fix(web): add url and npm plugin source types to marketplace schema

[amondnet]

Summary

• Added url and npm source types to Zod validation schemas (marketplace-schema.ts, content.config.ts)
• Added corresponding TypeScript interfaces in marketplace.ts and PluginCard.vue
• Updated PluginCard.vue to handle url/npm sources for metadata fetch, source URL display, and source text rendering
• Fixed parseGitHubRepo to strip .git suffix from URLs
• Fixed import.meta.env → process.env for GITHUB_TOKEN in server utils
• Installed @iconify-json/simple-icons for icon collection support

Test plan

• Verify plugins with github source type continue to work as before
• Verify plugins with url source type display correct source URL and text
• Verify plugins with npm source type display correct npm package link
• Confirm GitHub metadata fetch still works with updated parseGitHubRepo (.git suffix stripped)
• Confirm GITHUB_TOKEN is correctly read from process.env in server context

---

Summary by cubic

Adds support for url and npm plugin sources in the marketplace. The UI links to raw GitHub URLs and npm packages and fetches metadata for github/url sources.

• New Features

  • Added url and npm source types to schemas (server/utils/marketplace-schema.ts, content.config.ts) and types (app/types/marketplace.ts); added optional ref/sha for github/url/git-subdir.
  • PluginCard.vue builds raw URLs for github/url, computes display source text, and links to GitHub/npm; added @iconify-json/simple-icons.
  • Enforced stricter URL validation with z.string().url() in content.config.ts.

• Bug Fixes

  • Ensured metadata fetch always clears loading via a finally block.
  • parseGitHubRepo now strips .git suffix; server reads GITHUB_TOKEN from process.env using the node:process import.
  • Reverted Node engine to 22.x to match the repo baseline.

^{Written for commit 4958c99. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
claude-code-plugins	Ready	Preview, Comment	Mar 27, 2026 2:45pm

[gemini-code-assist]

Code Review

This pull request introduces support for url and npm plugin sources, updates metadata fetching to handle these new types, and upgrades the Node.js engine to version 24.x. It also refines GitHub repository parsing and environment variable access. Review feedback highlights a logic bug where an early return could leave the component in a permanent loading state and recommends refactoring a complex ternary expression in the template into a computed property to improve maintainability.

[cubic-dev-ai]

4 issues found across 7 files

Confidence score: 2/5

• Merge risk is high because there are multiple high-confidence issues with concrete impact, including a likely TypeScript build break in apps/web/app/components/PluginCard.vue (ref accessed on PluginSourceGitHub where the type does not define it).
• apps/web/package.json raises runtime/CI risk by requiring Node 24.x, which conflicts with the repo’s Node 22 baseline and can break installs or pipelines in pinned environments.
• apps/web/app/components/PluginCard.vue has a control-flow bug where an early return can skip the finally reset, leaving loading stuck true and causing visible UI regressions.
• Pay close attention to apps/web/app/components/PluginCard.vue, apps/web/package.json, and apps/web/content.config.ts - type/runtime compatibility and loading-state handling are the main merge risks, with URL validation as a smaller follow-up hardening item.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/web/app/components/PluginCard.vue">

<violation number="1" location="apps/web/app/components/PluginCard.vue:86">
P1: `ref` is accessed on `PluginSourceGitHub`, but that type does not define `ref`, causing a TypeScript error.</violation>

<violation number="2" location="apps/web/app/components/PluginCard.vue:94">
P2: Early return on unmatched URL leaves `loading` stuck `true` because it bypasses the `finally` reset.</violation>
</file>

<file name="apps/web/package.json">

<violation number="1" location="apps/web/package.json:7">
P1: The Node engine was bumped to `24.x`, which conflicts with the repo’s Node 22 baseline and can cause install/CI failures in environments pinned to 22.</violation>
</file>

<file name="apps/web/content.config.ts">

<violation number="1" location="apps/web/content.config.ts:45">
P2: Validate `source.url` as a real URL instead of accepting any string.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Browser as Browser (UI)
    participant Card as PluginCard Component
    participant Content as Nuxt Content / Schema
    participant Server as Server (Nuxt/Nitro)
    participant GitHub as GitHub (Raw/API)
    participant NPM as NPM Registry

    Note over Browser,NPM: Marketplace Plugin Loading & Metadata Flow

    Browser->>Content: Load marketplace data
    Content->>Content: Validate data via marketplace-schema
    Note right of Content: NEW: Validates 'url' and 'npm' source types

    Browser->>Card: Render PluginCard(plugin)
    
    rect rgb(240, 240, 240)
        Note over Card,GitHub: Metadata Fetch (Client-side)
        Card->>Card: checkSourceType()
        alt NEW: Source is 'github' OR 'url' (GitHub-compatible)
            Card->>Card: Construct raw.githubusercontent.com URL
            Card->>GitHub: fetch(".claude-plugin/plugin.json")
            GitHub-->>Card: return plugin metadata
        else Source is 'npm' or other
            Card->>Card: Skip metadata fetch
        end
    end

    rect rgb(240, 240, 240)
        Note over Server,GitHub: GitHub Statistics (Server-side)
        Server->>Server: CHANGED: parseGitHubRepo()
        Note right of Server: Strips '.git' suffix from URLs
        Server->>GitHub: GET /repos/{owner}/{repo}
        Note right of Server: CHANGED: Uses process.env.GITHUB_TOKEN
        GitHub-->>Server: return stars/forks
    end

    rect rgb(240, 240, 240)
        Note over Card,NPM: UI Rendering Logic
        alt NEW: source.source == 'npm'
            Card->>Card: NEW: Render link to npmjs.com/{package}
            Card->>Card: NEW: Show iconify-json/simple-icons (npm icon)
        else NEW: source.source == 'url'
            Card->>Card: NEW: Render raw URL (stripped of .git)
        else source.source == 'github'
            Card->>Card: Render link to github.com/{repo}
        end
    end

    Card-->>Browser: Display Plugin Card with source info

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}