zmarketplace 0.4.2

package/.claude-plugin/plugin.json

@@ -0,0 +1,15 @@
+{
+  "name": "zmarketplace",
+  "version": "0.3.0",
+  "description": "Cross-agent marketplace search: find, audit, and install packages across pi, omp, claude code, opencode, gemini cli, and codex",
+  "author": { "name": "zico20047" },
+  "license": "MIT",
+  "keywords": [
+    "marketplace",
+    "search",
+    "install",
+    "audit",
+    "cross-agent"
+  ],
+  "defaultEnabled": true
+}

package/.codex-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "zmarketplace",
+  "version": "0.3.0",
+  "description": "Cross-agent marketplace search: find, audit, and install packages across pi, omp, claude code, opencode, gemini cli, and codex",
+  "license": "MIT"
+}

package/README.md

@@ -0,0 +1,129 @@
+# zmarketplace
+
+Cross-agent marketplace search plugin. Type `/zmarketplace` in pi/omp to search, inspect, audit, and install packages across npm, Claude marketplace, and Gemini extensions.
+
+## Install
+
+```bash
+# pi / omp (slash command)
+pi install npm:zmarketplace
+# or link locally:
+omp plugin link ./search_marketplace
+
+# then in omp TUI:
+/reload
+/zmarketplace search mcp
+```
+
+## Usage
+
+```
+/zmarketplace search <query> [--type=<type>] [--eco=<ecosystem>] [--limit=<n>]
+/zmarketplace detail <id|name>
+/zmarketplace audit <id|name>
+/zmarketplace install <id|name>
+```
+
+### Search
+
+```
+/zmarketplace search mcp
+/zmarketplace search subagent --eco=pi
+/zmarketplace search theme --type=theme --limit=10
+```
+
+Opens an interactive select list. Scroll up/down, type to filter, enter to pick.
+
+### Detail + README
+
+Pick a package → select "📋 Details + README" → full README in a scrollable list.
+
+- **Enter on a URL line** (🖼 IMAGE, 🔗 link) → opens in your browser
+- **Enter on text** → stays in detail view
+- **Type to search** → filters README lines
+- **ESC or "Back to menu"** → returns to action menu
+
+### Install
+
+Pick "⬇ Install" → choose ecosystem:
+
+| Option | Command |
+|---|---|
+| 🥧 pi install | `pi install npm:<name>` |
+| ⌥ omp install | `omp plugin install npm:<name>` |
+| 🤖 claude install | `claude plugin install npm:<name>` |
+| 🔓 opencode install | `opencode plugin <name>` |
+| 💎 gemini install | `gemini extension install <url>` |
+| 🔲 codex install | `codex plugin add npm:<name>` |
+| 📦 npm install | `npm install <name>` |
+| ⚡ bunx | `bunx <name>` |
+
+Quick security check runs before showing the command. High-risk packages require confirmation.
+
+### Audit
+
+```
+/zmarketplace audit pi-mcp-adapter
+```
+
+Two-layer security scan:
+- **Layer 1 (metadata):** dependency count, file count, size, license
+- **Layer 2 (source):** downloads tarball, scans `.ts`/`.js` for dangerous patterns (`rm -rf`, `eval()`, `execSync()`, `child_process`, etc.)
+
+## Registries
+
+| Source | Coverage |
+|---|---|
+| npm | `pi-package`, `claude-code`, `opencode`, `gemini-cli`, `codex` keywords |
+| Claude marketplace | `anthropics/claude-plugins-official` + community (~800+ plugins) |
+| Gemini extensions | `geminicli.com/extensions.json` (~993 extensions) |
+
+## CLI (standalone, no agent needed)
+
+```bash
+bunx zmarketplace search "mcp" --limit=5
+bunx zmarketplace detail pi-marketplace
+bunx zmarketplace audit pi-marketplace
+bunx zmarketplace install pi-marketplace
+```
+
+## Architecture
+
+```
+src/
+├── index.ts          ← pi/omp extension: registerCommand("/zmarketplace")
+├── cli.ts            ← standalone CLI: bunx zmarketplace
+├── opencode.ts       ← opencode plugin entry
+├── core/
+│   ├── types.ts      ← unified package model
+│   ├── search.ts     ← cross-registry search + dedup + ranking
+│   ├── detail.ts     ← npm metadata + README fetch
+│   ├── audit.ts      ← 2-layer security scanner
+│   ├── install.ts    ← agent detection + install command dispatch
+│   ├── cache.ts      ← results cache for ID-based reference
+│   └── tui.ts        ← icons, formatting, arg parser
+└── registries/
+    ├── npm.ts        ← npm registry (parallel per-keyword queries)
+    ├── claude.ts     ← Claude marketplace JSON
+    └── gemini.ts     ← Gemini CLI extensions registry
+```
+
+## Cross-agent manifests
+
+| File | Ecosystem |
+|---|---|
+| `package.json` (`pi.extensions`, `omp.extensions`) | Pi, OMP |
+| `package.json` (`bin`, `exports`) | CLI, OpenCode |
+| `.claude-plugin/plugin.json` | Claude Code |
+| `gemini-extension.json` | Gemini CLI |
+| `.codex-plugin/plugin.json` | Codex |
+
+## Support
+
+If this plugin helped you, consider supporting:
+
+☕ [ko-fi.com/zicodev](https://ko-fi.com/zicodev)
+
+## License
+
+MIT

package/gemini-extension.json

@@ -0,0 +1,7 @@
+{
+  "name": "zmarketplace",
+  "version": "0.3.0",
+  "description": "Cross-agent marketplace search: find, audit, and install packages across pi, omp, claude code, opencode, gemini cli, and codex",
+  "url": "https://github.com/zico20047/zmarketplace",
+  "contextFileName": "zmarketplace"
+}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "zmarketplace",
+  "version": "0.4.2",
+  "description": "Cross-agent marketplace search: find, audit, and install plugins/skills/themes/prompts across pi, omp, claude code, opencode, gemini cli, and codex",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "zmarketplace": "./src/cli.ts"
+  },
+  "files": [
+    "src",
+    "README.md",
+    ".claude-plugin",
+    ".codex-plugin",
+    "gemini-extension.json"
+  ],
+  "keywords": [
+    "pi-package",
+    "claude-code",
+    "opencode",
+    "gemini-cli",
+    "codex",
+    "marketplace",
+    "plugin",
+    "search",
+    "install",
+    "audit"
+  ],
+  "pi": {
+    "extensions": ["./src/index.ts"]
+  },
+  "omp": {
+    "extensions": ["./src/index.ts"]
+  },
+  "exports": {
+    ".": "./src/index.ts",
+    "./server": "./src/opencode.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "bun run test/full-test.ts"
+  },
+  "devDependencies": {
+    "typescript": "^5",
+    "@types/bun": "^1.3.14"
+  },
+  "engines": {
+    "bun": ">=1.1.0"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,128 @@
+#!/usr/bin/env bun
+/**
+ * CLI entry point — standalone command for `bunx zmarketplace`.
+ * Works without any agent runtime. Used by Claude Code commands/,
+ * Gemini CLI, and Codex.
+ *
+ * Usage:
+ *   bunx zmarketplace search "mcp" --eco=pi --limit=10
+ *   bunx zmarketplace detail pi-marketplace
+ *   bunx zmarketplace audit pi-marketplace
+ *   bunx zmarketplace install pi-marketplace
+ */
+
+import { search } from "./core/search.ts";
+import { getDetail } from "./core/detail.ts";
+import { auditPackage } from "./core/audit.ts";
+import { installPackage } from "./core/install.ts";
+import { formatResultOption, formatDetailCard, formatAuditReport, formatHelp, parseArgs } from "./core/tui.ts";
+import type { SearchOptions } from "./core/types.ts";
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2);
+  const parsed = parseArgs(args);
+
+  switch (parsed.subcommand) {
+    case "":
+    case "help": {
+      console.log(formatHelp());
+      break;
+    }
+
+    case "search":
+    case "s": {
+      const query = parsed.positional.join(" ").trim();
+      const opts: SearchOptions = {
+        query,
+        type: (parsed.flags["type"] as SearchOptions["type"]) ?? "all",
+        ecosystem: (parsed.flags["eco"] as SearchOptions["ecosystem"]) ?? "all",
+        limit: parseInt(parsed.flags["limit"] ?? "20", 10),
+      };
+
+      console.log(`Searching for "${query || "all"}"...`);
+      const results = await search(opts);
+
+      if (results.length === 0) {
+        console.log("No packages found.");
+        break;
+      }
+
+      console.log(`\n${results.length} package(s) found:\n`);
+      for (let i = 0; i < results.length; i++) {
+        const opt = formatResultOption(results[i], i);
+        console.log(`  ${opt.label}`);
+        if (results[i].installCommand) {
+          console.log(`     → ${results[i].installCommand}`);
+        }
+      }
+      break;
+    }
+
+    case "detail":
+    case "d":
+    case "info": {
+      const name = parsed.positional[0];
+      if (!name) {
+        console.error("Error: package name required. Usage: zmarketplace detail <name>");
+        process.exit(1);
+      }
+
+      const detail = await getDetail(name);
+      if (!detail) {
+        console.error(`Package "${name}" not found.`);
+        process.exit(1);
+      }
+
+      console.log(formatDetailCard(detail));
+      break;
+    }
+
+    case "audit":
+    case "a": {
+      const name = parsed.positional[0];
+      if (!name) {
+        console.error("Error: package name required. Usage: zmarketplace audit <name>");
+        process.exit(1);
+      }
+
+      console.log(`Auditing ${name} (downloading source)...`);
+      const report = await auditPackage(name, { deepScan: parsed.flags["deepScan"] !== "false" });
+      console.log("\n" + formatAuditReport(report));
+      break;
+    }
+
+    case "install":
+    case "i": {
+      const name = parsed.positional[0];
+      if (!name) {
+        console.error("Error: package name required. Usage: zmarketplace install <name>");
+        process.exit(1);
+      }
+
+      console.log(`Auditing ${name} before install...`);
+      const report = await auditPackage(name, { deepScan: true });
+      console.log("\n" + formatAuditReport(report));
+
+      if (report.risk === "critical" || report.risk === "high") {
+        console.error(`\n⚠️  HIGH RISK: ${name} has ${report.risk} security issues. Review findings above.`);
+        console.error("If you still want to install, run the command manually.");
+        process.exit(1);
+      }
+
+      const result = await installPackage(name, { skipAudit: true });
+      console.log(`\n✅ Ready to install:`);
+      console.log(`  ${result.command}`);
+      break;
+    }
+
+    default:
+      console.error(`Unknown subcommand: ${parsed.subcommand}\n`);
+      console.log(formatHelp());
+      process.exit(1);
+  }
+}
+
+main().catch(err => {
+  console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});

package/src/core/audit.ts

@@ -0,0 +1,239 @@
+/**
+ * Security audit — two-layer scan of a package before installation.
+ * Layer 1: metadata check (zero cost).
+ * Layer 2: source code scan (downloads tarball, scans for dangerous patterns).
+ */
+
+import type { AuditReport, AuditFinding, AuditSeverity } from "./types.ts";
+import { getNpmPackageMeta } from "../registries/npm.ts";
+
+// Danger patterns ordered by severity.
+const CRITICAL_PATTERNS: Array<[RegExp, string]> = [
+  [/rm\s+-rf/i, "Recursive forced deletion command"],
+  [/\brimraf\b/i, "Recursive directory deletion library"],
+  [/fs\.unlink(Sync)?\s*\(/g, "File deletion"],
+  [/fs\.rmdir(Sync)?\s*\(/g, "Directory deletion"],
+  [/fs\.rm(Sync)?\s*\(/g, "File/directory removal"],
+];
+
+const HIGH_PATTERNS: Array<[RegExp, string]> = [
+  [/\beval\s*\(/g, "Dynamic code execution via eval()"],
+  [/\bnew\s+Function\s*\(/g, "Dynamic code execution via Function()"],
+  [/execSync\s*\(/g, "Synchronous command execution"],
+  [/execFile(Sync)?\s*\(/g, "Child process execution"],
+  [/\bspawn(Sync)?\s*\(/g, "Process spawning"],
+];
+
+const MEDIUM_PATTERNS: Array<[RegExp, string]> = [
+  [/process\.env\b/g, "Environment variable access"],
+  [/child_process/g, "Child process module import"],
+  [/\bfetch\s*\(/g, "HTTP fetch call"],
+  [/\bXMLHttpRequest\b/g, "HTTP request"],
+  [/https?:\/\/[^'")\s]+/g, "Hardcoded URL"],
+];
+
+const LOW_PATTERNS: Array<[RegExp, string]> = [
+  [/fs\.chmod(Sync)?\s*\(/g, "File permission change"],
+  [/fs\.chown(Sync)?\s*\(/g, "File ownership change"],
+];
+
+const ALL_PATTERN_LAYERS: Array<[AuditSeverity, Array<[RegExp, string]>]> = [
+  ["critical", CRITICAL_PATTERNS],
+  ["high", HIGH_PATTERNS],
+  ["medium", MEDIUM_PATTERNS],
+  ["low", LOW_PATTERNS],
+];
+
+const SEVERITY_WEIGHT: Record<AuditSeverity, number> = {
+  critical: 100,
+  high: 25,
+  medium: 5,
+  low: 1,
+  info: 0,
+};
+
+const SCANABLE_EXTENSIONS = new Set([".ts", ".js", ".mjs", ".cjs", ".tsx", ".jsx"]);
+
+/** Scan a source file string for dangerous patterns. */
+function scanSource(content: string, fileName: string): AuditFinding[] {
+  const lines = content.split("\n");
+  const findings: AuditFinding[] = [];
+
+  for (const [severity, patterns] of ALL_PATTERN_LAYERS) {
+    for (const [regex, reason] of patterns) {
+      regex.lastIndex = 0;
+      let match: RegExpExecArray | null;
+      while ((match = regex.exec(content)) !== null) {
+        // Find line number for the match offset
+        const offset = match.index;
+        const before = content.slice(0, offset);
+        const lineNum = before.split("\n").length;
+        const lineText = lines[lineNum - 1]?.trim() ?? "";
+
+        findings.push({
+          severity,
+          pattern: match[0],
+          file: fileName,
+          line: lineNum,
+          excerpt: lineText.slice(0, 200),
+          reason,
+        });
+      }
+    }
+  }
+
+  return findings;
+}
+
+/** Compute overall risk from findings. */
+function computeRisk(findings: AuditFinding[]): AuditReport["risk"] {
+  const score = findings.reduce((sum, f) => sum + SEVERITY_WEIGHT[f.severity], 0);
+  if (score >= 100) return "critical";
+  if (score >= 50) return "high";
+  if (score >= 15) return "moderate";
+  if (score >= 5) return "low";
+  return "safe";
+}
+
+/** Run a full audit on a package. */
+export async function auditPackage(
+  packageName: string,
+  options: { deepScan?: boolean } = {},
+): Promise<AuditReport> {
+  const deepScan = options.deepScan ?? true;
+  const meta = await getNpmPackageMeta(packageName);
+  const latestVersion = meta?.["dist-tags"]?.latest;
+
+  // Layer 1: Metadata check
+  const metadataFindings: AuditFinding[] = [];
+  if (meta && latestVersion) {
+    const versionData = meta.versions[latestVersion];
+    const depCount = Object.keys(versionData?.dependencies ?? {}).length;
+    const size = versionData?.dist?.unpackedSize ?? 0;
+    const fileCount = versionData?.dist?.fileCount ?? 0;
+
+    if (depCount > 20) {
+      metadataFindings.push({
+        severity: "medium",
+        pattern: `${depCount} dependencies`,
+        reason: "High dependency count increases supply chain risk",
+      });
+    }
+    if (size > 10 * 1024 * 1024) {
+      metadataFindings.push({
+        severity: "low",
+        pattern: `${(size / 1024 / 1024).toFixed(1)} MB`,
+        reason: "Large package size",
+      });
+    }
+    if (fileCount > 500) {
+      metadataFindings.push({
+        severity: "low",
+        pattern: `${fileCount} files`,
+        reason: "Large file count",
+      });
+    }
+    if (!versionData?.license) {
+      metadataFindings.push({
+        severity: "low",
+        pattern: "no license",
+        reason: "No license declared — usage rights unclear",
+      });
+    }
+  }
+
+  // Layer 2: Source scan
+  let sourceFindings: AuditFinding[] = [];
+
+  if (deepScan && latestVersion) {
+    try {
+      const tarballUrl = meta?.versions[latestVersion]?.dist?.tarball;
+      if (tarballUrl) {
+        const resp = await fetch(tarballUrl, { signal: AbortSignal.timeout(30000) });
+        if (resp.ok) {
+          const tarball = new Uint8Array(await resp.arrayBuffer());
+          const files = extractTextFilesFromTar(tarball);
+          sourceFindings = files.flatMap(({ name, content }) => scanSource(content, name));
+        }
+      }
+    } catch {
+      sourceFindings.push({
+        severity: "info",
+        pattern: "scan failed",
+        reason: "Could not download or extract tarball for source scanning",
+      });
+    }
+  }
+
+  const allFindings = [...metadataFindings, ...sourceFindings];
+  const risk = computeRisk(allFindings);
+
+  const summaryParts: string[] = [];
+  const counts: Partial<Record<AuditSeverity, number>> = {};
+  for (const f of allFindings) {
+    counts[f.severity] = (counts[f.severity] ?? 0) + 1;
+  }
+  const order: AuditSeverity[] = ["critical", "high", "medium", "low", "info"];
+  for (const sev of order) {
+    if (counts[sev]) summaryParts.push(`${counts[sev]} ${sev}`);
+  }
+
+  return {
+    packageName,
+    version: latestVersion,
+    risk,
+    metadataFindings,
+    sourceFindings,
+    findings: allFindings,
+    deepScanned: deepScan,
+    summary: `Risk: ${risk.toUpperCase()}. Findings: ${summaryParts.join(", ") || "none"}. ${deepScan ? "Source scanned." : "Metadata only."}`,
+  };
+}
+
+/**
+ * Minimal tar text-file extractor. Bun can handle .tar natively,
+ * but we do a pure-JS fallback to avoid loading heavy deps for large tarballs.
+ * Extracts only text files (.ts/.js/.mjs/.cjs/.tsx/.jsx).
+ */
+function extractTextFilesFromTar(tarball: Uint8Array): Array<{ name: string; content: string }> {
+  const results: Array<{ name: string; content: string }> = [];
+  const decoder = new TextDecoder("utf-8", { fatal: false });
+
+  let offset = 0;
+  while (offset + 512 <= tarball.length) {
+    // Read header block (512 bytes)
+    const header = tarball.subarray(offset, offset + 512);
+
+    // Check for end-of-archive (two zero blocks)
+    if (header.every(b => b === 0)) break;
+
+    // Parse name (offset 0, 100 bytes)
+    const name = decoder.decode(header.subarray(0, 100)).replace(/\0/g, "").trim();
+
+    // Parse size (offset 124, 12 bytes, octal)
+    const sizeStr = decoder.decode(header.subarray(124, 136)).replace(/\0/g, "").trim();
+    const size = sizeStr ? parseInt(sizeStr, 8) : 0;
+
+    // Parse type flag (offset 156, 1 byte) — '0' or '\0' = regular file
+    const typeFlag = String.fromCharCode(header[156] ?? 0);
+
+    offset += 512;
+
+    if ((typeFlag === "0" || typeFlag === "\0") && size > 0) {
+      // Check if it's a scanable file
+      const ext = name.substring(name.lastIndexOf("."));
+      if (SCANABLE_EXTENSIONS.has(ext)) {
+        const fileContent = tarball.subarray(offset, offset + size);
+        results.push({
+          name,
+          content: decoder.decode(fileContent),
+        });
+      }
+    }
+
+    // Advance past file data (padded to 512-byte boundary)
+    offset += Math.ceil(size / 512) * 512;
+  }
+
+  return results;
+}

package/src/core/cache.ts

@@ -0,0 +1,47 @@
+/**
+ * Results cache — stores the last search so IDs persist between commands.
+ * `/zmarketplace install 3` refers to the 3rd result from the last search.
+ */
+
+import type { PackageResult, AuditReport } from "./types.ts";
+
+let lastResults: PackageResult[] = [];
+let lastQuery = "";
+
+/** Store search results. */
+export function cacheResults(results: PackageResult[], query: string): void {
+  lastResults = results;
+  lastQuery = query;
+}
+
+/** Get cached results. */
+export function getCachedResults(): PackageResult[] {
+  return lastResults;
+}
+
+/** Get the last query string. */
+export function getLastQuery(): string {
+  return lastQuery;
+}
+
+/** Resolve a reference (ID number or package name) to a cached result. */
+export function resolveRef(ref: string): PackageResult | undefined {
+  // Try as numeric ID (1-based)
+  const id = parseInt(ref, 10);
+  if (!isNaN(id) && id >= 1 && id <= lastResults.length) {
+    return lastResults[id - 1];
+  }
+  // Try as package name (case-insensitive)
+  return lastResults.find(r => r.name.toLowerCase() === ref.toLowerCase());
+}
+
+/** Cache for audit reports by package name. */
+const auditCache = new Map<string, AuditReport>();
+
+export function cacheAudit(name: string, report: AuditReport): void {
+  auditCache.set(name.toLowerCase(), report);
+}
+
+export function getCachedAudit(name: string): AuditReport | undefined {
+  return auditCache.get(name.toLowerCase());
+}

package/src/core/detail.ts

@@ -0,0 +1,44 @@
+/**
+ * Package detail fetcher — retrieves full metadata, README, and manifest info.
+ */
+
+import type { PackageDetail } from "./types.ts";
+import { getNpmPackageMeta } from "../registries/npm.ts";
+
+/** Fetch detailed package information from npm + any available manifests. */
+export async function getDetail(packageName: string): Promise<PackageDetail | null> {
+  const meta = await getNpmPackageMeta(packageName);
+  if (!meta) return null;
+
+  const latestVersion = meta["dist-tags"]?.latest;
+  if (!latestVersion) return null;
+
+  const versionData = meta.versions[latestVersion];
+  if (!versionData) return null;
+
+  const repoUrl = typeof versionData.repository === "string"
+    ? versionData.repository
+    : versionData.repository?.url;
+
+  const dependencies = versionData.dependencies ?? {};
+  const depCount = Object.keys(dependencies).length;
+
+  return {
+    name: packageName,
+    description: meta.description ?? versionData.description ?? "",
+    version: latestVersion,
+    source: "npm",
+    ecosystems: [],
+    type: "unknown",
+    readme: meta.readme,
+    dependencyCount: depCount,
+    size: versionData.dist?.unpackedSize,
+    fileCount: versionData.dist?.fileCount,
+    license: versionData.license,
+    homepage: versionData.homepage ?? repoUrl,
+    repository: repoUrl,
+    npmUrl: `https://www.npmjs.com/package/${packageName}`,
+    keywords: versionData.keywords ?? [],
+    publishedAt: meta.time?.[latestVersion],
+  };
+}