@xortex/xcode 3.0.0

package/utils/plugins/orphanedPluginFilter.ts

@@ -0,0 +1,114 @@
+/**
+ * Provides ripgrep glob exclusion patterns for orphaned plugin versions.
+ *
+ * When plugin versions are updated, old versions are marked with a
+ * `.orphaned_at` file but kept on disk for 7 days (since concurrent
+ * sessions might still reference them). During this window, Grep/Glob
+ * could return files from orphaned versions, causing Claude to use
+ * outdated plugin code.
+ *
+ * We find `.orphaned_at` markers via a single ripgrep call and generate
+ * `--glob '!<dir>/**'` patterns for their parent directories. The cache
+ * is warmed in main.tsx AFTER cleanupOrphanedPluginVersionsInBackground
+ * settles disk state. Once populated, the exclusion list is frozen for
+ * the session unless /reload-plugins is called; subsequent disk mutations
+ * (autoupdate, concurrent sessions) don't affect it.
+ */
+
+import { dirname, isAbsolute, join, normalize, relative, sep } from 'path'
+import { ripGrep } from '../ripgrep.js'
+import { getPluginsDirectory } from './pluginDirectories.js'
+
+// Inlined from cacheUtils.ts to avoid a circular dep through commands.js.
+const ORPHANED_AT_FILENAME = '.orphaned_at'
+
+/** Session-scoped cache. Frozen once computed — only cleared by explicit /reload-plugins. */
+let cachedExclusions: string[] | null = null
+
+/**
+ * Get ripgrep glob exclusion patterns for orphaned plugin versions.
+ *
+ * @param searchPath - When provided, exclusions are only returned if the
+ *   search overlaps the plugin cache directory (avoids unnecessary --glob
+ *   args for searches outside the cache).
+ *
+ * Warmed eagerly in main.tsx after orphan GC; the lazy-compute path here
+ * is a fallback. Best-effort: returns empty array if anything goes wrong.
+ */
+export async function getGlobExclusionsForPluginCache(
+  searchPath?: string,
+): Promise<string[]> {
+  const cachePath = normalize(join(getPluginsDirectory(), 'cache'))
+
+  if (searchPath && !pathsOverlap(searchPath, cachePath)) {
+    return []
+  }
+
+  if (cachedExclusions !== null) {
+    return cachedExclusions
+  }
+
+  try {
+    // Find all .orphaned_at files within the plugin cache directory.
+    // --hidden: marker is a dotfile. --no-ignore: don't let a stray
+    // .gitignore hide it. --max-depth 4: marker is always at
+    // cache/<marketplace>/<plugin>/<version>/.orphaned_at — don't recurse
+    // into plugin contents (node_modules, etc.). Never-aborts signal: no
+    // caller signal to thread.
+    const markers = await ripGrep(
+      [
+        '--files',
+        '--hidden',
+        '--no-ignore',
+        '--max-depth',
+        '4',
+        '--glob',
+        ORPHANED_AT_FILENAME,
+      ],
+      cachePath,
+      new AbortController().signal,
+    )
+
+    cachedExclusions = markers.map(markerPath => {
+      // ripgrep may return absolute or relative — normalize to relative.
+      const versionDir = dirname(markerPath)
+      const rel = isAbsolute(versionDir)
+        ? relative(cachePath, versionDir)
+        : versionDir
+      // ripgrep glob patterns always use forward slashes, even on Windows
+      const posixRelative = rel.replace(/\\/g, '/')
+      return `!**/${posixRelative}/**`
+    })
+    return cachedExclusions
+  } catch {
+    // Best-effort — don't break core search tools if ripgrep fails here
+    cachedExclusions = []
+    return cachedExclusions
+  }
+}
+
+export function clearPluginCacheExclusions(): void {
+  cachedExclusions = null
+}
+
+/**
+ * One path is a prefix of the other. Special-cases root (normalize('/') + sep
+ * = '//'). Case-insensitive on win32 since normalize() doesn't lowercase
+ * drive letters and CLAUDE_CODE_PLUGIN_CACHE_DIR may disagree with resolved.
+ */
+function pathsOverlap(a: string, b: string): boolean {
+  const na = normalizeForCompare(a)
+  const nb = normalizeForCompare(b)
+  return (
+    na === nb ||
+    na === sep ||
+    nb === sep ||
+    na.startsWith(nb + sep) ||
+    nb.startsWith(na + sep)
+  )
+}
+
+function normalizeForCompare(p: string): string {
+  const n = normalize(p)
+  return process.platform === 'win32' ? n.toLowerCase() : n
+}

package/utils/plugins/parseMarketplaceInput.ts

@@ -0,0 +1,162 @@
+import { homedir } from 'os'
+import { resolve } from 'path'
+import { getErrnoCode } from '../errors.js'
+import { getFsImplementation } from '../fsOperations.js'
+import type { MarketplaceSource } from './schemas.js'
+
+/**
+ * Parses a marketplace input string and returns the appropriate marketplace source type.
+ * Handles various input formats:
+ * - Git SSH URLs (user@host:path or user@host:path.git)
+ *   - Standard: git@github.com:owner/repo.git
+ *   - GitHub Enterprise SSH certificates: org-123456@github.com:owner/repo.git
+ *   - Custom usernames: deploy@gitlab.com:group/project.git
+ *   - Self-hosted: user@192.168.10.123:path/to/repo
+ * - HTTP/HTTPS URLs
+ * - GitHub shorthand (owner/repo)
+ * - Local file paths (.json files)
+ * - Local directory paths
+ *
+ * @param input The marketplace source input string
+ * @returns MarketplaceSource object, error object, or null if format is unrecognized
+ */
+export async function parseMarketplaceInput(
+  input: string,
+): Promise<MarketplaceSource | { error: string } | null> {
+  const trimmed = input.trim()
+  const fs = getFsImplementation()
+
+  // Handle git SSH URLs with any valid username (not just 'git')
+  // Supports: user@host:path, user@host:path.git, and with #ref suffix
+  // Username can contain: alphanumeric, dots, underscores, hyphens
+  const sshMatch = trimmed.match(
+    /^([a-zA-Z0-9._-]+@[^:]+:.+?(?:\.git)?)(#(.+))?$/,
+  )
+  if (sshMatch?.[1]) {
+    const url = sshMatch[1]
+    const ref = sshMatch[3]
+    return ref ? { source: 'git', url, ref } : { source: 'git', url }
+  }
+
+  // Handle URLs
+  if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
+    // Extract fragment (ref) from URL if present
+    const fragmentMatch = trimmed.match(/^([^#]+)(#(.+))?$/)
+    const urlWithoutFragment = fragmentMatch?.[1] || trimmed
+    const ref = fragmentMatch?.[3]
+
+    // When user explicitly provides an HTTPS/HTTP URL that looks like a git
+    // repo, use the git source type so we clone rather than fetch-as-JSON.
+    // The .git suffix is a GitHub/GitLab/Bitbucket convention. Azure DevOps
+    // uses /_git/ in the path with NO suffix (appending .git breaks ADO:
+    // TF401019 "repo does not exist"). Without this check, an ADO URL falls
+    // through to source:'url' below, which tries to fetch it as a raw
+    // marketplace.json — the HTML response parses as "expected object,
+    // received string". (gh-31256 / CC-299)
+    if (
+      urlWithoutFragment.endsWith('.git') ||
+      urlWithoutFragment.includes('/_git/')
+    ) {
+      return ref
+        ? { source: 'git', url: urlWithoutFragment, ref }
+        : { source: 'git', url: urlWithoutFragment }
+    }
+    // Parse URL to check hostname
+    let url: URL
+    try {
+      url = new URL(urlWithoutFragment)
+    } catch (_err) {
+      // Not a valid URL for parsing, treat as generic URL
+      // new URL() throws TypeError for invalid URLs
+      return { source: 'url', url: urlWithoutFragment }
+    }
+
+    if (url.hostname === 'github.com' || url.hostname === 'www.github.com') {
+      const match = url.pathname.match(/^\/([^/]+\/[^/]+?)(\/|\.git|$)/)
+      if (match?.[1]) {
+        // User explicitly provided HTTPS URL - keep it as HTTPS via 'git' type
+        // Add .git suffix if not present for proper git clone
+        const gitUrl = urlWithoutFragment.endsWith('.git')
+          ? urlWithoutFragment
+          : `${urlWithoutFragment}.git`
+        return ref
+          ? { source: 'git', url: gitUrl, ref }
+          : { source: 'git', url: gitUrl }
+      }
+    }
+    return { source: 'url', url: urlWithoutFragment }
+  }
+
+  // Handle local paths
+  // On Windows, also recognize backslash-relative (.\, ..\) and drive letter paths (C:\)
+  // These are Windows-only because backslashes are valid filename chars on Unix
+  const isWindows = process.platform === 'win32'
+  const isWindowsPath =
+    isWindows &&
+    (trimmed.startsWith('.\\') ||
+      trimmed.startsWith('..\\') ||
+      /^[a-zA-Z]:[/\\]/.test(trimmed))
+  if (
+    trimmed.startsWith('./') ||
+    trimmed.startsWith('../') ||
+    trimmed.startsWith('/') ||
+    trimmed.startsWith('~') ||
+    isWindowsPath
+  ) {
+    const resolvedPath = resolve(
+      trimmed.startsWith('~') ? trimmed.replace(/^~/, homedir()) : trimmed,
+    )
+
+    // Stat the path to determine if it's a file or directory. Swallow all stat
+    // errors (ENOENT, EACCES, EPERM, etc.) and return an error result instead
+    // of throwing — matches the old existsSync behavior which never threw.
+    let stats
+    try {
+      stats = await fs.stat(resolvedPath)
+    } catch (e: unknown) {
+      const code = getErrnoCode(e)
+      return {
+        error:
+          code === 'ENOENT'
+            ? `Path does not exist: ${resolvedPath}`
+            : `Cannot access path: ${resolvedPath} (${code ?? e})`,
+      }
+    }
+
+    if (stats.isFile()) {
+      if (resolvedPath.endsWith('.json')) {
+        return { source: 'file', path: resolvedPath }
+      } else {
+        return {
+          error: `File path must point to a .json file (marketplace.json), but got: ${resolvedPath}`,
+        }
+      }
+    } else if (stats.isDirectory()) {
+      return { source: 'directory', path: resolvedPath }
+    } else {
+      return {
+        error: `Path is neither a file nor a directory: ${resolvedPath}`,
+      }
+    }
+  }
+
+  // Handle GitHub shorthand (owner/repo, owner/repo#ref, or owner/repo@ref)
+  // Accept both # and @ as ref separators — the display formatter uses @, so users
+  // naturally type @ when copying from error messages or managed settings.
+  if (trimmed.includes('/') && !trimmed.startsWith('@')) {
+    if (trimmed.includes(':')) {
+      return null
+    }
+    // Extract ref if present (either #ref or @ref)
+    const fragmentMatch = trimmed.match(/^([^#@]+)(?:[#@](.+))?$/)
+    const repo = fragmentMatch?.[1] || trimmed
+    const ref = fragmentMatch?.[2]
+    // Assume it's a GitHub repo
+    return ref ? { source: 'github', repo, ref } : { source: 'github', repo }
+  }
+
+  // NPM packages not yet implemented
+  // Returning null for unrecognized input
+
+  return null
+}

package/utils/plugins/performStartupChecks.tsx

@@ -0,0 +1,70 @@
+import { performBackgroundPluginInstallations } from '../../services/plugins/PluginInstallationManager.js';
+import type { AppState } from '../../state/AppState.js';
+import { checkHasTrustDialogAccepted } from '../config.js';
+import { logForDebugging } from '../debug.js';
+import { clearMarketplacesCache, registerSeedMarketplaces } from './marketplaceManager.js';
+import { clearPluginCache } from './pluginLoader.js';
+type SetAppState = (f: (prevState: AppState) => AppState) => void;
+
+/**
+ * Perform plugin startup checks and initiate background installations
+ *
+ * This function starts background installation of marketplaces and plugins
+ * from trusted sources (repository and user settings) without blocking startup.
+ * Installation progress and errors are tracked in AppState and shown via notifications.
+ *
+ * SECURITY: This function is only called from REPL.tsx after the "trust this folder"
+ * dialog has been confirmed. The trust dialog in cli.tsx blocks all execution until
+ * the user explicitly trusts the current working directory, ensuring that plugin
+ * installations only happen with user consent. This prevents malicious repositories
+ * from automatically installing plugins without user approval.
+ *
+ * @param setAppState Function to update app state with installation progress
+ */
+export async function performStartupChecks(setAppState: SetAppState): Promise<void> {
+  logForDebugging('performStartupChecks called');
+
+  // Check if the current directory has been trusted
+  if (!checkHasTrustDialogAccepted()) {
+    logForDebugging('Trust not accepted for current directory - skipping plugin installations');
+    return;
+  }
+  try {
+    logForDebugging('Starting background plugin installations');
+
+    // Register seed marketplaces (CLAUDE_CODE_PLUGIN_SEED_DIR) before diffing.
+    // Idempotent; no-op if seed not configured. Without this, background install
+    // would see seed marketplaces as missing → clone → defeats seed's purpose.
+    //
+    // If registration changed state, clear caches so earlier plugin-load passes
+    // (e.g. getAllMcpConfigs during REPL init) don't keep stale "marketplace
+    // not found" results.
+    const seedChanged = await registerSeedMarketplaces();
+    if (seedChanged) {
+      clearMarketplacesCache();
+      clearPluginCache('performStartupChecks: seed marketplaces changed');
+      // Set needsRefresh so useManagePlugins notifies the user to run
+      // /reload-plugins. Without this signal, the initial plugin-load
+      // (which raced and cached "marketplace not found") would persist
+      // until the user manually reloads.
+      setAppState(prev => {
+        if (prev.plugins.needsRefresh) return prev;
+        return {
+          ...prev,
+          plugins: {
+            ...prev.plugins,
+            needsRefresh: true
+          }
+        };
+      });
+    }
+
+    // Start background installations without waiting
+    // This will update AppState as installations progress
+    await performBackgroundPluginInstallations(setAppState);
+  } catch (error) {
+    // Even if something fails here, don't block startup
+    logForDebugging(`Error initiating background plugin installations: ${error}`);
+  }
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJwZXJmb3JtQmFja2dyb3VuZFBsdWdpbkluc3RhbGxhdGlvbnMiLCJBcHBTdGF0ZSIsImNoZWNrSGFzVHJ1c3REaWFsb2dBY2NlcHRlZCIsImxvZ0ZvckRlYnVnZ2luZyIsImNsZWFyTWFya2V0cGxhY2VzQ2FjaGUiLCJyZWdpc3RlclNlZWRNYXJrZXRwbGFjZXMiLCJjbGVhclBsdWdpbkNhY2hlIiwiU2V0QXBwU3RhdGUiLCJmIiwicHJldlN0YXRlIiwicGVyZm9ybVN0YXJ0dXBDaGVja3MiLCJzZXRBcHBTdGF0ZSIsIlByb21pc2UiLCJzZWVkQ2hhbmdlZCIsInByZXYiLCJwbHVnaW5zIiwibmVlZHNSZWZyZXNoIiwiZXJyb3IiXSwic291cmNlcyI6WyJwZXJmb3JtU3RhcnR1cENoZWNrcy50c3giXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgcGVyZm9ybUJhY2tncm91bmRQbHVnaW5JbnN0YWxsYXRpb25zIH0gZnJvbSAnLi4vLi4vc2VydmljZXMvcGx1Z2lucy9QbHVnaW5JbnN0YWxsYXRpb25NYW5hZ2VyLmpzJ1xuaW1wb3J0IHR5cGUgeyBBcHBTdGF0ZSB9IGZyb20gJy4uLy4uL3N0YXRlL0FwcFN0YXRlLmpzJ1xuaW1wb3J0IHsgY2hlY2tIYXNUcnVzdERpYWxvZ0FjY2VwdGVkIH0gZnJvbSAnLi4vY29uZmlnLmpzJ1xuaW1wb3J0IHsgbG9nRm9yRGVidWdnaW5nIH0gZnJvbSAnLi4vZGVidWcuanMnXG5pbXBvcnQge1xuICBjbGVhck1hcmtldHBsYWNlc0NhY2hlLFxuICByZWdpc3RlclNlZWRNYXJrZXRwbGFjZXMsXG59IGZyb20gJy4vbWFya2V0cGxhY2VNYW5hZ2VyLmpzJ1xuaW1wb3J0IHsgY2xlYXJQbHVnaW5DYWNoZSB9IGZyb20gJy4vcGx1Z2luTG9hZGVyLmpzJ1xuXG50eXBlIFNldEFwcFN0YXRlID0gKGY6IChwcmV2U3RhdGU6IEFwcFN0YXRlKSA9PiBBcHBTdGF0ZSkgPT4gdm9pZFxuXG4vKipcbiAqIFBlcmZvcm0gcGx1Z2luIHN0YXJ0dXAgY2hlY2tzIGFuZCBpbml0aWF0ZSBiYWNrZ3JvdW5kIGluc3RhbGxhdGlvbnNcbiAqXG4gKiBUaGlzIGZ1bmN0aW9uIHN0YXJ0cyBiYWNrZ3JvdW5kIGluc3RhbGxhdGlvbiBvZiBtYXJrZXRwbGFjZXMgYW5kIHBsdWdpbnNcbiAqIGZyb20gdHJ1c3RlZCBzb3VyY2VzIChyZXBvc2l0b3J5IGFuZCB1c2VyIHNldHRpbmdzKSB3aXRob3V0IGJsb2NraW5nIHN0YXJ0dXAuXG4gKiBJbnN0YWxsYXRpb24gcHJvZ3Jlc3MgYW5kIGVycm9ycyBhcmUgdHJhY2tlZCBpbiBBcHBTdGF0ZSBhbmQgc2hvd24gdmlhIG5vdGlmaWNhdGlvbnMuXG4gKlxuICogU0VDVVJJVFk6IFRoaXMgZnVuY3Rpb24gaXMgb25seSBjYWxsZWQgZnJvbSBSRVBMLnRzeCBhZnRlciB0aGUgXCJ0cnVzdCB0aGlzIGZvbGRlclwiXG4gKiBkaWFsb2cgaGFzIGJlZW4gY29uZmlybWVkLiBUaGUgdHJ1c3QgZGlhbG9nIGluIGNsaS50c3ggYmxvY2tzIGFsbCBleGVjdXRpb24gdW50aWxcbiAqIHRoZSB1c2VyIGV4cGxpY2l0bHkgdHJ1c3RzIHRoZSBjdXJyZW50IHdvcmtpbmcgZGlyZWN0b3J5LCBlbnN1cmluZyB0aGF0IHBsdWdpblxuICogaW5zdGFsbGF0aW9ucyBvbmx5IGhhcHBlbiB3aXRoIHVzZXIgY29uc2VudC4gVGhpcyBwcmV2ZW50cyBtYWxpY2lvdXMgcmVwb3NpdG9yaWVzXG4gKiBmcm9tIGF1dG9tYXRpY2FsbHkgaW5zdGFsbGluZyBwbHVnaW5zIHdpdGhvdXQgdXNlciBhcHByb3ZhbC5cbiAqXG4gKiBAcGFyYW0gc2V0QXBwU3RhdGUgRnVuY3Rpb24gdG8gdXBkYXRlIGFwcCBzdGF0ZSB3aXRoIGluc3RhbGxhdGlvbiBwcm9ncmVzc1xuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcGVyZm9ybVN0YXJ0dXBDaGVja3MoXG4gIHNldEFwcFN0YXRlOiBTZXRBcHBTdGF0ZSxcbik6IFByb21pc2U8dm9pZD4ge1xuICBsb2dGb3JEZWJ1Z2dpbmcoJ3BlcmZvcm1TdGFydHVwQ2hlY2tzIGNhbGxlZCcpXG5cbiAgLy8gQ2hlY2sgaWYgdGhlIGN1cnJlbnQgZGlyZWN0b3J5IGhhcyBiZWVuIHRydXN0ZWRcbiAgaWYgKCFjaGVja0hhc1RydXN0RGlhbG9nQWNjZXB0ZWQoKSkge1xuICAgIGxvZ0ZvckRlYnVnZ2luZyhcbiAgICAgICdUcnVzdCBub3QgYWNjZXB0ZWQgZm9yIGN1cnJlbnQgZGlyZWN0b3J5IC0gc2tpcHBpbmcgcGx1Z2luIGluc3RhbGxhdGlvbnMnLFxuICAgIClcbiAgICByZXR1cm5cbiAgfVxuXG4gIHRyeSB7XG4gICAgbG9nRm9yRGVidWdnaW5nKCdTdGFydGluZyBiYWNrZ3JvdW5kIHBsdWdpbiBpbnN0YWxsYXRpb25zJylcblxuICAgIC8vIFJlZ2lzdGVyIHNlZWQgbWFya2V0cGxhY2VzIChDTEFVREVfQ09ERV9QTFVHSU5fU0VFRF9ESVIpIGJlZm9yZSBkaWZmaW5nLlxuICAgIC8vIElkZW1wb3RlbnQ7IG5vLW9wIGlmIHNlZWQgbm90IGNvbmZpZ3VyZWQuIFdpdGhvdXQgdGhpcywgYmFja2dyb3VuZCBpbnN0YWxsXG4gICAgLy8gd291bGQgc2VlIHNlZWQgbWFya2V0cGxhY2VzIGFzIG1pc3Npbmcg4oaSIGNsb25lIOKGkiBkZWZlYXRzIHNlZWQncyBwdXJwb3NlLlxuICAgIC8vXG4gICAgLy8gSWYgcmVnaXN0cmF0aW9uIGNoYW5nZWQgc3RhdGUsIGNsZWFyIGNhY2hlcyBzbyBlYXJsaWVyIHBsdWdpbi1sb2FkIHBhc3Nlc1xuICAgIC8vIChlLmcuIGdldEFsbE1jcENvbmZpZ3MgZHVyaW5nIFJFUEwgaW5pdCkgZG9uJ3Qga2VlcCBzdGFsZSBcIm1hcmtldHBsYWNlXG4gICAgLy8gbm90IGZvdW5kXCIgcmVzdWx0cy5cbiAgICBjb25zdCBzZWVkQ2hhbmdlZCA9IGF3YWl0IHJlZ2lzdGVyU2VlZE1hcmtldHBsYWNlcygpXG4gICAgaWYgKHNlZWRDaGFuZ2VkKSB7XG4gICAgICBjbGVhck1hcmtldHBsYWNlc0NhY2hlKClcbiAgICAgIGNsZWFyUGx1Z2luQ2FjaGUoJ3BlcmZvcm1TdGFydHVwQ2hlY2tzOiBzZWVkIG1hcmtldHBsYWNlcyBjaGFuZ2VkJylcbiAgICAgIC8vIFNldCBuZWVkc1JlZnJlc2ggc28gdXNlTWFuYWdlUGx1Z2lucyBub3RpZmllcyB0aGUgdXNlciB0byBydW5cbiAgICAgIC8vIC9yZWxvYWQtcGx1Z2lucy4gV2l0aG91dCB0aGlzIHNpZ25hbCwgdGhlIGluaXRpYWwgcGx1Z2luLWxvYWRcbiAgICAgIC8vICh3aGljaCByYWNlZCBhbmQgY2FjaGVkIFwibWFya2V0cGxhY2Ugbm90IGZvdW5kXCIpIHdvdWxkIHBlcnNpc3RcbiAgICAgIC8vIHVudGlsIHRoZSB1c2VyIG1hbnVhbGx5IHJlbG9hZHMuXG4gICAgICBzZXRBcHBTdGF0ZShwcmV2ID0+IHtcbiAgICAgICAgaWYgKHByZXYucGx1Z2lucy5uZWVkc1JlZnJlc2gpIHJldHVybiBwcmV2XG4gICAgICAgIHJldHVybiB7XG4gICAgICAgICAgLi4ucHJldixcbiAgICAgICAgICBwbHVnaW5zOiB7IC4uLnByZXYucGx1Z2lucywgbmVlZHNSZWZyZXNoOiB0cnVlIH0sXG4gICAgICAgIH1cbiAgICAgIH0pXG4gICAgfVxuXG4gICAgLy8gU3RhcnQgYmFja2dyb3VuZCBpbnN0YWxsYXRpb25zIHdpdGhvdXQgd2FpdGluZ1xuICAgIC8vIFRoaXMgd2lsbCB1cGRhdGUgQXBwU3RhdGUgYXMgaW5zdGFsbGF0aW9ucyBwcm9ncmVzc1xuICAgIGF3YWl0IHBlcmZvcm1CYWNrZ3JvdW5kUGx1Z2luSW5zdGFsbGF0aW9ucyhzZXRBcHBTdGF0ZSlcbiAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAvLyBFdmVuIGlmIHNvbWV0aGluZyBmYWlscyBoZXJlLCBkb24ndCBibG9jayBzdGFydHVwXG4gICAgbG9nRm9yRGVidWdnaW5nKFxuICAgICAgYEVycm9yIGluaXRpYXRpbmcgYmFja2dyb3VuZCBwbHVnaW4gaW5zdGFsbGF0aW9uczogJHtlcnJvcn1gLFxuICAgIClcbiAgfVxufVxuIl0sIm1hcHBpbmdzIjoiQUFBQSxTQUFTQSxvQ0FBb0MsUUFBUSxxREFBcUQ7QUFDMUcsY0FBY0MsUUFBUSxRQUFRLHlCQUF5QjtBQUN2RCxTQUFTQywyQkFBMkIsUUFBUSxjQUFjO0FBQzFELFNBQVNDLGVBQWUsUUFBUSxhQUFhO0FBQzdDLFNBQ0VDLHNCQUFzQixFQUN0QkMsd0JBQXdCLFFBQ25CLHlCQUF5QjtBQUNoQyxTQUFTQyxnQkFBZ0IsUUFBUSxtQkFBbUI7QUFFcEQsS0FBS0MsV0FBVyxHQUFHLENBQUNDLENBQUMsRUFBRSxDQUFDQyxTQUFTLEVBQUVSLFFBQVEsRUFBRSxHQUFHQSxRQUFRLEVBQUUsR0FBRyxJQUFJOztBQUVqRTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQSxPQUFPLGVBQWVTLG9CQUFvQkEsQ0FDeENDLFdBQVcsRUFBRUosV0FBVyxDQUN6QixFQUFFSyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7RUFDZlQsZUFBZSxDQUFDLDZCQUE2QixDQUFDOztFQUU5QztFQUNBLElBQUksQ0FBQ0QsMkJBQTJCLENBQUMsQ0FBQyxFQUFFO0lBQ2xDQyxlQUFlLENBQ2IsMEVBQ0YsQ0FBQztJQUNEO0VBQ0Y7RUFFQSxJQUFJO0lBQ0ZBLGVBQWUsQ0FBQywwQ0FBMEMsQ0FBQzs7SUFFM0Q7SUFDQTtJQUNBO0lBQ0E7SUFDQTtJQUNBO0lBQ0E7SUFDQSxNQUFNVSxXQUFXLEdBQUcsTUFBTVIsd0JBQXdCLENBQUMsQ0FBQztJQUNwRCxJQUFJUSxXQUFXLEVBQUU7TUFDZlQsc0JBQXNCLENBQUMsQ0FBQztNQUN4QkUsZ0JBQWdCLENBQUMsaURBQWlELENBQUM7TUFDbkU7TUFDQTtNQUNBO01BQ0E7TUFDQUssV0FBVyxDQUFDRyxJQUFJLElBQUk7UUFDbEIsSUFBSUEsSUFBSSxDQUFDQyxPQUFPLENBQUNDLFlBQVksRUFBRSxPQUFPRixJQUFJO1FBQzFDLE9BQU87VUFDTCxHQUFHQSxJQUFJO1VBQ1BDLE9BQU8sRUFBRTtZQUFFLEdBQUdELElBQUksQ0FBQ0MsT0FBTztZQUFFQyxZQUFZLEVBQUU7VUFBSztRQUNqRCxDQUFDO01BQ0gsQ0FBQyxDQUFDO0lBQ0o7O0lBRUE7SUFDQTtJQUNBLE1BQU1oQixvQ0FBb0MsQ0FBQ1csV0FBVyxDQUFDO0VBQ3pELENBQUMsQ0FBQyxPQUFPTSxLQUFLLEVBQUU7SUFDZDtJQUNBZCxlQUFlLENBQ2IscURBQXFEYyxLQUFLLEVBQzVELENBQUM7RUFDSDtBQUNGIiwiaWdub3JlTGlzdCI6W119

package/utils/plugins/pluginAutoupdate.ts

@@ -0,0 +1,284 @@
+/**
+ * Background plugin autoupdate functionality
+ *
+ * At startup, this module:
+ * 1. First updates marketplaces that have autoUpdate enabled
+ * 2. Then checks all installed plugins from those marketplaces and updates them
+ *
+ * Updates are non-inplace (disk-only), requiring a restart to take effect.
+ * Official Anthropic marketplaces have autoUpdate enabled by default,
+ * but users can disable it per-marketplace.
+ */
+
+import { updatePluginOp } from '../../services/plugins/pluginOperations.js'
+import { shouldSkipPluginAutoupdate } from '../config.js'
+import { logForDebugging } from '../debug.js'
+import { errorMessage } from '../errors.js'
+import { logError } from '../log.js'
+import {
+  getPendingUpdatesDetails,
+  hasPendingUpdates,
+  isInstallationRelevantToCurrentProject,
+  loadInstalledPluginsFromDisk,
+} from './installedPluginsManager.js'
+import {
+  getDeclaredMarketplaces,
+  loadKnownMarketplacesConfig,
+  refreshMarketplace,
+} from './marketplaceManager.js'
+import { parsePluginIdentifier } from './pluginIdentifier.js'
+import { isMarketplaceAutoUpdate, type PluginScope } from './schemas.js'
+
+/**
+ * Callback type for notifying when plugins have been updated
+ */
+export type PluginAutoUpdateCallback = (updatedPlugins: string[]) => void
+
+// Store callback for plugin update notifications
+let pluginUpdateCallback: PluginAutoUpdateCallback | null = null
+
+// Store pending updates that occurred before callback was registered
+// This handles the race condition where updates complete before REPL mounts
+let pendingNotification: string[] | null = null
+
+/**
+ * Register a callback to be notified when plugins are auto-updated.
+ * This is used by the REPL to show restart notifications.
+ *
+ * If plugins were already updated before the callback was registered,
+ * the callback will be invoked immediately with the pending updates.
+ */
+export function onPluginsAutoUpdated(
+  callback: PluginAutoUpdateCallback,
+): () => void {
+  pluginUpdateCallback = callback
+
+  // If there are pending updates that happened before registration, deliver them now
+  if (pendingNotification !== null && pendingNotification.length > 0) {
+    callback(pendingNotification)
+    pendingNotification = null
+  }
+
+  return () => {
+    pluginUpdateCallback = null
+  }
+}
+
+/**
+ * Check if pending updates came from autoupdate (for notification purposes).
+ * Returns the list of plugin names that have pending updates.
+ */
+export function getAutoUpdatedPluginNames(): string[] {
+  if (!hasPendingUpdates()) {
+    return []
+  }
+  return getPendingUpdatesDetails().map(
+    d => parsePluginIdentifier(d.pluginId).name,
+  )
+}
+
+/**
+ * Get the set of marketplaces that have autoUpdate enabled.
+ * Returns the marketplace names that should be auto-updated.
+ */
+async function getAutoUpdateEnabledMarketplaces(): Promise<Set<string>> {
+  const config = await loadKnownMarketplacesConfig()
+  const declared = getDeclaredMarketplaces()
+  const enabled = new Set<string>()
+
+  for (const [name, entry] of Object.entries(config)) {
+    // Settings-declared autoUpdate takes precedence over JSON state
+    const declaredAutoUpdate = declared[name]?.autoUpdate
+    const autoUpdate =
+      declaredAutoUpdate !== undefined
+        ? declaredAutoUpdate
+        : isMarketplaceAutoUpdate(name, entry)
+    if (autoUpdate) {
+      enabled.add(name.toLowerCase())
+    }
+  }
+
+  return enabled
+}
+
+/**
+ * Update a single plugin's installations.
+ * Returns the plugin ID if any installation was updated, null otherwise.
+ */
+async function updatePlugin(
+  pluginId: string,
+  installations: Array<{ scope: PluginScope; projectPath?: string }>,
+): Promise<string | null> {
+  let wasUpdated = false
+
+  for (const { scope } of installations) {
+    try {
+      const result = await updatePluginOp(pluginId, scope)
+
+      if (result.success && !result.alreadyUpToDate) {
+        wasUpdated = true
+        logForDebugging(
+          `Plugin autoupdate: updated ${pluginId} from ${result.oldVersion} to ${result.newVersion}`,
+        )
+      } else if (!result.alreadyUpToDate) {
+        logForDebugging(
+          `Plugin autoupdate: failed to update ${pluginId}: ${result.message}`,
+          { level: 'warn' },
+        )
+      }
+    } catch (error) {
+      logForDebugging(
+        `Plugin autoupdate: error updating ${pluginId}: ${errorMessage(error)}`,
+        { level: 'warn' },
+      )
+    }
+  }
+
+  return wasUpdated ? pluginId : null
+}
+
+/**
+ * Update all project-relevant installed plugins from the given marketplaces.
+ *
+ * Iterates installed_plugins.json, filters to plugins whose marketplace is in
+ * the set, further filters each plugin's installations to those relevant to
+ * the current project (user/managed scope, or project/local scope matching
+ * cwd — see isInstallationRelevantToCurrentProject), then calls updatePluginOp
+ * per installation. Already-up-to-date plugins are silently skipped.
+ *
+ * Called by:
+ * - updatePlugins() below — background autoupdate path (autoUpdate-enabled
+ *   marketplaces only; third-party marketplaces default autoUpdate: false)
+ * - ManageMarketplaces.tsx applyChanges() — user-initiated /plugin marketplace
+ *   update. Before #29512 this path only called refreshMarketplace() (git
+ *   pull on the marketplace clone), so the loader would create the new
+ *   version cache dir but installed_plugins.json stayed on the old version,
+ *   and the orphan GC stamped the NEW dir with .orphaned_at on next startup.
+ *
+ * @param marketplaceNames - lowercase marketplace names to update plugins from
+ * @returns plugin IDs that were actually updated (not already up-to-date)
+ */
+export async function updatePluginsForMarketplaces(
+  marketplaceNames: Set<string>,
+): Promise<string[]> {
+  const installedPlugins = loadInstalledPluginsFromDisk()
+  const pluginIds = Object.keys(installedPlugins.plugins)
+
+  if (pluginIds.length === 0) {
+    return []
+  }
+
+  const results = await Promise.allSettled(
+    pluginIds.map(async pluginId => {
+      const { marketplace } = parsePluginIdentifier(pluginId)
+      if (!marketplace || !marketplaceNames.has(marketplace.toLowerCase())) {
+        return null
+      }
+
+      const allInstallations = installedPlugins.plugins[pluginId]
+      if (!allInstallations || allInstallations.length === 0) {
+        return null
+      }
+
+      const relevantInstallations = allInstallations.filter(
+        isInstallationRelevantToCurrentProject,
+      )
+      if (relevantInstallations.length === 0) {
+        return null
+      }
+
+      return updatePlugin(pluginId, relevantInstallations)
+    }),
+  )
+
+  return results
+    .filter(
+      (r): r is PromiseFulfilledResult<string> =>
+        r.status === 'fulfilled' && r.value !== null,
+    )
+    .map(r => r.value)
+}
+
+/**
+ * Update plugins from marketplaces that have autoUpdate enabled.
+ * Returns the list of plugin IDs that were updated.
+ */
+async function updatePlugins(
+  autoUpdateEnabledMarketplaces: Set<string>,
+): Promise<string[]> {
+  return updatePluginsForMarketplaces(autoUpdateEnabledMarketplaces)
+}
+
+/**
+ * Auto-update marketplaces and plugins in the background.
+ *
+ * This function:
+ * 1. Checks which marketplaces have autoUpdate enabled
+ * 2. Refreshes only those marketplaces (git pull/re-download)
+ * 3. Updates installed plugins from those marketplaces
+ * 4. If any plugins were updated, notifies via the registered callback
+ *
+ * Official Anthropic marketplaces have autoUpdate enabled by default,
+ * but users can disable it per-marketplace in the UI.
+ *
+ * This function runs silently without blocking user interaction.
+ * Called from main.tsx during startup as a background job.
+ */
+export function autoUpdateMarketplacesAndPluginsInBackground(): void {
+  void (async () => {
+    if (shouldSkipPluginAutoupdate()) {
+      logForDebugging('Plugin autoupdate: skipped (auto-updater disabled)')
+      return
+    }
+
+    try {
+      // Get marketplaces with autoUpdate enabled
+      const autoUpdateEnabledMarketplaces =
+        await getAutoUpdateEnabledMarketplaces()
+
+      if (autoUpdateEnabledMarketplaces.size === 0) {
+        return
+      }
+
+      // Refresh only marketplaces with autoUpdate enabled
+      const refreshResults = await Promise.allSettled(
+        Array.from(autoUpdateEnabledMarketplaces).map(async name => {
+          try {
+            await refreshMarketplace(name, undefined, {
+              disableCredentialHelper: true,
+            })
+          } catch (error) {
+            logForDebugging(
+              `Plugin autoupdate: failed to refresh marketplace ${name}: ${errorMessage(error)}`,
+              { level: 'warn' },
+            )
+          }
+        }),
+      )
+
+      // Log any refresh failures
+      const failures = refreshResults.filter(r => r.status === 'rejected')
+      if (failures.length > 0) {
+        logForDebugging(
+          `Plugin autoupdate: ${failures.length} marketplace refresh(es) failed`,
+          { level: 'warn' },
+        )
+      }
+
+      logForDebugging('Plugin autoupdate: checking installed plugins')
+      const updatedPlugins = await updatePlugins(autoUpdateEnabledMarketplaces)
+
+      if (updatedPlugins.length > 0) {
+        if (pluginUpdateCallback) {
+          // Callback is already registered, invoke it immediately
+          pluginUpdateCallback(updatedPlugins)
+        } else {
+          // Callback not yet registered (REPL not mounted), store for later delivery
+          pendingNotification = updatedPlugins
+        }
+      }
+    } catch (error) {
+      logError(error)
+    }
+  })()
+}