Ship prebuilt, so a git URL is the whole install

Grok Build loads plugins out of ~/.grok/plugins/ and clones marketplace sources
straight from git; it never runs npm install or a build for you. So a plugin that
ships TypeScript is a plugin you have to build by hand before it does anything,
and the SessionStart hook's first act is to print "not built yet".

dist/ is now committed, and the tree is arranged so that a bare clone can run:

- The daemon is bundled to a single ESM file with rolldown, platform node. Its one
  runtime dependency (@simplewebauthn/server, plus the asn1/cbor tree under it) is
  inlined; the only imports left in the output are node: builtins. Not minified —
  a committed blob nobody can read is worse than no committed blob.
- tsc no longer emits for the server, it only typechecks (noEmit). rolldown emits.
- dist/web was already a self-contained static bundle.
- The hook scripts under bin/ were stdlib-only from the start.

.grok-plugin/marketplace.json makes the repo its own one-entry catalog with a local
source of "./", so `grok plugin marketplace add <git-url>` followed by
`grok plugin install grok-glance` works without pinning a SHA of itself.

`npm run check:dist` rebuilds and fails if the committed output is stale — the one
real hazard of checking in build output.

Also drops the daemon's "non-default port, run `glance sync-hooks`" startup note,
which the previous commit should have taken with the rest of that scheme; the hook
scripts read config.json themselves, so a non-default port needs nothing.

The e2e suite now takes GLANCE_ROOT and was run twice: once against the repo, once
against a copy containing only tracked files plus dist/ and no node_modules — which
is what actually demonstrates the claim, passkey registration and assertion
included. 233 checks, both runs green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

skills/glance/SKILL.md

@@ -14,16 +14,12 @@ same dashboard — no per-session setup.
 The daemon is started automatically by the `SessionStart` hook. Everything below is done through
 the `glance` CLI at `$GROK_PLUGIN_ROOT/bin/glance`.
 
-## First check whether it is even built
+## No build step
 
-The plugin ships as TypeScript and must be built once:
-
-```sh
-cd "$GROK_PLUGIN_ROOT" && npm install && npm run build
-```
-
-`glance status` prints a "not built" error with this same instruction if it is missing. Do not
-attempt to skip the build — the daemon entry point is `dist/server/index.js`.
+The plugin ships prebuilt: `dist/` is committed, and the daemon is a single dependency-free
+bundle. A clone is ready to run. Only reach for `npm install && npm run build` in
+`$GROK_PLUGIN_ROOT` if `glance status` actually says it is not built, which means `dist/` was
+deleted from the checkout.
 
 ## The commands
 
@@ -99,7 +95,8 @@ and wait for a tap on the phone. Defaults that matter:
   secret in `$GLANCE_HOME/hook.secret` no longer matches the one the daemon loaded (events are being
   dropped with a 403); `glance stop && glance up` fixes that. Otherwise check that
   `hooks/hooks.json` exists and that the plugin is registered with Grok Build.
-- **Page says "run npm install && npm run build"** → the web bundle is missing; build it.
+- **Page says "run npm install && npm run build"** → `dist/web` is missing from the checkout,
+  which should not happen in a clone. Re-clone, or build it.
 - **Only one agent shows up** → the others were started before the plugin was installed, or in an
   environment where the hooks are not registered. A session appears on its next hook event; nothing
   can be back-filled for one that already ran.