claudeup 6.2.0 → 6.3.0

package/src/services/plugin-manager.ts

@@ -1,10 +1,15 @@
 import path from "node:path";
+import { defaultMarketplaces } from "../data/marketplaces.js";
+import type {
+	InstalledPluginsRegistry,
+	PluginRelease,
+} from "../types/index.js";
+import { formatMarketplaceName, parsePluginId } from "../utils/string-utils.js";
+import type { PluginScope } from "./claude-cli.js";
 import {
 	getConfiguredMarketplaces,
 	getEnabledPlugins,
 	getGlobalClaudeDir,
-	readSettings,
-	writeSettings,
 	getGlobalConfiguredMarketplaces,
 	getGlobalEnabledPlugins,
 	getGlobalInstalledPluginVersions,
@@ -13,40 +18,32 @@ import {
 	getProjectInstalledPluginVersions,
 	pickRegistryEntry,
 	readInstalledPluginsRegistry,
+	readSettings,
+	removeFromInstalledPluginsRegistry,
 	saveGlobalInstalledPluginVersion,
 	saveLocalInstalledPluginVersion,
 	updateInstalledPluginsRegistry,
-	removeFromInstalledPluginsRegistry,
+	writeSettings,
 } from "./claude-settings.js";
-import type { PluginScope } from "./claude-cli.js";
 import { hasContentDrift } from "./content-drift.js";
 import { inheritablePaths } from "./git-worktree.js";
-import { defaultMarketplaces } from "../data/marketplaces.js";
-import type {
-	InstalledPluginsRegistry,
-	PluginRelease,
-} from "../types/index.js";
 import {
-	scanLocalMarketplaces,
-	repairAllMarketplaces,
 	type LocalMarketplace,
 	type ProgressCallback,
 	type RepairMarketplaceResult,
+	repairAllMarketplaces,
+	scanLocalMarketplaces,
 } from "./local-marketplace.js";
 import {
-	formatMarketplaceName,
-	parsePluginId,
-} from "../utils/string-utils.js";
-import {
+	type CatalogSource,
+	type MarketplaceFetchFailure,
+	type MarketplacePlugin,
 	clearMarketplaceCache as clearFetcherCache,
 	clearPersistedCatalogs,
 	fetchMarketplacePlugins,
 	getMarketplaceFetchFailures,
 	isAuthoritative,
 	resolveMarketplacePlugins,
-	type CatalogSource,
-	type MarketplaceFetchFailure,
-	type MarketplacePlugin,
 } from "./marketplace-fetcher.js";
 export {
 	fetchMarketplacePlugins,
@@ -224,7 +221,6 @@ export function resolveScopeAction(
 	return hasUpdate ? "update" : "uninstall";
 }
 
-
 export async function getAvailablePlugins(
 	projectPath?: string,
 ): Promise<PluginInfo[]> {
@@ -728,7 +724,8 @@ async function annotateContentDrift(
 		plugins.map(async (plugin) => {
 			if (plugin.hasUpdate || plugin.isOrphaned) return;
 			if (!plugin.installedVersion || !plugin.version) return;
-			if (compareVersions(plugin.version, plugin.installedVersion) !== 0) return;
+			if (compareVersions(plugin.version, plugin.installedVersion) !== 0)
+				return;
 
 			const entry = pickRegistryEntry(
 				registry.plugins[plugin.id],

package/src/services/plugin-mcp-config.ts

@@ -1,6 +1,6 @@
-import fs from "fs-extra";
-import path from "node:path";
 import os from "node:os";
+import path from "node:path";
+import fs from "fs-extra";
 
 const CLAUDE_PLUGINS_DIR = path.join(
 	os.homedir(),

package/src/services/plugin-requires.ts

@@ -7,14 +7,15 @@
  * bug where a plugin's MCP server silently fails because its binary is missing.
  */
 
-import fs from "fs-extra";
-import path from "node:path";
 import os from "node:os";
+import path from "node:path";
+import fs from "fs-extra";
 import type {
 	BinInstaller,
 	BinRequirement,
 	PluginRequires,
 } from "../types/index.js";
+import { goBinaryName } from "../utils/go-module.js";
 import { parsePluginId } from "../utils/string-utils.js";
 import { getLocalMarketplacesInfo } from "./plugin-manager.js";
 
@@ -79,9 +80,7 @@ function parseSetup(setup: unknown): BinRequirement[] {
 	const s = setup as Record<string, unknown>;
 	const bins: BinRequirement[] = [];
 
-	const pkgManager = (
-		key: "bun" | "npm" | "pip",
-	): void => {
+	const pkgManager = (key: "bun" | "npm" | "pip"): void => {
 		for (const spec of (s[key] as string[] | undefined) ?? []) {
 			if (typeof spec !== "string") continue;
 			const { base, version } = splitVersion(spec);
@@ -98,20 +97,29 @@ function parseSetup(setup: unknown): BinRequirement[] {
 	pkgManager("npm");
 	pkgManager("pip");
 
+	// Not basename(): a Go module's trailing /vN is its major version, not the
+	// binary. `tmux-mcp/v2` installs `tmux-mcp`; naming it `v2` here made every
+	// downstream presence check look for a binary that never exists.
 	for (const spec of (s.go as string[] | undefined) ?? []) {
 		if (typeof spec !== "string") continue;
 		const { base, version } = splitVersion(spec);
+		const name = goBinaryName(base);
 		bins.push({
-			name: basename(base),
+			name,
 			via: "go",
 			module: base,
 			version,
-			check: `${basename(base)} --version`,
+			check: `${name} --version`,
 		});
 	}
 	for (const spec of (s.brew as string[] | undefined) ?? []) {
 		if (typeof spec !== "string") continue;
-		bins.push({ name: spec, via: "brew", formula: spec, check: `${spec} --version` });
+		bins.push({
+			name: spec,
+			via: "brew",
+			formula: spec,
+			check: `${spec} --version`,
+		});
 	}
 	// `required` names a system tool that must be present; brew is the assumed
 	// installer (matches the "system tools via brew" decision).

package/src/services/plugin-setup.ts

@@ -26,13 +26,14 @@
  */
 
 import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import fs from "fs-extra";
-import { access } from "node:fs/promises";
 import { constants as fsConstants } from "node:fs";
-import path from "node:path";
+import { access } from "node:fs/promises";
 import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import fs from "fs-extra";
 import { which } from "../utils/command-utils.js";
+import { goBinaryName } from "../utils/go-module.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -392,14 +393,32 @@ async function installCargoPackages(
 	}
 }
 
+/**
+ * {@link parseAtSpec} for a Go module spec.
+ *
+ * Same split, but the name comes from {@link goBinaryName}: Go's `/vN`
+ * major-version suffix is part of the module path, not the binary, so
+ * "github.com/MadAppGang/tmux-mcp/v2@v2.0.0" installs `tmux-mcp`, not `v2`.
+ * The generic parser cannot do this — an npm scope may legitimately be `v2`.
+ */
+export function parseGoSpec(spec: string): ParsedSpec {
+	const parsed = parseAtSpec(spec);
+	// Same separator rule as parseAtSpec: a leading `@` is never a version.
+	const at = spec.lastIndexOf("@");
+	const modulePath = at > 0 ? spec.slice(0, at) : spec;
+	return { ...parsed, name: goBinaryName(modulePath) };
+}
+
 /**
  * Extract binary name from a Go module path.
- * The binary name is the last path segment before @version.
- * e.g., "github.com/MadAppGang/tmux-mcp@latest" → "tmux-mcp"
- *       "github.com/user/tool" → "tool"
+ * The binary name is the last path segment before @version, minus any /vN
+ * major-version suffix.
+ * e.g., "github.com/MadAppGang/tmux-mcp@latest"    → "tmux-mcp"
+ *       "github.com/MadAppGang/tmux-mcp/v2@v2.0.0" → "tmux-mcp"
+ *       "github.com/user/tool"                      → "tool"
  */
 export function extractGoBinaryName(pkg: string): string {
-	return parseAtSpec(pkg).name;
+	return parseGoSpec(pkg).name;
 }
 
 /**
@@ -409,7 +428,7 @@ export function extractGoBinaryName(pkg: string): string {
  *       "github.com/user/tool"                  → null
  */
 export function extractGoVersion(pkg: string): string | null {
-	return parseAtSpec(pkg).version;
+	return parseGoSpec(pkg).version;
 }
 
 /** Normalize a semver-ish string for comparison: trim and drop a leading "v". */
@@ -641,7 +660,7 @@ export async function binaryDepDecision(
 
 /** {@link binaryDepDecision} for a Go module path. */
 export async function goDepDecision(pkg: string): Promise<GoDepDecision> {
-	return binaryDepDecision(parseAtSpec(pkg), getGoInstallDir);
+	return binaryDepDecision(parseGoSpec(pkg), getGoInstallDir);
 }
 
 /**
@@ -781,10 +800,10 @@ export async function getPluginSetupConfig(
 
 	// Find the version directory
 	const versions = await fs.readdir(pluginPath);
-	if (versions.length === 0) return null;
 
 	// Use the latest version directory
-	const latestVersion = versions.sort().pop()!;
+	const latestVersion = versions.sort().pop();
+	if (latestVersion === undefined) return null;
 	const manifestPath = path.join(pluginPath, latestVersion, "plugin.json");
 
 	if (!(await fs.pathExists(manifestPath))) return null;
@@ -824,9 +843,7 @@ export async function getPluginSetupFromSource(
 			try {
 				const manifest = await fs.readJson(pluginJson);
 				return manifest.setup || null;
-			} catch {
-				continue;
-			}
+			} catch {}
 		}
 	}
 

package/src/services/plugin-version-check.ts

@@ -276,9 +276,7 @@ export function formatMismatchWarning(
  * Format mismatch info for TUI modal display.
  * Returns a multi-line string suitable for a modal message.
  */
-export function formatMismatchModal(
-	mismatches: VersionMismatchInfo[],
-): string {
+export function formatMismatchModal(mismatches: VersionMismatchInfo[]): string {
 	const lines: string[] = [];
 
 	lines.push("Your plugins will not work correctly in this project.");
@@ -290,7 +288,9 @@ export function formatMismatchModal(
 
 	for (const m of mismatches) {
 		const name = m.pluginId.split("@")[0];
-		lines.push(`  ${name}: v${m.firstEntryVersion} loaded, expected v${m.currentProjectVersion}`);
+		lines.push(
+			`  ${name}: v${m.firstEntryVersion} loaded, expected v${m.currentProjectVersion}`,
+		);
 	}
 
 	lines.push("");

package/src/services/profile-materializer.ts

@@ -11,8 +11,8 @@
  * and touches no global state, so it is fully testable with a temp dir.
  */
 
-import fs from "fs-extra";
 import path from "node:path";
+import fs from "fs-extra";
 import type { ResolvedClosure } from "../types/index.js";
 import { profileDir } from "./symlink-manager.js";
 
@@ -48,9 +48,9 @@ export function buildProfileSettings(
 }
 
 /** Build the .mcp.json contents for a profile. */
-export function buildProfileMcp(
-	closure: ResolvedClosure,
-): { mcpServers: Record<string, unknown> } {
+export function buildProfileMcp(closure: ResolvedClosure): {
+	mcpServers: Record<string, unknown>;
+} {
 	return { mcpServers: { ...closure.mcpServers } };
 }
 
@@ -73,7 +73,11 @@ async function seedSkillsFromProject(
 ): Promise<void> {
 	if (await fs.pathExists(skillsDir)) return;
 
-	const projectSkills = path.join(projectPath ?? process.cwd(), ".claude", "skills");
+	const projectSkills = path.join(
+		projectPath ?? process.cwd(),
+		".claude",
+		"skills",
+	);
 	try {
 		// lstat, not pathExists: an existing profile symlink is not a source.
 		const stat = await fs.lstat(projectSkills);

package/src/services/profile-sync.ts

@@ -8,8 +8,8 @@
  * becomes a reviewable manifest diff instead of silent, throwaway drift.
  */
 
-import fs from "fs-extra";
 import path from "node:path";
+import fs from "fs-extra";
 import type {
 	McpServerConfig,
 	ProfileManifest,
@@ -68,7 +68,10 @@ export function computeSync(
 	const { enabledPlugins: _drop, ...settings } = materializedSettings;
 	if (JSON.stringify(settings) !== JSON.stringify(entry.settings ?? {})) {
 		if (Object.keys(settings).length > 0) next.settings = settings;
-		else delete next.settings;
+		else {
+			// biome-ignore lint/performance/noDelete: the manifest entry is serialised to profiles.json and diffed with JSON.stringify/toStrictEqual; the key must be absent, not undefined
+			delete next.settings;
+		}
 		changes.push({ kind: "settings-changed", detail: "settings updated" });
 	}
 
@@ -76,7 +79,10 @@ export function computeSync(
 	const mcp = materializedMcp.mcpServers ?? {};
 	if (JSON.stringify(mcp) !== JSON.stringify(entry.mcpServers ?? {})) {
 		if (Object.keys(mcp).length > 0) next.mcpServers = mcp;
-		else delete next.mcpServers;
+		else {
+			// biome-ignore lint/performance/noDelete: the manifest entry is serialised to profiles.json and diffed with JSON.stringify/toStrictEqual; the key must be absent, not undefined
+			delete next.mcpServers;
+		}
 		changes.push({ kind: "mcp-changed", detail: "mcp servers updated" });
 	}
 
@@ -129,7 +135,9 @@ export async function syncProfile(
 	const settingsPath = path.join(dir, "settings.json");
 	const mcpPath = path.join(dir, "mcp.json");
 	if (!(await fs.pathExists(settingsPath))) {
-		throw new Error(`Profile "${name}" isn't materialized (${settingsPath} missing).`);
+		throw new Error(
+			`Profile "${name}" isn't materialized (${settingsPath} missing).`,
+		);
 	}
 
 	const materializedSettings = await fs.readJson(settingsPath);

package/src/services/profiles.ts

@@ -1,7 +1,7 @@
-import fs from "fs-extra";
-import path from "node:path";
 import os from "node:os";
-import type { Profile, ProfilesFile, ProfileEntry } from "../types/index.js";
+import path from "node:path";
+import fs from "fs-extra";
+import type { Profile, ProfileEntry, ProfilesFile } from "../types/index.js";
 
 const PROFILES_FILE = "profiles.json";
 

package/src/services/resolver.ts

@@ -9,6 +9,9 @@
  */
 
 import semver from "semver";
+import { cliTools } from "../data/cli-tools.js";
+import { getMarketplaceByName } from "../data/marketplaces.js";
+import { PREDEFINED_PROFILES } from "../data/predefined-profiles.js";
 import type {
 	BinRequirement,
 	ProfileManifest,
@@ -16,9 +19,6 @@ import type {
 	ResolvedBin,
 	ResolvedClosure,
 } from "../types/index.js";
-import { cliTools } from "../data/cli-tools.js";
-import { getMarketplaceByName } from "../data/marketplaces.js";
-import { PREDEFINED_PROFILES } from "../data/predefined-profiles.js";
 import { resolvePluginBinRequirements } from "./plugin-requires.js";
 
 export interface ResolveOptions {
@@ -237,17 +237,21 @@ function pickVersion(
  * resolved deterministically to the higher pin — NOT by profile order — and
  * collected into `conflicts` so `install`/`profile show` can surface them.
  */
-function mergeClosures(a: ResolvedClosure, b: ResolvedClosure): ResolvedClosure {
+function mergeClosures(
+	a: ResolvedClosure,
+	b: ResolvedClosure,
+): ResolvedClosure {
 	const conflicts = [...(a.conflicts ?? []), ...(b.conflicts ?? [])];
 
 	// Plugins: deterministic version pick per id.
 	const plugins: Record<string, string> = { ...a.plugins };
 	for (const [id, ver] of Object.entries(b.plugins)) {
-		if (plugins[id] === undefined) {
+		const existing = plugins[id];
+		if (existing === undefined) {
 			plugins[id] = ver;
 			continue;
 		}
-		const { chosen, conflict } = pickVersion(id, plugins[id]!, ver);
+		const { chosen, conflict } = pickVersion(id, existing, ver);
 		plugins[id] = chosen;
 		if (conflict) conflicts.push(conflict);
 	}

package/src/services/settings-manager.ts

@@ -1,42 +1,74 @@
-import * as fs from "fs";
-import * as path from "path";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { SettingDefinition } from "../data/settings-catalog.js";
+import type { ClaudeSettings } from "../types/index.js";
 import {
-	readSettings,
-	writeSettings,
 	readGlobalSettings,
+	readSettings,
 	writeGlobalSettings,
+	writeSettings,
 } from "./claude-settings.js";
-import type { SettingDefinition } from "../data/settings-catalog.js";
 
 export type SettingScope = "user" | "project";
 
-/** Read the current value of a setting from the given scope */
-export async function readSettingValue(
-	setting: SettingDefinition,
+/**
+ * settings.json is an open JSON object: the catalog addresses keys that the
+ * typed `ClaudeSettings` shape does not enumerate (`attribution`, `env`, any
+ * dotted path). Read and write through this record view and narrow each value.
+ */
+type SettingsRecord = ClaudeSettings & Record<string, unknown>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** The `attribution` block as Claude Code stores it. */
+interface Attribution {
+	commit?: unknown;
+	pr?: unknown;
+}
+
+function readAttribution(settings: SettingsRecord): Attribution | undefined {
+	const raw = settings.attribution;
+	return isRecord(raw) ? raw : undefined;
+}
+
+async function loadSettings(
 	scope: SettingScope,
 	projectPath?: string,
-): Promise<string | undefined> {
+): Promise<SettingsRecord> {
 	const settings =
 		scope === "user"
 			? await readGlobalSettings()
 			: await readSettings(projectPath);
+	return settings as SettingsRecord;
+}
+
+/** Read the current value of a setting from the given scope */
+export async function readSettingValue(
+	setting: SettingDefinition,
+	scope: SettingScope,
+	projectPath?: string,
+): Promise<string | undefined> {
+	const settings = await loadSettings(scope, projectPath);
 
 	if (setting.storage.type === "attribution") {
 		// Attribution is an object: { commit: "", pr: "" } means disabled
-		const attr = (settings as any).attribution;
+		const attr = readAttribution(settings);
 		if (attr && attr.commit === "" && attr.pr === "") {
 			return "false";
 		}
 		return undefined; // default (enabled)
-	} else if (setting.storage.type === "attribution-text") {
+	}
+	if (setting.storage.type === "attribution-text") {
 		// Custom attribution text: read from attribution.commit, strip the Co-Authored-By trailer prefix
-		const attr = (settings as any).attribution;
+		const attr = readAttribution(settings);
 		if (!attr || (attr.commit === "" && attr.pr === "")) {
 			// Attribution is disabled or not set — no custom text stored
 			return undefined;
 		}
-		const commit: string | undefined = attr.commit;
-		if (!commit) {
+		const commit = attr.commit;
+		if (typeof commit !== "string" || commit === "") {
 			return undefined;
 		}
 		// The commit value is "Co-Authored-By: Magus <magus@madappgang.com>\n\n{customText}"
@@ -48,18 +80,19 @@ export async function readSettingValue(
 		}
 		// If no trailer prefix, the value is the raw text (or Claude default — return undefined)
 		return undefined;
-	} else if (setting.storage.type === "env") {
-		const env = (settings as any).env as Record<string, string> | undefined;
-		return env?.[setting.storage.key];
-	} else {
-		// Direct settings key (supports dot notation like "permissions.defaultMode")
-		const keys = setting.storage.key.split(".");
-		let value: any = settings;
-		for (const k of keys) {
-			value = value?.[k];
-		}
-		return value !== undefined && value !== null ? String(value) : undefined;
 	}
+	if (setting.storage.type === "env") {
+		const env = settings.env;
+		const raw = isRecord(env) ? env[setting.storage.key] : undefined;
+		return typeof raw === "string" ? raw : undefined;
+	}
+	// Direct settings key (supports dot notation like "permissions.defaultMode")
+	const keys = setting.storage.key.split(".");
+	let value: unknown = settings;
+	for (const k of keys) {
+		value = isRecord(value) ? value[k] : undefined;
+	}
+	return value !== undefined && value !== null ? String(value) : undefined;
 }
 
 /** Write a setting value to the given scope */
@@ -69,57 +102,60 @@ export async function writeSettingValue(
 	scope: SettingScope,
 	projectPath?: string,
 ): Promise<void> {
-	const settings =
-		scope === "user"
-			? await readGlobalSettings()
-			: await readSettings(projectPath);
+	const settings = await loadSettings(scope, projectPath);
 
 	if (setting.storage.type === "attribution") {
 		// Boolean toggle: "false" -> write { commit: "", pr: "" }, "true"/undefined -> delete key
 		if (value === "false") {
-			(settings as any).attribution = { commit: "", pr: "" };
+			settings.attribution = { commit: "", pr: "" };
 		} else {
-			delete (settings as any).attribution;
+			// biome-ignore lint/performance/noDelete: the key must be absent from the serialised settings.json; `undefined` would still be listed by Object.keys and defeat the "revert to Claude defaults" contract
+			delete settings.attribution;
 		}
 	} else if (setting.storage.type === "attribution-text") {
 		if (value && value.trim().length > 0) {
 			// Write custom text: commit gets a Co-Authored-By trailer + the text; pr gets the text
-			(settings as any).attribution = {
+			settings.attribution = {
 				commit: `Co-Authored-By: Magus <magus@madappgang.com>\n\n${value}`,
 				pr: value,
 			};
 		} else {
 			// Empty value: remove attribution key entirely (revert to Claude defaults)
-			delete (settings as any).attribution;
+			// biome-ignore lint/performance/noDelete: the key must be absent from the serialised settings.json, not present with an undefined value
+			delete settings.attribution;
 		}
 	} else if (setting.storage.type === "env") {
 		// Write to the "env" block in settings.json
-		(settings as any).env = (settings as any).env || {};
+		const env = isRecord(settings.env) ? settings.env : {};
+		settings.env = env;
 		if (value === undefined || value === "" || value === setting.defaultValue) {
-			delete (settings as any).env[setting.storage.key];
+			delete env[setting.storage.key];
 			// Clean up empty env block
-			if (Object.keys((settings as any).env).length === 0) {
-				delete (settings as any).env;
+			if (Object.keys(env).length === 0) {
+				// biome-ignore lint/performance/noDelete: an empty env block is removed from the file entirely; assigning undefined would leave the key for Object.keys and JSON readers that check `in`
+				delete settings.env;
 			}
 		} else {
-			(settings as any).env[setting.storage.key] = value;
+			env[setting.storage.key] = value;
 		}
 	} else {
 		// Direct settings key (supports dot notation)
 		const keys = setting.storage.key.split(".");
 		if (keys.length === 1) {
 			if (value === undefined || value === "") {
-				delete (settings as any)[keys[0]];
+				delete settings[keys[0]];
 			} else {
 				// Try to preserve type: boolean, number, or string
-				(settings as any)[keys[0]] = parseSettingValue(value, setting.type);
+				settings[keys[0]] = parseSettingValue(value, setting.type);
 			}
 		} else {
 			// Nested key like "permissions.defaultMode"
-			let obj: any = settings;
+			let obj: Record<string, unknown> = settings;
 			for (let i = 0; i < keys.length - 1; i++) {
-				obj[keys[i]] = obj[keys[i]] || {};
-				obj = obj[keys[i]];
+				const existing = obj[keys[i]];
+				const next = isRecord(existing) ? existing : {};
+				obj[keys[i]] = next;
+				obj = next;
 			}
 			const lastKey = keys[keys.length - 1];
 			if (value === undefined || value === "") {
@@ -137,7 +173,7 @@ export async function writeSettingValue(
 	}
 }
 
-function parseSettingValue(value: string, type: string): any {
+function parseSettingValue(value: string, type: string): string | boolean {
 	if (type === "boolean") {
 		return value === "true" || value === "1";
 	}
@@ -205,13 +241,13 @@ export async function discoverOutputStyles(
 	const enabledPlugins = new Set<string>();
 	try {
 		const userSettings = await readGlobalSettings();
-		for (const [k, v] of Object.entries((userSettings as any).enabledPlugins || {})) {
+		for (const [k, v] of Object.entries(userSettings.enabledPlugins ?? {})) {
 			if (v) enabledPlugins.add(k);
 		}
 	} catch {}
 	try {
 		const projSettings = await readSettings(projectPath);
-		for (const [k, v] of Object.entries((projSettings as any).enabledPlugins || {})) {
+		for (const [k, v] of Object.entries(projSettings.enabledPlugins ?? {})) {
 			if (v) enabledPlugins.add(k);
 		}
 	} catch {}

package/src/services/skills-manager.ts

@@ -751,10 +751,14 @@ export async function getInstalledSkillNames(
 
 // ─── Firebase Skills API ──────────────────────────────────────────────────────
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function mapApiSkillToSkillInfo(raw: any): SkillInfo {
-	const repo = (raw.repo as string) || "unknown";
-	const skillPath = (raw.skillPath as string) || (raw.name as string) || "";
+function mapApiSkillToSkillInfo(entry: unknown): SkillInfo {
+	const raw: Record<string, unknown> =
+		typeof entry === "object" && entry !== null
+			? (entry as Record<string, unknown>)
+			: {};
+	const str = (v: unknown): string => (typeof v === "string" ? v : "");
+	const repo = str(raw.repo) || "unknown";
+	const skillPath = str(raw.skillPath) || str(raw.name) || "";
 	const source: SkillSource = {
 		label: repo,
 		repo,
@@ -763,8 +767,8 @@ function mapApiSkillToSkillInfo(raw: any): SkillInfo {
 	const stars = typeof raw.stars === "number" ? raw.stars : undefined;
 	return {
 		id: `${repo}/${skillPath}`,
-		name: (raw.name as string) || skillPath,
-		description: (raw.description as string) || "",
+		name: str(raw.name) || skillPath,
+		description: str(raw.description),
 		source,
 		repoPath: skillPath ? `${skillPath}/SKILL.md` : "SKILL.md",
 		gitBlobSha: "",
@@ -943,9 +947,7 @@ export async function installSkill(
 				content = await response.text();
 				break;
 			}
-		} catch {
-			continue;
-		}
+		} catch {}
 	}
 
 	if (!content) {