CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 15 Wiki Activity

Triple-C marketplace: agents, skills, commands, hooks and plugins for all or individual containers #65

Merged
jknapp merged 48 commits from feat/marketplace into main 2026-09-27 23:43:27 +00:00
Conversation 0 Commits 48 Files Changed 91
+5 -3
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 2ce019c470 - Show all commits
CLAUDE.md
+5 -3
View File
@@ -732,9 +732,11 @@ a project's Docker volumes are deliberately out of scope — this is not a proje
(`validate_imported_marketplace_state`) — an import is untrusted input, not a trusted restore.
The preview warns whenever the import carries one or more **global hook installs or global
plugin installs**, in addition to the base-URL and custom-image warnings above: a hook runs
commands in every project container, and a plugin can carry its own hooks and MCP servers into
one — and an imported install skips the hook-confirm step an install from the Marketplace tab
shows, so this is the only place that confirmation happens for an import.
commands in every project container, and a plugin can carry its own hooks, MCP/LSP servers and
commands into one. In the Marketplace tab both kinds have a confirm step before they install
(`HookConfirmModal` lists a hook's commands, `PluginConfirmModal` lists everything a plugin
brings that runs); an import installs them without either, so the preview warning is the only
place that confirmation happens for an import.
- **Encrypted because it can carry live credentials, not for appearance's sake.** Argon2id derives
a 256-bit key from the user's password (memory-hard — meaningfully resistant to GPU/ASIC
brute-forcing, unlike PBKDF2 at any reasonable iteration count), AES-256-GCM does the actual