fix: プラグインインストールの PATH 不整合とライブラリパス修正

.claude/plugins/known_marketplaces.json.template

@@ -1,4 +1,12 @@
 {
+  "agent-browser": {
+    "source": {
+      "source": "github",
+      "repo": "vercel-labs/agent-browser"
+    },
+    "installLocation": "{{HOME}}/.claude/plugins/marketplaces/agent-browser",
+    "lastUpdated": "2025-01-01T00:00:00.000Z"
+  },
   "anthropic-agent-skills": {
     "source": {
       "source": "git",
@@ -39,12 +47,28 @@
     "installLocation": "{{HOME}}/.claude/plugins/marketplaces/claude-plugins-official",
     "lastUpdated": "2025-01-01T00:00:00.000Z"
   },
+  "intellectronica-skills": {
+    "source": {
+      "source": "github",
+      "repo": "intellectronica/agent-skills"
+    },
+    "installLocation": "{{HOME}}/.claude/plugins/marketplaces/intellectronica-skills",
+    "lastUpdated": "2025-01-01T00:00:00.000Z"
+  },
   "playwright-skill": {
     "source": {
       "source": "github",
       "repo": "lackeyjb/playwright-skill"
     },
     "installLocation": "{{HOME}}/.claude/plugins/marketplaces/playwright-skill",
     "lastUpdated": "2025-01-01T00:00:00.000Z"
+  },
+  "supabase-agent-skills": {
+    "source": {
+      "source": "github",
+      "repo": "supabase/agent-skills"
+    },
+    "installLocation": "{{HOME}}/.claude/plugins/marketplaces/supabase-agent-skills",
+    "lastUpdated": "2025-01-01T00:00:00.000Z"
   }
 }

.claude/plugins/plugins.txt

@@ -23,3 +23,12 @@ backend-development@claude-code-workflows
 full-stack-orchestration@claude-code-workflows
 database-design@claude-code-workflows
 database-migrations@claude-code-workflows
+
+# === Supabase Agent Skills (Plugin) ===
+postgres-best-practices@supabase-agent-skills
+
+# === Vercel Agent Browser (Plugin) ===
+agent-browser@agent-browser
+
+# === Context7 (Plugin) ===
+context7@intellectronica-skills

.claude/skills/skills.txt

@@ -14,6 +14,7 @@ vercel-labs/agent-skills@vercel-composition-patterns
 
 # === Supabase Agent Skills ===
 # Supabase 開発のベストプラクティス
+# Plugin 併用: postgres-best-practices@supabase-agent-skills
 supabase/agent-skills
 supabase/agent-skills@supabase-postgres-best-practices
 
@@ -23,8 +24,10 @@ vercel-labs/skills
 
 # === Vercel Agent Browser ===
 # ブラウザ自動化（テスト、フォーム、スクリーンショット、データ抽出）
+# Plugin 併用: agent-browser@agent-browser
 vercel-labs/agent-browser
 
 # === Context7 ===
 # ライブラリ・フレームワークの最新ドキュメント取得
+# Plugin 併用: context7@intellectronica-skills
 intellectronica/agent-skills

.devcontainer/Dockerfile

@@ -1,8 +1,8 @@
 FROM mcr.microsoft.com/devcontainers/base:ubuntu
 
 # Build arguments
 ARG CLAUDE_CODE_OAUTH_TOKEN
 ARG ANTHROPIC_API_KEY
 ARG IMAGE_VERSION="dev"
 
 # OCI Image Labels for version tracking
@@ -12,7 +12,7 @@
       org.opencontainers.image.description="DevContainer base image with Claude Code, Codex, and development tools"
 
 # Install dependencies and Node.js using official binaries
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get upgrade -y && apt-get install -y \
     curl \
     git \
     alsa-utils \
@@ -77,6 +77,7 @@
 USER vscode
 RUN curl -fsSL https://claude.ai/install.sh | bash -s 2.1.39 \
  && echo 'export PATH="$HOME/.claude/local/bin:$PATH"' >> /home/vscode/.bashrc
+ENV PATH="/home/vscode/.claude/local/bin:${PATH}"
 USER root
 
 # Install other global npm packages
@@ -124,7 +125,7 @@
 COPY --chown=vscode:vscode script/install-skills.sh /tmp/install-skills.sh
 COPY --chown=root:root script/setup-claude.sh /usr/local/bin/setup-claude.sh
 COPY --chown=vscode:vscode script/setup-claude-build.sh /tmp/setup-claude-build.sh
-COPY --chown=vscode:vscode script/lib /tmp/script-lib
+COPY --chown=vscode:vscode script/lib /tmp/script/lib
 COPY --chown=root:root script/lib /usr/local/script/lib
 COPY --chown=root:root script/*.sh /usr/local/script/
 RUN chmod +x /usr/local/bin/setup-claude.sh /tmp/setup-claude-build.sh /tmp/install-skills.sh /usr/local/script/*.sh

.trivyignore

@@ -38,3 +38,16 @@ CVE-2024-24790
 # Expected resolution: Wait for Doppler to rebuild with patched Go version
 # Tracking: https://github.com/DopplerHQ/cli/issues (monitor for Go version update)
 CVE-2025-68121
+
+# Vercel CLI path-to-regexp vulnerability
+# @vercel/node@5.6.3 and @vercel/remix-builder@5.5.10 still depend on path-to-regexp@6.1.0
+# Vercel has started migration (added path-to-regexp-updated@6.3.0 alias) but hasn't removed the old dep
+
+# CVE-2024-45296: path-to-regexp: Backtracking regular expressions cause ReDoS
+# Severity: HIGH
+# Affected: path-to-regexp 6.1.0 (via @vercel/node, @vercel/remix-builder)
+# Fixed in: 6.3.0
+# Reason: Transitive dependency via Vercel CLI, cannot override without upstream fix
+# Expected resolution: Wait for Vercel to complete migration to path-to-regexp@6.3.0+
+# Tracking: https://github.com/vercel/vercel/issues
+CVE-2024-45296

npm/global.json

@@ -74,7 +74,7 @@
       "overridden": false
     },
     "vercel": {
-      "version": "50.15.1",
+      "version": "50.16.0",
       "overridden": false
     }
   }

script/install-claude-plugins.sh

@@ -2,6 +2,7 @@
 # ============================================================================
 # Claude Code Plugin Installer (for Docker build)
 # Docker ビルド時にプラグインをインストールするスクリプト
+# ライブラリ (claude_plugins.sh) を使用して管理
 # ============================================================================
 
 set -euo pipefail
@@ -10,25 +11,52 @@ PLUGINS_FILE="${1:-/home/vscode/.claude/plugins/plugins.txt}"
 CLAUDE_DIR="/home/vscode/.claude"
 CREDENTIALS_SECRET="/run/secrets/claude_credentials"
 
-echo "[INFO] Claude プラグインのインストールを開始します..."
+# --- PATH フォールバック ---
+# Dockerfile の ENV PATH で設定されるが、念のため確認
+for _bin_dir in "/home/vscode/.claude/local/bin" "${HOME}/.claude/local/bin"; do
+    if [[ -d "$_bin_dir" ]] && [[ ":${PATH}:" != *":${_bin_dir}:"* ]]; then
+        export PATH="${_bin_dir}:${PATH}"
+    fi
+done
+
+# --- ライブラリ読み込み ---
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LIB_DIR=""
+
+for _candidate in "/tmp/script/lib" "/usr/local/script/lib" "${SCRIPT_DIR}/lib"; do
+    if [[ -d "$_candidate" ]] && [[ -f "${_candidate}/output.sh" ]]; then
+        LIB_DIR="$_candidate"
+        break
+    fi
+done
+
+if [[ -z "$LIB_DIR" ]]; then
+    echo "[ERROR] ライブラリディレクトリが見つかりません"
+    exit 1
+fi
+
+# shellcheck source=script/lib/output.sh
+source "${LIB_DIR}/output.sh"
+# shellcheck source=script/lib/claude_plugins.sh
+source "${LIB_DIR}/claude_plugins.sh"
 
-# プラグインリストが存在するか確認
+log_info "Claude プラグインのインストールを開始します..."
+
+# --- プラグインリスト確認 ---
 if [[ ! -f "$PLUGINS_FILE" ]]; then
-    echo "[WARN] plugins.txt が見つかりません: ${PLUGINS_FILE}"
+    log_warn "plugins.txt が見つかりません: ${PLUGINS_FILE}"
     exit 0
 fi
 
-# 認証情報の設定
+# --- 認証情報の設定 ---
 mkdir -p "$CLAUDE_DIR"
 
-# 方法1: BuildKit secret からコピー（推奨）
 if [[ -f "$CREDENTIALS_SECRET" ]]; then
-    echo "[INFO] BuildKit secret から認証情報を読み込み中..."
+    log_info "BuildKit secret から認証情報を読み込み中..."
     cp "$CREDENTIALS_SECRET" "${CLAUDE_DIR}/.credentials.json"
     chmod 600 "${CLAUDE_DIR}/.credentials.json"
-# 方法2: 環境変数から作成（OAuth トークンまたは API キー）
 elif [[ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]]; then
-    echo "[INFO] CLAUDE_CODE_OAUTH_TOKEN から認証情報を作成中..."
+    log_info "CLAUDE_CODE_OAUTH_TOKEN から認証情報を作成中..."
     cat > "${CLAUDE_DIR}/.credentials.json" << EOF
 {
   "claudeAiOauth": {
@@ -38,7 +66,7 @@ elif [[ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]]; then
 }
 EOF
 elif [[ -n "${ANTHROPIC_API_KEY:-}" ]]; then
-    echo "[INFO] ANTHROPIC_API_KEY から認証情報を作成中..."
+    log_info "ANTHROPIC_API_KEY から認証情報を作成中..."
     cat > "${CLAUDE_DIR}/.credentials.json" << EOF
 {
   "claudeAiOauth": {
@@ -48,50 +76,32 @@ elif [[ -n "${ANTHROPIC_API_KEY:-}" ]]; then
 }
 EOF
 else
-    echo "[ERROR] 認証情報が見つかりません"
+    log_warn "認証情報が見つかりません"
     echo "  - BuildKit secret: $CREDENTIALS_SECRET"
     echo "  - 環境変数: CLAUDE_CODE_OAUTH_TOKEN または ANTHROPIC_API_KEY"
     exit 1
 fi
 
-echo "[INFO] マーケットプレイスを初期化中..."
-# 必須マーケットプレイスを追加（完全なHTTPS URLを使用）
-claude plugin marketplace add https://github.com/anthropics/claude-plugins-official.git 2>&1 || echo "[WARN] claude-plugins-official already exists or failed to add"
-claude plugin marketplace add https://github.com/anthropics/claude-code.git 2>&1 || echo "[WARN] claude-code-plugins already exists or failed to add"
-claude plugin marketplace add https://github.com/wshobson/agents.git 2>&1 || echo "[WARN] claude-code-workflows already exists or failed to add"
-claude plugin marketplace add https://github.com/lackeyjb/playwright-skill.git 2>&1 || echo "[WARN] playwright-skill already exists or failed to add"
-
-echo "[INFO] プラグインをインストール中..."
-echo "[DEBUG] Claude version: $(claude --version 2>&1 || echo 'not found')"
-echo "[DEBUG] Marketplaces directory: ${CLAUDE_DIR}/plugins/marketplaces"
-ls -la "${CLAUDE_DIR}/plugins/marketplaces" 2>/dev/null || echo "[WARN] Marketplaces directory not found"
-
-installed=0
-failed=0
-
-while IFS= read -r line || [[ -n "$line" ]]; do
-    # 空行とコメント行をスキップ
-    [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
-
-    # 前後の空白を除去
-    plugin=$(echo "$line" | xargs)
-    [[ -z "$plugin" ]] && continue
-
-    echo "[INFO]   インストール中: ${plugin}"
-
-    # エラー出力をキャプチャ
-    if output=$(claude plugin install "$plugin" 2>&1); then
-        echo "[SUCCESS]   完了: ${plugin}"
-        installed=$((installed + 1))
-    else
-        echo "[ERROR]   失敗: ${plugin}"
-        echo "[ERROR]   エラー詳細: ${output}"
-        failed=$((failed + 1))
-    fi
-done < "$PLUGINS_FILE"
+# --- known_marketplaces.json 生成 ---
+TEMPLATE="${CLAUDE_DIR}/plugins/known_marketplaces.json.template"
+KNOWN_MARKETPLACES="${CLAUDE_DIR}/plugins/known_marketplaces.json"
+
+if [[ -f "$TEMPLATE" ]]; then
+    log_info "テンプレートから known_marketplaces.json を生成中..."
+    sed "s|{{HOME}}|${HOME}|g" "$TEMPLATE" > "$KNOWN_MARKETPLACES"
+    log_success "known_marketplaces.json を生成しました"
+fi
+
+# --- Claude CLI 確認 ---
+log_info "Claude version: $(claude --version 2>&1 || echo 'not found')"
+
+# --- マーケットプレイス追加 ---
+plugins::detect_and_add_marketplaces "$PLUGINS_FILE" "$KNOWN_MARKETPLACES"
+
+# --- プラグインインストール ---
+plugins::install_from_manifest "$PLUGINS_FILE"
 
-# 認証情報を削除（セキュリティのため）
+# --- 認証情報を削除（セキュリティ） ---
 rm -f "${CLAUDE_DIR}/.credentials.json"
 
-echo "[INFO] プラグイン: ${installed} インストール完了、${failed} 失敗/スキップ"
-echo "[SUCCESS] Claude プラグインのインストールが完了しました"
+log_success "Claude プラグインのインストールが完了しました"

script/lib/claude_plugins.sh

@@ -10,12 +10,15 @@ set -euo pipefail
 # Fallback marketplace list (synced with known_marketplaces.json.template)
 # Format: "name:repo" for GitHub repos, "name:url:https://..." for full URLs
 readonly PLUGINS_KNOWN_MARKETPLACES_FALLBACK=(
+    "agent-browser:vercel-labs/agent-browser"
     "anthropic-agent-skills:url:https://github.com/anthropics/skills.git"
     "claude-code-plugins:anthropics/claude-code"
     "claude-code-templates:url:https://github.com/davila7/claude-code-templates.git"
     "claude-code-workflows:wshobson/agents"
     "claude-plugins-official:anthropics/claude-plugins-official"
+    "intellectronica-skills:intellectronica/agent-skills"
     "playwright-skill:lackeyjb/playwright-skill"
+    "supabase-agent-skills:supabase/agent-skills"
 )
 
 # コマンド・エージェント・フックの同期