Skip to content

Add plugin marketplace picker#284

Merged
mbektas merged 3 commits into
plmbr:mainfrom
puneetdixit200:codex/plugin-install-marketplace-picker
May 18, 2026
Merged

Add plugin marketplace picker#284
mbektas merged 3 commits into
plmbr:mainfrom
puneetdixit200:codex/plugin-install-marketplace-picker

Conversation

@puneetdixit200
Copy link
Copy Markdown

@puneetdixit200 puneetdixit200 commented May 17, 2026

Summary

  • add an API to list plugins available in an added Claude plugin marketplace
  • read marketplace plugin entries from the cached .claude-plugin/marketplace.json
  • replace the freeform install input with marketplace and plugin dropdowns
  • install the selected plugin using plugin@marketplace

Validation

  • python -m pytest tests\test_plugin_manager.py -q
  • jlpm test tests/ts/plugins-panel.test.tsx --runInBand
  • jlpm build:lib
  • jlpm lint:check

Fixes #282

@puneetdixit200 puneetdixit200 changed the title [codex] Add plugin marketplace picker Add plugin marketplace picker May 17, 2026
@mbektas
Copy link
Copy Markdown
Collaborator

mbektas commented May 17, 2026

@puneetdixit200 PR is in Draft mode, are you planning to do more work?

@mbektas
Copy link
Copy Markdown
Collaborator

mbektas commented May 17, 2026

@pjdoland this looks good to me, could you also review?

@puneetdixit200 puneetdixit200 marked this pull request as ready for review May 17, 2026 15:37
Copilot AI review requested due to automatic review settings May 17, 2026 15:37
@mbektas mbektas added this to the 5.0.x milestone May 17, 2026
Copilot AI reviewed May 17, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

pjdoland
pjdoland reviewed May 17, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@pjdoland pjdoland left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for putting this together. The backend handler, route ordering, manifest path resolution, and the path-traversal validation all look solid. Three things I think are worth considering before this lands:

  1. Removing the freeform input is a regression for power users. Someone who already knows myplugin@official now has to scroll a dropdown to install it. Could the dialog keep a 'Specify manually' option (toggle or second tab) that restores the existing text field? The previous helper text explicitly promoted the plugin@marketplace shorthand.

  2. No way to refresh a stale marketplace cache. The endpoint reads whatever Claude last wrote to ~/.claude/plugins/marketplaces/<name>/.claude-plugin/marketplace.json. If a user added the marketplace months ago and a new plugin shipped yesterday, it won't appear in the picker, and without the manual input from (1) they can't install it from the UI at all. Either surface a refresh button (claude plugin marketplace update <name>) or keep the freeform fallback as a safety valve.

  3. Fallback inconsistency with #280. That PR adds p.name ?? p.id for installed plugins to handle Claude CLI version skew. The new pluginEntryName(plugin) here is only String(plugin.name ?? '').trim() and silently filters out entries with an empty name. If a marketplace manifest happens to use id for some entries (same skew that motivates #280), they'd drop out of the picker. Worth aligning the two paths so the same fallback applies.

@pjdoland pjdoland added the enhancement New feature or request label May 17, 2026
@mbektas
Copy link
Copy Markdown
Collaborator

mbektas commented May 17, 2026

@puneetdixit200 can you address the comments from @pjdoland above

@mbektas mbektas mentioned this pull request May 17, 2026
Closed
@mbektas
Copy link
Copy Markdown
Collaborator

mbektas commented May 18, 2026

@puneetdixit200 can you resolve the conflicts?

Merge remote-tracking branch 'origin/main' into codex/plugin-install-…
a677d45 
…marketplace-picker

# Conflicts:
#	src/components/plugins-panel.tsx
@mbektas mbektas merged commit 754158f into plmbr:main May 18, 2026
@pjdoland pjdoland mentioned this pull request May 22, 2026
Merged
pjdoland added a commit to pjdoland/notebook-intelligence that referenced this pull request May 22, 2026
@pjdoland
chore(release): prep 5.0.0 docs and version bump
f43fafa 
Promotes the [Unreleased] CHANGELOG snapshot to [5.0.0] - 2026-05-22
and expands it to cover everything merged into upstream/main after
PR plmbr#287's docs refresh. Bumps package.json to 5.0.0.

CHANGELOG additions cover the post-plmbr#287 surface:

- Settings tabs: plugin marketplace picker (plmbr#284), plugin marketplace
  details + Update button (plmbr#303), per-workspace MCP disable (plmbr#286),
  JSON-paste path in Add MCP server (plmbr#285).
- Launchers: hide-with-policy (plmbr#288), brand icons for Codex / opencode
  (plmbr#325, plmbr#333), per-launch directory picker (plmbr#332).
- Chat sidebar and agentic UX: workspace @-mention in Claude mode
  (plmbr#327), reload-open-files-on-disk (plmbr#330), steered system prompt
  away from over-eager notebook creation (plmbr#336).
- Skills: multi-manifest support (plmbr#321), tracks-upstream for user-
  imported skills (plmbr#322), HTTP kill switch for the reconciler (plmbr#291).
- Accessibility: full sub-section covering plmbr#305-plmbr#320.
- Security: shell-tool sandbox (plmbr#290), Claude UI-bridge sandbox (plmbr#323),
  0o600 on encrypted token (plmbr#293), env-secret scrubbing (plmbr#295), MCP
  config shape validation (plmbr#299), XSS allowlist (plmbr#296), Copilot WS
  auth + origin (plmbr#301), GHE host detection (plmbr#292), fastmcp -> mcp SDK
  swap (plmbr#324).
- Fixed: session listing unification (plmbr#310), session preview unwrap
  (plmbr#331), down-area runtime throw (plmbr#330 follow-up), WS message-handler
  leak (plmbr#294).
- Removed: fastmcp dependency, history.jsonl session gate.

Adds a Migration note covering the five behavior changes operators
should review before upgrading from 4.x: fastmcp swap, path
sandboxes, history.jsonl gate removal, workspace @-mention pointer
shape, and the Copilot WebSocket auth/origin tightening.

Two reviewer rounds (six personas each) applied:
- Round 1 caught security overclaims (plmbr#293, plmbr#299, plmbr#323), the
  plmbr#284/plmbr#303 mis-attribution, missing migration note, 3 em dashes,
  and the stale `fastmcp==2.x.*` recommendation in the admin guide.
- Round 2 caught the missing plmbr#301 migration bullet, missing version-
  matrix 5.0.x row, missing README TOC entry, and a couple of style
  nits (sub-heading overpromise, orphan bullet).

Skipped (deferred to future PRs):
- README first-run tour mention.
- Admin guide HTTP kill-switch row in Failure-modes table.
- Terminal drag-drop trust-model precision update after plmbr#327.
- Cipher description nit in plmbr#293 (Fernet AES-128-CBC+HMAC, not
  AES-GCM).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@mbektas mbektas mbektas approved these changes

+1 more reviewer

@pjdoland pjdoland pjdoland left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

enhancement New feature or request

Projects

None yet

Milestone

5.0.x

Development

Successfully merging this pull request may close these issues.

Plugin install enhancements

4 participants

@puneetdixit200 @mbektas @pjdoland