@shnitzel/plugscout 0.3.24 → 0.3.26

package/dist/interfaces/cli/index.js

@@ -19,6 +19,7 @@ import { detectProjectSignals } from '../../recommendation/project-analysis.js';
 import { recommend } from '../../recommendation/engine.js';
 import { loadRequirementsProfile } from '../../recommendation/requirements.js';
 import { assessRisk, buildAssessment } from '../../security/assessment.js';
+import { runLiveChecks, formatLiveChecks } from '../../security/live-check.js';
 import { applyQuarantineFromReport, verifyWhitelist } from '../../security/whitelist.js';
 import { runDoctorChecks } from './doctor.js';
 import { renderCsv } from './formatters/csv.js';
@@ -486,6 +487,7 @@ async function handleShow(args) {
     if (!id) {
         throw new Error('Usage: show --id <catalog-id>');
     }
+    const noLive = hasFlag(args, '--no-live');
     const [item, whitelist, quarantine, insights] = await Promise.all([
         loadCatalogItemById(id),
         loadWhitelist(),
@@ -515,14 +517,21 @@ async function handleShow(args) {
     printHint(`Install with: plugscout install --id ${item.id} --yes`);
     printHint('Review provenance, risk, and capabilities first. Do not install blindly from a suggestion or score.');
     console.log(`Provenance: source=${item.source} catalogType=${getCatalogType(item)} confidence=${getSourceConfidence(item)}`);
-    const metadata = getItemMetadata(item);
-    const sourceRepo = typeof metadata.sourceRepo === 'string' ? metadata.sourceRepo : undefined;
-    const sourcePage = typeof metadata.sourcePage === 'string' ? metadata.sourcePage : undefined;
-    if (sourceRepo) {
-        console.log(`Source repo: ${sourceRepo}`);
+    const links = buildItemLinks(item);
+    if (links.length > 0) {
+        console.log('\nLinks:');
+        for (const link of links) {
+            console.log(`  ${link.label}: ${link.url}`);
+        }
     }
-    if (sourcePage) {
-        console.log(`Source page: ${sourcePage}`);
+    if (!noLive) {
+        process.stdout.write('\x1b[90mRunning live checks…\x1b[0m\r');
+        const liveResults = await runLiveChecks(item);
+        process.stdout.write('                        \r');
+        const liveOutput = formatLiveChecks(liveResults);
+        if (liveOutput) {
+            console.log(liveOutput);
+        }
     }
 }
 async function handleSearch(args) {
@@ -808,6 +817,7 @@ async function handleAssess(args) {
     if (!id) {
         throw new Error('Missing --id for assess');
     }
+    const noLive = hasFlag(args, '--no-live');
     const found = await loadCatalogItemById(id);
     if (!found) {
         throw new Error(await buildCatalogItemNotFoundMessage(id));
@@ -816,6 +826,22 @@ async function handleAssess(args) {
     console.log(renderJson(assessment));
     await recordItemReview(found.id, 'assess');
     printHint(`Risk scale (lower is safer): ${formatRiskScale(policy)}`);
+    const links = buildItemLinks(found);
+    if (links.length > 0) {
+        console.log('\nLinks:');
+        for (const link of links) {
+            console.log(`  ${link.label}: ${link.url}`);
+        }
+    }
+    if (!noLive) {
+        process.stdout.write('\x1b[90mRunning live checks…\x1b[0m\r');
+        const liveResults = await runLiveChecks(found);
+        process.stdout.write('                        \r');
+        const liveOutput = formatLiveChecks(liveResults);
+        if (liveOutput) {
+            console.log(liveOutput);
+        }
+    }
 }
 async function handleInstall(args) {
     const id = readFlag(args, '--id');
@@ -1460,3 +1486,43 @@ function getSourceConfidence(item) {
     }
     return 'official';
 }
+function buildItemLinks(item) {
+    const meta = getItemMetadata(item);
+    const links = [];
+    const seen = new Set();
+    function add(label, url) {
+        if (typeof url !== 'string' || !url.startsWith('http'))
+            return;
+        if (seen.has(url))
+            return;
+        seen.add(url);
+        links.push({ label, url });
+    }
+    // Kind-specific derived URLs first (most useful)
+    if (item.kind === 'cursor-extension') {
+        const vsixId = meta.vsixId;
+        if (typeof vsixId === 'string') {
+            add('Marketplace', `https://marketplace.visualstudio.com/items?itemName=${vsixId}`);
+        }
+    }
+    if (item.kind === 'gemini-extension') {
+        const pkg = meta.npmPackage;
+        if (typeof pkg === 'string') {
+            add('npm', `https://www.npmjs.com/package/${encodeURIComponent(pkg)}`);
+        }
+    }
+    // install.url is the most direct link for the user
+    add('Install page', item.install.url);
+    // Metadata links — priority order
+    add('Repository', meta.repositoryUrl);
+    add('Repository', meta.githubUrl);
+    add('Repository', meta.sourceRepo?.toString().startsWith('http') ? meta.sourceRepo : undefined);
+    add('Website', meta.websiteUrl);
+    add('Source page', meta.sourcePage);
+    // GitHub shorthand (e.g. "github/awesome-copilot") → full URL
+    if (typeof meta.sourceRepo === 'string' && !meta.sourceRepo.startsWith('http')) {
+        const ghUrl = `https://github.com/${meta.sourceRepo}`;
+        add('Repository', ghUrl);
+    }
+    return links;
+}

package/dist/interfaces/cli/ui/web-report.js

@@ -454,10 +454,7 @@ function renderHtml(rows, allItems, stats, policy) {
 </html>`;
 }
 function renderDetailCard(entry) {
-    const metadata = asMetadata(entry.item.metadata);
     const trustScore = computeTrustScore(entry.item);
-    const sourceRepo = typeof metadata.sourceRepo === 'string' ? metadata.sourceRepo : '';
-    const sourcePage = typeof metadata.sourcePage === 'string' ? metadata.sourcePage : '';
     const status = entry.blocked ? 'blocked' : entry.approved ? 'approved' : 'allowed';
     const statusClass = entry.blocked ? 'bad' : 'ok';
     const installHint = buildInstallHint(entry.item);
@@ -473,8 +470,6 @@ function renderDetailCard(entry) {
     const bodyId = `body-${safeId}`;
     const searchKey = escapeHtml(`${entry.item.id} ${entry.item.name} ${entry.item.capabilities.join(' ')}`.toLowerCase());
     const plugscoutCmd = `plugscout install --id ${entry.item.id} --yes`;
-    const isManualUrl = entry.item.install.kind === 'manual' && typeof entry.item.install.url === 'string' && String(entry.item.install.url).startsWith('http');
-    const manualUrl = isManualUrl ? String(entry.item.install.url) : '';
     const previewChips = entry.item.capabilities
         .slice(0, 3)
         .map((cap) => `<span class="chip">${escapeHtml(cap)}</span>`)
@@ -517,9 +512,7 @@ function renderDetailCard(entry) {
       </div>
       ${entry.assessment.reasons.length > 0 ? `<div class="line"><span class="label">Risk signals: </span>${escapeHtml(entry.assessment.reasons.join(' · '))}</div>` : ''}
       <div class="line"><span class="label">Provider:</span> ${escapeHtml(entry.item.provider)} &nbsp;·&nbsp; <span class="label">Source:</span> ${escapeHtml(entry.item.source)}</div>
-      ${sourceRepo ? `<div class="line"><span class="label">Repo: </span><a class="link" href="${escapeHtml(sourceRepo)}" target="_blank" rel="noopener noreferrer">${escapeHtml(sourceRepo)}</a></div>` : ''}
-      ${sourcePage ? `<div class="line"><span class="label">Page: </span><a class="link" href="${escapeHtml(sourcePage)}" target="_blank" rel="noopener noreferrer">${escapeHtml(sourcePage)}</a></div>` : ''}
-      ${isManualUrl ? `<div class="line"><span class="label">Install page: </span><a class="link" href="${escapeHtml(manualUrl)}" target="_blank" rel="noopener noreferrer">${escapeHtml(manualUrl)}</a></div>` : ''}
+      ${buildItemLinks(entry.item).map(l => `<div class="line"><span class="label">${escapeHtml(l.label)}: </span><a class="link" href="${escapeHtml(l.url)}" target="_blank" rel="noopener noreferrer">${escapeHtml(l.url)}</a></div>`).join('')}
       <div class="install-block">
         <div class="install-header">
           <span class="install-label">Install command</span>
@@ -568,6 +561,43 @@ function asMetadata(value) {
     }
     return value;
 }
+function buildItemLinks(item) {
+    const meta = asMetadata(item.metadata);
+    const links = [];
+    const seen = new Set();
+    function add(label, url) {
+        if (typeof url !== 'string' || !url.startsWith('http'))
+            return;
+        if (seen.has(url))
+            return;
+        seen.add(url);
+        links.push({ label, url });
+    }
+    if (item.kind === 'cursor-extension') {
+        const vsixId = meta.vsixId;
+        if (typeof vsixId === 'string') {
+            add('Marketplace', `https://marketplace.visualstudio.com/items?itemName=${vsixId}`);
+        }
+    }
+    if (item.kind === 'gemini-extension') {
+        const pkg = meta.npmPackage;
+        if (typeof pkg === 'string') {
+            add('npm', `https://www.npmjs.com/package/${encodeURIComponent(pkg)}`);
+        }
+    }
+    add('Install page', item.install.url);
+    add('Repository', meta.repositoryUrl);
+    add('Repository', meta.githubUrl);
+    if (typeof meta.sourceRepo === 'string' && meta.sourceRepo.startsWith('http')) {
+        add('Repository', meta.sourceRepo);
+    }
+    else if (typeof meta.sourceRepo === 'string' && meta.sourceRepo.includes('/')) {
+        add('Repository', `https://github.com/${meta.sourceRepo}`);
+    }
+    add('Website', meta.websiteUrl);
+    add('Source page', meta.sourcePage);
+    return links;
+}
 function escapeHtml(value) {
     return value
         .replaceAll('&', '&amp;')

package/dist/security/live-check.js

@@ -0,0 +1,311 @@
+import path from 'node:path';
+import fs from 'fs-extra';
+import { getStatePath } from '../lib/paths.js';
+const TTL_MS = {
+    'osv': 6 * 60 * 60 * 1000,
+    'npm-registry': 6 * 60 * 60 * 1000,
+    'vscode-marketplace': 6 * 60 * 60 * 1000,
+    'github': 60 * 60 * 1000,
+    'url-health': 60 * 60 * 1000,
+};
+const DEFAULT_TTL_MS = 6 * 60 * 60 * 1000;
+async function readCache(itemId) {
+    const p = getStatePath('data', 'live-checks', `${itemId.replace(/[^a-zA-Z0-9-_.]/g, '_')}.json`);
+    try {
+        const entry = await fs.readJson(p);
+        const now = Date.now();
+        // Each result may have a different TTL — use the shortest applicable
+        const allFresh = entry.results.every(r => {
+            const ttl = TTL_MS[r.source] ?? DEFAULT_TTL_MS;
+            return now - new Date(r.checkedAt).getTime() < ttl;
+        });
+        return allFresh ? entry.results : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function writeCache(itemId, results) {
+    const p = getStatePath('data', 'live-checks', `${itemId.replace(/[^a-zA-Z0-9-_.]/g, '_')}.json`);
+    const entry = { results, cachedAt: new Date().toISOString() };
+    try {
+        await fs.ensureFile(p);
+        await fs.writeJson(p, entry, { spaces: 2 });
+    }
+    catch {
+        // cache write failure is non-fatal
+    }
+}
+async function fetchWithTimeout(url, options, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...options, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function checkOsv(pkg) {
+    const checkedAt = new Date().toISOString();
+    try {
+        const res = await fetchWithTimeout('https://api.osv.dev/v1/query', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ package: { name: pkg, ecosystem: 'npm' } }),
+        }, 6000);
+        if (!res.ok) {
+            return { source: 'osv', label: 'OSV vulnerability database', status: 'error', findings: [], checkedAt };
+        }
+        const data = await res.json();
+        const vulns = data.vulns ?? [];
+        if (vulns.length === 0) {
+            return {
+                source: 'osv', label: 'OSV vulnerability database', status: 'clean',
+                findings: [{ severity: 'info', text: 'No known vulnerabilities' }],
+                checkedAt,
+            };
+        }
+        return {
+            source: 'osv', label: 'OSV vulnerability database', status: 'flagged',
+            findings: vulns.slice(0, 5).map(v => ({
+                severity: 'critical',
+                text: `${v.id}${v.summary ? ': ' + v.summary.slice(0, 100) : ''}`,
+            })),
+            checkedAt,
+        };
+    }
+    catch {
+        return { source: 'osv', label: 'OSV vulnerability database', status: 'error', findings: [{ severity: 'info', text: 'Check timed out' }], checkedAt };
+    }
+}
+async function checkNpmRegistry(pkg) {
+    const checkedAt = new Date().toISOString();
+    try {
+        const res = await fetchWithTimeout(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`, { headers: { 'User-Agent': 'plugscout/1.0' } }, 6000);
+        if (!res.ok) {
+            return { source: 'npm-registry', label: 'npm registry', status: 'unavailable', findings: [{ severity: 'warn', text: `Package not found (HTTP ${res.status})` }], checkedAt };
+        }
+        const data = await res.json();
+        if (data.deprecated) {
+            const msg = typeof data.deprecated === 'string' ? data.deprecated : 'package is deprecated';
+            return {
+                source: 'npm-registry', label: 'npm registry', status: 'flagged',
+                findings: [{ severity: 'warn', text: `Deprecated: ${msg}` }],
+                checkedAt,
+            };
+        }
+        return {
+            source: 'npm-registry', label: 'npm registry', status: 'clean',
+            findings: [{ severity: 'info', text: `Latest: v${data.version ?? 'unknown'} — not deprecated` }],
+            checkedAt,
+        };
+    }
+    catch {
+        return { source: 'npm-registry', label: 'npm registry', status: 'error', findings: [{ severity: 'info', text: 'Check timed out' }], checkedAt };
+    }
+}
+async function checkVscodeMarketplace(vsixId) {
+    const checkedAt = new Date().toISOString();
+    try {
+        const res = await fetchWithTimeout('https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json;api-version=7.2-preview.1',
+                'User-Agent': 'plugscout/1.0',
+            },
+            body: JSON.stringify({
+                filters: [{ criteria: [{ filterType: 7, value: vsixId }] }],
+                flags: 0x200 | 0x100 | 0x20, // statistics + assetUri + excludeNonValidated
+            }),
+        }, 8000);
+        if (!res.ok) {
+            return { source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'error', findings: [], checkedAt };
+        }
+        const data = await res.json();
+        const ext = data.results?.[0]?.extensions?.[0];
+        if (!ext) {
+            return {
+                source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'unavailable',
+                findings: [{ severity: 'warn', text: 'Extension not found in marketplace — may have been removed' }],
+                checkedAt,
+            };
+        }
+        const findings = [];
+        const verified = ext.publisher.isDomainVerified ?? false;
+        const latest = ext.versions?.[0];
+        const installs = ext.statistics?.find(s => s.statisticName === 'install')?.value ?? 0;
+        findings.push({
+            severity: verified ? 'info' : 'warn',
+            text: verified ? 'Publisher domain verified' : 'Publisher not domain-verified',
+        });
+        if (latest) {
+            findings.push({ severity: 'info', text: `v${latest.version} — updated ${latest.lastUpdated.slice(0, 10)}` });
+        }
+        if (installs > 0) {
+            findings.push({ severity: 'info', text: `${installs.toLocaleString()} installs` });
+        }
+        return {
+            source: 'vscode-marketplace', label: 'VS Code Marketplace',
+            status: verified ? 'clean' : 'flagged',
+            findings, checkedAt,
+        };
+    }
+    catch {
+        return { source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'error', findings: [{ severity: 'info', text: 'Check timed out' }], checkedAt };
+    }
+}
+function extractGithubOwnerRepo(url) {
+    const m = url.match(/github\.com\/([^/]+\/[^/]+?)(?:\/|$|#|\?|\.git)/);
+    return m ? m[1] : null;
+}
+async function checkGithubRepo(ownerRepo) {
+    const checkedAt = new Date().toISOString();
+    try {
+        const res = await fetchWithTimeout(`https://api.github.com/repos/${ownerRepo}`, { headers: { 'User-Agent': 'plugscout/1.0', 'Accept': 'application/vnd.github.v3+json' } }, 6000);
+        if (res.status === 404) {
+            return {
+                source: 'github', label: 'GitHub repository', status: 'unavailable',
+                findings: [{ severity: 'warn', text: 'Repository not found or private' }],
+                checkedAt,
+            };
+        }
+        if (res.status === 403) {
+            return { source: 'github', label: 'GitHub repository', status: 'error', findings: [{ severity: 'info', text: 'Rate limited — try again later' }], checkedAt };
+        }
+        if (!res.ok) {
+            return { source: 'github', label: 'GitHub repository', status: 'error', findings: [], checkedAt };
+        }
+        const repo = await res.json();
+        const findings = [];
+        if (repo.disabled) {
+            findings.push({ severity: 'critical', text: 'Repository is disabled' });
+        }
+        else if (repo.archived) {
+            findings.push({ severity: 'warn', text: 'Repository is archived — no longer maintained' });
+        }
+        else {
+            const lastPush = repo.pushed_at ? repo.pushed_at.slice(0, 10) : 'unknown';
+            findings.push({ severity: 'info', text: `Active — last push: ${lastPush}` });
+        }
+        return {
+            source: 'github', label: 'GitHub repository',
+            status: (repo.archived || repo.disabled) ? 'flagged' : 'clean',
+            findings, checkedAt,
+        };
+    }
+    catch {
+        return { source: 'github', label: 'GitHub repository', status: 'error', findings: [{ severity: 'info', text: 'Check timed out' }], checkedAt };
+    }
+}
+async function checkUrlHealth(url) {
+    const checkedAt = new Date().toISOString();
+    try {
+        const res = await fetchWithTimeout(url, { method: 'HEAD', headers: { 'User-Agent': 'plugscout/1.0' } }, 6000);
+        // 405 = HEAD not allowed but server is live
+        const reachable = res.status < 400 || res.status === 405;
+        return {
+            source: 'url-health', label: 'Install URL',
+            status: reachable ? 'clean' : 'flagged',
+            findings: [{ severity: reachable ? 'info' : 'warn', text: `HTTP ${res.status} — ${reachable ? 'reachable' : 'not reachable'}` }],
+            checkedAt,
+        };
+    }
+    catch {
+        return {
+            source: 'url-health', label: 'Install URL', status: 'flagged',
+            findings: [{ severity: 'warn', text: 'URL unreachable' }],
+            checkedAt,
+        };
+    }
+}
+function asMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    return value;
+}
+function findGithubOwnerRepo(item, meta) {
+    const candidates = [meta.repositoryUrl, meta.githubUrl, meta.sourceRepo];
+    for (const c of candidates) {
+        if (typeof c === 'string') {
+            if (c.includes('github.com')) {
+                const r = extractGithubOwnerRepo(c);
+                if (r)
+                    return r;
+            }
+            else if (!c.startsWith('http') && c.includes('/')) {
+                return c;
+            }
+        }
+    }
+    const installUrl = item.install.url;
+    if (typeof installUrl === 'string' && installUrl.includes('github.com')) {
+        return extractGithubOwnerRepo(installUrl);
+    }
+    return null;
+}
+export async function runLiveChecks(item, opts = {}) {
+    if (!opts.noCache) {
+        const cached = await readCache(item.id);
+        if (cached)
+            return cached;
+    }
+    const meta = asMetadata(item.metadata);
+    const checks = [];
+    const npmPkg = typeof meta.npmPackage === 'string' ? meta.npmPackage : null;
+    if (npmPkg) {
+        checks.push(checkOsv(npmPkg));
+        checks.push(checkNpmRegistry(npmPkg));
+    }
+    if (item.kind === 'cursor-extension') {
+        const vsixId = typeof meta.vsixId === 'string' ? meta.vsixId : null;
+        if (vsixId) {
+            checks.push(checkVscodeMarketplace(vsixId));
+        }
+    }
+    const ghOwnerRepo = findGithubOwnerRepo(item, meta);
+    if (ghOwnerRepo) {
+        checks.push(checkGithubRepo(ghOwnerRepo));
+    }
+    if (item.kind === 'claude-plugin' || item.kind === 'claude-connector') {
+        const installUrl = item.install.url;
+        if (typeof installUrl === 'string' && installUrl.startsWith('https://')) {
+            checks.push(checkUrlHealth(installUrl));
+        }
+    }
+    if (checks.length === 0)
+        return [];
+    const results = await Promise.all(checks);
+    await writeCache(item.id, results);
+    return results;
+}
+export function formatLiveChecks(results) {
+    if (results.length === 0)
+        return '';
+    const lines = ['\nLive checks:'];
+    for (const r of results) {
+        const icon = r.status === 'clean' ? '\x1b[32m✓\x1b[0m'
+            : r.status === 'flagged' ? '\x1b[31m✗\x1b[0m'
+                : r.status === 'unavailable' ? '\x1b[33m?\x1b[0m'
+                    : '\x1b[90m~\x1b[0m';
+        const cached = new Date(r.checkedAt).getTime() < Date.now() - 10000 ? ' \x1b[90m(cached)\x1b[0m' : '';
+        lines.push(`  ${icon} ${r.label}${cached}`);
+        for (const f of r.findings) {
+            const fc = f.severity === 'critical' ? '\x1b[31m' : f.severity === 'warn' ? '\x1b[33m' : '\x1b[90m';
+            lines.push(`      ${fc}${f.text}\x1b[0m`);
+        }
+    }
+    return lines.join('\n');
+}
+export async function clearLiveCheckCache(itemId) {
+    if (itemId) {
+        const p = getStatePath('data', 'live-checks', `${itemId.replace(/[^a-zA-Z0-9-_.]/g, '_')}.json`);
+        await fs.remove(p);
+    }
+    else {
+        await fs.emptyDir(getStatePath('data', 'live-checks'));
+    }
+}
+// Suppress unused import warning — path is used implicitly via getStatePath internals
+void path.resolve;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shnitzel/plugscout",
-  "version": "0.3.24",
+  "version": "0.3.26",
   "description": "Claude plugins + Claude connectors + Copilot extensions + Skills + MCP security intelligence framework",
   "private": false,
   "type": "module",