claudeup 4.23.0 → 4.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.23.0",
+  "version": "4.25.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.23.0",
-    "claudeup-darwin-x64": "4.23.0",
-    "claudeup-linux-x64": "4.23.0"
+    "claudeup-darwin-arm64": "4.25.0",
+    "claudeup-darwin-x64": "4.25.0",
+    "claudeup-linux-x64": "4.25.0"
   }
 }

package/src/__tests__/enabled-not-installed.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, test } from "bun:test";
+import { isEnabledButNotInstalled } from "../services/plugin-manager.js";
+import type { PluginInfo } from "../services/plugin-manager.js";
+
+/**
+ * "Enabled but not installed" is a broken state that previously rendered
+ * identically to a healthy install: a green scope square and no version.
+ *
+ * It is also invisible to every update path, because the check is
+ * `installedVersion && compare(latest, installedVersion) > 0` — with no
+ * installed version that is false, so neither the update list nor the
+ * prerunner's auto-update will ever touch it.
+ */
+
+const plugin = (over: Partial<PluginInfo>): PluginInfo =>
+  ({
+    id: "x@magus",
+    name: "x",
+    version: "1.0.0",
+    description: "",
+    marketplace: "magus",
+    marketplaceDisplay: "Magus",
+    enabled: true,
+    ...over,
+  }) as PluginInfo;
+
+describe("isEnabledButNotInstalled", () => {
+  test("enabled in project scope with no installed version is flagged", () => {
+    // The real case: terminal/code-analysis are in this project's enabledPlugins
+    // but have no registry entry for it and none at user scope.
+    expect(
+      isEnabledButNotInstalled(
+        plugin({ projectScope: { enabled: true }, installedVersion: undefined }),
+      ),
+    ).toBe(true);
+  });
+
+  test("a healthy install is not flagged", () => {
+    expect(
+      isEnabledButNotInstalled(
+        plugin({ projectScope: { enabled: true }, installedVersion: "1.0.0" }),
+      ),
+    ).toBe(false);
+  });
+
+  test('installedVersion "0.0.0" means installed-with-unknown-version, not missing', () => {
+    // Anthropic's official plugins record exactly this. Treating it as missing
+    // would mislabel every one of them as broken.
+    expect(
+      isEnabledButNotInstalled(
+        plugin({ userScope: { enabled: true }, installedVersion: "0.0.0" }),
+      ),
+    ).toBe(false);
+  });
+
+  test("not enabled anywhere is not flagged — it is simply available", () => {
+    expect(isEnabledButNotInstalled(plugin({ installedVersion: undefined }))).toBe(false);
+  });
+
+  test("orphaned plugins are excluded — they have their own 'deprecated' state", () => {
+    expect(
+      isEnabledButNotInstalled(
+        plugin({
+          isOrphaned: true,
+          projectScope: { enabled: true },
+          installedVersion: undefined,
+        }),
+      ),
+    ).toBe(false);
+  });
+
+  test("any enabled scope counts, not just project", () => {
+    for (const scope of ["userScope", "projectScope", "localScope"] as const) {
+      expect(
+        isEnabledButNotInstalled(plugin({ [scope]: { enabled: true } })),
+      ).toBe(true);
+    }
+  });
+
+  test("a scope present but disabled does not count as enabled", () => {
+    expect(
+      isEnabledButNotInstalled(
+        plugin({ projectScope: { enabled: false }, installedVersion: undefined }),
+      ),
+    ).toBe(false);
+  });
+});

package/src/__tests__/version-snapshot.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test";
+import { diffVersions } from "../services/version-snapshot.js";
+
+/**
+ * Plugins get updated by things claudeup does not control — Claude Code's own
+ * `plugin update` writes installed_plugins.json without touching claudeup's
+ * bookkeeping. Diffing what we last rendered against reality catches every
+ * source; logging only claudeup's own actions catches none of them.
+ */
+
+describe("diffVersions", () => {
+  test("reports a genuine version transition", () => {
+    expect(
+      diffVersions({ "dev@magus": "2.12.0" }, { "dev@magus": "2.12.1" }),
+    ).toEqual([{ pluginId: "dev@magus", from: "2.12.0", to: "2.12.1" }]);
+  });
+
+  test("first run reports nothing — otherwise every plugin looks updated", () => {
+    expect(diffVersions(null, { "dev@magus": "2.12.1" })).toEqual([]);
+  });
+
+  test("a newly installed plugin is not an update", () => {
+    // Absent from the snapshot means we have never seen it, not that it moved.
+    expect(diffVersions({}, { "dev@magus": "2.12.1" })).toEqual([]);
+  });
+
+  test("unchanged versions report nothing", () => {
+    expect(
+      diffVersions({ "dev@magus": "2.12.1" }, { "dev@magus": "2.12.1" }),
+    ).toEqual([]);
+  });
+
+  test('"0.0.0" transitions are ignored on both sides', () => {
+    // 0.0.0 means installed-with-unknown-version (Anthropic official plugins).
+    // Treating it as a real version produces bogus "0.0.0 → x" badges.
+    expect(
+      diffVersions({ "a@mp": "0.0.0" }, { "a@mp": "1.0.0" }),
+    ).toEqual([]);
+    expect(
+      diffVersions({ "a@mp": "1.0.0" }, { "a@mp": "0.0.0" }),
+    ).toEqual([]);
+  });
+
+  test("a removed plugin is not reported", () => {
+    expect(diffVersions({ "gone@mp": "1.0.0" }, {})).toEqual([]);
+  });
+
+  test("reports every changed plugin, leaving unchanged ones out", () => {
+    const changes = diffVersions(
+      { "a@mp": "1.0.0", "b@mp": "2.0.0", "c@mp": "3.0.0" },
+      { "a@mp": "1.1.0", "b@mp": "2.0.0", "c@mp": "4.0.0" },
+    );
+    expect(changes.map((c) => c.pluginId).sort()).toEqual(["a@mp", "c@mp"]);
+  });
+
+  test("a downgrade is still reported", () => {
+    // Rolling back is a change the user should see, not silently hidden.
+    const changes = diffVersions({ "a@mp": "2.0.0" }, { "a@mp": "1.0.0" });
+    expect(changes).toEqual([{ pluginId: "a@mp", from: "2.0.0", to: "1.0.0" }]);
+  });
+});

package/src/services/plugin-manager.ts

@@ -72,6 +72,36 @@ export interface PluginInfo {
 	mcpServers?: string[];
 	lspServers?: Record<string, unknown>;
 	isOrphaned?: boolean;
+	/**
+	 * Set when this plugin's installed version changed since claudeup last
+	 * rendered it — including updates made by Claude Code or the prerunner
+	 * rather than by claudeup itself. Drives the "updated" badge.
+	 */
+	recentlyUpdatedFrom?: string;
+}
+
+/**
+ * True when a plugin is enabled in some scope but no installed version resolves
+ * anywhere — it is listed in `enabledPlugins` but was never actually installed.
+ *
+ * This is a broken state, not a healthy one: Claude Code will not load the
+ * plugin, and because the update check is `installedVersion && compare(...)`,
+ * it is also invisible to both the update list and the prerunner's auto-update.
+ * It previously rendered identically to a working install.
+ *
+ * `isOrphaned` is a different failure — installed, but no longer offered by any
+ * marketplace — and is rendered as "deprecated" already.
+ *
+ * "0.0.0" means installed-with-unknown-version (Anthropic's official plugins
+ * record exactly that), so it must NOT count as missing.
+ */
+export function isEnabledButNotInstalled(plugin: PluginInfo): boolean {
+	if (plugin.isOrphaned) return false;
+	const enabledSomewhere =
+		!!plugin.userScope?.enabled ||
+		!!plugin.projectScope?.enabled ||
+		!!plugin.localScope?.enabled;
+	return enabledSomewhere && !plugin.installedVersion;
 }
 
 

package/src/services/version-snapshot.ts

@@ -0,0 +1,97 @@
+/**
+ * version-snapshot.ts — detect plugin version changes that happened outside claudeup.
+ *
+ * Plugins get updated by things claudeup does not control: Claude Code's own
+ * `plugin install`/`update`, the `claudeup claude` prerunner, or a direct CLI
+ * call. All of them write `installed_plugins.json`; none of them tell the user
+ * anything the next time claudeup opens, so versions silently move underfoot.
+ *
+ * Rather than log what claudeup itself did — which misses every other source —
+ * this records what claudeup last *saw* installed and diffs against reality on
+ * load. Any change is reported, regardless of who made it.
+ *
+ * The snapshot is advisory UI state, kept separate from the update-check cache
+ * so a TTL expiry or a corrupt cache can never make plugins look updated.
+ */
+
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+
+export interface VersionChange {
+  pluginId: string;
+  from: string;
+  to: string;
+}
+
+interface SnapshotFile {
+  /** pluginId -> installedVersion as of the last time claudeup rendered it. */
+  seen: Record<string, string>;
+  updatedAt: string;
+}
+
+function snapshotPath(): string {
+  return path.join(os.homedir(), ".claude", "claudeup-version-snapshot.json");
+}
+
+async function read(): Promise<SnapshotFile | null> {
+  try {
+    const raw = await fs.readFile(snapshotPath(), "utf-8");
+    const data = JSON.parse(raw) as SnapshotFile;
+    if (!data || typeof data.seen !== "object" || data.seen === null) return null;
+    return data;
+  } catch {
+    return null; // absent or corrupt — treated as "first run"
+  }
+}
+
+/**
+ * Diff the versions currently installed against the previous snapshot.
+ *
+ * Returns only genuine transitions. Deliberately excluded:
+ *  - first run (no snapshot): everything would look "updated"
+ *  - a plugin absent from the snapshot: newly installed, not updated
+ *  - unchanged versions
+ *  - "0.0.0", which means installed-with-unknown-version rather than a real one
+ */
+export function diffVersions(
+  previous: Record<string, string> | null,
+  current: Record<string, string>,
+): VersionChange[] {
+  if (!previous) return [];
+  const changes: VersionChange[] = [];
+  for (const [pluginId, to] of Object.entries(current)) {
+    const from = previous[pluginId];
+    if (!from || from === to) continue;
+    if (from === "0.0.0" || to === "0.0.0") continue;
+    changes.push({ pluginId, from, to });
+  }
+  return changes;
+}
+
+/** Load the previous snapshot's version map, or null on first run. */
+export async function loadSeenVersions(): Promise<Record<string, string> | null> {
+  const data = await read();
+  return data ? data.seen : null;
+}
+
+/**
+ * Persist what is installed now, so the same change is not reported twice.
+ * Best-effort: a failure here must never break the UI, it only means the badge
+ * shows again next launch.
+ */
+export async function saveSeenVersions(
+  current: Record<string, string>,
+): Promise<void> {
+  try {
+    const file = snapshotPath();
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    const payload: SnapshotFile = {
+      seen: current,
+      updatedAt: new Date().toISOString(),
+    };
+    await fs.writeFile(file, JSON.stringify(payload, null, 2), "utf-8");
+  } catch {
+    // ignore
+  }
+}

package/src/ui/renderers/pluginRenderers.tsx

@@ -15,6 +15,7 @@ import {
 } from "../components/primitives/index.js";
 import { theme } from "../theme.js";
 import { highlightMatches } from "../../utils/fuzzy-search.js";
+import { isEnabledButNotInstalled } from "../../services/plugin-manager.js";
 
 // ─── Category renderers ───────────────────────────────────────────────────────
 
@@ -113,14 +114,26 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
   const hasLocal = !!plugin.localScope?.enabled;
   const hasAnyScope = hasUser || hasProject || hasLocal;
 
+  // Enabled somewhere but nothing actually installed — a broken state that used
+  // to render exactly like a healthy install.
+  const notInstalled = isEnabledButNotInstalled(plugin);
+
   // Build version string — only show if plugin is installed in at least one scope
   let versionStr = "";
   if (plugin.isOrphaned) {
     versionStr = " deprecated";
+  } else if (notInstalled) {
+    versionStr = " not installed";
   } else if (hasAnyScope && plugin.installedVersion && plugin.installedVersion !== "0.0.0") {
-    versionStr = ` v${plugin.installedVersion}`;
-    if (plugin.hasUpdate && plugin.version) {
-      versionStr += ` → v${plugin.version}`;
+    if (plugin.recentlyUpdatedFrom) {
+      // Show what actually happened, not just where it landed — the update may
+      // have come from Claude Code or the prerunner without ever telling us.
+      versionStr = ` v${plugin.recentlyUpdatedFrom} → v${plugin.installedVersion} updated`;
+    } else {
+      versionStr = ` v${plugin.installedVersion}`;
+      if (plugin.hasUpdate && plugin.version) {
+        versionStr += ` → v${plugin.version}`;
+      }
     }
   }
 
@@ -158,8 +171,19 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
       <span> </span>
       <ScopeSquares user={hasUser} project={hasProject} local={hasLocal} />
       <span> </span>
-      <span fg={hasAnyScope ? theme.colors.text : theme.colors.muted}>{displayName}</span>
-      <MetaText text={versionStr} tone={plugin.hasUpdate ? "warning" : "muted"} />
+      <span fg={hasAnyScope && !notInstalled ? theme.colors.text : theme.colors.muted}>
+        {displayName}
+      </span>
+      <MetaText
+        text={versionStr}
+        tone={
+          plugin.recentlyUpdatedFrom
+            ? "success"
+            : notInstalled || plugin.hasUpdate
+              ? "warning"
+              : "muted"
+        }
+      />
     </text>
   );
 }

package/src/ui/screens/PluginsScreen.tsx

@@ -7,6 +7,11 @@ import { ScrollableList } from "../components/ScrollableList.js";
 import { EmptyFilterState } from "../components/EmptyFilterState.js";
 import { fuzzyFilter } from "../../utils/fuzzy-search.js";
 import { getAllMarketplaces } from "../../data/marketplaces.js";
+import {
+	diffVersions,
+	loadSeenVersions,
+	saveSeenVersions,
+} from "../../services/version-snapshot.js";
 import {
 	getAvailablePlugins,
 	refreshAllMarketplaces,
@@ -73,6 +78,23 @@ export function PluginsScreen() {
 			const localMarketplaces = await getLocalMarketplacesInfo();
 			const allMarketplaces = getAllMarketplaces(localMarketplaces);
 			const pluginData = await getAvailablePlugins(state.projectPath);
+
+			// Surface version changes made outside claudeup (Claude Code's own
+			// plugin update, the prerunner, a manual CLI call). Diffing against
+			// what we last rendered catches all of them; logging only what
+			// claudeup did would miss every one.
+			const current: Record<string, string> = {};
+			for (const p of pluginData) {
+				if (p.installedVersion) current[p.id] = p.installedVersion;
+			}
+			const previous = await loadSeenVersions();
+			for (const change of diffVersions(previous, current)) {
+				const target = pluginData.find((p) => p.id === change.pluginId);
+				if (target) target.recentlyUpdatedFrom = change.from;
+			}
+			// Record now so the same change is not reported on the next launch.
+			void saveSeenVersions(current);
+
 			dispatch({
 				type: "PLUGINS_DATA_SUCCESS",
 				marketplaces: allMarketplaces,