@xortex/xcode 3.0.0

package/utils/plugins/officialMarketplace.ts

@@ -0,0 +1,25 @@
+/**
+ * Constants for the official Anthropic plugins marketplace.
+ *
+ * The official marketplace is hosted on GitHub and provides first-party
+ * plugins developed by Anthropic. This file defines the constants needed
+ * to install and identify this marketplace.
+ */
+
+import type { MarketplaceSource } from './schemas.js'
+
+/**
+ * Source configuration for the official Anthropic plugins marketplace.
+ * Used when auto-installing the marketplace on startup.
+ */
+export const OFFICIAL_MARKETPLACE_SOURCE = {
+  source: 'github',
+  repo: 'anthropics/claude-plugins-official',
+} as const satisfies MarketplaceSource
+
+/**
+ * Display name for the official marketplace.
+ * This is the name under which the marketplace will be registered
+ * in the known_marketplaces.json file.
+ */
+export const OFFICIAL_MARKETPLACE_NAME = 'claude-plugins-official'

package/utils/plugins/officialMarketplaceGcs.ts

@@ -0,0 +1,216 @@
+/**
+ * inc-5046: fetch the official marketplace from a GCS mirror instead of
+ * git-cloning GitHub on every startup.
+ *
+ * Backend (anthropic#317037) publishes a marketplace-only zip alongside the
+ * titanium squashfs, keyed by base repo SHA. This module fetches the `latest`
+ * pointer, compares against a local sentinel, and downloads+extracts the zip
+ * when there's a new SHA. Callers decide fallback behavior on failure.
+ */
+
+import axios from 'src/utils/axios.js'
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'fs/promises'
+import { dirname, join, resolve, sep } from 'path'
+import { waitForScrollIdle } from '../../bootstrap/state.js'
+import type { AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS } from '../../services/analytics/index.js'
+import { logEvent } from '../../services/analytics/index.js'
+import { logForDebugging } from '../debug.js'
+import { parseZipModes, unzipFile } from '../dxt/zip.js'
+import { errorMessage, getErrnoCode } from '../errors.js'
+
+type SafeString = AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS
+
+// CDN-fronted domain for the public GCS bucket (same bucket the native
+// binary ships from — nativeInstaller/download.ts:24 uses the raw GCS URL).
+// `{sha}.zip` is content-addressed so CDN can cache it indefinitely;
+// `latest` has Cache-Control: max-age=300 so CDN staleness is bounded.
+// Backend (anthropic#317037) populates this prefix.
+const GCS_BASE =
+  'https://downloads.claude.ai/claude-code-releases/plugins/claude-plugins-official'
+
+// Zip arc paths are seed-dir-relative (marketplaces/claude-plugins-official/…)
+// so the titanium seed machinery can use the same zip. Strip this prefix when
+// extracting for a laptop install.
+const ARC_PREFIX = 'marketplaces/claude-plugins-official/'
+
+/**
+ * Fetch the official marketplace from GCS and extract to installLocation.
+ * Idempotent — checks a `.gcs-sha` sentinel before downloading the ~3.5MB zip.
+ *
+ * @param installLocation where to extract (must be inside marketplacesCacheDir)
+ * @param marketplacesCacheDir the plugins marketplace cache root — passed in
+ *   by callers (rather than imported from pluginDirectories) to break a
+ *   circular-dep edge through marketplaceManager
+ * @returns the fetched SHA on success (including no-op), null on any failure
+ *   (network, 404, zip parse). Caller decides whether to fall through to git.
+ */
+export async function fetchOfficialMarketplaceFromGcs(
+  installLocation: string,
+  marketplacesCacheDir: string,
+): Promise<string | null> {
+  // Defense in depth: this function does `rm(installLocation, {recursive})`
+  // during the atomic swap. A corrupted known_marketplaces.json (gh-32793 —
+  // Windows path read on WSL, literal tilde, manual edit) could point at the
+  // user's project. Refuse any path outside the marketplaces cache dir.
+  // Same guard as refreshMarketplace() at marketplaceManager.ts:~2392 but
+  // inside the function so ALL callers are covered.
+  const cacheDir = resolve(marketplacesCacheDir)
+  const resolvedLoc = resolve(installLocation)
+  if (resolvedLoc !== cacheDir && !resolvedLoc.startsWith(cacheDir + sep)) {
+    logForDebugging(
+      `fetchOfficialMarketplaceFromGcs: refusing path outside cache dir: ${installLocation}`,
+      { level: 'error' },
+    )
+    return null
+  }
+
+  // Network + zip extraction competes for the event loop with scroll frames.
+  // This is a fire-and-forget startup call — delaying by a few hundred ms
+  // until scroll settles is invisible to the user.
+  await waitForScrollIdle()
+
+  const start = performance.now()
+  let outcome: 'noop' | 'updated' | 'failed' = 'failed'
+  let sha: string | undefined
+  let bytes: number | undefined
+  let errKind: string | undefined
+
+  try {
+    // 1. Latest pointer — ~40 bytes, backend sets Cache-Control: no-cache,
+    //    max-age=300. Cheap enough to hit every startup.
+    const latest = await axios.get(`${GCS_BASE}/latest`, {
+      responseType: 'text',
+      timeout: 10_000,
+    })
+    sha = String(latest.data).trim()
+    if (!sha) {
+      // Empty /latest body — backend misconfigured. Bail (null), don't
+      // lock into a permanently-broken empty-sentinel state.
+      throw new Error('latest pointer returned empty body')
+    }
+
+    // 2. Sentinel check — `.gcs-sha` at the install root holds the last
+    //    extracted SHA. Matching means we already have this content.
+    const sentinelPath = join(installLocation, '.gcs-sha')
+    const currentSha = await readFile(sentinelPath, 'utf8').then(
+      s => s.trim(),
+      () => null, // ENOENT — first fetch, proceed to download
+    )
+    if (currentSha === sha) {
+      outcome = 'noop'
+      return sha
+    }
+
+    // 3. Download zip and extract to a staging dir, then atomic-swap into
+    //    place. Crash mid-extract leaves a .staging dir (next run rm's it)
+    //    rather than a half-written installLocation.
+    const zipResp = await axios.get(`${GCS_BASE}/${sha}.zip`, {
+      responseType: 'arraybuffer',
+      timeout: 60_000,
+    })
+    const zipBuf = Buffer.from(zipResp.data)
+    bytes = zipBuf.length
+    const files = await unzipFile(zipBuf)
+    // fflate doesn't surface external_attr, so parse the central directory
+    // ourselves to recover exec bits. Without this, hooks/scripts extract as
+    // 0644 and `sh -c "/path/script.sh"` (hooks.ts:~1002) fails with EACCES
+    // on Unix. Git-clone preserves +x natively; this keeps GCS at parity.
+    const modes = parseZipModes(zipBuf)
+
+    const staging = `${installLocation}.staging`
+    await rm(staging, { recursive: true, force: true })
+    await mkdir(staging, { recursive: true })
+    for (const [arcPath, data] of Object.entries(files)) {
+      if (!arcPath.startsWith(ARC_PREFIX)) continue
+      const rel = arcPath.slice(ARC_PREFIX.length)
+      if (!rel || rel.endsWith('/')) continue // prefix dir entry or subdir entry
+      const dest = join(staging, rel)
+      await mkdir(dirname(dest), { recursive: true })
+      await writeFile(dest, data)
+      const mode = modes[arcPath]
+      if (mode && mode & 0o111) {
+        // Only chmod when an exec bit is set — skip plain files to save syscalls.
+        // Swallow EPERM/ENOTSUP (NFS root_squash, some FUSE mounts) — losing +x
+        // is the pre-PR behavior and better than aborting mid-extraction.
+        await chmod(dest, mode & 0o777).catch(() => {})
+      }
+    }
+    await writeFile(join(staging, '.gcs-sha'), sha)
+
+    // Atomic swap: rm old, rename staging. Brief window where installLocation
+    // doesn't exist — acceptable for a background refresh (caller retries next
+    // startup if it crashes here).
+    await rm(installLocation, { recursive: true, force: true })
+    await rename(staging, installLocation)
+
+    outcome = 'updated'
+    return sha
+  } catch (e) {
+    errKind = classifyGcsError(e)
+    logForDebugging(
+      `Official marketplace GCS fetch failed: ${errorMessage(e)}`,
+      { level: 'warn' },
+    )
+    return null
+  } finally {
+    // tengu_plugin_remote_fetch schema shared with the telemetry PR
+    // (.daisy/inc-5046/index.md) — adds source:'marketplace_gcs'. All string
+    // values below are static enums or a git SHA — not code/filepaths/PII.
+    logEvent('tengu_plugin_remote_fetch', {
+      source: 'marketplace_gcs' as SafeString,
+      host: 'downloads.claude.ai' as SafeString,
+      is_official: true,
+      outcome: outcome as SafeString,
+      duration_ms: Math.round(performance.now() - start),
+      ...(bytes !== undefined && { bytes }),
+      ...(sha && { sha: sha as SafeString }),
+      ...(errKind && { error_kind: errKind as SafeString }),
+    })
+  }
+}
+
+// Bounded set of errno codes we report by name. Anything else buckets as
+// fs_other to keep dashboard cardinality tractable.
+const KNOWN_FS_CODES = new Set([
+  'ENOSPC',
+  'EACCES',
+  'EPERM',
+  'EXDEV',
+  'EBUSY',
+  'ENOENT',
+  'ENOTDIR',
+  'EROFS',
+  'EMFILE',
+  'ENAMETOOLONG',
+])
+
+/**
+ * Classify a GCS fetch error into a stable telemetry bucket.
+ *
+ * Telemetry from v2.1.83+ showed 50% of failures landing in 'other' — and
+ * 99.99% of those had both sha+bytes set, meaning download succeeded but
+ * extraction/fs failed. This splits that bucket so we can see whether the
+ * failures are fixable (wrong staging dir, cross-device rename) or inherent
+ * (disk full, permission denied) before flipping the git-fallback kill switch.
+ */
+export function classifyGcsError(e: unknown): string {
+  if (axios.isAxiosError(e)) {
+    if (e.code === 'ECONNABORTED') return 'timeout'
+    if (e.response) return `http_${e.response.status}`
+    return 'network'
+  }
+  const code = getErrnoCode(e)
+  // Node fs errno codes are E<UPPERCASE> (ENOSPC, EACCES). Axios also sets
+  // .code (ERR_NETWORK, ERR_BAD_OPTION, EPROTO) — don't bucket those as fs.
+  if (code && /^E[A-Z]+$/.test(code) && !code.startsWith('ERR_')) {
+    return KNOWN_FS_CODES.has(code) ? `fs_${code}` : 'fs_other'
+  }
+  // fflate sets numeric .code (0-14) on inflate/unzip errors — catches
+  // deflate-level corruption ("unexpected EOF", "invalid block type") that
+  // the message regex misses.
+  if (typeof (e as { code?: unknown })?.code === 'number') return 'zip_parse'
+  const msg = errorMessage(e)
+  if (/unzip|invalid zip|central directory/i.test(msg)) return 'zip_parse'
+  if (/empty body/.test(msg)) return 'empty_latest'
+  return 'other'
+}

package/utils/plugins/officialMarketplaceStartupCheck.ts

@@ -0,0 +1,439 @@
+/**
+ * Auto-install logic for the official Anthropic marketplace.
+ *
+ * This module handles automatically installing the official marketplace
+ * on startup for new users, with appropriate checks for:
+ * - Enterprise policy restrictions
+ * - Git availability
+ * - Previous installation attempts
+ */
+
+import { join } from 'path'
+import { getFeatureValue_CACHED_MAY_BE_STALE } from '../../services/analytics/growthbook.js'
+import { logEvent } from '../../services/analytics/index.js'
+import { getGlobalConfig, saveGlobalConfig } from '../config.js'
+import { logForDebugging } from '../debug.js'
+import { isEnvTruthy } from '../envUtils.js'
+import { toError } from '../errors.js'
+import { logError } from '../log.js'
+import { checkGitAvailable, markGitUnavailable } from './gitAvailability.js'
+import { isSourceAllowedByPolicy } from './marketplaceHelpers.js'
+import {
+  addMarketplaceSource,
+  getMarketplacesCacheDir,
+  loadKnownMarketplacesConfig,
+  saveKnownMarketplacesConfig,
+} from './marketplaceManager.js'
+import {
+  OFFICIAL_MARKETPLACE_NAME,
+  OFFICIAL_MARKETPLACE_SOURCE,
+} from './officialMarketplace.js'
+import { fetchOfficialMarketplaceFromGcs } from './officialMarketplaceGcs.js'
+
+/**
+ * Reason why the official marketplace was not installed
+ */
+export type OfficialMarketplaceSkipReason =
+  | 'already_attempted'
+  | 'already_installed'
+  | 'policy_blocked'
+  | 'git_unavailable'
+  | 'gcs_unavailable'
+  | 'unknown'
+
+/**
+ * Check if official marketplace auto-install is disabled via environment variable.
+ */
+export function isOfficialMarketplaceAutoInstallDisabled(): boolean {
+  return isEnvTruthy(
+    process.env.CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL,
+  )
+}
+
+/**
+ * Configuration for retry logic
+ */
+export const RETRY_CONFIG = {
+  MAX_ATTEMPTS: 10,
+  INITIAL_DELAY_MS: 60 * 60 * 1000, // 1 hour
+  BACKOFF_MULTIPLIER: 2,
+  MAX_DELAY_MS: 7 * 24 * 60 * 60 * 1000, // 1 week
+}
+
+/**
+ * Calculate next retry delay using exponential backoff
+ */
+function calculateNextRetryDelay(retryCount: number): number {
+  const delay =
+    RETRY_CONFIG.INITIAL_DELAY_MS *
+    Math.pow(RETRY_CONFIG.BACKOFF_MULTIPLIER, retryCount)
+  return Math.min(delay, RETRY_CONFIG.MAX_DELAY_MS)
+}
+
+/**
+ * Determine if installation should be retried based on failure reason and retry state
+ */
+function shouldRetryInstallation(
+  config: ReturnType<typeof getGlobalConfig>,
+): boolean {
+  // If never attempted, should try
+  if (!config.officialMarketplaceAutoInstallAttempted) {
+    return true
+  }
+
+  // If already installed successfully, don't retry
+  if (config.officialMarketplaceAutoInstalled) {
+    return false
+  }
+
+  const failReason = config.officialMarketplaceAutoInstallFailReason
+  const retryCount = config.officialMarketplaceAutoInstallRetryCount || 0
+  const nextRetryTime = config.officialMarketplaceAutoInstallNextRetryTime
+  const now = Date.now()
+
+  // Check if we've exceeded max attempts
+  if (retryCount >= RETRY_CONFIG.MAX_ATTEMPTS) {
+    return false
+  }
+
+  // Permanent failures - don't retry
+  if (failReason === 'policy_blocked') {
+    return false
+  }
+
+  // Check if enough time has passed for next retry
+  if (nextRetryTime && now < nextRetryTime) {
+    return false
+  }
+
+  // Retry for temporary failures (unknown), semi-permanent (git_unavailable),
+  // and legacy state (undefined failReason from before retry logic existed)
+  return (
+    failReason === 'unknown' ||
+    failReason === 'git_unavailable' ||
+    failReason === 'gcs_unavailable' ||
+    failReason === undefined
+  )
+}
+
+/**
+ * Result of the auto-install check
+ */
+export type OfficialMarketplaceCheckResult = {
+  /** Whether the marketplace was successfully installed */
+  installed: boolean
+  /** Whether the installation was skipped (and why) */
+  skipped: boolean
+  /** Reason for skipping, if applicable */
+  reason?: OfficialMarketplaceSkipReason
+  /** Whether saving retry metadata to config failed */
+  configSaveFailed?: boolean
+}
+
+/**
+ * Check and install the official marketplace on startup.
+ *
+ * This function is designed to be called as a fire-and-forget operation
+ * during startup. It will:
+ * 1. Check if installation was already attempted
+ * 2. Check if marketplace is already installed
+ * 3. Check enterprise policy restrictions
+ * 4. Check git availability
+ * 5. Attempt installation
+ * 6. Record the result in GlobalConfig
+ *
+ * @returns Result indicating whether installation succeeded or was skipped
+ */
+export async function checkAndInstallOfficialMarketplace(): Promise<OfficialMarketplaceCheckResult> {
+  const config = getGlobalConfig()
+
+  // Check if we should retry installation
+  if (!shouldRetryInstallation(config)) {
+    const reason: OfficialMarketplaceSkipReason =
+      config.officialMarketplaceAutoInstallFailReason ?? 'already_attempted'
+    logForDebugging(`Official marketplace auto-install skipped: ${reason}`)
+    return {
+      installed: false,
+      skipped: true,
+      reason,
+    }
+  }
+
+  try {
+    // Check if auto-install is disabled via env var
+    if (isOfficialMarketplaceAutoInstallDisabled()) {
+      logForDebugging(
+        'Official marketplace auto-install disabled via env var, skipping',
+      )
+      saveGlobalConfig(current => ({
+        ...current,
+        officialMarketplaceAutoInstallAttempted: true,
+        officialMarketplaceAutoInstalled: false,
+        officialMarketplaceAutoInstallFailReason: 'policy_blocked',
+      }))
+      logEvent('tengu_official_marketplace_auto_install', {
+        installed: false,
+        skipped: true,
+        policy_blocked: true,
+      })
+      return { installed: false, skipped: true, reason: 'policy_blocked' }
+    }
+
+    // Check if marketplace is already installed
+    const knownMarketplaces = await loadKnownMarketplacesConfig()
+    if (knownMarketplaces[OFFICIAL_MARKETPLACE_NAME]) {
+      logForDebugging(
+        `Official marketplace '${OFFICIAL_MARKETPLACE_NAME}' already installed, skipping`,
+      )
+      // Mark as attempted so we don't check again
+      saveGlobalConfig(current => ({
+        ...current,
+        officialMarketplaceAutoInstallAttempted: true,
+        officialMarketplaceAutoInstalled: true,
+      }))
+      return { installed: false, skipped: true, reason: 'already_installed' }
+    }
+
+    // Check enterprise policy restrictions
+    if (!isSourceAllowedByPolicy(OFFICIAL_MARKETPLACE_SOURCE)) {
+      logForDebugging(
+        'Official marketplace blocked by enterprise policy, skipping',
+      )
+      saveGlobalConfig(current => ({
+        ...current,
+        officialMarketplaceAutoInstallAttempted: true,
+        officialMarketplaceAutoInstalled: false,
+        officialMarketplaceAutoInstallFailReason: 'policy_blocked',
+      }))
+      logEvent('tengu_official_marketplace_auto_install', {
+        installed: false,
+        skipped: true,
+        policy_blocked: true,
+      })
+      return { installed: false, skipped: true, reason: 'policy_blocked' }
+    }
+
+    // inc-5046: try GCS mirror first — doesn't need git, doesn't hit GitHub.
+    // Backend (anthropic#317037) publishes a marketplace zip to the same
+    // bucket as the native binary. If GCS succeeds, register the marketplace
+    // with source:'github' (still true — GCS is a mirror) and skip git
+    // entirely.
+    const cacheDir = getMarketplacesCacheDir()
+    const installLocation = join(cacheDir, OFFICIAL_MARKETPLACE_NAME)
+    const gcsSha = await fetchOfficialMarketplaceFromGcs(
+      installLocation,
+      cacheDir,
+    )
+    if (gcsSha !== null) {
+      const known = await loadKnownMarketplacesConfig()
+      known[OFFICIAL_MARKETPLACE_NAME] = {
+        source: OFFICIAL_MARKETPLACE_SOURCE,
+        installLocation,
+        lastUpdated: new Date().toISOString(),
+      }
+      await saveKnownMarketplacesConfig(known)
+
+      saveGlobalConfig(current => ({
+        ...current,
+        officialMarketplaceAutoInstallAttempted: true,
+        officialMarketplaceAutoInstalled: true,
+        officialMarketplaceAutoInstallFailReason: undefined,
+        officialMarketplaceAutoInstallRetryCount: undefined,
+        officialMarketplaceAutoInstallLastAttemptTime: undefined,
+        officialMarketplaceAutoInstallNextRetryTime: undefined,
+      }))
+      logEvent('tengu_official_marketplace_auto_install', {
+        installed: true,
+        skipped: false,
+        via_gcs: true,
+      })
+      return { installed: true, skipped: false }
+    }
+    // GCS failed (404 until backend writes, or network). Fall through to git
+    // ONLY if the kill-switch allows — same gate as refreshMarketplace().
+    if (
+      !getFeatureValue_CACHED_MAY_BE_STALE(
+        'tengu_plugin_official_mkt_git_fallback',
+        true,
+      )
+    ) {
+      logForDebugging(
+        'Official marketplace GCS failed; git fallback disabled by flag — skipping install',
+      )
+      // Same retry-with-backoff metadata as git_unavailable below — transient
+      // GCS failures should retry with exponential backoff, not give up.
+      const retryCount =
+        (config.officialMarketplaceAutoInstallRetryCount || 0) + 1
+      const now = Date.now()
+      const nextRetryTime = now + calculateNextRetryDelay(retryCount)
+      saveGlobalConfig(current => ({
+        ...current,
+        officialMarketplaceAutoInstallAttempted: true,
+        officialMarketplaceAutoInstalled: false,
+        officialMarketplaceAutoInstallFailReason: 'gcs_unavailable',
+        officialMarketplaceAutoInstallRetryCount: retryCount,
+        officialMarketplaceAutoInstallLastAttemptTime: now,
+        officialMarketplaceAutoInstallNextRetryTime: nextRetryTime,
+      }))
+      logEvent('tengu_official_marketplace_auto_install', {
+        installed: false,
+        skipped: true,
+        gcs_unavailable: true,
+        retry_count: retryCount,
+      })
+      return { installed: false, skipped: true, reason: 'gcs_unavailable' }
+    }
+
+    // Check git availability
+    const gitAvailable = await checkGitAvailable()
+    if (!gitAvailable) {
+      logForDebugging(
+        'Git not available, skipping official marketplace auto-install',
+      )
+      const retryCount =
+        (config.officialMarketplaceAutoInstallRetryCount || 0) + 1
+      const now = Date.now()
+      const nextRetryDelay = calculateNextRetryDelay(retryCount)
+      const nextRetryTime = now + nextRetryDelay
+
+      let configSaveFailed = false
+      try {
+        saveGlobalConfig(current => ({
+          ...current,
+          officialMarketplaceAutoInstallAttempted: true,
+          officialMarketplaceAutoInstalled: false,
+          officialMarketplaceAutoInstallFailReason: 'git_unavailable',
+          officialMarketplaceAutoInstallRetryCount: retryCount,
+          officialMarketplaceAutoInstallLastAttemptTime: now,
+          officialMarketplaceAutoInstallNextRetryTime: nextRetryTime,
+        }))
+      } catch (saveError) {
+        configSaveFailed = true
+        // Log the error properly so it gets tracked
+        const configError = toError(saveError)
+        logError(configError)
+
+        logForDebugging(
+          `Failed to save marketplace auto-install git_unavailable state: ${saveError}`,
+          { level: 'error' },
+        )
+      }
+      logEvent('tengu_official_marketplace_auto_install', {
+        installed: false,
+        skipped: true,
+        git_unavailable: true,
+        retry_count: retryCount,
+      })
+      return {
+        installed: false,
+        skipped: true,
+        reason: 'git_unavailable',
+        configSaveFailed,
+      }
+    }
+
+    // Attempt installation
+    logForDebugging('Attempting to auto-install official marketplace')
+    await addMarketplaceSource(OFFICIAL_MARKETPLACE_SOURCE)
+
+    // Success
+    logForDebugging('Successfully auto-installed official marketplace')
+    const previousRetryCount =
+      config.officialMarketplaceAutoInstallRetryCount || 0
+    saveGlobalConfig(current => ({
+      ...current,
+      officialMarketplaceAutoInstallAttempted: true,
+      officialMarketplaceAutoInstalled: true,
+      // Clear retry metadata on success
+      officialMarketplaceAutoInstallFailReason: undefined,
+      officialMarketplaceAutoInstallRetryCount: undefined,
+      officialMarketplaceAutoInstallLastAttemptTime: undefined,
+      officialMarketplaceAutoInstallNextRetryTime: undefined,
+    }))
+    logEvent('tengu_official_marketplace_auto_install', {
+      installed: true,
+      skipped: false,
+      retry_count: previousRetryCount,
+    })
+    return { installed: true, skipped: false }
+  } catch (error) {
+    // Handle installation failure
+    const errorMessage = error instanceof Error ? error.message : String(error)
+
+    // On macOS, /usr/bin/git is an xcrun shim that always exists on PATH, so
+    // checkGitAvailable() (which only does `which git`) passes even without
+    // Xcode CLT installed. The shim then fails at clone time with
+    // "xcrun: error: invalid active developer path (...)". Poison the memoized
+    // availability check so other git callers in this session skip cleanly,
+    // then return silently without recording any attempt state — next startup
+    // tries fresh (no backoff machinery for what is effectively "git absent").
+    if (errorMessage.includes('xcrun: error:')) {
+      markGitUnavailable()
+      logForDebugging(
+        'Official marketplace auto-install: git is a non-functional macOS xcrun shim, treating as git_unavailable',
+      )
+      logEvent('tengu_official_marketplace_auto_install', {
+        installed: false,
+        skipped: true,
+        git_unavailable: true,
+        macos_xcrun_shim: true,
+      })
+      return {
+        installed: false,
+        skipped: true,
+        reason: 'git_unavailable',
+      }
+    }
+
+    logForDebugging(
+      `Failed to auto-install official marketplace: ${errorMessage}`,
+      { level: 'error' },
+    )
+    logError(toError(error))
+
+    const retryCount =
+      (config.officialMarketplaceAutoInstallRetryCount || 0) + 1
+    const now = Date.now()
+    const nextRetryDelay = calculateNextRetryDelay(retryCount)
+    const nextRetryTime = now + nextRetryDelay
+
+    let configSaveFailed = false
+    try {
+      saveGlobalConfig(current => ({
+        ...current,
+        officialMarketplaceAutoInstallAttempted: true,
+        officialMarketplaceAutoInstalled: false,
+        officialMarketplaceAutoInstallFailReason: 'unknown',
+        officialMarketplaceAutoInstallRetryCount: retryCount,
+        officialMarketplaceAutoInstallLastAttemptTime: now,
+        officialMarketplaceAutoInstallNextRetryTime: nextRetryTime,
+      }))
+    } catch (saveError) {
+      configSaveFailed = true
+      // Log the error properly so it gets tracked
+      const configError = toError(saveError)
+      logError(configError)
+
+      logForDebugging(
+        `Failed to save marketplace auto-install failure state: ${saveError}`,
+        { level: 'error' },
+      )
+
+      // Still return the failure result even if config save failed
+      // This ensures we report the installation failure correctly
+    }
+    logEvent('tengu_official_marketplace_auto_install', {
+      installed: false,
+      skipped: true,
+      failed: true,
+      retry_count: retryCount,
+    })
+
+    return {
+      installed: false,
+      skipped: true,
+      reason: 'unknown',
+      configSaveFailed,
+    }
+  }
+}