publish desktop, and stop counting node_modules as a plugin

The catalogue row and the bundled offline fallback, so the plugin installs from the marketplace like
every other. Listed honestly: its permission is owner-only at every path, and its websocket is not
mounted yet — the README and BLOCKERS.md say so rather than letting an install discover it.

marketplace-sync globs plugins/ itself rather than going through discoverPlugins, so the node_modules
skip added there did not cover it. Same fix, second place: it was reporting 15/16 and 16/17.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/marketplace-sync.ts

@@ -147,7 +147,11 @@ function rawUrl(repoUrl: string, path: string): string {
 }
 
 const dirs = existsSync(PLUGINS_DIR)
-  ? [...new Bun.Glob('*/').scanSync({ cwd: PLUGINS_DIR, onlyFiles: false })].map((d) => join(PLUGINS_DIR, d))
+  ? [...new Bun.Glob('*/').scanSync({ cwd: PLUGINS_DIR, onlyFiles: false })]
+      // Not a plugin: the shared install target for plugin npm packages, which lives here because bun
+      // resolves node_modules up the tree. `discoverPlugins` skips it for the same reason.
+      .filter((d) => d.replace(/\/$/, '') !== 'node_modules')
+      .map((d) => join(PLUGINS_DIR, d))
   : [];
 
 if (dirs.length === 0) {

src/servers/plugins/marketplace.ts

@@ -191,6 +191,35 @@ const BUNDLED: CatalogueEntry[] = [
     // favourites and the cached browse tree are this plugin's own three tables.
     has: { api: true, schema: true, sidecar: true, web: true },
   },
+  {
+    appName: 'desktop',
+    publisher: 'officerdev',
+    version: '1.0.0',
+    platform: '>=1.0.0',
+    label: 'Desktop',
+    summary: 'Mirror this machine’s display in the browser — the real session, not a second one',
+    icon: 'MonitorSmartphone',
+    color: '#ec4899',
+    source: 'https://gitea.officer.dev/plugins/desktop.git',
+    permissions: [
+      {
+        key: 'desktop',
+        label: 'Desktop',
+        description: "The server owner's physical screen, mirrored in the browser",
+      },
+    ],
+    // One physical display, and it is the owner's — the manifest marks every path owner-only, so this is
+    // listed but not shareable. Its WebSocket is not mounted yet; see the plugin's BLOCKERS.md.
+    osDependencies: [
+      {
+        binary: 'x11vnc',
+        reason: 'Mirrors the physical display.',
+        packages: { apt: 'x11vnc', dnf: 'x11vnc', pacman: 'x11vnc' },
+      },
+    ],
+    // No db/ — the mirror keeps nothing. The password lives in the owner's ~/.vnc, written by the sidecar.
+    has: { api: true, schema: false, sidecar: true, web: true },
+  },
   {
     appName: 'jellyfin',
     publisher: 'officerdev',