[zheng-weihao]

Motivation

On a poor-quality network, plugin install failed silently: the marketplace error was swallowed, and the user saw only plugin install failed with no way to tell why.

Changes

install.sh

• Source resolution now lands on a chain: ORBIT_SOURCES > ORBIT_SOURCE > local checkout > default shorthand. Each retry rotates to the next entry; a one-entry chain never rotates, so a plain install stays single-source and stable.
• Every network operation goes through net_run: ORBIT_RETRY attempts (default 3), ORBIT_RETRY_DELAY_SECONDS apart (default 5), each attempt killed at ORBIT_TIMEOUT_SECONDS (default 60) via a portable TERM→grace→KILL timer (macOS has no GNU timeout). The final attempt prints the command's real error — nothing is silently swallowed.
• A marketplace add/update that fails through every retry now prints the CLI's real error plus a warning naming it as the root cause, then lets the plugin install decide (verified: all three agent CLIs exit 1 with a clear message when the marketplace is missing) — no parsing of unstable marketplace list output.
• GIT_TERMINAL_PROMPT=0 so a 404/private repo can't freeze the run on an interactive credential prompt (inherited by the agent CLIs' own clones).
• Latent bug fixed: --opencode with a URL source always failed — the --sparse clone never materialized .opencode-plugin/ or skills/.
• Mixed-chain fix: a path entry inside ORBIT_SOURCES now fetches via cp (previously the case fell through and net_run reported success with an empty orbit.sh).

try.sh

• Moved to the repo root (shorter canonical URL main/try.sh; future examples can still live in examples/).
• Piped, zero-config runs supply a shorthand → HTTPS → SSH chain so demo installs ride out intermittent blocks; user-set ORBIT_SOURCE/ORBIT_SOURCES pass through untouched. install.sh is fetched once (with retries), and retry knobs are validated up front.
• Plugin install output flows live; failure falls back to manual launch instructions.
• The OpenCode launch hint is now opencode --prompt start (stays in the TUI; run is headless).

Install command format — all user-facing commands switch to the Homebrew-style idiom /bin/bash -c "$(curl -fsSL …)": the script downloads fully before executing (no half-script execution on a cut connection), and _ holds $0 when flags follow.

Docs — README slims to bullets + links (demo blocks split per agent for one-click copy); USAGE.md gains a "Network-resilient installs" section (scope, knob table, chain priority, marketplace failure semantics, escape hatch).

Verification

• make lint clean; bats 29/29 (chain rotation order and wrap-around, pinned source, ORBIT_SOURCES priority, mixed-chain path entries, TERM/KILL timeout, knob validation, marketplace warn-then-install, try.sh passthrough and failure visibility).
• Live-tested on a network where github.com:443 was intermittently blocked: with the 3-entry chain, claude/codex/qoder/opencode installed 4/4 (raw timed out → HTTPS timed out → SSH succeeded). With SSH disabled, 4/4 failed — but with the full error chain visible (no silence, no hang).
• bash 3.2 (stock macOS) compatible: two set -u traps (empty-array expansion, out-of-range index) fixed.