@seojin08/skill-finder 0.3.3 → 0.3.5

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 새 버전의 항목은 `npm run package`가 내려받기 페이지의 meta.json에 서명과 함께 넣고, 앱의 "새 버전" 표시를 누르면 보입니다. 한 줄이 한 항목입니다.
 
+## 0.3.5 (2026-11-04)
+
+- 소개 페이지 주소가 https://seojin-skill-finder.pages.dev 로 바뀌었습니다. 업데이트와 공유 링크도 새 주소를 씁니다.
+- 설치 확인 창이 화면 왼쪽 위에 붙지 않고 가운데에 뜹니다.
+
+## 0.3.4 (2026-11-03)
+
+- 처음 실행할 때 함께 들어 있는 스킬 색인을 바로 씁니다. 몇 분씩 모으기를 기다리지 않아도 스킬 1만여 개를 몇 초 만에 검색할 수 있습니다.
+- 처음 실행하면 Anthropic 공식 스킬부터 모읍니다.
+- 지워진 저장소나 커밋을 동기화 때마다 다시 묻지 않고, GitHub가 요청이 많다고 하면 잠깐 쉬었다가 다시 받습니다.
+- GitHub가 잠깐 답하지 않아도 저장소 별 수 갱신을 멈추지 않고, 나눠서 다시 묻습니다.
+- 검색에 나오는 GitHub 저장소 카드에도 별을 눌러 즐겨찾기에 넣을 수 있습니다.
+- 즐겨찾기 화면 왼쪽에서 종류(스킬·GitHub 저장소)·제공자·카테고리·설치 방식으로 골라 볼 수 있습니다.
+- Windows에 설치하면 터미널 명령 skill-finder가 생깁니다(사용자 PATH에 추가). 새로 연 터미널에서 skill-finder --version으로 설치된 버전을 보고, skill-finder로 앱을 켭니다.
+- Firefox·Safari 등 번역 기능이 없는 브라우저에서도 스킬 설명을 화면 언어(한국어·일본어)로 번역합니다. 버튼을 누르지 않아도 처음 한 번 Firefox와 같은 Mozilla 번역 모델(약 46MB)을 받고, 번역은 이 PC 안에서만 합니다. Chrome은 페이지에서 처음 클릭하거나 입력할 때 번역 모델을 받습니다.
+- 이미 한국어·일본어인 설명이나 기호뿐인 글은 번역하지 않습니다. README 추천의 요약이 엉뚱한 글자로 바뀌던 문제가 고쳐졌습니다.
+- README 추천 결과에서 이미 설치한 스킬(고른 프로젝트·개인 범위)에 "설치됨"이 붙고, 칩을 눌러 숨길 수 있습니다. 왼쪽 필터로 제공자·카테고리·설치 방식을 골라 볼 수 있습니다.
+- 설치됨 화면에 플러그인 안에 든 스킬도 나오고, 고른 프로젝트와 상관없는 다른 폴더의 플러그인은 빠집니다. 스킬 목록을 범위·설치 경로·위험·색인·제공자·카테고리로 골라 보고, 5·10·20개씩 페이지로 넘깁니다.
+- README 추천이나 설치됨 화면에서 연 스킬은 그 화면에서 고른 프로젝트 폴더에 설치하도록 열립니다(범위는 바꿀 수 있음). 위험 등급이 주의 이상인 스킬을 개인 범위로 설치하려 하면 이 프로젝트에만 설치하는 것도 고려하라고 알려 줍니다.
+
 ## 0.3.3 (2026-11-03)
 
 - 스킬 설치에 쓰는 skills CLI를 1.7.6으로 올렸습니다. 저장소 안의 바로가기(symlink)를 통해 스킬 폴더 밖의 파일이 함께 복사될 수 있던 보안 문제가 막혔습니다.

package/README.md

@@ -19,7 +19,7 @@ Claude Code 스킬을 한곳에서 찾아 점수·위험 신호와 함께 보고
 
 ### Windows
 
-[소개 페이지](https://skill-finder.a01075011775.workers.dev)에서 zip을 받아 압축을 풀고 `SkillFinder.exe`를 실행합니다. 서버를 켜고 브라우저를 열며, 새 버전이 나오면 서명을 확인한 뒤 업데이트합니다.
+[소개 페이지](https://seojin-skill-finder.pages.dev)에서 zip을 받아 압축을 풀고 `SkillFinder.exe`를 실행합니다. 서버를 켜고 브라우저를 열며, 새 버전이 나오면 서명을 확인한 뒤 업데이트합니다.
 
 ### macOS·Linux·Windows (npx)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seojin08/skill-finder",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Find Claude Code skills across marketplaces, skills.sh and GitHub, see their risk signals, and install them after checking what comes along. Local web app and read-only CLI.",
   "license": "MIT",
   "type": "module",
@@ -20,7 +20,7 @@
     "type": "git",
     "url": "git+https://github.com/Parkseojin08/skill-finder.git"
   },
-  "homepage": "https://skill-finder.a01075011775.workers.dev",
+  "homepage": "https://seojin-skill-finder.pages.dev",
   "bugs": "https://github.com/Parkseojin08/skill-finder/issues",
   "keywords": [
     "claude-code",
@@ -33,6 +33,7 @@
     "bin",
     "server",
     "web/dist",
+    "seed-index.json.gz",
     "README.md",
     "LICENSE",
     "CHANGELOG.md",

package/server/src/app.js

@@ -10,6 +10,7 @@ import { favoritesRouter } from "./routes/favorites.js";
 import { recommendRouter } from "./routes/recommend.js";
 import { searchRouter } from "./routes/search.js";
 import { skillsRouter } from "./routes/skills.js";
+import { translateFiles, translateRouter } from "./routes/translate.js";
 import { CSP, securityMiddleware } from "./security.js";
 export function createApp(ctx, opts = {}) {
     const app = express();
@@ -27,12 +28,14 @@ export function createApp(ctx, opts = {}) {
     app.use('/api', favoritesRouter(ctx));
     app.use('/api', recommendRouter(ctx));
     app.use('/api', adminRouter(ctx));
+    app.use('/api', translateRouter(ctx));
     // any other /api path, in any case (/API/... is not an API route and not a page either)
     app.use((req, res, next) => {
         if (!req.path.toLowerCase().startsWith('/api'))
             return next();
         res.status(404).json({ error: '없는 API 주소입니다' });
     });
+    app.use(translateFiles(ctx));
     if (existsSync(WEB_DIST_DIR)) {
         app.use((_req, res, next) => {
             res.setHeader('Content-Security-Policy', CSP);

package/server/src/bootstrap.js

@@ -6,13 +6,14 @@ import { Indexer } from "./indexer.js";
 import { Jobs } from "./jobs.js";
 import { seedMarketplaces } from "./settings.js";
 import { GitHub } from "./sources/github.js";
+import { TranslateModels } from "./translate/models.js";
 import { APP_VERSION } from "./version.js";
 export function createContext(config, dbPath = join(config.dataDir, 'skill-finder.db')) {
     const store = new Store(openDb(dbPath, { backupLabel: dbPath === ':memory:' ? null : APP_VERSION }));
     seedMarketplaces(store);
     const github = new GitHub(store, config);
     const indexer = new Indexer(store, github);
-    return { config, store, github, indexer, jobs: new Jobs() };
+    return { config, store, github, indexer, jobs: new Jobs(), translateModels: new TranslateModels(join(config.dataDir, 'translate-models')) };
 }
 /**
  * createContext for the server: a damaged database file (project review #4) is moved aside and the newest backup

package/server/src/db/schema.js

@@ -92,4 +92,7 @@ export const MIGRATIONS = [
   ALTER TABLE favorites_local RENAME TO favorites;
   DELETE FROM settings WHERE key = 'sessionKey';
   `,
+    // Favorite GitHub repositories (user request 2026-11-03) are `repo:owner/name` rows; the description and topics the
+    // search showed are kept with them, since the index has neither.
+    `ALTER TABLE favorites ADD COLUMN meta_json TEXT;`,
 ];

package/server/src/db/seed.js

@@ -0,0 +1,89 @@
+// A prebuilt index shipped with a release (first-run speed, 2026-11-03): the default marketplaces' plugins, their
+// skills and the star counts of the repos they come from, taken from the index the release was built with. Nothing
+// a user searched for, set, starred or installed is in it. A new install puts it into its empty database at
+// startup, so the first searches need not wait ~20 minutes for 2,600 plugins to be read from GitHub (without a
+// token); the normal sync then reads only what changed since.
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { join, resolve } from 'node:path';
+import { gunzipSync, gzipSync } from 'node:zlib';
+import { ROOT_DIR } from "../config.js";
+import { RISK_RULES_VERSION } from "../analyze/risk.js";
+import { pluginFtsText } from "../indexer.js";
+import { DEFAULT_MARKETPLACES } from "../settings.js";
+const FORMAT = 1;
+/** Next to server/ and web/ in a release (the package scripts write it); a checkout has none. */
+export const SEED_PATH = process.env.SKILL_FINDER_SEED_PATH ? resolve(process.env.SKILL_FINDER_SEED_PATH) : join(ROOT_DIR, 'seed-index.json.gz');
+/** Plugin errors kept in the seed: the lasting verdicts the app shows. Others are retried anyway and may name local paths. */
+const lastingError = (e) => (e && /^(설치 불가:|GitHub 외 출처)/.test(e) ? e : null);
+/** The marketplaces a new install has on: one turned on later on the building PC would be searched though off. */
+export function exportSeed(db, now = new Date()) {
+    const all = (sql, ...args) => db.prepare(sql).all(...args).map((r) => ({ ...r }));
+    const marketplaces = DEFAULT_MARKETPLACES.filter((d) => d.enabled).flatMap((d) => all('SELECT name, repo, commit_sha, etag, plugin_count FROM marketplaces WHERE name = ? AND repo = ? AND commit_sha IS NOT NULL', d.name, d.repo));
+    const names = JSON.stringify(marketplaces.map((m) => m.name));
+    const ofSeed = 'SELECT id FROM plugins WHERE marketplace IN (SELECT value FROM json_each(?))';
+    const plugins = all(`SELECT * FROM plugins WHERE id IN (${ofSeed}) ORDER BY id`, names).map((p) => ({ ...p, error: lastingError(p.error) }));
+    const skills = all(`SELECT * FROM skills WHERE origin = 'plugin' AND plugin_id IN (${ofSeed}) ORDER BY id`, names);
+    const repos = all(`SELECT * FROM repos WHERE lower(full_name) IN (
+       SELECT lower(repo) FROM plugins WHERE id IN (${ofSeed}) AND repo IS NOT NULL
+       UNION SELECT lower(repo) FROM skills WHERE origin = 'plugin' AND plugin_id IN (${ofSeed}) AND repo IS NOT NULL)
+     ORDER BY full_name`, names, names);
+    return { format: FORMAT, createdAt: now.toISOString(), marketplaces, plugins, skills, repos };
+}
+/**
+ * Writes the seed of the database at `dbPath` as gzip JSON: read-only and in one read transaction, so a running app
+ * may hold it and a sync it is doing meanwhile does not split plugins from their skills. Refuses an index that would
+ * undo the point: empty, or checked with older risk rules (every install would download all SKILL.md files again).
+ */
+export function writeSeedFile(dbPath, outPath) {
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    try {
+        db.exec('BEGIN');
+        const seed = exportSeed(db);
+        db.exec('COMMIT');
+        if (seed.plugins.length === 0 || seed.skills.length === 0)
+            throw new Error('색인에 기본 마켓플레이스의 스킬이 없습니다. 앱으로 한 번 동기화한 뒤 만드세요');
+        const old = seed.skills.filter((s) => s.risk_rules != null && s.risk_rules < RISK_RULES_VERSION).length;
+        if (old > 0)
+            throw new Error(`스킬 ${old}개가 옛 위험 규칙으로 검사돼 있습니다. 앱을 실행해 다시 검사가 끝난 뒤 만드세요`);
+        const gz = gzipSync(JSON.stringify(seed), { level: 9 });
+        writeFileSync(outPath, gz);
+        return { plugins: seed.plugins.length, skills: seed.skills.length, repos: seed.repos.length, bytes: gz.length };
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * Puts the seed at `path` into a database with no plugins and no skills yet (a new install); does nothing otherwise
+ * or without the file. Marketplaces whose repo differs from the seed's are left to the sync. Star counts are dated
+ * when the seed was made, so searches stop trusting them a week after the release as they would any other count.
+ */
+export function importSeed(store, path) {
+    if (!existsSync(path) || store.countPlugins() > 0 || store.countSkills() > 0)
+        return null;
+    const seed = JSON.parse(gunzipSync(readFileSync(path)).toString('utf8'));
+    if (seed.format !== FORMAT)
+        throw new Error(`알 수 없는 색인 형식 ${seed.format}`);
+    const local = new Map(store.listMarketplaces().map((m) => [m.name, m.repo]));
+    const marketplaces = seed.marketplaces.filter((m) => local.get(m.name) === m.repo);
+    const names = new Set(marketplaces.map((m) => m.name));
+    const plugins = new Map(seed.plugins.filter((p) => names.has(p.marketplace)).map((p) => [p.id, p]));
+    const skills = seed.skills.filter((s) => s.plugin_id && plugins.has(s.plugin_id));
+    // never later than the counts themselves (the building PC refreshes them every 6 hours)
+    const madeAt = seed.createdAt;
+    store.transaction(() => {
+        for (const m of marketplaces)
+            store.updateMarketplaceSync(m.name, { etag: m.etag, plugin_count: m.plugin_count ?? undefined, commit_sha: m.commit_sha });
+        for (const p of plugins.values()) {
+            store.upsertPlugin(p);
+            if (p.skills_indexed_at)
+                store.markPluginIndexed(p.id, p.skills_indexed_sha, p.signals_json ? JSON.parse(p.signals_json) : null, p.error);
+        }
+        for (const s of skills)
+            store.upsertSkill(s, pluginFtsText(plugins.get(s.plugin_id)));
+        for (const r of seed.repos)
+            store.upsertRepo({ ...r, fetched_at: r.fetched_at && r.fetched_at < madeAt ? r.fetched_at : madeAt });
+    });
+    return { plugins: plugins.size, skills: skills.length, repos: seed.repos.length };
+}

package/server/src/db/store.js

@@ -316,15 +316,16 @@ export class Store {
             .slice(0, limit);
     }
     // ── favorites: this PC's, no accounts (user decision 2026-11-02) ──
-    addFavorite(skillId, skillName) {
-        this.run('INSERT INTO favorites (skill_id, skill_name, created_at) VALUES (?, ?, ?) ON CONFLICT DO NOTHING', skillId, skillName, now());
+    /** `meta`: what a repository favorite shows beyond its name (description, topics). */
+    addFavorite(skillId, skillName, meta = null) {
+        this.run('INSERT INTO favorites (skill_id, skill_name, created_at, meta_json) VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING', skillId, skillName, now(), meta == null ? null : JSON.stringify(meta));
     }
     removeFavorite(skillId) {
         this.run('DELETE FROM favorites WHERE skill_id = ?', skillId);
     }
     /** Newest first. */
     listFavorites() {
-        return this.all('SELECT skill_id, skill_name, created_at FROM favorites ORDER BY created_at DESC, rowid DESC');
+        return this.all('SELECT skill_id, skill_name, created_at, meta_json FROM favorites ORDER BY created_at DESC, rowid DESC');
     }
     /** Skills the app installed into a skills folder (skills CLI), newest first, to match those folders to the index. */
     listInstalledSkillLog() {

package/server/src/index.js

@@ -2,6 +2,7 @@ import { config, ensureDataDirs } from "./config.js";
 import { createApp } from "./app.js";
 import { openContext } from "./bootstrap.js";
 import { DataTooNewError } from "./db/index.js";
+import { importSeed, SEED_PATH } from "./db/seed.js";
 import { startUpdateChecks } from "./update.js";
 import { startLogFile } from "./util/log.js";
 import { pruneSearchLog, recheckRiskRules, refreshRepoMeta, relevelRisk, REPO_META_EVERY_MS, startSync } from "./tasks.js";
@@ -26,6 +27,16 @@ const ctx = (() => {
         process.exit(1);
     }
 })();
+// A new install starts from the index shipped with the release instead of an empty one; any problem only costs speed.
+try {
+    const t0 = Date.now();
+    const seeded = importSeed(ctx.store, SEED_PATH);
+    if (seeded)
+        console.log(`[seed] 미리 만든 색인을 넣었습니다: 스킬 ${seeded.skills}개, 플러그인 ${seeded.plugins}개, 저장소 ${seeded.repos}개 (${((Date.now() - t0) / 1000).toFixed(1)}초)`);
+}
+catch (err) {
+    console.warn('[seed] 미리 만든 색인을 넣지 못해 GitHub에서 처음부터 모읍니다:', String(err.message ?? err).slice(0, 200));
+}
 const app = createApp(ctx);
 // Express' listen(port) binds 0.0.0.0; always pass the loopback host explicitly.
 const server = app.listen(config.port, HOST, () => {

package/server/src/indexer.js

@@ -6,6 +6,7 @@ import { discoverRepo, parseJsonObject, PLUGIN_JSON } from "./discovery/classify
 import { genericAcceptor } from "./discovery/genericRules.js";
 import { discoverPluginSkills } from "./discovery/pluginRules.js";
 import { basename, joinPath, skillMdPath, TreeIndex } from "./discovery/tree.js";
+import { RepoUnreachableError } from "./sources/gitTree.js";
 import { RAW_MAX_BYTES } from "./sources/github.js";
 import { normalizeSource, resolveRelativeRoot } from "./sources/pluginSource.js";
 import { pool } from "./util/limiter.js";
@@ -280,7 +281,10 @@ export class Indexer {
         const path = msg.match(/^플러그인 경로가 없습니다: (.*)$/);
         if (path)
             return `마켓플레이스가 가리키는 폴더가 저장소에 없습니다 (${path[1]})`;
-        if (/^tree 422|^tree 409/.test(msg))
+        if (err instanceof RepoUnreachableError)
+            return '저장소가 삭제됐거나 비공개입니다';
+        // "not our ref": git's answer for a pinned commit no branch holds any more (the tree API says 422)
+        if (/^tree 422|^tree 409|not our ref/.test(msg))
             return '마켓플레이스가 고정한 커밋이 저장소 기록에서 지워졌습니다';
         if (/^tree 404|커밋을 찾을 수 없습니다/.test(msg)) {
             const exists = await this.github.repoExists(repo);

package/server/src/install/installed.js

@@ -1,9 +1,9 @@
 // What is installed on this PC and how it matches the index (UI debate stage 3: shown only, nothing is run).
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
-import { readdir, readFile } from 'node:fs/promises';
+import { readdir, readFile, realpath } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, posix } from 'node:path';
+import { basename, join, posix, resolve, sep } from 'node:path';
 import { extractSkillMeta } from "../analyze/frontmatter.js";
 import { riskLevel, skillRiskFlags } from "../analyze/risk.js";
 import { runClaude } from "../claude/cli.js";
@@ -89,36 +89,106 @@ export async function scanInstalledSkills(store, scope, projectPath, onlyFolder)
         if (onlyFolder && folder.toLowerCase() !== onlyFolder.toLowerCase())
             continue;
         const path = join(dir, folder);
-        let raw;
-        try {
-            raw = await readFile(join(path, 'SKILL.md'), 'utf8');
-        }
-        catch {
+        const hit = await inspectSkill(store, path, folder, (name) => {
+            const log = logged.get(name.toLowerCase()) ?? logged.get(folder.toLowerCase());
+            const fromLock = lock.get(folder.toLowerCase());
+            const id = (fromLock && store.getSkill(fromLock)?.id) || (log && store.getSkill(log.id) ? log.id : null);
+            return { id: id || null, installedRisk: log && log.id === id ? log.risk : null };
+        });
+        if (!hit)
             continue; // not a skill folder
-        }
-        const meta = extractSkillMeta(raw, folder);
-        const hash = mdHash(raw);
-        const log = logged.get(meta.name.toLowerCase()) ?? logged.get(folder.toLowerCase());
-        const fromLock = lock.get(folder.toLowerCase());
-        const skillId = (fromLock && store.getSkill(fromLock)?.id) || (log && store.getSkill(log.id) ? log.id : null) || store.findSkillIdByMdSha(hash);
-        const indexed = skillId ? store.getSkill(skillId) : undefined;
-        const flags = skillRiskFlags({ files: await listFiles(path), allowedTools: meta.allowedTools, body: meta.body, hasHooks: meta.hasHooks, raw });
         out.push({
+            ...hit,
             scope,
-            path,
-            folder,
-            name: meta.name,
-            description: truncate(meta.description, 200),
             removeCommand: `npx skills@${SKILLS_CLI_VERSION} remove ${/\s/.test(folder) ? `"${folder}"` : folder} -a claude-code -y${scope === 'user' ? ' -g' : ''}`,
-            skillId,
-            risk: { level: riskLevel(flags), flags },
-            installedRisk: (log?.id === skillId ? log?.risk : null) ?? null,
-            change: !indexed?.skill_md_sha256 ? 'unknown' : indexed.skill_md_sha256 === hash ? 'same' : 'changed',
-            tokens: skillTokens(meta.name, meta.description, raw),
         });
     }
     return out;
 }
+/**
+ * One skill folder as installed: its SKILL.md, the current risk rules run on its files, and its index row — the one
+ * `known` names (lock file, install log, plugin), else an indexed copy of the same SKILL.md. Null without a SKILL.md.
+ */
+async function inspectSkill(store, path, folder, known) {
+    let raw;
+    try {
+        raw = await readFile(join(path, 'SKILL.md'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const meta = extractSkillMeta(raw, folder);
+    const hash = mdHash(raw);
+    const { id, installedRisk } = known(meta.name);
+    const skillId = id ?? store.findSkillIdByMdSha(hash);
+    const indexed = skillId ? store.getSkill(skillId) : undefined;
+    const flags = skillRiskFlags({ files: await listFiles(path), allowedTools: meta.allowedTools, body: meta.body, hasHooks: meta.hasHooks, raw });
+    return {
+        path,
+        folder,
+        name: meta.name,
+        description: truncate(meta.description, 200),
+        skillId,
+        risk: { level: riskLevel(flags), flags },
+        installedRisk: id && id === skillId ? installedRisk : null,
+        change: !indexed?.skill_md_sha256 ? 'unknown' : indexed.skill_md_sha256 === hash ? 'same' : 'changed',
+        tokens: skillTokens(meta.name, meta.description, raw),
+    };
+}
+/**
+ * The skills inside an installed plugin, read from its install folder (user report 2026-11-04: the 설치됨 screen
+ * listed a plugin's skills only when the index knew them, folded away, so a project's skills looked incomplete).
+ * Claude Code reads the plugin's `skills/` folder plus the `skills` path(s) of `.claude-plugin/plugin.json`; each
+ * path is a skill folder or a folder of them, and must stay inside the install folder.
+ */
+export async function scanPluginSkills(store, plugin) {
+    if (typeof plugin.installPath !== 'string' || !plugin.installPath)
+        return [];
+    const root = resolve(plugin.installPath);
+    let declared;
+    try {
+        declared = JSON.parse(await readFile(join(root, '.claude-plugin', 'plugin.json'), 'utf8')).skills;
+    }
+    catch {
+        // no manifest: the default folder only
+    }
+    const paths = ['skills', ...(typeof declared === 'string' ? [declared] : Array.isArray(declared) ? declared.filter((p) => typeof p === 'string') : [])];
+    const candidates = [];
+    for (const p of paths) {
+        const dir = resolve(root, p);
+        if (existsSync(join(dir, 'SKILL.md'))) {
+            candidates.push(dir);
+            continue;
+        }
+        try {
+            for (const e of await readdir(dir, { withFileTypes: true }))
+                if (e.isDirectory() || e.isSymbolicLink())
+                    candidates.push(join(dir, e.name));
+        }
+        catch {
+            // no such folder
+        }
+    }
+    // a path or a link leading out of the plugin is not read: compared by where it really is
+    const realRoot = await realpath(root).catch(() => null);
+    if (!realRoot)
+        return [];
+    const dirs = new Set();
+    for (const dir of candidates) {
+        const real = await realpath(dir).catch(() => null);
+        if (real && (real === realRoot || real.startsWith(realRoot + sep)))
+            dirs.add(dir);
+    }
+    const indexedByName = new Map(pluginSkills(store, plugin.id).map((s) => [s.name.toLowerCase(), s.id]));
+    const out = [];
+    for (const path of [...dirs].sort()) {
+        const folder = basename(path);
+        const hit = await inspectSkill(store, path, folder, (name) => ({ id: indexedByName.get(name.toLowerCase()) ?? indexedByName.get(folder.toLowerCase()) ?? null, installedRisk: null }));
+        if (hit)
+            out.push({ ...hit, scope: plugin.scope === 'project' || plugin.scope === 'local' ? 'project' : 'user', plugin: { id: plugin.id, scope: plugin.scope, enabled: plugin.enabled } });
+    }
+    return out;
+}
 export async function existingSkillFolder(store, skillId, skillName, scope, projectPath) {
     const folder = skillFolderName(skillName);
     const path = join(scope === 'user' ? homedir() : projectPath, '.claude', 'skills', folder);
@@ -181,7 +251,7 @@ export function installedPluginCommits() {
     return out;
 }
 /** Windows paths compared as Claude Code writes them: backslashes, no trailing one, any case. */
-const pathKey = (p) => p.replace(/\//g, '\\').replace(/\\+$/, '').toLowerCase();
+export const pathKey = (p) => p.replace(/\//g, '\\').replace(/\\+$/, '').toLowerCase();
 export const pluginCommitKey = (id, scope, projectPath) => `${id}|${scope}|${scope === 'user' ? '' : pathKey(projectPath ?? '')}`;
 /** How a plugin install compares with the index: its skills' top risk and whether it came from the indexed commit. */
 /** The indexed skills a plugin install brought in (its own, or those whose install plan names it), for the 설치됨 screen. */

package/server/src/recommend/readme.js

@@ -150,8 +150,20 @@ function inlineText(s) {
         .replace(/\s+/g, ' ')
         .trim();
 }
+/** Markdown and HTML links with their text: what is left of a row of links ("Docs · Discord · Blog") is its separators. */
+const LINKS = /\[[^[\]]*\]\((?:[^()]|\([^()]*\))*\)|\[[^[\]]*\]\[[^[\]]*\]|<a\b[^<>]*>[^<]*<\/a>/gi;
 /**
- * Title (first H1, else the folder name), intro (first paragraph of 20+ chars), features (first list under a
+ * A paragraph that reads as a sentence, for the summary's intro: mostly letters (not a row of symbols) and 20+
+ * characters without its links' text (not a navigation row). Others still count as body text.
+ */
+function isProse(raw, text) {
+    const letters = text.match(/\p{L}/gu)?.length ?? 0;
+    if (letters < text.replace(/\s/g, '').length * 0.6)
+        return false;
+    return inlineText(raw.replace(LINKS, ' ')).length >= CONFIG.minParagraphChars;
+}
+/**
+ * Title (first H1, else the folder name), intro (first paragraph of 20+ chars that reads as prose), features (first list under a
  * "feature/기능/특징" heading, up to 5), other headings, body text and code-block languages. Code itself is
  * dropped: README code and badges otherwise dominate any word statistics.
  */
@@ -166,7 +178,7 @@ export function extractReadme(md, fallbackTitle) {
         const text = html ? inlineText(raw.replace(TAG, ' ')) : inlineText(raw);
         if (text.length < CONFIG.minParagraphChars)
             return; // badge rows and short lines
-        if (!out.intro)
+        if (!out.intro && isProse(raw, text))
             out.intro = text;
         else
             out.body.push(text);

package/server/src/routes/favorites.js

@@ -1,14 +1,34 @@
 import { Router } from 'express';
 import { z } from 'zod';
-import { freshInstalls, freshness, TRUST_SCORE, trustTier } from "../search/rank.js";
-import { buildResultItem, githubSource, marketplaceSource, storeLookup } from "../search/result.js";
+import { installSummary } from "../install/summary.js";
+import { isRepo } from "../install/validate.js";
+import { indexItem, storeLookup } from "../search/result.js";
+import { sanitizeLine } from "../util/sanitize.js";
 const FavoriteBody = z.object({ id: z.string().min(1).max(400) });
 /**
  * `name`: a search result not in the index yet (still being checked) is kept by it until it is. Unusable (empty,
  * not text) it is left out rather than refused, so an indexed skill still gets its star.
  */
-const FavoriteAdd = FavoriteBody.extend({ name: z.unknown().optional() });
+const FavoriteAdd = FavoriteBody.extend({ name: z.unknown().optional(), repo: z.unknown().optional() });
 const usableName = (v) => (typeof v === 'string' && v.trim() ? v.trim().slice(0, 200) : undefined);
+/** A favorite GitHub repository (user request 2026-11-03): `repo:` and the name in lower case, so one per repo. */
+const REPO_PREFIX = 'repo:';
+/** What the search showed of the repo; anything unusable is left out rather than refused. */
+function repoMeta(v) {
+    const o = (v && typeof v === 'object' ? v : {});
+    const description = typeof o.description === 'string' && o.description.trim() ? sanitizeLine(o.description).slice(0, 500) : null;
+    const topics = Array.isArray(o.topics) ? o.topics.filter((x) => typeof x === 'string' && /^[a-z0-9][a-z0-9-]{0,49}$/.test(x)).slice(0, 30) : [];
+    return { description, topics };
+}
+/** One damaged row must not take the whole favorites list down with it. */
+function parseJson(text) {
+    try {
+        return text ? JSON.parse(text) : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * This PC's favorite skills (user decision 2026-11-02). No accounts: the app runs for one person on 127.0.0.1, so a
  * login kept only here protected nothing. The API's header and same-origin checks apply as everywhere.
@@ -19,28 +39,52 @@ export function favoritesRouter(ctx) {
     r.get('/favorites/ids', (_req, res) => {
         res.json({ ids: store.listFavorites().map((f) => f.skill_id) });
     });
-    /** The favorites as result cards; ones whose skill left the index are listed by name. */
+    /** The favorites as result cards and repository cards; skills that left the index are listed by name. */
     r.get('/favorites', (_req, res) => {
         const lookup = storeLookup(store);
         const items = [];
+        const repos = [];
         const gone = [];
         for (const f of store.listFavorites()) {
+            if (f.skill_id.startsWith(REPO_PREFIX)) {
+                const repo = f.skill_name;
+                const meta = repoMeta(parseJson(f.meta_json));
+                repos.push({
+                    repo,
+                    url: `https://github.com/${repo}`,
+                    ...meta,
+                    stars: store.getRepo(repo)?.stars ?? null,
+                    // as the search's repository card lists them
+                    skills: store
+                        .findSkillsByRepo(repo)
+                        .filter((s) => s.description && s.origin !== 'wellknown')
+                        .slice(0, 30)
+                        .map((s) => installSummary(s, lookup)),
+                });
+                continue;
+            }
             const s = store.getSkill(f.skill_id);
             if (!s) {
                 gone.push({ id: f.skill_id, name: f.skill_name });
                 continue;
             }
-            const plugin = lookup.plugin(s.plugin_id);
-            const source = plugin ? marketplaceSource(s, plugin) : githubSource(s);
-            const breakdown = { R: 0, P: 0, F: freshness(s.last_commit_at), T: TRUST_SCORE[trustTier(s, plugin)] };
-            items.push(buildResultItem({ skill: s, lookup, sources: source ? [source] : [], installs: freshInstalls(s), stars: s.repo ? (store.getRepo(s.repo)?.stars ?? null) : null, breakdown, score: 0 }));
+            items.push(indexItem(store, lookup, s));
         }
-        res.json({ items, gone });
+        res.json({ items, repos, gone });
     });
     r.post('/favorites', (req, res) => {
         const parsed = FavoriteAdd.safeParse(req.body);
         if (!parsed.success)
             return void res.status(400).json({ error: '스킬 id가 없습니다' });
+        if (parsed.data.id.startsWith(REPO_PREFIX)) {
+            const repo = parsed.data.id.slice(REPO_PREFIX.length);
+            if (!isRepo(repo))
+                return void res.status(400).json({ error: '저장소 이름이 올바르지 않습니다' });
+            // the name as GitHub writes it (morluto/rea), when it is a repo name and the same repo
+            const name = usableName(parsed.data.name);
+            store.addFavorite(REPO_PREFIX + repo.toLowerCase(), isRepo(name) && name.toLowerCase() === repo.toLowerCase() ? name : repo, repoMeta(parsed.data.repo));
+            return void res.json({ ok: true });
+        }
         const skill = store.getSkill(parsed.data.id);
         // not indexed: listed by name on the favorites page, as a card once the index has it
         const name = skill?.name ?? usableName(parsed.data.name);
@@ -54,7 +98,8 @@ export function favoritesRouter(ctx) {
         const parsed = FavoriteBody.safeParse({ id: req.query.id });
         if (!parsed.success)
             return void res.status(400).json({ error: '스킬 id가 없습니다' });
-        store.removeFavorite(parsed.data.id);
+        // repository favorites are kept in lower case (POST)
+        store.removeFavorite(parsed.data.id.startsWith(REPO_PREFIX) ? parsed.data.id.toLowerCase() : parsed.data.id);
         res.json({ ok: true });
     });
     return r;

package/server/src/routes/install.js

@@ -5,7 +5,8 @@ import { Router } from 'express';
 import { z } from 'zod';
 import { buildSteps, planInstall } from "../install/plan.js";
 import { executeInstall } from "../install/run.js";
-import { existingSkillFolder, forgetPlugins, installedPluginCommits, listInstalledPlugins, pluginCommitKey, pluginIndexInfo, pluginSkills, scanInstalledSkills } from "../install/installed.js";
+import { existingSkillFolder, forgetPlugins, installedPluginCommits, listInstalledPlugins, pathKey, pluginCommitKey, pluginIndexInfo, pluginSkills, scanInstalledSkills, scanPluginSkills } from "../install/installed.js";
+import { indexItem, storeLookup } from "../search/result.js";
 import { uninstallPlugin, uninstallSkill } from "../install/uninstall.js";
 import { isProjectDir } from "../install/validate.js";
 import { getSettings } from "../settings.js";
@@ -241,7 +242,8 @@ export function installRouter(ctx) {
         }
         const listed = await listInstalledPlugins(projectPath ?? homedir(), true);
         const commits = installedPluginCommits();
-        const plugins = listed.plugins.map((o) => {
+        // with a folder, another project's project and local plugins are not this one's (user report 2026-11-04)
+        const plugins = listed.plugins.filter((o) => !projectPath || (o.scope !== 'project' && o.scope !== 'local') || pathKey(o.projectPath ?? '') === pathKey(projectPath)).map((o) => {
             const { scope, id: pid } = o;
             const ownProject = o.projectPath;
             // `claude plugin list` reports enabled for the folder it runs in; read the settings file that owns this install instead.
@@ -263,19 +265,43 @@ export function installRouter(ctx) {
             ...(await scanInstalledSkills(store, 'user', null)),
             ...(projectPath ? await scanInstalledSkills(store, 'project', projectPath) : []),
         ];
-        res.json({ plugins, pluginError: listed.error, skills, projects: store.listInstalledProjects() });
+        // The skills of the plugins that apply here: everyone's (user, synced) and this folder's. Without a folder the
+        // project plugins listed above belong to other folders. One row per folder: a plugin installed for the user and
+        // for a project shares its install folder (code review 2026-11-04).
+        const applying = plugins.filter((p) => (p.scope !== 'project' && p.scope !== 'local') || projectPath);
+        const seen = new Set();
+        const pluginSkillRows = (await Promise.all(applying.map((p) => scanPluginSkills(store, { ...p, enabled: typeof p.enabled === 'boolean' ? p.enabled : null }))))
+            .flat()
+            .filter((s) => !seen.has(s.path) && seen.add(s.path));
+        // the index's card for each indexed one: provider, category and install method for the side filters
+        const lookup = storeLookup(store);
+        const items = {};
+        for (const s of [...skills, ...pluginSkillRows]) {
+            const row = s.skillId ? store.getSkill(s.skillId) : undefined;
+            if (row && !items[row.id])
+                items[row.id] = indexItem(store, lookup, row);
+        }
+        res.json({ plugins, pluginError: listed.error, skills, pluginSkills: pluginSkillRows, items, projects: store.listInstalledProjects() });
     });
     // What is installed, by index id, for the "설치됨" badges on results (UI debate 3-1). Project skills are those of
-    // the default project folder in the settings. Unknown ones are simply absent: no badge, never "not installed".
-    r.get('/installed/ids', async (_req, res) => {
-        const project = getSettings(store).defaultProjectPath;
+    // `projectPath` (the folder README 추천 analyzed, user request 2026-11-04), else of the default project folder in
+    // the settings; with `projectPath`, project and local plugins of other folders are left out. Unknown ones are
+    // simply absent: no badge, never "not installed".
+    r.get('/installed/ids', async (req, res) => {
+        const asked = typeof req.query.projectPath === 'string' && req.query.projectPath.trim() ? req.query.projectPath.trim() : null;
+        if (asked && !isProjectDir(asked)) {
+            res.status(400).json({ error: '프로젝트 경로는 존재하는 디렉터리의 절대경로여야 합니다' });
+            return;
+        }
+        const project = asked ?? getSettings(store).defaultProjectPath;
         const listed = await listInstalledPlugins();
         const skills = [
             ...(await scanInstalledSkills(store, 'user', null)),
             ...(isProjectDir(project) ? await scanInstalledSkills(store, 'project', project) : []),
         ];
+        const inFolder = (p) => !asked || (p.scope !== 'project' && p.scope !== 'local') || pathKey(p.projectPath ?? '') === pathKey(asked);
         res.json({
-            plugins: listed.plugins.map((p) => ({ id: p.id, scope: p.scope })),
+            plugins: listed.plugins.filter(inFolder).map((p) => ({ id: p.id, scope: p.scope })),
             skills: skills.filter((s) => s.skillId).map((s) => ({ id: s.skillId, scope: s.scope })),
         });
     });