plugnz 0.0.4 → 0.0.5

package/src/hosts/codex.ts

@@ -1,183 +0,0 @@
-/**
- * codex host reader.
- *
- * Reader only — the writer (add/pin/remove) lives in
- * src/hosts/codex-writer.ts so loading a reader never evaluates writer code
- * (AGENTS.md: doctor is read-only by construction).
- *
- * Real store layout (measured 2026-09-16, evidence in docs/hosts/codex.md):
- *   ~/.codex/config.toml                          — [plugins."<name>@<marketplace>"] enabled = bool;
- *                                                    user-level [mcp_servers.<name>] (command/args
- *                                                    = stdio, url = HTTP)
- *   ~/.codex/plugins/cache/<marketplace>/<name>/<version>/  — install dirs
- *
- * Plugin MCP is declared via `.codex-plugin/plugin.json`'s `mcpServers`
- * member, which measured as a pointer string (`"./.mcp.json"`, never inline,
- * across 13 manifests) resolved against the plugin root; the plugins CLI also
- * writes spec `.mcp.json`/`mcp.json` copies — all are read, identical entries
- * deduped.
- *
- * Shadow semantics (measured): a user-level [mcp_servers.X] silently wins over
- * a plugin-provided server of the same name — see doctor check (2).
- */
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { basename, join } from 'node:path';
-import { parse as parseToml } from 'smol-toml';
-import type { HostReader, InstalledPlugin, McpServerEntry } from '../host';
-import { codexHome } from '../paths';
-import { collectPluginServers, type PluginMcpCandidate, type RawServerDef } from '../mcp';
-
-export function configFile(): string {
-  return join(codexHome(), 'config.toml');
-}
-
-/**
- * Where a plugin declares MCP servers. `.codex-plugin/plugin.json` measured as
- * a *pointer* (`"mcpServers": "./.mcp.json"`), never inline, so pinning it is a
- * no-op — the pointed file is a spec candidate here and is pinned directly.
- */
-export function mcpCandidates(): PluginMcpCandidate[] {
-  return [
-    { kind: 'inline', manifest: join('.codex-plugin', 'plugin.json') },
-    { kind: 'spec', file: '.mcp.json' },
-    { kind: 'spec', file: 'mcp.json' },
-  ];
-}
-
-function parseConfig(): Record<string, unknown> | null {
-  try {
-    const parsed: unknown = parseToml(readFileSync(configFile(), 'utf8'));
-    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : null;
-  } catch {
-    return null;
-  }
-}
-
-function table(value: unknown): Record<string, unknown> | null {
-  return typeof value === 'object' && value !== null && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
-}
-
-/** Pick the install dir using Codex's `active_plugin_version`: `local` wins, then semver, then lexical fallback. */
-function cacheDirFor(marketplace: string, name: string): string | undefined {
-  const slot = join(codexHome(), 'plugins', 'cache', marketplace, name);
-  if (!existsSync(slot)) return undefined;
-  let best: string | undefined;
-  for (const entry of readdirSync(slot)) {
-    const candidate = join(slot, entry);
-    try {
-      if (!statSync(candidate).isDirectory()) continue;
-    } catch {
-      continue;
-    }
-    if (best === undefined || comparePluginVersion(entry, best) > 0) best = entry;
-  }
-  return best === undefined ? undefined : join(slot, best);
-}
-
-function comparePluginVersion(left: string, right: string): number {
-  if (left === 'local') return right === 'local' ? 0 : 1;
-  if (right === 'local') return -1;
-  const parse = (value: string): { numbers: number[]; prerelease?: string } | null => {
-    const match = value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u);
-    return match === null ? null : { numbers: [Number(match[1]), Number(match[2]), Number(match[3])], ...(match[4] === undefined ? {} : { prerelease: match[4] }) };
-  };
-  const l = parse(left);
-  const r = parse(right);
-  if (l !== null && r !== null) {
-    for (let index = 0; index < 3; index += 1) if (l.numbers[index] !== r.numbers[index]) return (l.numbers[index] ?? 0) - (r.numbers[index] ?? 0);
-    if (l.prerelease === undefined && r.prerelease !== undefined) return 1;
-    if (l.prerelease !== undefined && r.prerelease === undefined) return -1;
-    if (l.prerelease !== undefined && r.prerelease !== undefined) return comparePrerelease(l.prerelease, r.prerelease);
-    return 0;
-  }
-  return left.localeCompare(right);
-}
-
-function comparePrerelease(left: string, right: string): number {
-  const l = left.split('.'); const r = right.split('.');
-  for (let index = 0; index < Math.max(l.length, r.length); index += 1) {
-    const a = l[index]; const b = r[index];
-    if (a === undefined) return -1;
-    if (b === undefined) return 1;
-    if (a === b) continue;
-    const an = /^\d+$/u.test(a); const bn = /^\d+$/u.test(b);
-    if (an && bn) return Number(a) - Number(b);
-    if (an) return -1;
-    if (bn) return 1;
-    return a.localeCompare(b);
-  }
-  return 0;
-}
-
-export const codex: HostReader = {
-  id: 'codex',
-  gui: false,
-
-  detect(): boolean {
-    return existsSync(codexHome());
-  },
-
-  stores(): string[] {
-    return [join(codexHome(), 'plugins', 'cache')];
-  },
-
-  listInstalled(): InstalledPlugin[] {
-    const config = parseConfig();
-    if (config === null) return [];
-    const plugins = table(config['plugins']);
-    if (plugins === null) return [];
-    const out: InstalledPlugin[] = [];
-    for (const id of Object.keys(plugins)) {
-      const def = table(plugins[id]);
-      const enabled = !(def !== null && def['enabled'] === false);
-      const at = id.indexOf('@');
-      const name = at === -1 ? id : id.slice(0, at);
-      const marketplace = at === -1 ? undefined : id.slice(at + 1);
-      const path = enabled && marketplace !== undefined ? cacheDirFor(marketplace, name) : undefined;
-      const plugin: InstalledPlugin = { id, name, enabled };
-      if (marketplace !== undefined) plugin.marketplace = marketplace;
-      if (path !== undefined) {
-        plugin.path = path;
-        const version = basename(path);
-        if (version.length > 0) plugin.version = version;
-      }
-      out.push(plugin);
-    }
-    return out;
-  },
-
-  mcpEntries(): McpServerEntry[] {
-    const config = parseConfig();
-    if (config === null) return [];
-    const entries: McpServerEntry[] = [];
-    const userServers = table(config['mcp_servers']);
-    if (userServers !== null) {
-      for (const [name, value] of Object.entries(userServers)) {
-        const def = table(value);
-        if (def === null) continue;
-        const defRecord = def as RawServerDef;
-        const transport =
-          typeof defRecord['url'] === 'string' ? 'http' : typeof defRecord['command'] === 'string' ? 'stdio' : null;
-        if (transport === null) continue;
-        const entry: McpServerEntry = {
-          name,
-          transport,
-          origin: 'user',
-          file: configFile(),
-          baseDir: codexHome(),
-        };
-        const command = defRecord['command'];
-        if (typeof command === 'string') entry.command = command;
-        const rawArgs = defRecord['args'];
-        if (Array.isArray(rawArgs)) entry.args = rawArgs.filter((a): a is string => typeof a === 'string');
-        if (defRecord['enabled'] === false) entry.enabled = false;
-        entries.push(entry);
-      }
-    }
-    for (const plugin of this.listInstalled()) {
-      if (plugin.path === undefined || !existsSync(plugin.path)) continue;
-      entries.push(...collectPluginServers(plugin.id, plugin.path, mcpCandidates()));
-    }
-    return entries;
-  },
-};

package/src/hosts/cursor-writer.ts

@@ -1,279 +0,0 @@
-/** Cursor's native local-plugin lifecycle writer. */
-import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { tmpdir } from 'node:os';
-import type { AddOptions, HostWriter, InstalledPlugin, PinOptions, PinOutcome } from '../host';
-import { cursorRoot } from '../paths';
-import type { PluginSource, ResolvedSource } from '../source';
-import { cursor, localDir, mcpCandidates } from './cursor';
-import { pinPluginMcpFiles } from '../mcp-write';
-import { discoverCommands } from '../conversion';
-
-const OWNERSHIP = '.plgnz-install.json';
-type Ownership = { source: string; pluginId: string; fingerprint: string };
-
-export const cursorWriter: HostWriter = {
-  ...cursor,
-  supportsAdoption: true,
-  async add(plugin: PluginSource, resolved: ResolvedSource, opts?: AddOptions): Promise<void | 'unchanged'> {
-    const id = plugin.name;
-    const ownershipId = plugin.marketplace === undefined ? id : `${id}@${plugin.marketplace}`;
-    assertSafeIdentity(id);
-    const root = localDir();
-    const target = join(root, id);
-    assertManagedDirectory(root, target);
-
-    if (!opts?.dryRun) mkdirSync(root, { recursive: true });
-    const stage = mkdtempSync(join(opts?.dryRun ? tmpdir() : root, '.plgnz-cursor-stage-'));
-    try {
-      stagePlugin(plugin.dir, stage, id);
-      // Preserve an unresolved bare command for the existing read-only `pin`
-      // diagnosis path; activation must not rewrite it into a guessed command.
-      await pinPluginMcpFiles(stage, mcpCandidates(), { dryRun: false });
-      writeOwnership(stage, { source: resolved.sourceUri, pluginId: ownershipId, fingerprint: plugin.contentFingerprint ?? '' });
-
-      const marker = readOwnership(target);
-      if (marker !== null && (marker.source !== resolved.sourceUri || !matchesOwnership(marker.pluginId, id, ownershipId))) {
-        throw new Error(`Cursor local plugin ${id} belongs to another source; refusing to replace it`);
-      }
-      const identicalUnowned = existsSync(target) && marker === null && sameTree(stage, target);
-      if (existsSync(target) && marker === null && !identicalUnowned) {
-        if (!opts?.adoptExisting) throw new Error(`Cursor local plugin ${id} is unowned and differs from the staged representation; pass --adopt-existing to take ownership explicitly`);
-        validateExistingIdentity(target, id, sourceVersion(plugin.dir));
-      }
-
-      // A bare legacy marker has no collection identity. Re-write it on the
-      // next successful add so reader metadata and the durable state agree.
-      const unchanged = marker !== null && marker.pluginId === ownershipId && marker.fingerprint === (plugin.contentFingerprint ?? '') && sameTree(stage, target);
-      if (opts?.dryRun) {
-        console.log(`[cursor] would activate directory: ${target}`);
-        return unchanged ? 'unchanged' : undefined;
-      }
-      if (unchanged) return 'unchanged';
-      activate(stage, target, root).commit();
-      return;
-    } finally {
-      rmSync(stage, { recursive: true, force: true });
-    }
-  },
-  async pin(plugin: InstalledPlugin, opts?: PinOptions): Promise<PinOutcome> {
-    if (plugin.path === undefined || !existsSync(plugin.path)) return { changes: [], refusals: [] };
-    return pinPluginMcpFiles(plugin.path, mcpCandidates(), opts);
-  },
-  async remove(id: string): Promise<void> {
-    assertSafeIdentity(id);
-    const root = localDir();
-    const target = join(root, id);
-    assertManagedDirectory(root, target);
-    const marker = readOwnership(target);
-    if (marker === null || !ownsNativeDirectory(marker.pluginId, id)) return;
-    rmSync(target, { recursive: true, force: true });
-  },
-};
-
-function stagePlugin(source: string, stage: string, expectedName: string): void {
-  assertNoSymlinks(source);
-  cpSync(source, stage, { recursive: true });
-  projectCommandsToSkills(stage);
-  ensureCursorManifest(stage, expectedName);
-  validateStage(stage, expectedName);
-}
-
-/**
- * Cursor folded commands into skills: every skill is `/`-invocable and
- * Cursor 2.4's /migrate-to-skills preserves command invocation behavior
- * (Cursor docs → Skills). Command sources therefore project into the
- * plugin's skills tree. A command that is not user-invocable cannot be
- * represented — every Cursor skill is /-invocable — and is refused rather
- * than silently weakened.
- */
-function projectCommandsToSkills(stage: string): void {
-  if (!hasCommands(stage)) return;
-  const commands = discoverCommands(stage);
-  const seen = new Set<string>();
-  for (const command of commands) {
-    if (command.userInvocable === false) throw new Error(`Cursor skill projection cannot represent user-invocable: false: ${command.source}`);
-    if (seen.has(command.name)) throw new Error(`Cursor command projection collision: ${command.name}`);
-    seen.add(command.name);
-    const target = join(stage, 'skills', command.name, 'SKILL.md');
-    if (existsSync(target)) throw new Error(`Cursor command collides with an existing skill: ${command.name}`);
-    mkdirSync(join(stage, 'skills', command.name), { recursive: true });
-    const body = command.body.endsWith('\n') ? command.body : `${command.body}\n`;
-    writeFileSync(target, `---\nname: ${JSON.stringify(command.name)}\ndescription: ${JSON.stringify(command.description)}\n---\n${body}`);
-  }
-  if (commands.length > 0) {
-    rmSync(join(stage, 'commands'), { recursive: true, force: true });
-    rmSync(join(stage, '.claude', 'commands'), { recursive: true, force: true });
-  }
-}
-
-function hasCommands(root: string): boolean {
-  return existsSync(join(root, 'commands')) || existsSync(join(root, '.claude', 'commands'));
-}
-
-function ensureCursorManifest(stage: string, expectedName: string): void {
-  const cursorManifest = join(stage, '.cursor-plugin', 'plugin.json');
-  if (existsSync(cursorManifest)) return;
-  const source = manifestCandidates(stage).find(existsSync);
-  if (source === undefined) throw new Error('Cursor stage has no Agent Plugins manifest');
-  mkdirSync(join(stage, '.cursor-plugin'), { recursive: true });
-  cpSync(source, cursorManifest);
-  if (parseManifest(cursorManifest).name !== expectedName) throw new Error(`Cursor manifest identity does not match ${expectedName}`);
-}
-
-function validateStage(stage: string, expectedName: string): void {
-  assertNoSymlinks(stage);
-  const native = parseManifest(join(stage, '.cursor-plugin', 'plugin.json'));
-  if (native.name !== expectedName) throw new Error(`Cursor manifest identity does not match ${expectedName}`);
-  const canonicalPath = manifestCandidates(stage).find(existsSync);
-  if (canonicalPath !== undefined) {
-    const canonical = parseManifest(canonicalPath);
-    if (native.name !== canonical.name || (canonical.version !== undefined && native.version !== canonical.version)) {
-      throw new Error('Cursor native manifest identity does not match the canonical manifest');
-    }
-  }
-  const skills = join(stage, 'skills');
-  if (existsSync(skills) && !statSync(skills).isDirectory()) throw new Error('Cursor stage skills path is not a directory');
-}
-
-function manifestCandidates(root: string): string[] {
-  return [join(root, '.claude-plugin', 'plugin.json'), join(root, 'plugin.json'), join(root, '.plugin', 'plugin.json')];
-}
-
-function sourceVersion(root: string): string | undefined {
-  const manifest = [join(root, '.cursor-plugin', 'plugin.json'), ...manifestCandidates(root)].find(existsSync);
-  return manifest === undefined ? undefined : parseManifest(manifest).version;
-}
-
-function parseManifest(path: string): { name: string; version?: string } {
-  let value: unknown;
-  try { value = JSON.parse(readFileSync(path, 'utf8')); }
-  catch (error) { throw new Error(`invalid Cursor plugin manifest: ${path} (${(error as Error).message})`); }
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error(`invalid Cursor plugin manifest: ${path}`);
-  const record = value as Record<string, unknown>;
-  if (typeof record['name'] !== 'string' || !validIdentity(record['name'])) throw new Error(`invalid Cursor plugin manifest identity: ${path}`);
-  if (record['version'] !== undefined && typeof record['version'] !== 'string') throw new Error(`invalid Cursor plugin manifest version: ${path}`);
-  return { name: record['name'], ...(typeof record['version'] === 'string' ? { version: record['version'] } : {}) };
-}
-
-function validateExistingIdentity(target: string, expectedName: string, expectedVersion: string | undefined): void {
-  const manifest = join(target, '.cursor-plugin', 'plugin.json');
-  if (!existsSync(manifest)) throw new Error(`unowned Cursor local plugin has no native manifest: ${target}`);
-  const parsed = parseManifest(manifest);
-  if (parsed.name !== expectedName || parsed.version !== expectedVersion) throw new Error(`unowned Cursor local plugin identity does not match ${expectedName}`);
-}
-
-function readOwnership(target: string): Ownership | null {
-  const marker = join(target, OWNERSHIP);
-  if (!existsSync(marker)) return null;
-  try {
-    const value: unknown = JSON.parse(readFileSync(marker, 'utf8'));
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('marker must be an object');
-    const record = value as Record<string, unknown>;
-    if (typeof record['source'] !== 'string' || typeof record['pluginId'] !== 'string' || typeof record['fingerprint'] !== 'string') throw new Error('marker fields are invalid');
-    return { source: record['source'], pluginId: record['pluginId'], fingerprint: record['fingerprint'] };
-  } catch (error) {
-    throw new Error(`invalid plgnz ownership marker: ${marker} (${(error as Error).message})`);
-  }
-}
-
-function writeOwnership(stage: string, ownership: Ownership): void {
-  writeFileSync(join(stage, OWNERSHIP), JSON.stringify(ownership));
-}
-
-/** A legacy bare marker remains owned only for this exact native directory. */
-function matchesOwnership(markerId: string, nativeId: string, ownershipId: string): boolean {
-  return markerId === nativeId || markerId === ownershipId;
-}
-
-function ownsNativeDirectory(markerId: string, nativeId: string): boolean {
-  if (markerId === nativeId) return true;
-  const prefix = `${nativeId}@`;
-  return markerId.startsWith(prefix) && validIdentity(markerId.slice(prefix.length));
-}
-
-function activate(stage: string, target: string, root: string): { commit(): void } {
-  if (!existsSync(target)) {
-    renameSync(stage, target);
-    return { commit: () => {} };
-  }
-  const backupRoot = mkdtempSync(join(root, '.plgnz-cursor-backup-'));
-  const backup = join(backupRoot, 'previous');
-  renameSync(target, backup);
-  try { renameSync(stage, target); }
-  catch (error) {
-    renameSync(backup, target);
-    rmSync(backupRoot, { recursive: true, force: true });
-    throw error;
-  }
-  return { commit: () => rmSync(backupRoot, { recursive: true, force: true }) };
-}
-
-function sameTree(left: string, right: string): boolean {
-  if (!existsSync(right)) return false;
-  const entries = (root: string): string[] => {
-    const out: string[] = [];
-    const walk = (dir: string, prefix: string): void => {
-      for (const name of readdirSync(dir).sort()) {
-        if (name === OWNERSHIP) continue;
-        const path = join(dir, name);
-        const relative = prefix === '' ? name : `${prefix}/${name}`;
-        const stat = lstatSync(path);
-        if (stat.isSymbolicLink()) throw new Error(`Cursor managed plugin contains symlink: ${path}`);
-        if (stat.isDirectory()) walk(path, relative);
-        else if (stat.isFile()) out.push(`${relative}:${hashBytes(path)}`);
-        else throw new Error(`Cursor managed plugin contains unsupported file: ${path}`);
-      }
-    };
-    walk(root, '');
-    return out;
-  };
-  return JSON.stringify(entries(left)) === JSON.stringify(entries(right));
-}
-
-function hashBytes(path: string): string {
-  const read = readFileSync as unknown as (file: string) => Uint8Array;
-  return Array.from(read(path)).join(',');
-}
-
-function assertManagedDirectory(root: string, target: string): void {
-  const resolvedRoot = resolve(cursorRoot());
-  const resolvedTarget = resolve(target);
-  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}/`)) throw new Error(`Cursor managed path escapes its store: ${target}`);
-  let current = resolvedRoot;
-  for (const part of resolvedTarget.slice(resolvedRoot.length).split('/').filter(Boolean)) {
-    if (existsSync(current)) assertDirectoryNotLink(current);
-    current = join(current, part);
-  }
-  if (existsSync(current)) assertDirectoryNotLink(current);
-}
-
-function assertDirectoryNotLink(path: string): void {
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink()) throw new Error(`Cursor managed path component is a symlink: ${path}`);
-  if (!stat.isDirectory()) throw new Error(`Cursor managed path component is not a directory: ${path}`);
-}
-
-function assertNoSymlinks(root: string): void {
-  const walk = (dir: string): void => {
-    const stat = lstatSync(dir);
-    if (stat.isSymbolicLink()) throw new Error(`Cursor plugin source contains symlink: ${dir}`);
-    if (!stat.isDirectory()) throw new Error(`Cursor plugin source is not a directory: ${dir}`);
-    for (const name of readdirSync(dir)) {
-      const path = join(dir, name);
-      const entry = lstatSync(path);
-      if (entry.isSymbolicLink()) throw new Error(`Cursor plugin source contains symlink: ${path}`);
-      if (entry.isDirectory()) walk(path);
-      else if (!entry.isFile()) throw new Error(`Cursor plugin source contains unsupported file: ${path}`);
-    }
-  };
-  walk(root);
-}
-
-function assertSafeIdentity(id: string): void {
-  if (!validIdentity(id)) throw new Error(`unsafe Cursor plugin identity: ${id}`);
-}
-
-function validIdentity(id: string): boolean {
-  return /^[a-z0-9][a-z0-9._-]*$/iu.test(id);
-}

package/src/hosts/cursor.ts

@@ -1,107 +0,0 @@
-/**
- * cursor host reader.
- *
- * Reader only — the writer (add/pin/remove) lives in
- * src/hosts/cursor-writer.ts so loading a reader never evaluates writer code
- * (AGENTS.md: doctor is read-only by construction).
- *
- * Real store layout (measured 2026-09-16, evidence in docs/hosts/cursor.md):
- *   ~/.cursor/mcp.json                      — user-level {mcpServers:{…}}
- *   ~/.cursor/plugins/local/<name>/         — dereferenced plugin copies (the route
- *                                              `npx plugins --target cursor` does NOT take;
- *                                              house evidence: install rejected)
- *   ~/.cursor/plugins/{cache,marketplaces}/ — cursor-native dirs, observed but not read in v0
- *
- * Plugin MCP is declared in `.mcp.json` (and a spec `mcp.json` copy) at the
- * plugin root. Cursor is a GUI host: `launchctl getenv PATH` is unset, so bare
- * commands cannot be assumed to resolve (spec §7.2.1) — doctor flags them and
- * `pin` rewrites them to absolute paths; `add` pins a fresh copy the same way.
- */
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-import type { HostReader, InstalledPlugin, McpServerEntry } from '../host';
-import { cursorRoot } from '../paths';
-import { collectPluginServers, collectUserServers, readJson, type PluginMcpCandidate } from '../mcp';
-
-export function localDir(): string {
-  return join(cursorRoot(), 'plugins', 'local');
-}
-
-/** Where a plugin copy may declare MCP servers, in cursor's priority order. */
-export function mcpCandidates(): PluginMcpCandidate[] {
-  return [
-    { kind: 'spec', file: '.mcp.json' },
-    { kind: 'spec', file: 'mcp.json' },
-  ];
-}
-
-function userConfigFile(): string {
-  return join(cursorRoot(), 'mcp.json');
-}
-
-export const cursor: HostReader = {
-  id: 'cursor',
-  gui: true,
-
-  detect(): boolean {
-    return existsSync(cursorRoot());
-  },
-
-  stores(): string[] {
-    return [localDir()];
-  },
-
-  listInstalled(): InstalledPlugin[] {
-    if (!existsSync(localDir())) return [];
-    const out: InstalledPlugin[] = [];
-    for (const entry of readdirSync(localDir())) {
-      const dir = join(localDir(), entry);
-      try {
-        if (!statSync(dir).isDirectory()) continue;
-      } catch {
-        continue;
-      }
-      const manifest = join(dir, '.cursor-plugin', 'plugin.json');
-      if (!existsSync(manifest)) continue;
-      const plugin: InstalledPlugin = { id: entry, name: entry, path: dir };
-      const marketplace = ownershipMarketplace(dir, entry);
-      if (marketplace !== undefined) plugin.marketplace = marketplace;
-      const parsed = readJson(manifest);
-      const version = parsed !== null ? parsed['version'] : undefined;
-      if (typeof version === 'string') plugin.version = version;
-      out.push(plugin);
-    }
-    return out;
-  },
-
-  mcpEntries(): McpServerEntry[] {
-    const entries: McpServerEntry[] = [];
-    entries.push(...collectUserServers(userConfigFile(), cursorRoot()));
-    for (const plugin of this.listInstalled()) {
-      if (plugin.path === undefined || !existsSync(plugin.path)) continue;
-      entries.push(...collectPluginServers(plugin.id, plugin.path, mcpCandidates()));
-    }
-    return entries;
-  },
-};
-
-/** Recover a collection identity only from a valid plgnz ownership marker. */
-function ownershipMarketplace(dir: string, name: string): string | undefined {
-  const marker = join(dir, '.plgnz-install.json');
-  if (!existsSync(marker)) return undefined;
-  try {
-    const parsed: unknown = JSON.parse(readFileSync(marker, 'utf8'));
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return undefined;
-    const ownership = parsed as Record<string, unknown>;
-    if (typeof ownership['source'] !== 'string' || typeof ownership['fingerprint'] !== 'string' || typeof ownership['pluginId'] !== 'string') return undefined;
-    const prefix = `${name}@`;
-    const marketplace = ownership['pluginId'].startsWith(prefix) ? ownership['pluginId'].slice(prefix.length) : undefined;
-    return marketplace !== undefined && validIdentity(marketplace) ? marketplace : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function validIdentity(value: string): boolean {
-  return /^[a-z0-9][a-z0-9._-]*$/iu.test(value);
-}