review: address PR #11 follow-ups (drop debug logs, centralize MCP_VERSION)

Addresses apappascs review on #11.

- Remove debug `console.log` calls from `incrementOps()` and
  `window.onmessage` in `ui-entry.ts`. The instrumentation served its
  purpose; shipping verbose runtime logging in a polish PR was wrong.
- Centralize the `pluginos@<version>` pin via build-time injection. The
  webpack config now reads `mcp-server/package.json#version` and passes
  it into the UI bundle (DefinePlugin → `__MCP_VERSION__`) and into
  `bootloader.html` (`templateParameters` → `<%= MCP_VERSION %>`).
  Drift becomes impossible because `package.json` is the single source.
- Drop the regex sweep in `scripts/bump-lockstep.cjs` over `ui-entry.ts`
  and `bootloader.html` — no longer needed, those files are templated.
- Drop the 2-line `constants.ts` shim. With `resolveJsonModule: true`,
  `ui-entry.ts` imports `DXT_URL` directly from `constants.json`.
- README: add a one-line nudge above the `<details>` install block so
  Cursor / Claude Code CLI users do not skim past the collapsed section.
- ESLint: ignore `.claude/` and `.worktrees/` (parallels `.prettierignore`)
  so nested Claude Code session worktrees do not poison `npm run lint`.

Items 4 and 6 from the review (TIER_1_RULES / INSTALL_COMMAND dedup
and bootloader theme-token drift) are deferred to a follow-up issue
since both span this PR's scope.

Verification: `npm run check` ✅ (lint + format + build:shared +
typecheck + build + test). Built `dist/bootloader.html` and `dist/ui.html`
both contain the literal `pluginos@0.4.2` from `mcp-server/package.json`.

Author: LSDimi

README.md

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

eslint.config.js

@@ -14,6 +14,8 @@ export default tseslint.config(
       "**/*.cjs",
       "**/*.mjs",
       "!eslint.config.js",
+      ".claude/",
+      ".worktrees/",
     ],
   },
   {

packages/bridge-plugin/src/bootloader.html

@@ -143,7 +143,7 @@
       }, 1000);
     }
 
-    var MCP_CONFIG_JSON = JSON.stringify({ mcpServers: { pluginos: { command: "npx", args: ["-y", "pluginos@0.4.2"] } } }, null, 2);
+    var MCP_CONFIG_JSON = JSON.stringify({ mcpServers: { pluginos: { command: "npx", args: ["-y", "pluginos@<%= MCP_VERSION %>"] } } }, null, 2);
     var TIER_1_RULES = "When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
     var INSTALL_COMMAND = "/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
     var DXT_URL = "<%= DXT_URL %>";

packages/bridge-plugin/src/constants.ts

@@ -1,4 +1,6 @@
-import { DXT_URL } from "./constants";
+import { DXT_URL } from "./constants.json";
+
+declare const __MCP_VERSION__: string;
 
 const TIER_1_RULES = `When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
   "mcpServers": {
     "pluginos": {
       "command": "npx",
-      "args": ["-y", "pluginos@0.4.2"]
+      "args": ["-y", "pluginos@${__MCP_VERSION__}"]
     }
   }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 function incrementOps() {
   opsRunCount++;
-  // eslint-disable-next-line no-console
-  console.log("[pluginos:debug] incrementOps called, count=" + opsRunCount);
   const el = $("ops-run-count");
   if (el) el.textContent = opsRunCount + " ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage = (event: MessageEvent) => {
   const msg = event.data.pluginMessage;
   if (!msg) return;
-  // eslint-disable-next-line no-console
-  console.log(
-    "[pluginos:debug] window.onmessage type=" + msg.type + " payload.type=" + msg?.payload?.type
-  );
 
   if (msg.type === "__ui_list_operations_result") {
     renderOpsPanel(msg.operations);

packages/bridge-plugin/src/ui-entry.ts

@@ -1,8 +1,10 @@
 const path = require("path");
+const webpack = require("webpack");
 const HtmlWebpackPlugin = require("html-webpack-plugin");
 const HtmlInlineScriptPlugin = require("html-inline-script-webpack-plugin");
 
 const { DXT_URL } = require("./src/constants.json");
+const { version: MCP_VERSION } = require("../mcp-server/package.json");
 
 const noModernSyntax = {
   arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
     resolve: { extensions: [".ts", ".js"] },
     devtool: false,
     plugins: [
+      new webpack.DefinePlugin({
+        __MCP_VERSION__: JSON.stringify(MCP_VERSION),
+      }),
       new HtmlWebpackPlugin({
         template: "./src/ui.html",
         filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
         template: "./src/bootloader.html",
         filename: "bootloader.html",
         inject: false,
-        templateParameters: { DXT_URL },
+        templateParameters: { DXT_URL, MCP_VERSION },
       }),
     ],
     mode: argv.mode || "production",

packages/bridge-plugin/webpack.config.js

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 const fs = require("node:fs");
 const path = require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs, JSON.stringify(dxt, null, 2) + "\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-const sourceTargets = [
-  "packages/bridge-plugin/src/ui-entry.ts",
-  "packages/bridge-plugin/src/bootloader.html",
-];
-
-for (const rel of sourceTargets) {
-  const abs = path.join(repoRoot, rel);
-  const before = fs.readFileSync(abs, "utf8");
-  const after = before.replace(/pluginos@\d+\.\d+\.\d+/g, `pluginos@${newVersion}`);
-  if (after !== before) {
-    fs.writeFileSync(abs, after);
-    console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-  }
-}