feat: add Marketplace for app and TUI - #1

Issue for this PR

Closes anomalyco#28696

Related: anomalyco#33698 explored CLI installation for skills and agents. This PR keeps that useful direction, but implements a broader package model and one shared runtime for Desktop, embedded Web, TUI, CLI, and API clients.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Adds a unified Marketplace for plugins, skills, agents, commands, MCP servers, instructions, and bundles.

Marketplace state is stored in SQLite rather than opencode.json. Installed plans are projected into effective configuration in memory, so user-authored configuration stays user-owned and disabling one provider reveals the next provider cleanly.

Installation, aggregate updates, and profile imports use a two-step plan/apply flow. Planning materializes and hashes executable bytes; apply consumes that exact one-time plan in a revision-checked transaction without refetching it. The content-addressed cache rejects traversal, unsafe redirects, stale authorization/not-found responses, oversized artifacts, and corrupted digests.

The PR also adds:

• Desktop and TUI catalog, installed, update, source, package, skill, and MCP controls;
• a dedicated Marketplace HttpApi and regenerated clients;
• CLI list/install/update/import/export/lock/verify commands;
• authenticated private catalog sources in Desktop, API, and CLI, using header-to-environment bindings (including repeatable --header-env NAME=ENV) so secret values are resolved only at request time and are never stored;
• private GitLab repository discovery through REST file and tree endpoints, including repository URLs without .git, SSO-safe catalog fetching, and complete skill-tree materialization;
• SSH Git repository sources backed by the shared repository cache, with refresh support and preservation of the original SSH reference;
• automatic repair of legacy GitHub source records that stored an obsolete raw catalog candidate;
• compatibility checks, deterministic profiles, artifact locks, pagination, and audit history;
• adapters for the maintained OpenAI Plugins, GitHub Copilot Plugins, and Claude Code Plugins catalogs;
• discovery of .agents/plugins/marketplace.json, .github/plugin/marketplace.json, .plugin/marketplace.json, and .claude-plugin/marketplace.json, plus the native OpenCode paths;
• materialization of repository skill directories as individually named and independently toggleable skills;
• English documentation for users and source authors, including supported source/manifest forms and compatibility limits.

Private GitLab and SSH repositories

Private GitLab repository URLs are resolved through GitLab REST file and repository-tree endpoints. This avoids HTML SSO redirects returned by raw web routes while retaining the user-entered repository URL as the source reference. Source creation validates the catalog before persisting it.

Credentials are configured as header-to-environment bindings, for example PRIVATE-TOKEN=GITLAB_TOKEN. The environment variable is resolved only for the request; its secret value is not stored in SQLite or returned to clients. Desktop exposes separate header-name and environment-variable fields, and the CLI accepts repeatable --header-env NAME=ENV options.

Git repositories may also use SSH URLs. OpenCode clones and refreshes them through its shared repository cache and reads the catalog from the local checkout.

Unsupported foreign-runtime features such as hooks, LSP servers, commands, agents, and registered apps remain visible as compatibility requirements instead of being silently dropped. Listings with no installable OpenCode components are marked incompatible.

The implementation is split into twelve focused conventional commits on the current upstream dev. It intentionally excludes the unrelated reliability changes that appeared in the first draft branch.

How did you verify your code works?

• Full repository pre-push typecheck passed for all 36 workspace packages.
• Private GitLab regression coverage verifies raw-to-REST API translation, PRIVATE-TOKEN forwarding, catalog loading, and complete skill-tree materialization.
• Private GitLab E2E verified with PRIVATE-TOKEN=GITLAB_TOKEN: CLI and Desktop UI both loaded all 10 catalog entries.
• Core: typecheck and 30 Marketplace/catalog-adapter tests passed.
• OpenCode: typecheck and the complete 21-test Marketplace registry/cache/service/API/runtime suite passed.
• App, TUI, and Desktop package typechecks passed.
• Desktop production build passed.
• Native Linux CLI/TUI build and version smoke test passed (0.0.0-marketplace-upstream-202608020158).
• Documentation production build passed and generated all localized Marketplace routes.
• git diff --check passed.

Manual production-build click-through covered:

• adding and displaying all three maintained sources;
• installing and inspecting a GitHub Copilot plugin with one materialized skill;
• installing and inspecting a Claude Code plugin with four materialized skills;
• inspecting the OpenAI Cloudflare plugin as 9 skills plus 1 MCP server;
• toggling individual skills and the Cloudflare MCP server in both Desktop and TUI, including persistence after reload;
• the expected authentication prompt when enabling the Cloudflare MCP server;
• source, plugin, component, MCP, and command-palette views in Desktop and TUI.

The full App unit suite currently reports 689 passing tests and one unrelated pre-existing i18n parity failure: five general English keys are absent from the Arabic dictionary. Marketplace-specific tests and all affected-package typechecks pass.

Screenshots

Desktop: configured sources

OpenAI Plugins, GitHub Copilot, and Claude Code are connected as independent maintained sources.

Desktop: compatible GitHub Copilot and Claude Code plugins

The Copilot plugin exposes its materialized skill individually:

The Claude Code plugin exposes four independently manageable skills:

Desktop: Cloudflare skills and MCP controls

The OpenAI Cloudflare package resolves to 9 skills and 1 MCP server instead of one aggregate skill directory:

Individual skill and MCP switches retain their state:

TUI: the same materialized plan

The TUI reports the same 9-skill, 1-MCP plan:

Skills remain independently manageable:

The MCP server has its own persisted toggle:

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR