one-code-extension 0.1.4 → 0.3.0

package/extensions/plugins/install/install.ts

@@ -0,0 +1,167 @@
+/**
+ * Plugin install/uninstall against the One Code plugin root.
+ *
+ * Install materializes the plugin's files into the versioned cache
+ * (`./relative` sources are copied out of the marketplace clone after a
+ * containment check — manifests are third-party content; git sources are
+ * shallow-cloned), then records the `{scope: "user", installPath, version,
+ * enabled: true}` entry in our installed_plugins.json. Never touches ~/.claude.
+ *
+ * Unsupported source kinds and features (npm/pip, commit-sha pinning,
+ * dependencies) fail loudly with the reason named.
+ */
+
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, readdirSync, realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve, relative, sep } from "node:path";
+import { gitClone, gitHeadSha } from "../marketplace/git.ts";
+import type { MarketplaceEntry } from "../marketplace/types.ts";
+import { addInstalledPlugin, installedEntry, removeInstalledPlugin } from "./registry.ts";
+import { pluginCacheDir, versionedCachePath, withinBase } from "./paths.ts";
+
+export interface InstallResult {
+	id: string;
+	installPath: string;
+	version: string;
+	gitCommitSha?: string;
+}
+
+function manifestVersion(pluginDir: string): string | undefined {
+	try {
+		const manifest = JSON.parse(readFileSync(join(pluginDir, ".claude-plugin", "plugin.json"), "utf-8")) as {
+			version?: unknown;
+		};
+		return typeof manifest.version === "string" ? manifest.version : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * A marketplace plugin may not smuggle files in via symlinks: `SKILL.md →
+ * ~/.ssh/id_rsa` would pass the containment check as a link and be copied
+ * (or, dereferenced, would copy the key into the plugin cache). Every symlink
+ * under `src` must resolve inside `src`; then the copy dereferences so the
+ * cache holds plain files (review M13).
+ */
+function assertSymlinksContained(src: string): void {
+	const root = realpathSync(src);
+	const stack = [src];
+	while (stack.length > 0) {
+		const dir = stack.pop() as string;
+		for (const entry of readdirSync(dir, { withFileTypes: true })) {
+			const path = join(dir, entry.name);
+			if (entry.isSymbolicLink()) {
+				let target: string;
+				try {
+					target = realpathSync(path);
+				} catch {
+					throw new Error(`plugin contains a broken symlink: ${relative(src, path)}`);
+				}
+				if (target !== root && !target.startsWith(root + sep)) {
+					throw new Error(`plugin contains a symlink that points outside the plugin: ${relative(src, path)} → ${target}`);
+				}
+			} else if (entry.isDirectory()) {
+				stack.push(path);
+			}
+		}
+	}
+}
+
+function copyIntoCache(src: string, dest: string): void {
+	assertSymlinksContained(src);
+	rmSync(dest, { recursive: true, force: true });
+	mkdirSync(join(dest, ".."), { recursive: true });
+	cpSync(src, dest, { recursive: true, dereference: true });
+}
+
+export async function installPlugin(
+	root: string,
+	marketplaceName: string,
+	entry: MarketplaceEntry,
+	contentRoot: string | undefined,
+): Promise<InstallResult> {
+	const id = `${entry.name}@${marketplaceName}`;
+	const raw = entry.raw;
+	if (raw.dependencies !== undefined) {
+		throw new Error(`${id}: plugin dependencies are not supported yet — install the dependencies manually first`);
+	}
+
+	let sourceDir: string;
+	let cleanup: string | undefined;
+	let gitCommitSha: string | undefined;
+
+	const source = entry.source;
+	if (typeof source === "string") {
+		if (!contentRoot) throw new Error(`${id}: the marketplace's content is not available locally (refresh it first)`);
+		if (!withinBase(contentRoot, source)) {
+			throw new Error(`${id}: source path "${source}" escapes the marketplace directory — refusing to install`);
+		}
+		sourceDir = resolve(contentRoot, source);
+		if (!existsSync(sourceDir)) throw new Error(`${id}: source path "${source}" does not exist in the marketplace`);
+	} else if (source.source === "github" || source.source === "url" || source.source === "git-subdir") {
+		if (source.sha) {
+			throw new Error(`${id}: commit-sha pinning is not supported yet — use a ref (branch/tag) instead`);
+		}
+		const url = source.source === "github" ? `https://github.com/${source.repo}.git` : source.url;
+		const temp = mkdtempSync(join(tmpdir(), "one-code-plugin-"));
+		cleanup = temp;
+		const cloneDir = join(temp, "clone");
+		await gitClone(url, cloneDir, {
+			ref: source.ref,
+			subdir: source.source === "git-subdir" ? source.path : undefined,
+		});
+		gitCommitSha = await gitHeadSha(cloneDir);
+		sourceDir = source.source === "git-subdir" ? join(cloneDir, source.path) : cloneDir;
+		if (source.source === "git-subdir" && !withinBase(cloneDir, source.path)) {
+			rmSync(temp, { recursive: true, force: true });
+			throw new Error(`${id}: git-subdir path "${source.path}" escapes the repository — refusing to install`);
+		}
+		if (!existsSync(sourceDir)) {
+			rmSync(temp, { recursive: true, force: true });
+			throw new Error(`${id}: "${source.source === "git-subdir" ? source.path : url}" has no content at the expected path`);
+		}
+	} else {
+		throw new Error(`${id}: source kind "${(source as { source: string }).source}" is not supported`);
+	}
+
+	try {
+		const version = entry.version ?? manifestVersion(sourceDir) ?? (gitCommitSha ? gitCommitSha.slice(0, 12) : "0.0.0");
+		const installPath = versionedCachePath(root, marketplaceName, entry.name, version);
+		// Defence in depth against a crafted version/name that escapes its own
+		// cache subdirectory (review M4): copyIntoCache would rmSync the resolved
+		// dest, so a path landing on the plugin or marketplace directory would
+		// delete siblings. sanitizePathSegment already neutralises dots-only
+		// segments; assert containment before the destructive copy regardless.
+		const pluginCacheBase = pluginCacheDir(root, marketplaceName, entry.name);
+		if (!withinBase(pluginCacheBase, installPath)) {
+			throw new Error(`${id}: computed install path "${installPath}" escapes the plugin cache directory — refusing to install`);
+		}
+		copyIntoCache(sourceDir, installPath);
+		const now = new Date().toISOString();
+		addInstalledPlugin(root, id, {
+			scope: "user",
+			installPath,
+			version,
+			installedAt: now,
+			lastUpdated: now,
+			gitCommitSha,
+			enabled: true,
+		});
+		return { id, installPath, version, gitCommitSha };
+	} finally {
+		if (cleanup) rmSync(cleanup, { recursive: true, force: true });
+	}
+}
+
+/** Remove the registry entry and the cached files. Keeps `data/` (plugin-owned state). */
+export function uninstallPlugin(root: string, id: string): void {
+	const entry = installedEntry(root, id);
+	removeInstalledPlugin(root, id);
+	// Only delete what lives inside OUR cache — never an install path that
+	// points elsewhere (hand-edited registries, claude-origin paths).
+	const cacheDir = `${resolve(join(root, "cache"))}/`;
+	if (entry?.installPath && resolve(entry.installPath).startsWith(cacheDir)) {
+		rmSync(entry.installPath, { recursive: true, force: true });
+	}
+}

package/extensions/plugins/install/paths.ts

@@ -0,0 +1,23 @@
+/**
+ * Plugin cache path construction + containment checks (pure).
+ *
+ * Installed plugin files live in `<root>/cache/<marketplace>/<plugin>/<version>/`
+ * with every segment sanitized — marketplace manifests are third-party content,
+ * so entry names must never be able to place files outside the cache, and
+ * `./relative` plugin sources must never read outside their marketplace clone.
+ */
+
+import { join } from "node:path";
+import { pathWithinBase, sanitizePathSegment } from "../../lib/plugin-root.ts";
+
+/** The directory holding every version of one plugin: `<root>/cache/<marketplace>/<plugin>`. */
+export function pluginCacheDir(root: string, marketplace: string, plugin: string): string {
+	return join(root, "cache", sanitizePathSegment(marketplace), sanitizePathSegment(plugin));
+}
+
+export function versionedCachePath(root: string, marketplace: string, plugin: string, version: string): string {
+	return join(pluginCacheDir(root, marketplace, plugin), sanitizePathSegment(version, true));
+}
+
+/** True when `target` resolves inside `base` (rejects .. escapes and absolute overrides). */
+export const withinBase = pathWithinBase;

package/extensions/plugins/install/registry.ts

@@ -0,0 +1,72 @@
+/**
+ * installed_plugins.json under the One Code plugin root (pure fs).
+ *
+ * Claude Code's v2 format, plus an `enabled` field on our entries (Claude Code
+ * keeps enabled state in settings.json; in our own root the entry is the
+ * natural home). Unknown keys round-trip untouched.
+ */
+
+import { join } from "node:path";
+import { readJsonFile, writeJsonAtomic } from "../../lib/atomic-write.ts";
+
+export interface InstalledEntry {
+	scope: "user";
+	installPath: string;
+	version?: string;
+	installedAt?: string;
+	lastUpdated?: string;
+	gitCommitSha?: string;
+	enabled?: boolean;
+	[key: string]: unknown;
+}
+
+interface RegistryFile {
+	version?: unknown;
+	plugins?: Record<string, unknown>;
+	[key: string]: unknown;
+}
+
+function registryPath(root: string): string {
+	return join(root, "installed_plugins.json");
+}
+
+function readRegistry(root: string): RegistryFile {
+	return readJsonFile<RegistryFile>(registryPath(root)) ?? {};
+}
+
+export function installedEntry(root: string, id: string): InstalledEntry | undefined {
+	const entries = readRegistry(root).plugins?.[id];
+	if (!Array.isArray(entries)) return undefined;
+	return entries.find((e) => e && typeof e === "object") as InstalledEntry | undefined;
+}
+
+/** Add or replace the plugin's entry (one user-scope entry per id in our root). */
+export function addInstalledPlugin(root: string, id: string, entry: InstalledEntry): void {
+	const registry = readRegistry(root);
+	writeJsonAtomic(registryPath(root), {
+		...registry,
+		version: 2,
+		plugins: { ...(registry.plugins ?? {}), [id]: [entry] },
+	});
+}
+
+export function removeInstalledPlugin(root: string, id: string): void {
+	const registry = readRegistry(root);
+	if (!registry.plugins || !(id in registry.plugins)) return;
+	const { [id]: _removed, ...rest } = registry.plugins;
+	writeJsonAtomic(registryPath(root), { ...registry, version: 2, plugins: rest });
+}
+
+/** Flip `enabled` on the plugin's entries, preserving everything else. */
+export function setInstalledEnabled(root: string, id: string, enabled: boolean): boolean {
+	const registry = readRegistry(root);
+	const entries = registry.plugins?.[id];
+	if (!Array.isArray(entries) || entries.length === 0) return false;
+	const updated = entries.map((e) => (e && typeof e === "object" ? { ...(e as InstalledEntry), enabled } : e));
+	writeJsonAtomic(registryPath(root), {
+		...registry,
+		version: 2,
+		plugins: { ...(registry.plugins ?? {}), [id]: updated },
+	});
+	return true;
+}

package/extensions/plugins/marketplace/git.ts

@@ -0,0 +1,103 @@
+/**
+ * Non-interactive git operations for marketplace/plugin fetching.
+ *
+ * Every call is prompt-proof (GIT_TERMINAL_PROMPT=0, empty GIT_ASKPASS,
+ * BatchMode SSH with strict host checking) and time-bounded. Clones land in a
+ * temp sibling and are renamed into place on success, so a failed or timed-out
+ * clone never leaves a partial directory behind.
+ */
+
+import { execFile } from "node:child_process";
+import { mkdirSync, renameSync, rmSync } from "node:fs";
+import { dirname } from "node:path";
+import { promisify } from "node:util";
+
+const run = promisify(execFile);
+
+export const GIT_TIMEOUT_MS = 120_000;
+
+const GIT_BASE_ARGS = ["-c", 'core.sshCommand=ssh -o BatchMode=yes -o StrictHostKeyChecking=yes'];
+
+function gitEnv(): NodeJS.ProcessEnv {
+	return { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "" };
+}
+
+async function git(args: string[], cwd: string | undefined, timeoutMs: number): Promise<string> {
+	try {
+		const { stdout } = await run("git", [...GIT_BASE_ARGS, ...args], {
+			cwd,
+			env: gitEnv(),
+			timeout: timeoutMs,
+			maxBuffer: 10 * 1024 * 1024,
+		});
+		return stdout.trim();
+	} catch (error) {
+		const detail = error as { stderr?: string; message?: string; code?: string };
+		if (detail.code === "ENOENT") throw new Error("git is not installed (or not on PATH)");
+		const stderr = (detail.stderr ?? "").trim().split("\n").slice(-3).join(" ");
+		throw new Error(stderr || detail.message || "git failed");
+	}
+}
+
+export interface GitCloneOptions {
+	ref?: string;
+	/** Sparse checkout of just this subdirectory (partial clone). */
+	subdir?: string;
+	timeoutMs?: number;
+}
+
+/**
+ * URLs and refs come from third-party marketplace manifests; one starting
+ * with "-" would be parsed by git as an option (e.g. --upload-pack=…), not a
+ * repository — classic argument injection even though execFile is shell-safe.
+ */
+function assertSafeGitValue(value: string, what: string): void {
+	if (value.startsWith("-")) throw new Error(`refusing ${what} starting with "-": ${value}`);
+}
+
+export async function gitClone(url: string, dest: string, options: GitCloneOptions = {}): Promise<void> {
+	assertSafeGitValue(url, "a git URL");
+	if (options.ref) assertSafeGitValue(options.ref, "a git ref");
+	const timeoutMs = options.timeoutMs ?? GIT_TIMEOUT_MS;
+	const tmp = `${dest}.tmp-${process.pid}-${Date.now()}`;
+	mkdirSync(dirname(dest), { recursive: true });
+	try {
+		const args = ["clone", "--depth", "1"];
+		if (options.subdir) args.push("--filter=tree:0", "--no-checkout");
+		else args.push("--recurse-submodules", "--shallow-submodules");
+		if (options.ref) args.push("--branch", options.ref);
+		args.push("--", url, tmp);
+		await git(args, undefined, timeoutMs);
+		if (options.subdir) {
+			await git(["sparse-checkout", "set", "--cone", "--", options.subdir], tmp, timeoutMs);
+			await git(["checkout", "HEAD"], tmp, timeoutMs);
+		}
+		rmSync(dest, { recursive: true, force: true });
+		renameSync(tmp, dest);
+	} catch (error) {
+		rmSync(tmp, { recursive: true, force: true });
+		throw error;
+	}
+}
+
+/** In-place update; the caller falls back to a fresh gitClone when this throws. */
+export async function gitUpdate(dest: string, options: { ref?: string; timeoutMs?: number } = {}): Promise<void> {
+	if (options.ref) assertSafeGitValue(options.ref, "a git ref");
+	const timeoutMs = options.timeoutMs ?? GIT_TIMEOUT_MS;
+	if (options.ref) {
+		await git(["fetch", "--depth", "1", "origin", options.ref], dest, timeoutMs);
+		await git(["checkout", options.ref], dest, timeoutMs);
+		await git(["reset", "--hard", "FETCH_HEAD"], dest, timeoutMs);
+	} else {
+		await git(["fetch", "--depth", "1", "origin", "HEAD"], dest, timeoutMs);
+		await git(["reset", "--hard", "FETCH_HEAD"], dest, timeoutMs);
+	}
+}
+
+export async function gitHeadSha(dest: string): Promise<string | undefined> {
+	try {
+		return await git(["rev-parse", "HEAD"], dest, 10_000);
+	} catch {
+		return undefined;
+	}
+}

package/extensions/plugins/marketplace/official.ts

@@ -0,0 +1,36 @@
+/**
+ * The official Claude Code plugin marketplace (Apache-2.0 GitHub repository).
+ *
+ * Registered lazily on the first /plugins open — never at session start — and
+ * refreshed when its clone is older than a day. Content comes from GitHub
+ * only; no other endpoints are used.
+ */
+
+import { readKnownMarketplaces, writeKnownMarketplace } from "./registry.ts";
+import type { KnownMarketplace } from "./types.ts";
+
+export const OFFICIAL_MARKETPLACE_NAME = "claude-plugins-official";
+
+export const OFFICIAL_MARKETPLACE_SOURCE = { source: "github", repo: "anthropics/claude-plugins-official" } as const;
+
+const STALE_AFTER_MS = 24 * 60 * 60 * 1000;
+
+/** Register the official marketplace in our root when absent; returns its entry. */
+export function ensureOfficialRegistered(root: string, installLocation: string): KnownMarketplace {
+	const existing = readKnownMarketplaces(root)[OFFICIAL_MARKETPLACE_NAME];
+	if (existing) return existing;
+	const entry: KnownMarketplace = {
+		source: OFFICIAL_MARKETPLACE_SOURCE,
+		installLocation,
+		lastUpdated: new Date(0).toISOString(),
+		autoUpdate: true,
+	};
+	writeKnownMarketplace(root, OFFICIAL_MARKETPLACE_NAME, entry);
+	return entry;
+}
+
+export function isStale(known: KnownMarketplace, now: Date = new Date()): boolean {
+	const last = Date.parse(known.lastUpdated);
+	if (Number.isNaN(last)) return true;
+	return now.getTime() - last > STALE_AFTER_MS;
+}

package/extensions/plugins/marketplace/parse.ts

@@ -0,0 +1,94 @@
+/**
+ * "Add Marketplace" input parsing (pure) — the same shorthand grammar Claude
+ * Code accepts:
+ *
+ *   owner/repo[#ref]                      github
+ *   git@host:path[.git][#ref]             git (SSH)
+ *   https://…/repo.git / …/_git/…         git (explicit clone URL)
+ *   https://github.com/owner/repo         git (forced .git)
+ *   https://…/marketplace.json (other)    url (fetched manifest)
+ *   ./path | /path | ~/path               file (.json) or directory
+ */
+
+import { existsSync, statSync } from "node:fs";
+import os from "node:os";
+import { basename, isAbsolute, resolve } from "node:path";
+import type { MarketplaceSource } from "./types.ts";
+import { expandTilde } from "../../lib/paths.ts";
+
+export interface ParsedMarketplaceInput {
+	source: MarketplaceSource;
+	suggestedName: string;
+}
+
+const SSH_RE = /^([a-zA-Z0-9._-]+@[^:]+:.+?)(?:#(.+))?$/;
+const GITHUB_SHORTHAND_RE = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:#(.+))?$/;
+
+function repoBasename(path: string): string {
+	return basename(path).replace(/\.git$/, "");
+}
+
+export function parseMarketplaceInput(input: string, cwd: string): ParsedMarketplaceInput | { error: string } {
+	const trimmed = input.trim();
+	if (!trimmed) return { error: "Enter a marketplace source." };
+
+	const ssh = trimmed.match(SSH_RE);
+	if (ssh && !trimmed.startsWith("http")) {
+		return {
+			source: { source: "git", url: ssh[1], ref: ssh[2] },
+			suggestedName: repoBasename(ssh[1].split(":").pop() ?? ssh[1]),
+		};
+	}
+
+	if (/^https?:\/\//.test(trimmed)) {
+		let url: URL;
+		try {
+			url = new URL(trimmed);
+		} catch {
+			return { error: `Not a valid URL: ${trimmed}` };
+		}
+		const ref = url.hash ? url.hash.slice(1) : undefined;
+		url.hash = "";
+		const bare = url.toString();
+		if (url.pathname.endsWith(".git") || url.pathname.includes("/_git/")) {
+			return { source: { source: "git", url: bare, ref }, suggestedName: repoBasename(url.pathname) };
+		}
+		if (url.hostname === "github.com" || url.hostname === "www.github.com") {
+			const parts = url.pathname.split("/").filter(Boolean);
+			if (parts.length === 2) {
+				return {
+					source: { source: "git", url: `https://github.com/${parts[0]}/${parts[1]}.git`, ref },
+					suggestedName: parts[1],
+				};
+			}
+		}
+		const jsonName = basename(url.pathname).replace(/\.json$/, "").replace(/\.git$/, "");
+		return { source: { source: "url", url: bare }, suggestedName: jsonName || url.hostname };
+	}
+
+	const looksLikePath =
+		trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed === "~" || trimmed.startsWith("~/") || isAbsolute(trimmed);
+	if (looksLikePath) {
+		// `~user` is deliberately not a path here: never guess another user's home.
+		const expanded = expandTilde(trimmed, os.homedir());
+		const path = resolve(cwd, expanded);
+		if (!existsSync(path)) return { error: `Path does not exist: ${path}` };
+		if (statSync(path).isDirectory()) {
+			return { source: { source: "directory", path }, suggestedName: basename(path) };
+		}
+		if (path.endsWith(".json")) {
+			return { source: { source: "file", path }, suggestedName: basename(path, ".json") };
+		}
+		return { error: `Not a marketplace: ${path} (expected a directory or a marketplace.json file)` };
+	}
+
+	const shorthand = trimmed.match(GITHUB_SHORTHAND_RE);
+	if (shorthand && !trimmed.startsWith("@") && !trimmed.includes(":")) {
+		return {
+			source: { source: "github", repo: `${shorthand[1]}/${shorthand[2]}`, ref: shorthand[3] },
+			suggestedName: shorthand[2],
+		};
+	}
+
+	return { error: `Could not understand "${trimmed}" — try owner/repo, a git URL, an https marketplace.json URL, or a local path.` };
+}

package/extensions/plugins/marketplace/registry.ts

@@ -0,0 +1,60 @@
+/**
+ * known_marketplaces.json under the One Code plugin root (pure fs).
+ *
+ * `{"<name>": {source, installLocation, lastUpdated, autoUpdate?}}` — the same
+ * shape Claude Code keeps, but in our own root; Claude Code's copy is never
+ * read or written (a claude-origin plugin's marketplace name already rides in
+ * its `name@marketplace` id, so nothing is lost).
+ */
+
+import { join } from "node:path";
+import { readJsonFile, writeJsonAtomic } from "../../lib/atomic-write.ts";
+import { sanitizePathSegment } from "../../lib/plugin-root.ts";
+import { type KnownMarketplace, parseKnownMarketplace } from "./types.ts";
+
+const FILE = "known_marketplaces.json";
+
+export function knownMarketplacesPath(root: string): string {
+	return join(root, FILE);
+}
+
+export function readKnownMarketplaces(root: string): Record<string, KnownMarketplace> {
+	const raw = readJsonFile<Record<string, unknown>>(knownMarketplacesPath(root));
+	if (!raw || typeof raw !== "object") return {};
+	const marketplaces: Record<string, KnownMarketplace> = {};
+	for (const [name, value] of Object.entries(raw)) {
+		const parsed = parseKnownMarketplace(value);
+		if (parsed) marketplaces[name] = parsed;
+	}
+	return marketplaces;
+}
+
+export function writeKnownMarketplace(root: string, name: string, entry: KnownMarketplace): void {
+	const path = knownMarketplacesPath(root);
+	const existing = readJsonFile<Record<string, unknown>>(path) ?? {};
+	writeJsonAtomic(path, { ...existing, [name]: entry });
+}
+
+export function removeKnownMarketplace(root: string, name: string): void {
+	const path = knownMarketplacesPath(root);
+	const existing = readJsonFile<Record<string, unknown>>(path);
+	if (!existing || !(name in existing)) return;
+	const { [name]: _removed, ...rest } = existing;
+	writeJsonAtomic(path, rest);
+}
+
+/**
+ * A registry name not yet taken, suffixing -2, -3, … on collision. The name
+ * becomes a path segment under marketplaces/ (and is rm'd on removal), so it
+ * is sanitized here — the one entry point every registration goes through —
+ * or a shorthand like `x/..` would name a marketplace `..`.
+ */
+export function availableMarketplaceName(root: string, suggested: string): string {
+	const safe = sanitizePathSegment(suggested);
+	const taken = new Set(Object.keys(readKnownMarketplaces(root)));
+	if (!taken.has(safe)) return safe;
+	for (let i = 2; ; i++) {
+		const candidate = `${safe}-${i}`;
+		if (!taken.has(candidate)) return candidate;
+	}
+}