fix: make the Cursor marketplace bundle start Pascal reliably

[Aymericr]

Cursor's approved Pascal listing installs skills/, which previously contained only the Claude manifest. Cursor therefore launched a globally installed pascal binary and sent the Claude-only hosted-key placeholder. A missing executable caused spawn pascal ENOENT; the affected desktop's old CLI then failed on its web runtime.

This adds a complete Cursor-native manifest, MCP config, and logo inside that actual installation root. Both Cursor entry points bootstrap the published CLI 1.0.0 through a pinned npm command. The hosted variable declaration travels with the installed plugin. Bundle metadata moves to 0.1.9; other hosts retain their existing command and credential contracts.

Validation:

• bun run skills:validate: 68 tests, 94 assertions, including rejection of the old Claude-only package, wrong MCP selector, global CLI dependency, and floating npm release.
• Changed-file Biome checks, git diff --check, and claude plugin validate . --strict pass.
• Clean npm cache and isolated local storage, with no global Pascal on PATH: MCP initialized 46 tools and successfully called list_scenes; no web runtime downloaded.
• On the affected Cursor desktop, upgrading the old global CLI and reloading the existing plugin restored Connected status. A native read-only chat called list_templates and returned all three templates without retrying.

The public marketplace still points to 5275f3e657c21dcd363e3b08e01c97789fc55079, gitPath: skills, with no variable schema. It must refresh to this change before new marketplace installations receive the fix. The optional hosted endpoint still requires the user's key; local-only users should disable it. No hosted authentication or refreshed marketplace install is claimed.

---

Note

Low Risk
Packaging, MCP bootstrap, and validation/docs only; no runtime application code or auth logic changes beyond how Cursor starts the local CLI.

Overview
Fixes Cursor marketplace installs that pull skills/ without a native plugin bundle, which previously fell back to a global pascal binary and Claude-only hosted-key placeholders (spawn pascal ENOENT and broken hosted auth).

0.1.9 adds a self-contained skills/.cursor-plugin/ manifest, MCP config, and logo at the real install root. The local MCP server now launches @pascal-app/cli@1.0.0 via a pinned npx command in both .cursor-plugin/mcp.json entry points; optional PASCAL_API_KEY stays on the Cursor plugin variable schema. Claude, Codex, and Gemini still use the existing global pascal mcp connect contract.

New cursor-plugin-policy checks (wired into skills:validate) enforce matching manifests at both roots, reject Claude-only or wrong MCP selectors, and block global CLI or floating npm versions. Docs and VALIDATION.md describe Cursor install, legacy repair steps, and that the live marketplace listing still needs a publisher refresh to pick up the fix.

^{Reviewed by Cursor Bugbot for commit e93ce51. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: cd173bdd-04c0-487a-b4f7-8bc3c4512bf5