zmarketplace 0.4.7 → 0.7.2

package/README.md

@@ -1,84 +1,116 @@
 # zmarketplace
 
-Cross-agent marketplace search plugin. Type `/zmarketplace` in pi/omp to search, inspect, audit, and install packages across npm, Claude marketplace, and Gemini extensions.
+Cross-agent package marketplace search. One `/zmarketplace` command searches npm, Claude marketplace, Gemini extensions, and the official MCP registry — then browse, audit, and install.
 
 ## Install
 
 ```bash
-# pi / omp (slash command)
 pi install npm:zmarketplace
-# or link locally:
-omp plugin link ./search_marketplace
-
-# then in omp TUI:
-/reload
-/zmarketplace search mcp
 ```
 
-## Usage
-
-```
-/zmarketplace search <query> [--type=<type>] [--eco=<ecosystem>] [--limit=<n>]
-/zmarketplace detail <id|name>
-/zmarketplace audit <id|name>
-/zmarketplace install <id|name>
+Or omp:
+```bash
+omp plugin install npm:zmarketplace
 ```
 
-### Search
+Then `/reload` and type `/zmarketplace`.
+
+## Quick Start
 
 ```
-/zmarketplace search mcp
-/zmarketplace search subagent --eco=pi
-/zmarketplace search theme --type=theme --limit=10
+/zmarketplace
+→ Choose limit: 25 / 50 / 150 / All (paged)
+→ Type query: "mcp"
+→ Browse 50 results per page (← Previous / → Next)
+→ Enter on package → detail + README
+→ Enter on ⬇ Install → choose ecosystem → command at bottom
 ```
 
-Opens an interactive select list. Scroll up/down, type to filter, enter to pick.
+## Commands
 
-### Detail + README
+| Command | What |
+|---|---|
+| `/zmarketplace` | Interactive search prompt |
+| `/zmarketplace search <query>` | Search directly |
+| `/zmarketplace search mcp --eco=pi` | Filter by ecosystem |
+| `/zmarketplace search theme --type=theme` | Filter by type |
+| `/zmarketplace detail <name>` | Show package detail |
+| `/zmarketplace audit <name>` | Security scan |
+| `/zmarketplace install <name>` | Install flow |
 
-Pick a package → select "📋 Details + README" → full README in a scrollable list.
+## Detail View
 
-- **Enter on a URL line** (🖼 IMAGE, 🔗 link) → opens in your browser
-- **Enter on text** → stays in detail view
-- **Type to search** → filters README lines
-- **ESC or "Back to menu"** → returns to action menu
+```
+ learnship — Details
+
+ ❯ ⬇ Install (audit first)
+   🔒 Audit only
+   ↩ Back to results
+   📦 learnship v2.4.0 — MIT · 0 deps · 1296KB
+   Learn as you build. Build with intent.
+   🔗 https://www.npmjs.com/package/learnship
+   🔗 https://github.com/FavioVazquez/learnship
+   ━━━ README ━━━
+   # learnship
+   ...40 lines of README...
+   ...(see npm for full README)
+   ✅ Run: pi install npm:learnship
+```
+
+- **Actions at top** — Install / Audit / Back
+- **README below** — 40 lines, scrollable
+- **Enter on 🔗 or 🖼** — opens URL in browser
+- **Enter on text** — stays in detail
+- **Selected command at bottom** — after picking install option
 
-### Install
+## Install Options
 
-Pick "⬇ Install" → choose ecosystem:
+After audit, choose how to install:
 
 | Option | Command |
 |---|---|
-| 🥧 pi install | `pi install npm:<name>` |
-| ⌥ omp install | `omp plugin install npm:<name>` |
-| 🤖 claude install | `claude plugin install npm:<name>` |
-| 🔓 opencode install | `opencode plugin <name>` |
-| 💎 gemini install | `gemini extension install <url>` |
-| 🔲 codex install | `codex plugin add npm:<name>` |
-| 📦 npm install | `npm install <name>` |
+| 🥧 pi | `pi install npm:<name>` |
+| ⌥ omp | `omp plugin install npm:<name>` |
+| 🤖 claude | `claude plugin install npm:<name>` |
+| 🔓 opencode | `opencode plugin <name>` |
+| 💎 gemini | `gemini extension install <url>` |
+| 🔲 codex | `codex plugin add npm:<name>` |
+| 📦 npm | `npm install <name>` |
+| 🟤 bun | `bun add <name>` |
+| 📦 pnpm | `pnpm add <name>` |
 | ⚡ bunx | `bunx <name>` |
 
-Quick security check runs before showing the command. High-risk packages require confirmation.
+High-risk packages require confirmation before showing the command.
 
-### Audit
+## Security Audit
 
-```
-/zmarketplace audit pi-mcp-adapter
-```
+| Layer | What it checks |
+|---|---|
+| Metadata | Dependency count, file count, size, license |
+| Source scan | Downloads tarball, scans `.ts`/`.js` for `eval()`, `execSync()`, `rm -rf`, `child_process`, `process.env`, HTTP calls |
 
-Two-layer security scan:
-- **Layer 1 (metadata):** dependency count, file count, size, license
-- **Layer 2 (source):** downloads tarball, scans `.ts`/`.js` for dangerous patterns (`rm -rf`, `eval()`, `execSync()`, `child_process`, etc.)
+Severity levels: 🔴 critical · 🟠 high · 🟡 medium · 🟢 low
 
 ## Registries
 
-| Source | Coverage |
+| Registry | Coverage |
 |---|---|
-| npm | `pi-package`, `claude-code`, `opencode`, `gemini-cli`, `codex` keywords |
-| Claude marketplace | `anthropics/claude-plugins-official` + community (~800+ plugins) |
-| Gemini extensions | `geminicli.com/extensions.json` (~993 extensions) |
+| npm | `pi-package`, `claude-code`, `opencode`, `gemini-cli`, `codex`, `npm`, `bun`, `pnpm` keywords |
+| Claude marketplace | Official + community (~800+ plugins) |
+| Gemini extensions | geminicli.com (~993 extensions) |
+| MCP registry | registry.modelcontextprotocol.io (official) |
+
+All queried in parallel, deduplicated, ranked by relevance.
+
+## Filters
+
+```
+--type=extension    extension, skill, theme, prompt, plugin, mcp
+--eco=pi            pi, claude, opencode, gemini, codex, npm
+--limit=50          25, 50, 150, All (paged at 50/page)
+```
 
-## CLI (standalone, no agent needed)
+## CLI (standalone)
 
 ```bash
 bunx zmarketplace search "mcp" --limit=5
@@ -87,40 +119,44 @@ bunx zmarketplace audit pi-marketplace
 bunx zmarketplace install pi-marketplace
 ```
 
+Works without any agent. Same core, different interface.
+
 ## Architecture
 
 ```
 src/
-├── index.ts          ← pi/omp extension: registerCommand("/zmarketplace")
-├── cli.ts            ← standalone CLI: bunx zmarketplace
-├── opencode.ts       ← opencode plugin entry
+├── index.ts              pi/omp extension (registerCommand)
+├── cli.ts                standalone CLI (bunx zmarketplace)
+├── opencode.ts           opencode plugin entry
 ├── core/
-│   ├── types.ts      ← unified package model
-│   ├── search.ts     ← cross-registry search + dedup + ranking
-│   ├── detail.ts     ← npm metadata + README fetch
-│   ├── audit.ts      ← 2-layer security scanner
-│   ├── install.ts    ← agent detection + install command dispatch
-│   ├── cache.ts      ← results cache for ID-based reference
-│   └── tui.ts        ← icons, formatting, arg parser
+│   ├── types.ts          unified package model + ecosystem keywords
+│   ├── search.ts         cross-registry search + dedup + ranking
+│   ├── detail.ts         npm metadata + README fetch
+│   ├── audit.ts          2-layer security scanner
+│   ├── install.ts        agent detection + command dispatch
+│   ├── cache.ts          results cache for ID reference
+│   └── tui.ts            icons, formatting, arg parser, help text
 └── registries/
-    ├── npm.ts        ← npm registry (parallel per-keyword queries)
-    ├── claude.ts     ← Claude marketplace JSON
-    └── gemini.ts     ← Gemini CLI extensions registry
+    ├── npm.ts            npm registry (parallel per-keyword queries)
+    ├── claude.ts         Claude marketplace JSON
+    ├── gemini.ts         Gemini CLI extensions registry
+    └── mcp.ts            Official MCP registry
 ```
 
-## Cross-agent manifests
+## Compatibility
 
-| File | Ecosystem |
-|---|---|
-| `package.json` (`pi.extensions`, `omp.extensions`) | Pi, OMP |
-| `package.json` (`bin`, `exports`) | CLI, OpenCode |
-| `.claude-plugin/plugin.json` | Claude Code |
-| `gemini-extension.json` | Gemini CLI |
-| `.codex-plugin/plugin.json` | Codex |
+| Agent | Status | How |
+|---|---|---|
+| pi | ✅ Works | `pi install npm:zmarketplace` |
+| omp | ✅ Works | `omp plugin install npm:zmarketplace` |
+| OpenCode | ✅ Plugin entry | `opencode plugin zmarketplace` |
+| Claude Code | ✅ CLI | `bunx zmarketplace search "mcp"` |
+| Gemini CLI | ✅ CLI | `bunx zmarketplace search "mcp"` |
+| Codex | ✅ CLI | `bunx zmarketplace search "mcp"` |
 
-## Support
+Zero runtime dependencies. TypeScript with Bun. No Bun-specific APIs (works on pi's jiti/Node loader).
 
-If this plugin helped you, consider supporting:
+## Support
 
 ☕ [ko-fi.com/zicodev](https://ko-fi.com/zicodev)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zmarketplace",
-  "version": "0.4.7",
+  "version": "0.7.2",
   "description": "Cross-agent marketplace search: find, audit, and install plugins/skills/themes/prompts across pi, omp, claude code, opencode, gemini cli, and codex",
   "license": "MIT",
   "type": "module",
@@ -20,6 +20,7 @@
     "opencode",
     "gemini-cli",
     "codex",
+    "npm",
     "marketplace",
     "plugin",
     "search",

package/src/core/install.ts

@@ -31,8 +31,9 @@ function buildCommand(packageName: string, target: InstallTarget): string {
     case "claude": return `claude plugin install npm:${packageName}`;
     case "opencode": return `opencode plugin ${packageName}`;
     case "gemini": return `gemini extension install npm:${packageName}`;
-    case "codex": return `codex plugin add npm:${packageName}`;
-    case "auto": return `npm install ${packageName}`;
+    case "npm":
+    case "auto":
+    default: return `npm install ${packageName}`;
   }
 }
 
@@ -49,6 +50,7 @@ async function resolveAutoTarget(packageName: string): Promise<InstallTarget> {
   if (kws.has("opencode")) return "opencode";
   if (kws.has("gemini-cli")) return "gemini";
   if (kws.has("codex")) return "codex";
+  if (kws.has("npm") || kws.has("bun") || kws.has("nodejs")) return "npm";
   return "auto";
 }
 

package/src/core/installed.ts

@@ -0,0 +1,75 @@
+/**
+ * Installed packages detector — checks pi and omp for user-installed plugins.
+ * Only checks explicit plugin installs, NOT dependency node_modules.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+export interface InstalledPackage {
+  name: string;
+  version?: string;
+  source: "pi" | "omp";
+}
+
+let cache: InstalledPackage[] | null = null;
+let cacheTime = 0;
+const CACHE_TTL = 10_000;
+
+/** Get user-installed packages from pi and omp (not dependencies). */
+export function getInstalledPackages(): InstalledPackage[] {
+  const now = Date.now();
+  if (cache && now - cacheTime < CACHE_TTL) return cache;
+
+  const results: InstalledPackage[] = [];
+  const home = homedir();
+
+  // omp plugins — from lock file (only explicitly enabled plugins)
+  const ompLock = join(home, ".omp", "plugins", "omp-plugins.lock.json");
+  try {
+    if (existsSync(ompLock)) {
+      const data = JSON.parse(readFileSync(ompLock, "utf8")) as { plugins?: Record<string, { version?: string; enabled?: boolean }> };
+      for (const [name, info] of Object.entries(data.plugins ?? {})) {
+        if (info.enabled !== false) {
+          results.push({ name, version: info.version, source: "omp" });
+        }
+      }
+    }
+  } catch { /* ignore */ }
+
+  // pi packages — from settings.json packages array (NOT node_modules scan)
+  const piSettings = join(home, ".pi", "agent", "settings.json");
+  try {
+    if (existsSync(piSettings)) {
+      const data = JSON.parse(readFileSync(piSettings, "utf8")) as { packages?: string[]; extensions?: string[] };
+      for (const pkg of data.packages ?? []) {
+        // Format: "npm:@scope/name@version" or "npm:name" or "git:..."
+        const cleaned = pkg.replace(/^npm:/, "").replace(/^git:.*\//, "").replace(/@[^@]*$/, "");
+        if (cleaned) results.push({ name: cleaned, source: "pi" });
+      }
+    }
+  } catch { /* ignore */ }
+
+  // Deduplicate (keep first = prefer omp with version info)
+  const seen = new Set<string>();
+  const deduped = results.filter(r => {
+    if (seen.has(r.name)) return false;
+    seen.add(r.name);
+    return true;
+  });
+
+  cache = deduped;
+  cacheTime = now;
+  return deduped;
+}
+
+/** Check if a package name is installed (user plugin, not dependency). */
+export function isInstalled(name: string): boolean {
+  return getInstalledPackages().some(p => p.name === name || p.name === name.replace(/^@[^/]+\//, ""));
+}
+
+/** Get installed version of a package, or undefined. */
+export function getInstalledVersion(name: string): string | undefined {
+  return getInstalledPackages().find(p => p.name === name)?.version;
+}

package/src/core/search.ts

@@ -8,11 +8,13 @@ import { searchNpm, detectEcosystems } from "../registries/npm.ts";
 import { searchClaudeMarketplace } from "../registries/claude.ts";
 import { searchGeminiExtensions } from "../registries/gemini.ts";
 import { searchMcpRegistry } from "../registries/mcp.ts";
+import { searchSmithery } from "../registries/smithery.ts";
+import { searchGitHubTopics } from "../registries/github.ts";
 
 /** Determine which registries to query based on options. */
 function registriesForOptions(registry?: RegistrySource | "all"): RegistrySource[] {
   if (!registry || registry === "all") {
-    return ["npm", "claude-marketplace", "gemini-extensions", "mcp-registry"];
+    return ["npm", "claude-marketplace", "gemini-extensions", "mcp-registry", "smithery", "github"];
   }
   return [registry];
 }
@@ -20,7 +22,6 @@ function registriesForOptions(registry?: RegistrySource | "all"): RegistrySource
 /** Map a user-facing ecosystem filter to npm ecosystem list for the npm adapter. */
 function ecosystemsForFilter(ecosystem?: Ecosystem | "all"): Ecosystem[] | undefined {
   if (!ecosystem || ecosystem === "all") return undefined;
-  // pi and omp share the same npm keyword
   if (ecosystem === "omp") return ["pi"];
   return [ecosystem];
 }
@@ -83,6 +84,12 @@ export async function search(options: SearchOptions): Promise<PackageResult[]> {
   if (registries.includes("mcp-registry")) {
     queries.push(searchMcpRegistry(options.query, limit));
   }
+  if (registries.includes("smithery")) {
+    queries.push(searchSmithery(options.query, limit));
+  }
+  if (registries.includes("github")) {
+    queries.push(searchGitHubTopics(options.query, limit));
+  }
 
   const settled = await Promise.allSettled(queries);
   let results = settled

package/src/core/tui.ts

@@ -24,6 +24,7 @@ const ECO_LABEL: Record<Ecosystem, string> = {
   opencode: "opencode",
   gemini: "gemini",
   codex: "codex",
+  npm: "npm",
   universal: "universal",
   unknown: "?",
 };
@@ -124,18 +125,20 @@ export function formatHelp(): string {
     "📦 zmarketplace — cross-agent package search",
     "",
     "Usage:",
-    "  /zmarketplace search <query>     Search across all registries",
-    "  /zmarketplace detail <id|name>   Show package details",
-    "  /zmarketplace audit <id|name>    Run security audit",
-    "  /zmarketplace install <id|name>  Audit + install a package",
+    "  /zmarketplace                     Interactive search prompt",
+    "  /zmarketplace search <query>      Search across all registries",
+    "  /zmarketplace popular             Browse popular packages",
+    "  /zmarketplace updates             Check installed packages for updates",
+    "  /zmarketplace detail <id|name>    Show package details",
+    "  /zmarketplace audit <id|name>     Run security audit",
+    "  /zmarketplace install <id|name>   Audit + install a package",
     "",
     "Options for 'search':",
     "  --type=<type>        Filter: extension, skill, theme, prompt, plugin, mcp",
-    "  --eco=<ecosystem>    Filter: pi, claude, opencode, gemini, codex",
+    "  --eco=<ecosystem>    Filter: pi, claude, opencode, gemini, codex, npm",
     "  --limit=<n>          Max results (default 20)",
     "",
-    "Registries: npm + Claude marketplace + Gemini extensions",
-    "",
+    "Registries: npm + Claude + Gemini + MCP + Smithery + GitHub",
     "Examples:",
     "  /zmarketplace search mcp",
     "  /zmarketplace search subagent --eco=pi",

package/src/core/types.ts

@@ -3,13 +3,13 @@
  */
 
 /** Which agent ecosystem a package targets. */
-export type Ecosystem = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "universal" | "unknown";
+export type Ecosystem = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "npm" | "universal" | "unknown";
 
 /** Package resource type. */
 export type PackageType = "extension" | "skill" | "theme" | "prompt" | "plugin" | "mcp" | "unknown";
 
 /** Which registry a result came from. */
-export type RegistrySource = "npm" | "claude-marketplace" | "gemini-extensions" | "pi-dev" | "mcp-registry";
+export type RegistrySource = "npm" | "claude-marketplace" | "gemini-extensions" | "pi-dev" | "mcp-registry" | "smithery" | "github";
 
 /** A normalized search result — the common currency across all registries. */
 export interface PackageResult {
@@ -113,7 +113,7 @@ export interface AuditReport {
 }
 
 /** Install target — which agent's install command to use. */
-export type InstallTarget = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "auto";
+export type InstallTarget = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex" | "npm" | "auto";
 
 /** Result of an install operation. */
 export interface InstallResult {
@@ -132,4 +132,5 @@ export const ECOSYSTEM_KEYWORDS: Record<Exclude<Ecosystem, "unknown" | "universa
   opencode: ["opencode", "opencode-plugin"],
   gemini: ["gemini-cli", "gemini-extension", "gemini-cli-extension"],
   codex: ["codex", "codex-plugin", "codex-cli"],
+  npm: ["npm", "bun", "pnpm", "yarn", "nodejs", "deno"],
 };

package/src/index.ts

@@ -10,6 +10,10 @@ import { auditPackage } from "./core/audit.ts";
 import { cacheResults, resolveRef, cacheAudit } from "./core/cache.ts";
 import { formatResultOption, formatAuditReport, formatHelp, parseArgs } from "./core/tui.ts";
 import type { PackageResult } from "./core/types.ts";
+import { isInstalled, getInstalledVersion } from "./core/installed.ts";
+import { getInstalledPackages } from "./core/installed.ts";
+import { getNpmPackageMeta } from "./registries/npm.ts";
+import { spawn } from "node:child_process";
 
 // ── Types ──────────────────────────────────────────────────────────────────
 
@@ -26,9 +30,9 @@ interface Ctx { cwd: string; hasUI: boolean; ui: UI }
 // ── Helpers ────────────────────────────────────────────────────────────────
 
 function openUrl(url: string): void {
-  if (process.platform === "win32") Bun.spawn(["cmd", "/c", "start", "", url], { stdout: "ignore", stderr: "ignore" });
-  else if (process.platform === "darwin") Bun.spawn(["open", url], { stdout: "ignore", stderr: "ignore" });
-  else Bun.spawn(["xdg-open", url], { stdout: "ignore", stderr: "ignore" });
+  const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
 }
 
 function extractUrl(line: string, repoBase?: string): string | null {
@@ -57,8 +61,10 @@ async function browseResults(results: PackageResult[], ctx: Ctx): Promise<void>
   while (true) {
     const pageEnd = Math.min(pageStart + PAGE_SIZE, results.length);
     const page = results.slice(pageStart, pageEnd);
-
-    const options: string[] = page.map((r, i) => formatResultOption(r, pageStart + i).label);
+    const options: string[] = page.map((r, i) => {
+      const label = formatResultOption(r, pageStart + i).label;
+      return isInstalled(r.name) ? `✓ ${label}` : label;
+    });
 
     if (pageStart > 0) {
       const ps = Math.max(0, pageStart - PAGE_SIZE) + 1;
@@ -117,9 +123,13 @@ async function packageDetail(pkg: PackageResult, ctx: Ctx): Promise<void> {
 
   while (true) {
     const selected = await ctx.ui.select(`${detail.name} — Details`, lines);
-    if (!selected) continue;  // ESC → stay in detail, don't quit to results
+    if (!selected) continue;
     if (selected.includes("Back to results")) return;
-    if (selected.includes("Install")) { await doInstall(pkg, ctx); continue; }  // stay in detail after install
+    if (selected.includes("Install")) {
+      const cmd = await doInstall(pkg, ctx);
+      if (cmd) lines.push(`✅ Run: ${cmd}`);  // show command at BOTTOM
+      continue;
+    }
     if (selected.includes("Audit only")) { await doAudit(pkg.name, ctx); continue; }
     const url = extractUrl(selected, repoBase);
     if (url) { openUrl(url); ctx.ui.notify("🌐 Opened in browser", "info"); }
@@ -145,7 +155,7 @@ async function doAudit(name: string, ctx: Ctx): Promise<void> {
 
 // ── Install (audit FIRST, then options) ────────────────────────────────────
 
-async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<void> {
+async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<string | null> {
   // Audit first
   ctx.ui.setStatus?.(`Auditing ${pkg.name} before install...`);
   const report = await auditPackage(pkg.name, { deepScan: true });
@@ -176,6 +186,12 @@ async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<void> {
     if (eco === "opencode" && !seen.has("opencode")) { seen.add("opencode"); addCmd("🔓 opencode", `opencode plugin ${pkg.name}`); }
     if (eco === "gemini" && !seen.has("gemini")) { seen.add("gemini"); addCmd("💎 gemini", `gemini extension install ${pkg.repository ?? pkg.name}`); }
     if (eco === "codex" && !seen.has("codex")) { seen.add("codex"); addCmd("🔲 codex", `codex plugin add npm:${pkg.name}`); }
+    if (eco === "npm" && !seen.has("npm")) {
+      seen.add("npm");
+      addCmd("📦 npm", `npm install ${pkg.name}`);
+      addCmd("🟤 bun add", `bun add ${pkg.name}`);
+      addCmd("📦 pnpm add", `pnpm add ${pkg.name}`);
+    }
   }
   if (!seen.has("npm")) addCmd("📦 npm", `npm install ${pkg.name}`);
   addCmd("⚡ bunx", `bunx ${pkg.name}`);
@@ -184,24 +200,99 @@ async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<void> {
   // High risk confirmation
   if (report.risk === "critical" || report.risk === "high") {
     const proceed = await ctx.ui.confirm(`${report.risk} risk`, `⚠️ ${pkg.name}: ${report.findings.length} security findings. Install anyway?`);
-    if (!proceed) { ctx.ui.notify("Cancelled.", "info"); return; }
+    if (!proceed) { ctx.ui.notify("Cancelled.", "info"); return null; }
   }
 
   const choice = await ctx.ui.select(`Install ${pkg.name} — Risk: ${report.risk}`, cmds);
-  if (!choice || choice === "↩ Cancel") return;
+  if (!choice || choice === "↩ Cancel") return null;
   const command = cmdMap.get(choice);
-  if (command) ctx.ui.notify(`✅ Run:\n  ${command}`, "info");
+  if (!command) return null;
+
+  // Auto-install: confirm, then execute
+  const doAuto = await ctx.ui.confirm("Install now?", `Run: ${command}`);
+  if (!doAuto) {
+    ctx.ui.notify(`✅ Command:\n  ${command}`, "info");
+    return command;
+  }
+
+  ctx.ui.setStatus?.(`Installing ${pkg.name}...`);
+  try {
+    const result = await new Promise<{ ok: boolean; out: string }>((resolve) => {
+      const proc = spawn(command, { shell: true, stdio: ["ignore", "pipe", "pipe"] });
+      let out = "";
+      proc.stdout?.on("data", (d: Buffer) => { out += d.toString(); });
+      proc.stderr?.on("data", (d: Buffer) => { out += d.toString(); });
+      proc.on("close", (code: number | null) => resolve({ ok: code === 0, out }));
+      proc.on("error", () => resolve({ ok: false, out: "Failed to start" }));
+    });
+
+    if (result.ok) {
+      ctx.ui.notify(`✅ Installed ${pkg.name}!\nRun /reload to activate.`, "info");
+    } else {
+      ctx.ui.notify(`❌ Install failed:\n${result.out.slice(0, 500)}`, "warning");
+      ctx.ui.notify(`Manual command:\n  ${command}`, "info");
+    }
+  } catch {
+    ctx.ui.notify(`Manual command:\n  ${command}`, "info");
+  }
+  return command;
 }
 
 // ── Factory ────────────────────────────────────────────────────────────────
-
 // Command handler — extracted so it can be registered at the right time.
+
+// ── Updates checker ────────────────────────────────────────────────────────
+
+async function doUpdates(ctx: Ctx): Promise<void> {
+  ctx.ui.setStatus?.("Checking installed packages for updates...");
+  const installed = getInstalledPackages();
+  if (installed.length === 0) { ctx.ui.notify("No installed packages found.", "info"); return; }
+
+  const lines: string[] = [];
+  let updateCount = 0;
+
+  for (const pkg of installed) {
+    const meta = await getNpmPackageMeta(pkg.name);
+    if (!meta) continue;
+    const latest = meta["dist-tags"]?.latest;
+    if (!latest) continue;
+
+    if (pkg.version && pkg.version !== latest) {
+      lines.push(`⬆ ${pkg.name}: ${pkg.version} → ${latest} [${pkg.source}]`);
+      updateCount++;
+    } else if (!pkg.version) {
+      lines.push(`? ${pkg.name}: latest is ${latest} [${pkg.source}]`);
+    } else {
+      lines.push(`✓ ${pkg.name}: ${pkg.version} [${pkg.source}]`);
+    }
+  }
+
+  if (lines.length === 0) { ctx.ui.notify("No packages to check.", "info"); return; }
+  lines.push("↩ Back");
+
+  const title = updateCount > 0
+    ? `${updateCount} update(s) available (${installed.length} packages)`
+    : `All ${installed.length} packages up to date`;
+  await ctx.ui.select(title, lines);
+}
+
+// ── Popular packages ───────────────────────────────────────────────────────
+
+async function doPopular(ctx: Ctx): Promise<void> {
+  ctx.ui.setStatus?.("Finding popular packages...");
+  const results = await search({ query: "", limit: 25, type: "all", ecosystem: "all" });
+  if (results.length === 0) { ctx.ui.notify("No packages found.", "info"); return; }
+  ctx.ui.notify(`Found ${results.length} popular packages.`, "info");
+  await browseResults(results, ctx);
+}
 const commandDef = {
   description: "Search, audit, and install packages across agent ecosystems",
   handler: async (rawArgs: string, ctx: Ctx) => {
     const args = parseArgs(rawArgs.trim().split(/\s+/).filter(Boolean));
     switch (args.subcommand) {
       case "help": { ctx.ui.notify(formatHelp(), "info"); break; }
+      case "updates": { await doUpdates(ctx); break; }
+      case "popular": { await doPopular(ctx); break; }
       case "audit":
       case "a": {
         const ref = args.positional[0];

package/src/opencode.ts

@@ -1,119 +1,104 @@
 /**
  * OpenCode plugin entry point.
  *
- * OpenCode plugins are npm packages with `exports["./server"]` pointing here.
- * They export a Plugin function that returns hooks.
+ * OpenCode plugins export functions that return hooks.
+ * This plugin provides a `zmarketplace` tool the agent can call.
  *
- * Install in opencode:
- *   opencode plugin zmarketplace
+ * OpenCode does NOT support slash commands from plugins.
+ * For /zmarketplace, create a command file:
+ *   ~/.config/opencode/commands/zmarketplace.md
  *
- * Or add to opencode.json:
- *   { "plugin": ["zmarketplace"] }
+ * Install: add "zmarketplace" to opencode.json plugin array.
  */
 
 import { search } from "./core/search.ts";
 import { getDetail } from "./core/detail.ts";
 import { auditPackage } from "./core/audit.ts";
-import { installPackage } from "./core/install.ts";
 import type { SearchOptions } from "./core/types.ts";
 
-/**
- * Minimal OpenCode plugin type shape.
- * Not imported from @opencode-ai/plugin to keep zero deps.
- */
-interface OpenCodeToolContext {
+interface ToolContext {
   sessionID?: string;
   messageID?: string;
   agent?: string;
   directory?: string;
+  worktree?: string;
   ask?(message: string): Promise<string>;
 }
 
-interface OpenCodePluginParams {
-  project?: string;
-  serverUrl?: string;
-  // Bun shell `$`
-  $?: unknown;
+interface ToolDef {
+  description: string;
+  args: Record<string, unknown>;
+  execute(args: Record<string, unknown>, ctx: ToolContext): Promise<string>;
 }
 
-interface OpenCodeHooks {
-  "tool.definition"?: (tools: unknown[]) => unknown[];
+interface PluginCtx {
+  project?: unknown;
+  client?: unknown;
+  directory?: string;
+  worktree?: string;
 }
 
-type PluginFn = (params: OpenCodePluginParams) => Promise<OpenCodeHooks>;
-
-const ZMARKETPLACE_TOOL = {
-  type: "function" as const,
-  function: {
-    name: "zmarketplace",
-    description:
-      "Search, inspect, audit, and install packages across agent ecosystems. " +
-      "Actions: search, detail, audit, install.",
-    parameters: {
-      type: "object",
-      properties: {
-        action: { type: "string", enum: ["search", "detail", "audit", "install"] },
-        query: { type: "string" },
-        name: { type: "string" },
-        type: { type: "string", enum: ["extension", "skill", "theme", "prompt", "plugin", "mcp", "all"] },
-        ecosystem: { type: "string", enum: ["pi", "omp", "claude", "opencode", "gemini", "codex", "all"] },
-        limit: { type: "number" },
-        deepScan: { type: "boolean" },
-        skipAudit: { type: "boolean" },
-      },
-      required: ["action"],
+/** The zmarketplace tool definition. */
+const zmarketplaceTool: ToolDef = {
+  description:
+    "Search, inspect, audit, and install packages across agent ecosystems " +
+    "(pi, omp, claude code, opencode, gemini cli, codex). " +
+    "Actions: search, detail, audit. " +
+    "Sources: npm, Claude marketplace, Gemini extensions, MCP registry, Smithery, GitHub.",
+  args: {
+    action: { type: "string", description: "search, detail, or audit" },
+    query: { type: "string", description: "Search query (for search)" },
+    name: { type: "string", description: "Package name (for detail/audit)" },
+    ecosystem: {
+      type: "string",
+      description: "Filter: pi, claude, opencode, gemini, codex, npm, all",
     },
-    execute: async (args: Record<string, unknown>, _ctx: OpenCodeToolContext): Promise<string> => {
-      const action = args["action"] as string;
+    limit: { type: "number", description: "Max results (default 20)" },
+  },
 
-      if (action === "search") {
-        const opts: SearchOptions = {
-          query: (args["query"] as string) ?? "",
-          type: (args["type"] as SearchOptions["type"]) ?? "all",
-          ecosystem: (args["ecosystem"] as SearchOptions["ecosystem"]) ?? "all",
-          limit: (args["limit"] as number) ?? 20,
-        };
-        const results = await search(opts);
-        return results.length === 0
-          ? "No packages found."
-          : results.map(r => `${r.name} [${r.ecosystems.filter(e => e !== "unknown").join(",")}] — ${r.description}`).join("\n");
-      }
+  async execute(args: Record<string, unknown>): Promise<string> {
+    const action = args["action"] as string;
 
-      if (action === "detail") {
-        const name = args["name"] as string;
-        if (!name) return "Error: 'name' required for detail.";
-        const detail = await getDetail(name);
-        if (!detail) return `Package "${name}" not found.`;
-        return `${detail.name} v${detail.version}\n${detail.description}\nDeps: ${detail.dependencyCount}  Size: ${detail.size ? (detail.size / 1024).toFixed(1) + " KB" : "?"}\n${detail.npmUrl}`;
-      }
+    if (action === "search") {
+      const opts: SearchOptions = {
+        query: (args["query"] as string) ?? "",
+        ecosystem: (args["ecosystem"] as SearchOptions["ecosystem"]) ?? "all",
+        limit: (args["limit"] as number) ?? 20,
+      };
+      const results = await search(opts);
+      if (results.length === 0) return "No packages found.";
+      return results.map(r =>
+        `${r.name} [${r.ecosystems.filter(e => e !== "unknown").join(",")}] (${r.source})\n  ${r.description.slice(0, 100)}\n  Install: ${r.installCommand ?? "n/a"}`
+      ).join("\n\n");
+    }
 
-      if (action === "audit") {
-        const name = args["name"] as string;
-        if (!name) return "Error: 'name' required for audit.";
-        const report = await auditPackage(name, { deepScan: (args["deepScan"] as boolean) ?? true });
-        return report.summary + "\n" + (report.findings.map(f => `[${f.severity.toUpperCase()}] ${f.reason}`).join("\n") || "No findings.");
-      }
+    if (action === "detail") {
+      const name = args["name"] as string;
+      if (!name) return "Error: name required.";
+      const detail = await getDetail(name);
+      if (!detail) return `Package "${name}" not found.`;
+      return `${detail.name} v${detail.version}\n${detail.description}\nDeps: ${detail.dependencyCount}  Size: ${detail.size ? (detail.size / 1024).toFixed(1) + " KB" : "?"}\n${detail.npmUrl ?? ""}`;
+    }
 
-      if (action === "install") {
-        const name = args["name"] as string;
-        if (!name) return "Error: 'name' required for install.";
-        const result = await installPackage(name, { skipAudit: (args["skipAudit"] as boolean) ?? false });
-        return result.message;
-      }
+    if (action === "audit") {
+      const name = args["name"] as string;
+      if (!name) return "Error: name required.";
+      const report = await auditPackage(name, { deepScan: true });
+      return `${report.summary}\nFindings:\n${report.findings.map(f => `[${f.severity}] ${f.reason}`).join("\n") || "None"}`;
+    }
 
-      return `Unknown action: ${action}`;
-    },
+    return `Unknown action: ${action}`;
   },
 };
 
-const ZmarketplacePlugin: PluginFn = async (_params: OpenCodePluginParams) => {
+/** OpenCode plugin — provides zmarketplace as a tool the agent can call. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const ZmarketplacePlugin = async (_ctx: PluginCtx): Promise<{ tool: Record<string, ToolDef> }> => {
   return {
-    "tool.definition": (tools: unknown[]) => {
-      tools.push(ZMARKETPLACE_TOOL);
-      return tools;
+    tool: {
+      zmarketplace: zmarketplaceTool,
     },
   };
 };
 
 export default ZmarketplacePlugin;
-export { ZmarketplacePlugin };

package/src/registries/github.ts

@@ -0,0 +1,63 @@
+/**
+ * GitHub topics adapter — searches GitHub repos by topic for agent plugins.
+ * Uses the public GitHub search API (60 requests/hour without auth).
+ */
+
+import type { PackageResult, PackageType, RegistrySource } from "../core/types.ts";
+
+const GITHUB_SEARCH = "https://api.github.com/search/repositories";
+
+const AGENT_TOPICS = [
+  "claude-code", "agent-plugin", "mcp-server",
+  "gemini-cli-extension", "codex-plugin", "pi-package",
+];
+
+interface GitHubRepo {
+  name: string;
+  full_name: string;
+  description: string | null;
+  html_url: string;
+  stargazers_count: number;
+  pushed_at: string;
+  owner: { login: string };
+  topics: string[];
+  license: { key: string } | null;
+}
+
+interface GitHubResponse {
+  total_count: number;
+  items: GitHubRepo[];
+}
+
+/** Search GitHub repos by agent-related topics. */
+export async function searchGitHubTopics(query: string, limit = 25): Promise<PackageResult[]> {
+  const q = query.trim();
+  const topicQuery = AGENT_TOPICS.map(t => `topic:${t}`).join(" ");
+  const searchText = q ? `${topicQuery} ${q}` : topicQuery;
+  const url = `${GITHUB_SEARCH}?q=${encodeURIComponent(searchText)}&sort=stars&order=desc&per_page=${limit}`;
+
+  try {
+    const resp = await fetch(url, {
+      signal: AbortSignal.timeout(10000),
+      headers: { "Accept": "application/vnd.github+json" },
+    });
+    if (!resp.ok) return [];
+    const data = await resp.json() as GitHubResponse;
+
+    return (data.items ?? []).slice(0, limit).map(repo => ({
+      name: repo.full_name,
+      description: repo.description ?? "",
+      author: repo.owner.login,
+      ecosystems: ["universal"] as const,
+      type: "plugin" as PackageType,
+      source: "github" as RegistrySource,
+      homepage: repo.html_url,
+      repository: repo.html_url,
+      license: repo.license?.key,
+      publishedAt: repo.pushed_at,
+      installCommand: `git clone ${repo.html_url}`,
+    }));
+  } catch {
+    return [];
+  }
+}

package/src/registries/npm.ts

@@ -54,6 +54,7 @@ export function detectEcosystems(keywords?: string[], name?: string): Ecosystem[
   if (kws.has("opencode") || kws.has("opencode-plugin") || n.includes("opencode")) result.push("opencode");
   if (kws.has("gemini-cli") || kws.has("gemini-extension") || kws.has("gemini-cli-extension") || n.includes("gemini")) result.push("gemini");
   if (kws.has("codex") || kws.has("codex-plugin") || kws.has("codex-cli") || n.includes("codex")) result.push("codex");
+  if (kws.has("npm") || kws.has("bun") || kws.has("pnpm") || kws.has("yarn") || kws.has("nodejs") || kws.has("deno")) result.push("npm");
 
   if (result.length === 0) result.push("unknown");
   return result;
@@ -83,7 +84,7 @@ export function installCommandFor(name: string, ecosystem: Ecosystem): string {
     case "claude": return `claude plugin install npm:${name}`;
     case "opencode": return `opencode plugin ${name}`;
     case "gemini": return `gemini extension install npm:${name}`;
-    case "codex": return `codex plugin add npm:${name}`;
+    case "npm": return `npm install ${name}`;
     default: return `npm install ${name}`;
   }
 }
@@ -96,7 +97,7 @@ export async function searchNpm(
   const limit = options.limit ?? 25;
   const allEcosystems: Ecosystem[] = options.ecosystems && options.ecosystems.length > 0
     ? options.ecosystems
-    : ["pi", "claude", "opencode", "gemini", "codex"];
+    : ["pi", "claude", "opencode", "gemini", "codex", "npm"];
 
   // Collect unique keywords for the selected ecosystems
   const keywords = new Set<string>();

package/src/registries/smithery.ts

@@ -0,0 +1,51 @@
+/**
+ * Smithery MCP registry adapter — queries api.smithery.ai for MCP servers.
+ */
+
+import type { PackageResult, PackageType, RegistrySource } from "../core/types.ts";
+
+const SMITHERY_URL = "https://api.smithery.ai/v1/servers";
+
+interface SmitheryServer {
+  qualifiedName?: string;
+  displayName?: string;
+  description?: string;
+  shortDescription?: string;
+  repository?: { url?: string; source?: string };
+  latestVersion?: string;
+  author?: { name?: string };
+}
+
+interface SmitheryResponse {
+  servers?: SmitheryServer[];
+}
+
+/** Search Smithery MCP registry. */
+export async function searchSmithery(query: string, limit = 25): Promise<PackageResult[]> {
+  const q = query.toLowerCase().trim();
+  const url = q
+    ? `${SMITHERY_URL}?q=${encodeURIComponent(query)}&page=1&pageSize=${limit}`
+    : `${SMITHERY_URL}?page=1&pageSize=${limit}`;
+
+  try {
+    const resp = await fetch(url, { signal: AbortSignal.timeout(10000) });
+    if (!resp.ok) return [];
+    const data = await resp.json() as SmitheryResponse;
+    const servers = data.servers ?? [];
+
+    return servers.slice(0, limit).map(srv => ({
+      name: srv.qualifiedName ?? srv.displayName ?? "unknown",
+      description: srv.shortDescription ?? srv.description ?? "",
+      version: srv.latestVersion,
+      author: srv.author?.name,
+      ecosystems: ["universal"] as const,
+      type: "mcp" as PackageType,
+      source: "smithery" as RegistrySource,
+      homepage: srv.repository?.url ?? srv.repository?.source,
+      repository: srv.repository?.url,
+      installCommand: `npx @smithery/cli install ${srv.qualifiedName ?? srv.displayName ?? ""}`,
+    }));
+  } catch {
+    return [];
+  }
+}