crewx 0.8.7-rc.2 → 0.8.7-rc.21

package/dist-server/domain/market/market.service.js

@@ -38,6 +38,9 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 var MarketService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MarketService = void 0;
@@ -55,6 +58,7 @@ const yaml = __importStar(require("js-yaml"));
 const zod_1 = require("zod");
 const skill_1 = require("@crewx/skill");
 const workspace_context_store_js_1 = require("../../common/workspace-context.store.js");
+const analytics_client_js_1 = require("../../common/analytics.client.js");
 // --- Zod schemas ---
 const MarketPackageTypeSchema = zod_1.z.enum(['skill', 'template', 'workflow', 'plugin']);
 const TemplateEntrySchema = zod_1.z.object({
@@ -69,6 +73,24 @@ const TemplateEntrySchema = zod_1.z.object({
     features: zod_1.z.array(zod_1.z.string()).optional(),
     crewxVersion: zod_1.z.string().optional(),
 });
+const MarketplaceRegistryEntrySchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    name: zod_1.z.string().optional(),
+    url: zod_1.z.string(),
+    type: zod_1.z.string().optional(),
+    trust: zod_1.z.enum(['trusted', 'verified', 'unverified']).optional(),
+    verified: zod_1.z.boolean().optional(),
+    default: zod_1.z.boolean().optional(),
+    tokenEnv: zod_1.z.string().optional(),
+    allow: zod_1.z.array(zod_1.z.string()).optional(),
+});
+const MarketplaceConfigSchema = zod_1.z.object({
+    version: zod_1.z.string().optional(),
+    forceDisabled: zod_1.z.array(zod_1.z.string()).optional(),
+    forceEnabled: zod_1.z.array(zod_1.z.string()).optional(),
+    deny: zod_1.z.array(zod_1.z.string()).optional(),
+    registries: zod_1.z.array(MarketplaceRegistryEntrySchema),
+});
 const VALID_REGISTRY_SOURCE_TYPES = new Set(['crewx', 'codex', 'claude']);
 const TRUST_RANK = { trusted: 2, verified: 1, unverified: 0 };
 function boolToTrustLevel(isVerified, isDefault, source) {
@@ -87,12 +109,31 @@ function trustLevelToIsVerified(level) {
 // --- Constants ---
 const DEFAULT_REGISTRY_URL = 'https://github.com/sowonlabs/crewx-templates';
 const DEFAULT_REGISTRY_NAME = 'crewx-templates';
+const MARKETPLACE_REMOTE_URL = 'https://raw.githubusercontent.com/sowonlabs/crewx-templates/main/marketplace.json';
+const MARKETPLACE_CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24h
+function loadBundledMarketplace() {
+    try {
+        const bundlePath = (0, path_1.join)(__dirname, 'default-marketplace.json');
+        const raw = JSON.parse((0, fs_1.readFileSync)(bundlePath, 'utf-8'));
+        const result = MarketplaceConfigSchema.safeParse(raw);
+        return result.success ? result.data : null;
+    }
+    catch {
+        return null;
+    }
+}
 // Cache TTL: 15 minutes (§4.3 rate limit)
 const CACHE_TTL_MS = 15 * 60 * 1000;
 let MarketService = MarketService_1 = class MarketService {
     logger = new common_1.Logger(MarketService_1.name);
+    analytics;
+    constructor(analytics) {
+        this.analytics = analytics;
+    }
     // In-memory cache for templates.json fetches
     templateCache = new Map();
+    marketplaceMemoryCache = null;
+    marketplaceRefreshPending = false;
     get skillsDir() {
         return (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), 'skills');
     }
@@ -108,6 +149,9 @@ let MarketService = MarketService_1 = class MarketService {
     get marketplacePath() {
         return (0, path_1.join)((0, os_1.homedir)(), '.crewx', 'marketplace.json');
     }
+    get marketplaceCachePath() {
+        return (0, path_1.join)((0, os_1.homedir)(), '.crewx', 'marketplace.cache.json');
+    }
     get workspaceMarketplacePath() {
         return (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), '.crewx', 'marketplace.json');
     }
@@ -142,6 +186,23 @@ let MarketService = MarketService_1 = class MarketService {
         if (tokenEnv !== undefined) {
             this.validateTokenEnv(tokenEnv);
         }
+        const mpConfig = this.loadMarketplaceJson();
+        if (mpConfig?.forceDisabled?.length) {
+            const disabledSet = new Set(mpConfig.forceDisabled);
+            const parsedInput = this.parseGitHubUrl(url);
+            const blockedByPolicy = mpConfig.registries.some((r) => {
+                if (!disabledSet.has(r.id))
+                    return false;
+                const parsedBlocked = this.parseGitHubUrl(r.url);
+                if (!parsedInput || !parsedBlocked)
+                    return false;
+                return (parsedInput.owner.toLowerCase() === parsedBlocked.owner.toLowerCase() &&
+                    parsedInput.repo.toLowerCase() === parsedBlocked.repo.toLowerCase());
+            });
+            if (blockedByPolicy) {
+                throw new common_1.BadRequestException('This registry is blocked by marketplace policy (forceDisabled)');
+            }
+        }
         const entries = this.loadRegistries();
         // Check duplicate URL
         const normalized = this.normalizeUrl(url);
@@ -157,6 +218,7 @@ let MarketService = MarketService_1 = class MarketService {
             trustLevel: 'unverified',
             isDefault: false,
             addedAt: new Date().toISOString(),
+            source: 'workspace',
             ...(tokenEnv ? { tokenEnv } : {}),
         };
         entries.push(entry);
@@ -172,6 +234,9 @@ let MarketService = MarketService_1 = class MarketService {
         if (entries[idx].isDefault) {
             throw new common_1.BadRequestException('Cannot delete the default registry');
         }
+        if (entries[idx].source === 'global') {
+            throw new common_1.BadRequestException('Cannot delete official registry from marketplace policy');
+        }
         entries.splice(idx, 1);
         this.saveRegistries(entries);
         this.templateCache.delete(id);
@@ -184,7 +249,11 @@ let MarketService = MarketService_1 = class MarketService {
             throw new common_1.NotFoundException(`Registry '${registryId}' not found`);
         }
         const templates = await this.fetchTemplates(registry);
-        const installedNames = await this.getInstalledItemNames();
+        const [installedNames, installStats] = await Promise.all([
+            this.getInstalledItemNames(),
+            this.analytics.fetchInstallStats(templates.map((t) => t.name)),
+        ]);
+        const installedSlugs = new Set([...installedNames].map((n) => n.toLowerCase().replace(/[\s_]+/g, '-')));
         const items = templates.map((t) => ({
             name: t.name,
             displayName: t.displayName || t.name,
@@ -195,12 +264,48 @@ let MarketService = MarketService_1 = class MarketService {
             type: t.type || 'template',
             trustLevel: registry.trustLevel,
             isVerified: trustLevelToIsVerified(registry.trustLevel),
-            isInstalled: installedNames.has(t.name),
+            isInstalled: installedNames.has(t.name) ||
+                installedSlugs.has(t.name.toLowerCase().replace(/[\s_]+/g, '-')),
             registryId: registry.id,
             registryName: registry.name,
+            installCount: installStats[t.name]?.unique ?? 0,
         }));
         return { items };
     }
+    async listAllMarketItems() {
+        const registries = this.loadRegistries();
+        const [installedNames, ...templateResults] = await Promise.all([
+            this.getInstalledItemNames(),
+            ...registries.map((registry) => this.fetchTemplates(registry)
+                .then((templates) => ({ registry, templates }))
+                .catch(() => ({ registry, templates: [] }))),
+        ]);
+        const installedSlugs = new Set([...installedNames].map((n) => n.toLowerCase().replace(/[\s_]+/g, '-')));
+        const allNames = templateResults.flatMap(({ templates }) => templates.map((t) => t.name));
+        const installStats = await this.analytics.fetchInstallStats(allNames);
+        const items = [];
+        for (const { registry, templates } of templateResults) {
+            for (const t of templates) {
+                items.push({
+                    name: t.name,
+                    displayName: t.displayName || t.name,
+                    description: t.description || '',
+                    author: t.author || '',
+                    version: t.version || '0.0.0',
+                    tags: t.tags || [],
+                    type: t.type || 'template',
+                    trustLevel: registry.trustLevel,
+                    isVerified: trustLevelToIsVerified(registry.trustLevel),
+                    isInstalled: installedNames.has(t.name) ||
+                        installedSlugs.has(t.name.toLowerCase().replace(/[\s_]+/g, '-')),
+                    registryId: registry.id,
+                    registryName: registry.name,
+                    installCount: installStats[t.name]?.unique ?? 0,
+                });
+            }
+        }
+        return { items };
+    }
     // --- Install / Uninstall ---
     async installMarketItem(registryId, marketName) {
         this.validateItemName(marketName);
@@ -209,6 +314,14 @@ let MarketService = MarketService_1 = class MarketService {
         if (!registry) {
             throw new common_1.NotFoundException(`Registry '${registryId}' not found`);
         }
+        // Deny list: block packages listed in marketplace.json deny[]
+        const mpConfig = this.loadMarketplaceJson();
+        if (mpConfig?.deny?.length) {
+            const denySet = new Set(mpConfig.deny.map((d) => d.toLowerCase()));
+            if (denySet.has(marketName.toLowerCase())) {
+                throw new common_1.BadRequestException(`Package '${marketName}' is blocked by marketplace policy (deny list).`);
+            }
+        }
         const templates = await this.fetchTemplates(registry);
         const template = templates.find((t) => t.name === marketName);
         if (!template) {
@@ -271,7 +384,7 @@ let MarketService = MarketService_1 = class MarketService {
                 const relPath = file.path.slice(skillPrefix.length);
                 // Path traversal guard
                 const destPath = (0, path_1.resolve)((0, path_1.join)(tempDir, relPath));
-                if (!destPath.startsWith(resolvedTempDir + '/') && destPath !== resolvedTempDir) {
+                if (!destPath.startsWith(resolvedTempDir + path_1.sep) && destPath !== resolvedTempDir) {
                     throw new Error(`Path traversal detected: ${relPath}`);
                 }
                 const destFileDir = (0, path_1.dirname)(destPath);
@@ -371,6 +484,12 @@ let MarketService = MarketService_1 = class MarketService {
                 this.logger.warn(`Failed to cache GitHub metadata for '${marketName}': ${err}`);
             });
             this.logger.log(`Installed skill '${marketName}' to ${targetDir}`);
+            this.analytics.track('market.install', {
+                item_name: marketName,
+                item_type: template.type || 'template',
+                item_version: template.version || '0.0.0',
+                registry_id: registryId,
+            });
             return { installed: true, path: targetDir };
         }
         catch (err) {
@@ -450,23 +569,26 @@ let MarketService = MarketService_1 = class MarketService {
     uninstallMarketItem(name) {
         this.validateItemName(name);
         const targetDir = (0, path_1.join)(this.skillsDir, name);
-        if (!(0, fs_1.existsSync)(targetDir)) {
-            throw new common_1.NotFoundException(`Installed skill '${name}' not found`);
+        if ((0, fs_1.existsSync)(targetDir)) {
+            (0, fs_1.rmSync)(targetDir, { recursive: true, force: true });
         }
-        (0, fs_1.rmSync)(targetDir, { recursive: true, force: true });
         const lock = this.loadLockFile();
         delete lock.skills[name];
         this.saveLockFile(lock);
         this.logger.log(`Uninstalled skill '${name}'`);
+        this.analytics.track('market.uninstall', {
+            item_name: name,
+            item_type: 'skill',
+        });
     }
     // --- Installed items ---
     resolveItemSource(dir, projectRoot) {
-        const nmDir = (0, path_1.join)(projectRoot, 'node_modules') + '/';
+        const nmDir = (0, path_1.join)(projectRoot, 'node_modules') + path_1.sep;
         if (!dir.startsWith(nmDir) && dir !== (0, path_1.join)(projectRoot, 'node_modules')) {
             return 'local';
         }
         const relFromNm = dir.slice(nmDir.length);
-        return relFromNm.startsWith('@crewx/') ? 'builtin' : 'node_modules';
+        return relFromNm.startsWith(`@crewx${path_1.sep}`) ? 'builtin' : 'node_modules';
     }
     async listInstalledMarkets() {
         const projectRoot = (0, path_1.dirname)(this.skillsDir);
@@ -658,6 +780,37 @@ let MarketService = MarketService_1 = class MarketService {
         }
         return { frontmatter: result, body: match[2] || '' };
     }
+    async getRemoteSkillDetail(registryId, skillName) {
+        this.validateItemName(skillName);
+        const entries = this.loadRegistries();
+        const registry = entries.find((r) => r.id === registryId);
+        if (!registry) {
+            throw new common_1.NotFoundException(`Registry '${registryId}' not found`);
+        }
+        const parsed = this.parseGitHubUrl(registry.url);
+        if (!parsed) {
+            return { body: '' };
+        }
+        const templates = await this.fetchTemplates(registry);
+        const template = templates.find((t) => t.name === skillName);
+        const skillPath = template?.path || skillName;
+        const candidates = registry.type === 'claude'
+            ? [`${skillPath}/SKILL.md`, `${skillPath}/README.md`]
+            : [`skills/${skillPath}/SKILL.md`, `${skillPath}/SKILL.md`, `skills/${skillPath}/README.md`, `${skillPath}/README.md`];
+        const headers = this.getGitHubHeaders(registry);
+        for (const candidate of candidates) {
+            const url = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/main/${candidate}`;
+            try {
+                const content = await this.fetchUrl(url, headers);
+                const { body } = this.parseFrontmatter(content);
+                return { body: body.trim() ? body : content };
+            }
+            catch {
+                continue;
+            }
+        }
+        return { body: '' };
+    }
     detectInstallSource(itemName) {
         const builtinDir = (0, path_1.join)(process.cwd(), 'packages', 'built-in', 'skill', 'skills', itemName);
         if ((0, fs_1.existsSync)(builtinDir)) {
@@ -835,21 +988,133 @@ let MarketService = MarketService_1 = class MarketService {
         };
     }
     loadMarketplaceJson() {
-        if (!(0, fs_1.existsSync)(this.marketplacePath))
+        // 1. Memory cache (process lifetime)
+        if (this.marketplaceMemoryCache) {
+            const age = Date.now() - this.marketplaceMemoryCache.fetchedAt;
+            if (age >= MARKETPLACE_CACHE_TTL_MS && !this.marketplaceRefreshPending) {
+                this.marketplaceRefreshPending = true;
+                this.refreshMarketplaceRemote();
+            }
+            return this.marketplaceMemoryCache.config;
+        }
+        // 2. User-managed override (~/.crewx/marketplace.json)
+        if ((0, fs_1.existsSync)(this.marketplacePath)) {
+            try {
+                const raw = JSON.parse((0, fs_1.readFileSync)(this.marketplacePath, 'utf-8'));
+                const result = MarketplaceConfigSchema.safeParse(raw);
+                if (result.success) {
+                    const config = result.data;
+                    this.marketplaceMemoryCache = { config, fetchedAt: Date.now() };
+                    return config;
+                }
+                this.logger.warn(`Invalid marketplace.json schema: ${result.error.message}`);
+            }
+            catch {
+                this.logger.warn('Failed to parse marketplace.json');
+            }
+        }
+        // 3. Disk cache (~/.crewx/marketplace.cache.json)
+        const diskCache = this.loadMarketplaceDiskCache();
+        if (diskCache) {
+            this.marketplaceMemoryCache = diskCache;
+            if (Date.now() - diskCache.fetchedAt >= MARKETPLACE_CACHE_TTL_MS && !this.marketplaceRefreshPending) {
+                this.marketplaceRefreshPending = true;
+                this.refreshMarketplaceRemote();
+            }
+            return diskCache.config;
+        }
+        // 4. No local data — return null, let loadRegistries() handle fallback.
+        return null;
+    }
+    loadMarketplaceDiskCache() {
+        if (!(0, fs_1.existsSync)(this.marketplaceCachePath))
             return null;
         try {
-            return JSON.parse((0, fs_1.readFileSync)(this.marketplacePath, 'utf-8'));
+            const raw = JSON.parse((0, fs_1.readFileSync)(this.marketplaceCachePath, 'utf-8'));
+            if (!raw || typeof raw.fetchedAt !== 'number' || !raw.config)
+                return null;
+            const result = MarketplaceConfigSchema.safeParse(raw.config);
+            if (!result.success)
+                return null;
+            return {
+                config: result.data,
+                etag: raw.etag,
+                lastModified: raw.lastModified,
+                fetchedAt: raw.fetchedAt,
+            };
         }
         catch {
-            this.logger.warn('Failed to parse marketplace.json');
             return null;
         }
     }
+    saveMarketplaceDiskCache(cache) {
+        try {
+            const dir = (0, path_1.dirname)(this.marketplaceCachePath);
+            if (!(0, fs_1.existsSync)(dir))
+                (0, fs_1.mkdirSync)(dir, { recursive: true });
+            (0, fs_1.writeFileSync)(this.marketplaceCachePath, JSON.stringify(cache, null, 2), 'utf-8');
+        }
+        catch {
+            this.logger.warn('Failed to save marketplace disk cache');
+        }
+    }
+    refreshMarketplaceRemote() {
+        const existing = this.marketplaceMemoryCache;
+        const headers = {};
+        if (existing?.etag)
+            headers['If-None-Match'] = existing.etag;
+        if (existing?.lastModified)
+            headers['If-Modified-Since'] = existing.lastModified;
+        fetch(MARKETPLACE_REMOTE_URL, { headers, signal: AbortSignal.timeout(10_000) })
+            .then(async (res) => {
+            if (res.status === 304) {
+                if (existing) {
+                    existing.fetchedAt = Date.now();
+                    this.saveMarketplaceDiskCache(existing);
+                }
+                return;
+            }
+            if (!res.ok)
+                return;
+            const text = await res.text();
+            const parsed = MarketplaceConfigSchema.safeParse(JSON.parse(text));
+            if (!parsed.success)
+                return;
+            const cache = {
+                config: parsed.data,
+                etag: res.headers.get('etag') ?? undefined,
+                lastModified: res.headers.get('last-modified') ?? undefined,
+                fetchedAt: Date.now(),
+            };
+            this.marketplaceMemoryCache = cache;
+            this.saveMarketplaceDiskCache(cache);
+        })
+            .catch(() => {
+            // Network failure — seed disk cache from bundled default if nothing cached yet
+            if (!this.marketplaceMemoryCache && !(0, fs_1.existsSync)(this.marketplaceCachePath)) {
+                const bundled = loadBundledMarketplace();
+                if (bundled) {
+                    const cache = { config: bundled, fetchedAt: Date.now() };
+                    this.marketplaceMemoryCache = cache;
+                    this.saveMarketplaceDiskCache(cache);
+                }
+            }
+        })
+            .finally(() => {
+            this.marketplaceRefreshPending = false;
+        });
+    }
     loadWorkspaceMarketplaceJson() {
         if (!(0, fs_1.existsSync)(this.workspaceMarketplacePath))
             return null;
         try {
-            return JSON.parse((0, fs_1.readFileSync)(this.workspaceMarketplacePath, 'utf-8'));
+            const raw = JSON.parse((0, fs_1.readFileSync)(this.workspaceMarketplacePath, 'utf-8'));
+            const result = MarketplaceConfigSchema.safeParse(raw);
+            if (!result.success) {
+                this.logger.warn(`Invalid workspace marketplace.json schema: ${result.error.message}`);
+                return null;
+            }
+            return result.data;
         }
         catch {
             this.logger.warn('Failed to parse workspace marketplace.json');
@@ -869,18 +1134,25 @@ let MarketService = MarketService_1 = class MarketService {
             ...(item.tokenEnv ? { tokenEnv: item.tokenEnv } : {}),
         };
     }
+    isBuiltinExempt(reg) {
+        return (reg.name.startsWith('@crewx/') ||
+            this.normalizeUrl(reg.url) === this.normalizeUrl(DEFAULT_REGISTRY_URL));
+    }
     mergeRegistries(global, workspace, forceDisabled) {
         const disabledSet = new Set(forceDisabled);
         const merged = new Map();
         for (const reg of global) {
-            if (!disabledSet.has(reg.id)) {
-                merged.set(reg.name, { ...reg, source: 'global' });
+            if (!disabledSet.has(reg.id) || this.isBuiltinExempt(reg)) {
+                merged.set(this.normalizeUrl(reg.url), { ...reg, source: 'global' });
             }
         }
         for (const reg of workspace) {
-            if (disabledSet.has(reg.id))
+            if (disabledSet.has(reg.id) && !this.isBuiltinExempt(reg))
+                continue;
+            const key = this.normalizeUrl(reg.url);
+            if (merged.has(key))
                 continue;
-            merged.set(reg.name, { ...reg, source: 'workspace', trustLevel: 'unverified' });
+            merged.set(key, { ...reg, source: 'workspace', trustLevel: 'unverified' });
         }
         return Array.from(merged.values());
     }
@@ -890,6 +1162,11 @@ let MarketService = MarketService_1 = class MarketService {
         const config = this.loadConfig();
         const registriesYaml = config?.skills?.registries;
         if (!mpConfig && !wsMpConfig) {
+            // No marketplace.json anywhere — seed disk cache from remote for next restart
+            if (!this.marketplaceRefreshPending) {
+                this.marketplaceRefreshPending = true;
+                this.refreshMarketplaceRemote();
+            }
             if (!registriesYaml || registriesYaml.length === 0) {
                 const defaults = this.getDefaultRegistries();
                 this.saveRegistries(defaults);
@@ -930,7 +1207,8 @@ let MarketService = MarketService_1 = class MarketService {
         if (!this.isPlainObject(config.skills)) {
             config.skills = {};
         }
-        config.skills.registries = entries.map((e) => this.registryEntryToYaml(e));
+        const persistable = entries.filter((e) => e.source !== 'global');
+        config.skills.registries = persistable.map((e) => this.registryEntryToYaml(e));
         this.saveConfig(config);
     }
     getDefaultRegistries() {
@@ -965,6 +1243,9 @@ let MarketService = MarketService_1 = class MarketService {
         if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
             return cached.data;
         }
+        if (registry.type === 'claude') {
+            return this.fetchClaudeTemplates(registry);
+        }
         const parsed = this.parseGitHubUrl(registry.url);
         if (!parsed) {
             this.logger.warn(`Invalid registry URL: ${registry.url}`);
@@ -996,6 +1277,120 @@ let MarketService = MarketService_1 = class MarketService {
             return [];
         }
     }
+    async fetchClaudeTemplates(registry) {
+        const parsed = this.parseGitHubUrl(registry.url);
+        if (!parsed) {
+            this.logger.warn(`Invalid registry URL: ${registry.url}`);
+            return [];
+        }
+        const url = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/main/.claude-plugin/marketplace.json`;
+        try {
+            const content = await this.fetchUrl(url, this.getGitHubHeaders(registry));
+            const json = JSON.parse(content);
+            const author = json.owner?.name ?? parsed.owner;
+            const version = json.metadata?.version ?? '1.0.0';
+            const templates = [];
+            for (const plugin of json.plugins ?? []) {
+                if (plugin.skills && plugin.skills.length > 0) {
+                    for (const skillRef of plugin.skills) {
+                        const skillPath = skillRef.replace(/^\.\//, '');
+                        const skillName = skillPath.split('/').pop() ?? skillPath;
+                        const displayName = skillName
+                            .split('-')
+                            .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+                            .join(' ');
+                        templates.push({
+                            name: skillName,
+                            displayName,
+                            description: plugin.description,
+                            path: skillPath,
+                            type: 'skill',
+                            author,
+                            version,
+                        });
+                    }
+                }
+                else if (plugin.source != null) {
+                    const discovered = await this.discoverSkillsViaSource(plugin.source, parsed, registry);
+                    for (const skillName of discovered) {
+                        const displayName = skillName
+                            .split('-')
+                            .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+                            .join(' ');
+                        templates.push({
+                            name: skillName,
+                            displayName,
+                            description: plugin.description,
+                            path: `skills/${skillName}`,
+                            type: 'skill',
+                            author,
+                            version,
+                        });
+                    }
+                }
+            }
+            this.templateCache.set(registry.id, {
+                data: templates,
+                fetchedAt: Date.now(),
+            });
+            return templates;
+        }
+        catch (err) {
+            this.logger.warn(`Failed to fetch .claude-plugin/marketplace.json from ${registry.url}: ${err}`);
+            return [];
+        }
+    }
+    async discoverSkillsViaSource(source, registryParsed, registry) {
+        let owner;
+        let repo;
+        let ref = 'main';
+        let basePath = '';
+        if (typeof source === 'string') {
+            owner = registryParsed.owner;
+            repo = registryParsed.repo;
+            basePath = source.replace(/^\.\//, '').replace(/\/+$/, '');
+        }
+        else {
+            if (source.url) {
+                const srcParsed = this.parseGitHubUrl(source.url);
+                if (!srcParsed)
+                    return [];
+                owner = srcParsed.owner;
+                repo = srcParsed.repo;
+            }
+            else {
+                owner = registryParsed.owner;
+                repo = registryParsed.repo;
+            }
+            if (source.ref)
+                ref = source.ref;
+            basePath = (source.path ?? '').replace(/^\.\//, '').replace(/\/+$/, '');
+        }
+        try {
+            const treesUrl = `https://api.github.com/repos/${owner}/${repo}/git/trees/${ref}?recursive=1`;
+            const treesRes = await fetch(treesUrl, { headers: this.getGitHubHeaders(registry) });
+            if (!treesRes.ok)
+                return [];
+            const treesData = await treesRes.json();
+            const skillsPrefix = basePath ? `${basePath}/skills/` : 'skills/';
+            const skillNames = new Set();
+            for (const item of treesData.tree) {
+                if (item.type !== 'blob')
+                    continue;
+                if (!item.path.startsWith(skillsPrefix))
+                    continue;
+                const rel = item.path.slice(skillsPrefix.length);
+                const parts = rel.split('/');
+                if (parts.length === 2 && parts[1] === 'SKILL.md') {
+                    skillNames.add(parts[0]);
+                }
+            }
+            return [...skillNames];
+        }
+        catch {
+            return [];
+        }
+    }
     async fetchUrl(url, headers) {
         const response = await fetch(url, headers ? { headers } : undefined);
         if (!response.ok) {
@@ -1047,5 +1442,6 @@ let MarketService = MarketService_1 = class MarketService {
 };
 exports.MarketService = MarketService;
 exports.MarketService = MarketService = MarketService_1 = __decorate([
-    (0, common_1.Injectable)()
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [analytics_client_js_1.AnalyticsService])
 ], MarketService);