@trendai-crem/claude-skills 0.7.2 → 0.9.0

package/cli.js

@@ -38,6 +38,14 @@ const teamSkills = readdirSync(join(__dir, 'skills'), { withFileTypes: true })
 
 const teamOk = run(['skills', 'add', __dir, '--all', '-g', '-y'], 'team skills');
 
+// 3. Marketplace plugins — failures are non-fatal
+let marketplaceResults = [];
+try {
+  marketplaceResults = installMarketplacePlugins();
+} catch (err) {
+  console.error(`\nmarketplace plugin installation failed unexpectedly: ${err.message}`);
+}
+
 // Summary
 console.log('\nResults:');
 externalResults.forEach(({ label, ok }) => console.log(`  ${ok ? '✓' : '✗'} ${label}`));
@@ -46,6 +54,9 @@ if (teamOk) {
 } else {
   console.log(`  ✗ team skills`);
 }
+marketplaceResults.forEach(({ plugin, action, ok }) =>
+  console.log(`  ${ok ? '✓' : '✗'} ${plugin} (${action})`)
+);
 
 if (!teamOk) {
   console.error('\nFATAL: Team skills installation failed.');
@@ -57,23 +68,178 @@ if (externalFailed.length > 0) {
   console.warn(`\nWARN: ${externalFailed.length} external source(s) failed — team skills installed successfully.`);
 }
 
+const marketplaceFailed = marketplaceResults.filter(r => !r.ok);
+if (marketplaceFailed.length > 0) {
+  console.warn(`\nWARN: ${marketplaceFailed.length} marketplace plugin(s) failed — team skills installed successfully.`);
+}
+
 // Configure update-check hooks
 setupAutoUpdate();
 
+// Reads a JSON file and returns its parsed value if it is a non-null, non-array object.
+// Returns `fallback` on any error (missing file, parse failure, wrong type).
+function readJsonObject(filePath, fallback, label) {
+  if (!existsSync(filePath)) return fallback;
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed;
+    console.warn(`\nWARN: Ignoring invalid ${label}: expected JSON object`);
+  } catch (err) {
+    console.warn(`\nWARN: Ignoring invalid ${label}: ${err.message}`);
+  }
+  return fallback;
+}
+
+// Extracts the registered source URL for a marketplace from known_marketplaces.json.
+// Handles both string entries and object entries with a `source` field.
+function getRegisteredMarketplaceSource(known, marketplaceName) {
+  const entry = known[marketplaceName];
+  if (typeof entry === 'string') return entry;
+  if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+    return typeof entry.source === 'string' ? entry.source : null;
+  }
+  return null;
+}
+
+// Normalizes a marketplace source URL to a canonical host/path form for comparison.
+// Treats SSH and HTTPS URLs pointing to the same repo as equivalent.
+// Returns null if the URL cannot be parsed.
+function normalizeMarketplaceSource(rawSource) {
+  const sshMatch = /^git@([^:]+):(.+?)(?:\.git)?$/.exec(rawSource);
+  if (sshMatch) {
+    return `${sshMatch[1].toLowerCase()}/${sshMatch[2].replace(/^\/+/, '').replace(/\.git$/, '')}`;
+  }
+  try {
+    const url = new URL(rawSource);
+    return `${url.hostname.toLowerCase()}/${url.pathname.replace(/^\/+/, '').replace(/\.git$/, '')}`;
+  } catch {
+    return null;
+  }
+}
+
+function installMarketplacePlugins() {
+  const configPath = join(__dir, 'marketplace.json');
+  if (!existsSync(configPath)) return [];
+
+  // Parse and validate marketplace.json — all failures are non-fatal (SCD-7)
+  const config = readJsonObject(configPath, null, 'marketplace.json');
+  const { marketplace, plugins } = config ?? {};
+
+  // Input validation + allowlisting (SCD-1, OWASP-A04)
+  // Leading `-` is rejected to prevent argv injection: `claude plugin install -s` parses as flag.
+  const SAFE_NAME = /^(?!-)[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+  const SAFE_SOURCE = /^(git@[\w.-]+:[\w.\-/]+\.git|https:\/\/[\w.-]+\/[\w.\-/]+\.git)$/;
+
+  if (
+    typeof marketplace?.name !== 'string' ||
+    typeof marketplace?.source !== 'string' ||
+    !Array.isArray(plugins)
+  ) {
+    console.error('\nInvalid marketplace.json: missing required fields (marketplace.name, marketplace.source, plugins[])');
+    return [];
+  }
+  if (!SAFE_NAME.test(marketplace.name) || !SAFE_SOURCE.test(marketplace.source)) {
+    console.error('\nInvalid marketplace name or source URL in marketplace.json');
+    return [];
+  }
+  // Reject the entire config on any invalid plugin name (fail-closed, not silent filter).
+  const invalidPlugins = plugins.filter(p => typeof p !== 'string' || !SAFE_NAME.test(p));
+  if (invalidPlugins.length > 0) {
+    console.error(`\nInvalid plugin names in marketplace.json: ${invalidPlugins.map(p => JSON.stringify(p)).join(', ')}`);
+    return [];
+  }
+  const validPlugins = plugins;
+
+  const { name: marketplaceName, source } = marketplace;
+  console.log(`\nInstalling marketplace plugins (${marketplaceName})...\n`);
+
+  // Register marketplace if not already known — verify source matches to prevent supply-chain mismatch (OWASP-A08)
+  const knownPath = join(homedir(), '.claude', 'plugins', 'known_marketplaces.json');
+  // Distinguish "file missing" (first-run, safe) from "file corrupted" (fail-closed).
+  const knownExists = existsSync(knownPath);
+  const known = readJsonObject(knownPath, knownExists ? null : {}, 'known_marketplaces.json');
+  if (knownExists && known === null) {
+    console.error('\nInvalid known_marketplaces.json: refusing to register marketplace automatically');
+    return validPlugins.map(plugin => ({ plugin, action: 'skipped (invalid marketplace registry)', ok: false }));
+  }
+  const registeredSource = getRegisteredMarketplaceSource(known, marketplaceName);
+  const normalizedSource = normalizeMarketplaceSource(source);
+  const normalizedRegistered = registeredSource ? normalizeMarketplaceSource(registeredSource) : null;
+
+  if (registeredSource && (!normalizedRegistered || normalizedRegistered !== normalizedSource)) {
+    console.error(`\nMarketplace source mismatch for ${marketplaceName}: registered as ${registeredSource}, but marketplace.json specifies ${source}`);
+    return validPlugins.map(plugin => ({ plugin, action: 'skipped (source mismatch)', ok: false }));
+  }
+
+  if (!registeredSource) {
+    try {
+      execFileSync('claude', ['plugin', 'marketplace', 'add', source, '--scope', 'user'], {
+        stdio: 'inherit',
+      });
+    } catch (error) {
+      const exitInfo = error.status != null ? `exit ${error.status}` : error.code ?? error.message;
+      console.error(`\nFailed to register marketplace: ${marketplaceName} (${exitInfo})`);
+      return validPlugins.map(plugin => ({ plugin, action: 'skipped (no marketplace)', ok: false }));
+    }
+  }
+
+  // Always update marketplace to pull latest plugin versions before install/update
+  try {
+    execFileSync('claude', ['plugin', 'marketplace', 'update', marketplaceName], { stdio: 'inherit' });
+  } catch (error) {
+    const exitInfo = error.status != null ? `exit ${error.status}` : error.code ?? error.message;
+    console.warn(`\nWARN: Failed to update marketplace ${marketplaceName} (${exitInfo}) — using cached version`);
+  }
+
+  // Load installed plugin registry (SCD-7)
+  const installedPath = join(homedir(), '.claude', 'plugins', 'installed_plugins.json');
+  const installedData = readJsonObject(installedPath, {}, 'installed_plugins.json');
+  // installed_plugins.json v2 nests under "plugins", v1 is flat
+  const rawInstalled = installedData.plugins ?? installedData;
+  const installed = (typeof rawInstalled === 'object' && rawInstalled !== null && !Array.isArray(rawInstalled))
+    ? rawInstalled
+    : {};
+
+  return validPlugins.map(plugin => {
+    const key = `${plugin}@${marketplaceName}`;
+    const isInstalled = Object.hasOwn(installed, key); // Object.hasOwn avoids prototype chain traversal (SCD-7)
+    const action = isInstalled ? 'update' : 'install';
+    const args = isInstalled
+      ? ['plugin', 'update', key]
+      : ['plugin', 'install', key, '--scope', 'user'];
+    try {
+      execFileSync('claude', args, { stdio: 'inherit' });
+      return { plugin, action, ok: true };
+    } catch (error) {
+      const exitInfo = error.status != null ? `exit ${error.status}` : error.code ?? error.message;
+      console.error(`\nFailed: ${key} ${action} (${exitInfo})`);
+      return { plugin, action, ok: false };
+    }
+  });
+}
+
 function setupAutoUpdate() {
   const { version: installedVersion } = JSON.parse(
     readFileSync(join(__dir, 'package.json'), 'utf8')
   );
 
-  const claudeDir    = join(homedir(), '.claude');
-  const hooksDir     = join(claudeDir, 'hooks');
-  const hookScript   = join(hooksDir, 'auto-update-claude-skills.sh');
-  const stampFile    = join(homedir(), '.cache', 'claude-skills-version-check.json');
-  const settingsPath = join(claudeDir, 'settings.json');
+  const claudeDir      = join(homedir(), '.claude');
+  const hooksDir       = join(claudeDir, 'hooks');
+  const cacheDir       = join(homedir(), '.cache');
+  const installScript  = join(hooksDir, 'claude-skills-install-update.sh');
+  const notifyScript   = join(hooksDir, 'auto-update-claude-skills.sh');
+  const installStamp   = join(cacheDir, 'claude-skills-install-check.json');
+  const notifyStamp    = join(cacheDir, 'claude-skills-version-check.json');
+  const settingsPath   = join(claudeDir, 'settings.json');
 
   mkdirSync(hooksDir, { recursive: true });
-  mkdirSync(join(homedir(), '.cache'), { recursive: true });
-  writeFileSync(hookScript, buildHookScript(stampFile, installedVersion), { mode: 0o755 });
+  mkdirSync(cacheDir, { recursive: true });
+
+  // SessionStart: auto-install if update available (24h throttle, synchronous)
+  writeFileSync(installScript, buildInstallScript(installStamp, installedVersion), { mode: 0o755 });
+
+  // UserPromptSubmit: notify only if update available (2h throttle)
+  writeFileSync(notifyScript, buildNotifyScript(notifyStamp, installedVersion), { mode: 0o755 });
 
   // Merge hooks into ~/.claude/settings.json (idempotent)
   let settings = {};
@@ -89,22 +255,22 @@ function setupAutoUpdate() {
 
   settings.hooks ??= {};
 
-  // SessionStart — check once at session start
+  // SessionStart — auto-install update (24h throttle)
   settings.hooks.SessionStart ??= [];
   settings.hooks.SessionStart = settings.hooks.SessionStart.filter(
-    e => !e.hooks?.some(h => typeof h.command === 'string' && h.command === hookScript)
+    e => !e.hooks?.some(h => typeof h.command === 'string' && h.command === installScript)
   );
   settings.hooks.SessionStart.push({
-    hooks: [{ type: 'command', command: hookScript }]
+    hooks: [{ type: 'command', command: installScript }]
   });
 
-  // UserPromptSubmit — periodic in-session check (throttled by stamp file)
+  // UserPromptSubmit — notify only (2h throttle)
   settings.hooks.UserPromptSubmit ??= [];
   settings.hooks.UserPromptSubmit = settings.hooks.UserPromptSubmit.filter(
-    e => !e.hooks?.some(h => typeof h.command === 'string' && h.command === hookScript)
+    e => !e.hooks?.some(h => typeof h.command === 'string' && h.command === notifyScript)
   );
   settings.hooks.UserPromptSubmit.push({
-    hooks: [{ type: 'command', command: hookScript }]
+    hooks: [{ type: 'command', command: notifyScript }]
   });
 
   // Atomic write
@@ -112,27 +278,24 @@ function setupAutoUpdate() {
   writeFileSync(tmpPath, JSON.stringify(settings, null, 2) + '\n');
   renameSync(tmpPath, settingsPath);
 
-  console.log('\n✓ Update-check hooks configured (SessionStart + UserPromptSubmit)');
+  console.log('\n✓ Update hooks configured (SessionStart: auto-install, UserPromptSubmit: notify)');
 }
 
-function buildHookScript(stampFile, installedVersion) {
+function buildInstallScript(stampFile, installedVersion) {
   if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(installedVersion)) {
     throw new Error(`Invalid version format in package.json: ${installedVersion}`);
   }
-
   return `#!/usr/bin/env bash
-# claude-skills update check — runs at session start and periodically during session.
-# If a newer version is available, outputs a systemMessage notification (no auto-install).
+# SessionStart: auto-install claude-skills update if available (24h throttle).
 set -euo pipefail
 
 STAMP="${stampFile}"
 PACKAGE="@trendai-crem/claude-skills"
 INSTALLED="${installedVersion}"
-MIN_INTERVAL=$((60 * 60 * 2))  # check at most every 2h
+MIN_INTERVAL=$((60 * 60 * 24))  # at most once per 24h
 
 mkdir -p "$(dirname "$STAMP")"
 
-# Throttle: skip if checked recently
 LAST_TS=0
 if [ -f "$STAMP" ]; then
   LAST_TS=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('ts',0))" "$STAMP" 2>/dev/null || echo 0)
@@ -142,18 +305,56 @@ fi
 NOW=$(date +%s)
 [ $(( NOW - LAST_TS )) -lt $MIN_INTERVAL ] && exit 0
 
-# Update timestamp
 python3 -c "import json,sys; json.dump({'ts': int(sys.argv[1])}, open(sys.argv[2],'w'))" "$NOW" "$STAMP"
 
-# Check latest version on npm
 LATEST=$(npm view "$PACKAGE" version 2>/dev/null || echo "")
 [ -z "$LATEST" ] && exit 0
 [ "$LATEST" = "$INSTALLED" ] && exit 0
+[[ "$LATEST" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]] || exit 0
+
+# Install update synchronously
+INSTALL_DIR="$(mktemp -d)"
+if npm install --prefix "$INSTALL_DIR" "$PACKAGE@$LATEST" --silent 2>/dev/null \
+   && node "$INSTALL_DIR/node_modules/$PACKAGE/cli.js" 2>/dev/null; then
+  rm -rf "$INSTALL_DIR"
+  python3 -c "import json,sys; print(json.dumps({'systemMessage': 'claude-skills updated: ' + sys.argv[1] + ' \u2192 ' + sys.argv[2]}))" "$INSTALLED" "$LATEST"
+else
+  rm -rf "$INSTALL_DIR"
+fi
+`;
+}
+
+function buildNotifyScript(stampFile, installedVersion) {
+  if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(installedVersion)) {
+    throw new Error(`Invalid version format in package.json: ${installedVersion}`);
+  }
+  return `#!/usr/bin/env bash
+# UserPromptSubmit: notify if claude-skills update available (2h throttle, no auto-install).
+set -euo pipefail
+
+STAMP="${stampFile}"
+PACKAGE="@trendai-crem/claude-skills"
+INSTALLED="${installedVersion}"
+MIN_INTERVAL=$((60 * 60 * 2))  # at most every 2h
+
+mkdir -p "$(dirname "$STAMP")"
 
-# Validate semver
+LAST_TS=0
+if [ -f "$STAMP" ]; then
+  LAST_TS=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('ts',0))" "$STAMP" 2>/dev/null || echo 0)
+fi
+[[ "$LAST_TS" =~ ^[0-9]+$ ]] || LAST_TS=0
+
+NOW=$(date +%s)
+[ $(( NOW - LAST_TS )) -lt $MIN_INTERVAL ] && exit 0
+
+python3 -c "import json,sys; json.dump({'ts': int(sys.argv[1])}, open(sys.argv[2],'w'))" "$NOW" "$STAMP"
+
+LATEST=$(npm view "$PACKAGE" version 2>/dev/null || echo "")
+[ -z "$LATEST" ] && exit 0
+[ "$LATEST" = "$INSTALLED" ] && exit 0
 [[ "$LATEST" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]] || exit 0
 
-# Notify via Claude Code systemMessage (shows in UI)
-python3 -c "import json,sys; print(json.dumps({'systemMessage': 'claude-skills update: ' + sys.argv[1] + ' \u2192 ' + sys.argv[2] + chr(10) + 'Run: npx @trendai-crem/claude-skills@latest'}))" "$INSTALLED" "$LATEST"
+python3 -c "import json,sys; print(json.dumps({'systemMessage': 'claude-skills update available: ' + sys.argv[1] + ' \u2192 ' + sys.argv[2] + chr(10) + 'Run: npx @trendai-crem/claude-skills@latest'}))" "$INSTALLED" "$LATEST"
 `;
 }

package/marketplace.json

@@ -0,0 +1,14 @@
+{
+  "marketplace": {
+    "name": "ai-skill-marketplace",
+    "source": "git@github.com:trend-ai-taskforce/ai-skill-marketplace.git"
+  },
+  "plugins": [
+    "wiki-tools",
+    "atlassian-tools",
+    "google-style-guides",
+    "l2-automation",
+    "service-doc-generator",
+    "claude-on-teams"
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trendai-crem/claude-skills",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "description": "Claude Code skills installer for the trendai-crem team",
   "license": "UNLICENSED",
   "repository": {
@@ -12,6 +12,7 @@
   },
   "files": [
     "cli.js",
+    "marketplace.json",
     "skills/"
   ],
   "type": "module",