Prepare the Claude plugin directory package

claude-code/.claude-plugin/plugin.json

@@ -11,6 +11,10 @@
   "homepage": "https://spacefast.com",
   "repository": "https://github.com/spacefast/plugins",
   "license": "MIT",
-  "keywords": ["spacefast", "publish-to-spacefast", "artifact-sharing", "hosting"],
-  "icon": "./assets/logo.png"
+  "keywords": [
+    "spacefast",
+    "publish-to-spacefast",
+    "artifact-sharing",
+    "hosting"
+  ]
 }

claude-code/README.md

@@ -1,5 +1,7 @@
 # Spacefast for Claude Code
 
+![Spacefast](assets/logo.png)
+
 Publish local files and manage Spacefast spaces without leaving Claude Code. The plugin adds 10 task skills and setup, linked-project and design verification hooks, and one hosted HTTP MCP connection.
 
 ## Install
@@ -42,11 +44,26 @@ These hooks are advisory. They do not run the skill, block the pending call, or
 change its arguments or approvals. The agent can read a tool-call reminder after
 the call runs. Shell wrappers may not be recognized.
 
-Manually installed Codex plugins include the hooks. Review and trust new or changed
-definitions with `/hooks` before relying on them; installation does not grant trust.
-The OpenAI public-directory package includes the skill guidance but no lifecycle hooks.
-See [Codex hooks](https://learn.chatgpt.com/docs/hooks) and
-[plugin packaging](https://developers.openai.com/plugins/build/plugins#bundled-mcp-servers-and-lifecycle-hooks).
+## Data handling
+
+Spacefast is developed by Automattic Inc. The hosted MCP connection sends the content and account
+data needed for your requested task to `https://mcp.spacefast.com` over HTTPS. Spacefast reads and stores
+the files, source code, and other content you choose to publish or manage. This content can
+include personal data. Account and team features also use profile information such as names
+and email addresses. Claude manages its OAuth credentials; the plugin does not bundle them.
+
+If you choose to use the optional CLI, it sends API requests to `https://api.spacefast.com`
+and uploads your selected files to the destinations returned by that API. The hooks only read
+local project metadata and tool input to show reminders. They do not send data over the network.
+CLI transfers happen outside the declared MCP connection. Published content is served according
+to the Space's access settings.
+
+Content and account data can remain longer than 30 days. Deleting a Space takes it offline;
+its content remains until Spacefast purges it. CLI install and setup telemetry goes to
+`https://api.spacefast.com/v1/events` and has the separate retention periods and opt-outs below.
+
+See the [privacy policy](https://automattic.com/privacy/), [terms of service](https://wordpress.com/tos/),
+and [support page](https://automattic.com/contact/).
 
 ## Telemetry
 

claude-code/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${GROK_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/hooks/session-start.mjs\""
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session-start.mjs\""
           }
         ]
       }
@@ -17,7 +17,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${GROK_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/hooks/design-reminder.mjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/design-reminder.mjs\"",
             "timeout": 5
           }
         ]

claude-code/skills/build-website/references.md

@@ -87,7 +87,7 @@ If you cannot resolve the requested team or follow the requested publishing meth
 
 If the user requests the Spacefast plugin or MCP, publish through the connected MCP tools. Do not install or sign in to the CLI for that request. If MCP cannot publish the artifact, report the limitation and ask before changing the publishing method.
 Otherwise, with shell access on the user's computer, an already installed and signed-in `sf` CLI can publish local files. A chat app or remote sandbox uses the MCP tools instead.
-Run `sf --version`. If it is missing, explain that the optional CLI can be installed with `curl -fsSL https://spacefast.com/install.sh | bash`, or `irm https://spacefast.com/install.ps1 | iex` in Windows PowerShell. Run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
+Run `sf --version`. If it is missing, explain that CLI setup is optional and link to the [CLI installation guide](https://spacefast.com/docs/cli). Read that guide and run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
 Run `sf whoami` before using the CLI. If it reports `auth_required`, explain that `cli_login` can give the CLI this MCP connection's account access, and call it only when the user explicitly requests that handoff. The handoff link works once and expires after five minutes; the resulting CLI login remains bounded by the connection's grant and stops when the user disconnects Spacefast.
 After a requested handoff, explain what was authorized, run the returned command, and verify with `sf whoami`. Do not hide sign-in links from the user. For ordinary interactive sign-in, run `sf login` when requested and show its sign-in link.
 Publish with `sf publish <path> --json`. For a requested destination team, add `--team <teamId>`. CLI and MCP credentials can authorize different teams, even for the same account. Do not assume their team access matches. The CLI reads the files from disk. The MCP publish tool with inline files sends each file through this conversation, so it is slow and has size limits. To update a known Space that the project does not link, add `--space <spaceId>`.

claude-code/skills/edit-space/references.md

@@ -217,7 +217,7 @@ If you cannot resolve the requested team or follow the requested publishing meth
 
 If the user requests the Spacefast plugin or MCP, publish through the connected MCP tools. Do not install or sign in to the CLI for that request. If MCP cannot publish the artifact, report the limitation and ask before changing the publishing method.
 Otherwise, with shell access on the user's computer, an already installed and signed-in `sf` CLI can publish local files. A chat app or remote sandbox uses the MCP tools instead.
-Run `sf --version`. If it is missing, explain that the optional CLI can be installed with `curl -fsSL https://spacefast.com/install.sh | bash`, or `irm https://spacefast.com/install.ps1 | iex` in Windows PowerShell. Run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
+Run `sf --version`. If it is missing, explain that CLI setup is optional and link to the [CLI installation guide](https://spacefast.com/docs/cli). Read that guide and run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
 Run `sf whoami` before using the CLI. If it reports `auth_required`, explain that `cli_login` can give the CLI this MCP connection's account access, and call it only when the user explicitly requests that handoff. The handoff link works once and expires after five minutes; the resulting CLI login remains bounded by the connection's grant and stops when the user disconnects Spacefast.
 After a requested handoff, explain what was authorized, run the returned command, and verify with `sf whoami`. Do not hide sign-in links from the user. For ordinary interactive sign-in, run `sf login` when requested and show its sign-in link.
 Publish with `sf publish <path> --json`. For a requested destination team, add `--team <teamId>`. CLI and MCP credentials can authorize different teams, even for the same account. Do not assume their team access matches. The CLI reads the files from disk. The MCP publish tool with inline files sends each file through this conversation, so it is slow and has size limits. To update a known Space that the project does not link, add `--space <spaceId>`.

claude-code/skills/fix-deployment/references.md

@@ -160,7 +160,7 @@ If you cannot resolve the requested team or follow the requested publishing meth
 
 If the user requests the Spacefast plugin or MCP, publish through the connected MCP tools. Do not install or sign in to the CLI for that request. If MCP cannot publish the artifact, report the limitation and ask before changing the publishing method.
 Otherwise, with shell access on the user's computer, an already installed and signed-in `sf` CLI can publish local files. A chat app or remote sandbox uses the MCP tools instead.
-Run `sf --version`. If it is missing, explain that the optional CLI can be installed with `curl -fsSL https://spacefast.com/install.sh | bash`, or `irm https://spacefast.com/install.ps1 | iex` in Windows PowerShell. Run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
+Run `sf --version`. If it is missing, explain that CLI setup is optional and link to the [CLI installation guide](https://spacefast.com/docs/cli). Read that guide and run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
 Run `sf whoami` before using the CLI. If it reports `auth_required`, explain that `cli_login` can give the CLI this MCP connection's account access, and call it only when the user explicitly requests that handoff. The handoff link works once and expires after five minutes; the resulting CLI login remains bounded by the connection's grant and stops when the user disconnects Spacefast.
 After a requested handoff, explain what was authorized, run the returned command, and verify with `sf whoami`. Do not hide sign-in links from the user. For ordinary interactive sign-in, run `sf login` when requested and show its sign-in link.
 Publish with `sf publish <path> --json`. For a requested destination team, add `--team <teamId>`. CLI and MCP credentials can authorize different teams, even for the same account. Do not assume their team access matches. The CLI reads the files from disk. The MCP publish tool with inline files sends each file through this conversation, so it is slow and has size limits. To update a known Space that the project does not link, add `--space <spaceId>`.

claude-code/skills/spacefast/references.md

@@ -87,7 +87,7 @@ If you cannot resolve the requested team or follow the requested publishing meth
 
 If the user requests the Spacefast plugin or MCP, publish through the connected MCP tools. Do not install or sign in to the CLI for that request. If MCP cannot publish the artifact, report the limitation and ask before changing the publishing method.
 Otherwise, with shell access on the user's computer, an already installed and signed-in `sf` CLI can publish local files. A chat app or remote sandbox uses the MCP tools instead.
-Run `sf --version`. If it is missing, explain that the optional CLI can be installed with `curl -fsSL https://spacefast.com/install.sh | bash`, or `irm https://spacefast.com/install.ps1 | iex` in Windows PowerShell. Run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
+Run `sf --version`. If it is missing, explain that CLI setup is optional and link to the [CLI installation guide](https://spacefast.com/docs/cli). Read that guide and run an installer, update, or `npx` download only when the user explicitly asks for that setup. A publish request alone does not authorize installing software. Otherwise use the connected MCP tools.
 Run `sf whoami` before using the CLI. If it reports `auth_required`, explain that `cli_login` can give the CLI this MCP connection's account access, and call it only when the user explicitly requests that handoff. The handoff link works once and expires after five minutes; the resulting CLI login remains bounded by the connection's grant and stops when the user disconnects Spacefast.
 After a requested handoff, explain what was authorized, run the returned command, and verify with `sf whoami`. Do not hide sign-in links from the user. For ordinary interactive sign-in, run `sf login` when requested and show its sign-in link.
 Publish with `sf publish <path> --json`. For a requested destination team, add `--team <teamId>`. CLI and MCP credentials can authorize different teams, even for the same account. Do not assume their team access matches. The CLI reads the files from disk. The MCP publish tool with inline files sends each file through this conversation, so it is slow and has size limits. To update a known Space that the project does not link, add `--space <spaceId>`.