feat: add registry plugin system (#27)

* feat: implement generic registry plugin system

Refactor package scanning into a pluggable adapter-based architecture:

- Add RegistryAdapter trait for registry-specific logic
- Create unified ExtractedPackage and PackageMetadata types
- Implement NpmAdapter and PypiAdapter from existing code
- Add AdapterRegistry for managing multiple adapters
- Refactor PackageScanner to use scan_unified() and scan_tarball_unified()
- Update capabilities and agentic modules for unified types
- Remove old scanner/npm.rs and scanner/pypi.rs (moved to registry/)

This enables easier addition of new registries (crates.io, etc.) by
implementing the RegistryAdapter trait.

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: bump version to 0.1.7

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: update gitignore

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: homanp

.gitignore

@@ -25,4 +25,5 @@ Cargo.lock
 # Logs
 *.log
 
-awesome-express-starter
+AGENTS.md
+CLAUDE.md

Cargo.toml

@@ -11,7 +11,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.6"
+version = "0.1.7"
 edition = "2021"
 authors = ["sus contributors"]
 license = "MIT"

crates/common/src/models.rs

@@ -90,7 +90,7 @@ pub enum ScanPriority {
 }
 
 /// Package registry type
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, sqlx::Type, Default)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, sqlx::Type, Default)]
 #[sqlx(type_name = "varchar", rename_all = "lowercase")]
 #[serde(rename_all = "lowercase")]
 pub enum Registry {

crates/worker/src/main.rs

@@ -1,11 +1,12 @@
 //! sus Scan Worker - processes package scan jobs from the queue
 
+mod registry;
 mod scanner;
 mod skill_generator;
 
 use anyhow::Result;
 use axum::{routing::get, Json, Router};
-use common::{Database, Registry, ScanQueue};
+use common::{Database, ScanQueue};
 use scanner::{AgenticScanner, PackageScanner};
 use std::net::SocketAddr;
 use std::time::Duration;
@@ -95,40 +96,17 @@ async fn worker_loop(queue: ScanQueue, scanner: PackageScanner) {
 
                 let start = std::time::Instant::now();
 
-                // Handle tarball jobs vs registry jobs based on registry type
+                // Handle tarball jobs vs registry jobs using unified scan methods
                 let scan_result = if let Some(tarball_path) = &job.tarball_path {
-                    // Local tarball - determine type based on registry
-                    match job.registry {
-                        Registry::Pypi => {
-                            scanner
-                                .scan_pypi_tarball(std::path::Path::new(tarball_path))
-                                .await
-                        }
-                        _ => {
-                            // Default to npm for tarballs
-                            scanner
-                                .scan_tarball(std::path::Path::new(tarball_path))
-                                .await
-                        }
-                    }
+                    // Local tarball - use unified tarball scan
+                    scanner
+                        .scan_tarball_unified(job.registry, std::path::Path::new(tarball_path))
+                        .await
                 } else {
-                    // Remote registry scan
-                    match job.registry {
-                        Registry::Npm => scanner.scan(&job.package, job.version.as_deref()).await,
-                        Registry::Pypi => {
-                            scanner
-                                .scan_pypi(&job.package, job.version.as_deref())
-                                .await
-                        }
-                        Registry::Crates => {
-                            // TODO: Implement crates.io support
-                            tracing::warn!(
-                                package = %job.package,
-                                "Crates.io registry not yet supported"
-                            );
-                            Err(anyhow::anyhow!("Crates.io registry not yet supported"))
-                        }
-                    }
+                    // Remote registry scan - use unified scan
+                    scanner
+                        .scan_unified(job.registry, &job.package, job.version.as_deref())
+                        .await
                 };
 
                 match scan_result {

crates/worker/src/registry/mod.rs

@@ -0,0 +1,83 @@
+//! Registry adapter module
+//!
+//! This module provides a unified interface for interacting with different package registries
+//! (npm, PyPI, etc.) through the `RegistryAdapter` trait.
+
+mod npm;
+mod pypi;
+mod types;
+
+pub use npm::NpmAdapter;
+pub use pypi::PypiAdapter;
+pub use types::{ExtractedPackage, Language, Maintainer, PackageMetadata, SourceFile};
+
+use anyhow::Result;
+use async_trait::async_trait;
+use common::Registry;
+use std::collections::HashMap;
+use std::sync::Arc;
+
+/// Trait for registry-specific operations
+///
+/// Each registry (npm, PyPI, etc.) implements this trait to provide
+/// a unified interface for fetching metadata, downloading packages,
+/// and computing trust scores.
+#[async_trait]
+pub trait RegistryAdapter: Send + Sync {
+    /// Which registry this adapter handles
+    fn registry(&self) -> Registry;
+
+    /// Fetch package metadata (version, maintainers, downloads, etc.)
+    ///
+    /// If `version` is None, fetches the latest version.
+    async fn fetch_metadata(&self, name: &str, version: Option<&str>) -> Result<PackageMetadata>;
+
+    /// Download and extract package to a temporary directory
+    async fn download_package(&self, name: &str, version: &str) -> Result<ExtractedPackage>;
+
+    /// Extract a local tarball/package file
+    fn extract_local(&self, path: &std::path::Path) -> Result<ExtractedPackage>;
+
+    /// Compute trust score (0-100) based on registry-specific factors
+    fn compute_trust_score(&self, metadata: &PackageMetadata) -> u8;
+
+    /// Get CVE ecosystem identifier (e.g., "npm", "PyPI")
+    ///
+    /// Returns None if this registry doesn't have CVE tracking.
+    fn cve_ecosystem(&self) -> Option<&'static str>;
+
+    /// Fetch weekly download count (if available)
+    async fn fetch_downloads(&self, name: &str) -> Result<Option<i64>>;
+}
+
+/// Registry for managing all available adapters
+pub struct AdapterRegistry {
+    adapters: HashMap<Registry, Arc<dyn RegistryAdapter>>,
+}
+
+impl AdapterRegistry {
+    /// Create a new adapter registry with all built-in adapters
+    pub fn new() -> Self {
+        let mut adapters: HashMap<Registry, Arc<dyn RegistryAdapter>> = HashMap::new();
+        adapters.insert(Registry::Npm, Arc::new(NpmAdapter::new()));
+        adapters.insert(Registry::Pypi, Arc::new(PypiAdapter::new()));
+        Self { adapters }
+    }
+
+    /// Get an adapter for a specific registry
+    pub fn get(&self, registry: Registry) -> Option<Arc<dyn RegistryAdapter>> {
+        self.adapters.get(&registry).cloned()
+    }
+
+    /// Register a new adapter (useful for testing or custom registries)
+    #[allow(dead_code)]
+    pub fn register(&mut self, adapter: Arc<dyn RegistryAdapter>) {
+        self.adapters.insert(adapter.registry(), adapter);
+    }
+}
+
+impl Default for AdapterRegistry {
+    fn default() -> Self {
+        Self::new()
+    }
+}