chore: lint via biome, current Open Plugins links, cron-auth constant-time compare, CI token scope, single biome version

.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   checks:
     name: Lint & typecheck

README.md

@@ -77,21 +77,24 @@ All content is submitted through the website — no pull requests needed for dat
 
 1. Go to [cursor.directory/plugins/new](https://cursor.directory/plugins/new)
 2. Sign in with GitHub or Google
-3. Paste a GitHub repo URL — we auto-detect components following the [Open Plugins](https://open-plugins.com) standard
+3. Paste a GitHub repo URL — we auto-detect components following the [Open Plugins](https://agent-plugins.org) standard
 4. Click **Submit**
 
 Auto-detected components:
 
 | Component | Path |
 |-----------|------|
 | Rules | `rules/*.mdc` |
-| MCP Servers | `.mcp.json` |
+| MCP Servers | `.mcp.json` or `mcp.json` |
 | Skills | `skills/*/SKILL.md` |
 | Agents | `agents/*.md` |
+| Commands | `commands/*.md` |
 | Hooks | `hooks/hooks.json` |
 | LSP Servers | `.lsp.json` |
 
-See the [Open Plugins specification](https://open-plugins.com/plugin-builders/specification) and [plugin template](https://github.com/cursor/plugin-template) for details.
+The manifest is read from `.plugin/plugin.json`, `.cursor-plugin/plugin.json` or `.claude-plugin/plugin.json` (first match wins). For monorepos, the same paths are also scanned inside every directory listed as `plugins[].source` in `.cursor-plugin/marketplace.json` and every directory that contains its own `.cursor-plugin/plugin.json`.
+
+See the [Open Plugins specification](https://agent-plugins.org/specification) and [plugin template](https://github.com/cursor/plugin-template) for details.
 
 ---
 
@@ -104,7 +107,7 @@ See the [Open Plugins specification](https://open-plugins.com/plugin-builders/sp
 - **Styling**: [Tailwind CSS](https://tailwindcss.com)
 - **UI**: [Radix UI](https://radix-ui.com) + [shadcn/ui](https://ui.shadcn.com)
 - **Search**: [Fuse.js](https://fusejs.io) (client-side fuzzy search)
-- **URL State**: [nuqs](https://nuqs.47ng.com)
+- **URL State**: [nuqs](https://nuqs.dev)
 - **Linting**: [Biome](https://biomejs.dev)
 
 ## Plugin security scan

apps/cursor/package.json

@@ -6,7 +6,7 @@
     "dev": "next dev --turbopack",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "biome check .",
     "typecheck": "tsc --noEmit",
     "seed:extract": "bun run --env-file=.env src/scripts/extract-from-github.ts",
     "seed:insert": "bun run --env-file=.env src/scripts/insert-from-jsonl.ts"
@@ -54,7 +54,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.14",
+    "@biomejs/biome": "2.4.15",
     "@tailwindcss/postcss": "^4.2.4",
     "@types/node": "^25.6.0",
     "@types/react": "^19",

apps/cursor/src/app/plugins/new/page.tsx

@@ -46,7 +46,7 @@ export default function Page() {
             <br />
             We follow the{" "}
             <a
-              href="https://open-plugins.com"
+              href="https://agent-plugins.org"
               target="_blank"
               rel="noreferrer"
               className="text-foreground border-b border-border border-dashed"

apps/cursor/src/components/forms/plugin-form.tsx

@@ -386,7 +386,7 @@ export function PluginForm() {
                 We'll scan for rules, MCP servers, skills, agents, and more
                 following the{" "}
                 <a
-                  href="https://open-plugins.com"
+                  href="https://agent-plugins.org"
                   target="_blank"
                   rel="noreferrer"
                   className="border-b border-border border-dashed hover:text-foreground transition-colors"

apps/cursor/src/lib/cron-auth.ts

@@ -1,3 +1,4 @@
+import { timingSafeEqual } from "node:crypto";
 import { NextResponse } from "next/server";
 
 /**
@@ -24,8 +25,14 @@ export function requireCronAuth(request: Request): NextResponse | null {
     );
   }
 
-  const header = request.headers.get("authorization");
-  if (header !== `Bearer ${cronSecret}`) {
+  const header = request.headers.get("authorization") ?? "";
+  const expected = Buffer.from(`Bearer ${cronSecret}`);
+  const received = Buffer.from(header);
+  // Constant-time compare so the response time does not leak how much of
+  // the secret matched. Lengths must match first or timingSafeEqual throws.
+  const authorized =
+    received.length === expected.length && timingSafeEqual(received, expected);
+  if (!authorized) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 

apps/cursor/src/lib/github-plugin/parse.ts

@@ -578,7 +578,7 @@ export async function parseGitHubPlugin(
     throw new GitHubParseError(
       `No plugin components found in: ${scannedPrefixes}. ` +
         `We looked for: ${hints.join(", ")}. ` +
-        `Make sure your repo follows the Open Plugins standard (https://open-plugins.com).`,
+        `Make sure your repo follows the Open Plugins standard (https://agent-plugins.org).`,
       "no_components",
     );
   }