0.20.0: myna as a plugin, so an agent knows what posting costs

[ralyodio]

0.19.0 made myna a companion — cli-tools installs it, and the README
explains why a compiled binary with its runtime inside is not a bin/*.ts.
This adds the other half: the marketplace plugin, so an agent driving it
knows what a post costs before it makes one.

Eight commands: /myna:post, :schedule, :queue, :accounts, :feed,
:draft, :infographic, :mcp.

Like bo, it fronts a command this repo does not implement — except this is the
one it does install, so the plugin is purely judgement rather than a second
executable on PATH.

Written off the source, not the README

myna's README and its main.ts disagree in ways that matter when something
automated is holding the tool. The commands document the source:

• The default target is every account. settings.defaultTargets ships as
  all, so a post whose target does not resolve is not a no-op — it goes to
  every connected account across 26 networks.
• A comma list is not a positional target. myna post bluesky,mastodon "text" — the example in myna's own HELP string and README — does not split
  on the comma, so the literal string becomes the post text and it fans out to
  the default target. Only --to bluesky,mastodon works. Every example here
  uses --to.
• --dry-run is a target check, not a preview. It resolves accounts, prints
  them and stops; it does not tailor per network, count characters or load
  media. The commands point at the TUI compose screen and myna_preview over
  MCP for the real rendering instead.
• myna logout bluesky matches a network, not just an account, and
  disconnects every account on it with no confirmation.
• There is no myna mcp subcommand. MCP is the separate
  @profullstack/myna-mcp package, whose bin is a .ts with a bun shebang — so
  that path needs Bun even though the CLI does not.

Login stays the user's: it prompts field by field with no flag or environment
variable behind any of them, and writes a live token into a vault this repo
never reads. Same line the companion entry draws.

Also

• README: myna and the previously-omitted ai added to the plugin list, and
  the "fronts a command this repo does not install" paragraph now distinguishes
  the two cases.
• Version 0.19.0 → 0.20.0.

Checks

• vitest run — 601 tests, 26 files, green.
• tsc --noEmit fails on two pre-existing exactOptionalPropertyTypes errors
  in src/free-names.ts, unchanged by this branch (no .ts file is touched).
• All 15 myna subcommands referenced in these docs exist in the dispatch
  table, including stats, which myna's own help does not mention.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WzoeVN9p8MDEFTGNaTr6na

[github-actions]

ThreatCrush Security Scan

8 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 3 | LOW: 3

Severity	Rule	Location
HIGH	sh-remote-script-execution	root-ubuntu.sh:2816
HIGH	sh-remote-script-execution	root-ubuntu.sh:2820
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:2969
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:3998
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
LOW	secret-generic-credential	src/credentials.ts:36
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.