zmarketplace 0.4.2

package/src/core/install.ts

@@ -0,0 +1,109 @@
+/**
+ * Install dispatcher — runs the correct install command for the detected agent.
+ * Always runs an audit first and requires explicit confirmation.
+ */
+
+import type { InstallResult, InstallTarget, AuditReport } from "./types.ts";
+import { auditPackage } from "./audit.ts";
+import { getNpmPackageMeta } from "../registries/npm.ts";
+
+/** Which agent are we running inside? Detected by probing globals/env. */
+export function detectAgent(): InstallTarget {
+  const env = globalThis.process?.env ?? {};
+  // Pi/omp sets these
+  if (env["PI_VERSION"] || env["OMP_VERSION"]) return "pi";
+  // Claude Code sets this
+  if (env["CLAUDE_CODE"] || env["CLAUDE"]) return "claude";
+  // OpenCode
+  if (env["OPENCODE"]) return "opencode";
+  // Gemini CLI
+  if (env["GEMINI_CLI"]) return "gemini";
+  // Codex
+  if (env["CODEX"]) return "codex";
+  return "auto";
+}
+
+/** Build the install command for a given target. */
+function buildCommand(packageName: string, target: InstallTarget): string {
+  switch (target) {
+    case "pi": return `pi install npm:${packageName}`;
+    case "omp": return `omp plugin install npm:${packageName}`;
+    case "claude": return `claude plugin install npm:${packageName}`;
+    case "opencode": return `opencode plugin ${packageName}`;
+    case "gemini": return `gemini extension install npm:${packageName}`;
+    case "codex": return `codex plugin add npm:${packageName}`;
+    case "auto": return `npm install ${packageName}`;
+  }
+}
+
+/** Resolve a "auto" target by checking package keywords. */
+async function resolveAutoTarget(packageName: string): Promise<InstallTarget> {
+  const meta = await getNpmPackageMeta(packageName);
+  if (!meta) return "auto";
+  const latest = meta["dist-tags"]?.latest;
+  if (!latest) return "auto";
+  const version = meta.versions[latest];
+  const kws = new Set((version?.keywords ?? []).map((k: string) => k.toLowerCase()));
+  if (kws.has("pi-package")) return "pi";
+  if (kws.has("claude-code")) return "claude";
+  if (kws.has("opencode")) return "opencode";
+  if (kws.has("gemini-cli")) return "gemini";
+  if (kws.has("codex")) return "codex";
+  return "auto";
+}
+
+export interface InstallOptions {
+  /** Force the install target instead of auto-detecting. */
+  target?: InstallTarget;
+  /** Skip the pre-install audit. Default false. */
+  skipAudit?: boolean;
+  /** Callback for audit-before-confirmation flow. Returns true to proceed. */
+  confirm?: (report: AuditReport | null) => boolean;
+}
+
+/**
+ * Install a package: audit → confirm → run command.
+ * Never auto-installs. Returns the command and result.
+ */
+export async function installPackage(
+  packageName: string,
+  options: InstallOptions = {},
+): Promise<InstallResult> {
+  // Step 1: Audit (unless skipped)
+  let report: AuditReport | null = null;
+  if (!options.skipAudit) {
+    report = await auditPackage(packageName, { deepScan: true });
+  }
+
+  // Step 2: Confirm
+  if (options.confirm && !options.confirm(report)) {
+    return {
+      packageName,
+      target: options.target ?? "auto",
+      command: "",
+      success: false,
+      message: "Installation cancelled by user.",
+    };
+  }
+
+  // Step 3: Resolve target
+  let target = options.target ?? detectAgent();
+  if (target === "auto") {
+    target = await resolveAutoTarget(packageName);
+  }
+
+  // Step 4: Build and return the command (do not execute — the agent/user runs it)
+  const command = buildCommand(packageName, target);
+
+  const riskNote = report && report.risk !== "safe"
+    ? ` ⚠️ Audit risk: ${report.risk.toUpperCase()}`
+    : "";
+
+  return {
+    packageName,
+    target,
+    command,
+    success: true,
+    message: `Ready to install. Run:\n  ${command}${riskNote}`,
+  };
+}

package/src/core/search.ts

@@ -0,0 +1,109 @@
+/**
+ * Unified search engine — aggregates results across all registries.
+ * Deduplicates and ranks by relevance.
+ */
+
+import type { PackageResult, SearchOptions, Ecosystem, RegistrySource } from "./types.ts";
+import { searchNpm, detectEcosystems } from "../registries/npm.ts";
+import { searchClaudeMarketplace } from "../registries/claude.ts";
+import { searchGeminiExtensions } from "../registries/gemini.ts";
+import { searchMcpRegistry } from "../registries/mcp.ts";
+
+/** Determine which registries to query based on options. */
+function registriesForOptions(registry?: RegistrySource | "all"): RegistrySource[] {
+  if (!registry || registry === "all") {
+    return ["npm", "claude-marketplace", "gemini-extensions", "mcp-registry"];
+  }
+  return [registry];
+}
+
+/** Map a user-facing ecosystem filter to npm ecosystem list for the npm adapter. */
+function ecosystemsForFilter(ecosystem?: Ecosystem | "all"): Ecosystem[] | undefined {
+  if (!ecosystem || ecosystem === "all") return undefined;
+  // pi and omp share the same npm keyword
+  if (ecosystem === "omp") return ["pi"];
+  return [ecosystem];
+}
+
+/** Deduplicate results by package name, preferring npm source for richer metadata. */
+function deduplicate(results: PackageResult[]): PackageResult[] {
+  const byName = new Map<string, PackageResult>();
+  for (const r of results) {
+    const key = r.name.toLowerCase();
+    const existing = byName.get(key);
+    if (!existing) {
+      byName.set(key, r);
+    } else {
+      // Merge: union ecosystems, keep richer source
+      byName.set(key, {
+        ...existing,
+        ecosystems: [...new Set([...existing.ecosystems, ...r.ecosystems])],
+        source: existing.source === "npm" ? existing.source : r.source,
+      });
+    }
+  }
+  return [...byName.values()];
+}
+
+/** Score a result by how well it matches the query. */
+function scoreResult(result: PackageResult, query: string): number {
+  const q = query.toLowerCase().trim();
+  if (!q) return 0;
+
+  const name = result.name.toLowerCase();
+  const desc = result.description.toLowerCase();
+
+  let score = 0;
+  if (name === q) score += 100;
+  else if (name.startsWith(q)) score += 50;
+  else if (name.includes(q)) score += 25;
+  if (desc.includes(q)) score += 10;
+  // Prefer packages with known ecosystems
+  score += result.ecosystems.filter(e => e !== "unknown").length * 5;
+  return score;
+}
+
+/** Execute a unified search across all configured registries. */
+export async function search(options: SearchOptions): Promise<PackageResult[]> {
+  const limit = options.limit ?? 20;
+  const registries = registriesForOptions(options.registry);
+  const ecosystems = ecosystemsForFilter(options.ecosystem);
+
+  const queries: Promise<PackageResult[]>[] = [];
+
+  if (registries.includes("npm")) {
+    queries.push(searchNpm(options.query, { ecosystems, type: options.type, limit }));
+  }
+  if (registries.includes("claude-marketplace")) {
+    queries.push(searchClaudeMarketplace(options.query, limit));
+  }
+  if (registries.includes("gemini-extensions")) {
+    queries.push(searchGeminiExtensions(options.query, limit));
+  }
+  if (registries.includes("mcp-registry")) {
+    queries.push(searchMcpRegistry(options.query, limit));
+  }
+
+  const settled = await Promise.allSettled(queries);
+  let results = settled
+    .filter((s): s is PromiseFulfilledResult<PackageResult[]> => s.status === "fulfilled")
+    .flatMap(s => s.value);
+
+  // Filter by type
+  if (options.type && options.type !== "all") {
+    results = results.filter(r => r.type === options.type);
+  }
+
+  // Filter by ecosystem
+  if (options.ecosystem && options.ecosystem !== "all") {
+    results = results.filter(r => r.ecosystems.includes(options.ecosystem as Ecosystem));
+  }
+
+  // Deduplicate
+  results = deduplicate(results);
+
+  // Rank: exact name > name prefix > name contains > description match
+  results.sort((a, b) => scoreResult(b, options.query) - scoreResult(a, options.query));
+
+  return results.slice(0, limit);
+}

package/src/core/tui.ts

@@ -0,0 +1,176 @@
+/**
+ * TUI display layer — formatting helpers for search results, detail cards,
+ * audit reports, and interactive option builders.
+ *
+ * Uses Unicode icons + box-drawing for terminal rendering.
+ */
+
+import type { PackageResult, PackageDetail, AuditReport, Ecosystem, PackageType, AuditSeverity } from "./types.ts";
+
+const TYPE_ICON: Record<PackageType, string> = {
+  extension: "🔧",
+  skill: "⭐",
+  theme: "🎨",
+  prompt: "📝",
+  plugin: "📦",
+  mcp: "🔌",
+  unknown: "❓",
+};
+
+const ECO_LABEL: Record<Ecosystem, string> = {
+  pi: "pi",
+  omp: "omp",
+  claude: "claude",
+  opencode: "opencode",
+  gemini: "gemini",
+  codex: "codex",
+  universal: "universal",
+  unknown: "?",
+};
+
+const SEVERITY_ICON: Record<AuditSeverity, string> = {
+  critical: "🔴",
+  high: "🟠",
+  medium: "🟡",
+  low: "🟢",
+  info: "ℹ️",
+};
+
+const RISK_ICON: Record<AuditReport["risk"], string> = {
+  safe: "✅",
+  low: "🟢",
+  moderate: "🟡",
+  high: "🟠",
+  critical: "🔴",
+};
+
+/** Format a single result as a one-line select option. */
+export function formatResultOption(result: PackageResult, index: number): { label: string; value: string } {
+  const icon = TYPE_ICON[result.type] ?? "📦";
+  const eco = result.ecosystems
+    .filter(e => e !== "unknown")
+    .map(e => ECO_LABEL[e])
+    .join(",");
+  const desc = result.description.length > 70
+    ? result.description.slice(0, 67) + "..."
+    : result.description;
+  const ver = result.version ? ` v${result.version}` : "";
+  return {
+    label: `${icon} [${index + 1}] ${result.name}${ver} (${eco}) — ${desc}`,
+    value: String(index),
+  };
+}
+
+/** Format results for ctx.ui.select(). */
+export function buildSelectOptions(results: PackageResult[]): Array<{ label: string; value: string }> {
+  return results.map((r, i) => formatResultOption(r, i));
+}
+
+/** Format a detailed package card. */
+export function formatDetailCard(detail: PackageDetail): string {
+  const icon = TYPE_ICON[detail.type] ?? "📦";
+  const eco = detail.ecosystems.filter(e => e !== "unknown").map(e => ECO_LABEL[e]).join(", ") || "npm";
+  const lines: string[] = [
+    `━━━ ${icon} ${detail.name} v${detail.version ?? "?"} [${eco}] ━━━`,
+    "",
+  ];
+
+  if (detail.description) lines.push(`  ${detail.description}`);
+  lines.push("");
+  if (detail.license) lines.push(`  License:      ${detail.license}`);
+  if (detail.dependencyCount !== undefined) lines.push(`  Dependencies: ${detail.dependencyCount}`);
+  if (detail.size) lines.push(`  Size:         ${(detail.size / 1024).toFixed(1)} KB`);
+  if (detail.fileCount) lines.push(`  Files:        ${detail.fileCount}`);
+  if (detail.publishedAt) lines.push(`  Published:    ${detail.publishedAt.slice(0, 10)}`);
+  if (detail.npmUrl) lines.push(`  npm:          ${detail.npmUrl}`);
+  if (detail.repository) lines.push(`  Repository:   ${detail.repository}`);
+
+  lines.push("");
+  if (detail.installCommand) lines.push(`  ▶ Install: ${detail.installCommand}`);
+
+  return lines.join("\n");
+}
+
+/** Format an audit report for display. */
+export function formatAuditReport(report: AuditReport): string {
+  const riskIcon = RISK_ICON[report.risk];
+  const lines: string[] = [
+    `${riskIcon} Security Audit: ${report.packageName} v${report.version ?? "?"}`,
+    `   Risk: ${report.risk.toUpperCase()}`,
+    `   Deep scan: ${report.deepScanned ? "yes (source code scanned)" : "no (metadata only)"}`,
+    "",
+  ];
+
+  if (report.findings.length === 0) {
+    lines.push("   ✅ No security issues found.");
+  } else {
+    lines.push(`   ${report.findings.length} finding(s):`);
+    for (const f of report.findings.slice(0, 20)) {
+      const icon = SEVERITY_ICON[f.severity];
+      const loc = f.file ? ` ${f.file}${f.line ? `:${f.line}` : ""}` : "";
+      lines.push(`   ${icon} [${f.severity.toUpperCase()}] ${f.reason}${loc}`);
+    }
+    if (report.findings.length > 20) {
+      lines.push(`   ... and ${report.findings.length - 20} more`);
+    }
+  }
+
+  return lines.join("\n");
+}
+
+/** Format a help message for /zmarketplace with no args. */
+export function formatHelp(): string {
+  return [
+    "📦 zmarketplace — cross-agent package search",
+    "",
+    "Usage:",
+    "  /zmarketplace search <query>     Search across all registries",
+    "  /zmarketplace detail <id|name>   Show package details",
+    "  /zmarketplace audit <id|name>    Run security audit",
+    "  /zmarketplace install <id|name>  Audit + install a package",
+    "",
+    "Options for 'search':",
+    "  --type=<type>        Filter: extension, skill, theme, prompt, plugin, mcp",
+    "  --eco=<ecosystem>    Filter: pi, claude, opencode, gemini, codex",
+    "  --limit=<n>          Max results (default 20)",
+    "",
+    "Registries: npm + Claude marketplace + Gemini extensions",
+    "",
+    "Examples:",
+    "  /zmarketplace search mcp",
+    "  /zmarketplace search subagent --eco=pi",
+    "  /zmarketplace install 3",
+    "  /zmarketplace audit pi-mcp-adapter",
+  ].join("\n");
+}
+
+/** Parse CLI-style args from the command input. */
+export interface ParsedArgs {
+  subcommand: string;
+  positional: string[];
+  flags: Record<string, string>;
+}
+
+export function parseArgs(args: string[]): ParsedArgs {
+  const positional: string[] = [];
+  const flags: Record<string, string> = {};
+  let subcommand = "";
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const eq = arg.indexOf("=");
+      if (eq !== -1) {
+        flags[arg.slice(2, eq)] = arg.slice(eq + 1);
+      } else {
+        flags[arg.slice(2)] = "true";
+      }
+    } else if (!subcommand) {
+      subcommand = arg;
+    } else {
+      positional.push(arg);
+    }
+  }
+
+  return { subcommand, positional, flags };
+}

package/src/core/types.ts

@@ -0,0 +1,135 @@
+/**
+ * Core types for zmarketplace — unified package model across all registries.
+ */
+
+/** Which agent ecosystem a package targets. */
+export type Ecosystem = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "universal" | "unknown";
+
+/** Package resource type. */
+export type PackageType = "extension" | "skill" | "theme" | "prompt" | "plugin" | "mcp" | "unknown";
+
+/** Which registry a result came from. */
+export type RegistrySource = "npm" | "claude-marketplace" | "gemini-extensions" | "pi-dev" | "mcp-registry";
+
+/** A normalized search result — the common currency across all registries. */
+export interface PackageResult {
+  /** Canonical package name (npm name, or marketplace entry name). */
+  name: string;
+  /** Short description. */
+  description: string;
+  /** Semantic version if known. */
+  version?: string;
+  /** Author display name or handle. */
+  author?: string;
+  /** Which ecosystems this package targets. */
+  ecosystems: Ecosystem[];
+  /** Resource type. */
+  type: PackageType;
+  /** Which registry surfaced this result. */
+  source: RegistrySource;
+  /** Homepage or repository URL. */
+  homepage?: string;
+  /** npm registry URL. */
+  npmUrl?: string;
+  /** Repository URL. */
+  repository?: string;
+  /** Download counts if available (monthly). */
+  downloads?: number;
+  /** Last published date (ISO string). */
+  publishedAt?: string;
+  /** License. */
+  license?: string;
+  /** Install command string for the detected/queried ecosystem. */
+  installCommand?: string;
+}
+
+/** Options for a search operation. */
+export interface SearchOptions {
+  query: string;
+  /** Filter by resource type. */
+  type?: PackageType | "all";
+  /** Filter by ecosystem. */
+  ecosystem?: Ecosystem | "all";
+  /** Filter by specific registry. */
+  registry?: RegistrySource | "all";
+  /** Max results total. Default 20. */
+  limit?: number;
+}
+
+/** Detailed package info — richer than PackageResult. */
+export interface PackageDetail extends PackageResult {
+  /** Full README or long description. */
+  readme?: string;
+  /** Dependencies count. */
+  dependencyCount?: number;
+  /** Unpacked size in bytes. */
+  size?: number;
+  /** File count in the tarball. */
+  fileCount?: number;
+  /** Keywords from npm. */
+  keywords?: string[];
+  /** Pi/omp manifest if present. */
+  piManifest?: Record<string, unknown>;
+  /** Claude plugin manifest if present. */
+  claudeManifest?: Record<string, unknown>;
+  /** Gemini extension manifest if present. */
+  geminiManifest?: Record<string, unknown>;
+}
+
+/** Severity for audit findings. */
+export type AuditSeverity = "critical" | "high" | "medium" | "low" | "info";
+
+/** A single security finding from the audit. */
+export interface AuditFinding {
+  severity: AuditSeverity;
+  /** Pattern that was matched. */
+  pattern: string;
+  /** File where the match was found. */
+  file?: string;
+  /** Line number. */
+  line?: number;
+  /** Excerpt of the matching code. */
+  excerpt?: string;
+  /** Explanation of why this is flagged. */
+  reason: string;
+}
+
+/** Result of a security audit. */
+export interface AuditReport {
+  packageName: string;
+  version?: string;
+  /** Overall risk rating. */
+  risk: "safe" | "low" | "moderate" | "high" | "critical";
+  /** Metadata-based findings (Layer 1 — zero cost). */
+  metadataFindings: AuditFinding[];
+  /** Source-scan findings (Layer 2 — requires tarball download). */
+  sourceFindings: AuditFinding[];
+  /** All findings combined. */
+  findings: AuditFinding[];
+  /** Whether a deep source scan was performed. */
+  deepScanned: boolean;
+  /** Summary text for display. */
+  summary: string;
+}
+
+/** Install target — which agent's install command to use. */
+export type InstallTarget = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "auto";
+
+/** Result of an install operation. */
+export interface InstallResult {
+  packageName: string;
+  target: InstallTarget;
+  command: string;
+  success: boolean;
+  message: string;
+}
+
+/** Keywords that mark packages for each ecosystem on npm. */
+export const ECOSYSTEM_KEYWORDS: Record<Exclude<Ecosystem, "unknown" | "universal">, string[]> = {
+  pi: ["pi-package"],
+  omp: ["pi-package"],
+  claude: ["claude-code", "claude-code-plugin", "cc-plugin"],
+  opencode: ["opencode", "opencode-plugin"],
+  gemini: ["gemini-cli", "gemini-extension", "gemini-cli-extension"],
+  codex: ["codex", "codex-plugin", "codex-cli"],
+};