@iaforged/context-code 1.0.63 → 1.0.65

package/dist/src/utils/plugins/parseMarketplaceInput.js

@@ -1,143 +0,0 @@
-import { homedir } from 'os';
-import { resolve } from 'path';
-import { getErrnoCode } from '../errors.js';
-import { getFsImplementation } from '../fsOperations.js';
-/**
- * Parses a marketplace input string and returns the appropriate marketplace source type.
- * Handles various input formats:
- * - Git SSH URLs (user@host:path or user@host:path.git)
- *   - Standard: git@github.com:owner/repo.git
- *   - GitHub Enterprise SSH certificates: org-123456@github.com:owner/repo.git
- *   - Custom usernames: deploy@gitlab.com:group/project.git
- *   - Self-hosted: user@192.168.10.123:path/to/repo
- * - HTTP/HTTPS URLs
- * - GitHub shorthand (owner/repo)
- * - Local file paths (.json files)
- * - Local directory paths
- *
- * @param input The marketplace source input string
- * @returns MarketplaceSource object, error object, or null if format is unrecognized
- */
-export async function parseMarketplaceInput(input) {
-    const trimmed = input.trim();
-    const fs = getFsImplementation();
-    // Handle git SSH URLs with any valid username (not just 'git')
-    // Supports: user@host:path, user@host:path.git, and with #ref suffix
-    // Username can contain: alphanumeric, dots, underscores, hyphens
-    const sshMatch = trimmed.match(/^([a-zA-Z0-9._-]+@[^:]+:.+?(?:\.git)?)(#(.+))?$/);
-    if (sshMatch?.[1]) {
-        const url = sshMatch[1];
-        const ref = sshMatch[3];
-        return ref ? { source: 'git', url, ref } : { source: 'git', url };
-    }
-    // Handle URLs
-    if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
-        // Extract fragment (ref) from URL if present
-        const fragmentMatch = trimmed.match(/^([^#]+)(#(.+))?$/);
-        const urlWithoutFragment = fragmentMatch?.[1] || trimmed;
-        const ref = fragmentMatch?.[3];
-        // When user explicitly provides an HTTPS/HTTP URL that looks like a git
-        // repo, use the git source type so we clone rather than fetch-as-JSON.
-        // The .git suffix is a GitHub/GitLab/Bitbucket convention. Azure DevOps
-        // uses /_git/ in the path with NO suffix (appending .git breaks ADO:
-        // TF401019 "repo does not exist"). Without this check, an ADO URL falls
-        // through to source:'url' below, which tries to fetch it as a raw
-        // marketplace.json — the HTML response parses as "expected object,
-        // received string". (gh-31256 / CC-299)
-        if (urlWithoutFragment.endsWith('.git') ||
-            urlWithoutFragment.includes('/_git/')) {
-            return ref
-                ? { source: 'git', url: urlWithoutFragment, ref }
-                : { source: 'git', url: urlWithoutFragment };
-        }
-        // Parse URL to check hostname
-        let url;
-        try {
-            url = new URL(urlWithoutFragment);
-        }
-        catch (_err) {
-            // Not a valid URL for parsing, treat as generic URL
-            // new URL() throws TypeError for invalid URLs
-            return { source: 'url', url: urlWithoutFragment };
-        }
-        if (url.hostname === 'github.com' || url.hostname === 'www.github.com') {
-            const match = url.pathname.match(/^\/([^/]+\/[^/]+?)(\/|\.git|$)/);
-            if (match?.[1]) {
-                // User explicitly provided HTTPS URL - keep it as HTTPS via 'git' type
-                // Add .git suffix if not present for proper git clone
-                const gitUrl = urlWithoutFragment.endsWith('.git')
-                    ? urlWithoutFragment
-                    : `${urlWithoutFragment}.git`;
-                return ref
-                    ? { source: 'git', url: gitUrl, ref }
-                    : { source: 'git', url: gitUrl };
-            }
-        }
-        return { source: 'url', url: urlWithoutFragment };
-    }
-    // Handle local paths
-    // On Windows, also recognize backslash-relative (.\, ..\) and drive letter paths (C:\)
-    // These are Windows-only because backslashes are valid filename chars on Unix
-    const isWindows = process.platform === 'win32';
-    const isWindowsPath = isWindows &&
-        (trimmed.startsWith('.\\') ||
-            trimmed.startsWith('..\\') ||
-            /^[a-zA-Z]:[/\\]/.test(trimmed));
-    if (trimmed.startsWith('./') ||
-        trimmed.startsWith('../') ||
-        trimmed.startsWith('/') ||
-        trimmed.startsWith('~') ||
-        isWindowsPath) {
-        const resolvedPath = resolve(trimmed.startsWith('~') ? trimmed.replace(/^~/, homedir()) : trimmed);
-        // Stat the path to determine if it's a file or directory. Swallow all stat
-        // errors (ENOENT, EACCES, EPERM, etc.) and return an error result instead
-        // of throwing — matches the old existsSync behavior which never threw.
-        let stats;
-        try {
-            stats = await fs.stat(resolvedPath);
-        }
-        catch (e) {
-            const code = getErrnoCode(e);
-            return {
-                error: code === 'ENOENT'
-                    ? `Path does not exist: ${resolvedPath}`
-                    : `Cannot access path: ${resolvedPath} (${code ?? e})`,
-            };
-        }
-        if (stats.isFile()) {
-            if (resolvedPath.endsWith('.json')) {
-                return { source: 'file', path: resolvedPath };
-            }
-            else {
-                return {
-                    error: `File path must point to a .json file (marketplace.json), but got: ${resolvedPath}`,
-                };
-            }
-        }
-        else if (stats.isDirectory()) {
-            return { source: 'directory', path: resolvedPath };
-        }
-        else {
-            return {
-                error: `Path is neither a file nor a directory: ${resolvedPath}`,
-            };
-        }
-    }
-    // Handle GitHub shorthand (owner/repo, owner/repo#ref, or owner/repo@ref)
-    // Accept both # and @ as ref separators — the display formatter uses @, so users
-    // naturally type @ when copying from error messages or managed settings.
-    if (trimmed.includes('/') && !trimmed.startsWith('@')) {
-        if (trimmed.includes(':')) {
-            return null;
-        }
-        // Extract ref if present (either #ref or @ref)
-        const fragmentMatch = trimmed.match(/^([^#@]+)(?:[#@](.+))?$/);
-        const repo = fragmentMatch?.[1] || trimmed;
-        const ref = fragmentMatch?.[2];
-        // Assume it's a GitHub repo
-        return ref ? { source: 'github', repo, ref } : { source: 'github', repo };
-    }
-    // NPM packages not yet implemented
-    // Returning null for unrecognized input
-    return null;
-}

package/dist/src/utils/plugins/performStartupChecks.js

@@ -1,66 +0,0 @@
-import { performBackgroundPluginInstallations } from '../../services/plugins/PluginInstallationManager.js';
-import { checkHasTrustDialogAccepted } from '../config.js';
-import { logForDebugging } from '../debug.js';
-import { clearMarketplacesCache, registerSeedMarketplaces } from './marketplaceManager.js';
-import { clearPluginCache } from './pluginLoader.js';
-/**
- * Perform plugin startup checks and initiate background installations
- *
- * This function starts background installation of marketplaces and plugins
- * from trusted sources (repository and user settings) without blocking startup.
- * Installation progress and errors are tracked in AppState and shown via notifications.
- *
- * SECURITY: This function is only called from REPL.tsx after the "trust this folder"
- * dialog has been confirmed. The trust dialog in cli.tsx blocks all execution until
- * the user explicitly trusts the current working directory, ensuring that plugin
- * installations only happen with user consent. This prevents malicious repositories
- * from automatically installing plugins without user approval.
- *
- * @param setAppState Function to update app state with installation progress
- */
-export async function performStartupChecks(setAppState) {
-    logForDebugging('performStartupChecks called');
-    // Check if the current directory has been trusted
-    if (!checkHasTrustDialogAccepted()) {
-        logForDebugging('Trust not accepted for current directory - skipping plugin installations');
-        return;
-    }
-    try {
-        logForDebugging('Starting background plugin installations');
-        // Register seed marketplaces (CLAUDE_CODE_PLUGIN_SEED_DIR) before diffing.
-        // Idempotent; no-op if seed not configured. Without this, background install
-        // would see seed marketplaces as missing → clone → defeats seed's purpose.
-        //
-        // If registration changed state, clear caches so earlier plugin-load passes
-        // (e.g. getAllMcpConfigs during REPL init) don't keep stale "marketplace
-        // not found" results.
-        const seedChanged = await registerSeedMarketplaces();
-        if (seedChanged) {
-            clearMarketplacesCache();
-            clearPluginCache('performStartupChecks: seed marketplaces changed');
-            // Set needsRefresh so useManagePlugins notifies the user to run
-            // /reload-plugins. Without this signal, the initial plugin-load
-            // (which raced and cached "marketplace not found") would persist
-            // until the user manually reloads.
-            setAppState(prev => {
-                if (prev.plugins.needsRefresh)
-                    return prev;
-                return {
-                    ...prev,
-                    plugins: {
-                        ...prev.plugins,
-                        needsRefresh: true
-                    }
-                };
-            });
-        }
-        // Start background installations without waiting
-        // This will update AppState as installations progress
-        await performBackgroundPluginInstallations(setAppState);
-    }
-    catch (error) {
-        // Even if something fails here, don't block startup
-        logForDebugging(`Error initiating background plugin installations: ${error}`);
-    }
-}
-//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJwZXJmb3JtQmFja2dyb3VuZFBsdWdpbkluc3RhbGxhdGlvbnMiLCJBcHBTdGF0ZSIsImNoZWNrSGFzVHJ1c3REaWFsb2dBY2NlcHRlZCIsImxvZ0ZvckRlYnVnZ2luZyIsImNsZWFyTWFya2V0cGxhY2VzQ2FjaGUiLCJyZWdpc3RlclNlZWRNYXJrZXRwbGFjZXMiLCJjbGVhclBsdWdpbkNhY2hlIiwiU2V0QXBwU3RhdGUiLCJmIiwicHJldlN0YXRlIiwicGVyZm9ybVN0YXJ0dXBDaGVja3MiLCJzZXRBcHBTdGF0ZSIsIlByb21pc2UiLCJzZWVkQ2hhbmdlZCIsInByZXYiLCJwbHVnaW5zIiwibmVlZHNSZWZyZXNoIiwiZXJyb3IiXSwic291cmNlcyI6WyJwZXJmb3JtU3RhcnR1cENoZWNrcy50c3giXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgcGVyZm9ybUJhY2tncm91bmRQbHVnaW5JbnN0YWxsYXRpb25zIH0gZnJvbSAnLi4vLi4vc2VydmljZXMvcGx1Z2lucy9QbHVnaW5JbnN0YWxsYXRpb25NYW5hZ2VyLmpzJ1xuaW1wb3J0IHR5cGUgeyBBcHBTdGF0ZSB9IGZyb20gJy4uLy4uL3N0YXRlL0FwcFN0YXRlLmpzJ1xuaW1wb3J0IHsgY2hlY2tIYXNUcnVzdERpYWxvZ0FjY2VwdGVkIH0gZnJvbSAnLi4vY29uZmlnLmpzJ1xuaW1wb3J0IHsgbG9nRm9yRGVidWdnaW5nIH0gZnJvbSAnLi4vZGVidWcuanMnXG5pbXBvcnQge1xuICBjbGVhck1hcmtldHBsYWNlc0NhY2hlLFxuICByZWdpc3RlclNlZWRNYXJrZXRwbGFjZXMsXG59IGZyb20gJy4vbWFya2V0cGxhY2VNYW5hZ2VyLmpzJ1xuaW1wb3J0IHsgY2xlYXJQbHVnaW5DYWNoZSB9IGZyb20gJy4vcGx1Z2luTG9hZGVyLmpzJ1xuXG50eXBlIFNldEFwcFN0YXRlID0gKGY6IChwcmV2U3RhdGU6IEFwcFN0YXRlKSA9PiBBcHBTdGF0ZSkgPT4gdm9pZFxuXG4vKipcbiAqIFBlcmZvcm0gcGx1Z2luIHN0YXJ0dXAgY2hlY2tzIGFuZCBpbml0aWF0ZSBiYWNrZ3JvdW5kIGluc3RhbGxhdGlvbnNcbiAqXG4gKiBUaGlzIGZ1bmN0aW9uIHN0YXJ0cyBiYWNrZ3JvdW5kIGluc3RhbGxhdGlvbiBvZiBtYXJrZXRwbGFjZXMgYW5kIHBsdWdpbnNcbiAqIGZyb20gdHJ1c3RlZCBzb3VyY2VzIChyZXBvc2l0b3J5IGFuZCB1c2VyIHNldHRpbmdzKSB3aXRob3V0IGJsb2NraW5nIHN0YXJ0dXAuXG4gKiBJbnN0YWxsYXRpb24gcHJvZ3Jlc3MgYW5kIGVycm9ycyBhcmUgdHJhY2tlZCBpbiBBcHBTdGF0ZSBhbmQgc2hvd24gdmlhIG5vdGlmaWNhdGlvbnMuXG4gKlxuICogU0VDVVJJVFk6IFRoaXMgZnVuY3Rpb24gaXMgb25seSBjYWxsZWQgZnJvbSBSRVBMLnRzeCBhZnRlciB0aGUgXCJ0cnVzdCB0aGlzIGZvbGRlclwiXG4gKiBkaWFsb2cgaGFzIGJlZW4gY29uZmlybWVkLiBUaGUgdHJ1c3QgZGlhbG9nIGluIGNsaS50c3ggYmxvY2tzIGFsbCBleGVjdXRpb24gdW50aWxcbiAqIHRoZSB1c2VyIGV4cGxpY2l0bHkgdHJ1c3RzIHRoZSBjdXJyZW50IHdvcmtpbmcgZGlyZWN0b3J5LCBlbnN1cmluZyB0aGF0IHBsdWdpblxuICogaW5zdGFsbGF0aW9ucyBvbmx5IGhhcHBlbiB3aXRoIHVzZXIgY29uc2VudC4gVGhpcyBwcmV2ZW50cyBtYWxpY2lvdXMgcmVwb3NpdG9yaWVzXG4gKiBmcm9tIGF1dG9tYXRpY2FsbHkgaW5zdGFsbGluZyBwbHVnaW5zIHdpdGhvdXQgdXNlciBhcHByb3ZhbC5cbiAqXG4gKiBAcGFyYW0gc2V0QXBwU3RhdGUgRnVuY3Rpb24gdG8gdXBkYXRlIGFwcCBzdGF0ZSB3aXRoIGluc3RhbGxhdGlvbiBwcm9ncmVzc1xuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcGVyZm9ybVN0YXJ0dXBDaGVja3MoXG4gIHNldEFwcFN0YXRlOiBTZXRBcHBTdGF0ZSxcbik6IFByb21pc2U8dm9pZD4ge1xuICBsb2dGb3JEZWJ1Z2dpbmcoJ3BlcmZvcm1TdGFydHVwQ2hlY2tzIGNhbGxlZCcpXG5cbiAgLy8gQ2hlY2sgaWYgdGhlIGN1cnJlbnQgZGlyZWN0b3J5IGhhcyBiZWVuIHRydXN0ZWRcbiAgaWYgKCFjaGVja0hhc1RydXN0RGlhbG9nQWNjZXB0ZWQoKSkge1xuICAgIGxvZ0ZvckRlYnVnZ2luZyhcbiAgICAgICdUcnVzdCBub3QgYWNjZXB0ZWQgZm9yIGN1cnJlbnQgZGlyZWN0b3J5IC0gc2tpcHBpbmcgcGx1Z2luIGluc3RhbGxhdGlvbnMnLFxuICAgIClcbiAgICByZXR1cm5cbiAgfVxuXG4gIHRyeSB7XG4gICAgbG9nRm9yRGVidWdnaW5nKCdTdGFydGluZyBiYWNrZ3JvdW5kIHBsdWdpbiBpbnN0YWxsYXRpb25zJylcblxuICAgIC8vIFJlZ2lzdGVyIHNlZWQgbWFya2V0cGxhY2VzIChDTEFVREVfQ09ERV9QTFVHSU5fU0VFRF9ESVIpIGJlZm9yZSBkaWZmaW5nLlxuICAgIC8vIElkZW1wb3RlbnQ7IG5vLW9wIGlmIHNlZWQgbm90IGNvbmZpZ3VyZWQuIFdpdGhvdXQgdGhpcywgYmFja2dyb3VuZCBpbnN0YWxsXG4gICAgLy8gd291bGQgc2VlIHNlZWQgbWFya2V0cGxhY2VzIGFzIG1pc3Npbmcg4oaSIGNsb25lIOKGkiBkZWZlYXRzIHNlZWQncyBwdXJwb3NlLlxuICAgIC8vXG4gICAgLy8gSWYgcmVnaXN0cmF0aW9uIGNoYW5nZWQgc3RhdGUsIGNsZWFyIGNhY2hlcyBzbyBlYXJsaWVyIHBsdWdpbi1sb2FkIHBhc3Nlc1xuICAgIC8vIChlLmcuIGdldEFsbE1jcENvbmZpZ3MgZHVyaW5nIFJFUEwgaW5pdCkgZG9uJ3Qga2VlcCBzdGFsZSBcIm1hcmtldHBsYWNlXG4gICAgLy8gbm90IGZvdW5kXCIgcmVzdWx0cy5cbiAgICBjb25zdCBzZWVkQ2hhbmdlZCA9IGF3YWl0IHJlZ2lzdGVyU2VlZE1hcmtldHBsYWNlcygpXG4gICAgaWYgKHNlZWRDaGFuZ2VkKSB7XG4gICAgICBjbGVhck1hcmtldHBsYWNlc0NhY2hlKClcbiAgICAgIGNsZWFyUGx1Z2luQ2FjaGUoJ3BlcmZvcm1TdGFydHVwQ2hlY2tzOiBzZWVkIG1hcmtldHBsYWNlcyBjaGFuZ2VkJylcbiAgICAgIC8vIFNldCBuZWVkc1JlZnJlc2ggc28gdXNlTWFuYWdlUGx1Z2lucyBub3RpZmllcyB0aGUgdXNlciB0byBydW5cbiAgICAgIC8vIC9yZWxvYWQtcGx1Z2lucy4gV2l0aG91dCB0aGlzIHNpZ25hbCwgdGhlIGluaXRpYWwgcGx1Z2luLWxvYWRcbiAgICAgIC8vICh3aGljaCByYWNlZCBhbmQgY2FjaGVkIFwibWFya2V0cGxhY2Ugbm90IGZvdW5kXCIpIHdvdWxkIHBlcnNpc3RcbiAgICAgIC8vIHVudGlsIHRoZSB1c2VyIG1hbnVhbGx5IHJlbG9hZHMuXG4gICAgICBzZXRBcHBTdGF0ZShwcmV2ID0+IHtcbiAgICAgICAgaWYgKHByZXYucGx1Z2lucy5uZWVkc1JlZnJlc2gpIHJldHVybiBwcmV2XG4gICAgICAgIHJldHVybiB7XG4gICAgICAgICAgLi4ucHJldixcbiAgICAgICAgICBwbHVnaW5zOiB7IC4uLnByZXYucGx1Z2lucywgbmVlZHNSZWZyZXNoOiB0cnVlIH0sXG4gICAgICAgIH1cbiAgICAgIH0pXG4gICAgfVxuXG4gICAgLy8gU3RhcnQgYmFja2dyb3VuZCBpbnN0YWxsYXRpb25zIHdpdGhvdXQgd2FpdGluZ1xuICAgIC8vIFRoaXMgd2lsbCB1cGRhdGUgQXBwU3RhdGUgYXMgaW5zdGFsbGF0aW9ucyBwcm9ncmVzc1xuICAgIGF3YWl0IHBlcmZvcm1CYWNrZ3JvdW5kUGx1Z2luSW5zdGFsbGF0aW9ucyhzZXRBcHBTdGF0ZSlcbiAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAvLyBFdmVuIGlmIHNvbWV0aGluZyBmYWlscyBoZXJlLCBkb24ndCBibG9jayBzdGFydHVwXG4gICAgbG9nRm9yRGVidWdnaW5nKFxuICAgICAgYEVycm9yIGluaXRpYXRpbmcgYmFja2dyb3VuZCBwbHVnaW4gaW5zdGFsbGF0aW9uczogJHtlcnJvcn1gLFxuICAgIClcbiAgfVxufVxuIl0sIm1hcHBpbmdzIjoiQUFBQSxTQUFTQSxvQ0FBb0MsUUFBUSxxREFBcUQ7QUFDMUcsY0FBY0MsUUFBUSxRQUFRLHlCQUF5QjtBQUN2RCxTQUFTQywyQkFBMkIsUUFBUSxjQUFjO0FBQzFELFNBQVNDLGVBQWUsUUFBUSxhQUFhO0FBQzdDLFNBQ0VDLHNCQUFzQixFQUN0QkMsd0JBQXdCLFFBQ25CLHlCQUF5QjtBQUNoQyxTQUFTQyxnQkFBZ0IsUUFBUSxtQkFBbUI7QUFFcEQsS0FBS0MsV0FBVyxHQUFHLENBQUNDLENBQUMsRUFBRSxDQUFDQyxTQUFTLEVBQUVSLFFBQVEsRUFBRSxHQUFHQSxRQUFRLEVBQUUsR0FBRyxJQUFJOztBQUVqRTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQSxPQUFPLGVBQWVTLG9CQUFvQkEsQ0FDeENDLFdBQVcsRUFBRUosV0FBVyxDQUN6QixFQUFFSyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7RUFDZlQsZUFBZSxDQUFDLDZCQUE2QixDQUFDOztFQUU5QztFQUNBLElBQUksQ0FBQ0QsMkJBQTJCLENBQUMsQ0FBQyxFQUFFO0lBQ2xDQyxlQUFlLENBQ2IsMEVBQ0YsQ0FBQztJQUNEO0VBQ0Y7RUFFQSxJQUFJO0lBQ0ZBLGVBQWUsQ0FBQywwQ0FBMEMsQ0FBQzs7SUFFM0Q7SUFDQTtJQUNBO0lBQ0E7SUFDQTtJQUNBO0lBQ0E7SUFDQSxNQUFNVSxXQUFXLEdBQUcsTUFBTVIsd0JBQXdCLENBQUMsQ0FBQztJQUNwRCxJQUFJUSxXQUFXLEVBQUU7TUFDZlQsc0JBQXNCLENBQUMsQ0FBQztNQUN4QkUsZ0JBQWdCLENBQUMsaURBQWlELENBQUM7TUFDbkU7TUFDQTtNQUNBO01BQ0E7TUFDQUssV0FBVyxDQUFDRyxJQUFJLElBQUk7UUFDbEIsSUFBSUEsSUFBSSxDQUFDQyxPQUFPLENBQUNDLFlBQVksRUFBRSxPQUFPRixJQUFJO1FBQzFDLE9BQU87VUFDTCxHQUFHQSxJQUFJO1VBQ1BDLE9BQU8sRUFBRTtZQUFFLEdBQUdELElBQUksQ0FBQ0MsT0FBTztZQUFFQyxZQUFZLEVBQUU7VUFBSztRQUNqRCxDQUFDO01BQ0gsQ0FBQyxDQUFDO0lBQ0o7O0lBRUE7SUFDQTtJQUNBLE1BQU1oQixvQ0FBb0MsQ0FBQ1csV0FBVyxDQUFDO0VBQ3pELENBQUMsQ0FBQyxPQUFPTSxLQUFLLEVBQUU7SUFDZDtJQUNBZCxlQUFlLENBQ2IscURBQXFEYyxLQUFLLEVBQzVELENBQUM7RUFDSDtBQUNGIiwiaWdub3JlTGlzdCI6W119

package/dist/src/utils/plugins/pluginAutoupdate.js

@@ -1,210 +0,0 @@
-/**
- * Background plugin autoupdate functionality
- *
- * At startup, this module:
- * 1. First updates marketplaces that have autoUpdate enabled
- * 2. Then checks all installed plugins from those marketplaces and updates them
- *
- * Updates are non-inplace (disk-only), requiring a restart to take effect.
- * Official ContextCompany marketplaces have autoUpdate enabled by default,
- * but users can disable it per-marketplace.
- */
-import { updatePluginOp } from '../../services/plugins/pluginOperations.js';
-import { shouldSkipPluginAutoupdate } from '../config.js';
-import { logForDebugging } from '../debug.js';
-import { errorMessage } from '../errors.js';
-import { logError } from '../log.js';
-import { getPendingUpdatesDetails, hasPendingUpdates, isInstallationRelevantToCurrentProject, loadInstalledPluginsFromDisk, } from './installedPluginsManager.js';
-import { getDeclaredMarketplaces, loadKnownMarketplacesConfig, refreshMarketplace, } from './marketplaceManager.js';
-import { parsePluginIdentifier } from './pluginIdentifier.js';
-import { isMarketplaceAutoUpdate } from './schemas.js';
-// Store callback for plugin update notifications
-let pluginUpdateCallback = null;
-// Store pending updates that occurred before callback was registered
-// This handles the race condition where updates complete before REPL mounts
-let pendingNotification = null;
-/**
- * Register a callback to be notified when plugins are auto-updated.
- * This is used by the REPL to show restart notifications.
- *
- * If plugins were already updated before the callback was registered,
- * the callback will be invoked immediately with the pending updates.
- */
-export function onPluginsAutoUpdated(callback) {
-    pluginUpdateCallback = callback;
-    // If there are pending updates that happened before registration, deliver them now
-    if (pendingNotification !== null && pendingNotification.length > 0) {
-        callback(pendingNotification);
-        pendingNotification = null;
-    }
-    return () => {
-        pluginUpdateCallback = null;
-    };
-}
-/**
- * Check if pending updates came from autoupdate (for notification purposes).
- * Returns the list of plugin names that have pending updates.
- */
-export function getAutoUpdatedPluginNames() {
-    if (!hasPendingUpdates()) {
-        return [];
-    }
-    return getPendingUpdatesDetails().map(d => parsePluginIdentifier(d.pluginId).name);
-}
-/**
- * Get the set of marketplaces that have autoUpdate enabled.
- * Returns the marketplace names that should be auto-updated.
- */
-async function getAutoUpdateEnabledMarketplaces() {
-    const config = await loadKnownMarketplacesConfig();
-    const declared = getDeclaredMarketplaces();
-    const enabled = new Set();
-    for (const [name, entry] of Object.entries(config)) {
-        // Settings-declared autoUpdate takes precedence over JSON state
-        const declaredAutoUpdate = declared[name]?.autoUpdate;
-        const autoUpdate = declaredAutoUpdate !== undefined
-            ? declaredAutoUpdate
-            : isMarketplaceAutoUpdate(name, entry);
-        if (autoUpdate) {
-            enabled.add(name.toLowerCase());
-        }
-    }
-    return enabled;
-}
-/**
- * Update a single plugin's installations.
- * Returns the plugin ID if any installation was updated, null otherwise.
- */
-async function updatePlugin(pluginId, installations) {
-    let wasUpdated = false;
-    for (const { scope } of installations) {
-        try {
-            const result = await updatePluginOp(pluginId, scope);
-            if (result.success && !result.alreadyUpToDate) {
-                wasUpdated = true;
-                logForDebugging(`Plugin autoupdate: updated ${pluginId} from ${result.oldVersion} to ${result.newVersion}`);
-            }
-            else if (!result.alreadyUpToDate) {
-                logForDebugging(`Plugin autoupdate: failed to update ${pluginId}: ${result.message}`, { level: 'warn' });
-            }
-        }
-        catch (error) {
-            logForDebugging(`Plugin autoupdate: error updating ${pluginId}: ${errorMessage(error)}`, { level: 'warn' });
-        }
-    }
-    return wasUpdated ? pluginId : null;
-}
-/**
- * Update all project-relevant installed plugins from the given marketplaces.
- *
- * Iterates installed_plugins.json, filters to plugins whose marketplace is in
- * the set, further filters each plugin's installations to those relevant to
- * the current project (user/managed scope, or project/local scope matching
- * cwd — see isInstallationRelevantToCurrentProject), then calls updatePluginOp
- * per installation. Already-up-to-date plugins are silently skipped.
- *
- * Called by:
- * - updatePlugins() below — background autoupdate path (autoUpdate-enabled
- *   marketplaces only; third-party marketplaces default autoUpdate: false)
- * - ManageMarketplaces.tsx applyChanges() — user-initiated /plugin marketplace
- *   update. Before #29512 this path only called refreshMarketplace() (git
- *   pull on the marketplace clone), so the loader would create the new
- *   version cache dir but installed_plugins.json stayed on the old version,
- *   and the orphan GC stamped the NEW dir with .orphaned_at on next startup.
- *
- * @param marketplaceNames - lowercase marketplace names to update plugins from
- * @returns plugin IDs that were actually updated (not already up-to-date)
- */
-export async function updatePluginsForMarketplaces(marketplaceNames) {
-    const installedPlugins = loadInstalledPluginsFromDisk();
-    const pluginIds = Object.keys(installedPlugins.plugins);
-    if (pluginIds.length === 0) {
-        return [];
-    }
-    const results = await Promise.allSettled(pluginIds.map(async (pluginId) => {
-        const { marketplace } = parsePluginIdentifier(pluginId);
-        if (!marketplace || !marketplaceNames.has(marketplace.toLowerCase())) {
-            return null;
-        }
-        const allInstallations = installedPlugins.plugins[pluginId];
-        if (!allInstallations || allInstallations.length === 0) {
-            return null;
-        }
-        const relevantInstallations = allInstallations.filter(isInstallationRelevantToCurrentProject);
-        if (relevantInstallations.length === 0) {
-            return null;
-        }
-        return updatePlugin(pluginId, relevantInstallations);
-    }));
-    return results
-        .filter((r) => r.status === 'fulfilled' && r.value !== null)
-        .map(r => r.value);
-}
-/**
- * Update plugins from marketplaces that have autoUpdate enabled.
- * Returns the list of plugin IDs that were updated.
- */
-async function updatePlugins(autoUpdateEnabledMarketplaces) {
-    return updatePluginsForMarketplaces(autoUpdateEnabledMarketplaces);
-}
-/**
- * Auto-update marketplaces and plugins in the background.
- *
- * This function:
- * 1. Checks which marketplaces have autoUpdate enabled
- * 2. Refreshes only those marketplaces (git pull/re-download)
- * 3. Updates installed plugins from those marketplaces
- * 4. If any plugins were updated, notifies via the registered callback
- *
- * Official Anthropic marketplaces have autoUpdate enabled by default,
- * but users can disable it per-marketplace in the UI.
- *
- * This function runs silently without blocking user interaction.
- * Called from main.tsx during startup as a background job.
- */
-export function autoUpdateMarketplacesAndPluginsInBackground() {
-    void (async () => {
-        if (shouldSkipPluginAutoupdate()) {
-            logForDebugging('Plugin autoupdate: skipped (auto-updater disabled)');
-            return;
-        }
-        try {
-            // Get marketplaces with autoUpdate enabled
-            const autoUpdateEnabledMarketplaces = await getAutoUpdateEnabledMarketplaces();
-            if (autoUpdateEnabledMarketplaces.size === 0) {
-                return;
-            }
-            // Refresh only marketplaces with autoUpdate enabled
-            const refreshResults = await Promise.allSettled(Array.from(autoUpdateEnabledMarketplaces).map(async (name) => {
-                try {
-                    await refreshMarketplace(name, undefined, {
-                        disableCredentialHelper: true,
-                    });
-                }
-                catch (error) {
-                    logForDebugging(`Plugin autoupdate: failed to refresh marketplace ${name}: ${errorMessage(error)}`, { level: 'warn' });
-                }
-            }));
-            // Log any refresh failures
-            const failures = refreshResults.filter(r => r.status === 'rejected');
-            if (failures.length > 0) {
-                logForDebugging(`Plugin autoupdate: ${failures.length} marketplace refresh(es) failed`, { level: 'warn' });
-            }
-            logForDebugging('Plugin autoupdate: checking installed plugins');
-            const updatedPlugins = await updatePlugins(autoUpdateEnabledMarketplaces);
-            if (updatedPlugins.length > 0) {
-                if (pluginUpdateCallback) {
-                    // Callback is already registered, invoke it immediately
-                    pluginUpdateCallback(updatedPlugins);
-                }
-                else {
-                    // Callback not yet registered (REPL not mounted), store for later delivery
-                    pendingNotification = updatedPlugins;
-                }
-            }
-        }
-        catch (error) {
-            logError(error);
-        }
-    })();
-}

package/dist/src/utils/plugins/pluginBlocklist.js

@@ -1,93 +0,0 @@
-/**
- * Plugin delisting detection.
- *
- * Compares installed plugins against marketplace manifests to find plugins
- * that have been removed, and auto-uninstalls them.
- *
- * The security.json fetch was removed (see #25447) — ~29.5M/week GitHub hits
- * for UI reason/text only. If re-introduced, serve from downloads.claude.ai.
- */
-import { uninstallPluginOp } from '../../services/plugins/pluginOperations.js';
-import { logForDebugging } from '../debug.js';
-import { errorMessage } from '../errors.js';
-import { loadInstalledPluginsV2 } from './installedPluginsManager.js';
-import { getMarketplace, loadKnownMarketplacesConfigSafe, } from './marketplaceManager.js';
-import { addFlaggedPlugin, getFlaggedPlugins, loadFlaggedPlugins, } from './pluginFlagging.js';
-/**
- * Detect plugins installed from a marketplace that are no longer listed there.
- *
- * @param installedPlugins All installed plugins
- * @param marketplace The marketplace to check against
- * @param marketplaceName The marketplace name suffix (e.g. "claude-plugins-official")
- * @returns List of delisted plugin IDs in "name@marketplace" format
- */
-export function detectDelistedPlugins(installedPlugins, marketplace, marketplaceName) {
-    const marketplacePluginNames = new Set(marketplace.plugins.map(p => p.name));
-    const suffix = `@${marketplaceName}`;
-    const delisted = [];
-    for (const pluginId of Object.keys(installedPlugins.plugins)) {
-        if (!pluginId.endsWith(suffix))
-            continue;
-        const pluginName = pluginId.slice(0, -suffix.length);
-        if (!marketplacePluginNames.has(pluginName)) {
-            delisted.push(pluginId);
-        }
-    }
-    return delisted;
-}
-/**
- * Detect delisted plugins across all marketplaces, auto-uninstall them,
- * and record them as flagged.
- *
- * This is the core delisting enforcement logic, shared between interactive
- * mode (useManagePlugins) and headless mode (main.tsx print path).
- *
- * @returns List of newly flagged plugin IDs
- */
-export async function detectAndUninstallDelistedPlugins() {
-    await loadFlaggedPlugins();
-    const installedPlugins = loadInstalledPluginsV2();
-    const alreadyFlagged = getFlaggedPlugins();
-    // Read-only iteration — Safe variant so a corrupted config doesn't throw
-    // out of this function (it's called in the same try-block as loadAllPlugins
-    // in useManagePlugins, so a throw here would void loadAllPlugins' resilience).
-    const knownMarketplaces = await loadKnownMarketplacesConfigSafe();
-    const newlyFlagged = [];
-    for (const marketplaceName of Object.keys(knownMarketplaces)) {
-        try {
-            const marketplace = await getMarketplace(marketplaceName);
-            if (!marketplace.forceRemoveDeletedPlugins)
-                continue;
-            const delisted = detectDelistedPlugins(installedPlugins, marketplace, marketplaceName);
-            for (const pluginId of delisted) {
-                if (pluginId in alreadyFlagged)
-                    continue;
-                // Skip managed-only plugins — enterprise admin should handle those
-                const installations = installedPlugins.plugins[pluginId] ?? [];
-                const hasUserInstall = installations.some(i => i.scope === 'user' || i.scope === 'project' || i.scope === 'local');
-                if (!hasUserInstall)
-                    continue;
-                // Auto-uninstall the delisted plugin from all user-controllable scopes
-                for (const installation of installations) {
-                    const { scope } = installation;
-                    if (scope !== 'user' && scope !== 'project' && scope !== 'local') {
-                        continue;
-                    }
-                    try {
-                        await uninstallPluginOp(pluginId, scope);
-                    }
-                    catch (error) {
-                        logForDebugging(`Failed to auto-uninstall delisted plugin ${pluginId} from ${scope}: ${errorMessage(error)}`, { level: 'error' });
-                    }
-                }
-                await addFlaggedPlugin(pluginId);
-                newlyFlagged.push(pluginId);
-            }
-        }
-        catch (error) {
-            // Marketplace may not be available yet — log and continue
-            logForDebugging(`Failed to check for delisted plugins in "${marketplaceName}": ${errorMessage(error)}`, { level: 'warn' });
-        }
-    }
-    return newlyFlagged;
-}