[harrymove-ctrl]

Summary

• Add scripts/build-claude-plugin.mjs to emit the complete standalone Claude plugin repository tree from packages/mcp/plugin/ plus the packages/mcp/plugin-repo/ CI overlay.
• Commit the rendered plugin prose (README.md, commands/*.md, skills/setup/*, docs/usage/*) directly under packages/mcp/plugin/ with SECRET_EXCLUSION_RULES, AUTO_SAVE_OPT_IN_RULE, and the pinned @mysten-incubation/memwal-mcp version already rendered, so .claude-plugin/marketplace.json, .cursor-plugin/marketplace.json, and npx degit MystenLabs/MemWal/packages/mcp/plugin never serve unresolved __MEMWAL_*__ tokens.
• Fail node scripts/build-claude-plugin.mjs --check if any file under packages/mcp/plugin/ carries an unresolved __MEMWAL_*__ token or drifts from packages/mcp/plugin/scripts/lib/memory-policy.mjs or packages/mcp/plugin/plugin.json (and provide --sync-in-place to refresh the committed markdown in place).
• Support --check --against <dir> to compare a checkout of the published plugin repo against a fresh generation and report missing, differing, or extra files.
• Include the emitted repository's own .github/workflows/ci.yml and .github/scripts/check-plugin-tree.mjs, asserting the trusted launcher shape across .mcp.json, .codex-mcp.json, and .cursor-mcp.json, verifying the npm version pin, scanning the full tree for leftover placeholders, and asserting SECRET_EXCLUSION_RULES and AUTO_SAVE_OPT_IN_RULE across README.md, commands/remember.md, commands/analyze.md, and skills/setup/SKILL.md (including the <!-- memwal:start --> ... <!-- memwal:end --> block).
• Wire scripts/build-claude-plugin.test.mjs into the existing meta matrix in .github/workflows/test.yml.

Verification

• node scripts/build-claude-plugin.mjs --check
• node scripts/build-claude-plugin.test.mjs
• claude plugin validate . --strict and node .github/scripts/check-plugin-tree.mjs on a freshly generated output tree

[ducnmm]

The generator check, both committed generator tests, and the generated tree's published-version check pass. Additional disposable-directory and checkout probes reproduce three issues below.

[harrymove-ctrl]

@ducnmm Rebased onto latest dev (39b093c1) and addressed all 3 review findings in cf56ea24:

1. [P1] Reject output paths that overlap the source checkout: assertSafeOutDir() canonicalizes ROOT and outDir (resolving realpathSync on the deepest existing ancestor) before build() / rmSync() runs and rejects filesystem roots, ROOT or its ancestors, and any path inside ROOT (--out ., --out <repo-root>, --out .., --out packages/mcp/plugin), with regression coverage in scripts/build-claude-plugin.test.mjs.
2. [P2] Ignore the Git metadata file of a linked worktree: walk() now skips entry.name === ".git" directly (and compare() filters target !== ".git"), with a regression test for a linked worktree .git file under --check --against.
3. [P2] Use the active dev endpoint in the generated setup guides: Updated docs/usage/hosted-connector.md and skills/setup/SETUP.md to use https://relayer.dev.memwal.ai/api/mcp and added checks in both build-claude-plugin.mjs and check-plugin-tree.mjs forbidding retired staging hostnames.

[ducnmm]

The generator now rejects output paths overlapping the source checkout, handles linked-worktree Git metadata, and rejects retired setup endpoints. The 44-file generated-tree check and all 3 generator regression tests pass. No blocking correctness or unnecessary-complexity issue found. Current CI checks pass (OpenClaw E2E is skipped); host-side Claude plugin validation was not rerun.