fix(marketplace): handle invalid registrations safely

src/cli/commands/plugin-skills.ts

@@ -18,7 +18,7 @@ import {
 } from '../../constants.js';
 import {
   addMarketplace,
-  findMarketplace,
+  findMarketplaceRegistration,
   listMarketplacePlugins,
   updateMarketplace,
 } from '../../core/marketplace.js';
@@ -645,14 +645,14 @@ async function installSkillViaMarketplace(opts: {
 
   // Check if the marketplace is already registered at any scope (user or project)
   let marketplaceName: string | undefined;
-  const existingAnyScope = await findMarketplace(
+  const existingAnyScope = await findMarketplaceRegistration(
     parsed?.repo ?? from,
     sourceLocation,
     isUser ? undefined : workspacePath,
   );
 
   if (existingAnyScope) {
-    marketplaceName = existingAnyScope.name;
+    marketplaceName = existingAnyScope.key;
     await updateMarketplace(
       marketplaceName,
       isUser ? undefined : workspacePath,
@@ -1182,14 +1182,14 @@ async function selectAndInstallSkillsFromSource(opts: {
     const sourceLocation = parsed ? `${parsed.owner}/${parsed.repo}` : undefined;
 
     let marketplaceName: string | undefined;
-    const existingAnyScope = await findMarketplace(
+    const existingAnyScope = await findMarketplaceRegistration(
       parsed?.repo ?? from,
       sourceLocation,
       isUser ? undefined : workspacePath,
     );
 
     if (existingAnyScope) {
-      marketplaceName = existingAnyScope.name;
+      marketplaceName = existingAnyScope.key;
       await updateMarketplace(marketplaceName, isUser ? undefined : workspacePath);
     } else {
       const scopeOptions = isUser
@@ -1534,14 +1534,14 @@ async function installAllViaMarketplace(opts: {
   const sourceLocation = parsed ? `${parsed.owner}/${parsed.repo}` : undefined;
 
   let marketplaceName: string | undefined;
-  const existingAnyScope = await findMarketplace(
+  const existingAnyScope = await findMarketplaceRegistration(
     parsed?.repo ?? from,
     sourceLocation,
     isUser ? undefined : workspacePath,
   );
 
   if (existingAnyScope) {
-    marketplaceName = existingAnyScope.name;
+    marketplaceName = existingAnyScope.key;
     await updateMarketplace(
       marketplaceName,
       isUser ? undefined : workspacePath,

src/cli/commands/plugin.ts

@@ -6,6 +6,7 @@ import {
   updateMarketplace,
   listMarketplacePlugins,
   findMarketplace,
+  findMarketplaceRegistration,
   parsePluginSpec,
   getAllagentsDir,
   getMarketplaceVersion,
@@ -15,6 +16,7 @@ import {
   loadRegistryFromPath,
   type ScopedMarketplaceEntry,
   getMarketplaceOverrides,
+  getMarketplaceAccessError,
 } from '../../core/marketplace.js';
 import { syncWorkspace, syncUserWorkspace } from '../../core/sync.js';
 import { loadSyncState } from '../../core/sync-state.js';
@@ -276,7 +278,7 @@ const marketplaceListCmd = command({
       if (isJsonMode()) {
         const enriched = await Promise.all(
           marketplaces.map(async (mp) => {
-            const version = await getMarketplaceVersion(mp.path);
+            const version = await getMarketplaceVersion(mp);
             return {
               ...mp,
               ...(version && {
@@ -327,7 +329,7 @@ const marketplaceListCmd = command({
         console.log(`  ❯ ${mp.name} (${mp.scope})`);
         console.log(`    Source: ${sourceLabel}`);
 
-        const version = await getMarketplaceVersion(mp.path);
+        const version = await getMarketplaceVersion(mp);
         if (version) {
           const ts = version.date.toISOString().replace('T', ' ').slice(0, 16);
           console.log(`    Version: ${version.hash} (${ts})`);
@@ -491,12 +493,16 @@ const marketplaceRemoveCmd = command({
             name,
             path: result.marketplace?.path,
             retainedUserPlugins: result.retainedUserPlugins ?? [],
+            warnings: result.warnings ?? [],
           },
         });
         return;
       }
 
       console.log(`\u2713 Marketplace '${name}' removed`);
+      for (const warning of result.warnings ?? []) {
+        console.warn(`Warning: ${warning}`);
+      }
       if (result.retainedUserPlugins && result.retainedUserPlugins.length > 0) {
         console.log(`\n  \u26A0 ${result.retainedUserPlugins.length} plugin(s) still reference this marketplace:`);
         for (const p of result.retainedUserPlugins) {
@@ -1408,8 +1414,9 @@ const pluginUpdateCmd = command({
 
         return {
           parsePluginSpec,
-          getMarketplace: (name: string, sourceLocation?: string) =>
-            findMarketplace(name, sourceLocation, workspacePath),
+          getMarketplaceRegistration: (name: string, sourceLocation?: string) =>
+            findMarketplaceRegistration(name, sourceLocation, workspacePath),
+          validateMarketplaceAccess: getMarketplaceAccessError,
           parseMarketplaceManifest,
           updateMarketplace: async (name: string) => {
             // Skip if already updated in this scope during this run

src/cli/tui/actions/plugins.ts

@@ -17,7 +17,8 @@ import {
   addMarketplace,
   removeMarketplace,
   updateMarketplace,
-  findMarketplace,
+  findMarketplaceRegistration,
+  getMarketplaceAccessError,
   parsePluginSpec,
   type MarketplaceEntry,
   type MarketplacePluginsResult,
@@ -42,8 +43,9 @@ function createUpdateDeps(workspacePath?: string) {
   const updatedMarketplaces = new Set<string>();
   return {
     parsePluginSpec,
-    getMarketplace: (name: string, sourceLocation?: string) =>
-      findMarketplace(name, sourceLocation, workspacePath),
+    getMarketplaceRegistration: (name: string, sourceLocation?: string) =>
+      findMarketplaceRegistration(name, sourceLocation, workspacePath),
+    validateMarketplaceAccess: getMarketplaceAccessError,
     parseMarketplaceManifest,
     updateMarketplace: async (name: string) => {
       if (updatedMarketplaces.has(name)) {
@@ -880,6 +882,10 @@ async function runMarketplaceDetail(
           continue;
         }
 
+        if (result.warnings && result.warnings.length > 0) {
+          p.note(result.warnings.join('\n'), 'Warning');
+        }
+
         cache?.invalidate();
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);