test: verify each vendor is installable via the plugins CLI + native Grok CLI

Add per-vendor installability checks to the plugin-manifest validation
workflow:

- install-via-plugins matrix runs the vendor-neutral `plugins` CLI once per
  supported target (claude-code, cursor, codex, grok, kimi, github-copilot),
  forcing each with --target and asserting the plugin installs. Grok and
  Copilot legs install their native CLIs first; the rest install file-based.
  Gemini is excluded (not a `plugins` CLI target — it ships as a Gemini
  extension).
- install-via-grok-cli exercises Grok Build's own `grok plugin install`,
  independent of the plugins CLI, confirming Grok's native path works.

Kimi has no headless native install (`/plugins install` is an interactive TUI
command); its only programmatic installer is the `plugins` CLI, which writes
Kimi's native store directly — so that path is covered by the matrix above.

Also drop the two vendor-specific MCP notes from AGENTS.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Rodriguespn

.github/workflows/validate-plugin-manifests.yml

@@ -5,9 +5,13 @@ on:
     branches:
       - main
 
+env:
+  # Pin the vendor-neutral installer so CI is deterministic; bump intentionally.
+  PLUGINS_CLI_VERSION: "1.3.4"
+
 jobs:
   validate:
-    name: Validate Claude plugin manifests
+    name: Validate Claude plugin manifest
     runs-on: ubuntu-latest
 
     steps:
@@ -22,3 +26,85 @@ jobs:
       - name: Validate plugin manifest
         run: npx -y @anthropic-ai/claude-code plugin validate .claude-plugin/plugin.json
 
+  install-via-plugins:
+    # Verify every supported vendor is installable through the vendor-neutral
+    # `plugins` CLI (https://www.npmjs.com/package/plugins). One leg per agent,
+    # forced with --target so we exercise exactly that vendor's surface.
+    # Gemini is intentionally omitted: it is not a `plugins` CLI target (it ships
+    # as a Gemini extension via gemini-extension.json).
+    name: Install via plugins CLI (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Target ids per the plugins CLI docs (Supported targets table).
+        target:
+          - claude-code
+          - cursor
+          - codex
+          - grok
+          - kimi
+          - github-copilot
+
+    env:
+      NO_COLOR: "1"
+      DO_NOT_TRACK: "1"
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      # Grok and Copilot install through their native CLIs, so those binaries
+      # must be present. The other targets are installed file-based and need no
+      # extra tooling.
+      - name: Install Grok Build CLI
+        if: matrix.target == 'grok'
+        run: |
+          curl -fsSL https://x.ai/cli/install.sh | GROK_BIN_DIR="$HOME/.grokbin" bash
+          echo "$HOME/.grokbin" >> "$GITHUB_PATH"
+
+      - name: Install GitHub Copilot CLI
+        if: matrix.target == 'github-copilot'
+        run: npm install -g @github/copilot
+
+      - name: Install Supabase plugin via plugins CLI
+        run: |
+          npx -y "plugins@${PLUGINS_CLI_VERSION}" add . --target "${{ matrix.target }}" --yes 2>&1 | tee install.log
+          grep -q "Installed" install.log
+
+  install-via-grok-cli:
+    # Verify the plugin also installs through Grok Build's own CLI
+    # (`grok plugin install`), independent of the plugins CLI. Grok natively
+    # prefers .grok-plugin/plugin.json.
+    #
+    # Kimi Code has no equivalent headless native install: `/plugins install` is
+    # an interactive TUI slash-command, and Kimi's only programmatic installer is
+    # the `plugins` CLI (covered above), which writes Kimi's native plugin store
+    # directly without invoking a `kimi` binary.
+    name: Install via native Grok CLI
+    runs-on: ubuntu-latest
+
+    env:
+      NO_COLOR: "1"
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install Grok Build CLI
+        run: |
+          curl -fsSL https://x.ai/cli/install.sh | GROK_BIN_DIR="$HOME/.grokbin" bash
+          echo "$HOME/.grokbin" >> "$GITHUB_PATH"
+
+      - name: Validate and install with grok plugin install
+        run: |
+          grok plugin validate .
+          grok plugin install . --trust 2>&1 | tee grok-install.log
+          grep -qi "supabase" grok-install.log
+          grok plugin list 2>&1 | tee grok-list.log
+          grep -qi "supabase" grok-list.log

AGENTS.md

@@ -16,17 +16,12 @@ Keep this repository focused on the shared multi-vendor plugin layout:
 - `.cursor-plugin/plugin.json` defines the Cursor plugin surface
 - `.codex-plugin/plugin.json` defines the Codex plugin surface
 - `.grok-plugin/plugin.json` defines the Grok Build plugin surface
-- `.kimi-plugin/plugin.json` defines the Kimi Code plugin surface (with its MCP server declared inline — see below)
+- `.kimi-plugin/plugin.json` defines the Kimi Code plugin surface (with its MCP server declared inline)
 - `.github/plugin/plugin.json` defines the GitHub Copilot plugin surface
 - `agents/claude/.mcp.json`, `agents/cursor/mcp.json`, `agents/grok/mcp.json`, `agents/codex/.app.json`, and `agents/copilot/.mcp.json` hold agent-specific MCP config files
 - `gemini-extension.json` defines the Gemini extension manifest
 - `skills/` contains the shipped, real skill files consumed by the supported plugin surfaces
 
-Two vendor-specific MCP notes:
-
-- **Grok Build** natively prefers `.grok-plugin/plugin.json` over `.claude-plugin/plugin.json` (verified against `grok` `v0.2.101`), so it gets its own manifest pointing at `agents/grok/mcp.json` (`X-Source-Name: grok-plugin`). This holds whether it is installed through the `plugins` CLI (which stages the whole repo) or via `grok plugin install`. Grok resolves the `mcpServers` file-path reference.
-- **Kimi Code is the one exception to the "MCP config lives in `agents/<vendor>/`" convention.** Kimi's plugin loader evaluates `mcpServers` as an inline object (`Object.entries(manifest.mcpServers)`), so a path string is iterated character-by-character and breaks — it cannot reference an external file. The Supabase MCP server (`X-Source-Name: kimi-plugin`) is therefore declared **inline** in `.kimi-plugin/plugin.json`, and there is intentionally no `agents/kimi/mcp.json`. When updating the shared MCP URL or headers, remember to edit the inline block in `.kimi-plugin/plugin.json` as well.
-
 This repo should stay self-contained. Claude marketplace installs copy the plugin into Claude's local cache, so paths outside the plugin root are fragile and should be avoided.
 
 ## Important Commands