zmarketplace 0.5.3 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zmarketplace",
-  "version": "0.5.3",
+  "version": "0.7.2",
   "description": "Cross-agent marketplace search: find, audit, and install plugins/skills/themes/prompts across pi, omp, claude code, opencode, gemini cli, and codex",
   "license": "MIT",
   "type": "module",

package/src/core/installed.ts

@@ -0,0 +1,75 @@
+/**
+ * Installed packages detector — checks pi and omp for user-installed plugins.
+ * Only checks explicit plugin installs, NOT dependency node_modules.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+export interface InstalledPackage {
+  name: string;
+  version?: string;
+  source: "pi" | "omp";
+}
+
+let cache: InstalledPackage[] | null = null;
+let cacheTime = 0;
+const CACHE_TTL = 10_000;
+
+/** Get user-installed packages from pi and omp (not dependencies). */
+export function getInstalledPackages(): InstalledPackage[] {
+  const now = Date.now();
+  if (cache && now - cacheTime < CACHE_TTL) return cache;
+
+  const results: InstalledPackage[] = [];
+  const home = homedir();
+
+  // omp plugins — from lock file (only explicitly enabled plugins)
+  const ompLock = join(home, ".omp", "plugins", "omp-plugins.lock.json");
+  try {
+    if (existsSync(ompLock)) {
+      const data = JSON.parse(readFileSync(ompLock, "utf8")) as { plugins?: Record<string, { version?: string; enabled?: boolean }> };
+      for (const [name, info] of Object.entries(data.plugins ?? {})) {
+        if (info.enabled !== false) {
+          results.push({ name, version: info.version, source: "omp" });
+        }
+      }
+    }
+  } catch { /* ignore */ }
+
+  // pi packages — from settings.json packages array (NOT node_modules scan)
+  const piSettings = join(home, ".pi", "agent", "settings.json");
+  try {
+    if (existsSync(piSettings)) {
+      const data = JSON.parse(readFileSync(piSettings, "utf8")) as { packages?: string[]; extensions?: string[] };
+      for (const pkg of data.packages ?? []) {
+        // Format: "npm:@scope/name@version" or "npm:name" or "git:..."
+        const cleaned = pkg.replace(/^npm:/, "").replace(/^git:.*\//, "").replace(/@[^@]*$/, "");
+        if (cleaned) results.push({ name: cleaned, source: "pi" });
+      }
+    }
+  } catch { /* ignore */ }
+
+  // Deduplicate (keep first = prefer omp with version info)
+  const seen = new Set<string>();
+  const deduped = results.filter(r => {
+    if (seen.has(r.name)) return false;
+    seen.add(r.name);
+    return true;
+  });
+
+  cache = deduped;
+  cacheTime = now;
+  return deduped;
+}
+
+/** Check if a package name is installed (user plugin, not dependency). */
+export function isInstalled(name: string): boolean {
+  return getInstalledPackages().some(p => p.name === name || p.name === name.replace(/^@[^/]+\//, ""));
+}
+
+/** Get installed version of a package, or undefined. */
+export function getInstalledVersion(name: string): string | undefined {
+  return getInstalledPackages().find(p => p.name === name)?.version;
+}

package/src/core/search.ts

@@ -8,11 +8,13 @@ import { searchNpm, detectEcosystems } from "../registries/npm.ts";
 import { searchClaudeMarketplace } from "../registries/claude.ts";
 import { searchGeminiExtensions } from "../registries/gemini.ts";
 import { searchMcpRegistry } from "../registries/mcp.ts";
+import { searchSmithery } from "../registries/smithery.ts";
+import { searchGitHubTopics } from "../registries/github.ts";
 
 /** Determine which registries to query based on options. */
 function registriesForOptions(registry?: RegistrySource | "all"): RegistrySource[] {
   if (!registry || registry === "all") {
-    return ["npm", "claude-marketplace", "gemini-extensions", "mcp-registry"];
+    return ["npm", "claude-marketplace", "gemini-extensions", "mcp-registry", "smithery", "github"];
   }
   return [registry];
 }
@@ -82,6 +84,12 @@ export async function search(options: SearchOptions): Promise<PackageResult[]> {
   if (registries.includes("mcp-registry")) {
     queries.push(searchMcpRegistry(options.query, limit));
   }
+  if (registries.includes("smithery")) {
+    queries.push(searchSmithery(options.query, limit));
+  }
+  if (registries.includes("github")) {
+    queries.push(searchGitHubTopics(options.query, limit));
+  }
 
   const settled = await Promise.allSettled(queries);
   let results = settled

package/src/core/tui.ts

@@ -125,18 +125,20 @@ export function formatHelp(): string {
     "📦 zmarketplace — cross-agent package search",
     "",
     "Usage:",
-    "  /zmarketplace search <query>     Search across all registries",
-    "  /zmarketplace detail <id|name>   Show package details",
-    "  /zmarketplace audit <id|name>    Run security audit",
-    "  /zmarketplace install <id|name>  Audit + install a package",
+    "  /zmarketplace                     Interactive search prompt",
+    "  /zmarketplace search <query>      Search across all registries",
+    "  /zmarketplace popular             Browse popular packages",
+    "  /zmarketplace updates             Check installed packages for updates",
+    "  /zmarketplace detail <id|name>    Show package details",
+    "  /zmarketplace audit <id|name>     Run security audit",
+    "  /zmarketplace install <id|name>   Audit + install a package",
     "",
     "Options for 'search':",
     "  --type=<type>        Filter: extension, skill, theme, prompt, plugin, mcp",
     "  --eco=<ecosystem>    Filter: pi, claude, opencode, gemini, codex, npm",
     "  --limit=<n>          Max results (default 20)",
     "",
-    "Registries: npm + Claude marketplace + Gemini extensions + MCP registry",
-    "",
+    "Registries: npm + Claude + Gemini + MCP + Smithery + GitHub",
     "Examples:",
     "  /zmarketplace search mcp",
     "  /zmarketplace search subagent --eco=pi",

package/src/core/types.ts

@@ -9,7 +9,7 @@ export type Ecosystem = "pi" | "omp" | "claude" | "opencode" | "gemini" | "codex
 export type PackageType = "extension" | "skill" | "theme" | "prompt" | "plugin" | "mcp" | "unknown";
 
 /** Which registry a result came from. */
-export type RegistrySource = "npm" | "claude-marketplace" | "gemini-extensions" | "pi-dev" | "mcp-registry";
+export type RegistrySource = "npm" | "claude-marketplace" | "gemini-extensions" | "pi-dev" | "mcp-registry" | "smithery" | "github";
 
 /** A normalized search result — the common currency across all registries. */
 export interface PackageResult {

package/src/index.ts

@@ -10,6 +10,9 @@ import { auditPackage } from "./core/audit.ts";
 import { cacheResults, resolveRef, cacheAudit } from "./core/cache.ts";
 import { formatResultOption, formatAuditReport, formatHelp, parseArgs } from "./core/tui.ts";
 import type { PackageResult } from "./core/types.ts";
+import { isInstalled, getInstalledVersion } from "./core/installed.ts";
+import { getInstalledPackages } from "./core/installed.ts";
+import { getNpmPackageMeta } from "./registries/npm.ts";
 import { spawn } from "node:child_process";
 
 // ── Types ──────────────────────────────────────────────────────────────────
@@ -58,8 +61,10 @@ async function browseResults(results: PackageResult[], ctx: Ctx): Promise<void>
   while (true) {
     const pageEnd = Math.min(pageStart + PAGE_SIZE, results.length);
     const page = results.slice(pageStart, pageEnd);
-
-    const options: string[] = page.map((r, i) => formatResultOption(r, pageStart + i).label);
+    const options: string[] = page.map((r, i) => {
+      const label = formatResultOption(r, pageStart + i).label;
+      return isInstalled(r.name) ? `✓ ${label}` : label;
+    });
 
     if (pageStart > 0) {
       const ps = Math.max(0, pageStart - PAGE_SIZE) + 1;
@@ -201,19 +206,93 @@ async function doInstall(pkg: PackageResult, ctx: Ctx): Promise<string | null> {
   const choice = await ctx.ui.select(`Install ${pkg.name} — Risk: ${report.risk}`, cmds);
   if (!choice || choice === "↩ Cancel") return null;
   const command = cmdMap.get(choice);
-  if (command) ctx.ui.notify(`✅ Run:\n  ${command}`, "info");
-  return command ?? null;
+  if (!command) return null;
+
+  // Auto-install: confirm, then execute
+  const doAuto = await ctx.ui.confirm("Install now?", `Run: ${command}`);
+  if (!doAuto) {
+    ctx.ui.notify(`✅ Command:\n  ${command}`, "info");
+    return command;
+  }
+
+  ctx.ui.setStatus?.(`Installing ${pkg.name}...`);
+  try {
+    const result = await new Promise<{ ok: boolean; out: string }>((resolve) => {
+      const proc = spawn(command, { shell: true, stdio: ["ignore", "pipe", "pipe"] });
+      let out = "";
+      proc.stdout?.on("data", (d: Buffer) => { out += d.toString(); });
+      proc.stderr?.on("data", (d: Buffer) => { out += d.toString(); });
+      proc.on("close", (code: number | null) => resolve({ ok: code === 0, out }));
+      proc.on("error", () => resolve({ ok: false, out: "Failed to start" }));
+    });
+
+    if (result.ok) {
+      ctx.ui.notify(`✅ Installed ${pkg.name}!\nRun /reload to activate.`, "info");
+    } else {
+      ctx.ui.notify(`❌ Install failed:\n${result.out.slice(0, 500)}`, "warning");
+      ctx.ui.notify(`Manual command:\n  ${command}`, "info");
+    }
+  } catch {
+    ctx.ui.notify(`Manual command:\n  ${command}`, "info");
+  }
+  return command;
 }
 
 // ── Factory ────────────────────────────────────────────────────────────────
-
 // Command handler — extracted so it can be registered at the right time.
+
+// ── Updates checker ────────────────────────────────────────────────────────
+
+async function doUpdates(ctx: Ctx): Promise<void> {
+  ctx.ui.setStatus?.("Checking installed packages for updates...");
+  const installed = getInstalledPackages();
+  if (installed.length === 0) { ctx.ui.notify("No installed packages found.", "info"); return; }
+
+  const lines: string[] = [];
+  let updateCount = 0;
+
+  for (const pkg of installed) {
+    const meta = await getNpmPackageMeta(pkg.name);
+    if (!meta) continue;
+    const latest = meta["dist-tags"]?.latest;
+    if (!latest) continue;
+
+    if (pkg.version && pkg.version !== latest) {
+      lines.push(`⬆ ${pkg.name}: ${pkg.version} → ${latest} [${pkg.source}]`);
+      updateCount++;
+    } else if (!pkg.version) {
+      lines.push(`? ${pkg.name}: latest is ${latest} [${pkg.source}]`);
+    } else {
+      lines.push(`✓ ${pkg.name}: ${pkg.version} [${pkg.source}]`);
+    }
+  }
+
+  if (lines.length === 0) { ctx.ui.notify("No packages to check.", "info"); return; }
+  lines.push("↩ Back");
+
+  const title = updateCount > 0
+    ? `${updateCount} update(s) available (${installed.length} packages)`
+    : `All ${installed.length} packages up to date`;
+  await ctx.ui.select(title, lines);
+}
+
+// ── Popular packages ───────────────────────────────────────────────────────
+
+async function doPopular(ctx: Ctx): Promise<void> {
+  ctx.ui.setStatus?.("Finding popular packages...");
+  const results = await search({ query: "", limit: 25, type: "all", ecosystem: "all" });
+  if (results.length === 0) { ctx.ui.notify("No packages found.", "info"); return; }
+  ctx.ui.notify(`Found ${results.length} popular packages.`, "info");
+  await browseResults(results, ctx);
+}
 const commandDef = {
   description: "Search, audit, and install packages across agent ecosystems",
   handler: async (rawArgs: string, ctx: Ctx) => {
     const args = parseArgs(rawArgs.trim().split(/\s+/).filter(Boolean));
     switch (args.subcommand) {
       case "help": { ctx.ui.notify(formatHelp(), "info"); break; }
+      case "updates": { await doUpdates(ctx); break; }
+      case "popular": { await doPopular(ctx); break; }
       case "audit":
       case "a": {
         const ref = args.positional[0];

package/src/opencode.ts

@@ -1,119 +1,104 @@
 /**
  * OpenCode plugin entry point.
  *
- * OpenCode plugins are npm packages with `exports["./server"]` pointing here.
- * They export a Plugin function that returns hooks.
+ * OpenCode plugins export functions that return hooks.
+ * This plugin provides a `zmarketplace` tool the agent can call.
  *
- * Install in opencode:
- *   opencode plugin zmarketplace
+ * OpenCode does NOT support slash commands from plugins.
+ * For /zmarketplace, create a command file:
+ *   ~/.config/opencode/commands/zmarketplace.md
  *
- * Or add to opencode.json:
- *   { "plugin": ["zmarketplace"] }
+ * Install: add "zmarketplace" to opencode.json plugin array.
  */
 
 import { search } from "./core/search.ts";
 import { getDetail } from "./core/detail.ts";
 import { auditPackage } from "./core/audit.ts";
-import { installPackage } from "./core/install.ts";
 import type { SearchOptions } from "./core/types.ts";
 
-/**
- * Minimal OpenCode plugin type shape.
- * Not imported from @opencode-ai/plugin to keep zero deps.
- */
-interface OpenCodeToolContext {
+interface ToolContext {
   sessionID?: string;
   messageID?: string;
   agent?: string;
   directory?: string;
+  worktree?: string;
   ask?(message: string): Promise<string>;
 }
 
-interface OpenCodePluginParams {
-  project?: string;
-  serverUrl?: string;
-  // Bun shell `$`
-  $?: unknown;
+interface ToolDef {
+  description: string;
+  args: Record<string, unknown>;
+  execute(args: Record<string, unknown>, ctx: ToolContext): Promise<string>;
 }
 
-interface OpenCodeHooks {
-  "tool.definition"?: (tools: unknown[]) => unknown[];
+interface PluginCtx {
+  project?: unknown;
+  client?: unknown;
+  directory?: string;
+  worktree?: string;
 }
 
-type PluginFn = (params: OpenCodePluginParams) => Promise<OpenCodeHooks>;
-
-const ZMARKETPLACE_TOOL = {
-  type: "function" as const,
-  function: {
-    name: "zmarketplace",
-    description:
-      "Search, inspect, audit, and install packages across agent ecosystems. " +
-      "Actions: search, detail, audit, install.",
-    parameters: {
-      type: "object",
-      properties: {
-        action: { type: "string", enum: ["search", "detail", "audit", "install"] },
-        query: { type: "string" },
-        name: { type: "string" },
-        type: { type: "string", enum: ["extension", "skill", "theme", "prompt", "plugin", "mcp", "all"] },
-        ecosystem: { type: "string", enum: ["pi", "omp", "claude", "opencode", "gemini", "codex", "all"] },
-        limit: { type: "number" },
-        deepScan: { type: "boolean" },
-        skipAudit: { type: "boolean" },
-      },
-      required: ["action"],
+/** The zmarketplace tool definition. */
+const zmarketplaceTool: ToolDef = {
+  description:
+    "Search, inspect, audit, and install packages across agent ecosystems " +
+    "(pi, omp, claude code, opencode, gemini cli, codex). " +
+    "Actions: search, detail, audit. " +
+    "Sources: npm, Claude marketplace, Gemini extensions, MCP registry, Smithery, GitHub.",
+  args: {
+    action: { type: "string", description: "search, detail, or audit" },
+    query: { type: "string", description: "Search query (for search)" },
+    name: { type: "string", description: "Package name (for detail/audit)" },
+    ecosystem: {
+      type: "string",
+      description: "Filter: pi, claude, opencode, gemini, codex, npm, all",
     },
-    execute: async (args: Record<string, unknown>, _ctx: OpenCodeToolContext): Promise<string> => {
-      const action = args["action"] as string;
+    limit: { type: "number", description: "Max results (default 20)" },
+  },
 
-      if (action === "search") {
-        const opts: SearchOptions = {
-          query: (args["query"] as string) ?? "",
-          type: (args["type"] as SearchOptions["type"]) ?? "all",
-          ecosystem: (args["ecosystem"] as SearchOptions["ecosystem"]) ?? "all",
-          limit: (args["limit"] as number) ?? 20,
-        };
-        const results = await search(opts);
-        return results.length === 0
-          ? "No packages found."
-          : results.map(r => `${r.name} [${r.ecosystems.filter(e => e !== "unknown").join(",")}] — ${r.description}`).join("\n");
-      }
+  async execute(args: Record<string, unknown>): Promise<string> {
+    const action = args["action"] as string;
 
-      if (action === "detail") {
-        const name = args["name"] as string;
-        if (!name) return "Error: 'name' required for detail.";
-        const detail = await getDetail(name);
-        if (!detail) return `Package "${name}" not found.`;
-        return `${detail.name} v${detail.version}\n${detail.description}\nDeps: ${detail.dependencyCount}  Size: ${detail.size ? (detail.size / 1024).toFixed(1) + " KB" : "?"}\n${detail.npmUrl}`;
-      }
+    if (action === "search") {
+      const opts: SearchOptions = {
+        query: (args["query"] as string) ?? "",
+        ecosystem: (args["ecosystem"] as SearchOptions["ecosystem"]) ?? "all",
+        limit: (args["limit"] as number) ?? 20,
+      };
+      const results = await search(opts);
+      if (results.length === 0) return "No packages found.";
+      return results.map(r =>
+        `${r.name} [${r.ecosystems.filter(e => e !== "unknown").join(",")}] (${r.source})\n  ${r.description.slice(0, 100)}\n  Install: ${r.installCommand ?? "n/a"}`
+      ).join("\n\n");
+    }
 
-      if (action === "audit") {
-        const name = args["name"] as string;
-        if (!name) return "Error: 'name' required for audit.";
-        const report = await auditPackage(name, { deepScan: (args["deepScan"] as boolean) ?? true });
-        return report.summary + "\n" + (report.findings.map(f => `[${f.severity.toUpperCase()}] ${f.reason}`).join("\n") || "No findings.");
-      }
+    if (action === "detail") {
+      const name = args["name"] as string;
+      if (!name) return "Error: name required.";
+      const detail = await getDetail(name);
+      if (!detail) return `Package "${name}" not found.`;
+      return `${detail.name} v${detail.version}\n${detail.description}\nDeps: ${detail.dependencyCount}  Size: ${detail.size ? (detail.size / 1024).toFixed(1) + " KB" : "?"}\n${detail.npmUrl ?? ""}`;
+    }
 
-      if (action === "install") {
-        const name = args["name"] as string;
-        if (!name) return "Error: 'name' required for install.";
-        const result = await installPackage(name, { skipAudit: (args["skipAudit"] as boolean) ?? false });
-        return result.message;
-      }
+    if (action === "audit") {
+      const name = args["name"] as string;
+      if (!name) return "Error: name required.";
+      const report = await auditPackage(name, { deepScan: true });
+      return `${report.summary}\nFindings:\n${report.findings.map(f => `[${f.severity}] ${f.reason}`).join("\n") || "None"}`;
+    }
 
-      return `Unknown action: ${action}`;
-    },
+    return `Unknown action: ${action}`;
   },
 };
 
-const ZmarketplacePlugin: PluginFn = async (_params: OpenCodePluginParams) => {
+/** OpenCode plugin — provides zmarketplace as a tool the agent can call. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const ZmarketplacePlugin = async (_ctx: PluginCtx): Promise<{ tool: Record<string, ToolDef> }> => {
   return {
-    "tool.definition": (tools: unknown[]) => {
-      tools.push(ZMARKETPLACE_TOOL);
-      return tools;
+    tool: {
+      zmarketplace: zmarketplaceTool,
     },
   };
 };
 
 export default ZmarketplacePlugin;
-export { ZmarketplacePlugin };

package/src/registries/github.ts

@@ -0,0 +1,63 @@
+/**
+ * GitHub topics adapter — searches GitHub repos by topic for agent plugins.
+ * Uses the public GitHub search API (60 requests/hour without auth).
+ */
+
+import type { PackageResult, PackageType, RegistrySource } from "../core/types.ts";
+
+const GITHUB_SEARCH = "https://api.github.com/search/repositories";
+
+const AGENT_TOPICS = [
+  "claude-code", "agent-plugin", "mcp-server",
+  "gemini-cli-extension", "codex-plugin", "pi-package",
+];
+
+interface GitHubRepo {
+  name: string;
+  full_name: string;
+  description: string | null;
+  html_url: string;
+  stargazers_count: number;
+  pushed_at: string;
+  owner: { login: string };
+  topics: string[];
+  license: { key: string } | null;
+}
+
+interface GitHubResponse {
+  total_count: number;
+  items: GitHubRepo[];
+}
+
+/** Search GitHub repos by agent-related topics. */
+export async function searchGitHubTopics(query: string, limit = 25): Promise<PackageResult[]> {
+  const q = query.trim();
+  const topicQuery = AGENT_TOPICS.map(t => `topic:${t}`).join(" ");
+  const searchText = q ? `${topicQuery} ${q}` : topicQuery;
+  const url = `${GITHUB_SEARCH}?q=${encodeURIComponent(searchText)}&sort=stars&order=desc&per_page=${limit}`;
+
+  try {
+    const resp = await fetch(url, {
+      signal: AbortSignal.timeout(10000),
+      headers: { "Accept": "application/vnd.github+json" },
+    });
+    if (!resp.ok) return [];
+    const data = await resp.json() as GitHubResponse;
+
+    return (data.items ?? []).slice(0, limit).map(repo => ({
+      name: repo.full_name,
+      description: repo.description ?? "",
+      author: repo.owner.login,
+      ecosystems: ["universal"] as const,
+      type: "plugin" as PackageType,
+      source: "github" as RegistrySource,
+      homepage: repo.html_url,
+      repository: repo.html_url,
+      license: repo.license?.key,
+      publishedAt: repo.pushed_at,
+      installCommand: `git clone ${repo.html_url}`,
+    }));
+  } catch {
+    return [];
+  }
+}

package/src/registries/smithery.ts

@@ -0,0 +1,51 @@
+/**
+ * Smithery MCP registry adapter — queries api.smithery.ai for MCP servers.
+ */
+
+import type { PackageResult, PackageType, RegistrySource } from "../core/types.ts";
+
+const SMITHERY_URL = "https://api.smithery.ai/v1/servers";
+
+interface SmitheryServer {
+  qualifiedName?: string;
+  displayName?: string;
+  description?: string;
+  shortDescription?: string;
+  repository?: { url?: string; source?: string };
+  latestVersion?: string;
+  author?: { name?: string };
+}
+
+interface SmitheryResponse {
+  servers?: SmitheryServer[];
+}
+
+/** Search Smithery MCP registry. */
+export async function searchSmithery(query: string, limit = 25): Promise<PackageResult[]> {
+  const q = query.toLowerCase().trim();
+  const url = q
+    ? `${SMITHERY_URL}?q=${encodeURIComponent(query)}&page=1&pageSize=${limit}`
+    : `${SMITHERY_URL}?page=1&pageSize=${limit}`;
+
+  try {
+    const resp = await fetch(url, { signal: AbortSignal.timeout(10000) });
+    if (!resp.ok) return [];
+    const data = await resp.json() as SmitheryResponse;
+    const servers = data.servers ?? [];
+
+    return servers.slice(0, limit).map(srv => ({
+      name: srv.qualifiedName ?? srv.displayName ?? "unknown",
+      description: srv.shortDescription ?? srv.description ?? "",
+      version: srv.latestVersion,
+      author: srv.author?.name,
+      ecosystems: ["universal"] as const,
+      type: "mcp" as PackageType,
+      source: "smithery" as RegistrySource,
+      homepage: srv.repository?.url ?? srv.repository?.source,
+      repository: srv.repository?.url,
+      installCommand: `npx @smithery/cli install ${srv.qualifiedName ?? srv.displayName ?? ""}`,
+    }));
+  } catch {
+    return [];
+  }
+}