claudeup 4.18.0 → 4.22.0

package/src/services/claude-cli.ts

@@ -11,6 +11,7 @@
 
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { defaultMarketplaces } from "../data/marketplaces.js";
 import { which } from "../utils/command-utils.js";
 import {
 	isMarketplaceRegistered,
@@ -18,7 +19,6 @@ import {
 	removeLocalInstalledPluginVersion,
 } from "./claude-settings.js";
 import { removeInstalledPluginVersion } from "./plugin-manager.js";
-import { defaultMarketplaces } from "../data/marketplaces.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -84,13 +84,21 @@ async function recoverMissingMarketplace(
 	marketplace: string,
 ): Promise<boolean> {
 	if (await isMarketplaceRegistered(marketplace)) {
-		// Registered but stale — existing recovery path.
-		const { recoverMarketplaceSettings } = await import(
-			"./claude-settings.js"
-		);
+		// Registered but the plugin wasn't found → the registry may use a stale or
+		// "directory" source. Fix the registry, then refresh the clone
+		// NON-DESTRUCTIVELY (git pull --ff-only) — never `marketplace update`, which
+		// deletes the directory before re-cloning and can leave it permanently gone
+		// on failure (see marketplace-refresh.ts). If the clone is absent, fall
+		// through to the safe `marketplace add` below to create it.
+		const { recoverMarketplaceSettings } = await import("./claude-settings.js");
 		await recoverMarketplaceSettings();
-		await updateMarketplace(marketplace);
-		return true;
+		const { fastForwardCloneIfPresent } = await import(
+			"./marketplace-refresh.js"
+		);
+		if ((await fastForwardCloneIfPresent(marketplace)) !== "absent") {
+			return true;
+		}
+		// Clone missing → fall through to `marketplace add`.
 	}
 
 	const defaultMp = defaultMarketplaces.find((m) => m.name === marketplace);
@@ -115,18 +123,11 @@ export async function installPlugin(
 	try {
 		await execClaude(["plugin", "install", pluginId, "--scope", scope]);
 	} catch (error) {
-		const msg =
-			error instanceof Error ? error.message : String(error);
+		const msg = error instanceof Error ? error.message : String(error);
 		if (msg.includes("not found in marketplace")) {
 			const marketplace = pluginId.split("@")[1];
 			if (marketplace && (await recoverMissingMarketplace(marketplace))) {
-				await execClaude([
-					"plugin",
-					"install",
-					pluginId,
-					"--scope",
-					scope,
-				]);
+				await execClaude(["plugin", "install", pluginId, "--scope", scope]);
 				return;
 			}
 		}
@@ -193,13 +194,9 @@ export async function updatePlugin(
 	scope: PluginScope = "user",
 ): Promise<void> {
 	try {
-		await execClaude(
-			["plugin", "install", pluginId, "--scope", scope],
-			60000,
-		);
+		await execClaude(["plugin", "install", pluginId, "--scope", scope], 60000);
 	} catch (error) {
-		const msg =
-			error instanceof Error ? error.message : String(error);
+		const msg = error instanceof Error ? error.message : String(error);
 		if (msg.includes("not found in marketplace")) {
 			const marketplace = pluginId.split("@")[1];
 			if (marketplace && (await recoverMissingMarketplace(marketplace))) {

package/src/services/claude-settings.ts

@@ -248,11 +248,85 @@ export async function getLocalEnabledPlugins(
 	return settings.enabledPlugins || {};
 }
 
+/**
+ * Overlay the installed_plugins.json registry onto a settings-derived version map.
+ *
+ * `settings.installedPluginVersions` is claudeup's own bookkeeping and is routinely
+ * incomplete: Claude Code's own `plugin install` writes the registry but not our
+ * settings key, so a plugin can be genuinely installed and still be absent here.
+ * Callers that only read settings then see `undefined` and — because the update
+ * check is `installedVersion && compare(...)` — silently treat the plugin as
+ * up to date instead of unknown. That hides real updates.
+ *
+ * The registry is what Claude Code actually loaded, so it wins on conflict.
+ *
+ * Scope resolution mirrors Claude Code: for a project scope, prefer an entry
+ * pinned to that exact projectPath (project or local), then fall back to the
+ * user-scope entry, which is what a project without its own install resolves to.
+ */
+export function pickRegistryEntry(
+	entries: InstalledPluginEntry[] | undefined,
+	scope: "user" | "project" | "local",
+	projectPath?: string,
+): InstalledPluginEntry | undefined {
+	if (!Array.isArray(entries) || entries.length === 0) return undefined;
+
+	if (scope === "user") return entries.find((e) => e.scope === "user");
+
+	const target = projectPath ? path.resolve(projectPath) : undefined;
+	if (target) {
+		const pinned = entries.find(
+			(e) =>
+				(e.scope === scope || e.scope === "local") &&
+				e.projectPath !== undefined &&
+				path.resolve(e.projectPath) === target,
+		);
+		if (pinned) return pinned;
+	}
+	// A project with no install of its own resolves to the user-scope entry.
+	return entries.find((e) => e.scope === "user");
+}
+
+async function overlayRegistryVersions(
+	base: Record<string, string>,
+	scope: "user" | "project" | "local",
+	projectPath?: string,
+): Promise<Record<string, string>> {
+	let registry: InstalledPluginsRegistry;
+	try {
+		registry = await readInstalledPluginsRegistry();
+	} catch {
+		return base; // registry unreadable — settings-only is still better than nothing
+	}
+
+	const merged = { ...base };
+	for (const [pluginId, entries] of Object.entries(registry.plugins ?? {})) {
+		const pick = pickRegistryEntry(entries, scope, projectPath);
+		if (pick?.version) merged[pluginId] = pick.version;
+	}
+	return merged;
+}
+
 export async function getLocalInstalledPluginVersions(
 	projectPath?: string,
 ): Promise<Record<string, string>> {
 	const settings = await readLocalSettings(projectPath);
-	return settings.installedPluginVersions || {};
+	return overlayRegistryVersions(
+		settings.installedPluginVersions || {},
+		"local",
+		projectPath,
+	);
+}
+
+/**
+ * Overlay the registry onto a project-scope settings map.
+ * Exported for plugin-manager, which reads project settings itself.
+ */
+export async function getProjectInstalledPluginVersions(
+	base: Record<string, string>,
+	projectPath?: string,
+): Promise<Record<string, string>> {
+	return overlayRegistryVersions(base, "project", projectPath);
 }
 
 // Local plugin management (writes to settings.local.json)
@@ -529,7 +603,10 @@ export async function getGlobalInstalledPluginVersions(): Promise<
 	Record<string, string>
 > {
 	const settings = await readGlobalSettings();
-	return settings.installedPluginVersions || {};
+	return overlayRegistryVersions(
+		settings.installedPluginVersions || {},
+		"user",
+	);
 }
 
 export async function saveGlobalInstalledPluginVersion(
@@ -744,20 +821,16 @@ export async function discoverAllGlobalMarketplaces(): Promise<
 	}
 }
 
-// installed_plugins.json registry management
-const INSTALLED_PLUGINS_FILE = path.join(
-	os.homedir(),
-	".claude",
-	"plugins",
-	"installed_plugins.json",
-);
+// installed_plugins.json registry management.
+// Resolved lazily (per-call) rather than cached at module load: caching
+// os.homedir() in a module-level constant makes the path capture whatever
+// HOME was set to when this module was first imported, which is fragile
+// (import-order-dependent) and breaks any caller that changes HOME afterward.
+const installedPluginsFile = (): string =>
+	path.join(os.homedir(), ".claude", "plugins", "installed_plugins.json");
 
-const KNOWN_MARKETPLACES_FILE = path.join(
-	os.homedir(),
-	".claude",
-	"plugins",
-	"known_marketplaces.json",
-);
+const knownMarketplacesFile = (): string =>
+	path.join(os.homedir(), ".claude", "plugins", "known_marketplaces.json");
 
 interface KnownMarketplaceEntry {
 	source: { source: string; path?: string; repo?: string };
@@ -774,8 +847,8 @@ type KnownMarketplaces = Record<string, KnownMarketplaceEntry>;
 async function writeKnownMarketplaces(
 	marketplaces: KnownMarketplaces,
 ): Promise<void> {
-	await fs.ensureDir(path.dirname(KNOWN_MARKETPLACES_FILE));
-	await fs.writeJson(KNOWN_MARKETPLACES_FILE, marketplaces, { spaces: 2 });
+	await fs.ensureDir(path.dirname(knownMarketplacesFile()));
+	await fs.writeJson(knownMarketplacesFile(), marketplaces, { spaces: 2 });
 }
 
 /**
@@ -1316,8 +1389,8 @@ export async function cleanupExtraKnownMarketplaces(
  */
 async function readKnownMarketplaces(): Promise<KnownMarketplaces> {
 	try {
-		if (await fs.pathExists(KNOWN_MARKETPLACES_FILE)) {
-			return await fs.readJson(KNOWN_MARKETPLACES_FILE);
+		if (await fs.pathExists(knownMarketplacesFile())) {
+			return await fs.readJson(knownMarketplacesFile());
 		}
 	} catch {
 		// Return empty if can't read
@@ -1434,8 +1507,8 @@ async function copyPluginToCache(
  */
 export async function readInstalledPluginsRegistry(): Promise<InstalledPluginsRegistry> {
 	try {
-		if (await fs.pathExists(INSTALLED_PLUGINS_FILE)) {
-			const content = await fs.readJson(INSTALLED_PLUGINS_FILE);
+		if (await fs.pathExists(installedPluginsFile())) {
+			const content = await fs.readJson(installedPluginsFile());
 			// Validate structure
 			if (!content.version || !content.plugins) {
 				throw new Error("Invalid registry structure");
@@ -1444,10 +1517,10 @@ export async function readInstalledPluginsRegistry(): Promise<InstalledPluginsRe
 		}
 	} catch (error) {
 		// Backup corrupted file
-		if (await fs.pathExists(INSTALLED_PLUGINS_FILE)) {
+		if (await fs.pathExists(installedPluginsFile())) {
 			try {
-				const backup = `${INSTALLED_PLUGINS_FILE}.backup.${Date.now()}`;
-				await fs.copy(INSTALLED_PLUGINS_FILE, backup);
+				const backup = `${installedPluginsFile()}.backup.${Date.now()}`;
+				await fs.copy(installedPluginsFile(), backup);
 				console.warn(`Corrupted registry backed up to: ${backup}`);
 			} catch {
 				// Ignore backup errors
@@ -1463,8 +1536,8 @@ export async function readInstalledPluginsRegistry(): Promise<InstalledPluginsRe
 export async function writeInstalledPluginsRegistry(
 	registry: InstalledPluginsRegistry,
 ): Promise<void> {
-	await fs.ensureDir(path.dirname(INSTALLED_PLUGINS_FILE));
-	await fs.writeJson(INSTALLED_PLUGINS_FILE, registry, { spaces: 2 });
+	await fs.ensureDir(path.dirname(installedPluginsFile()));
+	await fs.writeJson(installedPluginsFile(), registry, { spaces: 2 });
 }
 
 /**