedFiles() {
 }
 async function loadMcpScaffoldMetadata2(rootDir) {
   const metadataPath = resolve14(rootDir, MCP_SCAFFOLD_METADATA_PATH);
-  if (!existsSync21(metadataPath)) {
+  if (!existsSync22(metadataPath)) {
     throw new Error(`No MCP scaffold metadata found at ${MCP_SCAFFOLD_METADATA_PATH}. Run "pluxx init --from-mcp" first.`);
   }
   try {
@@ -12985,7 +13219,7 @@ async function loadMcpScaffoldMetadata2(rootDir) {
 }
 async function loadAgentProjectModel(rootDir, config) {
   const metadataPath = resolve14(rootDir, MCP_SCAFFOLD_METADATA_PATH);
-  if (existsSync21(metadataPath)) {
+  if (existsSync22(metadataPath)) {
     const metadata = await loadMcpScaffoldMetadata2(rootDir);
     const serverEntry = Object.entries(config.mcp ?? {})[0];
     const [serverName, server] = serverEntry ?? ["unknown", metadata.source];
@@ -13023,7 +13257,7 @@ function loadManualAgentProjectModel(rootDir, config) {
   const commandsDir = config.commands ? resolve14(rootDir, config.commands) : void 0;
   const skills = readCanonicalSkillFiles(rootDir, skillsDir);
   const commands = readCanonicalCommandFiles(commandsDir).map((command2) => ({
-    path: normalizeRelativePath(relative8(rootDir, command2.filePath)),
+    path: normalizeRelativePath(relative9(rootDir, command2.filePath)),
     title: command2.title,
     description: command2.description
   }));
@@ -13354,7 +13588,7 @@ async function collectAgentContextPackInternal(rootDir, options, overrides) {
     if (seenFilePaths.has(relativePath)) continue;
     seenFilePaths.add(relativePath);
     const filePath = resolve14(rootDir, relativePath);
-    if (!existsSync21(filePath)) {
+    if (!existsSync22(filePath)) {
       const source2 = {
         label: relativePath,
         kind: "file",
@@ -14524,18 +14758,18 @@ function normalizeRelativePath(path) {
   return path.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function readCanonicalSkillFiles(rootDir, skillsDir) {
-  if (!skillsDir || !existsSync21(skillsDir)) return [];
+  if (!skillsDir || !existsSync22(skillsDir)) return [];
   return walkSkillMarkdownFiles(skillsDir).sort((a, b) => a.localeCompare(b)).map((filePath) => {
     const content = readFileSync9(filePath, "utf-8");
     const { frontmatterLines, body } = splitSkillMarkdownFrontmatter(content);
-    const dirName = normalizeRelativePath(relative8(skillsDir, filePath).replace(/\/SKILL\.md$/i, ""));
+    const dirName = normalizeRelativePath(relative9(skillsDir, filePath).replace(/\/SKILL\.md$/i, ""));
     const title = firstMarkdownHeading(body) ?? dirName;
     return {
       dirName,
       title,
       description: parseYamlDescription(frontmatterLines),
       toolNames: [],
-      path: normalizeRelativePath(relative8(rootDir, filePath))
+      path: normalizeRelativePath(relative9(rootDir, filePath))
     };
   });
 }
@@ -14845,7 +15079,7 @@ async function executeCommand(command2, cwd, options = {}) {
     let claudeTurnCompleted = false;
     let claudeTurnFailed = false;
     const sentinelInterval = codexLastMessagePath || isClaudeStreamJson ? setInterval(() => {
-      const sawCompletionSignal = codexTurnCompleted || codexTurnFailed || claudeTurnCompleted || claudeTurnFailed || (codexLastMessagePath ? existsSync21(codexLastMessagePath) : false);
+      const sawCompletionSignal = codexTurnCompleted || codexTurnFailed || claudeTurnCompleted || claudeTurnFailed || (codexLastMessagePath ? existsSync22(codexLastMessagePath) : false);
       if (!sawCompletionSignal) return;
       if (sawFinalMessageAt == null) {
         sawFinalMessageAt = Date.now();
@@ -14971,15 +15205,15 @@ exec ${shellQuote(cursorBinary)} "$@"
   await mkdir3(resolve14(isolatedCodexHome, "memories"), { recursive: true });
   for (const relativePath of ["auth.json", "config.toml", "hooks.json", "installation_id"]) {
     const sourcePath = resolve14(currentCodexHome, relativePath);
-    if (!existsSync21(sourcePath)) continue;
+    if (!existsSync22(sourcePath)) continue;
     await copyFile(sourcePath, resolve14(isolatedCodexHome, relativePath));
   }
   const rulesSourceDir = resolve14(currentCodexHome, "rules");
-  if (existsSync21(rulesSourceDir)) {
+  if (existsSync22(rulesSourceDir)) {
     const rulesTargetDir = resolve14(isolatedCodexHome, "rules");
     await mkdir3(rulesTargetDir, { recursive: true });
     const defaultRulesPath = resolve14(rulesSourceDir, "default.rules");
-    if (existsSync21(defaultRulesPath)) {
+    if (existsSync22(defaultRulesPath)) {
       await copyFile(defaultRulesPath, resolve14(rulesTargetDir, "default.rules"));
     }
   }
@@ -15017,7 +15251,7 @@ function titleCase(value) {
 }
 async function loadAgentOverrides(rootDir) {
   const overridesPath = resolve14(rootDir, AGENT_OVERRIDES_PATH);
-  if (!existsSync21(overridesPath)) {
+  if (!existsSync22(overridesPath)) {
     return null;
   }
   const content = await readTextFile(overridesPath);
@@ -15119,12 +15353,12 @@ ${additions.map((block) => `- ${block.replace(/\n/g, "\n  ")}`).join("\n")}
 }
 
 // src/cli/doctor.ts
-import { accessSync, constants, existsSync as existsSync23, lstatSync, readFileSync as readFileSync11, readdirSync as readdirSync9 } from "fs";
-import { basename as basename6, dirname as dirname6, resolve as resolve16 } from "path";
+import { accessSync, constants, existsSync as existsSync24, lstatSync as lstatSync3, readFileSync as readFileSync11, readdirSync as readdirSync9 } from "fs";
+import { basename as basename6, dirname as dirname7, resolve as resolve16 } from "path";
 
 // src/cli/install.ts
-import { resolve as resolve15, dirname as dirname5 } from "path";
-import { existsSync as existsSync22, symlinkSync, mkdirSync as mkdirSync4, rmSync as rmSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4, cpSync as cpSync3, readdirSync as readdirSync8 } from "fs";
+import { resolve as resolve15, dirname as dirname6 } from "path";
+import { existsSync as existsSync23, symlinkSync, mkdirSync as mkdirSync4, rmSync as rmSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4, cpSync as cpSync3, readdirSync as readdirSync8 } from "fs";
 import { spawnSync } from "child_process";
 import * as readline2 from "readline";
 function listHookCommands(hooks) {
@@ -15173,6 +15407,10 @@ async function resolveInstallUserConfig(config, platforms = config.targets, opti
   const isTTY = options.isTTY ?? process.stdin.isTTY === true;
   for (const entry of planned) {
     if (entry.value !== void 0) {
+      if (entry.field.type === "secret" && isPlaceholderSecretValue(entry.value)) {
+        const hint = entry.envVar ? ` Export a real value first: export ${entry.envVar}='your_real_key'. Then rerun pluxx install.` : " Provide a real secret value before installing.";
+        throw new Error(`Refusing to install placeholder secret for userConfig "${entry.field.key}". Placeholder values like "dummy" are not usable by installed MCP servers.${hint}`);
+      }
       resolved.push({
         field: entry.field,
         value: entry.value,
@@ -15184,8 +15422,8 @@ async function resolveInstallUserConfig(config, platforms = config.targets, opti
       continue;
     }
     if (!isTTY) {
-      const hint = entry.envVar ? ` Export ${entry.envVar} or install interactively.` : " Re-run interactively to provide it.";
-      throw new Error(`Missing required userConfig "${entry.field.key}".${hint}`);
+      const hint = entry.envVar ? ` Export it before installing: export ${entry.envVar}='your_real_key'. Then rerun pluxx install.` : " Re-run interactively to provide it.";
+      throw new Error(`Missing required userConfig "${entry.field.key}". Installed plugins cannot prompt for this value later in every host UI.${hint}`);
     }
     const promptLabel = entry.field.title || entry.field.key;
     const envHint = entry.envVar ? ` [env: ${entry.envVar}]` : "";
@@ -15260,7 +15498,7 @@ async function ensureHookTrust(options) {
   const isTTY = options.isTTY ?? process.stdin.isTTY === true;
   if (!isTTY) {
     throw new Error(
-      `Refusing to install plugin with hooks in non-interactive mode. Re-run with --trust to continue.`
+      `Refusing to install plugin with hooks in non-interactive mode. Review the hook commands above. Re-run with --trust if you trust this plugin author.`
     );
   }
   const confirm = options.confirmPrompt ?? promptTrustConfirmation;
@@ -15393,12 +15631,12 @@ ${content.slice(frontmatterMatch[0].length)}`;
 }
 function syncOpenCodeSkills(pluginDir, pluginName) {
   const sourceSkillsDir = resolve15(pluginDir, "skills");
-  if (!existsSync22(sourceSkillsDir)) return;
+  if (!existsSync23(sourceSkillsDir)) return;
   mkdirSync4(getOpenCodeSkillRoot(), { recursive: true });
   for (const entry of readdirSync8(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const skillSourceDir = resolve15(sourceSkillsDir, entry.name);
-    if (!existsSync22(resolve15(skillSourceDir, "SKILL.md"))) continue;
+    if (!existsSync23(resolve15(skillSourceDir, "SKILL.md"))) continue;
     const installedSkillDir = getOpenCodeInstalledSkillDir(pluginName, entry.name);
     rmSync3(installedSkillDir, { recursive: true, force: true });
     cpSync3(skillSourceDir, installedSkillDir, { recursive: true });
@@ -15411,7 +15649,7 @@ function syncOpenCodeSkills(pluginDir, pluginName) {
 }
 function verifyOpenCodeInstall(pluginDir, pluginName) {
   const entryPath = getOpenCodeEntryPath(pluginDir);
-  if (!existsSync22(entryPath)) {
+  if (!existsSync23(entryPath)) {
     throw new Error(`OpenCode install is incomplete: missing host entry file at ${entryPath}`);
   }
   const entryContent = readFileSync10(entryPath, "utf-8");
@@ -15424,13 +15662,13 @@ function verifyOpenCodeInstall(pluginDir, pluginName) {
     throw new Error(`OpenCode install is incomplete: ${entryPath} does not preserve the plugin root bridge`);
   }
   const sourceSkillsDir = resolve15(pluginDir, "skills");
-  if (!existsSync22(sourceSkillsDir)) return;
+  if (!existsSync23(sourceSkillsDir)) return;
   for (const entry of readdirSync8(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const sourceSkillPath = resolve15(sourceSkillsDir, entry.name, "SKILL.md");
-    if (!existsSync22(sourceSkillPath)) continue;
+    if (!existsSync23(sourceSkillPath)) continue;
     const installedSkillPath = resolve15(getOpenCodeInstalledSkillDir(pluginName, entry.name), "SKILL.md");
-    if (!existsSync22(installedSkillPath)) {
+    if (!existsSync23(installedSkillPath)) {
       throw new Error(`OpenCode install is incomplete: missing synced skill at ${installedSkillPath}`);
     }
     const installedSkillContent = readFileSync10(installedSkillPath, "utf-8");
@@ -15441,7 +15679,7 @@ function verifyOpenCodeInstall(pluginDir, pluginName) {
 }
 function removeOpenCodeSkills(pluginName) {
   const root = getOpenCodeSkillRoot();
-  if (!existsSync22(root)) return false;
+  if (!existsSync23(root)) return false;
   let removed = false;
   for (const entry of readdirSync8(root, { withFileTypes: true })) {
     if (!entry.name.startsWith(`${pluginName}-`)) continue;
@@ -15459,7 +15697,7 @@ function getInstallFollowupNotes(platforms) {
     notes.push("Cursor note: if Cursor is already open, use Developer: Reload Window or restart Cursor to pick up the new install.");
   }
   if (platforms.includes("codex")) {
-    notes.push("Codex note: if Codex is already open, use Plugins > Refresh if that action is available in your current UI, or restart Codex to pick up the new install.");
+    notes.push("Codex note: if Codex is already open, use Plugins > Refresh if that action is available in your current UI, or restart Codex to pick up the new install. Plugin-bundled MCP servers may appear on the plugin detail page without appearing in the global MCP servers settings page.");
   }
   if (platforms.includes("opencode")) {
     notes.push("OpenCode note: if OpenCode is already open, restart or reload it so the plugin is picked up.");
@@ -15477,7 +15715,7 @@ function runCommandDefault(command2, args2) {
 function createSymlinkInstall(target) {
   const parentDir = resolve15(target.pluginDir, "..");
   mkdirSync4(parentDir, { recursive: true });
-  if (existsSync22(target.pluginDir)) {
+  if (existsSync23(target.pluginDir)) {
     rmSync3(target.pluginDir, { recursive: true, force: true });
   }
   symlinkSync(target.sourceDir, target.pluginDir);
@@ -15495,7 +15733,7 @@ function getCodexMarketplacePluginPath(pluginName) {
   return `./.codex/plugins/${pluginName}`;
 }
 function readCodexMarketplace(filepath) {
-  if (!existsSync22(filepath)) {
+  if (!existsSync23(filepath)) {
     return {
       name: "pluxx-local",
       interface: {
@@ -15514,7 +15752,7 @@ function readCodexMarketplace(filepath) {
 }
 function ensureCodexMarketplace(pluginName) {
   const filepath = getCodexMarketplacePath();
-  mkdirSync4(dirname5(filepath), { recursive: true });
+  mkdirSync4(dirname6(filepath), { recursive: true });
   const marketplace = readCodexMarketplace(filepath);
   const nextPlugins = (marketplace.plugins ?? []).filter((plugin) => plugin.name !== pluginName);
   nextPlugins.push({
@@ -15540,7 +15778,7 @@ function ensureCodexMarketplace(pluginName) {
 }
 function removeCodexMarketplacePlugin(pluginName) {
   const filepath = getCodexMarketplacePath();
-  if (!existsSync22(filepath)) return;
+  if (!existsSync23(filepath)) return;
   const marketplace = readCodexMarketplace(filepath);
   const nextPlugins = (marketplace.plugins ?? []).filter((plugin) => plugin.name !== pluginName);
   if (nextPlugins.length === (marketplace.plugins ?? []).length) {
@@ -15562,7 +15800,7 @@ function removeCodexMarketplacePlugin(pluginName) {
 function createCopiedInstall(target) {
   const parentDir = resolve15(target.pluginDir, "..");
   mkdirSync4(parentDir, { recursive: true });
-  if (existsSync22(target.pluginDir)) {
+  if (existsSync23(target.pluginDir)) {
     rmSync3(target.pluginDir, { recursive: true, force: true });
   }
   cpSync3(target.sourceDir, target.pluginDir, { recursive: true });
@@ -15587,7 +15825,7 @@ function patchInstalledMcpConfig(pluginDir, platform, config, entries) {
   const env = buildUserConfigEnvMap(entries);
   if (platform === "claude-code" || platform === "cursor") {
     const filepath = resolve15(pluginDir, platform === "claude-code" ? ".mcp.json" : "mcp.json");
-    if (!existsSync22(filepath)) return;
+    if (!existsSync23(filepath)) return;
     const mcpServers = {};
     const usesPlatformManagedAuth = platform === "claude-code" ? config.platforms?.["claude-code"]?.mcpAuth === "platform" : config.platforms?.cursor?.mcpAuth === "platform";
     for (const [name, server] of Object.entries(config.mcp)) {
@@ -15619,7 +15857,7 @@ function patchInstalledMcpConfig(pluginDir, platform, config, entries) {
   }
   if (platform === "codex") {
     const filepath = resolve15(pluginDir, ".mcp.json");
-    if (!existsSync22(filepath)) return;
+    if (!existsSync23(filepath)) return;
     const mcpServers = {};
     for (const [name, server] of Object.entries(config.mcp)) {
       if (server.transport === "stdio") {
@@ -15659,7 +15897,7 @@ function writeInstalledUserConfig(pluginDir, entries) {
 function disableInstalledEnvValidation(pluginDir, entries) {
   if (entries.length === 0) return;
   const filepath = resolve15(pluginDir, "scripts/check-env.sh");
-  if (!existsSync22(filepath)) return;
+  if (!existsSync23(filepath)) return;
   writeFileSync4(
     filepath,
     "#!/usr/bin/env bash\nset -euo pipefail\n# pluxx install materialized required config for this local plugin install.\nexit 0\n"
@@ -15679,11 +15917,159 @@ function getClaudeMarketplaceRoot(pluginName) {
   return resolve15(home, ".claude/plugins/data", getClaudeMarketplaceName(pluginName));
 }
 function resolveInstalledConsumerPath(target, pluginName) {
-  if (target.platform === "claude-code") {
-    return resolve15(getClaudeMarketplaceRoot(pluginName), "plugins", pluginName);
+  if (target.platform === "claude-code" && pluginName !== "") {
+    return target.pluginDir;
   }
   return target.pluginDir;
 }
+function manifestPathForPlatform(platform) {
+  switch (platform) {
+    case "claude-code":
+      return ".claude-plugin/plugin.json";
+    case "cursor":
+      return ".cursor-plugin/plugin.json";
+    case "codex":
+      return ".codex-plugin/plugin.json";
+    case "opencode":
+      return "package.json";
+    default:
+      return void 0;
+  }
+}
+function isRelativeBundlePath(value) {
+  return value.startsWith("./") || value.startsWith("../") || value.startsWith(".\\") || value.startsWith("..\\");
+}
+function resolveBundleReference(rootDir, value) {
+  if (isRelativeBundlePath(value)) {
+    return resolve15(rootDir, value);
+  }
+  const pluginRootMatch = value.match(/^\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|PLUGIN_ROOT)\}[\\/](.+)$/);
+  if (pluginRootMatch) {
+    return resolve15(rootDir, pluginRootMatch[1]);
+  }
+  return void 0;
+}
+function readBundleManifestReferences(manifest) {
+  const references = [];
+  for (const key of ["commands", "skills", "hooks", "mcpServers"]) {
+    const value = manifest[key];
+    if (typeof value === "string") {
+      references.push(value);
+    }
+  }
+  const agents = manifest.agents;
+  if (typeof agents === "string") {
+    references.push(agents);
+  } else if (Array.isArray(agents)) {
+    for (const entry of agents) {
+      if (typeof entry === "string") {
+        references.push(entry);
+      }
+    }
+  }
+  return references;
+}
+function collectHookCommandStrings(value, commands) {
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      collectHookCommandStrings(entry, commands);
+    }
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    if (key === "command" && typeof child === "string") {
+      commands.push(child);
+      continue;
+    }
+    collectHookCommandStrings(child, commands);
+  }
+}
+function extractBundleCommandTargets(command2) {
+  const matches = command2.match(/\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|PLUGIN_ROOT)\}[\\/][^\s"'`;$|&<>]+|\.\.?[\\/][^\s"'`;$|&<>]+/g);
+  return matches ?? [];
+}
+function findInstalledBundleIntegrityIssues(rootDir, platform) {
+  const manifestPath = manifestPathForPlatform(platform);
+  if (!manifestPath) {
+    return {
+      missingManifestPaths: [],
+      missingHookTargets: []
+    };
+  }
+  const manifestFile = resolve15(rootDir, manifestPath);
+  if (!existsSync23(manifestFile)) {
+    return {
+      manifestIssue: `missing plugin manifest at ${manifestPath}`,
+      missingManifestPaths: [],
+      missingHookTargets: []
+    };
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync10(manifestFile, "utf-8"));
+  } catch (error) {
+    return {
+      manifestIssue: `plugin manifest at ${manifestPath} is not parseable: ${error instanceof Error ? error.message : String(error)}`,
+      missingManifestPaths: [],
+      missingHookTargets: []
+    };
+  }
+  const missingManifestPaths = readBundleManifestReferences(manifest).filter((value) => {
+    const resolved = resolveBundleReference(rootDir, value);
+    return resolved !== void 0 && !existsSync23(resolved);
+  }).sort();
+  const hooksReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  if (!hooksReference) {
+    return {
+      missingManifestPaths,
+      missingHookTargets: []
+    };
+  }
+  const hooksPath = resolveBundleReference(rootDir, hooksReference);
+  if (!hooksPath || !existsSync23(hooksPath)) {
+    return {
+      missingManifestPaths,
+      missingHookTargets: []
+    };
+  }
+  try {
+    const hooks = JSON.parse(readFileSync10(hooksPath, "utf-8"));
+    const commands = [];
+    collectHookCommandStrings(hooks, commands);
+    const missingHookTargets = [...new Set(
+      commands.flatMap(extractBundleCommandTargets).filter((value) => {
+        const resolved = resolveBundleReference(rootDir, value);
+        return resolved !== void 0 && !existsSync23(resolved);
+      })
+    )].sort();
+    return {
+      missingManifestPaths,
+      missingHookTargets
+    };
+  } catch {
+    return {
+      missingManifestPaths,
+      missingHookTargets: []
+    };
+  }
+}
+function assertInstalledBundleIntegrity(rootDir, platform, label) {
+  const issues = findInstalledBundleIntegrityIssues(rootDir, platform);
+  const details = [];
+  if (issues.manifestIssue) {
+    details.push(issues.manifestIssue);
+  }
+  if (issues.missingManifestPaths.length > 0) {
+    details.push(`manifest paths missing: ${issues.missingManifestPaths.join(", ")}`);
+  }
+  if (issues.missingHookTargets.length > 0) {
+    details.push(`hook targets missing: ${issues.missingHookTargets.join(", ")}`);
+  }
+  if (details.length > 0) {
+    throw new Error(`${label} is incomplete: ${details.join("; ")}`);
+  }
+}
 function ensureClaudeMarketplace(pluginName, sourceDir, materialized) {
   const marketplaceName = getClaudeMarketplaceName(pluginName);
   const marketplaceRoot = getClaudeMarketplaceRoot(pluginName);
@@ -15694,12 +16080,11 @@ function ensureClaudeMarketplace(pluginName, sourceDir, materialized) {
   rmSync3(marketplaceRoot, { recursive: true, force: true });
   mkdirSync4(marketplaceManifestDir, { recursive: true });
   mkdirSync4(resolve15(marketplaceRoot, "plugins"), { recursive: true });
+  cpSync3(sourceDir, marketplacePluginDir, { recursive: true });
   if (materialized && materialized.entries.length > 0) {
-    cpSync3(sourceDir, marketplacePluginDir, { recursive: true });
     materializeInstalledPlugin(marketplacePluginDir, "claude-code", materialized.config, materialized.entries);
-  } else {
-    symlinkSync(sourceDir, marketplacePluginDir);
   }
+  assertInstalledBundleIntegrity(marketplacePluginDir, "claude-code", "Claude marketplace bundle");
   writeFileSync4(
     resolve15(marketplaceManifestDir, "marketplace.json"),
     JSON.stringify({
@@ -15741,7 +16126,7 @@ function ensureClaudeMarketplaceRegistered(pluginName, sourceDir, runCommand, ma
 }
 function installClaudePlugin(target, pluginName, runCommand, materialized) {
   const marketplaceName = ensureClaudeMarketplaceRegistered(pluginName, target.sourceDir, runCommand, materialized);
-  if (existsSync22(target.pluginDir)) {
+  if (existsSync23(target.pluginDir)) {
     rmSync3(target.pluginDir, { recursive: true, force: true });
   }
   runCommand("claude", ["plugin", "uninstall", `${pluginName}@${marketplaceName}`]);
@@ -15749,6 +16134,7 @@ function installClaudePlugin(target, pluginName, runCommand, materialized) {
   if (install.status !== 0) {
     throw new Error(`Failed to install Claude plugin: ${install.stderr || install.stdout}`);
   }
+  assertInstalledBundleIntegrity(target.pluginDir, "claude-code", "Installed Claude plugin bundle");
 }
 function uninstallClaudePlugin(target, pluginName, runCommand, options = {}) {
   const marketplaceName = getClaudeMarketplaceName(pluginName);
@@ -15760,9 +16146,9 @@ function uninstallClaudePlugin(target, pluginName, runCommand, options = {}) {
     }
   }
   const marketplaceRoot = getClaudeMarketplaceRoot(pluginName);
-  const hadMarketplaceRoot = existsSync22(marketplaceRoot);
+  const hadMarketplaceRoot = existsSync23(marketplaceRoot);
   rmSync3(marketplaceRoot, { recursive: true, force: true });
-  const hadLegacyPluginDir = existsSync22(target.pluginDir);
+  const hadLegacyPluginDir = existsSync23(target.pluginDir);
   if (hadLegacyPluginDir) {
     rmSync3(target.pluginDir, { recursive: true, force: true });
   }
@@ -15776,8 +16162,8 @@ function planInstallPlugin(distDir, pluginName, platforms) {
     return {
       ...target,
       sourceDir,
-      built: existsSync22(sourceDir),
-      existing: existsSync22(target.pluginDir)
+      built: existsSync23(sourceDir),
+      existing: existsSync23(target.pluginDir)
     };
   });
 }
@@ -15830,7 +16216,11 @@ async function installPlugin(distDir, pluginName, platforms, options = {}) {
     console.log("Nothing to install. Run `pluxx build` first.");
   } else if (!options.quiet) {
     console.log(`
-Installed ${installed} plugin(s). Reload or restart your tools to pick them up.`);
+Installed ${installed} plugin(s).`);
+    console.log("Next checks:");
+    console.log(`  1. Run: pluxx verify-install --target ${filtered.map((target) => target.platform).join(",")}`);
+    console.log("  2. Open the host plugin screen and confirm the plugin appears there.");
+    console.log("  3. Reload or restart the host if it was already open.");
     for (const note of getInstallFollowupNotes(filtered.map((target) => target.platform))) {
       console.log(note);
     }
@@ -15853,13 +16243,13 @@ async function uninstallPlugin(pluginName, platforms, options = {}) {
       continue;
     }
     let removedTarget = false;
-    if (existsSync22(target.pluginDir)) {
+    if (existsSync23(target.pluginDir)) {
       rmSync3(target.pluginDir, { recursive: true, force: true });
       removedTarget = true;
     }
     if (target.platform === "opencode") {
       const entryPath = getOpenCodeEntryPath(target.pluginDir);
-      if (existsSync22(entryPath)) {
+      if (existsSync23(entryPath)) {
         rmSync3(entryPath, { force: true });
         removedTarget = true;
       }
@@ -15969,7 +16359,7 @@ function checkReadablePath(checks, rootDir, label, configuredPath, required) {
     return;
   }
   const resolvedPath = resolve16(rootDir, configuredPath);
-  if (!existsSync23(resolvedPath)) {
+  if (!existsSync24(resolvedPath)) {
     addCheck2(checks, {
       level: "error",
       code: "path-not-found",
@@ -16335,7 +16725,7 @@ function checkCompilerIntent(checks, rootDir) {
 }
 function checkScaffoldMetadata(checks, rootDir, config) {
   const metadataPath = resolve16(rootDir, MCP_SCAFFOLD_METADATA_PATH);
-  if (!existsSync23(metadataPath)) {
+  if (!existsSync24(metadataPath)) {
     addCheck2(checks, {
       level: "info",
       code: "mcp-metadata-missing",
@@ -16400,7 +16790,7 @@ function checkScaffoldMetadata(checks, rootDir, config) {
   }
 }
 function detectConsumerLayout(rootDir) {
-  if (existsSync23(resolve16(rootDir, ".claude-plugin/plugin.json"))) {
+  if (existsSync24(resolve16(rootDir, ".claude-plugin/plugin.json"))) {
     return {
       kind: "installed-platform",
       platform: "claude-code",
@@ -16408,7 +16798,7 @@ function detectConsumerLayout(rootDir) {
       mcpConfigPath: ".mcp.json"
     };
   }
-  if (existsSync23(resolve16(rootDir, ".cursor-plugin/plugin.json"))) {
+  if (existsSync24(resolve16(rootDir, ".cursor-plugin/plugin.json"))) {
     return {
       kind: "installed-platform",
       platform: "cursor",
@@ -16416,7 +16806,7 @@ function detectConsumerLayout(rootDir) {
       mcpConfigPath: "mcp.json"
     };
   }
-  if (existsSync23(resolve16(rootDir, ".codex-plugin/plugin.json"))) {
+  if (existsSync24(resolve16(rootDir, ".codex-plugin/plugin.json"))) {
     return {
       kind: "installed-platform",
       platform: "codex",
@@ -16426,7 +16816,7 @@ function detectConsumerLayout(rootDir) {
   }
   const packagePath = resolve16(rootDir, "package.json");
   const indexPath = resolve16(rootDir, "index.ts");
-  if (existsSync23(packagePath) && existsSync23(indexPath)) {
+  if (existsSync24(packagePath) && existsSync24(indexPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(packagePath, "utf-8"));
       if (pkg.peerDependencies?.["@opencode-ai/plugin"] || pkg.keywords?.includes("opencode-plugin")) {
@@ -16444,10 +16834,10 @@ function detectConsumerLayout(rootDir) {
       };
     }
   }
-  if (CONFIG_FILES.some((filename) => existsSync23(resolve16(rootDir, filename)))) {
+  if (CONFIG_FILES.some((filename) => existsSync24(resolve16(rootDir, filename)))) {
     return { kind: "source-project" };
   }
-  if (["claude-code", "cursor", "codex", "opencode"].some((dir) => existsSync23(resolve16(rootDir, dir)))) {
+  if (["claude-code", "cursor", "codex", "opencode"].some((dir) => existsSync24(resolve16(rootDir, dir)))) {
     return { kind: "multi-target-dist" };
   }
   return { kind: "unknown" };
@@ -16458,7 +16848,7 @@ function readJsonFile2(rootDir, relativePath) {
 function checkConsumerBundlePath(checks, rootDir) {
   try {
     accessSync(rootDir, constants.R_OK);
-    const details = lstatSync(rootDir);
+    const details = lstatSync3(rootDir);
     addCheck2(checks, {
       level: "success",
       code: "consumer-path-readable",
@@ -16505,7 +16895,7 @@ function checkConsumerManifest(checks, rootDir, layout) {
 function checkInstalledUserConfig(checks, rootDir) {
   const userConfigPath = ".pluxx-user.json";
   const resolvedPath = resolve16(rootDir, userConfigPath);
-  if (!existsSync23(resolvedPath)) {
+  if (!existsSync24(resolvedPath)) {
     addCheck2(checks, {
       level: "info",
       code: "consumer-user-config-missing",
@@ -16520,6 +16910,10 @@ function checkInstalledUserConfig(checks, rootDir) {
     const payload = JSON.parse(readFileSync11(resolvedPath, "utf-8"));
     const valueCount = Object.keys(payload.values ?? {}).length;
     const envCount = Object.keys(payload.env ?? {}).length;
+    const placeholderKeys = [
+      ...Object.entries(payload.values ?? {}).filter(([, value]) => isPlaceholderSecretValue(value)).map(([key]) => key),
+      ...Object.entries(payload.env ?? {}).filter(([, value]) => isPlaceholderSecretValue(value)).map(([key]) => key)
+    ];
     addCheck2(checks, {
       level: "success",
       code: "consumer-user-config-valid",
@@ -16528,6 +16922,16 @@ function checkInstalledUserConfig(checks, rootDir) {
       fix: "No action needed.",
       path: userConfigPath
     });
+    if (placeholderKeys.length > 0) {
+      addCheck2(checks, {
+        level: "warning",
+        code: "consumer-user-config-placeholder-secret",
+        title: "Local install config contains placeholder-looking secret values",
+        detail: `.pluxx-user.json contains placeholder-looking value${placeholderKeys.length === 1 ? "" : "s"} for ${placeholderKeys.join(", ")}.`,
+        fix: "Reinstall the plugin with real secret values, or edit .pluxx-user.json and refresh/restart the host.",
+        path: userConfigPath
+      });
+    }
   } catch (error) {
     addCheck2(checks, {
       level: "error",
@@ -16542,7 +16946,7 @@ function checkInstalledUserConfig(checks, rootDir) {
 function checkInstalledEnvValidation(checks, rootDir) {
   const envScriptPath = "scripts/check-env.sh";
   const resolvedPath = resolve16(rootDir, envScriptPath);
-  if (!existsSync23(resolvedPath)) {
+  if (!existsSync24(resolvedPath)) {
     addCheck2(checks, {
       level: "info",
       code: "consumer-env-script-missing",
@@ -16587,7 +16991,7 @@ function checkInstalledMcpConfig(checks, rootDir, layout) {
     return;
   }
   const resolvedPath = resolve16(rootDir, layout.mcpConfigPath);
-  if (!existsSync23(resolvedPath)) {
+  if (!existsSync24(resolvedPath)) {
     addCheck2(checks, {
       level: "info",
       code: "consumer-mcp-config-missing",
@@ -16612,6 +17016,16 @@ function checkInstalledMcpConfig(checks, rootDir, layout) {
     if (servers.length === 0) {
       return;
     }
+    if (layout.platform === "codex") {
+      addCheck2(checks, {
+        level: "info",
+        code: "consumer-codex-mcp-bundled-visibility",
+        title: "Codex plugin-bundled MCP visibility clarified",
+        detail: `This Codex plugin bundle includes ${servers.length} MCP server${servers.length === 1 ? "" : "s"} through ${layout.mcpConfigPath}. Codex may show this on the plugin detail page without listing it on the global MCP servers settings page.`,
+        fix: "Use the plugin detail page, tool availability in chat, and `pluxx verify-install --target codex` as the source of truth for plugin-bundled MCP wiring. If the MCP remains unavailable after install, use Plugins > Refresh if present or restart Codex.",
+        path: layout.mcpConfigPath
+      });
+    }
     const remoteEntries = servers.filter((server) => "url" in server);
     const stdioEntries = servers.filter((server) => "command" in server);
     const inlineHeaderEntries = servers.filter((server) => {
@@ -16628,6 +17042,17 @@ function checkInstalledMcpConfig(checks, rootDir, layout) {
         fix: "If tools fail, verify the bundled command or its runtime dependencies on this machine.",
         path: layout.mcpConfigPath
       });
+      const missingRuntimePaths = findMissingInstalledStdioRuntimePaths(rootDir, stdioEntries);
+      if (missingRuntimePaths.length > 0) {
+        addCheck2(checks, {
+          level: "warning",
+          code: "consumer-mcp-stdio-runtime-missing",
+          title: "Bundled stdio MCP runtime files are missing",
+          detail: `This installed MCP config references local runtime path${missingRuntimePaths.length === 1 ? "" : "s"} that do not exist in the bundle: ${missingRuntimePaths.join(", ")}.`,
+          fix: "Rebuild the plugin with the MCP runtime directory included in passthrough, then reinstall the host bundle.",
+          path: layout.mcpConfigPath
+        });
+      }
     }
     if (remoteEntries.length > 0 && inlineHeaderEntries.length > 0) {
       addCheck2(checks, {
@@ -16662,9 +17087,59 @@ function checkInstalledMcpConfig(checks, rootDir, layout) {
     });
   }
 }
+function checkInstalledBundleIntegrity(checks, rootDir, layout) {
+  const issues = findInstalledBundleIntegrityIssues(rootDir, layout.platform);
+  const details = [];
+  if (issues.manifestIssue) {
+    details.push(issues.manifestIssue);
+  }
+  if (issues.missingManifestPaths.length > 0) {
+    details.push(`manifest references missing path${issues.missingManifestPaths.length === 1 ? "" : "s"}: ${issues.missingManifestPaths.join(", ")}`);
+  }
+  if (issues.missingHookTargets.length > 0) {
+    details.push(`hook commands reference missing bundle target${issues.missingHookTargets.length === 1 ? "" : "s"}: ${issues.missingHookTargets.join(", ")}`);
+  }
+  if (details.length === 0) {
+    addCheck2(checks, {
+      level: "success",
+      code: "consumer-bundle-integrity-valid",
+      title: "Installed bundle references resolve inside the plugin",
+      detail: "Every manifest-declared path and bundle-relative hook target exists in this installed bundle.",
+      fix: "No action needed.",
+      path: layout.manifestPath
+    });
+    return;
+  }
+  addCheck2(checks, {
+    level: "error",
+    code: "consumer-bundle-integrity-invalid",
+    title: "Installed bundle is missing referenced files",
+    detail: details.join("; "),
+    fix: "Reinstall the plugin or rebuild the bundle so every manifest path and hook target exists in the installed plugin.",
+    path: layout.manifestPath
+  });
+}
+function findMissingInstalledStdioRuntimePaths(rootDir, stdioEntries) {
+  const missing = /* @__PURE__ */ new Set();
+  for (const server of stdioEntries) {
+    const command2 = typeof server.command === "string" ? server.command : void 0;
+    const args2 = Array.isArray(server.args) ? server.args.filter((value) => typeof value === "string") : [];
+    for (const candidate of [command2, ...args2]) {
+      if (!candidate || !isLikelyLocalRuntimePath3(candidate)) continue;
+      const resolvedPath = resolve16(rootDir, candidate);
+      if (!existsSync24(resolvedPath)) {
+        missing.add(candidate);
+      }
+    }
+  }
+  return [...missing].sort();
+}
+function isLikelyLocalRuntimePath3(value) {
+  return value.startsWith("./") || value.startsWith("../") || value.startsWith(".\\") || value.startsWith("..\\");
+}
 function isLikelyOpenCodeInstallPath(rootDir) {
-  const parent = dirname6(rootDir);
-  const grandparent = dirname6(parent);
+  const parent = dirname7(rootDir);
+  const grandparent = dirname7(parent);
   return basename6(parent) === "plugins" && basename6(grandparent) === "opencode";
 }
 function checkInstalledOpenCodeHostBridge(checks, rootDir) {
@@ -16682,7 +17157,7 @@ function checkInstalledOpenCodeHostBridge(checks, rootDir) {
   const pluginName = basename6(rootDir);
   const entryPath = `${rootDir}.ts`;
   const entryRelativePath = `${pluginName}.ts`;
-  if (!existsSync23(entryPath)) {
+  if (!existsSync24(entryPath)) {
     addCheck2(checks, {
       level: "error",
       code: "consumer-opencode-entry-missing",
@@ -16722,7 +17197,7 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
   }
   const pluginName = basename6(rootDir);
   const sourceSkillsDir = resolve16(rootDir, "skills");
-  if (!existsSync23(sourceSkillsDir)) {
+  if (!existsSync24(sourceSkillsDir)) {
     addCheck2(checks, {
       level: "info",
       code: "consumer-opencode-skill-sync-not-applicable",
@@ -16733,17 +17208,17 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
     });
     return;
   }
-  const skillRoot = resolve16(dirname6(dirname6(rootDir)), "skills");
+  const skillRoot = resolve16(dirname7(dirname7(rootDir)), "skills");
   const missingSkills = [];
   const malformedSkills = [];
   let expectedSkillCount = 0;
   for (const entry of readdirSync9(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const sourceSkillPath = resolve16(sourceSkillsDir, entry.name, "SKILL.md");
-    if (!existsSync23(sourceSkillPath)) continue;
+    if (!existsSync24(sourceSkillPath)) continue;
     expectedSkillCount++;
     const installedSkillPath = resolve16(skillRoot, `${pluginName}-${entry.name}`, "SKILL.md");
-    if (!existsSync23(installedSkillPath)) {
+    if (!existsSync24(installedSkillPath)) {
       missingSkills.push(`${pluginName}-${entry.name}`);
       continue;
     }
@@ -16829,6 +17304,7 @@ async function doctorConsumer(rootDir = process.cwd()) {
     path: layout.manifestPath
   });
   checkConsumerManifest(checks, rootDir, layout);
+  checkInstalledBundleIntegrity(checks, rootDir, layout);
   checkInstalledUserConfig(checks, rootDir);
   checkInstalledEnvValidation(checks, rootDir);
   checkInstalledMcpConfig(checks, rootDir, layout);
@@ -16840,7 +17316,7 @@ async function doctorConsumer(rootDir = process.cwd()) {
 }
 async function doctorProject(rootDir = process.cwd()) {
   const checks = [];
-  const configPath = CONFIG_FILES.find((filename) => existsSync23(resolve16(rootDir, filename)));
+  const configPath = CONFIG_FILES.find((filename) => existsSync24(resolve16(rootDir, filename)));
   addRuntimeChecks(checks, "project");
   if (!configPath) {
     addCheck2(checks, {
@@ -16939,7 +17415,7 @@ function printDoctorReport(report) {
 
 // src/cli/dev.ts
 import { watch } from "fs";
-import { relative as relative9, resolve as resolve17 } from "path";
+import { relative as relative10, resolve as resolve17 } from "path";
 var WATCH_PATTERNS = [
   /^pluxx\.config\.(ts|js|json)$/,
   /^skills\//,
@@ -16965,7 +17441,7 @@ async function runDev(args2) {
   let pendingFile = null;
   const watcher = watch(rootDir, { recursive: true }, (_event, filename) => {
     if (!filename) return;
-    const rel = relative9(rootDir, resolve17(rootDir, filename));
+    const rel = relative10(rootDir, resolve17(rootDir, filename));
     if (rel.startsWith("dist/") || rel.startsWith(".") || rel.includes("node_modules")) {
       return;
     }
@@ -17020,8 +17496,8 @@ async function runBuild(rootDir, targets) {
 }
 
 // src/cli/migrate.ts
-import { basename as basename7, relative as relative10, resolve as resolve18 } from "path";
-import { existsSync as existsSync24, readdirSync as readdirSync10, mkdirSync as mkdirSync5, cpSync as cpSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename7, relative as relative11, resolve as resolve18 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync10, mkdirSync as mkdirSync5, cpSync as cpSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
 function detectPlatform(pluginDir) {
   const checks = [
     { dir: ".claude-plugin", platform: "claude-code" },
@@ -17030,12 +17506,12 @@ function detectPlatform(pluginDir) {
   ];
   for (const check of checks) {
     const manifestPath = resolve18(pluginDir, check.dir, "plugin.json");
-    if (existsSync24(manifestPath)) {
+    if (existsSync25(manifestPath)) {
       return { platform: check.platform, manifestPath };
     }
   }
   const pkgPath = resolve18(pluginDir, "package.json");
-  if (existsSync24(pkgPath)) {
+  if (existsSync25(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
       const deps = {
@@ -17088,7 +17564,7 @@ function parseMcp(pluginDir, detection) {
   } catch {
   }
   for (const mcpPath of mcpPaths) {
-    if (!existsSync24(mcpPath)) continue;
+    if (!existsSync25(mcpPath)) continue;
     try {
       const raw = JSON.parse(readFileSync12(mcpPath, "utf-8"));
       const servers = raw.mcpServers ?? raw;
@@ -17182,7 +17658,7 @@ function parseHooks(pluginDir, detection) {
   } catch {
   }
   for (const hooksPath of hooksPaths) {
-    if (!existsSync24(hooksPath)) continue;
+    if (!existsSync25(hooksPath)) continue;
     try {
       const raw = JSON.parse(readFileSync12(hooksPath, "utf-8"));
       const hooksObj = raw.hooks ?? raw;
@@ -17231,7 +17707,7 @@ function findInstructions(pluginDir) {
   ];
   for (const candidate of candidates) {
     const filePath = resolve18(pluginDir, candidate);
-    if (existsSync24(filePath)) {
+    if (existsSync25(filePath)) {
       return `./${candidate}`;
     }
   }
@@ -17256,7 +17732,7 @@ function detectCanonicalSourcePaths(pluginDir) {
   for (const bucket of Object.keys(CANONICAL_SOURCE_CANDIDATES)) {
     for (const candidate of CANONICAL_SOURCE_CANDIDATES[bucket]) {
       const normalized = stripRelativePrefix(candidate);
-      if (!existsSync24(resolve18(pluginDir, normalized))) continue;
+      if (!existsSync25(resolve18(pluginDir, normalized))) continue;
       result[bucket] = normalizeRelativeDir(normalized);
       break;
     }
@@ -17272,7 +17748,7 @@ function detectPassthroughDirs(pluginDir, mcp) {
       if (!match?.[1]) continue;
       const dirName = match[1];
       const dirPath = resolve18(pluginDir, dirName);
-      if (existsSync24(dirPath)) {
+      if (existsSync25(dirPath)) {
         passthrough.add(`./${dirName}/`);
       }
     }
@@ -17373,7 +17849,7 @@ function inferPermissionsFromMigratedSkills(pluginDir, sourcePaths) {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const skillPath = resolve18(skillsDir, entry.name, "SKILL.md");
-    if (!existsSync24(skillPath)) continue;
+    if (!existsSync25(skillPath)) continue;
     const content = readFileSync12(skillPath, "utf-8");
     const inferredRules = extractAllowedTools(content).map(normalizeMigratedAllowedTool).filter((rule) => Boolean(rule));
     if (inferredRules.length === 0) continue;
@@ -17418,7 +17894,7 @@ function readMigratedSkills(pluginDir, sourcePaths) {
       const skillPath = resolve18(skillsDir, dirName, "SKILL.md");
       let title = titleCaseFromDirName(dirName);
       let description;
-      if (existsSync24(skillPath)) {
+      if (existsSync25(skillPath)) {
         const content = readFileSync12(skillPath, "utf-8");
         title = extractFrontmatterField(content, "name") ?? firstHeading3(content) ?? title;
         description = extractFrontmatterField(content, "description");
@@ -17452,13 +17928,13 @@ var HOST_NATIVE_SKILL_FRONTMATTER_KEYS = /* @__PURE__ */ new Set([
   "allowed-tools"
 ]);
 function sanitizeMigratedSkillFrontmatter(outputDir) {
-  if (!existsSync24(resolve18(outputDir, "skills"))) return;
+  if (!existsSync25(resolve18(outputDir, "skills"))) return;
   const skillsDir = resolve18(outputDir, "skills");
   const entries = readdirSync10(skillsDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const skillPath = resolve18(skillsDir, entry.name, "SKILL.md");
-    if (!existsSync24(skillPath)) continue;
+    if (!existsSync25(skillPath)) continue;
     const content = readFileSync12(skillPath, "utf-8");
     const lines = content.split(/\r?\n/);
     if (lines[0]?.trim() !== "---") continue;
@@ -17621,11 +18097,11 @@ function walkMarkdownFiles3(dir) {
   return files;
 }
 function normalizeMigratedOpenCodeAgents(destDir) {
-  if (!existsSync24(destDir)) return [];
+  if (!existsSync25(destDir)) return [];
   const normalized = [];
   for (const filePath of walkMarkdownFiles3(destDir)) {
     if (normalizeMigratedOpenCodeAgentFile(filePath)) {
-      normalized.push(relative10(destDir, filePath).replace(/\\/g, "/"));
+      normalized.push(relative11(destDir, filePath).replace(/\\/g, "/"));
     }
   }
   return normalized.sort();
@@ -17710,7 +18186,7 @@ function buildMigratedScaffoldMetadata(result, outputDir) {
       if (!result.sourcePaths[dir]) return [];
       const baseDir = dir;
       const dirPath = resolve18(outputDir, baseDir);
-      if (!existsSync24(dirPath)) return [];
+      if (!existsSync25(dirPath)) return [];
       const entries = readdirSync10(dirPath, { withFileTypes: true });
       const files = [];
       for (const entry of entries) {
@@ -17777,7 +18253,7 @@ function copyDirectories(pluginDir, outputDir, sourcePaths, passthrough) {
     const normalizedSource = stripRelativePrefix(sourcePath);
     const src = resolve18(pluginDir, normalizedSource);
     const dest = resolve18(outputDir, dir);
-    if (existsSync24(dest)) {
+    if (existsSync25(dest)) {
       console.log(`  skip ./${dir}/ (already exists)`);
       continue;
     }
@@ -17794,7 +18270,7 @@ function copyDirectories(pluginDir, outputDir, sourcePaths, passthrough) {
     const normalized = entry.replace(/^\.\//, "").replace(/\/$/, "");
     const src = resolve18(pluginDir, normalized);
     const dest = resolve18(outputDir, normalized);
-    if (existsSync24(dest)) {
+    if (existsSync25(dest)) {
       console.log(`  skip ./${normalized}/ (already exists)`);
       continue;
     }
@@ -17940,7 +18416,7 @@ function quote(s) {
 async function migrate(inputPath) {
   const pluginDir = resolve18(inputPath);
   const outputDir = process.cwd();
-  if (!existsSync24(pluginDir)) {
+  if (!existsSync25(pluginDir)) {
     console.error(`Error: Path does not exist: ${pluginDir}`);
     process.exit(1);
   }
@@ -18007,7 +18483,7 @@ async function migrate(inputPath) {
   };
   const configContent = generateConfigTs(result);
   const configPath = resolve18(outputDir, "pluxx.config.ts");
-  if (existsSync24(configPath)) {
+  if (existsSync25(configPath)) {
     console.error(`
 Error: pluxx.config.ts already exists in ${outputDir}`);
     console.error("Remove it first or run from a different directory.");
@@ -18024,7 +18500,7 @@ Generated pluxx.config.ts`);
   if (instructions) {
     const srcInstr = resolve18(pluginDir, instructions);
     const destInstr = resolve18(outputDir, instructions);
-    if (!existsSync24(destInstr)) {
+    if (!existsSync25(destInstr)) {
       const content = readFileSync12(srcInstr, "utf-8");
       await writeTextFile(destInstr, content);
       console.log(`Copied: ${instructions}`);
@@ -18060,7 +18536,7 @@ Generated pluxx.config.ts`);
 
 // src/cli/mcp-proxy.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync13 } from "fs";
-import { dirname as dirname7, resolve as resolve19 } from "path";
+import { dirname as dirname8, resolve as resolve19 } from "path";
 import * as readline3 from "readline";
 function usage() {
   return [
@@ -18137,7 +18613,7 @@ async function loadReplayTape(filepath) {
 }
 async function writeTape(filepath, tape) {
   const absolutePath = resolve19(process.cwd(), filepath);
-  mkdirSync6(dirname7(absolutePath), { recursive: true });
+  mkdirSync6(dirname8(absolutePath), { recursive: true });
   await writeTextFile(absolutePath, `${JSON.stringify(tape, null, 2)}
 `);
 }
@@ -18308,7 +18784,7 @@ var PromptCancelledError = class extends Error {
   }
 };
 function ask(question) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve25, reject) => {
     const rl = readline4.createInterface({
       input: process.stdin,
       output: process.stdout
@@ -18336,7 +18812,7 @@ function ask(question) {
     rl.once("close", onClose);
     rl.question(question, (answer) => {
       settle(() => {
-        resolve24(answer);
+        resolve25(answer);
         rl.close();
       });
     });
@@ -19311,13 +19787,13 @@ ${c2}
 } }).prompt();
 
 // src/cli/index.ts
-import { basename as basename8, resolve as resolve23 } from "path";
+import { basename as basename8, resolve as resolve24 } from "path";
 import { mkdir as mkdir4, mkdtemp as mkdtemp3, rm as rm4 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
 import { spawn as spawn4, spawnSync as spawnSync3 } from "child_process";
 
 // src/cli/publish.ts
-import { chmodSync, existsSync as existsSync25, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync, existsSync as existsSync26, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { createHash } from "crypto";
 import { resolve as resolve20 } from "path";
 import { spawnSync as spawnSync2 } from "child_process";
@@ -19352,7 +19828,7 @@ function resolveRequestedChannels(options) {
 }
 function getBuiltTargets(rootDir, config) {
   return config.targets.filter(
-    (platform) => existsSync25(resolve20(rootDir, config.outDir, platform))
+    (platform) => existsSync26(resolve20(rootDir, config.outDir, platform))
   );
 }
 function getArchiveAssetName(pluginName, platform, version, variant) {
@@ -19411,7 +19887,7 @@ function buildReleaseAssets(rootDir, config, version, targets) {
 function readNpmPackageName(rootDir, config) {
   const packageDir = resolve20(rootDir, config.outDir, "opencode");
   const packageJsonPath = resolve20(packageDir, "package.json");
-  if (!existsSync25(packageJsonPath)) {
+  if (!existsSync26(packageJsonPath)) {
     return {};
   }
   try {
@@ -19464,7 +19940,7 @@ function collectChecks(args2) {
   if (args2.npmEnabled) {
     checks.push({
       name: "npm-package-ready",
-      ok: Boolean(args2.packageDir && existsSync25(resolve20(args2.packageDir, "package.json")) && args2.packageName),
+      ok: Boolean(args2.packageDir && existsSync26(resolve20(args2.packageDir, "package.json")) && args2.packageName),
       code: "npm-package-ready",
       detail: args2.packageDir ? `OpenCode package dir: ${args2.packageDir}` : "No npm-backed target package found."
     });
@@ -19620,6 +20096,175 @@ echo
 echo "Installed __DISPLAY_NAME__ across ${installerTargets.join(", ")}."
 `.replaceAll("__REPO__", "REPO_PLACEHOLDER").replaceAll("__DISPLAY_NAME__", "DISPLAY_PLACEHOLDER");
 }
+function renderInstallerUserConfigSnippet(config, platform, installDirVariable) {
+  const entries = collectUserConfigEntries(config, [platform]).map((entry) => ({
+    key: entry.key,
+    title: entry.title,
+    type: entry.type ?? "string",
+    required: entry.required !== false,
+    envVar: entry.envVar ?? defaultUserConfigEnvVar(entry.key)
+  }));
+  if (entries.length === 0) return "";
+  const promptLines = entries.map((entry) => {
+    const functionName = entry.type === "secret" ? "pluxx_prompt_secret_config" : "pluxx_prompt_text_config";
+    return `${functionName} ${JSON.stringify(entry.envVar)} ${JSON.stringify(entry.title)} ${entry.required ? "1" : "0"}`;
+  });
+  return `
+PLUXX_USER_CONFIG_SPEC="$(cat <<'PLUXX_USER_CONFIG_JSON'
+${JSON.stringify(entries)}
+PLUXX_USER_CONFIG_JSON
+)"
+
+pluxx_is_placeholder_secret() {
+  case "$1" in
+    *dummy*|*Dummy*|*DUMMY*|*placeholder*|*Placeholder*|*PLACEHOLDER*|*changeme*|*CHANGE_ME*|*replace*me*|*Replace*Me*|*your*key*|*YOUR*KEY*|*api*key*here*|*API*KEY*HERE*|*token*here*|*TOKEN*HERE*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+pluxx_prompt_secret_config() {
+  local env_var="$1"
+  local label="$2"
+  local required="$3"
+  local current_value="\${!env_var:-}"
+
+  if [[ -z "$current_value" && "$required" == "1" ]]; then
+    if [[ -t 0 || -r /dev/tty ]]; then
+      read -r -s -p "$label [$env_var]: " current_value </dev/tty
+      echo >/dev/tty
+    else
+      echo "Missing required config: export $env_var before running this installer." >&2
+      exit 1
+    fi
+  fi
+
+  if [[ -n "$current_value" ]] && pluxx_is_placeholder_secret "$current_value"; then
+    echo "Refusing placeholder-looking secret for $env_var. Set a real value and rerun the installer." >&2
+    exit 1
+  fi
+
+  export "$env_var=$current_value"
+}
+
+pluxx_prompt_text_config() {
+  local env_var="$1"
+  local label="$2"
+  local required="$3"
+  local current_value="\${!env_var:-}"
+
+  if [[ -z "$current_value" && "$required" == "1" ]]; then
+    if [[ -t 0 || -r /dev/tty ]]; then
+      read -r -p "$label [$env_var]: " current_value </dev/tty
+    else
+      echo "Missing required config: export $env_var before running this installer." >&2
+      exit 1
+    fi
+  fi
+
+  export "$env_var=$current_value"
+}
+
+${promptLines.join("\n")}
+
+export PLUXX_USER_CONFIG_SPEC
+export PLUXX_INSTALL_DIR="${installDirVariable}"
+
+node <<'NODE'
+const fs = require('fs')
+const path = require('path')
+
+const installDir = process.env.PLUXX_INSTALL_DIR
+const spec = JSON.parse(process.env.PLUXX_USER_CONFIG_SPEC || '[]')
+
+if (installDir && spec.length > 0) {
+  const env = {}
+  const values = {}
+
+  for (const entry of spec) {
+    const value = process.env[entry.envVar]
+    if (value === undefined || value === '') continue
+    values[entry.key] = value
+    env[entry.envVar] = value
+  }
+
+  fs.writeFileSync(
+    path.join(installDir, '.pluxx-user.json'),
+    JSON.stringify({ values, env }, null, 2) + '\\n',
+  )
+
+  const envScriptPath = path.join(installDir, 'scripts/check-env.sh')
+  if (fs.existsSync(envScriptPath)) {
+    fs.writeFileSync(
+      envScriptPath,
+      '#!/usr/bin/env bash\\nset -euo pipefail\\n# pluxx install materialized required config for this local plugin install.\\nexit 0\\n',
+    )
+  }
+
+  const materialize = (value) =>
+    typeof value === 'string'
+      ? value.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_match, name) => env[name] || '${" + name + "}')
+      : value
+
+  const materializeRecord = (record) => {
+    if (!record || typeof record !== 'object') return record
+    const next = {}
+    for (const [key, value] of Object.entries(record)) {
+      next[key] = materialize(value)
+    }
+    return next
+  }
+
+  for (const relativePath of ['.mcp.json', 'mcp.json']) {
+    const filepath = path.join(installDir, relativePath)
+    if (!fs.existsSync(filepath)) continue
+
+    const payload = JSON.parse(fs.readFileSync(filepath, 'utf8'))
+    for (const server of Object.values(payload.mcpServers || {})) {
+      if (!server || typeof server !== 'object') continue
+
+      if (server.env) {
+        server.env = materializeRecord(server.env)
+      }
+
+      if (server.bearer_token_env_var && env[server.bearer_token_env_var]) {
+        server.http_headers = {
+          ...(server.http_headers || {}),
+          Authorization: 'Bearer ' + env[server.bearer_token_env_var],
+        }
+        delete server.bearer_token_env_var
+      }
+
+      if (server.env_http_headers && typeof server.env_http_headers === 'object') {
+        server.http_headers = {
+          ...(server.http_headers || {}),
+        }
+        for (const [headerName, envVar] of Object.entries(server.env_http_headers)) {
+          if (env[envVar]) server.http_headers[headerName] = env[envVar]
+        }
+        delete server.env_http_headers
+      }
+
+      if (server.headers) {
+        server.headers = materializeRecord(server.headers)
+      }
+      if (server.http_headers) {
+        server.http_headers = materializeRecord(server.http_headers)
+      }
+    }
+
+    fs.writeFileSync(filepath, JSON.stringify(payload, null, 2) + '\\n')
+  }
+}
+NODE
+`;
+}
+function hasInstallerUserConfig(config, platform) {
+  return collectUserConfigEntries(config, [platform]).length > 0;
+}
 function renderInstallClaudeCodeScript(config) {
   return `#!/usr/bin/env bash
 set -euo pipefail
@@ -19646,6 +20291,7 @@ need_cmd tar
 need_cmd mktemp
 need_cmd grep
 need_cmd sed
+${hasInstallerUserConfig(config, "claude-code") ? "need_cmd node" : ""}
 
 if [[ "$SKIP_INSTALL" != "1" ]]; then
   need_cmd curl
@@ -19682,6 +20328,7 @@ DESCRIPTION="$(grep -E '"description"' "$PLUGIN_MANIFEST" | head -n1 | sed -E 's
 mkdir -p "$INSTALL_ROOT/.claude-plugin" "$INSTALL_ROOT/plugins"
 rm -rf "$INSTALL_ROOT/plugins/$PLUGIN_NAME"
 cp -R "$BUNDLE_DIR" "$INSTALL_ROOT/plugins/$PLUGIN_NAME"
+${renderInstallerUserConfigSnippet(config, "claude-code", "$INSTALL_ROOT/plugins/$PLUGIN_NAME")}
 
 cat > "$INSTALL_ROOT/.claude-plugin/marketplace.json" <<JSON
 {
@@ -19745,6 +20392,7 @@ need_cmd() {
 need_cmd tar
 need_cmd mktemp
 need_cmd curl
+${hasInstallerUserConfig(config, "cursor") ? "need_cmd node" : ""}
 
 TMP_DIR="$(mktemp -d)"
 cleanup() {
@@ -19773,6 +20421,7 @@ fi
 mkdir -p "$(dirname "$INSTALL_DIR")"
 rm -rf "$INSTALL_DIR"
 cp -R "$BUNDLE_DIR" "$INSTALL_DIR"
+${renderInstallerUserConfigSnippet(config, "cursor", "$INSTALL_DIR")}
 
 echo "Installed $PLUGIN_NAME to $INSTALL_DIR"
 echo "If Cursor is already open, use Developer: Reload Window or restart Cursor so the plugin is picked up."
@@ -19830,6 +20479,7 @@ fi
 mkdir -p "$(dirname "$INSTALL_DIR")"
 rm -rf "$INSTALL_DIR"
 cp -R "$BUNDLE_DIR" "$INSTALL_DIR"
+${renderInstallerUserConfigSnippet(config, "codex", "$INSTALL_DIR")}
 
 mkdir -p "$(dirname "$MARKETPLACE_PATH")"
 
@@ -19944,6 +20594,7 @@ fi
 mkdir -p "$(dirname "$INSTALL_DIR")" "$SKILLS_ROOT"
 rm -rf "$INSTALL_DIR"
 cp -R "$BUNDLE_DIR" "$INSTALL_DIR"
+${renderInstallerUserConfigSnippet(config, "opencode", "$INSTALL_DIR")}
 
 export ENTRY_PATH
 export PLUGIN_NAME
@@ -20271,22 +20922,107 @@ function printJson(value) {
 }
 
 // src/cli/verify-install.ts
-import { existsSync as existsSync26 } from "fs";
+import { existsSync as existsSync27, lstatSync as lstatSync4, readdirSync as readdirSync11, readFileSync as readFileSync15, readlinkSync, realpathSync, statSync as statSync5 } from "fs";
 import { resolve as resolve21 } from "path";
 function buildCheckFromReport(target, pluginName, report) {
   const consumerPath = resolveInstalledConsumerPath(target, pluginName);
+  const staleReason = target.built && existsSync27(consumerPath) ? detectStaleInstall(target, pluginName, consumerPath) : void 0;
+  const stale = staleReason !== void 0;
   return {
     platform: target.platform,
     installPath: target.pluginDir,
     consumerPath,
     built: target.built,
-    installed: existsSync26(consumerPath),
-    ok: report.errors === 0,
-    errors: report.errors,
+    installed: existsSync27(consumerPath),
+    stale,
+    ...staleReason ? { staleReason } : {},
+    ok: report.errors === 0 && !stale,
+    errors: report.errors + (stale ? 1 : 0),
     warnings: report.warnings,
     infos: report.infos
   };
 }
+function manifestPathForPlatform2(platform) {
+  switch (platform) {
+    case "claude-code":
+      return ".claude-plugin/plugin.json";
+    case "cursor":
+      return ".cursor-plugin/plugin.json";
+    case "codex":
+      return ".codex-plugin/plugin.json";
+    case "opencode":
+      return "package.json";
+    default:
+      return void 0;
+  }
+}
+function readInstalledManifestVersion(rootDir, platform) {
+  const manifestPath = manifestPathForPlatform2(platform);
+  if (!manifestPath) return void 0;
+  const filepath = resolve21(rootDir, manifestPath);
+  if (!existsSync27(filepath)) return void 0;
+  try {
+    const manifest = JSON.parse(readFileSync15(filepath, "utf-8"));
+    return typeof manifest.version === "string" ? manifest.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findCodexCacheCandidates(pluginName) {
+  const home = process.env.HOME ?? "~";
+  const cacheRoot = resolve21(home, ".codex/plugins/cache");
+  if (!existsSync27(cacheRoot)) return [];
+  const candidates = [];
+  for (const marketplace of readdirSync11(cacheRoot)) {
+    const pluginRoot = resolve21(cacheRoot, marketplace, pluginName);
+    if (!existsSync27(pluginRoot)) continue;
+    for (const versionDir of readdirSync11(pluginRoot)) {
+      const candidatePath = resolve21(pluginRoot, versionDir);
+      try {
+        const stats = statSync5(candidatePath);
+        if (!stats.isDirectory()) continue;
+        candidates.push({
+          path: candidatePath,
+          version: readInstalledManifestVersion(candidatePath, "codex") ?? versionDir,
+          mtimeMs: stats.mtimeMs
+        });
+      } catch {
+      }
+    }
+  }
+  return candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+function detectCodexCacheStaleness(pluginName, builtVersion) {
+  if (!builtVersion) return void 0;
+  const candidates = findCodexCacheCandidates(pluginName);
+  if (candidates.length === 0) return void 0;
+  if (candidates.some((candidate) => candidate.version === builtVersion)) return void 0;
+  const newest = candidates[0];
+  return `Codex active cache appears stale at ${newest.path}; cached version ${newest.version ?? "unknown"} does not match built version ${builtVersion}. Use Plugins > Refresh if available, or restart/reinstall Codex to load the current plugin bundle.`;
+}
+function detectStaleInstall(target, pluginName, consumerPath) {
+  try {
+    const details = lstatSync4(consumerPath);
+    if (details.isSymbolicLink()) {
+      const installedRealPath = realpathSync(consumerPath);
+      const builtRealPath = realpathSync(target.sourceDir);
+      if (installedRealPath !== builtRealPath) {
+        return `installed symlink points to ${readlinkSync(consumerPath)}, not the current build at ${target.sourceDir}`;
+      }
+    }
+  } catch {
+    return void 0;
+  }
+  const builtVersion = readInstalledManifestVersion(target.sourceDir, target.platform);
+  const installedVersion = readInstalledManifestVersion(consumerPath, target.platform);
+  if (builtVersion && installedVersion && builtVersion !== installedVersion) {
+    return `installed version ${installedVersion} does not match built version ${builtVersion}`;
+  }
+  if (target.platform === "codex") {
+    return detectCodexCacheStaleness(pluginName, builtVersion);
+  }
+  return void 0;
+}
 async function verifyInstall(config, options = {}) {
   const rootDir = options.rootDir ?? process.cwd();
   const distDir = resolve21(rootDir, config.outDir);
@@ -20314,12 +21050,39 @@ function printVerifyInstallResult(result) {
     console.log(`${prefix} ${check.platform}: ${check.consumerPath}`);
     console.log(`  install path: ${check.installPath}`);
     console.log(`  built: ${check.built ? "yes" : "no"}; installed: ${check.installed ? "yes" : "no"}; errors: ${check.errors}; warnings: ${check.warnings}; infos: ${check.infos}`);
+    if (check.stale) {
+      console.log(`  stale install: ${check.staleReason}`);
+    }
+    if (!check.ok) {
+      for (const action of getVerifyInstallRecoveryActions(check)) {
+        console.log(`  fix: ${action}`);
+      }
+    }
   }
   console.log(result.ok ? "pluxx verify-install passed." : "pluxx verify-install failed.");
 }
+function getVerifyInstallRecoveryActions(check) {
+  const actions = [];
+  if (!check.built) {
+    actions.push(`run pluxx build --target ${check.platform}`);
+  }
+  if (check.built && !check.installed) {
+    actions.push(`run pluxx install --target ${check.platform}${check.platform === "claude-code" ? " and accept/trust any hook prompt if expected" : ""}`);
+  }
+  if (check.stale) {
+    actions.push(`rerun pluxx install --target ${check.platform} to replace the stale local install`);
+    if (check.platform === "codex") {
+      actions.push("in Codex, use Plugins > Refresh if available, or restart Codex so the plugin cache reloads");
+    }
+  }
+  if (check.errors > 0 && actions.length === 0) {
+    actions.push(`run pluxx doctor --consumer "${check.consumerPath}" for the detailed host-specific failure`);
+  }
+  return actions;
+}
 
 // src/cli/behavioral.ts
-import { existsSync as existsSync27, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync16 } from "fs";
 import { mkdtemp as mkdtemp2, rm as rm3 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
 import { resolve as resolve22 } from "path";
@@ -20356,12 +21119,12 @@ function loadBehavioralCases(rootDir, targets, promptOverride) {
     }];
   }
   const filePath = resolve22(rootDir, BEHAVIORAL_CONFIG_PATH);
-  if (!existsSync27(filePath)) {
+  if (!existsSync28(filePath)) {
     throw new Error(
       `No behavioral smoke config found at ${BEHAVIORAL_CONFIG_PATH}. Add that file or pass --behavioral-prompt to define a real example query.`
     );
   }
-  const parsed = JSON.parse(readFileSync15(filePath, "utf-8"));
+  const parsed = JSON.parse(readFileSync16(filePath, "utf-8"));
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.cases) || parsed.cases.length === 0) {
     throw new Error(`${BEHAVIORAL_CONFIG_PATH} must contain a non-empty "cases" array.`);
   }
@@ -20471,7 +21234,7 @@ async function executeBehavioralCommand(platform, command2, cwd) {
       child.on("close", (code) => {
         const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
         const stderr = Buffer.concat(stderrChunks).toString("utf-8");
-        const codexMessage = codexLastMessagePath && existsSync27(codexLastMessagePath) ? readFileSync15(codexLastMessagePath, "utf-8") : "";
+        const codexMessage = codexLastMessagePath && existsSync28(codexLastMessagePath) ? readFileSync16(codexLastMessagePath, "utf-8") : "";
         resolvePromise({
           exitCode: code ?? 1,
           response: codexMessage.trim() || stdout.trim() || stderr.trim()
@@ -20533,6 +21296,396 @@ function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
+// src/cli/discover-installed-mcp.ts
+import { existsSync as existsSync29, readFileSync as readFileSync17 } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve23 } from "path";
+var INSTALLED_MCP_HOSTS = ["claude-code", "cursor", "codex", "opencode"];
+function discoverInstalledMcpServers(options = {}) {
+  const rootDir = options.rootDir ?? process.cwd();
+  const homeDir = options.homeDir ?? homedir2();
+  const hostSet = new Set(options.hosts ?? INSTALLED_MCP_HOSTS);
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of installedMcpFileCandidates(rootDir, homeDir)) {
+    if (!hostSet.has(candidate.host) || !existsSync29(candidate.path)) continue;
+    const parsed = candidate.parser === "json" ? parseJsonMcpFile(candidate.path, candidate.host) : parseCodexTomlMcpFile(candidate.path);
+    for (const discovered of parsed) {
+      const key = `${discovered.host}:${discovered.serverName}:${discovered.sourcePath}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      results.push(discovered);
+    }
+  }
+  return results.sort((a, b) => {
+    const hostOrder = INSTALLED_MCP_HOSTS.indexOf(a.host) - INSTALLED_MCP_HOSTS.indexOf(b.host);
+    if (hostOrder !== 0) return hostOrder;
+    return a.serverName.localeCompare(b.serverName);
+  });
+}
+function resolveInstalledMcpSelector(selector, candidates) {
+  const trimmed = selector.trim();
+  if (!trimmed) {
+    throw new Error("Provide an installed MCP selector such as `exa` or `codex:exa`.");
+  }
+  const exactId = candidates.filter((candidate) => candidate.id === trimmed);
+  if (exactId.length === 1) return exactId[0];
+  const hostMatch = trimmed.match(/^([^:]+):(.+)$/);
+  if (hostMatch) {
+    const host = normalizeInstalledMcpHost(hostMatch[1]);
+    const serverName = hostMatch[2];
+    const matches = candidates.filter((candidate) => candidate.host === host && candidate.serverName === serverName);
+    if (matches.length === 1) return matches[0];
+    if (matches.length > 1) {
+      throw new Error(`Installed MCP selector "${trimmed}" matched multiple config files. Use one of: ${matches.map((match) => match.id).join(", ")}`);
+    }
+  }
+  const nameMatches = candidates.filter((candidate) => candidate.serverName === trimmed);
+  if (nameMatches.length === 1) return nameMatches[0];
+  if (nameMatches.length > 1) {
+    throw new Error(`Installed MCP selector "${trimmed}" is ambiguous. Use one of: ${nameMatches.map((match) => match.id).join(", ")}`);
+  }
+  const available = candidates.map((candidate) => candidate.id).join(", ") || "none";
+  throw new Error(`No installed MCP named "${trimmed}" was found. Available installed MCPs: ${available}`);
+}
+function normalizeInstalledMcpHost(value) {
+  const normalized = value.trim().toLowerCase();
+  const aliases = {
+    claude: "claude-code",
+    "claude-code": "claude-code",
+    cursor: "cursor",
+    codex: "codex",
+    open: "opencode",
+    opencode: "opencode"
+  };
+  const host = aliases[normalized];
+  if (!host) {
+    throw new Error(`Installed MCP host must be one of: ${INSTALLED_MCP_HOSTS.join(", ")}`);
+  }
+  return host;
+}
+function formatInstalledMcpSource(discovered) {
+  const transport = discovered.server.transport;
+  const endpoint = transport === "stdio" ? [discovered.server.command, ...discovered.server.args ?? []].join(" ") : discovered.server.url;
+  return `${discovered.id} (${transport}: ${endpoint})`;
+}
+function installedMcpFileCandidates(rootDir, homeDir) {
+  return [
+    { host: "claude-code", path: resolve23(rootDir, ".mcp.json"), parser: "json" },
+    { host: "claude-code", path: resolve23(rootDir, ".claude-plugin/plugin.json"), parser: "json" },
+    { host: "claude-code", path: resolve23(rootDir, ".claude/settings.json"), parser: "json" },
+    { host: "claude-code", path: resolve23(rootDir, ".claude/settings.local.json"), parser: "json" },
+    { host: "claude-code", path: resolve23(homeDir, ".claude/settings.json"), parser: "json" },
+    { host: "claude-code", path: resolve23(homeDir, ".claude/settings.local.json"), parser: "json" },
+    { host: "claude-code", path: resolve23(homeDir, ".claude.json"), parser: "json" },
+    { host: "cursor", path: resolve23(rootDir, "mcp.json"), parser: "json" },
+    { host: "cursor", path: resolve23(rootDir, ".cursor/mcp.json"), parser: "json" },
+    { host: "cursor", path: resolve23(homeDir, ".cursor/mcp.json"), parser: "json" },
+    { host: "codex", path: resolve23(rootDir, ".mcp.json"), parser: "json" },
+    { host: "codex", path: resolve23(rootDir, ".codex/config.toml"), parser: "toml" },
+    { host: "codex", path: resolve23(homeDir, ".codex/config.toml"), parser: "toml" },
+    { host: "opencode", path: resolve23(rootDir, "opencode.json"), parser: "json" },
+    { host: "opencode", path: resolve23(rootDir, ".opencode.json"), parser: "json" },
+    { host: "opencode", path: resolve23(homeDir, ".config/opencode/opencode.json"), parser: "json" }
+  ];
+}
+function parseJsonMcpFile(path, host) {
+  try {
+    const raw = JSON.parse(readFileSync17(path, "utf-8"));
+    const servers = extractJsonMcpServers(raw, path, host);
+    return Object.entries(servers).flatMap(([serverName, config]) => {
+      const normalized = normalizeCommonMcpServer(config, host);
+      if (!normalized) return [];
+      return [toDiscovered(host, serverName, path, normalized.server, normalized.warnings)];
+    });
+  } catch {
+    return [];
+  }
+}
+function extractJsonMcpServers(raw, path, host) {
+  if (host === "opencode" && raw.mcp && typeof raw.mcp === "object") {
+    return raw.mcp;
+  }
+  if (raw.mcpServers && typeof raw.mcpServers === "object") {
+    return raw.mcpServers;
+  }
+  if (host === "claude-code" && raw.projects && typeof raw.projects === "object") {
+    const projectServers = {};
+    for (const projectConfig of Object.values(raw.projects)) {
+      if (!projectConfig || typeof projectConfig !== "object") continue;
+      const mcpServers = projectConfig.mcpServers;
+      if (!mcpServers || typeof mcpServers !== "object") continue;
+      Object.assign(projectServers, mcpServers);
+    }
+    return projectServers;
+  }
+  if (typeof raw.mcpServers === "string") return {};
+  if (path.endsWith("mcp.json") || path.endsWith(".mcp.json")) {
+    return raw;
+  }
+  return {};
+}
+function parseCodexTomlMcpFile(path) {
+  const text = readFileSync17(path, "utf-8");
+  const servers = {};
+  let currentServer;
+  let currentSubtable;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = stripTomlComment(rawLine).trim();
+    if (!line) continue;
+    const section = line.match(/^\[mcp_servers\.([A-Za-z0-9_.-]+)(?:\.([A-Za-z0-9_.-]+))?\]$/);
+    if (section) {
+      currentServer = section[1];
+      currentSubtable = section[2];
+      servers[currentServer] ??= {};
+      if (currentSubtable) {
+        const existing = servers[currentServer][currentSubtable];
+        if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+          servers[currentServer][currentSubtable] = {};
+        }
+      }
+      continue;
+    }
+    if (!currentServer) continue;
+    const assignment = line.match(/^([A-Za-z0-9_-]+)\s*=\s*(.+)$/);
+    if (!assignment) continue;
+    const key = assignment[1];
+    const value = parseTomlValue(assignment[2].trim());
+    if (currentSubtable) {
+      const table = servers[currentServer][currentSubtable];
+      table[key] = value;
+    } else {
+      servers[currentServer][key] = value;
+    }
+  }
+  return Object.entries(servers).flatMap(([serverName, config]) => {
+    const normalized = normalizeCommonMcpServer(config, "codex");
+    if (!normalized) return [];
+    return [toDiscovered("codex", serverName, path, normalized.server, normalized.warnings)];
+  });
+}
+function normalizeCommonMcpServer(config, host) {
+  if (!config || typeof config !== "object") return null;
+  const cfg = config;
+  const warnings = [];
+  const auth = inferAuth(cfg, warnings);
+  const remoteUrl = firstString(cfg.url, cfg.endpoint);
+  if (remoteUrl) {
+    const server = cfg.type === "sse" || cfg.transport === "sse" ? {
+      transport: "sse",
+      url: remoteUrl,
+      ...auth ? { auth } : {}
+    } : {
+      transport: "http",
+      url: remoteUrl,
+      ...auth ? { auth } : {}
+    };
+    return { server, warnings };
+  }
+  const command2 = normalizeCommand(cfg.command, host);
+  if (!command2) return null;
+  const args2 = normalizeArgs(cfg.command, cfg.args, host);
+  const env = normalizeEnv(cfg.env, warnings);
+  return {
+    server: {
+      transport: "stdio",
+      command: command2,
+      ...args2.length > 0 ? { args: args2 } : {},
+      ...Object.keys(env).length > 0 ? { env } : {},
+      ...auth ? { auth } : {}
+    },
+    warnings
+  };
+}
+function normalizeCommand(value, host) {
+  if (typeof value === "string") return value;
+  if (host === "opencode" && Array.isArray(value) && typeof value[0] === "string") {
+    return value[0];
+  }
+  return void 0;
+}
+function normalizeArgs(command2, args2, host) {
+  if (host === "opencode" && Array.isArray(command2)) {
+    return command2.slice(1).map(String);
+  }
+  return normalizeStringArray(args2);
+}
+function normalizeStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map(String);
+}
+function normalizeEnv(value, warnings) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const env = {};
+  for (const [key, rawValue] of Object.entries(value)) {
+    if (typeof rawValue !== "string") continue;
+    const placeholder = envPlaceholder(rawValue);
+    if (placeholder) {
+      env[key] = placeholder;
+      continue;
+    }
+    if (looksSecretKey(key)) {
+      env[key] = `\${${key}}`;
+      warnings.push(`Literal secret-like env value for ${key} was replaced with \${${key}}.`);
+      continue;
+    }
+    env[key] = rawValue;
+  }
+  return env;
+}
+function inferAuth(cfg, warnings) {
+  const bearerTokenEnv = firstString(cfg.bearer_token_env_var, cfg.bearerTokenEnvVar);
+  if (bearerTokenEnv) {
+    return {
+      type: "bearer",
+      envVar: bearerTokenEnv,
+      headerName: "Authorization",
+      headerTemplate: "Bearer ${value}"
+    };
+  }
+  const envHttpHeaders = cfg.env_http_headers ?? cfg.envHttpHeaders;
+  if (envHttpHeaders && typeof envHttpHeaders === "object" && !Array.isArray(envHttpHeaders)) {
+    const [headerName, envVar] = Object.entries(envHttpHeaders).find(([, value]) => typeof value === "string") ?? [];
+    if (typeof headerName === "string" && typeof envVar === "string") {
+      return {
+        type: headerName.toLowerCase() === "authorization" ? "bearer" : "header",
+        envVar,
+        headerName,
+        headerTemplate: headerName.toLowerCase() === "authorization" ? "Bearer ${value}" : "${value}"
+      };
+    }
+  }
+  const headers = cfg.headers ?? cfg.http_headers ?? cfg.httpHeaders;
+  if (!headers || typeof headers !== "object" || Array.isArray(headers)) return void 0;
+  const headerEntries = Object.entries(headers);
+  for (const [headerName, rawValue] of headerEntries) {
+    if (typeof rawValue !== "string") continue;
+    const envVar = extractEnvVar(rawValue);
+    if (envVar) {
+      return {
+        type: headerName.toLowerCase() === "authorization" ? "bearer" : "header",
+        envVar,
+        headerName,
+        headerTemplate: rawValue.replace(envReferencePattern(envVar), "${value}")
+      };
+    }
+    if (looksSecretValue(rawValue)) {
+      warnings.push(`Literal ${headerName} header value was not copied. Re-run init with --auth-env if this server needs auth.`);
+    }
+  }
+  return void 0;
+}
+function toDiscovered(host, serverName, sourcePath, server, warnings) {
+  return {
+    id: `${host}:${serverName}`,
+    host,
+    serverName,
+    sourcePath,
+    server,
+    warnings
+  };
+}
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return void 0;
+}
+function envPlaceholder(value) {
+  const envVar = extractEnvVar(value);
+  return envVar ? `\${${envVar}}` : void 0;
+}
+function extractEnvVar(value) {
+  const match = value.match(/\$\{(?:env:)?([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/);
+  return match?.[1] ?? match?.[2];
+}
+function envReferencePattern(envVar) {
+  return new RegExp(`\\$\\{(?:env:)?${escapeRegExp2(envVar)}\\}|\\$${escapeRegExp2(envVar)}`);
+}
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function looksSecretKey(value) {
+  return /(api|auth|secret|token|key|password|credential)/i.test(value);
+}
+function looksSecretValue(value) {
+  return value.length >= 16 && !extractEnvVar(value);
+}
+function stripTomlComment(line) {
+  let inString = false;
+  let quote2 = "";
+  for (let i = 0; i < line.length; i += 1) {
+    const char = line[i];
+    if ((char === '"' || char === "'") && line[i - 1] !== "\\") {
+      if (!inString) {
+        inString = true;
+        quote2 = char;
+      } else if (quote2 === char) {
+        inString = false;
+        quote2 = "";
+      }
+      continue;
+    }
+    if (char === "#" && !inString) return line.slice(0, i);
+  }
+  return line;
+}
+function parseTomlValue(value) {
+  if (value.startsWith('"') && value.endsWith('"')) return unquoteTomlString(value);
+  if (value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+  if (value.startsWith("[") && value.endsWith("]")) {
+    const inner = value.slice(1, -1).trim();
+    if (!inner) return [];
+    return splitTomlList(inner).map((part) => parseTomlValue(part.trim()));
+  }
+  if (value.startsWith("{") && value.endsWith("}")) {
+    const inner = value.slice(1, -1).trim();
+    const result = {};
+    if (!inner) return result;
+    for (const part of splitTomlList(inner)) {
+      const assignment = part.match(/^([A-Za-z0-9_-]+)\s*=\s*(.+)$/);
+      if (!assignment) continue;
+      result[assignment[1]] = parseTomlValue(assignment[2].trim());
+    }
+    return result;
+  }
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return value;
+}
+function splitTomlList(value) {
+  const parts = [];
+  let current = "";
+  let inString = false;
+  let quote2 = "";
+  let braceDepth = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    const char = value[i];
+    if ((char === '"' || char === "'") && value[i - 1] !== "\\") {
+      if (!inString) {
+        inString = true;
+        quote2 = char;
+      } else if (quote2 === char) {
+        inString = false;
+        quote2 = "";
+      }
+    }
+    if (!inString && char === "{") braceDepth += 1;
+    if (!inString && char === "}") braceDepth -= 1;
+    if (!inString && braceDepth === 0 && char === ",") {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (current.trim()) parts.push(current);
+  return parts;
+}
+function unquoteTomlString(value) {
+  return value.slice(1, -1).replace(/\\"/g, '"').replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\\\/g, "\\");
+}
+
 // src/cli/index.ts
 var CLI_PACKAGE_NAME = "@orchid-labs/pluxx";
 var rawArgs = process.argv.slice(2);
@@ -20583,6 +21736,9 @@ async function main() {
     case "mcp":
       await runMcp();
       break;
+    case "discover-mcp":
+      await runDiscoverMcp();
+      break;
     case "autopilot":
       await runAutopilot();
       break;
@@ -20596,6 +21752,10 @@ async function main() {
       await runVerifyInstall();
       break;
     case "publish":
+      if (isHelpRequested(args.slice(1))) {
+        printPublishHelp();
+        break;
+      }
       await runPublishCommand();
       break;
     case "uninstall":
@@ -20634,9 +21794,12 @@ function normalizeTopLevelArgs(input) {
   }
   return input;
 }
+function isHelpRequested(input) {
+  return input.includes("--help") || input.includes("-h");
+}
 function getCliPackageVersion() {
   const packageJsonPath = new URL("../../package.json", import.meta.url);
-  const raw = JSON.parse(readFileSync16(packageJsonPath, "utf-8"));
+  const raw = JSON.parse(readFileSync18(packageJsonPath, "utf-8"));
   if (typeof raw.version !== "string" || raw.version.trim() === "") {
     throw new Error("Unable to determine the installed pluxx version from package.json.");
   }
@@ -20748,20 +21911,21 @@ function planAutopilotPasses(input) {
   };
 }
 function countAutopilotSteps(input) {
-  return 2 + Number(input.taxonomy.enabled) + Number(input.instructions.enabled) + Number(input.review.enabled) + Number(input.verify);
+  return 2 + Number(input.taxonomy.enabled) + Number(input.instructions.enabled) + Number(input.review.enabled) + Number(input.verify) + Number(input.install) + Number(input.behavioral);
 }
 function formatAutopilotPassLine(label, decision) {
   return `${label}: ${decision.enabled ? "run" : "skip"} (${decision.reason})`;
 }
 function summarizeAutopilotWorkload(input) {
   const agentPassCount = Number(input.taxonomy.enabled) + Number(input.instructions.enabled) + Number(input.review.enabled);
+  const suffix = `${input.verify ? " + verification" : ""}${input.install ? " + install" : ""}${input.behavioral ? " + behavioral smoke" : ""}`;
   if (agentPassCount === 0 && !input.verify) {
-    return "deterministic scaffold only";
+    return `deterministic scaffold${input.install ? " + install" : ""}${input.behavioral ? " + behavioral smoke" : ""}`;
   }
   if (agentPassCount === 0) {
-    return "deterministic scaffold + verification";
+    return `deterministic scaffold${suffix}`;
   }
-  return `${agentPassCount} agent pass${agentPassCount === 1 ? "" : "es"}${input.verify ? " + verification" : ""}`;
+  return `${agentPassCount} agent pass${agentPassCount === 1 ? "" : "es"}${suffix}`;
 }
 function formatDuration(durationMs) {
   if (durationMs === void 0) {
@@ -21004,6 +22168,16 @@ function parseTargetFlagValues(rawArgs2) {
   if (!values) return void 0;
   return parseTargetPlatforms(values.join(","));
 }
+function parseInstallTargetFlag(rawArgs2, targets) {
+  const raw = readOption2(rawArgs2, "--install-target");
+  if (!raw) return [targets[0]];
+  const installTargets = parseTargetPlatforms(raw);
+  const unsupported = installTargets.filter((target) => !targets.includes(target));
+  if (unsupported.length > 0) {
+    throw new Error(`--install-target must be one of the configured autopilot targets: ${targets.join(", ")}`);
+  }
+  return installTargets;
+}
 function defaultHookMode(source) {
   if (source.auth?.type && source.auth.type !== "none" && source.auth.envVar) {
     return "safe";
@@ -21296,7 +22470,7 @@ async function planInitContextArtifactFiles(rootDir, contextPack) {
   return plannedFiles;
 }
 async function planAuxiliaryFile(rootDir, relativePath, content) {
-  const filePath = resolve23(rootDir, relativePath);
+  const filePath = resolve24(rootDir, relativePath);
   const action = await planTextFileAction(filePath, content);
   return {
     relativePath,
@@ -21326,6 +22500,7 @@ function formatMcpDiscoverySummary(introspection) {
 function parseInitFromMcpOptions(rawArgs2, initialName, initialSource) {
   return {
     source: initialSource ?? readOption2(rawArgs2, "--from-mcp"),
+    installedMcp: readOption2(rawArgs2, "--from-installed-mcp"),
     assumeDefaults: rawArgs2.includes("--yes"),
     name: readOption2(rawArgs2, "--name") ?? initialName,
     author: readOption2(rawArgs2, "--author"),
@@ -21354,11 +22529,49 @@ function toKebabCase3(value) {
 function toTsString(value) {
   return JSON.stringify(value);
 }
+function parseInstalledMcpHosts(rawArgs2) {
+  const hostValues = readMultiValueOption(rawArgs2, "--host") ?? readMultiValueOption(rawArgs2, "--hosts");
+  if (!hostValues) return void 0;
+  return hostValues.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean).map(normalizeInstalledMcpHost);
+}
+function resolveInstalledMcpForInit(selector, hosts) {
+  const discovered = discoverInstalledMcpServers({ hosts });
+  return resolveInstalledMcpSelector(selector, discovered);
+}
+async function runDiscoverMcp() {
+  const hosts = parseInstalledMcpHosts(args);
+  const discovered = discoverInstalledMcpServers({ hosts });
+  if (runtime.jsonOutput) {
+    printJson({
+      count: discovered.length,
+      servers: discovered
+    });
+    return;
+  }
+  if (discovered.length === 0) {
+    console.log("No installed MCP servers found.");
+    console.log(`Searched hosts: ${(hosts ?? INSTALLED_MCP_HOSTS).join(", ")}`);
+    return;
+  }
+  console.log("Installed MCP servers:");
+  for (const server of discovered) {
+    console.log(`  ${server.id}`);
+    console.log(`    source: ${server.sourcePath}`);
+    console.log(`    server: ${formatInstalledMcpSource(server)}`);
+    for (const warning of server.warnings) {
+      console.log(`    warning: ${warning}`);
+    }
+  }
+  console.log("");
+  console.log("Import one:");
+  console.log(`  pluxx init --from-installed-mcp ${discovered[0].id} --yes`);
+}
 async function runInit() {
   const positionalName = args[1] && !args[1].startsWith("-") ? args[1] : void 0;
   const fromMcpFlag = args.indexOf("--from-mcp");
+  const fromInstalledMcpFlag = args.indexOf("--from-installed-mcp");
   const fromMcpInput = fromMcpFlag !== -1 && args[fromMcpFlag + 1] && !args[fromMcpFlag + 1].startsWith("-") ? args[fromMcpFlag + 1] : void 0;
-  if (fromMcpFlag !== -1) {
+  if (fromMcpFlag !== -1 || fromInstalledMcpFlag !== -1) {
     await runInitFromMcp(positionalName, fromMcpInput);
     return;
   }
@@ -21442,7 +22655,7 @@ ${mcpBlock}${brandBlock}
   targets: [${targetsList}],
 })
 `;
-    await writeTextFile(resolve23(process.cwd(), "pluxx.config.ts"), template);
+    await writeTextFile(resolve24(process.cwd(), "pluxx.config.ts"), template);
     const skillDir = `skills/${skillName}`;
     await mkdir4(skillDir, { recursive: true });
     const skillContent = `---
@@ -21464,7 +22677,7 @@ Describe how agents should use this skill.
 Example prompt or command here
 \`\`\`
 `;
-    await writeTextFile(resolve23(process.cwd(), `${skillDir}/SKILL.md`), skillContent);
+    await writeTextFile(resolve24(process.cwd(), `${skillDir}/SKILL.md`), skillContent);
     console.log("");
     console.log("  Created:");
     console.log("    pluxx.config.ts");
@@ -21493,14 +22706,15 @@ async function runInitFromMcp(initialName, initialSource) {
   const contextPaths = options.contextPaths ?? [];
   const ingestProvider = options.ingestProvider ? parseChoiceOption(options.ingestProvider, AGENT_INGEST_PROVIDERS, "Ingestion provider") : void 0;
   if (!options.jsonOutput && !runtime.quiet) {
-    mt("pluxx init --from-mcp");
+    mt(options.installedMcp ? "pluxx init --from-installed-mcp" : "pluxx init --from-mcp");
   }
   try {
-    const rawSource = options.source ?? (interactive ? await clackText("MCP server URL or local command") : "");
+    const installedMcpSource = options.installedMcp ? resolveInstalledMcpForInit(options.installedMcp, parseInstalledMcpHosts(args)) : void 0;
+    const rawSource = installedMcpSource ? formatInstalledMcpSource(installedMcpSource) : options.source ?? (interactive ? await clackText("MCP server URL or local command") : "");
     if (!rawSource) {
-      throw new Error("Provide an MCP server URL or local command. Example: pluxx init --from-mcp https://example.com/mcp");
+      throw new Error("Provide an MCP server URL/local command or an installed MCP selector. Example: pluxx init --from-mcp https://example.com/mcp");
     }
-    let source = parseMcpSourceInput(rawSource, options.transport);
+    let source = installedMcpSource?.server ?? parseMcpSourceInput(rawSource, options.transport);
     let introspectionSource = source;
     const configuredRemoteAuth = source.transport === "stdio" ? void 0 : buildRemoteAuthConfig(options);
     if (configuredRemoteAuth && !source.auth) {
@@ -21653,7 +22867,7 @@ ${formatAuthRequiredMessage("init", retryError, source)}`);
     if (!options.jsonOutput && !runtime.quiet) {
       O2.step("Step 2/4 \xB7 Plugin identity");
     }
-    const defaultPluginName = options.name ? toKebabCase3(options.name) : derivePluginName(introspection, source);
+    const defaultPluginName = options.name ? toKebabCase3(options.name) : installedMcpSource?.serverName ? toKebabCase3(installedMcpSource.serverName) : derivePluginName(introspection, source);
     const pluginName = toKebabCase3(
       options.name ?? (interactive ? await clackText("Plugin name", defaultPluginName) : defaultPluginName)
     );
@@ -21687,6 +22901,7 @@ ${formatAuthRequiredMessage("init", retryError, source)}`);
       source,
       runtimeAuthMode,
       introspection,
+      serverName: installedMcpSource?.serverName,
       displayName,
       description: sourcedContextPack?.docsContext?.shortDescription,
       websiteUrl,
@@ -21708,7 +22923,7 @@ ${formatAuthRequiredMessage("init", retryError, source)}`);
     if (!runtime.dryRun) {
       await applyMcpScaffoldPlan(process.cwd(), plan);
       for (const file of contextArtifactFiles) {
-        await writeTextFile(resolve23(process.cwd(), file.relativePath), file.content);
+        await writeTextFile(resolve24(process.cwd(), file.relativePath), file.content);
       }
     }
     const lintResult = runtime.dryRun ? { errors: 0, warnings: 0, issues: [] } : await lintProject(process.cwd());
@@ -21778,6 +22993,11 @@ ${formatAuthRequiredMessage("init", retryError, source)}`);
         O2.info(n);
       }
     }
+    if (installedMcpSource && installedMcpSource.warnings.length > 0) {
+      for (const warning of installedMcpSource.warnings) {
+        O2.warn(`Installed MCP import: ${warning}`);
+      }
+    }
     if (summary.quality.issues.length > 0) {
       for (const line of formatMcpQualityLines(summary.quality)) {
         O2.info(line);
@@ -21871,7 +23091,7 @@ async function runSync() {
 async function runDoctor() {
   const consumerMode = readFlag(args, "--consumer");
   const doctorPath = args.slice(1).find((value) => !value.startsWith("-"));
-  const rootDir = doctorPath ? resolve23(process.cwd(), doctorPath) : process.cwd();
+  const rootDir = doctorPath ? resolve24(process.cwd(), doctorPath) : process.cwd();
   const report = consumerMode ? await doctorConsumer(rootDir) : await doctorProject(rootDir);
   if (runtime.jsonOutput) {
     printJson(report);
@@ -22056,6 +23276,9 @@ async function runAutopilot() {
   const attach = readOption2(args, "--attach");
   const reviewRequested = args.includes("--review");
   const verify = !args.includes("--no-verify");
+  const installRequested = args.includes("--install");
+  const behavioralRequested = args.includes("--behavioral");
+  const behavioralPrompt = readOption2(args, "--behavioral-prompt");
   const verboseRunner = args.includes("--verbose-runner");
   const interactive = !runtime.jsonOutput && runtime.isInteractive && !initOptions.assumeDefaults;
   let authEnv = initOptions.authEnv;
@@ -22064,17 +23287,23 @@ async function runAutopilot() {
   let authTemplate = initOptions.authTemplate;
   let runtimeAuthMode = resolveRuntimeAuthMode(initOptions.runtimeAuth);
   if (!initOptions.source && !interactive) {
-    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join("|")}> [--mode <${AUTOPILOT_MODES.join("|")}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--approve-mcp-tools] [--auth-env ENV] [--auth-type bearer|header|platform] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--oauth-wrapper] [--website URL] [--docs URL] [--ingest-provider <${AGENT_INGEST_PROVIDERS.join("|")}>] [--context <files...>] [--review] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`);
+    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join("|")}> [--mode <${AUTOPILOT_MODES.join("|")}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--approve-mcp-tools] [--auth-env ENV] [--auth-type bearer|header|platform] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--oauth-wrapper] [--website URL] [--docs URL] [--ingest-provider <${AGENT_INGEST_PROVIDERS.join("|")}>] [--context <files...>] [--review] [--install] [--install-target <platform>] [--trust] [--behavioral] [--behavioral-prompt TEXT] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`);
     process.exit(1);
   }
   if ((!runnerRaw || !AGENT_RUNNERS.includes(runnerRaw)) && !interactive) {
-    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join("|")}> [--mode <${AUTOPILOT_MODES.join("|")}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--approve-mcp-tools] [--auth-env ENV] [--auth-type bearer|header|platform] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--oauth-wrapper] [--website URL] [--docs URL] [--ingest-provider <${AGENT_INGEST_PROVIDERS.join("|")}>] [--context <files...>] [--review] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`);
+    console.error(`Usage: pluxx autopilot --from-mcp <source> --runner <${AGENT_RUNNERS.join("|")}> [--mode <${AUTOPILOT_MODES.join("|")}>] [--name NAME] [--display-name NAME] [--author NAME] [--targets <platforms>] [--grouping workflow|tool] [--hooks none|safe] [--approve-mcp-tools] [--auth-env ENV] [--auth-type bearer|header|platform] [--auth-header NAME] [--auth-template TEMPLATE] [--runtime-auth inline|platform] [--oauth-wrapper] [--website URL] [--docs URL] [--ingest-provider <${AGENT_INGEST_PROVIDERS.join("|")}>] [--context <files...>] [--review] [--install] [--install-target <platform>] [--trust] [--behavioral] [--behavioral-prompt TEXT] [--no-verify] [--verbose-runner] [--json] [--dry-run] [--quiet]`);
     process.exit(1);
   }
   if (modeRaw && !AUTOPILOT_MODES.includes(modeRaw)) {
     console.error(`Autopilot mode must be one of: ${AUTOPILOT_MODES.join(", ")}`);
     process.exit(1);
   }
+  if (installRequested && !verify) {
+    throw new Error("--install requires verification so autopilot can build outputs before installing. Remove --no-verify or omit --install.");
+  }
+  if (behavioralRequested && !installRequested) {
+    throw new Error("--behavioral requires --install so the selected host CLI can see the installed plugin bundle.");
+  }
   let tempDir;
   try {
     if (!runtime.jsonOutput && !runtime.quiet && interactive) {
@@ -22242,6 +23471,7 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
     const authorName = initOptions.author ?? (interactive ? await clackText("Author name", defaultAuthorName) : defaultAuthorName);
     const targetsRaw = initOptions.targets ?? (interactive ? await clackText("Platforms (comma-separated)", DEFAULT_INIT_TARGETS.join(",")) : DEFAULT_INIT_TARGETS.join(","));
     const targets = parseTargetPlatforms(targetsRaw);
+    const installTargets = installRequested ? parseInstallTargetFlag(args, targets) : [];
     const grouping = initOptions.grouping ? parseChoiceOption(initOptions.grouping, MCP_SKILL_GROUPINGS, "Skill grouping") : interactive ? await clackSelect("Skill grouping", [
       { value: "workflow", label: "workflow", hint: "Group related tools into workflow skills" },
       { value: "tool", label: "tool", hint: "One skill per tool" }
@@ -22271,7 +23501,9 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
       taxonomy: passDecisions.taxonomy,
       instructions: passDecisions.instructions,
       review: passDecisions.review,
-      verify
+      verify,
+      install: installRequested,
+      behavioral: behavioralRequested
     });
     const workspaceRoot = runtime.dryRun ? await mkdtemp3(`${tmpdir5()}/pluxx-autopilot-`) : process.cwd();
     tempDir = runtime.dryRun ? workspaceRoot : void 0;
@@ -22357,6 +23589,12 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
         quality,
         review: passDecisions.review.enabled,
         verify,
+        install: installRequested ? {
+          enabled: true,
+          platforms: installTargets,
+          notes: getInstallFollowupNotes(installTargets),
+          installTargets: []
+        } : void 0,
         steps: totalSteps,
         init: {
           createdFiles: initCreatedFiles,
@@ -22404,7 +23642,9 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
           taxonomy: passDecisions.taxonomy,
           instructions: passDecisions.instructions,
           review: passDecisions.review,
-          verify
+          verify,
+          install: installRequested,
+          behavioral: behavioralRequested
         })}`);
         console.log(`  Quality: ${quality.warnings} warning(s), ${quality.infos} info message(s)`);
         console.log(`  Scaffold create/update: ${[...initCreatedFiles, ...initUpdatedFiles].join(", ") || "none"}`);
@@ -22425,6 +23665,9 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
         } else {
           console.log("  Verification: skipped (--no-verify)");
         }
+        if (installRequested) {
+          console.log(`  Install: ${installTargets.join(", ")} after verification`);
+        }
       }
       return;
     }
@@ -22504,9 +23747,13 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
       });
       return result;
     })() : void 0;
-    const ok = (taxonomyResult?.ok ?? true) && (instructionsResult?.ok ?? true) && (reviewResult?.ok ?? true) && (verification?.ok ?? true);
-    const failureStage = taxonomyResult && taxonomyResult.runnerExitCode !== 0 ? "runner" : instructionsResult && instructionsResult.runnerExitCode !== 0 ? "runner" : reviewResult && reviewResult.runnerExitCode !== 0 ? "runner" : verification && !verification.ok ? "verification" : void 0;
-    const failureMessage = failureStage === "runner" ? "A headless runner command failed. Re-run with --verbose-runner to stream full runner output." : failureStage === "verification" ? "Verification failed after scaffold/refinement. Run `pluxx test` for details." : void 0;
+    const preInstallOk = (taxonomyResult?.ok ?? true) && (instructionsResult?.ok ?? true) && (reviewResult?.ok ?? true) && (verification?.ok ?? true);
+    const installedConfig = installRequested && preInstallOk ? await loadConfig() : void 0;
+    const install = installedConfig ? await maybeInstallBuiltOutputs(installedConfig, installTargets, { verifyConsumers: true }) : void 0;
+    const behavioralResult = install && install.verification?.ok && behavioralRequested ? await runBehavioralSuite(process.cwd(), installedConfig, installTargets, { promptOverride: behavioralPrompt }) : void 0;
+    const ok = preInstallOk && (install?.verification?.ok ?? true) && (behavioralResult?.ok ?? true);
+    const failureStage = taxonomyResult && taxonomyResult.runnerExitCode !== 0 ? "runner" : instructionsResult && instructionsResult.runnerExitCode !== 0 ? "runner" : reviewResult && reviewResult.runnerExitCode !== 0 ? "runner" : verification && !verification.ok ? "verification" : install?.verification && !install.verification.ok ? "verification" : behavioralResult && !behavioralResult.ok ? "verification" : void 0;
+    const failureMessage = failureStage === "runner" ? "A headless runner command failed. Re-run with --verbose-runner to stream full runner output." : failureStage === "verification" ? "Verification, install, or behavioral smoke failed after scaffold/refinement. Run `pluxx test --install` for details." : void 0;
     const summary = {
       ok,
       pluginName,
@@ -22568,6 +23815,8 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
       },
       verification,
       verificationDurationMs,
+      install,
+      behavioral: behavioralResult,
       failureStage,
       failureMessage
     };
@@ -22583,7 +23832,9 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
         taxonomy: passDecisions.taxonomy,
         instructions: passDecisions.instructions,
         review: passDecisions.review,
-        verify
+        verify,
+        install: installRequested,
+        behavioral: behavioralRequested
       })}`);
       console.log(`  Quality: ${quality.warnings} warning(s), ${quality.infos} info message(s)`);
       if (!verboseRunner) {
@@ -22606,6 +23857,23 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
       } else {
         console.log("  Verification: skipped (--no-verify)");
       }
+      if (install) {
+        console.log(`  Install: ${install.verification?.ok === false ? "failed" : "passed"} for ${install.platforms.join(", ")}`);
+        for (const target of install.installTargets) {
+          console.log(`    ${target.platform}: ${target.consumerPath}`);
+        }
+        if (install.verification) {
+          console.log(`  Verify-install: ${install.verification.ok ? "passed" : "failed"}`);
+        }
+        for (const note of install.notes) {
+          console.log(`  ${note}`);
+        }
+      } else if (installRequested) {
+        console.log(`  Install: skipped because verification did not produce a passing build`);
+      }
+      if (behavioralResult) {
+        console.log(`  Behavioral: ${behavioralResult.ok ? "passed" : "failed"}`);
+      }
       if (failureStage && failureMessage) {
         console.log(`  Failure stage: ${failureStage}`);
         console.log(`  Failure detail: ${failureMessage}`);
@@ -22614,6 +23882,9 @@ ${formatAuthRequiredMessage("autopilot", retryError, source)}`);
       console.log("  1. Review INSTRUCTIONS.md and skills/");
       console.log(`  2. Run: pluxx build${mode === "quick" && !passDecisions.taxonomy.enabled && !passDecisions.instructions.enabled && !passDecisions.review.enabled ? " (agent refinement was skipped; only do this if the deterministic scaffold already looks good)" : ""}`);
       console.log(`  3. Run: pluxx install${scaffoldPlan.generatedHookMode === "safe" ? " --trust" : ""} --target ${targets[0]}`);
+      if (!installRequested) {
+        console.log(`  Or rerun onboarding: pluxx autopilot --from-mcp "${rawSource}" --runner ${runner} --mode ${mode} --install --install-target ${targets[0]}${scaffoldPlan.generatedHookMode === "safe" ? " --trust" : ""}`);
+      }
     }
     if (!ok) {
       process.exit(1);
@@ -22828,7 +24099,7 @@ async function runVerifyInstall() {
   const targets = parseTargetFlagValues(args);
   const config = await loadConfig();
   if (runtime.dryRun) {
-    const distDir = resolve23(process.cwd(), config.outDir);
+    const distDir = resolve24(process.cwd(), config.outDir);
     const plan = planInstallPlugin(distDir, config.name, targets ?? config.targets);
     const summary = {
       dryRun: true,
@@ -22915,9 +24186,10 @@ Usage:
   pluxx agent prepare                     Generate agent context + boundary files for host agents
   pluxx agent prompt <kind>               Generate a prompt pack (taxonomy, instructions, review)
   pluxx agent run <kind> --runner <id>    Execute a prompt pack via Claude, Cursor, Codex, or OpenCode headlessly
+  pluxx discover-mcp [--host <hosts...>] List installed MCP servers from local host configs
   pluxx mcp proxy ...                     Run a local MCP proxy with optional record/replay tapes
   pluxx autopilot --from-mcp ...          Run import + agent refinement + verification in one command
-  pluxx init [name] [--from-mcp <source>] Create a new pluxx.config.ts
+  pluxx init [name] [--from-mcp <source>|--from-installed-mcp <selector>] Create a new pluxx.config.ts
   pluxx sync [--from-mcp <source>]        Refresh MCP-derived scaffold files
   pluxx migrate <path>                    Import an existing plugin into pluxx
   pluxx test [--target <platforms...>] [--install] [--behavioral]    Run config, lint, eval, build, and smoke checks
@@ -22937,6 +24209,10 @@ Common flags:
   --mode quick|standard|thorough          Control how much agent refinement autopilot performs
   --approve-mcp-tools                     Preapprove all tools from the imported MCP in canonical permissions
   --ingest-provider auto|local|firecrawl  Choose the docs/website ingestion backend for agent prepare/autopilot
+  --install                               Install autopilot's verified build into one selected host
+  --install-target <platform>             Host to install after autopilot verification; defaults to the first target
+  --trust                                 Trust local hook commands during install/test flows
+  --behavioral                            Run installed headless example-query smoke checks
 
 Targets:
   claude-code, cursor, codex, opencode, github-copilot, openhands,
@@ -22952,6 +24228,9 @@ Examples:
   pluxx init my-plugin                    Scaffold a new plugin config
   pluxx init --from-mcp https://example.com/mcp  Scaffold from a remote MCP server
   pluxx init --from-mcp "npx -y -p @acme/mcp acme-mcp"  Scaffold from a local MCP command
+  pluxx discover-mcp                      List installed MCP servers in Claude, Cursor, Codex, and OpenCode config
+  pluxx discover-mcp --host codex opencode --json
+  pluxx init --from-installed-mcp codex:acme --yes  Scaffold from an already installed MCP config
   pluxx init --from-mcp https://example.com/mcp --yes --name acme --display-name "Acme" --author "Acme" --targets claude-code,codex --grouping workflow --hooks safe --json
   pluxx init --from-mcp https://example.com/mcp --yes --auth-env API_KEY --auth-type header --auth-header X-API-Key --auth-template "\${value}"
   pluxx init --from-mcp https://example.com/mcp --yes --auth-type platform --runtime-auth platform
@@ -22976,6 +24255,8 @@ Examples:
   --attach is only supported for the opencode runner
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode quick --yes
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode standard --yes --name acme --display-name "Acme"
+  pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode standard --install --install-target codex --trust
+  pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode standard --auth-env API_KEY --auth-type bearer --install --install-target codex --trust
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --yes --approve-mcp-tools
   pluxx autopilot --from-mcp https://example.com/mcp --runner codex --mode thorough --yes --verbose-runner
   pluxx autopilot --from-mcp https://mcp.linear.app/mcp --runner codex --yes --oauth-wrapper
@@ -22992,6 +24273,39 @@ Examples:
   pluxx verify-install --target codex     Verify the installed Codex bundle in its native local path
   pluxx install --dry-run                 Preview local install paths and trust implications
   pluxx install --trust                   Install without hook trust confirmation
+  pluxx publish --dry-run                 Preview npm/GitHub release publish checks
+  pluxx publish --github-release --version 1.0.0  Create release installers and a GitHub release
+  pluxx publish --npm --tag next          Publish the npm package under a non-latest dist-tag
+`);
+}
+function printPublishHelp() {
+  console.log(`
+pluxx publish \u2014 package and release a built plugin or CLI
+
+Usage:
+  pluxx publish [--npm] [--github-release] [--allow-dirty] [--dry-run] [--json] [--tag latest] [--version x.y.z]
+
+Behavior:
+  - loads the current pluxx.config.* project
+  - plans npm publish and/or GitHub release work
+  - runs clean-working-tree checks unless --allow-dirty is passed
+  - writes release assets such as install scripts and release-manifest.json when applicable
+
+Flags:
+  --npm              Publish to npm using the configured package metadata
+  --github-release   Create or update GitHub release assets for the requested version
+  --version x.y.z    Override the release version for the publish plan
+  --tag <name>       Set the npm dist-tag (default: latest)
+  --allow-dirty      Skip the clean-working-tree check
+  --dry-run          Show the publish plan without writing or uploading
+  --json             Print the publish plan or result as JSON
+  --help, -h         Show this command help
+
+Examples:
+  pluxx publish --dry-run
+  pluxx publish --github-release --version 1.0.0
+  pluxx publish --npm --version 0.1.7
+  pluxx publish --npm --github-release --version 1.0.0
 `);
 }
 if (import.meta.main) {