Adopt Cache Components, retire dead surface area, and add CI

[leerob]

Summary

This PR lands the combined output of several parallel agent sessions on the directory app: a Vercel observability audit that turned into cost/bleeding fixes, a Cache Components (PPR) migration, a staff-level maintainability pass, and a CI baseline. It merges cleanly with main, reconciling the recently-merged owner menu (#405), slug preservation (#408), and scan sandbox fix (#409).

Why

Digging through Vercel observability, firewall, and logs surfaced concrete bleeding:

• The sync-ambassadors cron 500'd on all ~172 runs/week (stale Airtable credentials) — pure noise and wasted invocations.
• The legacy public rules API (/api, /api/[slug], /api/popular, /api/plugins/[slug]) and the npx install-plugin CLI have been hard-down since mid-February: bot protection serves challenge HTML to non-browser clients, and logs show zero successful consumers. Deleting beats carving firewall exceptions for unused endpoints.
• The homepage burned 3.57M ISR writes and 45.8 GB-hrs/week (7.6s p50 / 183s p99 renders): every plugin install called revalidatePath("/"), re-rendering a page that fetches all plugins.
• getSession() in shared components forced ~230K dynamic renders/week on /members, profiles, and /plugins/new — pages that are 95% static shell.
• /mcp/[slug] rendered ~57K times/week as a serverless function just to issue a redirect().

Separately, a maintainability review found the safe-action middleware logging every action's inputs/results (user PII) to stdout, an admin flag on the cookie-scoped Supabase client that made privilege escalation a one-liner, ~2,000 lines of orphaned dead code, two 800–1,000-line components, and 56 type errors on main — unsurprising, since nothing ran tsc or Biome.

What changed

Roughly one commit per workstream, in order:

1. Remove dead code — orphaned rules-era modules (subscribe form/action, rules search, save-rule button, videos dataset, ui/cursor.tsx, pricing/format utils, etc.); formatNumber callers consolidate on formatCount.
2. Remove the failing ambassadors cron + its route and AIRTABLE_* env docs.
3. Retire the legacy public API + install-plugin CLI (/api/members stays — the members page uses it).
4. Serve /mcp/[slug] as a permanent edge redirect via next.config.mjs (excludes /mcp/new; can't match /mcp/x/edit).
5. Stop logging action payloads; split the privileged Supabase client — failures-only logging (action name + error), and utils/supabase/server can no longer escalate: service-role access lives solely in admin-client with documented responsibilities.
6. Extract shared plugin types and split oversized components — lib/plugins/types.ts is the single source for plugin domain types/schemas (queries, scanner, actions, and admin UI used to re-declare drifting copies); plugin-detail.tsx (1,020 lines) splits into focused plugins/detail/* modules; the duplicated draft-component editor moves to forms/component-draft-editor.tsx; hand-rolled pagination loops collapse into fetchAllPages.
7. Adopt Cache Components (cacheComponents: true) —
   • Public reads in data/queries.ts get "use cache" + cacheLife + entity tags (plugins, plugin-{slug}, users, followers-{id}, stars-{userId}, …). Viewer-scoped reads (own profile, settings, admin) stay uncached.
   • Server actions invalidate tags instead of paths: updateTag for read-your-own-writes mutations, revalidateTag(…, "max") for counters (stars/installs) that can refresh in the background — an install no longer re-renders the homepage.
   • Pages move params/getSession() reads behind Suspense so shells prerender and only the personalized hole streams; Header/JoinCTA/ScrollToTop wrap their usePathname readers in Suspense.
   • OG image routes cache rendered PNG bytes (ImageResponse isn't serializable); scan drain/recover routes invalidate plugin tags when verdicts land.
8. Add CI — Biome + tsc --noEmit on every push/PR, and fix what it caught (stable React keys, unused state, the clickable-div upload control becomes a real button).

The merge commit reconciles with what landed on main meanwhile: ComponentDraft now carries stored slugs so the extracted editor preserves #408's fix (including parser-derived slugs in the create flow); getUserPlugins keeps #405's includeInactive with the owner variant uncached; the new owner-menu actions move from revalidatePath to updateTag so publish/unpublish/delete stay immediately visible.

Test plan

Verified locally:

• bunx biome ci . — clean (errors: 0)
• bun run typecheck — clean (was 56 errors on the pre-PR baseline)
• bun run build — passes: 3,343 pages, homepage fully static, every dynamic route shows ◐ (partial prerender), no route regressed to fully dynamic

Worth checking on the preview deploy:

• Homepage renders and search/leaderboard work; install a plugin and confirm the count updates without a full page rebuild
• Plugin detail: rules/MCP/skill tabs, Add to Cursor deeplinks, copy buttons
• Owner flows: edit a GitHub-imported plugin and save without changes → no slug churn, no needless rescan (Preserve stored component slugs in the plugin edit form #408 regression check); publish/unpublish/delete from the owner menu → change visible immediately
• Star a plugin → starred list on your profile updates immediately
• /mcp/<some-slug> 308s to /plugins/mcp-<some-slug>; /mcp/new still serves the submission form
• OG images render for /, a plugin, a profile, a company
• /admin/plugins moderation queue loads (admin-gated, uncached)
• Profile pages stream in behind the static shell (header nav fallback shouldn't flash)

Caveats

• Local builds need the current Supabase publishable key (the keys in older .env.local files were rotated; grab the sb_publishable_… key from the dashboard).
• The homepage now has a ~5-minute revalidate window via getTotalUsers; event-driven tags handle everything plugin-related.
• Non-owners visiting another user's /u/[slug]/settings now see "User not found" instead of a redirect.
• No alerting was added for cron failures (the ambassadors cron failed silently 172×/week for months) — worth a follow-up.

Made with Cursor

---

Note

Medium Risk
Broad caching and invalidation changes affect how quickly listings, profiles, and moderation state update site-wide; mis-tagged cache entries could show stale plugin or user data until invalidation runs.

Overview
Adopts Next.js Cache Components (cacheComponents: true) so public reads cache with entity tags (plugins, plugin-{slug}, users, etc.) and server actions invalidate via updateTag / revalidateTag instead of revalidatePath("/")—so installs, stars, and moderation no longer force full homepage rebuilds.

Removes dead or failing surface area: legacy public rules/plugin JSON APIs, the install-plugin CLI consumers, the Airtable ambassadors cron (and env docs), subscribeAction, and assorted unused UI/utils. /mcp/:slug becomes a config redirect to /plugins/mcp-:slug (excluding new / edit routes).

Hardens ops and DX: GitHub CI runs Biome + typecheck; safe-action middleware logs failures only (no client inputs/results). Plugin domain types and componentInputSchema move to lib/plugins/types; plugin detail and forms split into plugins/detail/* and component-draft-editor.

Rendering model: homepage, members, sitemap, and OG images use "use cache"; auth-, admin-, and owner-gated content streams behind Suspense; header/nav/CTA wrap usePathname readers; scan drain invalidates plugin tags when scans finish.

^{Reviewed by Cursor Bugbot for commit d8d2c03. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cursor-directory	Ready	Preview, Comment	Jun 9, 2026 1:29pm

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Rescan leaves plugin cache stale
  • rescanPluginAction now selects the slug and calls updateTag("plugins") and updateTag(plugin-${slug}) (previously it only revalidated the admin path, leaving the public detail page stale), and updateMCPListingAction now also invalidates mcp-${slug} to match toggleMCPListingAction.
• ✅ Fixed: Follow skips members list tag
  • toggleFollowAction now also calls updateTag("users") so the members directory cached under the users tag refreshes its follower_count after a follow or unfollow.

Or push these changes by commenting:

@cursor push 5f7ed45f42

Preview (5f7ed45f42)

diff --git a/apps/cursor/src/actions/review-flagged-plugin.ts b/apps/cursor/src/actions/review-flagged-plugin.ts
--- a/apps/cursor/src/actions/review-flagged-plugin.ts
+++ b/apps/cursor/src/actions/review-flagged-plugin.ts
@@ -76,14 +76,16 @@
   .action(async ({ parsedInput: { pluginId } }) => {
     const supabase = await createClient();
 
-    const { error: resetError } = await supabase
+    const { data: plugin, error: resetError } = await supabase
       .from("plugins")
       .update({ scan_status: "pending" })
-      .eq("id", pluginId);
+      .eq("id", pluginId)
+      .select("slug")
+      .single();
 
-    if (resetError) {
+    if (resetError || !plugin) {
       throw new ActionError(
-        `Failed to reset scan state: ${resetError.message}`,
+        `Failed to reset scan state: ${resetError?.message ?? "not found"}`,
       );
     }
 
@@ -97,5 +99,7 @@
     }
 
     revalidatePath("/admin/plugins");
+    updateTag("plugins");
+    updateTag(`plugin-${plugin.slug}`);
     return { success: true };
   });

diff --git a/apps/cursor/src/actions/toggle-follow-action.ts b/apps/cursor/src/actions/toggle-follow-action.ts
--- a/apps/cursor/src/actions/toggle-follow-action.ts
+++ b/apps/cursor/src/actions/toggle-follow-action.ts
@@ -24,8 +24,10 @@
       const supabase = await createClient();
 
       const invalidate = () => {
-        // Profile follower counts, the followed user's followers list, and
-        // the current user's following list must all reflect the change.
+        // Profile follower counts, the members directory's cached follower
+        // counts, the followed user's followers list, and the current user's
+        // following list must all reflect the change.
+        updateTag("users");
         updateTag(`user-${slug}`);
         updateTag(`followers-${userId}`);
         updateTag(`following-${currentUserId}`);

diff --git a/apps/cursor/src/actions/update-mcp-listing.ts b/apps/cursor/src/actions/update-mcp-listing.ts
--- a/apps/cursor/src/actions/update-mcp-listing.ts
+++ b/apps/cursor/src/actions/update-mcp-listing.ts
@@ -39,7 +39,7 @@
         })
         .eq("id", id)
         .eq("owner_id", userId)
-        .select("id")
+        .select("id, slug")
         .single();
 
       if (error) {
@@ -47,6 +47,7 @@
       }
 
       updateTag("mcps");
+      updateTag(`mcp-${data.slug}`);
 
       return data;
     },

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Rescan pending not cache-flushed
  • Moved the revalidatePath/updateTag cache invalidation to run immediately after the scan_status='pending' DB update commits and before the enqueue try-catch, so a queue failure can no longer leave cached views showing the stale status.

Or push these changes by commenting:

@cursor push 4e48bb73d7

Preview (4e48bb73d7)

diff --git a/apps/cursor/src/actions/review-flagged-plugin.ts b/apps/cursor/src/actions/review-flagged-plugin.ts
--- a/apps/cursor/src/actions/review-flagged-plugin.ts
+++ b/apps/cursor/src/actions/review-flagged-plugin.ts
@@ -89,6 +89,14 @@
       );
     }
 
+    // The status reset must reach cached readers (detail banner, leaderboard)
+    // right away, so invalidate before enqueueing — a queue failure must not
+    // leave cached views showing the stale status when the row is already
+    // pending. The drain route only invalidates again once the scan ends.
+    revalidatePath("/admin/plugins");
+    updateTag("plugins");
+    updateTag(`plugin-${plugin.slug}`);
+
     try {
       await enqueuePluginScan(pluginId);
       kickDrainAfterResponse();
@@ -98,10 +106,5 @@
       );
     }
 
-    revalidatePath("/admin/plugins");
-    // The status reset must reach cached readers (detail banner, leaderboard)
-    // right away; the drain route only invalidates again once the scan ends.
-    updateTag("plugins");
-    updateTag(`plugin-${plugin.slug}`);
     return { success: true };
   });

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 9834409. Configure here.}

[leerob]

@cursor push 4e48bb7