Merge origin/main into eshwar/per-target-mcp-and-plugin-root-files

Reconcile the per-target MCP override + plugin-root files features with
main's target-registry refactor (src/targets.ts -> src/targets/).

- source.ts: kept main's resolveTargetOverride-based readPluginFiles; re-added
  the plugin.pluginpack.json "files" map emission and threaded "target" into
  readMcpServers so targets/<host>/.mcp.json overrides the base .mcp.json.
- targets.ts deleted (accepted main's refactor); the resolveMcpServers call
  moved to src/targets/engine.ts and now passes "target".
- render.ts/types.ts/schema.ts: target param on readMcpServers/resolveMcpServers
  and the "files" field on sourcePluginManifestSchema merged cleanly.
- tests/core.test.ts: kept all of main's tests; re-added the 4 feature tests
  (per-target MCP override, plugin-root files, collision guard, missing source).

npm run test:all green (80 tests, format/lint/typecheck/build/docs).

Author: Cherrypick Bot

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       matrix:
         node-version: [24]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node
         uses: actions/setup-node@v6
@@ -26,5 +26,8 @@ jobs:
       - name: Check
         run: npm run check
 
+      - name: Audit production dependencies
+        run: npm run audit
+
       - name: Verify package contents
         run: npm pack --dry-run

.prettierignore

@@ -5,3 +5,4 @@ examples/glean/plugins/
 examples/basic/dist/
 package-lock.json
 tests/fixtures/cursor/*.schema.json
+CHANGELOG.md

CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## v0.8.0 (2026-07-27)
+
+#### :rocket: Enhancement
+
+- [#18](https://github.com/gleanwork/pluginpack/pull/18) feat: add install-info command and buildInstallSnippet API ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+- [#12](https://github.com/gleanwork/pluginpack/pull/12) feat: add opt-in update-check hook for claude and cursor targets ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+
+#### :bug: Bug Fix
+
+- [#20](https://github.com/gleanwork/pluginpack/pull/20) fix(deps): resolve brace-expansion DoS advisory; scope audit to production deps ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+- [#16](https://github.com/gleanwork/pluginpack/pull/16) fix: correct Codex plugin output for the target registry ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+- [#13](https://github.com/gleanwork/pluginpack/pull/13) fix: correct Copilot and Antigravity plugin output + polymorphic target registry ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+
+#### :house: Internal
+
+- [#17](https://github.com/gleanwork/pluginpack/pull/17) refactor: delete legacy per-target emitters/validators now that all targets are migrated ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+- [#19](https://github.com/gleanwork/pluginpack/pull/19) refactor: migrate claude to the target registry (no behavior change) ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+- [#14](https://github.com/gleanwork/pluginpack/pull/14) refactor: migrate cursor to the target registry ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+
+#### Committers: 1
+
+- Steve Calvert ([@steve-calvert-glean](https://github.com/steve-calvert-glean))
+
+
+
 ## 0.7.0 (2026-07-13)
 
 - Add a native Codex target that emits `.agents/plugins/marketplace.json`,

CLAUDE.md

@@ -13,6 +13,10 @@ manager or publisher.
   tests run the real built binary (`dist/cli.js`) via `bintastic`.
 - `npm run check` — the full gate (`test:all`): `format:check` → `lint` →
   `typecheck` → `test` → `build` → `docs`. Run this before considering work done.
+- `npm run audit` — `npm audit --omit=dev`, also run in CI. Scoped to production
+  dependencies on purpose: devDependencies (eslint, test fixtures, etc.) never
+  ship in the published package, so a vulnerability there isn't a risk to
+  consumers — don't add fixes/overrides for dev-only findings.
 - `npm run build` — bundle with tsup.
 - After changing CLI commands/options, regenerate the README CLI reference with
   `node dist/cli.js docs` (the gate's `docs --check` fails if it is stale).
@@ -37,25 +41,35 @@ diff, prune, and validate all derive from it.
   generated output is never misread as source), and the root-skills plugin.
 - `src/render.ts` — `collectPluginFiles` (component dirs + static files, with
   `targets/<name>/` override resolution) and `resolveMcpServers`.
-- `src/targets.ts` — `emitTarget` + per-target emitters. `cursor`/`claude`/
-  `antigravity` share the `emitPlugins` engine via callbacks; `emitCopilot` is
-  bespoke (no per-plugin manifest, dual marketplace). Manifest builders live here
-  too.
+- `src/targets/registry.ts` — `targets: Record<TargetName, PluginTargetDefinition>`,
+  one file per target (`src/targets/<name>.ts`). Everything that varies by
+  target — default components, manifest/marketplace builders, output paths,
+  validation, install snippet — lives on that target's own
+  `PluginTargetDefinition` (`src/targets/types.ts`).
+- `src/targets/engine.ts` — `emitFromDefinition`/`validateFromDefinition`: the
+  one emit/validate engine every target runs through, driven by its
+  `PluginTargetDefinition`. Also `withRootFiles` (injects per-target
+  repo-root files into the artifact).
+- `src/targets/validation-shared.ts` — validators shared across targets whose
+  shape actually matches (bare-string marketplace `source`, hooks.json shape,
+  frontmatter conventions); a target with a genuinely different shape (e.g.
+  Codex's structured `source`) writes its own instead of forcing a fit.
+- `src/adapters.ts` — `emitTarget`/`validateOutput`/`targetNames`, thin
+  wrappers around the registry + engine.
 - `src/build.ts` — `build()`: emit all targets → `assertNoCrossTargetCollisions`
   → write/prune/manifest. Holds the delete guard.
 - `src/managed.ts` — the managed-file manifest (`.pluginpack/<target>.json`),
   `prune`/`clean`, the delete guard, and path-safety checks.
 - `src/diff.ts` — `diffTarget`: build to a temp dir and compare against an
   existing target repo (the CI staleness gate).
-- `src/validate.ts` — per-target output validation.
 
 ## Targets
 
-`cursor`, `claude`, `antigravity`, `copilot`. Adding a target currently touches ~5
-places: the `TargetName` union (`types.ts`), the `targets` array + `parseTarget`
-(`cli.ts`), `allTargets` (`build.ts`), the `emitters` map + a new `emitFoo`
-(`targets.ts`), and a branch + `validateFoo` (`validate.ts`). If you are adding a
-target, consider introducing a single target registry first to localize this.
+`copilot`, `antigravity`, `cursor`, `claude`, `codex`. Adding a target means one
+new file implementing `PluginTargetDefinition` (`src/targets/<name>.ts`) plus one
+new entry in `src/targets/registry.ts` — `TargetName` (`types.ts`) is still a
+separate union to extend, but everything else (CLI `--target` choices, `build()`'s
+target set, emit/validate dispatch) derives from the registry automatically.
 
 ## Conformance
 
@@ -80,6 +94,7 @@ schemas at runtime — vendor a pinned copy with recorded provenance.
 
 ## Conventions
 
-- Strict TypeScript, no `any` (the one exception is `readJson` in `validate.ts`).
+- Strict TypeScript, no `any` (the one exception is `readJson` in
+  `src/targets/validation-shared.ts`).
 - Prettier + eslint enforced by the gate.
 - Conventional commits. Keep the README CLI reference regenerated.

CONFORMANCE.md

@@ -14,7 +14,7 @@ Each app's source of truth is something other than a stable schema URL:
 | `cursor`      | Glean-authored schemas in `gleanwork/cursor-plugins/schemas/`                                                                                        | **No upstream.** The schema `$id` (`https://cursor.com/schemas/cursor-plugin/...`) 500s; no Cursor-published schema found.                                                                                                         |
 | `antigravity` | Antigravity CLI plugin docs (`plugin.json`, optional `mcp_config.json`)                                                                              | **No.** Defined by product docs and observed CLI layout, not a published schema.                                                                                                                                                   |
 | `copilot`     | [`github/copilot-plugins`](https://github.com/github/copilot-plugins) — a Claude-marketplace-derived format                                          | **Structural.** Copilot shares the Claude marketplace base but extends entries (`skills[]`, `mcpServers` as a path), which `claude plugin validate` rejects — so conformance is asserted structurally against the official format. |
-| `codex`       | [OpenAI Codex CLI plugin docs](https://developers.openai.com/codex/plugins/build) (`.codex-plugin/plugin.json` + `.agents/plugins/marketplace.json`) | **No published schema.** Defined by product docs; conformance is asserted structurally against the documented format (retrieved 2026-06-17).                                                                                       |
+| `codex`       | [OpenAI Codex CLI plugin docs](https://developers.openai.com/codex/plugins/build) (`.codex-plugin/plugin.json` + `.agents/plugins/marketplace.json`) | **No published schema.** Defined by product docs; conformance is asserted structurally against the documented format (retrieved 2026-07-26).                                                                                       |
 
 ## Oracles the harness uses
 
@@ -48,14 +48,80 @@ against a temp fixture via [`bintastic`](https://github.com/scalvert/bintastic).
   `tests/core.test.ts` (required `plugin.json` fields present; optional
   `mcp_config.json` written when MCP servers are present). Antigravity CLI does
   not expose a published schema to validate against.
-- **codex** — asserted structurally in `tests/conformance.test.ts` against the
-  [documented Codex plugin format](https://developers.openai.com/codex/plugins/build):
-  a repo-scoped `.agents/plugins/marketplace.json` (`{ name, interface, plugins }`)
-  plus a per-plugin `.codex-plugin/plugin.json` (`{ name, version, description,
-skills }`) and optional `.mcp.json`. No published JSON Schema exists; the test
-  pins the documented shape and confirms a per-plugin `entry` passthrough lands in
-  the marketplace entry. Codex shares no marketplace path with the other targets,
-  so it needs no separate output root.
+- **codex** — asserted structurally in `tests/conformance.test.ts` and
+  `tests/core.test.ts` against the
+  [documented Codex plugin format](https://developers.openai.com/codex/plugins/build)
+  (re-verified 2026-07-26 via direct fetch, twice, for consistency): a
+  repo-scoped `.agents/plugins/marketplace.json` (`{ name, interface, plugins }`,
+  no `owner` field) plus a per-plugin `.codex-plugin/plugin.json` where only
+  `name` is required — `version`/`description`/`skills`/`hooks`/`mcpServers` are
+  optional pointers to bundled components. Every marketplace entry must carry
+  `policy.installation`, `policy.authentication`, and `category`; pluginpack has
+  no way to infer these, so the base entry stays guess-free and `validateOutput`
+  errors clearly if an author never supplies them via the per-plugin `entry`
+  passthrough. An entry's `source` is a bare string only for local plugins (the
+  only shape pluginpack itself ever emits); a `url`/`git-subdir`/`npm` source
+  added via `entry` is a structured object with an inner `source` discriminator
+  (e.g. `{ source: "git-subdir", url, path, ref }`), validated by shape rather
+  than requiring a local directory to exist. No published JSON Schema exists.
+  Codex shares no marketplace path with the other targets, so it needs no
+  separate output root.
+
+## Update-check hook facts
+
+The generated update-check hook (`updateCheck` config, claude/cursor targets)
+relies on two upstream hook behaviors that have no referenceable schema. Both
+were verified against product docs on 2026-07-22:
+
+- **Claude Code** — a `SessionStart` hook may print JSON whose top-level
+  `systemMessage` field is shown directly to the user (separate from model
+  context), and plugin hooks are auto-discovered from `hooks/hooks.json` with
+  `${CLAUDE_PLUGIN_ROOT}` substituted in commands.
+  Source: <https://code.claude.com/docs/en/hooks>.
+- **Cursor** — the `sessionStart` hook supports only `additional_context`
+  (injected into the agent's context); there is no user-visible message field,
+  so the cursor nudge asks the agent to relay it. Plugin hooks live in a
+  `hooks.json` (`{ "version": 1, "hooks": { "sessionStart": [...] } }`)
+  referenced from the plugin manifest, with commands relative to the plugin
+  root. Source: <https://cursor.com/docs/agent/hooks>.
+
+The emitted `hooks/hooks.json` shapes are covered by the conformance suite (the
+cursor manifest's `hooks` key validates against the vendored plugin schema, and
+`claude plugin validate --strict` exercises the claude hooks file when the CLI
+is present).
+
+Every target's `validateOutput` shares one `validateHooksShape`
+(`src/targets/validation-shared.ts`) for the parts of a hooks file that are
+target-agnostic: each event's entries must be an array, no `command` string
+may be empty, and any command referencing the generated update-check script
+(`scripts/pluginpack-update-check.sh`) must ship that script.
+
+## Install-snippet facts
+
+`pluginpack install-info` (and the `buildInstallSnippet` library function)
+prints the real command or URL a user needs to add a pluginpack-built
+marketplace. Each target's snippet and citation live on its own
+`PluginTargetDefinition.installSnippet` in `src/targets/<name>.ts`, verified
+directly against product docs:
+
+| Target        | Snippet                                                                                                                  | Source                                                                                                | Verified   |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- | ---------- |
+| `claude`      | `/plugin marketplace add <repo>` then `/plugin install <name>@<marketplace>` (slash-only)                                | <https://code.claude.com/docs/en/plugins-reference#cli-commands-reference>                            | 2026-07-25 |
+| `codex`       | `codex plugin marketplace add <repo>`                                                                                    | <https://learn.chatgpt.com/codex/developer-commands>                                                  | 2026-07-25 |
+| `copilot`     | `copilot plugin marketplace add <repo>` then `copilot plugin install <name>@<marketplace>`                               | <https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/plugins-finding-installing> | 2026-07-25 |
+| `antigravity` | `git clone <repo> plugin-source && cd plugin-source && agy plugin install <pluginPath>`                                  | <https://antigravity.google/docs/cli/plugins>                                                         | 2026-07-25 |
+| `cursor`      | No CLI equivalent exists. Prints the repo URL, pasted into Dashboard → Plugins → Team Marketplaces → "Import from Repo." | <https://cursor.com/docs/plugins>                                                                     | 2026-07-25 |
+
+`claude`'s two-step sequence is not symmetric with `codex`/`copilot`'s shell
+commands: `/plugin marketplace add` is slash-only inside an active Claude Code
+session, with no shell equivalent — but once a marketplace is already added,
+`claude plugin install <name>@<marketplace>` does work as a standalone shell
+command, surfaced as a secondary `note`.
+
+Every target resolves to `userConfigurable: true` today;
+`getUnsupportedInstallTargets()` returns `[]`. The `false` branch of the
+`InstallSnippet` union exists for forward-compatibility, not because any
+target needs it now.
 
 ## Refreshing vendored schemas