Improve npm install fallback for unpublished pm packages #133

Problem

In a real workspace smoke test, pm install npm:<package> fails hard when a package exists as a repo but is not yet published on npm.

Example failures observed:

• pm install npm:pm-brief --project
• pm install npm:pm-context --project

Both return an npm 404 from npm pack with a generic recovery bundle that suggests --json / --pack-destination, but does not help an agent recover to an installable source.

Why this matters for agents

Agents burn tokens diagnosing source availability and manually switching to github.com/unbraind/<repo> installs. This is avoidable and hurts first-run UX.

Repro

workspace=/tmp/pm-install-repro
rm -rf "$workspace" && mkdir -p "$workspace" && cd "$workspace"
git init -q
pm init --yes
pm install npm:pm-brief --project

Expected

When npm:<name> is missing:

1. Detect npm 404 specifically.
2. Suggest (or optionally auto-try) canonical fallback sources in priority order:
   • github.com/unbraind/<name> when repository exists
   • matching entry from package/extension catalog (if available)
3. Emit concise machine-readable hints in JSON output (fallback_candidates, next_best_command).

Suggested implementation

• Add a resolver layer for install targets:
  • classify npm errors (404 vs auth vs network)
  • query known catalog + optional GitHub existence check
  • provide deterministic fallback suggestion payload
• Optional flag: --auto-fallback to attempt the first safe fallback without re-prompting.

Impact

Lower token usage, faster autonomous recovery, and better install ergonomics for mixed npm/GitHub package ecosystems.