claudeup 4.17.0 → 4.19.0

package/src/services/gitignore-service.ts

@@ -49,8 +49,30 @@ export async function applyAllSafeFixes(
 export async function applyDestructiveFix(
   cwd: string,
   violation: Violation,
+  rulePattern?: string,
 ): Promise<DestructiveFixResult> {
-  return coreApplyDestructiveFix(cwd, violation);
+  return coreApplyDestructiveFix(cwd, violation, rulePattern);
+}
+
+export async function ensureProjectManifestForEdit(
+  cwd: string,
+  resolved: ResolvedManifest,
+): Promise<string> {
+  const projectManifestPath = join(cwd, ".claude", "gitignore.json");
+  if (existsSync(projectManifestPath)) {
+    const existing = await readFile(projectManifestPath, "utf8");
+    if (existing.trim().length > 0) return projectManifestPath;
+  }
+
+  const manifest: GitignoreManifest = { ignore: [], track: [] };
+  for (const rule of resolved.rules) {
+    if (rule.action === "ignore") manifest.ignore.push(rule.pattern);
+    else manifest.track.push(rule.pattern);
+  }
+
+  await mkdir(dirname(projectManifestPath), { recursive: true });
+  await writeFile(projectManifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  return projectManifestPath;
 }
 
 export interface ApplyTemplateResult {

package/src/services/marketplace-fetcher.js

@@ -0,0 +1,96 @@
+/**
+ * Marketplace.json fetcher with offline fallback.
+ *
+ * Extracted from `plugin-manager.ts` so the fetch + fallback logic can be
+ * unit-tested without dragging in claude-settings.ts's module-level
+ * `os.homedir()` constants (which contaminate the test suite when
+ * imported via plugin-manager.ts).
+ */
+import { isValidGitHubRepo } from "../utils/string-utils.js";
+// Session-level cache for fetched marketplace data (no TTL - persists until explicit refresh)
+const marketplaceCache = new Map();
+export function clearMarketplaceCache() {
+    marketplaceCache.clear();
+}
+export async function fetchMarketplacePlugins(marketplaceName, repo) {
+    // Check cache first - session-level, no TTL
+    const cached = marketplaceCache.get(marketplaceName);
+    if (cached) {
+        return cached;
+    }
+    // Validate repo format to prevent SSRF
+    if (!isValidGitHubRepo(repo)) {
+        console.error(`Invalid GitHub repo format: ${repo}`);
+        return [];
+    }
+    try {
+        // Fetch marketplace.json from GitHub
+        const url = `https://raw.githubusercontent.com/${repo}/main/.claude-plugin/marketplace.json`;
+        const response = await fetch(url, {
+            signal: AbortSignal.timeout(10000), // 10s timeout
+        });
+        if (!response.ok) {
+            console.error(`Failed to fetch marketplace: ${response.status}`);
+            return [];
+        }
+        // Validate content-type
+        const contentType = response.headers.get("content-type");
+        if (contentType &&
+            !contentType.includes("application/json") &&
+            !contentType.includes("text/plain")) {
+            console.error(`Invalid content-type for marketplace: ${contentType}`);
+            return [];
+        }
+        const data = (await response.json());
+        const plugins = [];
+        if (data.plugins && Array.isArray(data.plugins)) {
+            for (const plugin of data.plugins) {
+                plugins.push({
+                    name: plugin.name,
+                    version: plugin.version || null,
+                    description: plugin.description || "",
+                    category: plugin.category,
+                    author: plugin.author,
+                    homepage: plugin.homepage,
+                    tags: plugin.tags,
+                });
+            }
+        }
+        // Cache the result (session-level)
+        marketplaceCache.set(marketplaceName, plugins);
+        return plugins;
+    }
+    catch (error) {
+        console.error(`Error fetching marketplace ${marketplaceName}:`, error);
+        return [];
+    }
+}
+/**
+ * Resolve marketplace plugins with offline fallback.
+ *
+ * Calls `fetchMarketplacePlugins` (which hits GitHub) and, when it returns
+ * empty AND a local marketplace cache exists for the same name, falls back
+ * to the cached plugin manifest. This prevents every installed plugin from
+ * being flagged `isOrphaned: true` (and rendered "deprecated") whenever the
+ * machine can't reach `raw.githubusercontent.com` — the local cache already
+ * has the data, it just wasn't being consulted as a fallback.
+ *
+ * The two shapes are nearly identical; we drop a couple of LocalMarketplacePlugin
+ * fields (lspServers, agents, etc.) that MarketplacePlugin doesn't carry
+ * since the caller doesn't read them at this layer.
+ */
+export async function resolveMarketplacePlugins(mpName, repo, localMarketplaces) {
+    const remote = await fetchMarketplacePlugins(mpName, repo);
+    if (remote.length > 0)
+        return remote;
+    const local = localMarketplaces.get(mpName);
+    if (!local || local.plugins.length === 0)
+        return remote;
+    return local.plugins.map((p) => ({
+        name: p.name,
+        version: p.version,
+        description: p.description,
+        category: p.category,
+        author: p.author,
+    }));
+}

package/src/services/marketplace-fetcher.ts

@@ -0,0 +1,137 @@
+/**
+ * Marketplace.json fetcher with offline fallback.
+ *
+ * Extracted from `plugin-manager.ts` so the fetch + fallback logic can be
+ * unit-tested without dragging in claude-settings.ts's module-level
+ * `os.homedir()` constants (which contaminate the test suite when
+ * imported via plugin-manager.ts).
+ */
+
+import { isValidGitHubRepo } from "../utils/string-utils.js";
+import type { LocalMarketplace } from "./local-marketplace.js";
+
+export interface MarketplacePlugin {
+  name: string;
+  version: string | null;
+  description: string;
+  category?: string;
+  author?: { name: string; email?: string };
+  homepage?: string;
+  tags?: string[];
+}
+
+// Session-level cache for fetched marketplace data (no TTL - persists until explicit refresh)
+const marketplaceCache = new Map<string, MarketplacePlugin[]>();
+
+export function clearMarketplaceCache(): void {
+  marketplaceCache.clear();
+}
+
+export async function fetchMarketplacePlugins(
+  marketplaceName: string,
+  repo: string,
+): Promise<MarketplacePlugin[]> {
+  // Check cache first - session-level, no TTL
+  const cached = marketplaceCache.get(marketplaceName);
+  if (cached) {
+    return cached;
+  }
+
+  // Validate repo format to prevent SSRF
+  if (!isValidGitHubRepo(repo)) {
+    console.error(`Invalid GitHub repo format: ${repo}`);
+    return [];
+  }
+
+  try {
+    // Fetch marketplace.json from GitHub
+    const url = `https://raw.githubusercontent.com/${repo}/main/.claude-plugin/marketplace.json`;
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(10000), // 10s timeout
+    });
+
+    if (!response.ok) {
+      console.error(`Failed to fetch marketplace: ${response.status}`);
+      return [];
+    }
+
+    // Validate content-type
+    const contentType = response.headers.get("content-type");
+    if (
+      contentType &&
+      !contentType.includes("application/json") &&
+      !contentType.includes("text/plain")
+    ) {
+      console.error(`Invalid content-type for marketplace: ${contentType}`);
+      return [];
+    }
+
+    interface RawPlugin {
+      name: string;
+      version?: string | null;
+      description?: string;
+      category?: string;
+      author?: { name: string; email?: string };
+      homepage?: string;
+      tags?: string[];
+    }
+    const data = (await response.json()) as { plugins?: RawPlugin[] };
+    const plugins: MarketplacePlugin[] = [];
+
+    if (data.plugins && Array.isArray(data.plugins)) {
+      for (const plugin of data.plugins) {
+        plugins.push({
+          name: plugin.name,
+          version: plugin.version || null,
+          description: plugin.description || "",
+          category: plugin.category,
+          author: plugin.author,
+          homepage: plugin.homepage,
+          tags: plugin.tags,
+        });
+      }
+    }
+
+    // Cache the result (session-level)
+    marketplaceCache.set(marketplaceName, plugins);
+
+    return plugins;
+  } catch (error) {
+    console.error(`Error fetching marketplace ${marketplaceName}:`, error);
+    return [];
+  }
+}
+
+/**
+ * Resolve marketplace plugins with offline fallback.
+ *
+ * Calls `fetchMarketplacePlugins` (which hits GitHub) and, when it returns
+ * empty AND a local marketplace cache exists for the same name, falls back
+ * to the cached plugin manifest. This prevents every installed plugin from
+ * being flagged `isOrphaned: true` (and rendered "deprecated") whenever the
+ * machine can't reach `raw.githubusercontent.com` — the local cache already
+ * has the data, it just wasn't being consulted as a fallback.
+ *
+ * The two shapes are nearly identical; we drop a couple of LocalMarketplacePlugin
+ * fields (lspServers, agents, etc.) that MarketplacePlugin doesn't carry
+ * since the caller doesn't read them at this layer.
+ */
+export async function resolveMarketplacePlugins(
+  mpName: string,
+  repo: string,
+  localMarketplaces: Map<string, LocalMarketplace>,
+): Promise<MarketplacePlugin[]> {
+  const remote = await fetchMarketplacePlugins(mpName, repo);
+  if (remote.length > 0) return remote;
+
+  const local = localMarketplaces.get(mpName);
+  if (!local || local.plugins.length === 0) return remote;
+
+  return local.plugins.map((p) => ({
+    name: p.name,
+    version: p.version,
+    description: p.description,
+    category: p.category,
+    author: p.author,
+  }));
+}

package/src/services/plugin-manager.js

@@ -4,64 +4,11 @@ import { execSync } from "node:child_process";
 import { getConfiguredMarketplaces, getEnabledPlugins, readSettings, writeSettings, getGlobalConfiguredMarketplaces, getGlobalEnabledPlugins, getGlobalInstalledPluginVersions, getLocalEnabledPlugins, getLocalInstalledPluginVersions, updateInstalledPluginsRegistry, removeFromInstalledPluginsRegistry, } from "./claude-settings.js";
 import { defaultMarketplaces } from "../data/marketplaces.js";
 import { scanLocalMarketplaces, repairAllMarketplaces, } from "./local-marketplace.js";
-import { formatMarketplaceName, isValidGitHubRepo, parsePluginId, } from "../utils/string-utils.js";
+import { formatMarketplaceName, parsePluginId, } from "../utils/string-utils.js";
+import { clearMarketplaceCache as clearFetcherCache, fetchMarketplacePlugins, resolveMarketplacePlugins, } from "./marketplace-fetcher.js";
+export { fetchMarketplacePlugins, resolveMarketplacePlugins, };
 // Cache for local marketplaces (session-level) - Promise-based to prevent race conditions
 let localMarketplacesPromise = null;
-// Session-level cache for fetched marketplace data (no TTL - persists until explicit refresh)
-const marketplaceCache = new Map();
-export async function fetchMarketplacePlugins(marketplaceName, repo) {
-    // Check cache first - session-level, no TTL
-    const cached = marketplaceCache.get(marketplaceName);
-    if (cached) {
-        return cached;
-    }
-    // Validate repo format to prevent SSRF
-    if (!isValidGitHubRepo(repo)) {
-        console.error(`Invalid GitHub repo format: ${repo}`);
-        return [];
-    }
-    try {
-        // Fetch marketplace.json from GitHub
-        const url = `https://raw.githubusercontent.com/${repo}/main/.claude-plugin/marketplace.json`;
-        const response = await fetch(url, {
-            signal: AbortSignal.timeout(10000), // 10s timeout
-        });
-        if (!response.ok) {
-            console.error(`Failed to fetch marketplace: ${response.status}`);
-            return [];
-        }
-        // Validate content-type
-        const contentType = response.headers.get("content-type");
-        if (contentType &&
-            !contentType.includes("application/json") &&
-            !contentType.includes("text/plain")) {
-            console.error(`Invalid content-type for marketplace: ${contentType}`);
-            return [];
-        }
-        const data = (await response.json());
-        const plugins = [];
-        if (data.plugins && Array.isArray(data.plugins)) {
-            for (const plugin of data.plugins) {
-                plugins.push({
-                    name: plugin.name,
-                    version: plugin.version || null,
-                    description: plugin.description || "",
-                    category: plugin.category,
-                    author: plugin.author,
-                    homepage: plugin.homepage,
-                    tags: plugin.tags,
-                });
-            }
-        }
-        // Cache the result (session-level)
-        marketplaceCache.set(marketplaceName, plugins);
-        return plugins;
-    }
-    catch (error) {
-        console.error(`Error fetching marketplace ${marketplaceName}:`, error);
-        return [];
-    }
-}
 export async function getAvailablePlugins(projectPath) {
     const configuredMarketplaces = await getConfiguredMarketplaces(projectPath);
     const enabledPlugins = await getEnabledPlugins(projectPath);
@@ -111,7 +58,7 @@ export async function getAvailablePlugins(projectPath) {
         const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
         if (!marketplace)
             continue;
-        const marketplacePlugins = await fetchMarketplacePlugins(mpName, marketplace.source.repo);
+        const marketplacePlugins = await resolveMarketplacePlugins(mpName, marketplace.source.repo, localMarketplaces);
         // Auto-sync local cache if remote has plugins the local cache doesn't
         localMarketplaces = await autoSyncIfStale(mpName, marketplacePlugins.map((p) => p.name), localMarketplaces);
         for (const plugin of marketplacePlugins) {
@@ -265,7 +212,7 @@ export async function getGlobalAvailablePlugins() {
         const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
         if (!marketplace)
             continue;
-        const marketplacePlugins = await fetchMarketplacePlugins(mpName, marketplace.source.repo);
+        const marketplacePlugins = await resolveMarketplacePlugins(mpName, marketplace.source.repo, localMarketplaces);
         // Auto-sync local cache if remote has plugins the local cache doesn't
         localMarketplaces = await autoSyncIfStale(mpName, marketplacePlugins.map((p) => p.name), localMarketplaces);
         for (const plugin of marketplacePlugins) {
@@ -414,7 +361,7 @@ export async function removeInstalledPluginVersion(pluginId, projectPath) {
 }
 // Clear marketplace cache
 export function clearMarketplaceCache() {
-    marketplaceCache.clear();
+    clearFetcherCache();
     localMarketplacesPromise = null;
 }
 // Get local marketplaces (with Promise-based caching to prevent race conditions)

package/src/services/plugin-manager.ts

@@ -24,9 +24,19 @@ import {
 } from "./local-marketplace.js";
 import {
 	formatMarketplaceName,
-	isValidGitHubRepo,
 	parsePluginId,
 } from "../utils/string-utils.js";
+import {
+	clearMarketplaceCache as clearFetcherCache,
+	fetchMarketplacePlugins,
+	resolveMarketplacePlugins,
+	type MarketplacePlugin,
+} from "./marketplace-fetcher.js";
+export {
+	fetchMarketplacePlugins,
+	resolveMarketplacePlugins,
+	type MarketplacePlugin,
+};
 // Cache for local marketplaces (session-level) - Promise-based to prevent race conditions
 let localMarketplacesPromise: Promise<Map<string, LocalMarketplace>> | null =
 	null;
@@ -63,93 +73,6 @@ export interface PluginInfo {
 	isOrphaned?: boolean;
 }
 
-export interface MarketplacePlugin {
-	name: string;
-	version: string | null;
-	description: string;
-	category?: string;
-	author?: { name: string; email?: string };
-	homepage?: string;
-	tags?: string[];
-}
-
-// Session-level cache for fetched marketplace data (no TTL - persists until explicit refresh)
-const marketplaceCache = new Map<string, MarketplacePlugin[]>();
-
-export async function fetchMarketplacePlugins(
-	marketplaceName: string,
-	repo: string,
-): Promise<MarketplacePlugin[]> {
-	// Check cache first - session-level, no TTL
-	const cached = marketplaceCache.get(marketplaceName);
-	if (cached) {
-		return cached;
-	}
-
-	// Validate repo format to prevent SSRF
-	if (!isValidGitHubRepo(repo)) {
-		console.error(`Invalid GitHub repo format: ${repo}`);
-		return [];
-	}
-
-	try {
-		// Fetch marketplace.json from GitHub
-		const url = `https://raw.githubusercontent.com/${repo}/main/.claude-plugin/marketplace.json`;
-		const response = await fetch(url, {
-			signal: AbortSignal.timeout(10000), // 10s timeout
-		});
-
-		if (!response.ok) {
-			console.error(`Failed to fetch marketplace: ${response.status}`);
-			return [];
-		}
-
-		// Validate content-type
-		const contentType = response.headers.get("content-type");
-		if (
-			contentType &&
-			!contentType.includes("application/json") &&
-			!contentType.includes("text/plain")
-		) {
-			console.error(`Invalid content-type for marketplace: ${contentType}`);
-			return [];
-		}
-
-		interface RawPlugin {
-			name: string;
-			version?: string | null;
-			description?: string;
-			category?: string;
-			author?: { name: string; email?: string };
-			homepage?: string;
-			tags?: string[];
-		}
-		const data = (await response.json()) as { plugins?: RawPlugin[] };
-		const plugins: MarketplacePlugin[] = [];
-
-		if (data.plugins && Array.isArray(data.plugins)) {
-			for (const plugin of data.plugins) {
-				plugins.push({
-					name: plugin.name,
-					version: plugin.version || null,
-					description: plugin.description || "",
-					category: plugin.category,
-					author: plugin.author,
-					homepage: plugin.homepage,
-					tags: plugin.tags,
-				});
-			}
-		}
-
-		// Cache the result (session-level)
-		marketplaceCache.set(marketplaceName, plugins);
-
-		return plugins;
-	} catch (error) {
-		console.error(`Error fetching marketplace ${marketplaceName}:`, error);
-		return [];
-	}
-}
 
 export async function getAvailablePlugins(
 	projectPath?: string,
@@ -213,9 +136,10 @@ export async function getAvailablePlugins(
 		const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
 		if (!marketplace) continue;
 
-		const marketplacePlugins = await fetchMarketplacePlugins(
+		const marketplacePlugins = await resolveMarketplacePlugins(
 			mpName,
 			marketplace.source.repo,
+			localMarketplaces,
 		);
 
 		// Auto-sync local cache if remote has plugins the local cache doesn't
@@ -397,9 +321,10 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 		const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
 		if (!marketplace) continue;
 
-		const marketplacePlugins = await fetchMarketplacePlugins(
+		const marketplacePlugins = await resolveMarketplacePlugins(
 			mpName,
 			marketplace.source.repo,
+			localMarketplaces,
 		);
 
 		// Auto-sync local cache if remote has plugins the local cache doesn't
@@ -592,7 +517,7 @@ export async function removeInstalledPluginVersion(
 
 // Clear marketplace cache
 export function clearMarketplaceCache(): void {
-	marketplaceCache.clear();
+	clearFetcherCache();
 	localMarketplacesPromise = null;
 }
 

package/src/services/plugin-setup.js

@@ -241,6 +241,63 @@ export function extractGoBinaryName(pkg) {
     const withoutVersion = pkg.replace(/@[^/]*$/, "");
     return withoutVersion.split("/").pop() || pkg;
 }
+/**
+ * Extract the pinned version from a Go module path, or null when unpinned.
+ * e.g., "github.com/MadAppGang/tmux-mcp@v1.6.2" → "v1.6.2"
+ *       "github.com/MadAppGang/tmux-mcp@latest" → null (a moving target)
+ *       "github.com/user/tool"                  → null
+ */
+export function extractGoVersion(pkg) {
+    const at = pkg.lastIndexOf("@");
+    if (at === -1)
+        return null;
+    const version = pkg.slice(at + 1);
+    if (version === "" || version === "latest")
+        return null;
+    return version;
+}
+/** Normalize a semver-ish string for comparison: trim and drop a leading "v". */
+function normalizeVersion(v) {
+    return v.trim().replace(/^v/, "");
+}
+/**
+ * Read an installed binary's version via `<binary> --version`, normalized, or
+ * null if it produced no usable version string. Used to tell whether a pinned Go
+ * dependency is already at the right version.
+ */
+async function getInstalledBinaryVersion(binaryName) {
+    const { ok, stdout } = await run(binaryName, ["--version"], 10000);
+    if (!ok || !stdout)
+        return null;
+    const match = stdout.split("\n")[0].match(/v?\d+\.\d+\.\d+[^\s]*/);
+    return match ? normalizeVersion(match[0]) : null;
+}
+/**
+ * Decide whether a Go dependency needs (re)installing. This is what makes a
+ * plugin *update* actually update its binary: without a version check an
+ * already-present binary is skipped forever, so a bumped plugin never pulls the
+ * new binary.
+ *
+ *  - binary absent                                    → yes
+ *  - pinned version, installed reports the same one   → no
+ *  - pinned version, installed reports a different one → yes
+ *  - pinned version, installed version can't be read  → yes (can't confirm the
+ *    pin, so reinstall to be safe)
+ *  - unpinned (@latest) and present                   → no (a moving target
+ *    can't be verified without a network round-trip)
+ */
+export async function goDepNeedsInstall(pkg) {
+    const binaryName = extractGoBinaryName(pkg);
+    if (!(await isBinaryAvailable(binaryName)))
+        return true;
+    const pinned = extractGoVersion(pkg);
+    if (!pinned)
+        return false;
+    const installed = await getInstalledBinaryVersion(binaryName);
+    if (installed === null)
+        return true;
+    return normalizeVersion(pinned) !== installed;
+}
 /**
  * Install Go packages via `go install`
  */
@@ -253,8 +310,7 @@ async function installGoPackages(packages, result) {
         return;
     }
     for (const pkg of packages) {
-        const binaryName = extractGoBinaryName(pkg);
-        if (await isBinaryAvailable(binaryName)) {
+        if (!(await goDepNeedsInstall(pkg))) {
             result.skipped.push(`go:${pkg}`);
             continue;
         }
@@ -422,8 +478,7 @@ export async function checkMissingDeps(setup) {
     if (setup.go?.length) {
         const missingGo = [];
         for (const pkg of setup.go) {
-            const bin = extractGoBinaryName(pkg);
-            if (!(await isBinaryAvailable(bin))) {
+            if (await goDepNeedsInstall(pkg)) {
                 missingGo.push(pkg);
             }
         }

package/src/services/plugin-setup.ts

@@ -295,6 +295,65 @@ export function extractGoBinaryName(pkg: string): string {
 	return withoutVersion.split("/").pop() || pkg;
 }
 
+/**
+ * Extract the pinned version from a Go module path, or null when unpinned.
+ * e.g., "github.com/MadAppGang/tmux-mcp@v1.6.2" → "v1.6.2"
+ *       "github.com/MadAppGang/tmux-mcp@latest" → null (a moving target)
+ *       "github.com/user/tool"                  → null
+ */
+export function extractGoVersion(pkg: string): string | null {
+	const at = pkg.lastIndexOf("@");
+	if (at === -1) return null;
+	const version = pkg.slice(at + 1);
+	if (version === "" || version === "latest") return null;
+	return version;
+}
+
+/** Normalize a semver-ish string for comparison: trim and drop a leading "v". */
+function normalizeVersion(v: string): string {
+	return v.trim().replace(/^v/, "");
+}
+
+/**
+ * Read an installed binary's version via `<binary> --version`, normalized, or
+ * null if it produced no usable version string. Used to tell whether a pinned Go
+ * dependency is already at the right version.
+ */
+async function getInstalledBinaryVersion(
+	binaryName: string,
+): Promise<string | null> {
+	const { ok, stdout } = await run(binaryName, ["--version"], 10000);
+	if (!ok || !stdout) return null;
+	const match = stdout.split("\n")[0].match(/v?\d+\.\d+\.\d+[^\s]*/);
+	return match ? normalizeVersion(match[0]) : null;
+}
+
+/**
+ * Decide whether a Go dependency needs (re)installing. This is what makes a
+ * plugin *update* actually update its binary: without a version check an
+ * already-present binary is skipped forever, so a bumped plugin never pulls the
+ * new binary.
+ *
+ *  - binary absent                                    → yes
+ *  - pinned version, installed reports the same one   → no
+ *  - pinned version, installed reports a different one → yes
+ *  - pinned version, installed version can't be read  → yes (can't confirm the
+ *    pin, so reinstall to be safe)
+ *  - unpinned (@latest) and present                   → no (a moving target
+ *    can't be verified without a network round-trip)
+ */
+export async function goDepNeedsInstall(pkg: string): Promise<boolean> {
+	const binaryName = extractGoBinaryName(pkg);
+	if (!(await isBinaryAvailable(binaryName))) return true;
+
+	const pinned = extractGoVersion(pkg);
+	if (!pinned) return false;
+
+	const installed = await getInstalledBinaryVersion(binaryName);
+	if (installed === null) return true;
+	return normalizeVersion(pinned) !== installed;
+}
+
 /**
  * Install Go packages via `go install`
  */
@@ -311,8 +370,7 @@ async function installGoPackages(
 	}
 
 	for (const pkg of packages) {
-		const binaryName = extractGoBinaryName(pkg);
-		if (await isBinaryAvailable(binaryName)) {
+		if (!(await goDepNeedsInstall(pkg))) {
 			result.skipped.push(`go:${pkg}`);
 			continue;
 		}
@@ -515,8 +573,7 @@ export async function checkMissingDeps(
 	if (setup.go?.length) {
 		const missingGo: string[] = [];
 		for (const pkg of setup.go) {
-			const bin = extractGoBinaryName(pkg);
-			if (!(await isBinaryAvailable(bin))) {
+			if (await goDepNeedsInstall(pkg)) {
 				missingGo.push(pkg);
 			}
 		}