@wntic/ocm 0.1.0

package/loader/ui-marketplaces.js

@@ -0,0 +1,187 @@
+// The marketplace flows of the /ocm TUI dialog (spec 10b): list,
+// per-marketplace menu, add/remove/update/pin, and update-all.
+import {
+  addMarketplace,
+  componentRoot,
+  enabledPlugins,
+  grantTrust,
+  materialize,
+  pinMarketplace,
+  pullRepo,
+  readRegistry,
+  removeMarketplace,
+  syncAll,
+} from "./core.js"
+import { NOTICE, alert, componentSummary, confirm, message, prompt, select, toast } from "./ui-dialog.js"
+import { openMainMenu } from "./ui.js"
+import { trustFlow, trustMessage, untrustFlow } from "./ui-trust.js"
+
+function busy(api, text) {
+  api.ui.dialog.replace(() =>
+    api.ui.DialogSelect({ title: "ocm", options: [{ title: text, value: "busy" }], onSelect: () => {} }),
+  )
+}
+
+export function openMarketplaces(api) {
+  const options = Object.entries(readRegistry().marketplaces ?? {}).map(([name, entry]) => ({
+    title: name,
+    value: name,
+    description: entry.local ? `${entry.url} (local)` : entry.url,
+  }))
+  options.push(
+    { title: "Add", value: "add", description: "Add a marketplace from a URL or path" },
+    { title: "Back", value: "back", description: "Back to the main menu" },
+  )
+  select(api, {
+    title: "Marketplaces",
+    options,
+    onSelect: (option) => {
+      if (option.value === "add") addMarketplaceFlow(api, () => openMarketplaces(api))
+      else if (option.value === "back") openMainMenu(api)
+      else openMarketplace(api, option.value)
+    },
+  })
+}
+
+function openMarketplace(api, name) {
+  const entry = readRegistry().marketplaces?.[name]
+  if (!entry) {
+    toast(api, "error", `marketplace "${name}" not found (ocm list)`)
+    openMarketplaces(api)
+    return
+  }
+  const trusted = entry.trust?.code === "granted"
+  select(api, {
+    title: name,
+    options: [
+      { title: "Update", value: "update", description: "Pull latest changes and refresh links" },
+      { title: "Remove", value: "remove", description: "Remove this marketplace and its links" },
+      {
+        title: trusted ? "Untrust" : "Trust",
+        value: "trust",
+        description: trusted ? "Remove its executable components" : "Approve its executable components",
+      },
+      { title: "Pin", value: "pin", description: "Follow a specific branch or tag" },
+      { title: "Back", value: "back", description: "Back to the marketplace list" },
+    ],
+    onSelect: (option) => {
+      if (option.value === "update") updateFlow(api, name, () => openMarketplace(api, name))
+      else if (option.value === "remove") removeFlow(api, name)
+      else if (option.value === "trust") {
+        const back = () => openMarketplace(api, name)
+        if (trusted) untrustFlow(api, name, back)
+        else trustFlow(api, name, back)
+      } else if (option.value === "pin") pinFlow(api, name)
+      else openMarketplaces(api)
+    },
+  })
+}
+
+export async function updateFlow(api, name, back) {
+  const entry = readRegistry().marketplaces?.[name]
+  if (!entry) {
+    toast(api, "error", `marketplace "${name}" not found (ocm list)`)
+    back()
+    return
+  }
+  busy(api, `Updating ${name}...`)
+  try {
+    let changed = false
+    if (entry.local === false) {
+      const pull = await pullRepo(entry.dir, typeof entry.ref === "string" ? entry.ref : null)
+      if (!pull.ok) throw new Error(pull.output)
+      changed = pull.changed
+    }
+    const root = componentRoot(entry)
+    const links = materialize(name, root, { enabled: enabledPlugins(entry, root) })
+    if (links.warnings.length) toast(api, "warning", links.warnings.join("\n"))
+    const mutated = changed || links.created > 0
+    toast(api, "success", `${name}: ${changed ? "updated to a new revision" : "already up to date"}${mutated ? ` — ${NOTICE}` : ""}`)
+  } catch (err) {
+    toast(api, "error", `${name}: update failed: ${message(err)}`)
+  }
+  back()
+}
+
+async function removeFlow(api, name) {
+  const entry = readRegistry().marketplaces?.[name]
+  if (!entry) {
+    toast(api, "error", `marketplace "${name}" not found (ocm list)`)
+    openMarketplaces(api)
+    return
+  }
+  const lines = [`remove marketplace "${name}"?`]
+  for (const [plugin, record] of Object.entries(entry.plugins ?? {})) {
+    if (!record.collision) lines.push(`  ${plugin} (${componentSummary(record)})`)
+  }
+  if (entry.local === false) lines.push(`the clone at ${entry.dir} is deleted`)
+  if (!(await confirm(api, name, lines.join("\n")))) {
+    openMarketplace(api, name)
+    return
+  }
+  try {
+    const result = removeMarketplace(name)
+    if (result.warnings.length) toast(api, "warning", result.warnings.join("\n"))
+    toast(api, "success", `removed marketplace "${name}" — ${NOTICE}`)
+  } catch (err) {
+    toast(api, "error", message(err))
+  }
+  openMarketplaces(api)
+}
+
+async function pinFlow(api, name) {
+  const ref = await prompt(api, `Pin ${name}`, "Branch or tag to follow (empty to follow the default branch)")
+  if (ref === null) {
+    openMarketplace(api, name)
+    return
+  }
+  try {
+    const result = await pinMarketplace(name, ref || null)
+    toast(api, "success", `marketplace "${name}" ${result.cleared ? "unpinned" : `pinned to ${result.ref}`} — ${NOTICE}`)
+  } catch (err) {
+    toast(api, "error", message(err))
+  }
+  openMarketplace(api, name)
+}
+
+export async function addMarketplaceFlow(api, back) {
+  const source = await prompt(api, "Add marketplace", "URL or path of the marketplace to add")
+  if (!source) {
+    back()
+    return
+  }
+  busy(api, `Adding ${source}...`)
+  let result
+  try {
+    result = await addMarketplace(source)
+  } catch (err) {
+    // a refused add still owes the user the diagnostics behind the refusal
+    if (Array.isArray(err.warnings) && err.warnings.length) toast(api, "warning", err.warnings.join("\n"))
+    alert(api, "ocm", `error: ${message(err)}`, back)
+    return
+  }
+  if (result.warnings.length) toast(api, "warning", result.warnings.join("\n"))
+  if (result.trustComponents.length && (await confirm(api, result.name, trustMessage(result.name, result.dir, result.trustComponents)))) {
+    const second = grantTrust(result.name)
+    if (second.report?.warnings.length) toast(api, "warning", second.report.warnings.join("\n"))
+  }
+  toast(api, "success", `added marketplace "${result.name}" — ${NOTICE}`)
+  back()
+}
+
+export async function runUpdateAll(api) {
+  busy(api, "Updating all marketplaces...")
+  try {
+    const result = await syncAll({ force: true })
+    const lines = []
+    if (result.updated.length) lines.push(`updated: ${result.updated.join(", ")}`)
+    if (result.unchanged.length) lines.push(`unchanged: ${result.unchanged.join(", ")}`)
+    if (result.failed.length) lines.push(`failed: ${result.failed.join(", ")}`)
+    for (const [name, error] of Object.entries(result.errors)) lines.push(`  ${name}: ${error}`)
+    if (result.warnings?.length) lines.push(...result.warnings)
+    if (result.changed) lines.push(NOTICE)
+    alert(api, "ocm", lines.join("\n") || "no marketplaces added yet (ocm add <url|path>)", () => openMainMenu(api))
+  } catch (err) {
+    alert(api, "ocm", `error: ${message(err)}`, () => openMainMenu(api))
+  }
+}

package/loader/ui-plugins.js

@@ -0,0 +1,101 @@
+// The per-plugin flows of the /ocm TUI dialog (spec 10b): the plugin menu,
+// install/uninstall, and the details view.
+import { readRegistry, setEnabled } from "./core.js"
+import { NOTICE, alert, componentSummary, confirm, message, select, toast } from "./ui-dialog.js"
+import { openBrowse } from "./ui.js"
+import { updateFlow } from "./ui-marketplaces.js"
+import { trustFlow } from "./ui-trust.js"
+
+// executable components ship blocked until the marketplace is trusted (spec 07)
+export function blocked(record, entry) {
+  const components = record.components ?? {}
+  if (!(components.plugin?.length || components.mcp?.length)) return false
+  return entry.trust?.code !== "granted" || entry.trustPending === true
+}
+
+export function openPlugin(api, marketplace, name) {
+  const entry = readRegistry().marketplaces?.[marketplace]
+  const record = entry?.plugins?.[name]
+  if (!entry || !record) {
+    openBrowse(api)
+    return
+  }
+  const arg = `${name}@${marketplace}`
+  const options = [
+    { title: record.enabled ? "Uninstall" : "Install", value: "toggle", description: componentSummary(record) },
+    { title: "Details", value: "details", description: "The ocm info record" },
+  ]
+  if (blocked(record, entry)) {
+    options.push({ title: "Trust marketplace", value: "trust", description: `Approve executable components from ${marketplace}` })
+  }
+  options.push(
+    { title: `Update ${marketplace}`, value: "update", description: "Pull just this marketplace" },
+    { title: "Back", value: "back", description: "Back to the plugin list" },
+  )
+  select(api, {
+    title: arg,
+    options,
+    onSelect: (option) => {
+      if (option.value === "toggle") togglePlugin(api, marketplace, name)
+      else if (option.value === "details") showDetails(api, marketplace, name)
+      else if (option.value === "trust") trustFlow(api, marketplace, () => openPlugin(api, marketplace, name))
+      else if (option.value === "update") updateFlow(api, marketplace, () => openPlugin(api, marketplace, name))
+      else openBrowse(api)
+    },
+  })
+}
+
+async function togglePlugin(api, marketplace, name) {
+  const entry = readRegistry().marketplaces?.[marketplace]
+  const record = entry?.plugins?.[name]
+  if (!entry || !record) {
+    openBrowse(api)
+    return
+  }
+  const arg = `${name}@${marketplace}`
+  const enabling = !record.enabled
+  const executable = (record.components?.plugin?.length ?? 0) + (record.components?.mcp?.length ?? 0)
+  let text = enabling ? `Install ${arg} (${componentSummary(record)})?` : `Uninstall ${arg}?`
+  if (!enabling && executable) text += `\n\nit removes ${executable} executable component(s) opencode runs on start`
+  if (!(await confirm(api, arg, text))) {
+    openPlugin(api, marketplace, name)
+    return
+  }
+  try {
+    const result = setEnabled(arg, enabling)
+    if (result.disagreement) toast(api, "warning", result.disagreement)
+    if (result.report.warnings.length) toast(api, "warning", result.report.warnings.join("\n"))
+    toast(api, "success", `${enabling ? "installed" : "uninstalled"} ${arg} — ${NOTICE}`)
+  } catch (err) {
+    toast(api, "error", message(err))
+  }
+  openBrowse(api)
+}
+
+function showDetails(api, marketplace, name) {
+  const entry = readRegistry().marketplaces?.[marketplace]
+  const record = entry?.plugins?.[name]
+  if (!entry || !record) {
+    openBrowse(api)
+    return
+  }
+  const manifest = record.manifest ?? {}
+  const lines = [`${name} @ ${marketplace}`]
+  if (manifest.description) lines.push(`description: ${manifest.description}`)
+  if (record.version) lines.push(`version: ${record.version}`)
+  if (manifest.category) lines.push(`category: ${manifest.category}`)
+  lines.push(`enabled: ${record.enabled ? "yes" : "no"}`)
+  lines.push(`installed: ${record.installedAt ?? "no"}`)
+  lines.push(`marketplace: ${entry.url}${entry.ref ? ` @ ${entry.ref}` : ""}`)
+  lines.push(`trust: ${entry.trust?.code ?? "none"}`)
+  const components = record.components ?? {}
+  const named = [
+    ...(components.command ?? []).map((file) => `command ${name}:${file}`),
+    ...(components.agent ?? []).map((file) => `agent ${name}:${file}`),
+    ...(components.skill ?? []).map((rel) => `skill ${name}:${rel}`),
+    ...(components.plugin ?? []).map((file) => `plugin ocm--${name}--${file}`),
+    ...(components.mcp ?? []).map((server) => `mcp ocm--${name}--${server}`),
+  ]
+  if (named.length) lines.push("components:", ...named.map((line) => `  ${line}`))
+  alert(api, `${name}@${marketplace}`, lines.join("\n"), () => openPlugin(api, marketplace, name))
+}

package/loader/ui-trust.js

@@ -0,0 +1,68 @@
+// The trust flows of the /ocm TUI dialog (spec 10b): the prompt renders the
+// same component list the CLI prints before a trust decision (spec 07).
+import { componentRoot, denyTrust, executableComponents, grantTrust, readRegistry } from "./core.js"
+import { NOTICE, confirm, message, toast } from "./ui-dialog.js"
+
+// the same block the CLI prints before a trust prompt (spec 07)
+function trustMessage(name, dir, components) {
+  const lines = [`marketplace "${name}" ships code that opencode will execute:`]
+  for (const component of components) {
+    if (component.kind === "plugin") {
+      lines.push(`  plugin  ${component.plugin}/${component.name.replace(/\.[jt]s$/, "")} (${component.rel})`)
+    } else {
+      const value = component.value
+      const command = Array.isArray(value?.command) ? value.command.join(" ") : ""
+      const detail = value && typeof value.url === "string" ? `remote server: ${value.url}` : `local server: ${command}`
+      lines.push(`  mcp     ${component.plugin}/${component.name} (${detail})`)
+    }
+  }
+  lines.push("this code runs with your shell's permissions on every opencode start.")
+  lines.push(`review it at ${dir}`)
+  lines.push("trust this marketplace to run code?")
+  return lines.join("\n")
+}
+
+export async function trustFlow(api, name, back) {
+  const entry = readRegistry().marketplaces?.[name]
+  if (!entry) {
+    toast(api, "error", `marketplace "${name}" not found (ocm list)`)
+    back()
+    return
+  }
+  const components = executableComponents(componentRoot(entry), entry)
+  if (!components.length) {
+    toast(api, "info", `marketplace "${name}" ships no code; nothing to trust`)
+    back()
+    return
+  }
+  if (!(await confirm(api, name, trustMessage(name, entry.dir, components)))) {
+    back()
+    return
+  }
+  try {
+    const result = grantTrust(name)
+    if (result.report?.warnings.length) toast(api, "warning", result.report.warnings.join("\n"))
+    toast(api, "success", `marketplace "${name}" trusted to run code — ${NOTICE}`)
+  } catch (err) {
+    toast(api, "error", message(err))
+  }
+  back()
+}
+
+export async function untrustFlow(api, name, back) {
+  const text = `stop trusting marketplace "${name}"?\n\nits executable components are removed from opencode`
+  if (!(await confirm(api, name, text))) {
+    back()
+    return
+  }
+  try {
+    const result = denyTrust(name)
+    if (result.report.warnings.length) toast(api, "warning", result.report.warnings.join("\n"))
+    toast(api, "success", `marketplace "${name}" no longer trusted — ${NOTICE}`)
+  } catch (err) {
+    toast(api, "error", message(err))
+  }
+  back()
+}
+
+export { trustMessage }

package/loader/ui.js

@@ -0,0 +1,109 @@
+// The /ocm TUI dialog entry (spec 10b): registers the /ocm command and
+// renders the menu screens. Every mutation is a core function the CLI also
+// calls; the flows live in the ui-*.js siblings.
+import { readRegistry, searchPlugins } from "./core.js"
+import { alert, componentSummary, prompt, select } from "./ui-dialog.js"
+import { blocked, openPlugin } from "./ui-plugins.js"
+import { addMarketplaceFlow, openMarketplaces, runUpdateAll } from "./ui-marketplaces.js"
+
+export function openMainMenu(api) {
+  const marketplaces = Object.entries(readRegistry().marketplaces ?? {})
+  if (!marketplaces.length) {
+    alert(
+      api,
+      "ocm",
+      "No marketplaces added yet.\n\nAdd one from your terminal:\n  ocm add <url|path>\n\nOr add one here.",
+      () => addMarketplaceFlow(api, () => openMainMenu(api)),
+    )
+    return
+  }
+  const plugins = marketplaces.reduce((count, [, entry]) => count + Object.keys(entry.plugins ?? {}).length, 0)
+  select(api, {
+    title: "ocm",
+    options: [
+      { title: "Browse plugins", value: "browse", description: `${plugins} plugins across ${marketplaces.length} marketplaces` },
+      { title: "Search", value: "search", description: "Find a plugin by name, tag or command" },
+      { title: "Marketplaces", value: "marketplaces", description: "Add, update, remove" },
+      { title: "Update all", value: "update-all", description: "Pull every marketplace now" },
+    ],
+    onSelect: (option) => {
+      if (option.value === "browse") openBrowse(api)
+      else if (option.value === "search") searchFlow(api)
+      else if (option.value === "marketplaces") openMarketplaces(api)
+      else runUpdateAll(api)
+    },
+  })
+}
+
+function pluginOption(registry, marketplace, name, value) {
+  const entry = registry.marketplaces[marketplace]
+  const record = entry.plugins[name]
+  const suffix = !record.enabled ? " (disabled)" : blocked(record, entry) ? " (blocked)" : ""
+  return {
+    title: `${name}@${marketplace}${suffix}`,
+    value,
+    description: record.manifest?.description || componentSummary(record),
+    category: marketplace,
+  }
+}
+
+function openPluginList(api, title, items) {
+  const registry = readRegistry()
+  select(api, {
+    title,
+    options: items.map((item, i) => pluginOption(registry, item.marketplace, item.name, String(i))),
+    onSelect: (option) => {
+      const item = items[Number(option.value)]
+      if (item) openPlugin(api, item.marketplace, item.name)
+    },
+  })
+}
+
+export function openBrowse(api) {
+  const items = []
+  for (const [marketplace, entry] of Object.entries(readRegistry().marketplaces ?? {})) {
+    for (const name of Object.keys(entry.plugins ?? {})) items.push({ marketplace, name })
+  }
+  if (!items.length) {
+    alert(api, "ocm", "No plugins found in any marketplace.", () => openMainMenu(api))
+    return
+  }
+  openPluginList(api, "Browse plugins", items)
+}
+
+async function searchFlow(api) {
+  const query = await prompt(api, "Search plugins", "Find a plugin by name, tag or command")
+  if (!query) {
+    openMainMenu(api)
+    return
+  }
+  const matches = searchPlugins(query)
+  if (!matches.length) {
+    alert(api, "ocm", `No plugins match "${query}".`, () => openMainMenu(api))
+    return
+  }
+  openPluginList(api, `Search: ${query}`, matches.map((m) => ({ marketplace: m.marketplace, name: m.plugin })))
+}
+
+export default {
+  id: "ocm-ui",
+  tui: async (api) => {
+    const unregister = api.keymap?.registerLayer?.({
+      commands: [
+        {
+          namespace: "palette",
+          name: "ocm.open",
+          title: "ocm marketplace",
+          category: "ocm",
+          slashName: "ocm",
+          slash: { name: "ocm" },
+          run: () => openMainMenu(api),
+        },
+      ],
+      bindings: [],
+    })
+    if (typeof unregister === "function" && typeof api.lifecycle?.onDispose === "function") {
+      api.lifecycle.onDispose(unregister)
+    }
+  },
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@wntic/ocm",
+  "version": "0.1.0",
+  "description": "File-based plugin marketplace for opencode: skills, agents, commands distributed via git repos",
+  "type": "module",
+  "bin": {
+    "ocm": "./bin/ocm.ts"
+  },
+  "files": [
+    "bin",
+    "src",
+    "loader",
+    "template",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "dev": "bun run ./bin/ocm.ts",
+    "test": "bun test"
+  },
+  "license": "MIT",
+  "engines": {
+    "bun": ">=1.0.0"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.4.0",
+    "tsx": "^4.23.13",
+    "typescript": "^7.0.2"
+  }
+}

package/src/commands/doctor-config.ts

@@ -0,0 +1,79 @@
+// spec 12 doctor: the opencode.json checks. Every fix goes through the core's
+// atomic, ownership-scoped writers (setSkillsPath, removeMcpKeys), which
+// return a warning string on failure instead of throwing — a failed write is
+// an error finding, never a corrupted config.
+import { existsSync, readFileSync } from "node:fs"
+import { removeMcpKeys, setSkillsPath } from "../../loader/core.js"
+import type { CoreRegistry } from "../../loader/core.js"
+import { OCM_LINKS_DIR, OPENCODE_GLOBAL_CONFIG } from "../paths"
+import { error, fixed, warning, type Finding } from "../findings"
+
+// undefined: no config file (normal); null: present but unusable
+function readConfig(): Record<string, unknown> | null | undefined {
+  let raw: string | undefined
+  try {
+    raw = readFileSync(OPENCODE_GLOBAL_CONFIG, "utf8")
+  } catch {
+    return undefined
+  }
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>
+    }
+  } catch {}
+  return null
+}
+
+export function checkConfig(findings: Finding[], registry: CoreRegistry, fix: boolean, registryUsable: boolean): void {
+  const config = readConfig()
+  if (config === null) {
+    findings.push(warning(`${OPENCODE_GLOBAL_CONFIG}: not valid JSON, left untouched — fix it by hand`))
+    return
+  }
+  if (config === undefined) return
+  checkSkillsPaths(config, findings, fix)
+  checkMcpKeys(config, registry, findings, fix && registryUsable)
+}
+
+// only entries under ocm's links dir are ocm's to remove; a user's orphaned
+// entry stays (ownership)
+function checkSkillsPaths(config: Record<string, unknown>, findings: Finding[], fix: boolean): void {
+  const skills = config.skills
+  if (typeof skills !== "object" || skills === null || !Array.isArray((skills as { paths?: unknown }).paths)) return
+  for (const entry of (skills as { paths: unknown[] }).paths) {
+    if (typeof entry !== "string" || !entry.startsWith(`${OCM_LINKS_DIR}/`) || existsSync(entry)) continue
+    if (!fix) {
+      findings.push(error(`${entry}: orphaned ocm skills path — target is gone (ocm doctor --fix)`))
+      continue
+    }
+    const failure = setSkillsPath(entry, false)
+    if (failure) findings.push(error(failure))
+    else findings.push(fixed(`${entry}: removed from skills.paths`))
+  }
+}
+
+function checkMcpKeys(config: Record<string, unknown>, registry: CoreRegistry, findings: Finding[], fix: boolean): void {
+  const mcp = config.mcp
+  if (typeof mcp !== "object" || mcp === null || Array.isArray(mcp)) return
+  const known = new Set<string>()
+  for (const entry of Object.values(registry.marketplaces)) {
+    for (const name of Object.keys(entry.plugins ?? {})) known.add(name)
+  }
+  const orphaned: { key: string; plugin: string }[] = []
+  for (const key of Object.keys(mcp)) {
+    if (!key.startsWith("ocm--")) continue
+    const plugin = key.slice(5).split("--")[0]!
+    if (!known.has(plugin)) orphaned.push({ key, plugin })
+  }
+  if (!orphaned.length) return
+  if (!fix) {
+    for (const { key, plugin } of orphaned) {
+      findings.push(error(`${key}: orphaned MCP key — plugin "${plugin}" is not in the registry`))
+    }
+    return
+  }
+  const failure = removeMcpKeys([...new Set(orphaned.map(({ plugin }) => plugin))])
+  if (failure) findings.push(error(failure))
+  else for (const { key } of orphaned) findings.push(fixed(`${key}: removed from opencode.json`))
+}