@chatcode/cco-market 1.45.1

package/lib/updates.js

@@ -0,0 +1,361 @@
+/**
+ * Update detection: per-plugin comparison of what the profile has against
+ * the source of truth — git HEAD for github installs, the npm latest
+ * dist-tag for registry installs — with a TTL cache.
+ */
+import { DIST_TAG } from './channels.js';
+import { resolveHeadCommit } from './accelerate.js';
+import { marketFetch } from './net.js';
+import { activeRegion } from './regions.js';
+import { profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits } from './profile.js';
+import { gitCommitOfTarget, gitUploadPackUrl, githubCommitOfTarget, githubRefOfTarget, isGitHostedSpec, repoOfTarget } from './sources.js';
+const UPDATES_TTL_MS = 30 * 60 * 1000;
+const GIT_REMOTE_HEAD_TIMEOUT_MS = 6000;
+let updatesCache = null;
+/**
+ * HEAD for an arbitrary smart-HTTP git remote (Gitea, GitLab, …). Same
+ * advertisement format as GitHub's info/refs; kept here so accelerate.ts
+ * does not need to import sources.ts.
+ */
+async function resolveGitRemoteHead(spec, ref) {
+    const url = gitUploadPackUrl(spec);
+    if (url === null)
+        return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), GIT_REMOTE_HEAD_TIMEOUT_MS);
+    try {
+        const res = await marketFetch(url, {
+            signal: controller.signal,
+            headers: { 'user-agent': 'git/2.40.0' },
+        });
+        if (!res.ok)
+            return null;
+        const body = await res.text();
+        const contentType = res.headers?.get?.('content-type')?.toLowerCase() ?? '';
+        if (contentType.includes('text/html')
+            || !body.includes('# service=git-upload-pack')
+            || !/[0-9a-f]{40} (?:HEAD|refs\/(?:heads|tags)\/)/u.test(body)) {
+            return null;
+        }
+        if (ref === undefined) {
+            const found = /([0-9a-f]{40}) HEAD/.exec(body);
+            return found === null ? null : found[1];
+        }
+        const quoted = ref.replace(/[.*+?^${}()|[\]\\]/gu, String.raw `\$&`);
+        for (const namespace of ['heads', 'tags']) {
+            const found = new RegExp(String.raw `([0-9a-f]{40}) refs/${namespace}/${quoted}(?![^\s])`, 'u').exec(body);
+            if (found !== null)
+                return found[1];
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function parseSemver(v) {
+    const m = SEMVER.exec(v.trim());
+    if (m === null)
+        return null;
+    return { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] === undefined ? [] : m[4].split('.') };
+}
+/**
+ * Semver precedence: negative / 0 / positive like a comparator, or null when
+ * either side isn't a plain semver version. Build metadata is ignored, a
+ * release outranks any prerelease of the same core, and prerelease
+ * identifiers compare numerically when both are numeric (so `rc.10` > `rc.9`).
+ */
+export function compareVersions(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (pa === null || pb === null)
+        return null;
+    for (let i = 0; i < 3; i++) {
+        if (pa.core[i] !== pb.core[i])
+            return pa.core[i] - pb.core[i];
+    }
+    if (pa.pre.length === 0 || pb.pre.length === 0)
+        return pb.pre.length - pa.pre.length;
+    for (let i = 0; i < Math.max(pa.pre.length, pb.pre.length); i++) {
+        const x = pa.pre[i];
+        const y = pb.pre[i];
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        if (x === y)
+            continue;
+        const nx = /^\d+$/.test(x);
+        const ny = /^\d+$/.test(y);
+        if (nx && ny)
+            return Number(x) - Number(y);
+        if (nx !== ny)
+            return nx ? -1 : 1;
+        return x < y ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * True only when the registry's `latest` is semantically HIGHER than what the
+ * profile has (#64 by @ZeroOrigin64). A plain `!==` also fires when a
+ * package's `latest` dist-tag is left pointing at an OLDER release than the
+ * pinned install — clicking "update" then rewrote the exact pin to `@latest`
+ * and downgraded the profile until it no longer booted.
+ *
+ * Undecidable inputs (missing or non-semver versions) report no update:
+ * without a direction we cannot promise the "update" isn't a downgrade.
+ */
+export function isUpgrade(installed, latest) {
+    if (installed === null || latest === null)
+        return false;
+    const cmp = compareVersions(latest, installed);
+    return cmp !== null && cmp > 0;
+}
+/** Drop the cached listing (after a successful install/update/uninstall). */
+export function invalidateUpdates() {
+    updatesCache = null;
+}
+/**
+ * The npm registry update checks read, no trailing slash.
+ *
+ * Module state driven from the routes, like `updatesCache` beside it, rather
+ * than a parameter on all five call sites: the registry is a property of the
+ * running market, not of any one question asked of it, and threading it
+ * through would put the same value in five signatures and every test that
+ * calls them.
+ */
+let registryBase = 'https://registry.npmjs.org';
+/**
+ * Point update checks at a registry. Called when the download region
+ * resolves and whenever it changes.
+ *
+ * Dropping the cache is the load-bearing half. A mirror can lag the official
+ * registry by minutes, so answers gathered from one are not answers from the
+ * other — keeping them across a switch would report a version this registry
+ * cannot yet serve.
+ */
+export function setUpdateRegistry(base) {
+    const next = base.replace(/\/+$/, '');
+    if (next === registryBase)
+        return;
+    registryBase = next;
+    updatesCache = null;
+}
+/** A registry URL for `path`, on whichever registry is currently in force. */
+function npmUrl(path) {
+    return `${registryBase}/${path}`;
+}
+async function fetchJson(url) {
+    // Through the proxy when one is configured: Node's global fetch ignores
+    // HTTP_PROXY, so on a machine whose route out is a local proxy every
+    // update check silently took the slow path — or none at all.
+    const res = await marketFetch(url, {
+        headers: { accept: 'application/json', 'user-agent': 'ChatCode-CLI-Market' },
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return res.json();
+}
+/**
+ * Evidence check behind the "wait a day" stale diagnosis (#45): whether the
+ * package's CURRENT latest release was published recently enough to sit
+ * inside pnpm's default fresh-release window. pnpm's silent hold leaves no
+ * trace in its output, so the publish time is the only verifiable signal.
+ * @returns true/false when the npm time metadata answers, null when it
+ *   can't be determined (offline, unpublished, non-npm) — callers must NOT
+ *   claim the safety wait on null.
+ */
+export async function latestPublishedRecently(name, windowMs = 26 * 60 * 60 * 1000) {
+    try {
+        const doc = (await fetchJson(npmUrl(`${encodeURIComponent(name)}`)));
+        const latest = doc['dist-tags']?.latest;
+        const published = latest !== undefined ? doc.time?.[latest] : undefined;
+        if (published === undefined)
+            return null;
+        const age = Date.now() - Date.parse(published);
+        return Number.isFinite(age) ? age < windowMs : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The registry's current `latest` version for a package, or null when it can't be read. */
+/**
+ * The version a channel subscriber should be offered: the newest build in
+ * the set that channel is willing to receive.
+ *
+ * A channel is a SET, not a tag. Someone on beta has not stopped accepting
+ * releases — they accept releases and prereleases — so beta means
+ * {latest, beta} and dev means {latest, beta, dev}. Reading it as one tag
+ * gets a real case wrong: once 1.14.0 ships, `beta` still points at
+ * 1.14.0-beta.1 until the next prerelease is cut, and following that tag
+ * literally would walk a subscriber BACKWARDS onto a build their channel
+ * has already moved past.
+ *
+ * The nesting is also what makes a channel leavable. Going backwards is
+ * only ever offered when the user narrows the set — picking stable while a
+ * prerelease is installed drops `beta` out of it, so the answer becomes
+ * `latest` and the market can finally offer the way back. That case used to
+ * be unreachable: comparing 1.13.1 against an installed 1.14.0-beta.1 found
+ * nothing newer and answered "up to date", so the control the user had just
+ * used appeared to do nothing.
+ *
+ * @param stable - the `latest` version, already fetched by the caller.
+ */
+export async function versionOnChannel(name, channel, stable) {
+    let best = stable;
+    for (const tag of EXTRA_TAGS[channel]) {
+        const candidate = await tagVersion(name, tag);
+        if (candidate !== null && (best === null || isUpgrade(best, candidate)))
+            best = candidate;
+    }
+    return best;
+}
+/** Tags a channel adds on top of `latest`, widest channel last. */
+const EXTRA_TAGS = {
+    stable: [],
+    beta: [DIST_TAG.beta],
+    dev: [DIST_TAG.beta, DIST_TAG.dev],
+};
+/** One dist-tag's version, or null when it isn't published or can't be read. */
+async function tagVersion(name, tag) {
+    try {
+        const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/${tag}`)));
+        return typeof meta.version === 'string' ? meta.version : null;
+    }
+    catch {
+        // An unpublished tag is the ordinary case for a channel nobody has cut
+        // a build on yet, and a registry hiccup must not take the whole update
+        // check down with it.
+        return null;
+    }
+}
+export async function fetchNpmLatest(name) {
+    try {
+        const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/latest`)));
+        return typeof meta.version === 'string' ? meta.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Per-plugin update checks; a failed check reports no update rather than failing the listing. */
+export async function checkUpdates(profile, force = false, explicitDir, 
+/**
+ * Packages that follow a release channel instead of plain `latest`. Only
+ * ever the market itself: opting into early builds is volunteering to try
+ * THIS plugin early, not a licence to pull every other author's
+ * unreleased work.
+ */
+channelFor = new Map(), 
+/**
+ * Curated npm sources for `file:` installs that were matched to the market
+ * catalog. `link:` workspaces remain development sources and are never
+ * opted into online updates.
+ */
+onlineSourceFor = new Map()) {
+    const activeProfileDir = profileDir(profile, explicitDir);
+    // The channel is part of the key: switching to betas has to change the
+    // answer immediately, and a cache keyed on the profile alone would serve
+    // the stable verdict for the rest of the TTL — reading as "the setting did
+    // nothing".
+    const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}`;
+    if (!force && updatesCache?.key === cacheKey && Date.now() - updatesCache.at < UPDATES_TTL_MS) {
+        return updatesCache.data;
+    }
+    const installed = readInstalled(profile, activeProfileDir);
+    const lockCommits = readLockCommits(profile, activeProfileDir);
+    const result = {};
+    await Promise.all(Object.entries(installed).map(async ([name, spec]) => {
+        const version = readInstalledVersion(profile, name, activeProfileDir);
+        const normalizedSpec = spec.toLowerCase();
+        if (normalizedSpec.startsWith('file:')) {
+            const onlineSource = onlineSourceFor.get(name);
+            if (onlineSource !== undefined) {
+                const latest = await fetchNpmLatest(onlineSource);
+                const updateAvailable = isUpgrade(version, latest);
+                result[name] = {
+                    kind: 'linked', version, current: version, latest, updateAvailable,
+                    ...(updateAvailable ? { restoreRequired: true } : {}),
+                };
+                return;
+            }
+            result[name] = { kind: 'linked', version, current: null, latest: null, updateAvailable: false };
+            return;
+        }
+        if (normalizedSpec.startsWith('link:')) {
+            result[name] = { kind: 'linked', version, current: null, latest: null, updateAvailable: false };
+            return;
+        }
+        // The repo behind the spec, in every supported spelling. Older regional
+        // installs can carry a proxied codeload URL rather than a `github:`
+        // shortcut, and asking only about the shortcut sent those through the npm
+        // branch below — where a GitHub-only plugin
+        // either 404s or, far worse, matches an unrelated package that happens
+        // to share its name.
+        const repo = repoOfTarget(spec)?.split('#')[0] ?? null;
+        try {
+            if (repo !== null) {
+                // A proxied legacy URL or exact `github:#sha` carries its pin in the
+                // spec; a mutable `github:` shortcut keeps it in the lockfile. Prefer
+                // the spec because it is authoritative even if the lockfile is stale.
+                const current = githubCommitOfTarget(spec) ?? lockCommits.get(repo) ?? null;
+                // git's own ref advertisement, NOT api.github.com/repos/…/commits.
+                // The REST API allows 60 requests an hour per IP unauthenticated,
+                // shared across every plugin AND every check — a handful of
+                // github-installed plugins exhausts it and the whole list silently
+                // stops reporting updates (#349). The ref endpoint git itself uses
+                // has no such quota; this is the same call `acceleratedTarget`
+                // already makes to resolve a commit for the China region.
+                // Ask about the ref the install actually names. Answering with the
+                // default branch for a `#branch` install compares two lines that
+                // never converge, so the row reported an update forever (#446).
+                const latest = await resolveHeadCommit(repo, activeRegion(), process.env, githubRefOfTarget(spec) ?? undefined);
+                result[name] = {
+                    kind: 'github', version, current, latest,
+                    updateAvailable: current !== null && latest !== null && current !== latest,
+                };
+            }
+            else if (isGitHostedSpec(spec)) {
+                // Private / self-hosted git (Gitea, GitLab, raw git+https). Never ask
+                // npm by package name — a colliding registry package would be offered
+                // as an update and then installed over the git source (#525).
+                // Reuse kind `github` as "git-sourced" so the existing Installed UI
+                // keeps treating the row as a VCS install without a client change.
+                const current = gitCommitOfTarget(spec)
+                    ?? readGitResolutionCommit(profile, spec, activeProfileDir);
+                const latest = await resolveGitRemoteHead(spec);
+                result[name] = {
+                    kind: 'github', version, current, latest,
+                    updateAvailable: current !== null && latest !== null && current !== latest,
+                };
+            }
+            else {
+                const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/latest`)));
+                const stable = typeof meta.version === 'string' ? meta.version : null;
+                const channel = channelFor.get(name);
+                const latest = channel === undefined ? stable : await versionOnChannel(name, channel, stable);
+                // Forwards is an update; a difference in the other direction is a
+                // channel switch and is reported as one, under its own field.
+                const upgrade = isUpgrade(version, latest);
+                const sideways = channel !== undefined && !upgrade
+                    && version !== null && latest !== null && version !== latest;
+                result[name] = {
+                    kind: 'npm', version, current: version, latest,
+                    updateAvailable: upgrade,
+                    ...(sideways ? { channelSwitch: latest } : {}),
+                };
+            }
+        }
+        catch {
+            result[name] = { kind: (spec.startsWith('github:') || isGitHostedSpec(spec)) ? 'github' : 'npm', version, current: null, latest: null, updateAvailable: false };
+        }
+    }));
+    updatesCache = { key: cacheKey, at: Date.now(), data: result };
+    return result;
+}