@jackwener/opencli 1.3.3 → 1.4.0

package/dist/plugin.d.ts

@@ -4,12 +4,37 @@
  * Plugins live in ~/.opencli/plugins/<name>/.
  * Install source format: "github:user/repo"
  */
+/** Path to the lock file that tracks installed plugin versions. */
+export declare function getLockFilePath(): string;
+export declare const LOCK_FILE: string;
+export interface LockEntry {
+    source: string;
+    commitHash: string;
+    installedAt: string;
+    updatedAt?: string;
+}
 export interface PluginInfo {
     name: string;
     path: string;
     commands: string[];
     source?: string;
+    version?: string;
+    installedAt?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
 }
+export declare function readLockFile(): Record<string, LockEntry>;
+export declare function writeLockFile(lock: Record<string, LockEntry>): void;
+/** Get the HEAD commit hash of a git repo directory. */
+export declare function getCommitHash(dir: string): string | undefined;
+/**
+ * Validate that a downloaded plugin directory is a structurally valid plugin.
+ * Checks for at least one command file (.yaml, .yml, .ts, .js) and a valid
+ * package.json if it contains .ts files.
+ */
+export declare function validatePluginStructure(pluginDir: string): ValidationResult;
 /**
  * Install a plugin from a source.
  * Currently supports "github:user/repo" format (git clone wrapper).
@@ -23,6 +48,16 @@ export declare function uninstallPlugin(name: string): void;
  * Update a plugin by name (git pull + re-install lifecycle).
  */
 export declare function updatePlugin(name: string): void;
+export interface UpdateResult {
+    name: string;
+    success: boolean;
+    error?: string;
+}
+/**
+ * Update all installed plugins.
+ * Continues even if individual plugin updates fail.
+ */
+export declare function updateAllPlugins(): UpdateResult[];
 /**
  * List all installed plugins.
  */
@@ -32,4 +67,8 @@ declare function parseSource(source: string): {
     cloneUrl: string;
     name: string;
 } | null;
-export { parseSource as _parseSource };
+/**
+ * Resolve the path to the esbuild CLI executable with fallback strategies.
+ */
+export declare function resolveEsbuildBin(): string | null;
+export { resolveEsbuildBin as _resolveEsbuildBin, getCommitHash as _getCommitHash, parseSource as _parseSource, readLockFile as _readLockFile, updateAllPlugins as _updateAllPlugins, validatePluginStructure as _validatePluginStructure, writeLockFile as _writeLockFile, };

package/dist/plugin.js

@@ -5,10 +5,88 @@
  * Install source format: "github:user/repo"
  */
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { execSync, execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { PLUGINS_DIR } from './discovery.js';
+import { getErrorMessage } from './errors.js';
 import { log } from './logger.js';
+const isWindows = process.platform === 'win32';
+/** Get home directory, respecting HOME environment variable for test isolation. */
+function getHomeDir() {
+    return process.env.HOME || process.env.USERPROFILE || os.homedir();
+}
+/** Path to the lock file that tracks installed plugin versions. */
+export function getLockFilePath() {
+    return path.join(getHomeDir(), '.opencli', 'plugins.lock.json');
+}
+// Legacy const for backward compatibility (computed at load time)
+export const LOCK_FILE = path.join(os.homedir(), '.opencli', 'plugins.lock.json');
+// ── Lock file helpers ───────────────────────────────────────────────────────
+export function readLockFile() {
+    try {
+        const raw = fs.readFileSync(getLockFilePath(), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+export function writeLockFile(lock) {
+    const lockPath = getLockFilePath();
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+}
+/** Get the HEAD commit hash of a git repo directory. */
+export function getCommitHash(dir) {
+    try {
+        return execFileSync('git', ['rev-parse', 'HEAD'], {
+            cwd: dir,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Validate that a downloaded plugin directory is a structurally valid plugin.
+ * Checks for at least one command file (.yaml, .yml, .ts, .js) and a valid
+ * package.json if it contains .ts files.
+ */
+export function validatePluginStructure(pluginDir) {
+    const errors = [];
+    if (!fs.existsSync(pluginDir)) {
+        return { valid: false, errors: ['Plugin directory does not exist'] };
+    }
+    const files = fs.readdirSync(pluginDir);
+    const hasYaml = files.some(f => f.endsWith('.yaml') || f.endsWith('.yml'));
+    const hasTs = files.some(f => f.endsWith('.ts') && !f.endsWith('.d.ts') && !f.endsWith('.test.ts'));
+    const hasJs = files.some(f => f.endsWith('.js') && !f.endsWith('.d.js'));
+    if (!hasYaml && !hasTs && !hasJs) {
+        errors.push(`No command files found in plugin directory. A plugin must contain at least one .yaml, .ts, or .js command file.`);
+    }
+    if (hasTs) {
+        const pkgJsonPath = path.join(pluginDir, 'package.json');
+        if (!fs.existsSync(pkgJsonPath)) {
+            errors.push(`Plugin contains .ts files but no package.json. A package.json with "type": "module" and "@jackwener/opencli" peer dependency is required for TS plugins.`);
+        }
+        else {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+                if (pkg.type !== 'module') {
+                    errors.push(`Plugin package.json must have "type": "module" for TypeScript plugins.`);
+                }
+            }
+            catch {
+                errors.push(`Plugin package.json is malformed or invalid JSON.`);
+            }
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
 /**
  * Shared post-install lifecycle: npm install → host symlink → TS transpile.
  * Called by both installPlugin() and updatePlugin().
@@ -22,10 +100,11 @@ function postInstallLifecycle(pluginDir) {
             cwd: pluginDir,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
+            ...(isWindows && { shell: true }),
         });
     }
-    catch {
-        // Non-fatal: npm install may fail if no real deps
+    catch (err) {
+        console.error(`[plugin] npm install failed in ${pluginDir}: ${err instanceof Error ? err.message : err}`);
     }
     // Symlink host opencli so TS plugins resolve '@jackwener/opencli/registry'
     // against the running host, not a stale npm-published version.
@@ -59,9 +138,25 @@ export function installPlugin(source) {
         });
     }
     catch (err) {
-        throw new Error(`Failed to clone plugin: ${err.message}`);
+        throw new Error(`Failed to clone plugin: ${getErrorMessage(err)}`);
+    }
+    const validation = validatePluginStructure(targetDir);
+    if (!validation.valid) {
+        // If validation fails, clean up the cloned directory and abort
+        fs.rmSync(targetDir, { recursive: true, force: true });
+        throw new Error(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
     }
     postInstallLifecycle(targetDir);
+    const commitHash = getCommitHash(targetDir);
+    if (commitHash) {
+        const lock = readLockFile();
+        lock[name] = {
+            source: cloneUrl,
+            commitHash,
+            installedAt: new Date().toISOString(),
+        };
+        writeLockFile(lock);
+    }
     return name;
 }
 /**
@@ -73,6 +168,11 @@ export function uninstallPlugin(name) {
         throw new Error(`Plugin "${name}" is not installed.`);
     }
     fs.rmSync(targetDir, { recursive: true, force: true });
+    const lock = readLockFile();
+    if (lock[name]) {
+        delete lock[name];
+        writeLockFile(lock);
+    }
 }
 /**
  * Update a plugin by name (git pull + re-install lifecycle).
@@ -90,9 +190,44 @@ export function updatePlugin(name) {
         });
     }
     catch (err) {
-        throw new Error(`Failed to update plugin: ${err.message}`);
+        throw new Error(`Failed to update plugin: ${getErrorMessage(err)}`);
+    }
+    const validation = validatePluginStructure(targetDir);
+    if (!validation.valid) {
+        log.warn(`Plugin "${name}" updated, but structure is now invalid:\n- ${validation.errors.join('\n- ')}`);
     }
     postInstallLifecycle(targetDir);
+    const commitHash = getCommitHash(targetDir);
+    if (commitHash) {
+        const lock = readLockFile();
+        const existing = lock[name];
+        lock[name] = {
+            source: existing?.source ?? getPluginSource(targetDir) ?? '',
+            commitHash,
+            installedAt: existing?.installedAt ?? new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+        };
+        writeLockFile(lock);
+    }
+}
+/**
+ * Update all installed plugins.
+ * Continues even if individual plugin updates fail.
+ */
+export function updateAllPlugins() {
+    return listPlugins().map((plugin) => {
+        try {
+            updatePlugin(plugin.name);
+            return { name: plugin.name, success: true };
+        }
+        catch (err) {
+            return {
+                name: plugin.name,
+                success: false,
+                error: getErrorMessage(err),
+            };
+        }
+    });
 }
 /**
  * List all installed plugins.
@@ -101,6 +236,7 @@ export function listPlugins() {
     if (!fs.existsSync(PLUGINS_DIR))
         return [];
     const entries = fs.readdirSync(PLUGINS_DIR, { withFileTypes: true });
+    const lock = readLockFile();
     const plugins = [];
     for (const entry of entries) {
         if (!entry.isDirectory())
@@ -108,11 +244,14 @@ export function listPlugins() {
         const pluginDir = path.join(PLUGINS_DIR, entry.name);
         const commands = scanPluginCommands(pluginDir);
         const source = getPluginSource(pluginDir);
+        const lockEntry = lock[entry.name];
         plugins.push({
             name: entry.name,
             path: pluginDir,
             commands,
             source,
+            version: lockEntry?.commitHash?.slice(0, 7),
+            installedAt: lockEntry?.installedAt,
         });
     }
     return plugins;
@@ -135,7 +274,7 @@ function scanPluginCommands(dir) {
 /** Get git remote origin URL */
 function getPluginSource(dir) {
     try {
-        return execSync('git config --get remote.origin.url', {
+        return execFileSync('git', ['config', '--get', 'remote.origin.url'], {
             cwd: dir,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -179,7 +318,7 @@ function linkHostOpencli(pluginDir) {
         // Determine the host opencli package root from this module's location.
         // Both dev (tsx src/plugin.ts) and prod (node dist/plugin.js) are one level
         // deep, so path.dirname + '..' always gives us the package root.
-        const thisFile = new URL(import.meta.url).pathname;
+        const thisFile = fileURLToPath(import.meta.url);
         const hostRoot = path.resolve(path.dirname(thisFile), '..');
         const targetLink = path.join(pluginDir, 'node_modules', '@jackwener', 'opencli');
         // Remove existing (npm-installed copy or stale symlink)
@@ -188,13 +327,73 @@ function linkHostOpencli(pluginDir) {
         }
         // Ensure parent directory exists
         fs.mkdirSync(path.dirname(targetLink), { recursive: true });
-        // Create symlink
-        fs.symlinkSync(hostRoot, targetLink, 'dir');
+        // Use 'junction' on Windows (doesn't require admin privileges),
+        // 'dir' symlink on other platforms.
+        const linkType = isWindows ? 'junction' : 'dir';
+        fs.symlinkSync(hostRoot, targetLink, linkType);
         log.debug(`Linked host opencli into plugin: ${targetLink} → ${hostRoot}`);
     }
     catch (err) {
-        log.warn(`Failed to link host opencli into plugin: ${err.message}`);
+        log.warn(`Failed to link host opencli into plugin: ${getErrorMessage(err)}`);
+    }
+}
+/**
+ * Resolve the path to the esbuild CLI executable with fallback strategies.
+ */
+export function resolveEsbuildBin() {
+    const thisFile = fileURLToPath(import.meta.url);
+    const hostRoot = path.resolve(path.dirname(thisFile), '..');
+    // Strategy 1 (Windows): prefer the .cmd wrapper which is executable via shell
+    if (isWindows) {
+        const cmdPath = path.join(hostRoot, 'node_modules', '.bin', 'esbuild.cmd');
+        if (fs.existsSync(cmdPath)) {
+            return cmdPath;
+        }
+    }
+    // Strategy 2: resolve esbuild binary via import.meta.resolve
+    // (On Unix, shebang scripts are directly executable; on Windows they are not,
+    //  so this strategy is skipped on Windows in favour of the .cmd wrapper above.)
+    if (!isWindows) {
+        try {
+            const pkgUrl = import.meta.resolve('esbuild/package.json');
+            if (pkgUrl.startsWith('file://')) {
+                const pkgPath = fileURLToPath(pkgUrl);
+                const pkgRaw = fs.readFileSync(pkgPath, 'utf8');
+                const pkg = JSON.parse(pkgRaw);
+                if (pkg.bin && typeof pkg.bin === 'object' && pkg.bin.esbuild) {
+                    const binPath = path.resolve(path.dirname(pkgPath), pkg.bin.esbuild);
+                    if (fs.existsSync(binPath))
+                        return binPath;
+                }
+                else if (typeof pkg.bin === 'string') {
+                    const binPath = path.resolve(path.dirname(pkgPath), pkg.bin);
+                    if (fs.existsSync(binPath))
+                        return binPath;
+                }
+            }
+        }
+        catch {
+            // ignore package resolution failures
+        }
+    }
+    // Strategy 3: fallback to node_modules/.bin/esbuild (Unix)
+    const binFallback = path.join(hostRoot, 'node_modules', '.bin', 'esbuild');
+    if (fs.existsSync(binFallback)) {
+        return binFallback;
     }
+    // Strategy 4: global esbuild in PATH
+    try {
+        const lookupCmd = isWindows ? 'where esbuild' : 'which esbuild';
+        // `where` on Windows may return multiple lines; take only the first match.
+        const globalBin = execSync(lookupCmd, { encoding: 'utf-8', stdio: 'pipe' }).trim().split('\n')[0].trim();
+        if (globalBin && fs.existsSync(globalBin)) {
+            return globalBin;
+        }
+    }
+    catch {
+        // ignore PATH lookup failures
+    }
+    return null;
 }
 /**
  * Transpile TS plugin files to JS so they work in production mode.
@@ -202,12 +401,9 @@ function linkHostOpencli(pluginDir) {
  */
 function transpilePluginTs(pluginDir) {
     try {
-        // Resolve esbuild binary from the host opencli's node_modules
-        const thisFile = new URL(import.meta.url).pathname;
-        const hostRoot = path.resolve(path.dirname(thisFile), '..');
-        const esbuildBin = path.join(hostRoot, 'node_modules', '.bin', 'esbuild');
-        if (!fs.existsSync(esbuildBin)) {
-            log.debug('esbuild not found in host node_modules, skipping TS transpilation');
+        const esbuildBin = resolveEsbuildBin();
+        if (!esbuildBin) {
+            log.debug('esbuild not found in host node_modules, via resolve, or in PATH, skipping TS transpilation');
             return;
         }
         const files = fs.readdirSync(pluginDir);
@@ -223,11 +419,12 @@ function transpilePluginTs(pluginDir) {
                     cwd: pluginDir,
                     encoding: 'utf-8',
                     stdio: ['pipe', 'pipe', 'pipe'],
+                    ...(isWindows && { shell: true }),
                 });
                 log.debug(`Transpiled plugin file: ${tsFile} → ${jsFile}`);
             }
             catch (err) {
-                log.warn(`Failed to transpile ${tsFile}: ${err.message}`);
+                log.warn(`Failed to transpile ${tsFile}: ${getErrorMessage(err)}`);
             }
         }
     }
@@ -235,4 +432,4 @@ function transpilePluginTs(pluginDir) {
         // Non-fatal: skip transpilation if anything goes wrong
     }
 }
-export { parseSource as _parseSource };
+export { resolveEsbuildBin as _resolveEsbuildBin, getCommitHash as _getCommitHash, parseSource as _parseSource, readLockFile as _readLockFile, updateAllPlugins as _updateAllPlugins, validatePluginStructure as _validatePluginStructure, writeLockFile as _writeLockFile, };

package/dist/plugin.test.d.ts

@@ -1,4 +1,4 @@
 /**
- * Tests for plugin management: install, uninstall, list.
+ * Tests for plugin management: install, uninstall, list, and lock file support.
  */
 export {};

package/dist/plugin.test.js

@@ -1,11 +1,13 @@
 /**
- * Tests for plugin management: install, uninstall, list.
+ * Tests for plugin management: install, uninstall, list, and lock file support.
  */
-import { describe, it, expect, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { PLUGINS_DIR } from './discovery.js';
-import { listPlugins, uninstallPlugin, updatePlugin, _parseSource } from './plugin.js';
+import * as pluginModule from './plugin.js';
+const { LOCK_FILE, _getCommitHash, listPlugins, _readLockFile, _resolveEsbuildBin, uninstallPlugin, updatePlugin, _parseSource, _updateAllPlugins, _validatePluginStructure, _writeLockFile, } = pluginModule;
 describe('parseSource', () => {
     it('parses github:user/repo format', () => {
         const result = _parseSource('github:ByteYue/opencli-plugin-github-trending');
@@ -34,6 +36,131 @@ describe('parseSource', () => {
         expect(_parseSource('npm:some-package')).toBeNull();
     });
 });
+describe('validatePluginStructure', () => {
+    const testDir = path.join(PLUGINS_DIR, '__test-validate__');
+    beforeEach(() => {
+        fs.mkdirSync(testDir, { recursive: true });
+    });
+    afterEach(() => {
+        try {
+            fs.rmSync(testDir, { recursive: true });
+        }
+        catch { }
+    });
+    it('returns invalid for non-existent directory', () => {
+        const res = _validatePluginStructure(path.join(PLUGINS_DIR, '__does_not_exist__'));
+        expect(res.valid).toBe(false);
+        expect(res.errors[0]).toContain('does not exist');
+    });
+    it('returns invalid for empty directory', () => {
+        const res = _validatePluginStructure(testDir);
+        expect(res.valid).toBe(false);
+        expect(res.errors[0]).toContain('No command files found');
+    });
+    it('returns valid for YAML plugin', () => {
+        fs.writeFileSync(path.join(testDir, 'cmd.yaml'), 'site: test');
+        const res = _validatePluginStructure(testDir);
+        expect(res.valid).toBe(true);
+        expect(res.errors).toHaveLength(0);
+    });
+    it('returns valid for JS plugin', () => {
+        fs.writeFileSync(path.join(testDir, 'cmd.js'), 'console.log("hi");');
+        const res = _validatePluginStructure(testDir);
+        expect(res.valid).toBe(true);
+        expect(res.errors).toHaveLength(0);
+    });
+    it('returns invalid for TS plugin without package.json', () => {
+        fs.writeFileSync(path.join(testDir, 'cmd.ts'), 'console.log("hi");');
+        const res = _validatePluginStructure(testDir);
+        expect(res.valid).toBe(false);
+        expect(res.errors[0]).toContain('contains .ts files but no package.json');
+    });
+    it('returns invalid for TS plugin with missing type: module', () => {
+        fs.writeFileSync(path.join(testDir, 'cmd.ts'), 'console.log("hi");');
+        fs.writeFileSync(path.join(testDir, 'package.json'), JSON.stringify({ name: 'test' }));
+        const res = _validatePluginStructure(testDir);
+        expect(res.valid).toBe(false);
+        expect(res.errors[0]).toContain('must have "type": "module"');
+    });
+    it('returns valid for TS plugin with correct package.json', () => {
+        fs.writeFileSync(path.join(testDir, 'cmd.ts'), 'console.log("hi");');
+        fs.writeFileSync(path.join(testDir, 'package.json'), JSON.stringify({ type: 'module' }));
+        const res = _validatePluginStructure(testDir);
+        expect(res.valid).toBe(true);
+        expect(res.errors).toHaveLength(0);
+    });
+});
+describe('lock file', () => {
+    const backupPath = `${LOCK_FILE}.test-backup`;
+    let hadOriginal = false;
+    beforeEach(() => {
+        hadOriginal = fs.existsSync(LOCK_FILE);
+        if (hadOriginal) {
+            fs.mkdirSync(path.dirname(backupPath), { recursive: true });
+            fs.copyFileSync(LOCK_FILE, backupPath);
+        }
+    });
+    afterEach(() => {
+        if (hadOriginal) {
+            fs.copyFileSync(backupPath, LOCK_FILE);
+            fs.unlinkSync(backupPath);
+            return;
+        }
+        try {
+            fs.unlinkSync(LOCK_FILE);
+        }
+        catch { }
+    });
+    it('reads empty lock when file does not exist', () => {
+        try {
+            fs.unlinkSync(LOCK_FILE);
+        }
+        catch { }
+        expect(_readLockFile()).toEqual({});
+    });
+    it('round-trips lock entries', () => {
+        const entries = {
+            'test-plugin': {
+                source: 'https://github.com/user/repo.git',
+                commitHash: 'abc1234567890def',
+                installedAt: '2025-01-01T00:00:00.000Z',
+            },
+            'another-plugin': {
+                source: 'https://github.com/user/another.git',
+                commitHash: 'def4567890123abc',
+                installedAt: '2025-02-01T00:00:00.000Z',
+                updatedAt: '2025-03-01T00:00:00.000Z',
+            },
+        };
+        _writeLockFile(entries);
+        expect(_readLockFile()).toEqual(entries);
+    });
+    it('handles malformed lock file gracefully', () => {
+        fs.mkdirSync(path.dirname(LOCK_FILE), { recursive: true });
+        fs.writeFileSync(LOCK_FILE, 'not valid json');
+        expect(_readLockFile()).toEqual({});
+    });
+});
+describe('getCommitHash', () => {
+    it('returns a hash for a git repo', () => {
+        const hash = _getCommitHash(process.cwd());
+        expect(hash).toBeDefined();
+        expect(hash).toMatch(/^[0-9a-f]{40}$/);
+    });
+    it('returns undefined for non-git directory', () => {
+        expect(_getCommitHash(os.tmpdir())).toBeUndefined();
+    });
+});
+describe('resolveEsbuildBin', () => {
+    it('resolves a usable esbuild executable path', () => {
+        const binPath = _resolveEsbuildBin();
+        expect(binPath).not.toBeNull();
+        expect(typeof binPath).toBe('string');
+        expect(fs.existsSync(binPath)).toBe(true);
+        // On Windows the resolved path ends with 'esbuild.cmd', on Unix 'esbuild'
+        expect(binPath).toMatch(/esbuild(\.cmd)?$/);
+    });
+});
 describe('listPlugins', () => {
     const testDir = path.join(PLUGINS_DIR, '__test-list-plugin__');
     afterEach(() => {
@@ -50,6 +177,24 @@ describe('listPlugins', () => {
         expect(found).toBeDefined();
         expect(found.commands).toContain('hello');
     });
+    it('includes version metadata from the lock file', () => {
+        fs.mkdirSync(testDir, { recursive: true });
+        fs.writeFileSync(path.join(testDir, 'hello.yaml'), 'site: test\nname: hello\n');
+        const lock = _readLockFile();
+        lock['__test-list-plugin__'] = {
+            source: 'https://github.com/user/repo.git',
+            commitHash: 'abcdef1234567890abcdef1234567890abcdef12',
+            installedAt: '2025-01-01T00:00:00.000Z',
+        };
+        _writeLockFile(lock);
+        const plugins = listPlugins();
+        const found = plugins.find(p => p.name === '__test-list-plugin__');
+        expect(found).toBeDefined();
+        expect(found.version).toBe('abcdef1');
+        expect(found.installedAt).toBe('2025-01-01T00:00:00.000Z');
+        delete lock['__test-list-plugin__'];
+        _writeLockFile(lock);
+    });
     it('returns empty array when no plugins dir', () => {
         // listPlugins should handle missing dir gracefully
         const plugins = listPlugins();
@@ -70,6 +215,19 @@ describe('uninstallPlugin', () => {
         uninstallPlugin('__test-uninstall__');
         expect(fs.existsSync(testDir)).toBe(false);
     });
+    it('removes lock entry on uninstall', () => {
+        fs.mkdirSync(testDir, { recursive: true });
+        fs.writeFileSync(path.join(testDir, 'test.yaml'), 'site: test');
+        const lock = _readLockFile();
+        lock['__test-uninstall__'] = {
+            source: 'https://github.com/user/repo.git',
+            commitHash: 'abc123',
+            installedAt: '2025-01-01T00:00:00.000Z',
+        };
+        _writeLockFile(lock);
+        uninstallPlugin('__test-uninstall__');
+        expect(_readLockFile()['__test-uninstall__']).toBeUndefined();
+    });
     it('throws for non-existent plugin', () => {
         expect(() => uninstallPlugin('__nonexistent__')).toThrow('not installed');
     });
@@ -79,3 +237,61 @@ describe('updatePlugin', () => {
         expect(() => updatePlugin('__nonexistent__')).toThrow('not installed');
     });
 });
+vi.mock('node:child_process', () => {
+    return {
+        execFileSync: vi.fn((_cmd, args, opts) => {
+            if (Array.isArray(args) && args[0] === 'rev-parse' && args[1] === 'HEAD') {
+                if (opts?.cwd === os.tmpdir()) {
+                    throw new Error('not a git repository');
+                }
+                return '1234567890abcdef1234567890abcdef12345678\n';
+            }
+            if (opts && opts.cwd && String(opts.cwd).endsWith('plugin-b')) {
+                throw new Error('Network error');
+            }
+            return '';
+        }),
+        execSync: vi.fn(() => ''),
+    };
+});
+describe('updateAllPlugins', () => {
+    const testDirA = path.join(PLUGINS_DIR, 'plugin-a');
+    const testDirB = path.join(PLUGINS_DIR, 'plugin-b');
+    const testDirC = path.join(PLUGINS_DIR, 'plugin-c');
+    beforeEach(() => {
+        fs.mkdirSync(testDirA, { recursive: true });
+        fs.mkdirSync(testDirB, { recursive: true });
+        fs.mkdirSync(testDirC, { recursive: true });
+        fs.writeFileSync(path.join(testDirA, 'cmd.yaml'), 'site: a');
+        fs.writeFileSync(path.join(testDirB, 'cmd.yaml'), 'site: b');
+        fs.writeFileSync(path.join(testDirC, 'cmd.yaml'), 'site: c');
+    });
+    afterEach(() => {
+        try {
+            fs.rmSync(testDirA, { recursive: true });
+        }
+        catch { }
+        try {
+            fs.rmSync(testDirB, { recursive: true });
+        }
+        catch { }
+        try {
+            fs.rmSync(testDirC, { recursive: true });
+        }
+        catch { }
+        vi.clearAllMocks();
+    });
+    it('collects successes and failures without throwing', () => {
+        const results = _updateAllPlugins();
+        const resA = results.find(r => r.name === 'plugin-a');
+        const resB = results.find(r => r.name === 'plugin-b');
+        const resC = results.find(r => r.name === 'plugin-c');
+        expect(resA).toBeDefined();
+        expect(resA.success).toBe(true);
+        expect(resB).toBeDefined();
+        expect(resB.success).toBe(false);
+        expect(resB.error).toContain('Network error');
+        expect(resC).toBeDefined();
+        expect(resC.success).toBe(true);
+    });
+});