review: address PR #11 follow-ups (drop debug logs, centralize MCP_VERSION)

Addresses apappascs review on #11.
- Remove debug `console.log` calls from `incrementOps()` and
`window.onmessage` in `ui-entry.ts`. The instrumentation served its
purpose; shipping verbose runtime logging in a polish PR was wrong.
- Centralize the `pluginos@<version>` pin via build-time injection. The
webpack config now reads `mcp-server/package.json#version` and passes
it into the UI bundle (DefinePlugin → `__MCP_VERSION__`) and into
`bootloader.html` (`templateParameters` → `<%= MCP_VERSION %>`).
Drift becomes impossible because `package.json` is the single source.
- Drop the regex sweep in `scripts/bump-lockstep.cjs` over `ui-entry.ts`
and `bootloader.html` — no longer needed, those files are templated.
- Drop the 2-line `constants.ts` shim. With `resolveJsonModule: true`,
`ui-entry.ts` imports `DXT_URL` directly from `constants.json`.
- README: add a one-line nudge above the `<details>` install block so
Cursor / Claude Code CLI users do not skim past the collapsed section.
- ESLint: ignore `.claude/` and `.worktrees/` (parallels `.prettierignore`)
so nested Claude Code session worktrees do not poison `npm run lint`.
Items 4 and 6 from the review (TIER_1_RULES / INSTALL_COMMAND dedup
and bootloader theme-token drift) are deferred to a follow-up issue
since both span this PR's scope.
Verification: `npm run check` ✅ (lint + format + build:shared +
typecheck + build + test). Built `dist/bootloader.html` and `dist/ui.html`
both contain the literal `pluginos@0.4.2` from `mcp-server/package.json`.

Author: LSDimi

README.md

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

eslint.config.js

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

packages/bridge-plugin/src/bootloader.html

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

packages/bridge-plugin/src/constants.ts

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

packages/bridge-plugin/src/ui-entry.ts

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

packages/bridge-plugin/webpack.config.js

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

scripts/bump-lockstep.cjs

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

README.md

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

eslint.config.js

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

packages/bridge-plugin/src/bootloader.html

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

packages/bridge-plugin/src/constants.ts

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

packages/bridge-plugin/src/ui-entry.ts

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

packages/bridge-plugin/webpack.config.js

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

scripts/bump-lockstep.cjs

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

README.md

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

eslint.config.js

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

packages/bridge-plugin/src/bootloader.html

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

packages/bridge-plugin/src/constants.ts

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

packages/bridge-plugin/src/ui-entry.ts

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

packages/bridge-plugin/webpack.config.js

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

scripts/bump-lockstep.cjs

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

README.md

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

eslint.config.js

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

packages/bridge-plugin/src/bootloader.html

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

packages/bridge-plugin/src/constants.ts

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

packages/bridge-plugin/src/ui-entry.ts

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

packages/bridge-plugin/webpack.config.js

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

scripts/bump-lockstep.cjs

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

README.md

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

eslint.config.js

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

packages/bridge-plugin/src/bootloader.html

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

packages/bridge-plugin/src/constants.ts

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

packages/bridge-plugin/src/ui-entry.ts

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

packages/bridge-plugin/webpack.config.js

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

scripts/bump-lockstep.cjs

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

README.md

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

eslint.config.js

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

packages/bridge-plugin/src/bootloader.html

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

packages/bridge-plugin/src/constants.ts

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

packages/bridge-plugin/src/ui-entry.ts

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

packages/bridge-plugin/webpack.config.js

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

scripts/bump-lockstep.cjs

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}

README.md

@@ -30,6 +30,8 @@ PluginOS takes a fundamentally different approach:
 
 No JSON editing, no terminal. Note: Claude.ai web is **not** supported — it cannot reach local MCP servers.
 
+Using Cursor or Claude Code CLI? Open the section below for the right config.
+
 <details>
 <summary><strong>Other AI tools</strong> (Cursor, Claude Code CLI, manual config)</summary>
 

eslint.config.js

@@ -14,6 +14,8 @@ export default tseslint.config(
 "**/*.cjs",
 "**/*.mjs",
 "!eslint.config.js",
+".claude/",
+".worktrees/",
 ],
 },
 {

packages/bridge-plugin/src/bootloader.html

@@ -143,7 +143,7 @@
 },1000);
 }
 
-varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@0.4.2"]}}},null,2);
+varMCP_CONFIG_JSON=JSON.stringify({mcpServers: {pluginos: {command: "npx",args: ["-y","pluginos@<%= MCP_VERSION %>"]}}},null,2);
 varTIER_1_RULES="When working with Figma, always use PluginOS tools exclusively:\n- Use `list_operations` (pluginos) first to discover available Figma operations.\n- Use `run_operation` (pluginos) to execute them.\n- Use `execute_figma` (pluginos) only for one-off custom logic not covered by built-in ops.\n- Do NOT use `mcp__Figma__*` tools — they bypass the plugin and return raw, token-heavy data. PluginOS returns pre-summarized, structured results at ~230 tokens/call.\n- If PluginOS returns \"No plugin connected\", open the PluginOS Bridge plugin in Figma before retrying.\n\nAudit/lint/check operations default to `scope: \"selection\"`. Pass `scope: \"page\"` explicitly (and `confirm: true` for pages over 500 nodes) to scan the whole page. Responses carry `_hint` and `_next_hints` fields — respect them when deciding what to do next.";
 varINSTALL_COMMAND="/plugin marketplace add github:LSDimi/pluginos\n/plugin install pluginos";
 varDXT_URL="<%= DXT_URL %>";

packages/bridge-plugin/src/constants.ts

@@ -1,4 +1,6 @@
-import{DXT_URL}from"./constants";
+import{DXT_URL}from"./constants.json";
+
+declareconst__MCP_VERSION__: string;
 
 constTIER_1_RULES=`When working with Figma, always use PluginOS tools exclusively:
 - Use \`list_operations\` (pluginos) first to discover available Figma operations.
@@ -13,7 +15,7 @@ const MCP_CONFIG_JSON = `{
  "mcpServers": {
  "pluginos": {
  "command": "npx",
- "args": ["-y", "pluginos@0.4.2"]
+ "args": ["-y", "pluginos@${__MCP_VERSION__}"]
  }
  }
 }`;
@@ -189,8 +191,6 @@ function updateFilename(name: string) {
 
 functionincrementOps(){
 opsRunCount++;
-// eslint-disable-next-line no-console
-console.log("[pluginos:debug] incrementOps called, count="+opsRunCount);
 constel=$("ops-run-count");
 if(el)el.textContent=opsRunCount+" ops run";
 }
@@ -307,10 +307,6 @@ document
 window.onmessage=(event: MessageEvent)=>{
 constmsg=event.data.pluginMessage;
 if(!msg)return;
-// eslint-disable-next-line no-console
-console.log(
-"[pluginos:debug] window.onmessage type="+msg.type+" payload.type="+msg?.payload?.type
-);
 
 if(msg.type==="__ui_list_operations_result"){
 renderOpsPanel(msg.operations);

packages/bridge-plugin/src/ui-entry.ts

@@ -1,8 +1,10 @@
 constpath=require("path");
+constwebpack=require("webpack");
 constHtmlWebpackPlugin=require("html-webpack-plugin");
 constHtmlInlineScriptPlugin=require("html-inline-script-webpack-plugin");
 
 const{DXT_URL}=require("./src/constants.json");
+const{version: MCP_VERSION}=require("../mcp-server/package.json");
 
 constnoModernSyntax={
 arrowFunction: true,
@@ -43,6 +45,9 @@ module.exports = (env, argv) => [
 resolve: {extensions: [".ts",".js"]},
 devtool: false,
 plugins: [
+newwebpack.DefinePlugin({
+__MCP_VERSION__: JSON.stringify(MCP_VERSION),
+}),
 newHtmlWebpackPlugin({
 template: "./src/ui.html",
 filename: "ui.html",
@@ -62,7 +67,7 @@ module.exports = (env, argv) => [
 template: "./src/bootloader.html",
 filename: "bootloader.html",
 inject: false,
-templateParameters: {DXT_URL},
+templateParameters: {DXT_URL,MCP_VERSION},
 }),
 ],
 mode: argv.mode||"production",

packages/bridge-plugin/webpack.config.js

@@ -2,9 +2,12 @@
 /**
  * Postversion hook for packages/mcp-server. When `npm version` bumps the
  * MCP server, propagate the same version string to every file that pins the
- * pluginos version: peer package.json manifests, the DXT manifest (both the
- * top-level `version` and its `server.mcp_config.args` pin), and the
- * hardcoded npx args inside the Figma plugin's UI sources.
+ * pluginos version: peer package.json manifests and the DXT manifest (both
+ * the top-level `version` and its `server.mcp_config.args` pin).
+ *
+ * Note: the Figma plugin UI (`bridge-plugin/src/ui-entry.ts` and
+ * `bootloader.html`) reads `mcp-server/package.json#version` at webpack
+ * build time, so no source-file rewrite is needed there.
  */
 constfs=require("node:fs");
 constpath=require("node:path");
@@ -40,20 +43,3 @@ if (Array.isArray(dxt?.server?.mcp_config?.args)) {
 }
 fs.writeFileSync(dxtAbs,JSON.stringify(dxt,null,2)+"\n");
 console.log(`Bumped ${dxtManifestRel} → ${newVersion}`);
-
-// Sources that hardcode `pluginos@<version>` in copy-paste MCP config snippets.
-// These use a regex swap so formatting is preserved.
-constsourceTargets=[
-"packages/bridge-plugin/src/ui-entry.ts",
-"packages/bridge-plugin/src/bootloader.html",
-];
-
-for(constrelofsourceTargets){
-constabs=path.join(repoRoot,rel);
-constbefore=fs.readFileSync(abs,"utf8");
-constafter=before.replace(/pluginos@\d+\.\d+\.\d+/g,`pluginos@${newVersion}`);
-if(after!==before){
-fs.writeFileSync(abs,after);
-console.log(`Bumped ${rel} → pluginos@${newVersion}`);
-}
-}