Bug Report: Marketplace scanner ignores .plugin/plugin.json manifest and custom component paths

[Narrator]

Summary

The Cursor marketplace "Scan repo" feature only checks hardcoded root-level paths for plugin components. It does not read .plugin/plugin.json (or .cursor-plugin/plugin.json) to discover components at custom paths declared via manifest fields like "skills" or inline "mcpServers". This breaks monorepo plugins that follow the Open Plugins specification.

Environment

• Cursor marketplace: Submit a Plugin → Auto (GitHub) → Scan repo
• Repo: https://github.com/patchorbit/domscribe

Steps to reproduce

1. Create a valid plugin with .plugin/plugin.json that declares custom component paths:

   {
     "name": "domscribe",
     "version": "0.4.0",
     "skills": "./packages/domscribe-relay/src/skills",
     "mcpServers": {
       "domscribe": {
         "type": "stdio",
         "command": "npx",
         "args": ["-y", "@domscribe/mcp"]
       }
     }
   }

2. Place the skill at the declared path: packages/domscribe-relay/src/skills/domscribe/SKILL.md
3. Go to Cursor marketplace → Submit a Plugin → Auto (GitHub)
4. Enter the repo URL and click "Scan repo"

Result:

No plugin components found in: repo root. We looked for: rules/.mdc, .mcp.json or mcp.json, skills//SKILL.md, agents/.md, commands/.md, hooks/hooks.json, .lsp.json. Make sure your repo follows the Open Plugins standard (https://open-plugins.com).

Expected behavior

The scanner should:

1. Check for .plugin/plugin.json (or .cursor-plugin/plugin.json) at the repo root
2. Read the manifest's component fields (skills, mcpServers, agents, commands, rules, hooks)
3. Resolve custom paths declared in those fields (e.g., "skills": "./packages/domscribe-relay/src/skills")
4. Discover components at the resolved paths

Then fall back to the default root-level paths only for components not declared in the manifest.

Actual behavior

The scanner skips manifest discovery entirely and only checks hardcoded default paths at the repo root.

Impact

• Monorepo plugins that declare custom component paths via plugin.json cannot be submitted via the auto-detect flow
• Inline mcpServers in plugin.json are not detected (the scanner only checks .mcp.json / mcp.json files)
• This contradicts the Open Plugins spec, which explicitly supports custom paths in the manifest

References

• Open Plugins specification — defines .plugin/plugin.json as a valid manifest location and supports custom component paths via manifest fields
• The spec states component fields accept string paths ("./custom/skills/"), arrays, or objects with "exclusive": true