@shnitzel/plugscout 0.3.26 → 0.3.27

package/dist/security/live-check.js

@@ -107,6 +107,9 @@ async function checkNpmRegistry(pkg) {
 }
 async function checkVscodeMarketplace(vsixId) {
     const checkedAt = new Date().toISOString();
+    const error = (status, text) => ({
+        result: { source: 'vscode-marketplace', label: 'VS Code Marketplace', status, findings: text ? [{ severity: 'info', text }] : [], checkedAt },
+    });
     try {
         const res = await fetchWithTimeout('https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery', {
             method: 'POST',
@@ -117,21 +120,28 @@ async function checkVscodeMarketplace(vsixId) {
             },
             body: JSON.stringify({
                 filters: [{ criteria: [{ filterType: 7, value: vsixId }] }],
-                flags: 0x200 | 0x100 | 0x20, // statistics + assetUri + excludeNonValidated
+                // statistics (0x200) + assetUri (0x100) + excludeNonValidated (0x20) + versionProperties (0x10)
+                flags: 0x200 | 0x100 | 0x20 | 0x10,
             }),
         }, 8000);
-        if (!res.ok) {
-            return { source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'error', findings: [], checkedAt };
-        }
+        if (!res.ok)
+            return error('error');
         const data = await res.json();
         const ext = data.results?.[0]?.extensions?.[0];
         if (!ext) {
             return {
-                source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'unavailable',
-                findings: [{ severity: 'warn', text: 'Extension not found in marketplace — may have been removed' }],
-                checkedAt,
+                result: {
+                    source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'unavailable',
+                    findings: [{ severity: 'warn', text: 'Extension not found in marketplace — may have been removed' }],
+                    checkedAt,
+                },
             };
         }
+        // Extract GitHub repository URL from version properties
+        const props = ext.versions?.[0]?.properties ?? [];
+        const repoProp = props.find(p => p.key === 'Microsoft.VisualStudio.Services.Links.Source' ||
+            p.key === 'Microsoft.VisualStudio.Services.Links.GitHub');
+        const repositoryUrl = repoProp?.value?.includes('github.com') ? repoProp.value : undefined;
         const findings = [];
         const verified = ext.publisher.isDomainVerified ?? false;
         const latest = ext.versions?.[0];
@@ -147,13 +157,16 @@ async function checkVscodeMarketplace(vsixId) {
             findings.push({ severity: 'info', text: `${installs.toLocaleString()} installs` });
         }
         return {
-            source: 'vscode-marketplace', label: 'VS Code Marketplace',
-            status: verified ? 'clean' : 'flagged',
-            findings, checkedAt,
+            result: {
+                source: 'vscode-marketplace', label: 'VS Code Marketplace',
+                status: verified ? 'clean' : 'flagged',
+                findings, checkedAt,
+            },
+            repositoryUrl,
         };
     }
     catch {
-        return { source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'error', findings: [{ severity: 'info', text: 'Check timed out' }], checkedAt };
+        return error('error', 'Check timed out');
     }
 }
 function extractGithubOwnerRepo(url) {
@@ -258,15 +271,24 @@ export async function runLiveChecks(item, opts = {}) {
         checks.push(checkOsv(npmPkg));
         checks.push(checkNpmRegistry(npmPkg));
     }
+    // cursor-extension: marketplace first (to extract repo URL), then github check if found
+    const cursorMarketplaceResults = [];
     if (item.kind === 'cursor-extension') {
         const vsixId = typeof meta.vsixId === 'string' ? meta.vsixId : null;
         if (vsixId) {
-            checks.push(checkVscodeMarketplace(vsixId));
+            const mkt = await checkVscodeMarketplace(vsixId);
+            cursorMarketplaceResults.push(mkt.result);
+            const ghOwnerRepo = mkt.repositoryUrl ? extractGithubOwnerRepo(mkt.repositoryUrl) : findGithubOwnerRepo(item, meta);
+            if (ghOwnerRepo) {
+                checks.push(checkGithubRepo(ghOwnerRepo));
+            }
         }
     }
-    const ghOwnerRepo = findGithubOwnerRepo(item, meta);
-    if (ghOwnerRepo) {
-        checks.push(checkGithubRepo(ghOwnerRepo));
+    else {
+        const ghOwnerRepo = findGithubOwnerRepo(item, meta);
+        if (ghOwnerRepo) {
+            checks.push(checkGithubRepo(ghOwnerRepo));
+        }
     }
     if (item.kind === 'claude-plugin' || item.kind === 'claude-connector') {
         const installUrl = item.install.url;
@@ -274,9 +296,9 @@ export async function runLiveChecks(item, opts = {}) {
             checks.push(checkUrlHealth(installUrl));
         }
     }
-    if (checks.length === 0)
+    const results = [...cursorMarketplaceResults, ...(checks.length > 0 ? await Promise.all(checks) : [])];
+    if (results.length === 0)
         return [];
-    const results = await Promise.all(checks);
     await writeCache(item.id, results);
     return results;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shnitzel/plugscout",
-  "version": "0.3.26",
+  "version": "0.3.27",
   "description": "Claude plugins + Claude connectors + Copilot extensions + Skills + MCP security intelligence framework",
   "private": false,
   "type": "module",