@shnitzel/plugscout 0.3.26 → 0.3.28

package/dist/interfaces/cli/index.js

@@ -480,7 +480,7 @@ async function handleList(args) {
     if (details) {
         console.log(renderCatalogDecisionDetails(filtered, policy, insights));
     }
-    await promptResultBrowser(filtered.map((e) => ({ id: e.item.id, name: e.item.name })));
+    await promptResultBrowser(filtered.map((e) => ({ id: e.item.id, name: e.item.name, url: buildItemLinks(e.item)[0]?.url })));
 }
 async function handleShow(args) {
     const id = readFlag(args, '--id');
@@ -560,7 +560,7 @@ async function handleSearch(args) {
         name: entry.item.name
     }))));
     printHint('Use `show --id <catalog-id>` for full detail.');
-    await promptResultBrowser(matches.map((e) => ({ id: e.item.id, name: e.item.name })));
+    await promptResultBrowser(matches.map((e) => ({ id: e.item.id, name: e.item.name, url: buildItemLinks(e.item)[0]?.url })));
 }
 async function handleExplain(args) {
     const kinds = readKinds(args);
@@ -681,12 +681,16 @@ async function handleTop(args) {
     printHint('Review each suggestion before installing. Do not install blindly from rank alone.');
     printHint(`Risk scale (lower is safer): ${formatRiskScale(policy)}`);
     printHint('Use `show --id <catalog-id>` or `assess --id <catalog-id>` for deep inspection.');
+    const topCatalogItems = await loadCatalogItems();
+    const topCatalogMap = new Map(topCatalogItems.map((item) => [item.id, item]));
     if (details) {
-        const [catalogItems, insights] = await Promise.all([loadCatalogItems(), loadItemInsights()]);
-        const catalogMap = new Map(catalogItems.map((item) => [item.id, item]));
-        console.log(renderRecommendationDecisionDetails(safe, catalogMap, policy, insights));
+        const insights = await loadItemInsights();
+        console.log(renderRecommendationDecisionDetails(safe, topCatalogMap, policy, insights));
     }
-    await promptResultBrowser(safe.map((e) => ({ id: e.id, name: '' })));
+    await promptResultBrowser(safe.map((e) => {
+        const item = topCatalogMap.get(e.id);
+        return { id: e.id, name: '', url: item ? buildItemLinks(item)[0]?.url : undefined };
+    }));
 }
 async function handleSync(args) {
     const kinds = readKinds(args);
@@ -787,7 +791,12 @@ async function handleRecommend(args) {
     }
     printHint('Next: run `show --id <catalog-id>` or `install --id <catalog-id> --yes`.');
     if (format !== 'json') {
-        await promptResultBrowser(ranked.map((e) => ({ id: e.id, name: '' })));
+        const recCatalogItems = await loadCatalogItems();
+        const recCatalogMap = new Map(recCatalogItems.map((item) => [item.id, item]));
+        await promptResultBrowser(ranked.map((e) => {
+            const item = recCatalogMap.get(e.id);
+            return { id: e.id, name: '', url: item ? buildItemLinks(item)[0]?.url : undefined };
+        }));
     }
 }
 async function handleWeb(args) {
@@ -1173,15 +1182,16 @@ async function promptResultBrowser(entries) {
     const ENTER = '\r';
     const CTRL_C = '';
     const Q = 'q';
-    // Single-line navigator — no second table. The rendered results above are the reference.
+    // Two-line navigator: id/name line + url line (blank if none). Always writes 2 lines so cursor math is stable.
     function renderNavigator(firstRender) {
         if (!firstRender) {
-            moveCursor(process.stdout, 0, -1);
+            moveCursor(process.stdout, 0, -2);
             clearScreenDown(process.stdout);
         }
         const entry = entries[selected];
         const label = entry.name ? `${entry.id}  \x1b[90m${entry.name}\x1b[0m` : entry.id;
         process.stdout.write(`  \x1b[36m❯\x1b[0m  ${label}  \x1b[90m(${selected + 1}/${entries.length})\x1b[0m\n`);
+        process.stdout.write(entry.url ? `     \x1b[90m${entry.url}\x1b[0m\n` : '\n');
     }
     // eslint-disable-next-line prefer-const
     let running = true;

package/dist/security/live-check.js

@@ -107,6 +107,9 @@ async function checkNpmRegistry(pkg) {
 }
 async function checkVscodeMarketplace(vsixId) {
     const checkedAt = new Date().toISOString();
+    const error = (status, text) => ({
+        result: { source: 'vscode-marketplace', label: 'VS Code Marketplace', status, findings: text ? [{ severity: 'info', text }] : [], checkedAt },
+    });
     try {
         const res = await fetchWithTimeout('https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery', {
             method: 'POST',
@@ -117,21 +120,28 @@ async function checkVscodeMarketplace(vsixId) {
             },
             body: JSON.stringify({
                 filters: [{ criteria: [{ filterType: 7, value: vsixId }] }],
-                flags: 0x200 | 0x100 | 0x20, // statistics + assetUri + excludeNonValidated
+                // statistics (0x200) + assetUri (0x100) + excludeNonValidated (0x20) + versionProperties (0x10)
+                flags: 0x200 | 0x100 | 0x20 | 0x10,
             }),
         }, 8000);
-        if (!res.ok) {
-            return { source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'error', findings: [], checkedAt };
-        }
+        if (!res.ok)
+            return error('error');
         const data = await res.json();
         const ext = data.results?.[0]?.extensions?.[0];
         if (!ext) {
             return {
-                source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'unavailable',
-                findings: [{ severity: 'warn', text: 'Extension not found in marketplace — may have been removed' }],
-                checkedAt,
+                result: {
+                    source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'unavailable',
+                    findings: [{ severity: 'warn', text: 'Extension not found in marketplace — may have been removed' }],
+                    checkedAt,
+                },
             };
         }
+        // Extract GitHub repository URL from version properties
+        const props = ext.versions?.[0]?.properties ?? [];
+        const repoProp = props.find(p => p.key === 'Microsoft.VisualStudio.Services.Links.Source' ||
+            p.key === 'Microsoft.VisualStudio.Services.Links.GitHub');
+        const repositoryUrl = repoProp?.value?.includes('github.com') ? repoProp.value : undefined;
         const findings = [];
         const verified = ext.publisher.isDomainVerified ?? false;
         const latest = ext.versions?.[0];
@@ -147,13 +157,16 @@ async function checkVscodeMarketplace(vsixId) {
             findings.push({ severity: 'info', text: `${installs.toLocaleString()} installs` });
         }
         return {
-            source: 'vscode-marketplace', label: 'VS Code Marketplace',
-            status: verified ? 'clean' : 'flagged',
-            findings, checkedAt,
+            result: {
+                source: 'vscode-marketplace', label: 'VS Code Marketplace',
+                status: verified ? 'clean' : 'flagged',
+                findings, checkedAt,
+            },
+            repositoryUrl,
         };
     }
     catch {
-        return { source: 'vscode-marketplace', label: 'VS Code Marketplace', status: 'error', findings: [{ severity: 'info', text: 'Check timed out' }], checkedAt };
+        return error('error', 'Check timed out');
     }
 }
 function extractGithubOwnerRepo(url) {
@@ -258,15 +271,24 @@ export async function runLiveChecks(item, opts = {}) {
         checks.push(checkOsv(npmPkg));
         checks.push(checkNpmRegistry(npmPkg));
     }
+    // cursor-extension: marketplace first (to extract repo URL), then github check if found
+    const cursorMarketplaceResults = [];
     if (item.kind === 'cursor-extension') {
         const vsixId = typeof meta.vsixId === 'string' ? meta.vsixId : null;
         if (vsixId) {
-            checks.push(checkVscodeMarketplace(vsixId));
+            const mkt = await checkVscodeMarketplace(vsixId);
+            cursorMarketplaceResults.push(mkt.result);
+            const ghOwnerRepo = mkt.repositoryUrl ? extractGithubOwnerRepo(mkt.repositoryUrl) : findGithubOwnerRepo(item, meta);
+            if (ghOwnerRepo) {
+                checks.push(checkGithubRepo(ghOwnerRepo));
+            }
         }
     }
-    const ghOwnerRepo = findGithubOwnerRepo(item, meta);
-    if (ghOwnerRepo) {
-        checks.push(checkGithubRepo(ghOwnerRepo));
+    else {
+        const ghOwnerRepo = findGithubOwnerRepo(item, meta);
+        if (ghOwnerRepo) {
+            checks.push(checkGithubRepo(ghOwnerRepo));
+        }
     }
     if (item.kind === 'claude-plugin' || item.kind === 'claude-connector') {
         const installUrl = item.install.url;
@@ -274,9 +296,9 @@ export async function runLiveChecks(item, opts = {}) {
             checks.push(checkUrlHealth(installUrl));
         }
     }
-    if (checks.length === 0)
+    const results = [...cursorMarketplaceResults, ...(checks.length > 0 ? await Promise.all(checks) : [])];
+    if (results.length === 0)
         return [];
-    const results = await Promise.all(checks);
     await writeCache(item.id, results);
     return results;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shnitzel/plugscout",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "Claude plugins + Claude connectors + Copilot extensions + Skills + MCP security intelligence framework",
   "private": false,
   "type": "module",