claudeup 4.26.0 → 4.27.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.26.0",
+  "version": "4.27.1",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.26.0",
-    "claudeup-darwin-x64": "4.26.0",
-    "claudeup-linux-x64": "4.26.0"
+    "claudeup-darwin-arm64": "4.27.1",
+    "claudeup-darwin-x64": "4.27.1",
+    "claudeup-linux-x64": "4.27.1"
   }
 }

package/src/__tests__/version-check-refresh.test.ts

@@ -0,0 +1,45 @@
+/**
+ * Guards the update-check refresh fix. checkForUpdates caches within a session
+ * (so we don't hammer the registry), but `force` bypasses that cache so a
+ * release landing mid-session is actually seen — the 4.25-vs-4.26 banner
+ * staleness. (The fetch itself also sets `cache: "no-store"` so a CDN-stale
+ * response can't mask a fresh release.)
+ */
+import { afterEach, describe, expect, it } from "bun:test";
+import { checkForUpdates } from "../services/version-check.js";
+
+describe("checkForUpdates — session cache vs forced re-check", () => {
+	const realFetch = globalThis.fetch;
+	afterEach(() => {
+		globalThis.fetch = realFetch;
+	});
+
+	it("serves the session cache by default and re-fetches only when forced", async () => {
+		let calls = 0;
+		let latest = "9.9.9";
+		globalThis.fetch = (async () => {
+			calls++;
+			return new Response(JSON.stringify({ version: latest }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}) as typeof fetch;
+
+		// Force the first call so the test is independent of any cache another
+		// test in the same process may have primed.
+		const first = await checkForUpdates(true);
+		expect(calls).toBe(1);
+		expect(first.latestVersion).toBe("9.9.9");
+
+		// Default call is served from the session cache — no new fetch.
+		const cached = await checkForUpdates();
+		expect(calls).toBe(1);
+		expect(cached.latestVersion).toBe("9.9.9");
+
+		// A release lands; a forced re-check bypasses the cache and sees it.
+		latest = "9.9.10";
+		const forced = await checkForUpdates(true);
+		expect(calls).toBe(2);
+		expect(forced.latestVersion).toBe("9.9.10");
+	});
+});

package/src/__tests__/version-snapshot.test.ts

@@ -1,5 +1,9 @@
 import { describe, expect, test } from "bun:test";
-import { diffVersions } from "../services/version-snapshot.js";
+import {
+  diffVersions,
+  isKnownVersion,
+  UNKNOWN_VERSION,
+} from "../services/version-snapshot.js";
 
 /**
  * Plugins get updated by things claudeup does not control — Claude Code's own
@@ -8,20 +12,60 @@ import { diffVersions } from "../services/version-snapshot.js";
  * source; logging only claudeup's own actions catches none of them.
  */
 
-describe("diffVersions", () => {
-  test("reports a genuine version transition", () => {
+describe("isKnownVersion", () => {
+  test('"0.0.0" is not a usable version', () => {
+    // Claude Code records this for a plugin whose version it cannot determine.
+    expect(isKnownVersion(UNKNOWN_VERSION)).toBe(false);
+    expect(isKnownVersion(undefined)).toBe(false);
+    expect(isKnownVersion("")).toBe(false);
+    expect(isKnownVersion("1.0.0")).toBe(true);
+  });
+});
+
+describe("diffVersions — first run", () => {
+  test("no baseline reports nothing at all", () => {
+    // Without this, the first launch would flag every installed plugin as new,
+    // which is both wrong and the fastest way to train someone to ignore badges.
     expect(
-      diffVersions({ "dev@magus": "2.12.0" }, { "dev@magus": "2.12.1" }),
-    ).toEqual([{ pluginId: "dev@magus", from: "2.12.0", to: "2.12.1" }]);
+      diffVersions(null, { "dev@magus": "2.12.1", "a@mp": UNKNOWN_VERSION }),
+    ).toEqual([]);
   });
 
-  test("first run reports nothing — otherwise every plugin looks updated", () => {
-    expect(diffVersions(null, { "dev@magus": "2.12.1" })).toEqual([]);
+  test("an empty baseline is NOT the same as no baseline", () => {
+    // A real snapshot that happens to be empty means we have looked before and
+    // saw nothing, so anything present now is genuinely new.
+    const changes = diffVersions({}, { "dev@magus": "2.12.1" });
+    expect(changes).toEqual([
+      { pluginId: "dev@magus", kind: "installed", to: "2.12.1" },
+    ]);
   });
+});
 
-  test("a newly installed plugin is not an update", () => {
-    // Absent from the snapshot means we have never seen it, not that it moved.
-    expect(diffVersions({}, { "dev@magus": "2.12.1" })).toEqual([]);
+describe("diffVersions — installs", () => {
+  test("a plugin absent from the baseline is reported as installed, not updated", () => {
+    const changes = diffVersions({ "other@mp": "1.0.0" }, { "new@mp": "3.1.0" });
+    expect(changes).toEqual([
+      { pluginId: "new@mp", kind: "installed", to: "3.1.0" },
+    ]);
+  });
+
+  test("an install with an unknown version is still reported", () => {
+    // The version is unusable but the install is real — the UI shows "new"
+    // with no version rather than suppressing the plugin entirely.
+    const changes = diffVersions({}, { "a@mp": UNKNOWN_VERSION });
+    expect(changes).toEqual([
+      { pluginId: "a@mp", kind: "installed", to: UNKNOWN_VERSION },
+    ]);
+  });
+});
+
+describe("diffVersions — updates", () => {
+  test("reports a genuine version transition", () => {
+    expect(
+      diffVersions({ "dev@magus": "2.12.0" }, { "dev@magus": "2.12.1" }),
+    ).toEqual([
+      { pluginId: "dev@magus", kind: "updated", from: "2.12.0", to: "2.12.1" },
+    ]);
   });
 
   test("unchanged versions report nothing", () => {
@@ -30,32 +74,38 @@ describe("diffVersions", () => {
     ).toEqual([]);
   });
 
-  test('"0.0.0" transitions are ignored on both sides', () => {
-    // 0.0.0 means installed-with-unknown-version (Anthropic official plugins).
-    // Treating it as a real version produces bogus "0.0.0 → x" badges.
-    expect(
-      diffVersions({ "a@mp": "0.0.0" }, { "a@mp": "1.0.0" }),
-    ).toEqual([]);
-    expect(
-      diffVersions({ "a@mp": "1.0.0" }, { "a@mp": "0.0.0" }),
-    ).toEqual([]);
+  test("learning a previously unknown version is not an update", () => {
+    // This is exactly what v4.22.0's registry overlay caused: versions that
+    // could not be resolved suddenly could be. Reporting it would announce
+    // claudeup's own bugfix as if the user's plugins had changed.
+    expect(diffVersions({ "a@mp": UNKNOWN_VERSION }, { "a@mp": "5.3.0" })).toEqual([]);
   });
 
+  test("losing a known version is not an update either", () => {
+    expect(diffVersions({ "a@mp": "5.3.0" }, { "a@mp": UNKNOWN_VERSION })).toEqual([]);
+  });
+
+  test("a downgrade IS reported", () => {
+    // Rolling back is a real change, arguably the most important to surface.
+    expect(diffVersions({ "a@mp": "2.0.0" }, { "a@mp": "1.0.0" })).toEqual([
+      { pluginId: "a@mp", kind: "updated", from: "2.0.0", to: "1.0.0" },
+    ]);
+  });
+});
+
+describe("diffVersions — removals and mixed sets", () => {
   test("a removed plugin is not reported", () => {
     expect(diffVersions({ "gone@mp": "1.0.0" }, {})).toEqual([]);
   });
 
-  test("reports every changed plugin, leaving unchanged ones out", () => {
+  test("classifies each plugin independently in one pass", () => {
     const changes = diffVersions(
-      { "a@mp": "1.0.0", "b@mp": "2.0.0", "c@mp": "3.0.0" },
-      { "a@mp": "1.1.0", "b@mp": "2.0.0", "c@mp": "4.0.0" },
+      { same: "1.0.0", moved: "2.0.0", learned: UNKNOWN_VERSION },
+      { same: "1.0.0", moved: "2.1.0", learned: "9.0.0", fresh: "0.1.0" },
     );
-    expect(changes.map((c) => c.pluginId).sort()).toEqual(["a@mp", "c@mp"]);
-  });
-
-  test("a downgrade is still reported", () => {
-    // Rolling back is a change the user should see, not silently hidden.
-    const changes = diffVersions({ "a@mp": "2.0.0" }, { "a@mp": "1.0.0" });
-    expect(changes).toEqual([{ pluginId: "a@mp", from: "2.0.0", to: "1.0.0" }]);
+    expect(changes).toEqual([
+      { pluginId: "moved", kind: "updated", from: "2.0.0", to: "2.1.0" },
+      { pluginId: "fresh", kind: "installed", to: "0.1.0" },
+    ]);
   });
 });

package/src/services/plugin-manager.ts

@@ -78,6 +78,11 @@ export interface PluginInfo {
 	 * rather than by claudeup itself. Drives the "updated" badge.
 	 */
 	recentlyUpdatedFrom?: string;
+	/**
+	 * Set when claudeup is seeing this plugin installed for the first time.
+	 * Never set on the very first run, when there is no baseline to compare to.
+	 */
+	recentlyInstalled?: boolean;
 }
 
 /**

package/src/services/version-check.ts

@@ -33,6 +33,9 @@ async function fetchLatestVersion(): Promise<string | null> {
 			signal: controller.signal,
 			headers: {
 				Accept: "application/json",
+				// Always revalidate — a CDN/HTTP-cached response serves a stale
+				// "latest" right after a release (the 4.25-vs-4.26 flicker).
+				"Cache-Control": "no-cache",
 			},
 		});
 
@@ -70,12 +73,15 @@ function getUpdateType(
 }
 
 /**
- * Check if a new version is available
- * Returns cached result if already checked this session
+ * Check if a new version is available.
+ * Returns the session-cached result unless `force` requests a fresh check.
  */
-export async function checkForUpdates(): Promise<VersionCheckResult> {
-	// Return cached result if available
-	if (cachedResult) {
+export async function checkForUpdates(
+	force = false,
+): Promise<VersionCheckResult> {
+	// Return the session-cached result unless a fresh check is forced — a periodic
+	// re-check passes force:true so a release landing mid-session updates the banner.
+	if (!force && cachedResult) {
 		return cachedResult;
 	}
 

package/src/services/version-snapshot.ts

@@ -1,32 +1,51 @@
 /**
- * version-snapshot.ts — detect plugin version changes that happened outside claudeup.
+ * version-snapshot.ts — detect plugin changes that happened outside claudeup.
  *
  * Plugins get updated by things claudeup does not control: Claude Code's own
  * `plugin install`/`update`, the `claudeup claude` prerunner, or a direct CLI
  * call. All of them write `installed_plugins.json`; none of them tell the user
- * anything the next time claudeup opens, so versions silently move underfoot.
+ * anything the next time claudeup opens, so versions move underfoot silently.
  *
  * Rather than log what claudeup itself did — which misses every other source —
  * this records what claudeup last *saw* installed and diffs against reality on
  * load. Any change is reported, regardless of who made it.
  *
  * The snapshot is advisory UI state, kept separate from the update-check cache
- * so a TTL expiry or a corrupt cache can never make plugins look updated.
+ * so a TTL expiry or a corrupt cache can never make plugins look changed.
  */
 
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import os from "node:os";
 
-export interface VersionChange {
+/**
+ * Sentinel recorded by Claude Code for a plugin that is installed but whose
+ * version is unknown — every plugin in the official Anthropic marketplace uses
+ * it. It is not a real version and must never be rendered as one.
+ */
+export const UNKNOWN_VERSION = "0.0.0";
+
+/** True when a version string carries no usable information. */
+export function isKnownVersion(v: string | undefined): v is string {
+  return !!v && v !== UNKNOWN_VERSION;
+}
+
+export type PluginChangeKind = "installed" | "updated";
+
+export interface PluginChange {
   pluginId: string;
-  from: string;
+  kind: PluginChangeKind;
+  /** Previous version. Only set for "updated", and always a known version. */
+  from?: string;
+  /** Current version. May be UNKNOWN_VERSION — callers must not render it raw. */
   to: string;
 }
 
 interface SnapshotFile {
   /** pluginId -> installedVersion as of the last time claudeup rendered it. */
   seen: Record<string, string>;
+  /** Set on the run that first created the baseline. */
+  seededAt: string;
   updatedAt: string;
 }
 
@@ -41,35 +60,56 @@ async function read(): Promise<SnapshotFile | null> {
     if (!data || typeof data.seen !== "object" || data.seen === null) return null;
     return data;
   } catch {
-    return null; // absent or corrupt — treated as "first run"
+    return null; // absent or corrupt — treated as "no baseline yet"
   }
 }
 
 /**
- * Diff the versions currently installed against the previous snapshot.
+ * Diff what is installed now against the previous snapshot.
+ *
+ * Three cases are deliberately silent, because each reflects claudeup's own
+ * knowledge changing rather than anything happening to the user's plugins:
+ *
+ *  1. No baseline (first run). Every plugin would otherwise be reported as
+ *     newly installed on the very first launch — a guaranteed false flood that
+ *     trains the user to ignore the badge. The first run seeds and says nothing.
  *
- * Returns only genuine transitions. Deliberately excluded:
- *  - first run (no snapshot): everything would look "updated"
- *  - a plugin absent from the snapshot: newly installed, not updated
- *  - unchanged versions
- *  - "0.0.0", which means installed-with-unknown-version rather than a real one
+ *  2. A version moving to or from UNKNOWN_VERSION. That is claudeup learning
+ *     (or losing) a version it could not previously resolve — notably after
+ *     v4.22.0 taught it to read the registry — not the plugin changing.
+ *
+ *  3. A plugin disappearing. Uninstalls are visible elsewhere; nothing to badge.
+ *
+ * A downgrade IS reported: rolling back is a real change worth surfacing.
  */
 export function diffVersions(
   previous: Record<string, string> | null,
   current: Record<string, string>,
-): VersionChange[] {
+): PluginChange[] {
   if (!previous) return [];
-  const changes: VersionChange[] = [];
+
+  const changes: PluginChange[] = [];
   for (const [pluginId, to] of Object.entries(current)) {
     const from = previous[pluginId];
-    if (!from || from === to) continue;
-    if (from === "0.0.0" || to === "0.0.0") continue;
-    changes.push({ pluginId, from, to });
+
+    // Never seen before → newly installed, not an update. There is no
+    // meaningful "from", and `to` may legitimately be UNKNOWN_VERSION.
+    if (from === undefined) {
+      changes.push({ pluginId, kind: "installed", to });
+      continue;
+    }
+
+    if (from === to) continue;
+
+    // One side carries no real version: we learned or lost it, nothing moved.
+    if (!isKnownVersion(from) || !isKnownVersion(to)) continue;
+
+    changes.push({ pluginId, kind: "updated", from, to });
   }
   return changes;
 }
 
-/** Load the previous snapshot's version map, or null on first run. */
+/** Load the previous snapshot's version map, or null when no baseline exists. */
 export async function loadSeenVersions(): Promise<Record<string, string> | null> {
   const data = await read();
   return data ? data.seen : null;
@@ -77,7 +117,7 @@ export async function loadSeenVersions(): Promise<Record<string, string> | null>
 
 /**
  * Persist what is installed now, so the same change is not reported twice.
- * Best-effort: a failure here must never break the UI, it only means the badge
+ * Best-effort: a failure here must never break the UI — it only means the badge
  * shows again next launch.
  */
 export async function saveSeenVersions(
@@ -86,9 +126,12 @@ export async function saveSeenVersions(
   try {
     const file = snapshotPath();
     await fs.mkdir(path.dirname(file), { recursive: true });
+    const existing = await read();
+    const now = new Date().toISOString();
     const payload: SnapshotFile = {
       seen: current,
-      updatedAt: new Date().toISOString(),
+      seededAt: existing?.seededAt ?? now,
+      updatedAt: now,
     };
     await fs.writeFile(file, JSON.stringify(payload, null, 2), "utf-8");
   } catch {

package/src/ui/App.tsx

@@ -348,11 +348,22 @@ function AppContent({ onExit }: AppContentProps) {
 	} | null>(null);
 	const gitignoreModal = useGitignoreModal();
 
-	// Check for updates on startup (non-blocking)
+	// Check for updates on startup, then re-check periodically (force-bypassing
+	// the session cache) so the banner reflects a release that lands while
+	// claudeup is left open — otherwise it shows the stale startup value.
 	useEffect(() => {
 		checkForUpdates()
 			.then(setUpdateInfo)
 			.catch(() => {});
+		const id = setInterval(
+			() => {
+				checkForUpdates(true)
+					.then(setUpdateInfo)
+					.catch(() => {});
+			},
+			15 * 60 * 1000, // 15 min
+		);
+		return () => clearInterval(id);
 	}, []);
 
 	// Auto-dismiss recovery banner after 5 seconds

package/src/ui/renderers/pluginRenderers.tsx

@@ -17,6 +17,7 @@ import { theme } from "../theme.js";
 import { highlightMatches } from "../../utils/fuzzy-search.js";
 import { getMarketplaceVersion } from "../../services/marketplace-fetcher.js";
 import { isEnabledButNotInstalled } from "../../services/plugin-manager.js";
+import { isKnownVersion } from "../../services/version-snapshot.js";
 
 // ─── Category renderers ───────────────────────────────────────────────────────
 
@@ -125,19 +126,28 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
   // to render exactly like a healthy install.
   const notInstalled = isEnabledButNotInstalled(plugin);
 
-  // Build version string — only show if plugin is installed in at least one scope
+  // A known version is one we can actually show. "0.0.0" means installed with an
+  // unknown version (every official Anthropic plugin records it) — never render it.
+  const shownVersion = isKnownVersion(plugin.installedVersion)
+    ? plugin.installedVersion
+    : undefined;
+
   let versionStr = "";
   if (plugin.isOrphaned) {
     versionStr = " deprecated";
   } else if (notInstalled) {
     versionStr = " not installed";
-  } else if (hasAnyScope && plugin.installedVersion && plugin.installedVersion !== "0.0.0") {
-    if (plugin.recentlyUpdatedFrom) {
+  } else if (hasAnyScope) {
+    if (plugin.recentlyUpdatedFrom && shownVersion) {
       // Show what actually happened, not just where it landed — the update may
       // have come from Claude Code or the prerunner without ever telling us.
-      versionStr = ` v${plugin.recentlyUpdatedFrom} → v${plugin.installedVersion} updated`;
-    } else {
-      versionStr = ` v${plugin.installedVersion}`;
+      versionStr = ` v${plugin.recentlyUpdatedFrom} → v${shownVersion} updated`;
+    } else if (plugin.recentlyInstalled) {
+      // Newly seen. Version is optional here: a plugin can be genuinely
+      // installed with no version we can name.
+      versionStr = shownVersion ? ` v${shownVersion} new` : " new";
+    } else if (shownVersion) {
+      versionStr = ` v${shownVersion}`;
       if (plugin.hasUpdate && plugin.version) {
         versionStr += ` → v${plugin.version}`;
       }
@@ -160,9 +170,7 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
 
   if (plugin.isOrphaned) {
     const ver =
-      plugin.installedVersion && plugin.installedVersion !== "0.0.0"
-        ? ` v${plugin.installedVersion}`
-        : "";
+      isKnownVersion(plugin.installedVersion) ? ` v${plugin.installedVersion}` : "";
     return (
       <text>
         <span fg={theme.colors.danger}> ■■■ </span>
@@ -184,7 +192,7 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
       <MetaText
         text={versionStr}
         tone={
-          plugin.recentlyUpdatedFrom
+          plugin.recentlyUpdatedFrom || plugin.recentlyInstalled
             ? "success"
             : notInstalled || plugin.hasUpdate
               ? "warning"
@@ -239,9 +247,9 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
     components.push(`${Object.keys(plugin.lspServers).length} LSP`);
   }
 
-  const showVersion = plugin.version && plugin.version !== "0.0.0";
+  const showVersion = isKnownVersion(plugin.version ?? undefined);
   const showInstalledVersion =
-    isInstalled && plugin.installedVersion && plugin.installedVersion !== "0.0.0";
+    isInstalled && isKnownVersion(plugin.installedVersion);
 
   return (
     <box flexDirection="column">

package/src/ui/screens/PluginsScreen.tsx

@@ -90,7 +90,12 @@ export function PluginsScreen() {
 			const previous = await loadSeenVersions();
 			for (const change of diffVersions(previous, current)) {
 				const target = pluginData.find((p) => p.id === change.pluginId);
-				if (target) target.recentlyUpdatedFrom = change.from;
+				if (!target) continue;
+				if (change.kind === "updated") {
+					target.recentlyUpdatedFrom = change.from;
+				} else {
+					target.recentlyInstalled = true;
+				}
 			}
 			// Record now so the same change is not reported on the next launch.
 			void saveSeenVersions(current);