vskill 1.0.13 → 1.0.15

package/dist/commands/add.js

@@ -17,6 +17,7 @@ import { checkInstallSafety } from "../blocklist/blocklist.js";
 import { getSkill, searchSkills } from "../api/client.js";
 import { checkPlatformSecurity } from "../security/index.js";
 import { discoverSkills, getDefaultBranch, checkRepoExists, warnRateLimitOnce } from "../discovery/github-tree.js";
+import { githubFetch } from "../lib/github-fetch.js";
 import { parseGitHubSource } from "../utils/validation.js";
 import { parseSkillsShUrl, isCompleteParsed, isIncompleteParsed, } from "../resolvers/url-resolver.js";
 import { bold, green, red, yellow, dim, cyan, spinner, link, formatInstalls, } from "../utils/output.js";
@@ -32,7 +33,7 @@ import { extractFrontmatterVersion } from "../utils/version.js";
 // mutation to the claude CLI (ADR 0724-01), and we honour the --no-enable
 // flag to skip it. Uninstall is imported for F-003 rollback of earlier
 // already-enabled plugins on a partway failure.
-import { claudePluginInstall, claudePluginUninstall } from "../utils/claude-plugin.js";
+import { claudePluginInstall, claudePluginUninstall, claudePluginMarketplaceAdd, claudePluginMarketplaceList, } from "../utils/claude-plugin.js";
 import { buildPerAgentReport, resolvePluginId, } from "../lib/skill-lifecycle.js";
 // ---------------------------------------------------------------------------
 /** Validate that a download_url from GitHub Contents API points to a trusted GitHub domain. */
@@ -48,7 +49,7 @@ function isGitHubDownloadUrl(url) {
 async function parseManifestFromContentsApi(data) {
     // Prefer download_url for raw content — validate URL before fetching (SSRF prevention)
     if (data.download_url && isGitHubDownloadUrl(data.download_url)) {
-        const rawRes = await fetch(data.download_url);
+        const rawRes = await githubFetch(data.download_url);
         if (rawRes.ok) {
             const content = await rawRes.text();
             if (getAvailablePlugins(content).length > 0)
@@ -75,7 +76,7 @@ export async function detectMarketplaceRepo(owner, repo) {
     const headers = { Accept: "application/vnd.github.v3+json", "User-Agent": "vskill-cli" };
     // Attempt 1: Contents API
     try {
-        const res = await fetch(contentsUrl, { headers });
+        const res = await githubFetch(contentsUrl, { headers });
         if (res.status === 404)
             return { isMarketplace: false };
         if (res.status === 403)
@@ -93,7 +94,7 @@ export async function detectMarketplaceRepo(owner, repo) {
     // Attempt 2: Retry Contents API after 1s delay
     try {
         await new Promise((r) => setTimeout(r, 1000));
-        const res = await fetch(contentsUrl, { headers });
+        const res = await githubFetch(contentsUrl, { headers });
         if (res.status === 404)
             return { isMarketplace: false };
         if (res.status === 403)
@@ -112,7 +113,7 @@ export async function detectMarketplaceRepo(owner, repo) {
     try {
         const branch = await getDefaultBranch(owner, repo);
         const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/.claude-plugin/marketplace.json`;
-        const res = await fetch(rawUrl);
+        const res = await githubFetch(rawUrl);
         if (res.ok) {
             const content = await res.text();
             if (getAvailablePlugins(content).length > 0) {
@@ -191,7 +192,7 @@ async function installMarketplaceRepo(owner, repo, manifestContent, opts, preSel
                 // Not in marketplace or unregistered list — probe plugins/<name>/ folder directly
                 let probeSource = null;
                 try {
-                    const probeRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/plugins/${preSelected[0]}`, { headers: { "User-Agent": "vskill-cli" } });
+                    const probeRes = await githubFetch(`https://api.github.com/repos/${owner}/${repo}/contents/plugins/${preSelected[0]}`, { headers: { "User-Agent": "vskill-cli" } });
                     if (probeRes.ok) {
                         const data = await probeRes.json();
                         if (Array.isArray(data)) {
@@ -351,7 +352,7 @@ async function installMarketplaceRepo(owner, repo, manifestContent, opts, preSel
                 // Discover skills: try nested {pluginPath}/skills/ first, fall back to flat {pluginPath}/SKILL.md
                 const skillsToSubmit = [];
                 const skillsUrl = `https://api.github.com/repos/${owner}/${repo}/contents/${pluginPath}/skills`;
-                const skillsRes = await fetch(skillsUrl, { headers: { "User-Agent": "vskill-cli" } });
+                const skillsRes = await githubFetch(skillsUrl, { headers: { "User-Agent": "vskill-cli" } });
                 if (skillsRes.ok) {
                     const skillDirs = (await skillsRes.json())
                         .filter((e) => e.type === "dir");
@@ -450,24 +451,27 @@ async function installMarketplaceRepo(owner, repo, manifestContent, opts, preSel
         })),
     ];
     for (const plugin of allPluginsToInstall) {
-        const pluginPath = plugin.source.replace(/^\.\//, "");
-        if (!pluginPath) {
-            results.push({ name: plugin.name, installed: false, method: "failed" });
-            continue;
-        }
+        // 0826: a marketplace plugin whose `source` is `"./"` lives at the repo
+        // root — the previous guard (`if (!pluginPath) … failed`) short-circuited
+        // those installs. Keep the path normalization but allow an empty value to
+        // mean "repo root" instead of treating it as a hard failure. Build URL
+        // segments with a leading-slash prefix only when there's a real path so
+        // we don't emit `//` between the contents-API base and `skills`.
+        const pluginPath = plugin.source.replace(/^\.\//, "").replace(/\/$/, "");
+        const pathSegment = pluginPath ? `/${pluginPath}` : "";
         const installSpin = spinner(`Installing skills: ${bold(plugin.name)}`);
         try {
             // Discover skills: try {pluginPath}/skills/ first, then fall back to {pluginPath}/SKILL.md
             const installedSkillNames = [];
-            const skillsUrl = `https://api.github.com/repos/${owner}/${repo}/contents/${pluginPath}/skills`;
-            const skillsRes = await fetch(skillsUrl, { headers: { "User-Agent": "vskill-cli" } });
+            const skillsUrl = `https://api.github.com/repos/${owner}/${repo}/contents${pathSegment}/skills`;
+            const skillsRes = await githubFetch(skillsUrl, { headers: { "User-Agent": "vskill-cli" } });
             if (skillsRes.ok) {
                 // Nested layout: {pluginPath}/skills/{skillName}/SKILL.md
                 const skillDirs = (await skillsRes.json())
                     .filter((e) => e.type === "dir");
                 for (const sd of skillDirs) {
-                    const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/skills/${sd.name}/SKILL.md`;
-                    const contentRes = await fetch(rawUrl);
+                    const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}${pathSegment}/skills/${sd.name}/SKILL.md`;
+                    const contentRes = await githubFetch(rawUrl);
                     if (!contentRes.ok)
                         continue;
                     const content = await contentRes.text();
@@ -488,8 +492,8 @@ async function installMarketplaceRepo(owner, repo, manifestContent, opts, preSel
             }
             else {
                 // Flat layout: {pluginPath}/SKILL.md directly in the plugin root
-                const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/SKILL.md`;
-                const contentRes = await fetch(rawUrl);
+                const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}${pathSegment}/SKILL.md`;
+                const contentRes = await githubFetch(rawUrl);
                 if (contentRes.ok) {
                     const content = await contentRes.text();
                     const processedContent = ensureFrontmatter(content, plugin.name);
@@ -565,7 +569,14 @@ async function installMarketplaceRepo(owner, repo, manifestContent, opts, preSel
     // `enabledSoFar` so that a later failure rolls back all earlier
     // already-enabled plugins (otherwise we'd leave exactly the stale
     // `enabledPlugins` entries that `vskill cleanup` is meant to fix).
+    // 0826: include `opts.global` here. Previously a Studio "Global" install
+    // (or CLI `vskill install … --global`) wrote the SKILL.md stub to disk
+    // but never invoked `claude plugin install` — leaving the plugin
+    // unenabled. The user saw the skill on disk but Claude Code didn't load
+    // it. Treat --global as opt-in to the enable hook (scope = user, since
+    // --global is per-machine, not per-repo).
     const userOptedIn = opts.scope !== undefined ||
+        opts.global === true ||
         opts.dryRun === true ||
         opts.enable === false;
     if (userOptedIn) {
@@ -692,9 +703,62 @@ export function enableAfterInstall(skillName, entry, opts) {
         console.log(dim(`Dry-run: would invoke ${cyan(`claude plugin install --scope ${scope} -- ${pluginId}`)}`));
         return { invoked: false, pluginId, scope };
     }
+    // 0826: when the source repo is a Claude Code plugin marketplace that
+    // hasn't been registered yet, `claude plugin install foo@bar` fails with
+    // "Plugin foo not found in marketplace bar" — and the rollback then
+    // wipes the on-disk extraction we just succeeded at. Detect that case
+    // up-front from the lockfile entry's marketplace metadata and register
+    // the marketplace via `claude plugin marketplace add` before delegating
+    // the install. Best-effort — if the add fails (network, invalid source)
+    // we still attempt the install so the original error is surfaced.
+    ensureMarketplaceRegistered(entry, pluginId, scope);
     claudePluginInstall(pluginId, scope, scope === "project" ? { cwd: process.cwd() } : undefined);
     return { invoked: true, pluginId, scope };
 }
+/**
+ * 0826: Ensure the marketplace referenced by `entry` is registered with the
+ * claude CLI before we try to enable the plugin. The lockfile entry shape
+ * stores the marketplace name (e.g. `postiz-agent`) plus the originating
+ * `sourceRepoUrl` — we derive `<owner>/<repo>` from the URL and run
+ * `claude plugin marketplace add` if the name is missing from the current
+ * `claude plugin marketplace list`.
+ *
+ * Pure best-effort: any failure (network, parse) falls through silently and
+ * lets the subsequent `claudePluginInstall` surface the real error.
+ */
+function ensureMarketplaceRegistered(entry, pluginId, scope) {
+    const marketplaceName = entry.marketplace;
+    if (!marketplaceName)
+        return;
+    // Already registered — nothing to do.
+    let registered = [];
+    try {
+        registered = claudePluginMarketplaceList();
+    }
+    catch {
+        return;
+    }
+    if (registered.includes(marketplaceName))
+        return;
+    // Derive a `claude plugin marketplace add` source from the lockfile.
+    // GitHub URL → `owner/repo`; falls back to `marketplace@<id>` form which
+    // claude rejects with a clear message.
+    const repoSource = entry.sourceRepoUrl?.match(/github\.com\/([^/]+\/[^/]+?)(?:\.git)?\/?$/);
+    const source = repoSource ? repoSource[1] : "";
+    if (!source) {
+        console.error(dim(`  marketplace "${marketplaceName}" not registered and no source repo URL available — skipping auto-add (claude plugin install will likely fail).`));
+        return;
+    }
+    console.log(dim(`  Registering marketplace "${marketplaceName}" (${source}) — required for ${pluginId}`));
+    try {
+        claudePluginMarketplaceAdd(source, scope);
+    }
+    catch (err) {
+        // Surface the underlying error but keep going — claudePluginInstall
+        // will still throw a clearer "not found in marketplace" if needed.
+        console.error(dim(`  Failed to auto-register marketplace "${marketplaceName}": ${err.message.split("\n")[0]}`));
+    }
+}
 /**
  * 0724 T-006: rollback the on-disk extraction + lockfile entry when
  * `claudePluginInstall` throws (AC-US1-05). Best-effort — wraps each rm in
@@ -871,7 +935,7 @@ async function promptInstallOptions(agents, opts) {
 async function fetchSkillContent(url) {
     const spin = spinner("Fetching skill");
     try {
-        const res = await fetch(url);
+        const res = await githubFetch(url);
         if (!res.ok) {
             spin.stop();
             if (res.status === 404) {
@@ -1173,7 +1237,7 @@ sourceSkillPath) {
     // Fetch content (non-exiting for multi-skill support)
     let content;
     try {
-        const res = await fetch(rawUrl);
+        const res = await githubFetch(rawUrl);
         if (!res.ok) {
             return { skillName, installed: false, verdict: "FETCH_FAILED" };
         }
@@ -1221,7 +1285,7 @@ sourceSkillPath) {
         agentFiles = {};
         const fetches = Object.entries(agentRawUrls).map(async ([relPath, url]) => {
             try {
-                const res = await fetch(url);
+                const res = await githubFetch(url);
                 if (res.ok)
                     agentFiles[relPath] = await res.text();
             }
@@ -1264,7 +1328,7 @@ async function installAllRepoPlugins(ownerRepo, opts) {
     const manifestSpin = spinner("Fetching marketplace.json");
     let manifestContent;
     try {
-        const res = await fetch(manifestUrl);
+        const res = await githubFetch(manifestUrl);
         if (!res.ok) {
             manifestSpin.stop();
             console.error(red(`marketplace.json not found at ${owner}/${repo}\n`) +
@@ -1326,7 +1390,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
     const manifestSpin = spinner("Fetching marketplace.json");
     let manifestContent;
     try {
-        const res = await fetch(manifestUrl);
+        const res = await githubFetch(manifestUrl);
         if (!res.ok) {
             manifestSpin.stop();
             throw new Error(`marketplace.json not found at ${owner}/${repo}. ` +
@@ -1347,7 +1411,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
         // Not in marketplace.json — probe plugins/<name>/ folder in the repo
         const probeSpin = spinner(`Looking for "${pluginName}" folder in repo`);
         try {
-            const probeRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/plugins/${pluginName}`, { headers: { "User-Agent": "vskill-cli" } });
+            const probeRes = await githubFetch(`https://api.github.com/repos/${owner}/${repo}/contents/plugins/${pluginName}`, { headers: { "User-Agent": "vskill-cli" } });
             if (probeRes.ok) {
                 const data = await probeRes.json();
                 if (Array.isArray(data)) {
@@ -1387,7 +1451,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
     let skillEntries = [];
     let flatLayout = false;
     try {
-        const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${pluginPath}/skills`, { headers: { "User-Agent": "vskill-cli" } });
+        const res = await githubFetch(`https://api.github.com/repos/${owner}/${repo}/contents/${pluginPath}/skills`, { headers: { "User-Agent": "vskill-cli" } });
         if (res.ok) {
             skillEntries = (await res.json()).filter((e) => e.type === "dir");
         }
@@ -1396,7 +1460,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
     // Flat layout fallback: check for SKILL.md directly at plugin root
     if (skillEntries.length === 0) {
         try {
-            const res = await fetch(`https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/SKILL.md`);
+            const res = await githubFetch(`https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/SKILL.md`);
             if (res.ok) {
                 flatLayout = true;
                 skillEntries = [{ name: pluginName, type: "dir" }];
@@ -1406,7 +1470,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
     }
     let cmdEntries = [];
     try {
-        const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${pluginPath}/commands`, { headers: { "User-Agent": "vskill-cli" } });
+        const res = await githubFetch(`https://api.github.com/repos/${owner}/${repo}/contents/${pluginPath}/commands`, { headers: { "User-Agent": "vskill-cli" } });
         if (res.ok) {
             cmdEntries = (await res.json()).filter((e) => e.name.endsWith(".md"));
         }
@@ -1433,7 +1497,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
             ? `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/SKILL.md`
             : `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/skills/${entry.name}/SKILL.md`;
         try {
-            const res = await fetch(rawUrl);
+            const res = await githubFetch(rawUrl);
             if (res.ok) {
                 const content = await res.text();
                 skills.push({ name: entry.name, content });
@@ -1446,7 +1510,7 @@ async function installRepoPlugin(ownerRepo, pluginName, opts, overrideSource) {
     for (const entry of cmdEntries) {
         const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${pluginPath}/commands/${entry.name}`;
         try {
-            const res = await fetch(rawUrl);
+            const res = await githubFetch(rawUrl);
             if (res.ok) {
                 const content = await res.text();
                 commands.push({ name: entry.name, content });
@@ -1630,7 +1694,7 @@ export async function addCommand(source, opts) {
                 const pluginPath = plugin.source.replace(/^\.\//, "");
                 const subpath = `${pluginPath}/skills/${threeSkill}/SKILL.md`;
                 const probeUrl = `https://raw.githubusercontent.com/${threeOwner}/${threeRepo}/${branch}/${subpath}`;
-                const probeRes = await fetch(probeUrl);
+                const probeRes = await githubFetch(probeUrl);
                 if (probeRes.ok) {
                     return installSingleSkillLegacy(threeOwner, threeRepo, threeSkill, opts, subpath, plugin.name);
                 }
@@ -2157,7 +2221,7 @@ async function installSingleSkillLegacy(owner, repo, skill, opts, skillSubpathOv
                 ? skillSubpathOverride.replace(/\/SKILL\.md$/, "/agents")
                 : `skills/${skill}/agents`;
             const agentsDirUrl = `https://api.github.com/repos/${owner}/${repo}/contents/${agentsBasePath}`;
-            const dirRes = await fetch(agentsDirUrl, { headers: { Accept: "application/vnd.github.v3+json" } });
+            const dirRes = await githubFetch(agentsDirUrl, { headers: { Accept: "application/vnd.github.v3+json" } });
             if (dirRes.ok) {
                 const entries = (await dirRes.json());
                 const mdEntries = entries.filter((e) => e.name.endsWith(".md") && e.download_url && isGitHubDownloadUrl(e.download_url));
@@ -2165,7 +2229,7 @@ async function installSingleSkillLegacy(owner, repo, skill, opts, skillSubpathOv
                     legacyAgentFiles = {};
                     const fetches = mdEntries.map(async (entry) => {
                         try {
-                            const res = await fetch(entry.download_url);
+                            const res = await githubFetch(entry.download_url);
                             if (res.ok)
                                 legacyAgentFiles[`agents/${entry.name}`] = await res.text();
                         }