Replace Vercel Workflow with Supabase Queues + duplicate detection

[pontusab]

Summary

• Moves the plugin security scan off the workflow package onto a Postgres-native pgmq queue drained by a 1-min Vercel cron (/api/queue/plugin-scans/drain, maxDuration=800s, VT=900s, bury after 5 attempts). The Workflow runtime has been unreliable in prod; this replaces it with infrastructure we already operate.
• Server actions now enqueuePluginScan(...) and fire a non-blocking after() kick at the drain route, so freshly submitted plugins start scanning within milliseconds. The cron is the durability/retry safety net.
• Adds duplicate detection in the same flow: find_similar_plugins RPC (pg_trgm @ 0.7) surfaces the top 5 active plugins with similar names; the scan agent gets them in a POTENTIAL DUPLICATES prompt section and decides whether to flag as low_quality / spam / impersonation.
• Cleanup: drops workflow, the @workflow/world@4.1.1 Bun patch, withWorkflow in next.config.mjs, the workflow TS plugin, and src/workflows/.

Migrations applied

• 20260515_plugin_scan_queue.sql — creates the plugin_scans queue and locks pgmq_public.* EXECUTE down to service_role (closes the default-open PUBLIC/anon/authenticated grants).
• 20260515_plugin_similar_search.sql — enables pg_trgm, GIN trigram index on plugins.name, find_similar_plugins(uuid, real, int) RPC granted only to service_role.

Both already applied to the live Cursor Directory project; pushing the branch is a no-op for the database.

---

Note

Medium Risk
Changes the production plugin security scanning pipeline and its retry/bury semantics, which can affect plugin publishing/flagging behavior and background job reliability. Also introduces new database migrations and cron-driven queue draining that depend on correct env/permissions.

Overview
Replaces the plugin security scan execution backend from the workflow package to a Supabase pgmq queue (plugin_scans) drained by a new /api/queue/plugin-scans/drain route (cron every minute) with VT-based retries and bury-after-5 behavior.

Updates all scan entry points (plugin submit/insert, update, admin rescan, and stuck-scan recovery cron) to enqueuePluginScan(...) and optionally kickDrainAfterResponse() for near-immediate processing outside the request lifecycle.

Enhances scan logic by adding duplicate-candidate detection via a new find_similar_plugins RPC (pg_trgm + GIN index) and passing those candidates into the Cursor agent prompt, while also introducing clearer fatal-vs-retryable error handling (FatalScanError) and queue permission hardening migrations for pgmq_public.

^{Reviewed by Cursor Bugbot for commit b99b94e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cursor-directory	Ready	Preview, Comment	May 15, 2026 8:24am

[cursor]

Cursor Bugbot has reviewed your changes using high mode and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b99b94e. Configure here.}