Bob-Marketplace

### Problem Statement Modern AI coding assistants rely heavily on external configurations—Model Context Protocol (MCP) servers, custom operating modes, prompt skills, and workspace rules—to deliver specialized developer capabilities. However, the ecosystem around IBM Bob 2.0 extensions remains fragmented. Developers must manually scour unindexed GitHub repositories, copy-paste raw JSON/YAML blocks into hidden directories (~/.bob/settings/mcp.json), and troubleshoot silent syntax errors. Furthermore, there is no standardized registry, version pinning, or dependency accounting, leading to workspace pollution and configuration drift. ### Solution Overview Bob Marketplace is the first decentralized package manager and cloud registry engineered natively for the IBM Bob 2.0 agentic coding ecosystem. It bridges the gap between extension authors and developers by offering a comprehensive platform consisting of: 1. A Production Web Registry (https://bob.nodesemesta.com) with an 8-category agentic taxonomy, live search, and GitHub OAuth one-click publishing. 2. A One-Line Global Setup CLI (`npx bob-marketplace init`) that configures IBM Bob IDE globally in under 5 seconds. 3. An In-IDE stdio MCP Bridge (`@marketplace`) enabling conversational package management directly within the IBM Bob chat panel. ### Target Users & Interaction Flow Bob Marketplace serves AI developers, enterprise engineering teams, and open-source extension authors. - In-IDE Developers install extensions conversationally: typing `@marketplace add sample` triggers atomic downloads, validates manifests against strict Zod schemas, extracts assets to `.bob/`, and writes a deterministic lockfile (`.marketplace-lock.json`). Installed slash commands (such as `/sample run`) activate immediately without restarting the IDE. - Extension Publishers connect via GitHub OAuth to ingest repositories, tag versions, and distribute packages globally with zero-build pipeline overhead. ### Creativity & Uniqueness Unlike traditional package managers (npm, pip) that run opaque postinstall shell scripts, Bob Marketplace enforces declarative sandboxing with dual-layer path traversal protection. It guarantees cryptographic release immutability via Supabase Storage CDN and introduces the first standardized `bob-package.json` specification for agentic artifacts. ### Efficiency & Business Value Bob Marketplace collapses 15–30 minutes of manual configuration into a single 3-second conversational command, eliminating human syntax errors and establishing a foundational distribution layer for the future of agentic coding.