[leijuns]

Purpose

Claude Code marketplaces can give a plugin entry an object source for a plugin hosted outside the marketplace repository: github, url, git-subdir, npm, archive, or command (marketplace reference). For example:

{"name": "aha-skills", "source": {"source": "archive", "url": "https://example.com/aha-skills.zip"}, "skills": ["./aha-react-ui-generator"]}

marketplacePlugin.Source is a string, so a single entry like this makes json.Unmarshal fail for the whole marketplace.json. ReadCatalog then falls back to readSkillsDir("skills"), which only lists the top level of skills/. Every skill that the marketplace lists at a nested path disappears from clime skills install.

Behavior change

• source is decoded as json.RawMessage.
• A plugin whose source is a string, or absent, works as before.
• A plugin whose source is an object is skipped. Its files are not in the repository snapshot, so clime cannot install them, which matches the design rule that skills are read from the snapshot.

Installing remote-source plugins is out of scope here.

Test evidence

• New test TestReadCatalogFromMarketplaceSkipsRemoteSources covers a local plugin with a nested skill path next to archive, github, and git-subdir entries. It fails on master (the catalog falls back to skills/unlisted) and passes with this change.

• gofmt -l is clean. go vet ./... and go test ./... pass with LC_ALL=C. Without it, TestSnapshotReportsFetchProgressAndKeepsCacheHitsSilent fails on a machine whose git prints localized progress; that failure is unrelated to this change.

• I also ran ReadCatalog against a copy of a real marketplace (AfterShip/skills) after moving three skills into an archive entry:

  	Skills found
  master	69 (fallback scan; drops skills/cli/clime-cli, skills/cli/files-cli, skills/qa-common/* ×3, skills/pltf-nf/enter, skills/infrastructure/query)
  this branch	76

🤖 Generated with Claude Code