claudeup 4.33.0 → 4.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.33.0",
+  "version": "4.35.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.33.0",
-    "claudeup-darwin-x64": "4.33.0",
-    "claudeup-linux-x64": "4.33.0"
+    "claudeup-darwin-arm64": "4.35.0",
+    "claudeup-darwin-x64": "4.35.0",
+    "claudeup-linux-x64": "4.35.0"
   }
 }

package/src/__tests__/content-drift.test.ts

@@ -20,8 +20,17 @@ let configDir: string;
 let prevConfigDir: string | undefined;
 let repo: string;
 
+// commit.gpgsign=false isolates the developer's git config. With signing on
+// (1Password's SSH signer, for instance) every commit here calls that signer,
+// and because this helper ignores the exit status a failure is silent: no
+// commit is created, so drift is never detected and the assertions fail with a
+// bare `false` that points nowhere near the real cause. CI has no signing
+// config, so this only ever broke locally.
 const git = (args: string[]) =>
-	spawnSync("git", args, { cwd: repo, encoding: "utf-8" });
+	spawnSync("git", ["-c", "commit.gpgsign=false", ...args], {
+		cwd: repo,
+		encoding: "utf-8",
+	});
 
 const head = () => git(["rev-parse", "HEAD"]).stdout.trim();
 

package/src/__tests__/gitignore-detector.test.ts

@@ -9,7 +9,19 @@ import type { ResolvedManifest } from "../types/gitignore";
 function git(cwd: string, ...args: string[]): string {
   // core.excludesFile=/dev/null bypasses the developer's global gitignore
   // so the test environment doesn't leak into the result.
-  const r = spawnSync("git", ["-c", "core.excludesFile=/dev/null", ...args], {
+  //
+  // commit.gpgsign=false is the same isolation, one step further: a developer
+  // with signed commits makes every `git commit` here call their signer. With
+  // 1Password's SSH agent that means a prompt or an agent error, so these tests
+  // failed or timed out locally for reasons that have nothing to do with the
+  // code under test. CI has no signing config, so it only ever broke locally.
+  const r = spawnSync("git", [
+    "-c",
+    "core.excludesFile=/dev/null",
+    "-c",
+    "commit.gpgsign=false",
+    ...args,
+  ], {
     cwd,
     encoding: "utf8",
   });

package/src/__tests__/resolver.test.ts

@@ -216,3 +216,74 @@ describe("resolveAllProfiles — union", () => {
 		expect(union.conflicts?.some((c) => c.includes("claudish"))).toBe(true);
 	});
 });
+
+describe("marketplaces derived from plugin ids", () => {
+	const noBins = { binResolver: fakeBinResolver({}) };
+
+	test("a plugin id registers the marketplace it names", async () => {
+		const manifest = manifestOf({
+			solo: { name: "Solo", plugins: { "dev@magus": "latest" } },
+		});
+		const c = await resolveProfile(manifest, "solo", noBins);
+		expect(c.marketplaces.magus).toEqual({
+			source: "github",
+			repo: "MadAppGang/magus",
+		});
+	});
+
+	test("extends alone is enough — the failure this fixes", async () => {
+		// A profile that only extends a predefined one inherits plugins like
+		// dev@magus and previously NO marketplaces, so install resolved every
+		// plugin against a marketplace that was never registered.
+		const manifest = manifestOf({
+			team: { name: "Team", extends: "developer-essentials" },
+		});
+		const c = await resolveProfile(manifest, "team", noBins);
+		expect(Object.keys(c.plugins).length).toBeGreaterThan(0);
+		expect(c.marketplaces.magus?.repo).toBe("MadAppGang/magus");
+	});
+
+	test("each distinct channel is derived, not just the first", async () => {
+		const manifest = manifestOf({
+			mixed: {
+				name: "Mixed",
+				plugins: {
+					"dev@magus": "latest",
+					"seo@magus-marketing": "latest",
+					"autolinear@magus-alpha": "latest",
+				},
+			},
+		});
+		const c = await resolveProfile(manifest, "mixed", noBins);
+		expect(c.marketplaces["magus-marketing"]?.repo).toBe("MadAppGang/magus-marketing");
+		expect(c.marketplaces["magus-alpha"]?.repo).toBe("MadAppGang/magus-alpha");
+	});
+
+	test("an explicit declaration is never overridden", async () => {
+		const manifest = manifestOf({
+			pinned: {
+				name: "Pinned",
+				marketplaces: { magus: { source: "github", repo: "MadAppGang/magus-fork" } },
+				plugins: { "dev@magus": "latest" },
+			},
+		});
+		const c = await resolveProfile(manifest, "pinned", noBins);
+		expect(c.marketplaces.magus?.repo).toBe("MadAppGang/magus-fork");
+	});
+
+	test("an unknown marketplace is left for the manifest to declare", async () => {
+		const manifest = manifestOf({
+			third: { name: "Third", plugins: { "thing@someones-marketplace": "latest" } },
+		});
+		const c = await resolveProfile(manifest, "third", noBins);
+		expect(c.marketplaces["someones-marketplace"]).toBeUndefined();
+	});
+
+	test("a bare plugin id contributes no marketplace", async () => {
+		const manifest = manifestOf({
+			bare: { name: "Bare", plugins: { local: "latest" } },
+		});
+		const c = await resolveProfile(manifest, "bare", noBins);
+		expect(Object.keys(c.marketplaces)).toHaveLength(0);
+	});
+});

package/src/__tests__/skill-install-files.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import {
+  resolveSkillFilePath,
+  selectSkillFiles,
+} from "../services/skills-manager.js";
+
+/**
+ * Installing a skill used to write exactly one file, SKILL.md, and drop
+ * everything beside it. Measured against the real repos: audit-website lost
+ * `references/OUTPUT-FORMAT.md` while its SKILL.md still linked to it,
+ * systematic-debugging lost `find-polluter.sh` and 9 more, and
+ * remotion-best-practices lost 136 files. The installed skill looked fine and
+ * had dangling links.
+ *
+ * These cover the two pieces of that fix that are pure: choosing which files
+ * belong to a skill, and refusing to write outside its directory.
+ */
+
+const blob = (p: string) => ({ path: p, type: "blob" });
+const tree = (p: string) => ({ path: p, type: "tree" });
+
+describe("selectSkillFiles", () => {
+  test("returns paths relative to the skill directory", () => {
+    expect(
+      selectSkillFiles(
+        [
+          blob("skills/audit-website/SKILL.md"),
+          blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
+          blob("skills/audit-website/assets/icon-small.svg"),
+        ],
+        "skills/audit-website",
+      ),
+    ).toEqual(["SKILL.md", "references/OUTPUT-FORMAT.md", "assets/icon-small.svg"]);
+  });
+
+  test("REGRESSION: a sibling with a shared name prefix is excluded", () => {
+    // Without the trailing slash on the prefix, "skills/audit" also matches
+    // "skills/audit-website/..." and dumps a second skill's files into the
+    // first one's directory.
+    expect(
+      selectSkillFiles(
+        [
+          blob("skills/audit/SKILL.md"),
+          blob("skills/audit-website/SKILL.md"),
+          blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
+        ],
+        "skills/audit",
+      ),
+    ).toEqual(["SKILL.md"]);
+  });
+
+  test("tree entries are skipped — only blobs are downloadable", () => {
+    expect(
+      selectSkillFiles(
+        [
+          tree("skills/x/references"),
+          blob("skills/x/SKILL.md"),
+          blob("skills/x/references/a.md"),
+        ],
+        "skills/x",
+      ),
+    ).toEqual(["SKILL.md", "references/a.md"]);
+  });
+
+  test("files outside the skill directory are excluded", () => {
+    expect(
+      selectSkillFiles(
+        [blob("README.md"), blob("other/SKILL.md"), blob("skills/x/SKILL.md")],
+        "skills/x",
+      ),
+    ).toEqual(["SKILL.md"]);
+  });
+
+  test("a trailing slash on the skill path does not break matching", () => {
+    expect(
+      selectSkillFiles([blob("skills/x/SKILL.md")], "skills/x/"),
+    ).toEqual(["SKILL.md"]);
+  });
+
+  test("a skill directory with no files yields nothing", () => {
+    expect(selectSkillFiles([blob("skills/other/SKILL.md")], "skills/x")).toEqual([]);
+  });
+});
+
+describe("resolveSkillFilePath", () => {
+  const dir = path.join(path.sep, "tmp", "skills", "demo");
+
+  test("resolves a plain relative path inside the install directory", () => {
+    expect(resolveSkillFilePath(dir, "SKILL.md")).toBe(
+      path.join(dir, "SKILL.md"),
+    );
+  });
+
+  test("resolves a nested path", () => {
+    expect(resolveSkillFilePath(dir, "references/OUTPUT-FORMAT.md")).toBe(
+      path.join(dir, "references", "OUTPUT-FORMAT.md"),
+    );
+  });
+
+  test("SECURITY: rejects paths escaping via ..", () => {
+    // These paths come from a remote repository and are untrusted input to a
+    // filesystem write.
+    expect(resolveSkillFilePath(dir, "../evil.md")).toBeNull();
+    expect(resolveSkillFilePath(dir, "../../.bashrc")).toBeNull();
+    expect(resolveSkillFilePath(dir, "refs/../../../evil.md")).toBeNull();
+  });
+
+  test("SECURITY: rejects absolute paths", () => {
+    expect(resolveSkillFilePath(dir, path.join(path.sep, "etc", "passwd"))).toBeNull();
+  });
+
+  test("rejects an empty path", () => {
+    expect(resolveSkillFilePath(dir, "")).toBeNull();
+  });
+
+  test("a .. that stays inside the directory is allowed", () => {
+    expect(resolveSkillFilePath(dir, "refs/../SKILL.md")).toBe(
+      path.join(dir, "SKILL.md"),
+    );
+  });
+
+  test("REGRESSION: a sibling directory sharing the name prefix is rejected", () => {
+    // path.startsWith without a separator would accept /tmp/skills/demo-evil
+    // as being inside /tmp/skills/demo.
+    expect(resolveSkillFilePath(dir, "../demo-evil/x.md")).toBeNull();
+  });
+});

package/src/data/marketplaces.ts

@@ -53,6 +53,19 @@ export const defaultMarketplaces: Marketplace[] = [
 		owned: true, // Ours: always listed even when uninstalled, sorted to the top
 		// Not featured: a niche channel, so keep it collapsed by default.
 	},
+	{
+		name: "magus-alpha",
+		displayName: "Magus Alpha",
+		source: {
+			source: "github",
+			repo: "MadAppGang/magus-alpha",
+		},
+		description:
+			"Experimental plugins with evolving interfaces — may change or be withdrawn without notice",
+		official: false,
+		owned: true, // Ours: always listed even when uninstalled, sorted to the top
+		// Not featured: experimental, so keep it collapsed by default.
+	},
 	{
 		name: "claude-plugins-official",
 		displayName: "Anthropic Official",

package/src/data/skill-repos.ts

@@ -32,11 +32,17 @@ const MEGA_REPOS = new Set([
 ]);
 
 /** Skill-dump repos: large collections where stars reflect quantity, not quality. */
+// Renamed repos are listed under BOTH names on purpose. The curated catalog
+// serves the current name while older cached copies and this file's fallback
+// list still carry the old one; dropping either silently reclassifies the repo
+// as "dedicated" and its stars start reading as a quality signal again.
 const SKILL_DUMP_REPOS = new Set([
   "affaan-m/everything-claude-code",
   "openclaw/openclaw",
   "jh941213/my-claude-code-asset",
+  "jh941213/my-cc-harness", // renamed from my-claude-code-asset
   "inferen-sh/skills",
+  "inference-sh/skills", // renamed from inferen-sh
 ]);
 
 /**

package/src/services/resolver.ts

@@ -17,6 +17,7 @@ import type {
 	ResolvedClosure,
 } from "../types/index.js";
 import { cliTools } from "../data/cli-tools.js";
+import { getMarketplaceByName } from "../data/marketplaces.js";
 import { PREDEFINED_PROFILES } from "../data/predefined-profiles.js";
 import { resolvePluginBinRequirements } from "./plugin-requires.js";
 
@@ -147,6 +148,36 @@ async function resolveBins(
 }
 
 /** Resolve a single profile (applying `extends`) into an install closure. */
+/**
+ * Add the marketplace every plugin id already names.
+ *
+ * A plugin id carries its marketplace — `dev@magus`, `seo@magus-marketing` —
+ * so requiring the manifest to ALSO declare that marketplace is redundant, and
+ * forgetting to is silent: the plugin resolves against a marketplace that was
+ * never registered. `extends` made this the default failure, because it
+ * inherits plugins from a predefined profile and no marketplaces at all.
+ *
+ * Only marketplaces claudeup already knows are derived, since a repo is needed
+ * to register one. An unknown suffix is left alone for the manifest to declare.
+ * An explicit entry always wins: deriving must never override a pin.
+ */
+function withDerivedMarketplaces(
+	declared: ProfileManifestEntry["marketplaces"],
+	plugins: Record<string, string>,
+): NonNullable<ProfileManifestEntry["marketplaces"]> {
+	const out = { ...(declared ?? {}) };
+	for (const id of Object.keys(plugins)) {
+		const at = id.lastIndexOf("@");
+		if (at <= 0) continue;
+		const name = id.slice(at + 1);
+		if (out[name]) continue;
+		const known = getMarketplaceByName(name);
+		if (!known?.source.repo) continue;
+		out[name] = { source: "github", repo: known.source.repo };
+	}
+	return out;
+}
+
 export async function resolveProfile(
 	manifest: ProfileManifest,
 	profileId: string,
@@ -161,7 +192,7 @@ export async function resolveProfile(
 	const bins = await resolveBins(entry, Object.keys(plugins), binResolver);
 
 	return {
-		marketplaces: { ...(entry.marketplaces ?? {}) },
+		marketplaces: withDerivedMarketplaces(entry.marketplaces, plugins),
 		plugins,
 		mcpServers: { ...(entry.mcpServers ?? {}) },
 		bins,

package/src/services/skills-manager.ts

@@ -344,11 +344,69 @@ export async function fetchAvailableSkills(
 
 // ─── Install / Uninstall ──────────────────────────────────────────────────────
 
+/** Hard ceilings so one pathological repo cannot fill a user's disk. */
+const MAX_SKILL_FILES = 200;
+const MAX_SKILL_BYTES = 20 * 1024 * 1024;
+
+/**
+ * Pick the files that belong to one skill out of a whole-repo tree listing.
+ *
+ * Returns paths relative to the skill directory, so `skills/x/refs/a.md`
+ * under `skills/x` becomes `refs/a.md`.
+ *
+ * The trailing slash on the prefix is load-bearing: without it `skills/audit`
+ * also matches `skills/audit-website/...`, and the user gets a second skill's
+ * files dumped into the first one's directory.
+ */
+export function selectSkillFiles(
+	treePaths: { path: string; type: string }[],
+	repoPath: string,
+): string[] {
+	const prefix = `${repoPath.replace(/\/+$/, "")}/`;
+	return treePaths
+		.filter((e) => e.type === "blob" && e.path.startsWith(prefix))
+		.map((e) => e.path.slice(prefix.length))
+		.filter((rel) => rel.length > 0);
+}
+
+/**
+ * Resolve one relative path inside the install directory, or return null.
+ *
+ * These paths come from a remote repository, so they are untrusted input to a
+ * filesystem write. Anything that escapes the install directory — `..`
+ * segments, an absolute path — is dropped rather than written outside the
+ * skill folder.
+ */
+export function resolveSkillFilePath(
+	installDir: string,
+	relativePath: string,
+): string | null {
+	if (!relativePath || path.isAbsolute(relativePath)) return null;
+	const resolvedDir = path.resolve(installDir);
+	const target = path.resolve(resolvedDir, relativePath);
+	if (target !== resolvedDir && !target.startsWith(resolvedDir + path.sep)) {
+		return null;
+	}
+	return target;
+}
+
+/** What an install actually delivered — surfaced so the UI can be honest. */
+export interface InstallResult {
+	/** Number of files written, always ≥ 1 (SKILL.md). */
+	fileCount: number;
+	/**
+	 * Set when only SKILL.md could be written for a skill that has more files,
+	 * e.g. the GitHub tree call was rate-limited. The skill is installed but
+	 * incomplete, and the caller should say so.
+	 */
+	degraded?: string;
+}
+
 export async function installSkill(
 	skill: SkillInfo,
 	scope: "user" | "project",
 	projectPath?: string,
-): Promise<void> {
+): Promise<InstallResult> {
 	// Try multiple URL patterns — repos structure SKILL.md differently
 	const repo = skill.source.repo;
 	const repoPath = skill.repoPath.replace(/\/SKILL\.md$/, "");
@@ -392,6 +450,74 @@ export async function installSkill(
 
 	await fs.ensureDir(installDir);
 	await fs.writeFile(path.join(installDir, "SKILL.md"), content, "utf8");
+
+	// SKILL.md alone is usually not a working skill. Skills ship scripts,
+	// references and assets beside it and link to them by relative path, so
+	// writing only SKILL.md leaves dangling links — measured: audit-website
+	// references `references/OUTPUT-FORMAT.md`, systematic-debugging ships
+	// `find-polluter.sh` and 9 more. Fetch the rest of the directory.
+	let extras: string[] = [];
+	try {
+		const tree = await fetchGitTree(repo);
+		extras = selectSkillFiles(tree.tree, repoPath).filter(
+			(rel) => rel !== "SKILL.md",
+		);
+	} catch (error) {
+		// The tree call is the rate-limited one. A skill with only SKILL.md is
+		// still correct, so report the shortfall instead of failing the install.
+		return {
+			fileCount: 1,
+			degraded:
+				error instanceof Error && /rate limit/i.test(error.message)
+					? "GitHub rate limit — supporting files not fetched. Set GITHUB_TOKEN and reinstall."
+					: "supporting files could not be listed; SKILL.md only",
+		};
+	}
+
+	if (extras.length === 0) return { fileCount: 1 };
+
+	const truncated = extras.length > MAX_SKILL_FILES;
+	const selected = truncated ? extras.slice(0, MAX_SKILL_FILES) : extras;
+
+	let written = 1;
+	let bytes = content.length;
+	let budgetHit = false;
+
+	for (const rel of selected) {
+		if (bytes >= MAX_SKILL_BYTES) {
+			budgetHit = true;
+			break;
+		}
+		const target = resolveSkillFilePath(installDir, rel);
+		if (!target) continue; // escapes the install dir — never write it
+		try {
+			const res = await fetch(
+				`https://raw.githubusercontent.com/${repo}/HEAD/${repoPath}/${rel}`,
+				{ signal: AbortSignal.timeout(15000) },
+			);
+			if (!res.ok) continue;
+			// Buffer, not text: skills ship binary assets (.png, .svg) and
+			// decoding those as UTF-8 corrupts them.
+			const buf = Buffer.from(await res.arrayBuffer());
+			await fs.ensureDir(path.dirname(target));
+			await fs.writeFile(target, buf);
+			written++;
+			bytes += buf.length;
+		} catch {
+			// One unreachable asset should not abandon a half-written skill.
+		}
+	}
+
+	let degraded: string | undefined;
+	if (budgetHit) {
+		degraded = `stopped at ${MAX_SKILL_BYTES / 1024 / 1024}MB — skill is larger than the install budget`;
+	} else if (truncated) {
+		degraded = `only the first ${MAX_SKILL_FILES} of ${extras.length + 1} files were installed`;
+	} else if (written < selected.length + 1) {
+		degraded = `${selected.length + 1 - written} of ${selected.length + 1} files could not be fetched`;
+	}
+
+	return { fileCount: written, degraded };
 }
 
 export async function uninstallSkill(
@@ -411,11 +537,20 @@ export async function uninstallSkill(
 
 	const skillMdPath = path.join(installDir, "SKILL.md");
 
+	// Remove the whole skill directory, not just SKILL.md. Installs now write
+	// supporting files (scripts, references, assets); deleting SKILL.md alone
+	// left those orphaned, and the follow-up `rmdir` then failed silently on the
+	// non-empty directory — so the skill vanished from the UI while its files
+	// stayed on disk forever.
+	//
+	// Gated on SKILL.md existing so this only ever deletes a directory that is
+	// actually an installed skill.
 	if (await fs.pathExists(skillMdPath)) {
-		await fs.remove(skillMdPath);
+		await fs.remove(installDir);
+		return;
 	}
 
-	// Try to remove directory if empty
+	// No SKILL.md: at most an empty leftover directory. Remove it only if empty.
 	try {
 		await fs.rmdir(installDir);
 	} catch {

package/src/ui/screens/PluginsScreen.tsx

@@ -6,7 +6,7 @@ import { ScreenLayout } from "../components/layout/index.js";
 import { ScrollableList } from "../components/ScrollableList.js";
 import { EmptyFilterState } from "../components/EmptyFilterState.js";
 import { fuzzyFilter } from "../../utils/fuzzy-search.js";
-import { getAllMarketplaces } from "../../data/marketplaces.js";
+import { defaultMarketplaces, getAllMarketplaces } from "../../data/marketplaces.js";
 import { clearContentDriftCache } from "../../services/content-drift.js";
 import {
 	diffVersions,
@@ -33,6 +33,7 @@ import {
 } from "../../services/claude-settings.js";
 import { saveProfile } from "../../services/profiles.js";
 import {
+	addMarketplace as cliAddMarketplace,
 	installPlugin as cliInstallPlugin,
 	repairPlugin as cliRepairPlugin,
 	uninstallPlugin as cliUninstallPlugin,
@@ -387,16 +388,60 @@ export function PluginsScreen() {
 		}
 	};
 
+	/**
+	 * Add a marketplace.
+	 *
+	 * The known ones are offered as a menu and added here — that covers every
+	 * marketplace claudeup ships with, including magus, so a first run does not
+	 * have to leave the tool. An arbitrary owner/repo still needs the terminal:
+	 * there is no text-input modal, only confirm/message/select.
+	 */
 	const handleShowAddMarketplaceInstructions = async () => {
+		const installed = new Set(
+			pluginsState.marketplaces.status === "success"
+				? pluginsState.marketplaces.data.map((m) => m.name)
+				: [],
+		);
+		const addable = defaultMarketplaces.filter(
+			(m) => !installed.has(m.name) && !m.deprecated && m.source.repo,
+		);
+
+		if (addable.length > 0) {
+			const choice = await modal.select(
+				"Add Marketplace",
+				"Pick one to add now, or choose Other for a repo not listed.",
+				[
+					...addable.map((m) => ({
+						label: m.displayName || m.name,
+						value: m.source.repo as string,
+						description: m.description,
+					})),
+					{ label: "Other…", value: "", description: "Any owner/repo" },
+				],
+			);
+			if (choice === null) return;
+			if (choice) {
+				try {
+					await cliAddMarketplace(choice);
+					await handleRefresh();
+				} catch (e) {
+					await modal.message(
+						"Could not add marketplace",
+						`${(e as Error).message}\n\nRun it yourself if this persists:\n\n` +
+							`  claude plugin marketplace add ${choice}`,
+						"error",
+					);
+				}
+				return;
+			}
+		}
+
 		await modal.message(
 			"Add Marketplace",
-			"To add a marketplace, run this command in your terminal:\n\n" +
+			"For a marketplace that is not listed, run this in your terminal:\n\n" +
 				"  claude plugin marketplace add owner/repo\n\n" +
-				"Examples:\n" +
-				"  claude plugin marketplace add MadAppGang/magus\n" +
-				"  claude plugin marketplace add anthropics/claude-plugins-official\n\n" +
 				"Auto-update is enabled by default for new marketplaces.\n\n" +
-				"After adding, refresh claudeup with 'r' to see the new marketplace.",
+				"After adding, refresh claudeup with 'r' to see it.",
 			"info",
 		);
 	};
@@ -593,14 +638,30 @@ export function PluginsScreen() {
 					);
 				}
 			} else {
-				await modal.message(
+				// Add it here rather than printing the command for the user to run.
+				// Telling someone to leave the tool, paste a command, come back and
+				// press 'r' is a step claudeup can just take: it already knows the
+				// repo, and addMarketplace() is the same call they would make.
+				const repo = mp.source.repo || mp.name;
+				const wantAdd = await modal.confirm(
 					`Add ${mp.displayName}?`,
-					`To add this marketplace, run in your terminal:\n\n` +
-						`  claude plugin marketplace add ${mp.source.repo || mp.name}\n\n` +
-						`Auto-update is enabled by default.\n\n` +
-						`After adding, refresh claudeup with 'r' to see it.`,
-					"info",
+					`Clone ${repo} and register it as a marketplace?\n\n` +
+						`Auto-update is enabled by default.`,
 				);
+				if (wantAdd) {
+					try {
+						await cliAddMarketplace(repo);
+						await handleRefresh();
+					} catch (e) {
+						await modal.message(
+							"Could not add marketplace",
+							`${(e as Error).message}\n\n` +
+								`Run it yourself if this persists:\n\n` +
+								`  claude plugin marketplace add ${repo}`,
+							"error",
+						);
+					}
+				}
 			}
 		} else if (item.kind === "plugin") {
 			const plugin = item.plugin;

package/src/ui/screens/SkillsScreen.tsx

@@ -271,10 +271,12 @@ export function SkillsScreen() {
       showStatus(`Installing ${toInstall.length} skills from ${set.name}...`);
       let installed = 0;
       let failed = 0;
+      let degraded = 0;
       for (const skill of toInstall) {
         try {
-          await installSkill(skill, scope, state.projectPath);
+          const result = await installSkill(skill, scope, state.projectPath);
           installed++;
+          if (result.degraded) degraded++;
         } catch {
           failed++;
         }
@@ -282,6 +284,13 @@ export function SkillsScreen() {
       await scanDisk();
       if (failed > 0) {
         showStatus(`Installed ${installed}/${toInstall.length} (${failed} failed)`, "error");
+      } else if (degraded > 0) {
+        // Incomplete is not the same as installed. Say so rather than let a
+        // batch of half-written skills report a clean success.
+        showStatus(
+          `Installed ${installed} skills from ${set.name} to ${scope} — ${degraded} incomplete (missing supporting files)`,
+          "error",
+        );
       } else {
         showStatus(`Installed ${installed} skills from ${set.name} to ${scope}`);
       }
@@ -443,9 +452,20 @@ export function SkillsScreen() {
   const handleInstall = useCallback(async (scope: "user" | "project") => {
     if (!selectedSkill) return;
     try {
-      await installSkill(selectedSkill, scope, state.projectPath);
+      const result = await installSkill(selectedSkill, scope, state.projectPath);
       await scanDisk(); // Re-scan disk only — no network re-fetch needed
-      showStatus(`Installed ${selectedSkill.name} to ${scope}`);
+      const files =
+        result.fileCount === 1 ? "1 file" : `${result.fileCount} files`;
+      // An install that silently dropped supporting files used to report plain
+      // success, so a half-installed skill looked identical to a good one.
+      if (result.degraded) {
+        showStatus(
+          `Installed ${selectedSkill.name} to ${scope} (${files}) — ${result.degraded}`,
+          "error",
+        );
+      } else {
+        showStatus(`Installed ${selectedSkill.name} to ${scope} (${files})`);
+      }
     } catch (error) {
       showStatus(`Failed: ${error}`, "error");
     }