rush-ai 0.14.0 → 0.15.0

package/README.md

@@ -141,12 +141,24 @@ rush-ai task status <id> --json
 
 | 命令 | 说明 |
 |------|------|
-| `marketplace add <source>` | 注册 marketplace（`github:owner/repo` 或 `directory:/abs/path`） |
+| `marketplace add <source>` | 注册 marketplace（`github:owner/repo`、`directory:/abs/path`、`rush://<host>`） |
 | `marketplace list` / `remove` / `update` | 管理本地 marketplace 缓存 |
-| `plugin install <ref>` | 一条命令同步装到 Claude Code + Codex + Cursor；`--target` 单独装；`--dry-run` / `--force` |
+| `plugin install <ref>` | 一条命令同步装到 Claude Code + Codex + Cursor；`--target` 单独装；`--dry-run` / `--force` / `--secret KEY=VALUE` |
 | `plugin list` / `uninstall` / `update` | 对称管理 |
 
-`<ref>` 格式：`<name>` 或 `<name>@<marketplace>`（例 `rush@rush-plugin`）。
+`<ref>` 格式：`<name>` 或 `<name>@<marketplace>`（例 `my-plugin@rush`）。
+
+`rush://` source 特性：
+- 首次 `plugin install xxx@rush` 自动注册 Rush 平台 marketplace（无需手动 `marketplace add`）
+- 自动从 API 获取 plugin manifest + 用 reskill 下载完整 skill 目录
+- `--secret KEY=VALUE`（可重复）预设 MCP 凭证，跳过交互式输入
+- `--force` 重新拉取 manifest 并更新 secrets
+
+`claude-plugins-official` source 特性：
+- 首次 `plugin install xxx@claude-plugins-official` 自动注册 Anthropic 官方 marketplace
+- 支持 URL source 按需 clone：外部 git repo 的 plugin 自动 clone 到 `~/.rush/plugin-cache/`
+- 支持 git-subdir 模式（一个 repo 内多个 plugin）
+- `--force` 重新 clone 最新版本
 
 ### 认证 / 配置 / 其他
 
@@ -194,20 +206,34 @@ rush-ai config list
 
 ### 插件分发（可选）
 
-如果你想把 Rush 生态的 skill / command / rule / MCP 同时装到本地的 Claude Code / Codex / Cursor：
+把 Rush 平台上创建的 Plugin（Skill + MCP 组合包）一键装到本地 IDE：
 
 ```bash
-rush-ai marketplace add github:kanyun-inc/rush-plugin
-rush-ai plugin install rush
-# ✓ Claude Code  (commands + skills + rules + MCP)
+# 从 Rush 平台安装（自动注册 marketplace，无需手动 add）
+rush-ai plugin install my-plugin@rush
+# ✓ Claude Code  (skills + MCP)
 # ✓ Codex         (skills + MCP)
-# ✓ Cursor        (skills + rules + MCP)
+# ✓ Cursor        (skills + MCP)
+
+# 带 MCP secrets（CI/非交互模式）
+rush-ai plugin install my-plugin@rush --secret SHIMO_TOKEN=xxx --secret API_KEY=yyy
 
 # 只装某一家
-rush-ai plugin install rush --target claude-code
+rush-ai plugin install my-plugin@rush --target claude-code
+
+# 更新 secrets / 刷新 skill
+rush-ai plugin install my-plugin@rush --force --secret SHIMO_TOKEN=new-value
 
 # 预览不落盘
-rush-ai plugin install rush --dry-run
+rush-ai plugin install my-plugin@rush --dry-run
+
+# Anthropic 官方 marketplace（170+ 社区 plugin，自动注册）
+rush-ai plugin install sentry@claude-plugins-official
+rush-ai plugin install aikido@claude-plugins-official --target claude-code
+
+# GitHub marketplace 也支持
+rush-ai marketplace add github:kanyun-inc/rush-plugin
+rush-ai plugin install rush
 ```
 
 这条路径和每个 IDE 自己的 `/plugin install` 等价 —— 装完之后 IDE 的 `/plugin list` 能看到、`/plugin uninstall` 也能卸载。不用这条路径就忽略；日常的 `task create` / `task push` 和插件分发完全独立。

package/dist/index.js

@@ -4291,6 +4291,7 @@ function registerMcpCommand(program) {
 }
 
 // src/commands/plugin/install.ts
+import { rm as rm12 } from "fs/promises";
 import { resolve as resolve20 } from "path";
 
 // src/installers/claude-code/installer.ts
@@ -4518,7 +4519,7 @@ var ClaudeCodeInstaller = class {
     const { ref, version } = plugin;
     const pluginVersionDir = this.paths.pluginVersionDir(ref, version);
     const key = pluginKey(ref);
-    if (!opts.force) {
+    if (!opts.force && version !== "unknown") {
       let already = false;
       try {
         already = await this.isAlreadyInstalledAtVersion(ref, version);
@@ -5837,7 +5838,7 @@ var CodexInstaller = class {
       };
     }
     const ref = plugin.ref;
-    if (!opts.force && await this.isInstalled(ref)) {
+    if (!opts.force && plugin.version !== "unknown" && await this.isInstalled(ref)) {
       const existingVersion = await detectInstalledVersion(this.home, ref);
       if (existingVersion?.version === plugin.version) {
         return {
@@ -6647,8 +6648,8 @@ async function writeFileAtomic(filePath, content) {
   const tmp = `${filePath}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
     await writeFile6(tmp, content, { encoding: "utf8", flag: "w" });
-    const { rename: rename9 } = await import("fs/promises");
-    await rename9(tmp, filePath);
+    const { rename: rename10 } = await import("fs/promises");
+    await rename10(tmp, filePath);
   } catch (err) {
     await rm7(tmp, { force: true }).catch(() => {
     });
@@ -7141,7 +7142,7 @@ var CursorInstaller = class {
     const { included, skipped } = partitionCapabilities(plugin.capabilities);
     const force = opts.force === true;
     const dryRun = opts.dryRun === true;
-    if (!force && !dryRun) {
+    if (!force && !dryRun && plugin.version !== "unknown") {
       const store = await RushRegistryStore.load({ home: this.home });
       const existing = store.get(plugin.ref)?.targets?.cursor;
       if (existing && existing.version === plugin.version) {
@@ -7591,8 +7592,8 @@ async function fileExists(p) {
   }
 }
 async function safeRename(from, to) {
-  const { rename: rename9 } = await import("fs/promises");
-  await rename9(from, to);
+  const { rename: rename10 } = await import("fs/promises");
+  await rename10(from, to);
 }
 async function classifyArtifactPath(p) {
   let s;
@@ -7830,9 +7831,12 @@ async function appendMigrationFailure(reason, opts = {}) {
 
 // src/migration/migrate.ts
 import { access as access12, readFile as readFile13 } from "fs/promises";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 
 // src/plugins/resolver.ts
+import { randomUUID as randomUUID8 } from "crypto";
+import { mkdir as mkdir11, rename as rename9, rm as rm11 } from "fs/promises";
+import { homedir as homedir11 } from "os";
 import {
   isAbsolute as isAbsolute5,
   relative as pathRelative2,
@@ -8031,15 +8035,15 @@ var PluginManifestCorruptError = class extends PluginResolverError {
     this.name = "PluginManifestCorruptError";
   }
 };
-var InvalidPluginVersionError = class extends PluginResolverError {
-  constructor(pluginName, manifestPath, actualValue) {
+var PluginCloneFailedError = class extends PluginResolverError {
+  constructor(pluginName, marketplaceName, cause) {
     super(
-      `plugin.json at '${manifestPath}' has invalid version field (got ${actualValue === void 0 ? "undefined" : `'${actualValue}'`}). Plugin '${pluginName}' must declare a non-empty version (e.g. "0.1.0"); 'unknown' is not allowed (see #906).`
+      `Failed to clone plugin '${pluginName}' from marketplace '${marketplaceName}': ${cause instanceof Error ? cause.message : String(cause)}`
     );
     this.pluginName = pluginName;
-    this.manifestPath = manifestPath;
-    this.actualValue = actualValue;
-    this.name = "InvalidPluginVersionError";
+    this.marketplaceName = marketplaceName;
+    this.cause = cause;
+    this.name = "PluginCloneFailedError";
   }
 };
 
@@ -8081,13 +8085,8 @@ function parsePluginManifest(pluginName, raw, sourcePathForError) {
       "'name' must be a non-empty string"
     );
   }
-  const version = obj.version;
-  if (typeof version !== "string" || version.length === 0 || version.toLowerCase() === "unknown") {
-    throw new InvalidPluginVersionError(
-      pluginName,
-      sourcePathForError,
-      typeof version === "string" ? version : void 0
-    );
+  if (typeof obj.version !== "string" || obj.version.length === 0) {
+    obj.version = "unknown";
   }
   if (obj.mcpServers !== void 0) {
     const m = obj.mcpServers;
@@ -8108,6 +8107,10 @@ var RUSH_AI_MARKETPLACE_NAME3 = "rush-marketplace";
 var RUSH_MCP_SERVER_KEY3 = "rush";
 async function resolvePlugin(ref, marketplace, options = {}) {
   const entry = findPluginEntry(ref, marketplace);
+  await ensurePluginCloned(ref, marketplace, entry, {
+    runner: options.gitRunner,
+    dryRun: options.dryRun
+  });
   const sourceDir = resolvePluginSourceDir(ref, marketplace, entry);
   const manifest = await readPluginManifest(ref.name, sourceDir);
   const capabilities = await scanCapabilities(sourceDir, manifest);
@@ -8137,6 +8140,9 @@ function findPluginEntry(ref, marketplace) {
   return entry;
 }
 function resolvePluginSourceDir(ref, marketplace, entry) {
+  if (hasUrlSource(entry)) {
+    return extractUrlSourceDir(marketplace, entry);
+  }
   const relPath = extractRelativeSourcePath(ref, marketplace, entry);
   if (isAbsolute5(relPath)) {
     throw new PluginSourceUnresolvableError(
@@ -8158,6 +8164,29 @@ function resolvePluginSourceDir(ref, marketplace, entry) {
   }
   return abs;
 }
+function extractUrlSourceDir(marketplace, entry) {
+  const src = entry.source;
+  const cacheDir = pluginCacheDir(marketplace.name, entry.name);
+  const subPath = typeof src.path === "string" ? src.path.trim() : "";
+  if (!subPath) return cacheDir;
+  if (isAbsolute5(subPath)) {
+    throw new PluginSourceUnresolvableError(
+      entry.name,
+      marketplace.name,
+      `URL source subpath must be relative; got absolute '${subPath}'`
+    );
+  }
+  const resolved = pathResolve2(cacheDir, subPath);
+  const rel = pathRelative2(cacheDir, resolved);
+  if (rel === ".." || rel.startsWith(`..${pathSep}`) || isAbsolute5(rel)) {
+    throw new PluginSourceUnresolvableError(
+      entry.name,
+      marketplace.name,
+      `URL source subpath '${subPath}' escapes plugin cache dir`
+    );
+  }
+  return resolved;
+}
 function extractRelativeSourcePath(ref, marketplace, entry) {
   if (entry.source === void 0 || entry.source === null) {
     return `plugins/${entry.name}`;
@@ -8227,12 +8256,93 @@ function defaultRushAiBinaryResolver2() {
   }
   return void 0;
 }
+function pluginCacheDir(marketplaceName, pluginName) {
+  assertSafePathComponent(marketplaceName, "marketplace name");
+  assertSafePathComponent(pluginName, "plugin name");
+  return pathResolve2(
+    homedir11(),
+    ".rush",
+    "plugin-cache",
+    marketplaceName,
+    pluginName
+  );
+}
+function assertSafePathComponent(value, label) {
+  if (value.includes("/") || value.includes("\\") || value === ".." || value.startsWith("../") || value.startsWith("..\\")) {
+    throw new PluginSourceUnresolvableError(
+      value,
+      "",
+      `${label} '${value}' contains unsafe path characters`
+    );
+  }
+}
+function hasUrlSource(entry) {
+  const src = entry.source;
+  return !!src && typeof src === "object" && !Array.isArray(src) && typeof src.url === "string" && src.url.length > 0;
+}
+async function ensurePluginCloned(ref, marketplace, entry, opts) {
+  const src = entry.source;
+  if (!src || typeof src !== "object" || Array.isArray(src)) return;
+  if (typeof src.url !== "string" || !src.url) return;
+  const cacheDir = pluginCacheDir(marketplace.name, entry.name);
+  if (await pathExists2(cacheDir)) return;
+  if (opts?.dryRun) {
+    throw new PluginSourceUnresolvableError(
+      ref.name,
+      marketplace.name,
+      `Plugin '${ref.name}' has not been cached yet. Run without --dry-run first.`
+    );
+  }
+  const git = opts?.runner ?? defaultGitRunner;
+  const parent = pathResolve2(cacheDir, "..");
+  await mkdir11(parent, { recursive: true });
+  const tmpDir = `${cacheDir}.${randomUUID8()}.tmp`;
+  try {
+    const args = ["clone", "--depth", "1"];
+    if (typeof src.ref === "string" && src.ref.length > 0) {
+      args.push("--branch", src.ref);
+    }
+    args.push("--", src.url, tmpDir);
+    const result = await git(args);
+    if (result.exitCode !== 0) {
+      throw new Error(
+        `git clone exited with code ${result.exitCode}: ${result.stderr.trim()}`
+      );
+    }
+    if (typeof src.sha === "string" && src.sha.length > 0) {
+      try {
+        const head = await git(["rev-parse", "HEAD"], { cwd: tmpDir });
+        const actualSha = head.stdout.trim();
+        if (!actualSha.startsWith(src.sha) && !src.sha.startsWith(actualSha)) {
+          output.warn(
+            `Plugin '${ref.name}' sha mismatch (expected ${src.sha.slice(0, 7)}, got ${actualSha.slice(0, 7)})`
+          );
+        }
+      } catch {
+      }
+    }
+    try {
+      await rename9(tmpDir, cacheDir);
+    } catch (err) {
+      if (err.code === "ENOTEMPTY" && await pathExists2(cacheDir)) {
+        await rm11(tmpDir, { recursive: true, force: true });
+        return;
+      }
+      throw err;
+    }
+  } catch (err) {
+    await rm11(tmpDir, { recursive: true, force: true }).catch(() => {
+    });
+    if (err instanceof PluginSourceUnresolvableError) throw err;
+    throw new PluginCloneFailedError(ref.name, marketplace.name, err);
+  }
+}
 
 // src/migration/migrate.ts
 var LEGACY_MIGRATION_KEY = "legacy-rush-0.7.x";
 var SKIP_MIGRATION_ENV = "RUSH_SKIP_MIGRATION";
 async function maybeRunMigration(input) {
-  const home = input.home ?? homedir11();
+  const home = input.home ?? homedir12();
   const now = input.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const envGet = input.env ?? ((key) => process.env[key]);
   const reporter = input.reporter ?? {};
@@ -8804,6 +8914,10 @@ async function runInstall(input) {
         const rushSource = parseSource(`rush://${apiHost}`);
         await cache.add(rushSource, { as: ref.marketplace });
         marketplace = await cache.get(ref.marketplace);
+      } else if (ref.marketplace === "claude-plugins-official") {
+        const source = parseSource("github:anthropics/claude-plugins-official");
+        await cache.add(source, { as: "claude-plugins-official" });
+        marketplace = await cache.get("claude-plugins-official");
       } else {
         throw new RushError(
           `Marketplace '${ref.marketplace}' is not in the local cache. Run 'rush-ai marketplace add <source>' first.`,
@@ -8900,15 +9014,24 @@ async function runInstall(input) {
       }
     }
   }
+  if (force && !dryRun) {
+    const entry = marketplace.manifest.plugins.find((p) => p.name === ref.name);
+    if (entry && hasUrlSource(entry)) {
+      await rm12(pluginCacheDir(ref.marketplace, ref.name), {
+        recursive: true,
+        force: true
+      });
+    }
+  }
   const resolveFn = input.resolvePluginFn ?? resolvePlugin;
   let plugin;
   try {
-    plugin = await resolveFn(ref, marketplace);
+    plugin = await resolveFn(ref, marketplace, { dryRun });
   } catch (err) {
     if (err instanceof PluginNotFoundInMarketplaceError && marketplace.source.kind === "rush") {
       marketplace = await cache.update(ref.marketplace);
       try {
-        plugin = await resolveFn(ref, marketplace);
+        plugin = await resolveFn(ref, marketplace, { dryRun });
       } catch (retryErr) {
         if (retryErr instanceof PluginNotFoundInMarketplaceError) {
           throw new RushError(
@@ -9106,8 +9229,9 @@ function registerInstallCommand(group, _root) {
 function printInstallSummary(result) {
   const { plugin, results, targetExplicit, dryRun } = result;
   const tag = dryRun ? " (dry-run)" : "";
+  const ver = plugin.version !== "unknown" ? ` v${plugin.version}` : "";
   output.log(
-    `Installing ${plugin.ref.name}@${plugin.ref.marketplace} v${plugin.version}...${tag}`
+    `Installing ${plugin.ref.name}@${plugin.ref.marketplace}${ver}...${tag}`
   );
   output.newline();
   for (const r of results) {
@@ -9768,7 +9892,7 @@ function registerSkillCommand(program) {
 
 // src/commands/task/index.ts
 import { createWriteStream } from "fs";
-import { mkdir as mkdir11, readFile as readFile14, stat as stat10 } from "fs/promises";
+import { mkdir as mkdir12, readFile as readFile14, stat as stat10 } from "fs/promises";
 import path3 from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
@@ -10136,7 +10260,7 @@ function writeHandoffFile(projectPath, content) {
 var NO_PROJECT_HINT = [
   "No rush project detected for this directory. Either:",
   '  rush-ai task create -a web-builder -p "..."   (build a new site from a prompt)',
-  "  rush-ai task init                              (link an existing local project)"
+  "  rush-ai task link                              (link an existing local project)"
 ].join("\n");
 function registerPushSubcommand(task, program) {
   task.command("push").description(
@@ -10314,7 +10438,7 @@ function pushWithRouting(projectPath, source, envGitRemote) {
   if (!envRemoteUsable) {
     return {
       success: false,
-      stderr: "Cannot push: .rush/env.md identifies a Rush project but has no usable GIT_REMOTE. Re-run `rush-ai task init` to refresh the deploy token, or set `origin` to the Rush GitLab URL."
+      stderr: "Cannot push: .rush/env.md identifies a Rush project but has no usable GIT_REMOTE. Re-run `rush-ai task link` to refresh the deploy token, or set `origin` to the Rush GitLab URL."
     };
   }
   return gitPushUrl(projectPath, envGitRemote);
@@ -11341,7 +11465,7 @@ async function downloadFile(file2, destPath, client) {
   if (!response.body) {
     throw new Error("No response body");
   }
-  await mkdir11(path3.dirname(destPath), { recursive: true });
+  await mkdir12(path3.dirname(destPath), { recursive: true });
   const nodeStream = Readable.fromWeb(
     response.body
   );
@@ -11947,8 +12071,8 @@ function registerCommands(program) {
 }
 
 // src/util/update-check.ts
-import { mkdir as mkdir12, readFile as readFile15, writeFile as writeFile9 } from "fs/promises";
-import { homedir as homedir12 } from "os";
+import { mkdir as mkdir13, readFile as readFile15, writeFile as writeFile9 } from "fs/promises";
+import { homedir as homedir13 } from "os";
 import { dirname as dirname10, join as join10 } from "path";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 3e3;
@@ -11972,13 +12096,13 @@ function isNewerVersion(current, latest) {
 }
 async function writeLastCheck(checkFile) {
   try {
-    await mkdir12(dirname10(checkFile), { recursive: true });
+    await mkdir13(dirname10(checkFile), { recursive: true });
     await writeFile9(checkFile, JSON.stringify({ lastCheck: Date.now() }));
   } catch {
   }
 }
 async function checkForUpdate(currentVersion) {
-  const rushDir = join10(homedir12(), ".rush");
+  const rushDir = join10(homedir13(), ".rush");
   const checkFile = join10(rushDir, "update-check.json");
   try {
     if (process.env.CI) return;