Marketplace catalog unreachable via symlinked .claude-plugin path (breaks plugin-directory / `github://openhands/extensions`)

[jpelletier1]

Summary

When the plugin-directory is configured with MARKETPLACE_SOURCE=github://openhands/extensions, the marketplace catalog does not render — the Plugin Directory shows an empty catalog.

Root cause: the catalog is exposed through a double symlink, and raw.githubusercontent.com does not dereference symlinks through directory paths.

How plugin-directory fetches the catalog

openhands/plugin-directory builds a hardcoded raw URL from the source config (server/app/services/marketplace_service.py):

CATALOG_PATH = ".claude-plugin/marketplace.json"
url = f"https://raw.githubusercontent.com/{owner}/{repo}/{ref}/{catalog_path}"

So it requests exactly:

https://raw.githubusercontent.com/openhands/extensions/main/.claude-plugin/marketplace.json

The symlink chain in this repo

Traced via the GitHub git Trees API (mode=120000 = symlink):

Path	Git mode	Type	Target
.claude-plugin	120000	symlink	.plugin
.plugin/marketplace.json	120000	symlink	../marketplaces/openhands-extensions.json
marketplaces/openhands-extensions.json	100644	real file	(the actual catalog)

Verification

raw.githubusercontent.com serves the raw blob content stored in git. A symlink is stored as a blob whose content is the link-target text, and the raw server does not traverse symlinked directory paths:

• .claude-plugin/marketplace.json → HTTP 404 (symlinked directory not traversable)
• .plugin/marketplace.json → returns the literal string ../marketplaces/openhands-extensions.json (the symlink blob body), not the JSON catalog — so even if level 1 resolved, JSON parsing would fail
• marketplaces/openhands-extensions.json → HTTP 200, the real catalog JSON

As a result, plugin-directory's fetch_catalog() raises CatalogUnavailableError on the 404, the plugins list comes back empty, and nothing renders. This is a server-side (GitHub raw) limitation, not something the plugin-directory client can work around — the catalog simply never arrives.

Suggested fix

1. In this repo (simplest): commit a real .claude-plugin/marketplace.json file (or a real .claude-plugin/ directory) instead of the symlink chain, so the catalog is reachable at the path plugin-directory (and other consumers using the standard .claude-plugin/marketplace.json convention) expects.

Happy to open a PR for either direction if helpful.

---

This issue was created by an AI agent (OpenHands) on behalf of a user.

[jpelletier1]

@OpenHands please implement a fix and then create a PR

[openhands-ai]

I'm on it! jpelletier1 can track my progress at all-hands.dev

[openhands-ai]

I fixed issue #394 and opened PR #395: #395

What was wrong

The marketplace catalog was unreachable at the standard .claude-plugin/marketplace.json path because it was exposed through a double symlink chain:

• .claude-plugin (symlink) → .plugin
• .plugin/marketplace.json (symlink) → ../marketplaces/openhands-extensions.json

raw.githubusercontent.com serves git symlinks as their literal target text and does not traverse symlinked directory paths. So consumers using MARKETPLACE_SOURCE=github://openhands/extensions (e.g. openhands/plugin-directory) got a 404 at .claude-plugin/marketplace.json and the literal symlink body at .plugin/marketplace.json — an empty Plugin Directory. This is a server-side GitHub raw limitation the client cannot work around.

The fix

1. Replaced the root vendor symlinks with real directories + real marketplace.json files under .claude-plugin/, .codex-plugin/, and .plugin/, each mirroring the canonical marketplaces/openhands-extensions.json byte-for-byte (canonicalized JSON). Git mode changed from 120000 (symlink) to 100644 (regular file).
2. Added a root-marketplace sync task to scripts/sync_extensions.py that keeps these copies in sync with the canonical file and reports drift in --check mode. CI runs python scripts/sync_extensions.py --check with no task filter, so the new task is automatically enforced on every PR.
3. Added tests in tests/test_sync_extensions.py (TestRootMarketplace) verifying the real-repo files are non-symlinks, match the canonical catalog, are valid JSON, and that the sync task both detects and fixes the original symlink chain and stale copies.
4. Updated AGENTS.md documenting the invariant (root catalog copies are real files, never symlinks).

Verification

• python scripts/sync_extensions.py --check exits 0 (only the pre-existing, non-blocking coverage warning for plugins/issue-duplicate-checker remains — unrelated to this change).
• python -m pytest tests/test_sync_extensions.py -q → 40 passed.
• Broader non-SDK suite (test_plugin_manifest, test_skills_catalog, test_catalogs, test_skills_have_readme, test_version_alignment) → 113 passed.
• The only failing tests in the wider suite (test_sdk_loading.py, one case in test_skill_plugin_loading.py) fail solely due to the openhands SDK not being installed in this base environment (per AGENTS.md), unrelated to this change.

After merge to main, curl https://raw.githubusercontent.com/OpenHands/extensions/main/.claude-plugin/marketplace.json will return the catalog JSON (HTTP 200) instead of 404.

[NataliaBorova]

Additional investigation

Confirmed this issue causes "no agents visible in marketplace" in Agent Canvas deployments. The registered_marketplaces field stays empty because the marketplace catalog cannot be fetched.

Local cache verification (this repo):

.claude-plugin -> .plugin  (symlink)
.plugin/marketplace.json  (actual file, NOT symlink in cached copy)

The local cache works, but raw.githubusercontent.com follows symlinks differently than local filesystem.

Impact: Any Agent Canvas instance trying to fetch the marketplace catalog via the standard GitHub raw URL path gets a 404 or invalid JSON, causing the marketplace to appear empty.