claude-code-arcane 2.9.2 → 2.9.3

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [2.9.3](https://github.com/SebastianLuser/claude-code-arcane/compare/v2.9.2...v2.9.3) (2026-09-07)
+
+
+### Bug Fixes
+
+* **update:** resolve the content version once per run, never fabricate it ([ef78ecf](https://github.com/SebastianLuser/claude-code-arcane/commit/ef78ecf6c5ab17f1a51ea6ae27ef9fa161594798))
+
 ## [2.9.2](https://github.com/SebastianLuser/claude-code-arcane/compare/v2.9.1...v2.9.2) (2026-09-07)
 
 

package/dist/cli.js

@@ -1439,22 +1439,18 @@ var GitHubContentSource = class {
       fs9.rmSync(tmpDir, { recursive: true, force: true });
     }
   }
-  async isAvailable() {
-    try {
-      const response = await fetch(
-        `https://api.github.com/repos/${this.owner}/${this.repo}/commits/${this.branch}`,
-        {
-          method: "HEAD",
-          headers: { "User-Agent": "arcane-cli" },
-          signal: AbortSignal.timeout(5e3)
-        }
-      );
-      return response.ok;
-    } catch {
-      return false;
-    }
-  }
-  async getVersion() {
+  /**
+   * The head commit of the branch, or null when GitHub cannot answer.
+   *
+   * One request, memoized, shared by isAvailable() and getVersion(). It used to be
+   * two - a HEAD to answer "is it reachable?" and a GET to read the sha - against an
+   * endpoint that allows 60 requests an hour unauthenticated. That doubled the cost of
+   * every resolution and, worse, opened a window between the two calls: the HEAD spent
+   * the last request of the hour, the GET came back 403, and the caller had already
+   * committed to the github source. That window is where the fabricated versions came
+   * from.
+   */
+  async resolveVersion() {
     if (this.resolvedVersion) return this.resolvedVersion;
     try {
       const response = await fetch(
@@ -1467,17 +1463,36 @@ var GitHubContentSource = class {
           signal: AbortSignal.timeout(1e4)
         }
       );
-      if (!response.ok) {
-        throw new Error(`GitHub API returned ${response.status}`);
-      }
+      if (!response.ok) return null;
       const data = await response.json();
       this.resolvedVersion = data.sha.substring(0, 12);
       return this.resolvedVersion;
     } catch {
-      this.resolvedVersion = `github-${Date.now()}`;
-      return this.resolvedVersion;
+      return null;
     }
   }
+  async isAvailable() {
+    return await this.resolveVersion() !== null;
+  }
+  /**
+   * Throws when the version cannot be read, rather than inventing one.
+   *
+   * It used to answer `github-${Date.now()}` on any failure, and that string went on to
+   * be an identity: it stamped `source_version` in the manifest, named a cache directory,
+   * and made the install permanently un-diffable against any real version - it never
+   * matched again, so every later run reported an update and no run ever settled. A
+   * transient 403 became durable state on disk. Callers that cannot proceed without a
+   * version now fall back to the cache, which knows a real one.
+   */
+  async getVersion() {
+    const version = await this.resolveVersion();
+    if (!version) {
+      throw new Error(
+        "Could not read the content version from GitHub (offline, or the unauthenticated API rate limit is exhausted - it resets hourly)."
+      );
+    }
+    return version;
+  }
   async downloadAndExtract(destDir) {
     const tarballUrl = `https://api.github.com/repos/${this.owner}/${this.repo}/tarball/${this.branch}`;
     const response = await fetch(tarballUrl, {
@@ -1548,7 +1563,9 @@ async function resolveContentSource(opts = {}) {
       return github;
     }
     if (preference === "github") {
-      throw new Error("GitHub source requested but not available. Check your internet connection.");
+      throw new Error(
+        "GitHub source requested but not available. Check your internet connection, or wait for the unauthenticated API rate limit to reset (hourly)."
+      );
     }
     const cached = findLatestCache();
     if (cached) {
@@ -2357,6 +2374,10 @@ async function updateCommand(opts) {
 Updating ${targets.length} installation${targets.length === 1 ? "" : "s"}...`)
     );
   }
+  const sharedSource = await resolveContentSource({
+    source: opts.source ?? "auto",
+    quiet: opts.quiet
+  });
   const results = [];
   for (const target of targets) {
     if (!opts.quiet) {
@@ -2364,7 +2385,7 @@ Updating ${targets.length} installation${targets.length === 1 ? "" : "s"}...`)
 \u2022 ${target}`));
     }
     try {
-      results.push(await updateTarget(target, opts));
+      results.push(await updateTarget(target, opts, sharedSource));
     } catch (err) {
       if (!opts.quiet) {
         console.log(chalk7.red(`  Update failed: ${err.message}`));
@@ -2382,7 +2403,7 @@ Updating ${targets.length} installation${targets.length === 1 ? "" : "s"}...`)
     printGeneralSummary(results, opts.dryRun ?? false);
   }
 }
-async function updateTarget(target, opts) {
+async function updateTarget(target, opts, sharedSource) {
   const manifest = readManifest(target);
   if (!manifest) {
     if (!opts.quiet) {
@@ -2390,7 +2411,7 @@ async function updateTarget(target, opts) {
     }
     return { target, status: "no-manifest", updated: 0, skipped: 0, removed: 0 };
   }
-  const contentSource = await resolveContentSource({
+  const contentSource = sharedSource ?? await resolveContentSource({
     source: opts.source ?? "auto",
     quiet: opts.quiet
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-arcane",
-  "version": "2.9.2",
+  "version": "2.9.3",
   "description": "Skills, agents, hooks and rules for Claude Code — installable via npx claude-code-arcane",
   "type": "module",
   "bin": {