Add plugin owner menu with publish, delete, and verification actions.

[pontusab]

Owners manage listings from a compact options menu with confirmation dialogs, and can delete published plugins after confirming in an alert dialog.

---

Note

Medium Risk
Introduces irreversible plugin deletion and listing visibility changes backed by owner checks; mistakes or authorization gaps would affect directory data and public listings.

Overview
Adds a plugin owner options menu on the edit page and plugin detail view, replacing the standalone Edit link with edit, verification request, publish/unpublish, and permanent delete (with dialog confirmations).

New authenticated server actions deletePluginAction and togglePluginListingAction enforce owner_id, block publishing when permanently_blocked, and revalidate listing paths after changes. VerifyControls is narrowed to admin-only approve/deny/mark verified; owner verification submission moves into the owner menu.

Profile and cards surface unpublished listings for the profile owner via getUserPlugins(..., { includeInactive: isOwner }) and an Unpublished badge on PluginCard. Owners see an unpublished banner on the detail page while content remains viewable; one-click install stays gated on active.

Adds alert-dialog UI (Radix) and a small DropdownMenuItem gap style tweak for icon+label rows.

^{Reviewed by Cursor Bugbot for commit 5e1c31e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cursor-directory	Ready	Preview, Comment	May 29, 2026 7:49am

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Publish ignores scan status
  • Publishing now requires the plugin scan status to be safe in both the server action and owner menu.
• ✅ Fixed: Missing null check after update
  • The update result now treats a missing returned row as a controlled ActionError before revalidation.

Or push these changes by commenting:

@cursor push fc22372b14

Preview (fc22372b14)

diff --git a/apps/cursor/src/actions/toggle-plugin-listing.ts b/apps/cursor/src/actions/toggle-plugin-listing.ts
--- a/apps/cursor/src/actions/toggle-plugin-listing.ts
+++ b/apps/cursor/src/actions/toggle-plugin-listing.ts
@@ -20,7 +20,7 @@
 
     const { data: existing, error: fetchError } = await supabase
       .from("plugins")
-      .select("id, owner_id, slug, permanently_blocked")
+      .select("id, owner_id, slug, permanently_blocked, scan_status")
       .eq("id", id)
       .single();
 
@@ -38,6 +38,12 @@
       );
     }
 
+    if (active && existing.scan_status !== "safe") {
+      throw new ActionError(
+        "This plugin cannot be published until the security scan passes.",
+      );
+    }
+
     const { data, error } = await supabase
       .from("plugins")
       .update({ active })
@@ -46,8 +52,8 @@
       .select("slug")
       .single();
 
-    if (error) {
-      throw new ActionError(error.message);
+    if (error || !data) {
+      throw new ActionError(error?.message ?? "Plugin not found.");
     }
 
     revalidatePath("/");

diff --git a/apps/cursor/src/components/plugins/plugin-owner-menu.tsx b/apps/cursor/src/components/plugins/plugin-owner-menu.tsx
--- a/apps/cursor/src/components/plugins/plugin-owner-menu.tsx
+++ b/apps/cursor/src/components/plugins/plugin-owner-menu.tsx
@@ -126,7 +126,8 @@
 
   const busy = isRequesting || isToggling || isDeleting;
   const canVerify = !plugin.verified && !requestPending;
-  const canPublish = !active && !plugin.permanently_blocked;
+  const canPublish =
+    !active && !plugin.permanently_blocked && plugin.scan_status === "safe";
 
   return (
     <>

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 5e1c31e. Configure here.}