zmarketplace 0.4.6 → 0.5.3

package/README.md

@@ -1,84 +1,116 @@
 # zmarketplace
 
-Cross-agent marketplace search plugin. Type `/zmarketplace` in pi/omp to search, inspect, audit, and install packages across npm, Claude marketplace, and Gemini extensions.
+Cross-agent package marketplace search. One `/zmarketplace` command searches npm, Claude marketplace, Gemini extensions, and the official MCP registry — then browse, audit, and install.
 
 ## Install
 
 ```bash
-# pi / omp (slash command)
 pi install npm:zmarketplace
-# or link locally:
-omp plugin link ./search_marketplace
-
-# then in omp TUI:
-/reload
-/zmarketplace search mcp
 ```
 
-## Usage
-
-```
-/zmarketplace search <query> [--type=<type>] [--eco=<ecosystem>] [--limit=<n>]
-/zmarketplace detail <id|name>
-/zmarketplace audit <id|name>
-/zmarketplace install <id|name>
+Or omp:
+```bash
+omp plugin install npm:zmarketplace
 ```
 
-### Search
+Then `/reload` and type `/zmarketplace`.
+
+## Quick Start
 
 ```
-/zmarketplace search mcp
-/zmarketplace search subagent --eco=pi
-/zmarketplace search theme --type=theme --limit=10
+/zmarketplace
+→ Choose limit: 25 / 50 / 150 / All (paged)
+→ Type query: "mcp"
+→ Browse 50 results per page (← Previous / → Next)
+→ Enter on package → detail + README
+→ Enter on ⬇ Install → choose ecosystem → command at bottom
 ```
 
-Opens an interactive select list. Scroll up/down, type to filter, enter to pick.
+## Commands
 
-### Detail + README
+| Command | What |
+|---|---|
+| `/zmarketplace` | Interactive search prompt |
+| `/zmarketplace search <query>` | Search directly |
+| `/zmarketplace search mcp --eco=pi` | Filter by ecosystem |
+| `/zmarketplace search theme --type=theme` | Filter by type |
+| `/zmarketplace detail <name>` | Show package detail |
+| `/zmarketplace audit <name>` | Security scan |
+| `/zmarketplace install <name>` | Install flow |
 
-Pick a package → select "📋 Details + README" → full README in a scrollable list.
+## Detail View
 
-- **Enter on a URL line** (🖼 IMAGE, 🔗 link) → opens in your browser
-- **Enter on text** → stays in detail view
-- **Type to search** → filters README lines
-- **ESC or "Back to menu"** → returns to action menu
+```
+ learnship — Details
+
+ ❯ ⬇ Install (audit first)
+   🔒 Audit only
+   ↩ Back to results
+   📦 learnship v2.4.0 — MIT · 0 deps · 1296KB
+   Learn as you build. Build with intent.
+   🔗 https://www.npmjs.com/package/learnship
+   🔗 https://github.com/FavioVazquez/learnship
+   ━━━ README ━━━
+   # learnship
+   ...40 lines of README...
+   ...(see npm for full README)
+   ✅ Run: pi install npm:learnship
+```
+
+- **Actions at top** — Install / Audit / Back
+- **README below** — 40 lines, scrollable
+- **Enter on 🔗 or 🖼** — opens URL in browser
+- **Enter on text** — stays in detail
+- **Selected command at bottom** — after picking install option
 
-### Install
+## Install Options
 
-Pick "⬇ Install" → choose ecosystem:
+After audit, choose how to install:
 
 | Option | Command |
 |---|---|
-| 🥧 pi install | `pi install npm:<name>` |
-| ⌥ omp install | `omp plugin install npm:<name>` |
-| 🤖 claude install | `claude plugin install npm:<name>` |
-| 🔓 opencode install | `opencode plugin <name>` |
-| 💎 gemini install | `gemini extension install <url>` |
-| 🔲 codex install | `codex plugin add npm:<name>` |
-| 📦 npm install | `npm install <name>` |
+| 🥧 pi | `pi install npm:<name>` |
+| ⌥ omp | `omp plugin install npm:<name>` |
+| 🤖 claude | `claude plugin install npm:<name>` |
+| 🔓 opencode | `opencode plugin <name>` |
+| 💎 gemini | `gemini extension install <url>` |
+| 🔲 codex | `codex plugin add npm:<name>` |
+| 📦 npm | `npm install <name>` |
+| 🟤 bun | `bun add <name>` |
+| 📦 pnpm | `pnpm add <name>` |
 | ⚡ bunx | `bunx <name>` |
 
-Quick security check runs before showing the command. High-risk packages require confirmation.
+High-risk packages require confirmation before showing the command.
 
-### Audit
+## Security Audit
 
-```
-/zmarketplace audit pi-mcp-adapter
-```
+| Layer | What it checks |
+|---|---|
+| Metadata | Dependency count, file count, size, license |
+| Source scan | Downloads tarball, scans `.ts`/`.js` for `eval()`, `execSync()`, `rm -rf`, `child_process`, `process.env`, HTTP calls |
 
-Two-layer security scan:
-- **Layer 1 (metadata):** dependency count, file count, size, license
-- **Layer 2 (source):** downloads tarball, scans `.ts`/`.js` for dangerous patterns (`rm -rf`, `eval()`, `execSync()`, `child_process`, etc.)
+Severity levels: 🔴 critical · 🟠 high · 🟡 medium · 🟢 low
 
 ## Registries
 
-| Source | Coverage |
+| Registry | Coverage |
 |---|---|
-| npm | `pi-package`, `claude-code`, `opencode`, `gemini-cli`, `codex` keywords |
-| Claude marketplace | `anthropics/claude-plugins-official` + community (~800+ plugins) |
-| Gemini extensions | `geminicli.com/extensions.json` (~993 extensions) |
+| npm | `pi-package`, `claude-code`, `opencode`, `gemini-cli`, `codex`, `npm`, `bun`, `pnpm` keywords |
+| Claude marketplace | Official + community (~800+ plugins) |
+| Gemini extensions | geminicli.com (~993 extensions) |
+| MCP registry | registry.modelcontextprotocol.io (official) |
+
+All queried in parallel, deduplicated, ranked by relevance.
+
+## Filters
+
+```
+--type=extension    extension, skill, theme, prompt, plugin, mcp
+--eco=pi            pi, claude, opencode, gemini, codex, npm
+--limit=50          25, 50, 150, All (paged at 50/page)
+```
 
-## CLI (standalone, no agent needed)
+## CLI (standalone)
 
 ```bash
 bunx zmarketplace search "mcp" --limit=5
@@ -87,40 +119,44 @@ bunx zmarketplace audit pi-marketplace
 bunx zmarketplace install pi-marketplace
 ```
 
+Works without any agent. Same core, different interface.
+
 ## Architecture
 
 ```
 src/
-├── index.ts          ← pi/omp extension: registerCommand("/zmarketplace")
-├── cli.ts            ← standalone CLI: bunx zmarketplace
-├── opencode.ts       ← opencode plugin entry
+├── index.ts              pi/omp extension (registerCommand)
+├── cli.ts                standalone CLI (bunx zmarketplace)
+├── opencode.ts           opencode plugin entry
 ├── core/
-│   ├── types.ts      ← unified package model
-│   ├── search.ts     ← cross-registry search + dedup + ranking
-│   ├── detail.ts     ← npm metadata + README fetch
-│   ├── audit.ts      ← 2-layer security scanner
-│   ├── install.ts    ← agent detection + install command dispatch
-│   ├── cache.ts      ← results cache for ID-based reference
-│   └── tui.ts        ← icons, formatting, arg parser
+│   ├── types.ts          unified package model + ecosystem keywords
+│   ├── search.ts         cross-registry search + dedup + ranking
+│   ├── detail.ts         npm metadata + README fetch
+│   ├── audit.ts          2-layer security scanner
+│   ├── install.ts        agent detection + command dispatch
+│   ├── cache.ts          results cache for ID reference
+│   └── tui.ts            icons, formatting, arg parser, help text
 └── registries/
-    ├── npm.ts        ← npm registry (parallel per-keyword queries)
-    ├── claude.ts     ← Claude marketplace JSON
-    └── gemini.ts     ← Gemini CLI extensions registry
+    ├── npm.ts            npm registry (parallel per-keyword queries)
+    ├── claude.ts         Claude marketplace JSON
+    ├── gemini.ts         Gemini CLI extensions registry
+    └── mcp.ts            Official MCP registry
 ```
 
-## Cross-agent manifests
+## Compatibility
 
-| File | Ecosystem |
-|---|---|
-| `package.json` (`pi.extensions`, `omp.extensions`) | Pi, OMP |
-| `package.json` (`bin`, `exports`) | CLI, OpenCode |
-| `.claude-plugin/plugin.json` | Claude Code |
-| `gemini-extension.json` | Gemini CLI |
-| `.codex-plugin/plugin.json` | Codex |
+| Agent | Status | How |
+|---|---|---|
+| pi | ✅ Works | `pi install npm:zmarketplace` |
+| omp | ✅ Works | `omp plugin install npm:zmarketplace` |
+| OpenCode | ✅ Plugin entry | `opencode plugin zmarketplace` |
+| Claude Code | ✅ CLI | `bunx zmarketplace search "mcp"` |
+| Gemini CLI | ✅ CLI | `bunx zmarketplace search "mcp"` |
+| Codex | ✅ CLI | `bunx zmarketplace search "mcp"` |
 
-## Support
+Zero runtime dependencies. TypeScript with Bun. No Bun-specific APIs (works on pi's jiti/Node loader).
 
-If this plugin helped you, consider supporting:
+## Support
 
 ☕ [ko-fi.com/zicodev](https://ko-fi.com/zicodev)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zmarketplace",
-  "version": "0.4.6",
+  "version": "0.5.3",
   "description": "Cross-agent marketplace search: find, audit, and install plugins/skills/themes/prompts across pi, omp, claude code, opencode, gemini cli, and codex",
   "license": "MIT",
   "type": "module",
@@ -20,6 +20,7 @@
     "opencode",
     "gemini-cli",
     "codex",
+    "npm",
     "marketplace",
     "plugin",
     "search",

package/src/core/install.ts

@@ -31,8 +31,9 @@ function buildCommand(packageName: string, target: InstallTarget): string {
     case "claude": return `claude plugin install npm:${packageName}`;
     case "opencode": return `opencode plugin ${packageName}`;
     case "gemini": return `gemini extension install npm:${packageName}`;
-    case "codex": return `codex plugin add npm:${packageName}`;
-    case "auto": return `npm install ${packageName}`;
+    case "npm":
+    case "auto":
+    default: return `npm install ${packageName}`;
   }
 }
 
@@ -49,6 +50,7 @@ async function resolveAutoTarget(packageName: string): Promise<InstallTarget> {
   if (kws.has("opencode")) return "opencode";
   if (kws.has("gemini-cli")) return "gemini";
   if (kws.has("codex")) return "codex";
+  if (kws.has("npm") || kws.has("bun") || kws.has("nodejs")) return "npm";
   return "auto";
 }
 

package/src/core/search.ts

@@ -20,7 +20,6 @@ function registriesForOptions(registry?: RegistrySource | "all"): RegistrySource
 /** Map a user-facing ecosystem filter to npm ecosystem list for the npm adapter. */
 function ecosystemsForFilter(ecosystem?: Ecosystem | "all"): Ecosystem[] | undefined {
   if (!ecosystem || ecosystem === "all") return undefined;
-  // pi and omp share the same npm keyword
   if (ecosystem === "omp") return ["pi"];
   return [ecosystem];
 }

package/src/core/tui.ts

@@ -24,6 +24,7 @@ const ECO_LABEL: Record<Ecosystem, string> = {
   opencode: "opencode",
   gemini: "gemini",
   codex: "codex",
+  npm: "npm",
   universal: "universal",
   unknown: "?",
 };
@@ -131,10 +132,10 @@ export function formatHelp(): string {
     "",
     "Options for 'search':",
     "  --type=<type>        Filter: extension, skill, theme, prompt, plugin, mcp",
-    "  --eco=<ecosystem>    Filter: pi, claude, opencode, gemini, codex",
+    "  --eco=<ecosystem>    Filter: pi, claude, opencode, gemini, codex, npm",
     "  --limit=<n>          Max results (default 20)",
     "",
-    "Registries: npm + Claude marketplace + Gemini extensions",
+    "Registries: npm + Claude marketplace + Gemini extensions + MCP registry",
     "",
     "Examples:",
     "  /zmarketplace search mcp",

package/src/core/types.ts

@@ -3,7 +3,7 @@
  */
 
 /** Which agent ecosystem a package targets. */
-export type Ecosystem = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "universal" | "unknown";
+export type Ecosystem = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "npm" | "universal" | "unknown";
 
 /** Package resource type. */
 export type PackageType = "extension" | "skill" | "theme" | "prompt" | "plugin" | "mcp" | "unknown";
@@ -113,7 +113,7 @@ export interface AuditReport {
 }
 
 /** Install target — which agent's install command to use. */
-export type InstallTarget = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "auto";
+export type InstallTarget = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "npm" | "auto";
 
 /** Result of an install operation. */
 export interface InstallResult {
@@ -132,4 +132,5 @@ export const ECOSYSTEM_KEYWORDS: Record<Exclude<Ecosystem, "unknown" | "universa
   opencode: ["opencode", "opencode-plugin"],
   gemini: ["gemini-cli", "gemini-extension", "gemini-cli-extension"],
   codex: ["codex", "codex-plugin", "codex-cli"],
+  npm: ["npm", "bun", "pnpm", "yarn", "nodejs", "deno"],
 };

package/src/index.ts

@@ -10,6 +10,7 @@ import { auditPackage } from "./core/audit.ts";
 import { cacheResults, resolveRef, cacheAudit } from "./core/cache.ts";
 import { formatResultOption, formatAuditReport, formatHelp, parseArgs } from "./core/tui.ts";
 import type { PackageResult } from "./core/types.ts";
+import { spawn } from "node:child_process";
 
 // ── Types ──────────────────────────────────────────────────────────────────
 
@@ -26,9 +27,9 @@ interface Ctx { cwd: string; hasUI: boolean; ui: UI }
 // ── Helpers ────────────────────────────────────────────────────────────────
 
 function openUrl(url: string): void {
-  if (process.platform === "win32") Bun.spawn(["cmd", "/c", "start", "", url], { stdout: "ignore", stderr: "ignore" });
-  else if (process.platform === "darwin") Bun.spawn(["open", url], { stdout: "ignore", stderr: "ignore" });
-  else Bun.spawn(["xdg-open", url], { stdout: "ignore", stderr: "ignore" });
+  const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
 }
 
 function extractUrl(line: string, repoBase?: string): string | null {
@@ -96,36 +97,34 @@ async function packageDetail(pkg: PackageResult, ctx: Ctx): Promise<void> {
     "⬇ Install (audit first)",
     "🔒 Audit only",
     "↩ Back to results",
-    "━━━ Package ━━━",
-    `📦 ${detail.name} v${detail.version ?? "?"}`,
+    `📦 ${detail.name} v${detail.version ?? "?"} — ${detail.license ?? "?"} · ${detail.dependencyCount ?? "?"} deps · ${detail.size ? (detail.size / 1024).toFixed(0) + "KB" : "?"}`,
     detail.description || "",
-    `License: ${detail.license ?? "?"}  Deps: ${detail.dependencyCount ?? "?"}  Size: ${detail.size ? (detail.size / 1024).toFixed(1) + " KB" : "?"}`,
-    `Published: ${detail.publishedAt?.slice(0, 10) ?? "?"}`,
   ];
-  if (detail.keywords?.length) lines.push(`Keywords: ${detail.keywords.join(", ")}`);
   if (detail.npmUrl) lines.push(`🔗 ${detail.npmUrl}`);
   if (repoBase) lines.push(`🔗 ${repoBase}`);
 
   if (detail.readme) {
-    lines.push("━━━ README (enter on 🔗/🖼 to open) ━━━");
+    lines.push("━━━ README (40 lines — enter on 🔗 to open) ━━━");
     const rl = detail.readme
-      .replace(/!\[.*?\]\((https?:\/\/[^)]+)\)/g, "\n🖼 IMAGE: $1\n")
-      .replace(/!\[.*?\]\(([^)]+)\)/g, (_m, p) => `\n🖼 IMAGE: ${repoBase ? repoBase + "/raw/main/" + p.replace(/^\.\//, "") : p}\n`)
+      .replace(/!\[.*?\]\((https?:\/\/[^)]+)\)/g, "\n🖼 $1\n")
+      .replace(/!\[.*?\]\(([^)]+)\)/g, (_m, p) => `\n🖼 ${repoBase ? repoBase + "/raw/main/" + p.replace(/^\.\//, "") : p}\n`)
       .replace(/\[([^\]]+)\]\((https?:\/\/[^)]+)\)/g, "$1 → $2")
-      .replace(/<img[^>]*src=["']([^"']+)["'][^>]*>/gi, (_m, p) => `\n🖼 IMAGE: ${p}\n`)
-      .replace(/<a[^>]*href=["']([^"']+)["'][^>]*>(.*?)<\/a>/gi, "$2 → $1")
       .replace(/<[^>]+>/g, "")
       .split("\n").map(l => l.trimEnd()).filter(l => l.length > 0)
-      .slice(0, 150);
+      .slice(0, 40);
     lines.push(...rl);
-    if (detail.readme.length > 8000) lines.push("...(truncated — see npm for full README)");
+    lines.push("...(see npm for full README)");
   }
 
   while (true) {
     const selected = await ctx.ui.select(`${detail.name} — Details`, lines);
-    if (!selected) continue;  // ESC → stay in detail, don't quit to results
+    if (!selected) continue;
     if (selected.includes("Back to results")) return;
-    if (selected.includes("Install")) { await doInstall(pkg, ctx); continue; }  // stay in detail after install
+    if (selected.includes("Install")) {
+      const cmd = await doInstall(pkg, ctx);
+      if (cmd) lines.push(`✅ Run: ${cmd}`);  // show command at BOTTOM
+      continue;
+    }
     if (selected.includes("Audit only")) { await doAudit(pkg.name, ctx); continue; }
     const url = extractUrl(selected, repoBase);
     if (url) { openUrl(url); ctx.ui.notify("🌐 Opened in browser", "info"); }
@@ -151,7 +150,7 @@ async function doAudit(name: string, ctx: Ctx): Promise<void> {
 
 // ── Install (audit FIRST, then options) ────────────────────────────────────
 
-async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<void> {
+async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<string | null> {
   // Audit first
   ctx.ui.setStatus?.(`Auditing ${pkg.name} before install...`);
   const report = await auditPackage(pkg.name, { deepScan: true });
@@ -182,6 +181,12 @@ async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<void> {
     if (eco === "opencode" && !seen.has("opencode")) { seen.add("opencode"); addCmd("🔓 opencode", `opencode plugin ${pkg.name}`); }
     if (eco === "gemini" && !seen.has("gemini")) { seen.add("gemini"); addCmd("💎 gemini", `gemini extension install ${pkg.repository ?? pkg.name}`); }
     if (eco === "codex" && !seen.has("codex")) { seen.add("codex"); addCmd("🔲 codex", `codex plugin add npm:${pkg.name}`); }
+    if (eco === "npm" && !seen.has("npm")) {
+      seen.add("npm");
+      addCmd("📦 npm", `npm install ${pkg.name}`);
+      addCmd("🟤 bun add", `bun add ${pkg.name}`);
+      addCmd("📦 pnpm add", `pnpm add ${pkg.name}`);
+    }
   }
   if (!seen.has("npm")) addCmd("📦 npm", `npm install ${pkg.name}`);
   addCmd("⚡ bunx", `bunx ${pkg.name}`);
@@ -190,13 +195,14 @@ async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<void> {
   // High risk confirmation
   if (report.risk === "critical" || report.risk === "high") {
     const proceed = await ctx.ui.confirm(`${report.risk} risk`, `⚠️ ${pkg.name}: ${report.findings.length} security findings. Install anyway?`);
-    if (!proceed) { ctx.ui.notify("Cancelled.", "info"); return; }
+    if (!proceed) { ctx.ui.notify("Cancelled.", "info"); return null; }
   }
 
   const choice = await ctx.ui.select(`Install ${pkg.name} — Risk: ${report.risk}`, cmds);
-  if (!choice || choice === "↩ Cancel") return;
+  if (!choice || choice === "↩ Cancel") return null;
   const command = cmdMap.get(choice);
   if (command) ctx.ui.notify(`✅ Run:\n  ${command}`, "info");
+  return command ?? null;
 }
 
 // ── Factory ────────────────────────────────────────────────────────────────

package/src/registries/npm.ts

@@ -54,6 +54,7 @@ export function detectEcosystems(keywords?: string[], name?: string): Ecosystem[
   if (kws.has("opencode") || kws.has("opencode-plugin") || n.includes("opencode")) result.push("opencode");
   if (kws.has("gemini-cli") || kws.has("gemini-extension") || kws.has("gemini-cli-extension") || n.includes("gemini")) result.push("gemini");
   if (kws.has("codex") || kws.has("codex-plugin") || kws.has("codex-cli") || n.includes("codex")) result.push("codex");
+  if (kws.has("npm") || kws.has("bun") || kws.has("pnpm") || kws.has("yarn") || kws.has("nodejs") || kws.has("deno")) result.push("npm");
 
   if (result.length === 0) result.push("unknown");
   return result;
@@ -83,7 +84,7 @@ export function installCommandFor(name: string, ecosystem: Ecosystem): string {
     case "claude": return `claude plugin install npm:${name}`;
     case "opencode": return `opencode plugin ${name}`;
     case "gemini": return `gemini extension install npm:${name}`;
-    case "codex": return `codex plugin add npm:${name}`;
+    case "npm": return `npm install ${name}`;
     default: return `npm install ${name}`;
   }
 }
@@ -96,7 +97,7 @@ export async function searchNpm(
   const limit = options.limit ?? 25;
   const allEcosystems: Ecosystem[] = options.ecosystems && options.ecosystems.length > 0
     ? options.ecosystems
-    : ["pi", "claude", "opencode", "gemini", "codex"];
+    : ["pi", "claude", "opencode", "gemini", "codex", "npm"];
 
   // Collect unique keywords for the selected ecosystems
   const keywords = new Set<string>();