fix: keep the bundle under 1 MiB and set directory listing links

[tnj]

Summary

Address two findings from validating the plugin folder in the Claude plugin directory portal after #87:

• Files or downloads the validator couldn't inspect (policy hold): "scripts/bundle.js (over the 1 MiB read limit)"
• Listing link or icon path not accepted (warning): "supportUrl "https://deploygate.com`." is not https:// or mailto:"

Bundle under 1 MiB

The bundle was 1,210,603 bytes. scripts/build-bundle.mjs now leaves out two parts of the dependencies that the server never uses. It stays unminified and readable.

• zod's non-English locales (about 280 KB). zod re-exports every error-message locale as z.locales, but it configures English itself (config(en())), and nothing switches locales. The build replaces zod/v4/locales/index.js with a module that re-exports only en.
• The MCP SDK's ajv validator (about 270 KB with its dependencies). On the server side, the SDK uses it only to validate form elicitation responses (elicitInput in server/index.js), and this server never elicits. The build replaces validation/ajv-provider.js with a validator that throws if it is ever used. A new test in plugin.test.ts checks that the server source doesn't use elicitation.

With the locked dependencies (zod 4.6.5, MCP SDK 1.32.0), the bundle drops to 781,077 bytes (0.74 MiB). Dropping the locales alone left it at 1,062,693 bytes, still over the limit.

• The bundle build now fails at 1 MiB. bundle-compat runs npm run bundle on every PR, so CI catches dependency growth before a release. If an SDK update moves either replaced file, the bundle grows and this check fails.
• plugin/scripts/bundle.js itself isn't committed here. The next release PR regenerates it, so the hold should clear on main once that release merges.

The pre-submission checklist mentions 256 KiB, but the validator reported a 1 MiB read limit. Staying under 1 MiB should let it read the bundle, which we'll confirm by validating again after the release.

Directory listing links

The directory reads listing links from plugin.json (manifest reference). Without them, it took a URL out of the README text, backtick included, and rejected it. plugin/.claude-plugin/plugin.json now sets these fields:

Field	Value
documentationUrl	https://github.com/DeployGate/deploygate-agent-plugin#readme
supportUrl	https://github.com/DeployGate/deploygate-agent-plugin/blob/main/SUPPORT.md
privacyPolicyUrl	https://deploygate.com/terms/privacy
termsOfServiceUrl	https://deploygate.com/terms

The privacy and terms URLs match the Codex manifest. The README's support section now matches SUPPORT.md: the Help Center for questions about the service, GitHub Issues for the plugin, and help@deploygate.com for security reports.

Findings left for the reviewer

• Uses a credential from the user's machine (8 findings): CI secrets such as DEPLOYGATE_API_TOKEN in the ci-setup references and the GitHub Actions templates. They run on the user's CI provider and go to deploygate.com, or to Apple for code signing. KEYCHAIN_PASSWORD is a temporary keychain password that stays on the CI runner.
• Scripts the validator couldn't follow: a Node server started from a plugin in a subfolder is always held.

Test plan

• npm run build && npm test with the locked dependencies (484 tests pass)
• npm run bundle produces a 781,077-byte bundle, and scripts/smoke-bundle.mjs passes (58 tools)
• Calling upload_app with invalid arguments on the trimmed bundle returns zod's English validation messages
• claude plugin validate ./plugin passes
• After the next release merges, run Validate in the portal again and confirm that the bundle and listing link findings are gone

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The changes consistently address the directory validation findings without introducing unresolved issues.

0 open findings

What changed in this PR

Adds safeguards and metadata needed for Claude plugin directory validation.

Changes:

• Trims unused Zod locales and enforces a 1 MiB bundle limit.
• Adds explicit directory listing URLs.
• Aligns support documentation and tests.

File	Description
scripts/​build-bundle.mjs	Keeps only Zod’s English locale and checks bundle size.
plugin/​.claude-plugin/​plugin.json	Adds directory listing URLs.
plugin/​README.md	Documents bundle limits and support channels.
src/​__tests__/​plugin.test.ts	Validates listing URL presence and HTTPS format.
CLAUDE.md	Documents the bundle-size convention.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The changes consistently address the reported validation findings with appropriate safeguards and documentation.

0 open findings

🧠 Review effort: Balanced