claudeup 4.27.0 → 4.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.27.0",
+  "version": "4.28.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.27.0",
-    "claudeup-darwin-x64": "4.27.0",
-    "claudeup-linux-x64": "4.27.0"
+    "claudeup-darwin-arm64": "4.28.0",
+    "claudeup-darwin-x64": "4.28.0",
+    "claudeup-linux-x64": "4.28.0"
   }
 }

package/src/__tests__/plugin-releases.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, test } from "bun:test";
+import {
+	MAX_RELEASES,
+	normalizeReleases,
+} from "../services/plugin-releases.js";
+import type { PluginRelease } from "../types/index.js";
+
+/** Narrow to a populated result, failing the test rather than the assertion's type. */
+function expectEntries(input: unknown): PluginRelease[] {
+	const out = normalizeReleases(input);
+	if (!out) throw new Error("expected releases, got undefined");
+	return out;
+}
+
+describe("normalizeReleases", () => {
+	test("passes through a well-formed entry", () => {
+		expect(
+			normalizeReleases([
+				{
+					version: "3.3.0",
+					date: "2026-07-29",
+					kinds: ["Changed", "Fixed"],
+					summary: "Model resolution is now live",
+				},
+			]),
+		).toEqual([
+			{
+				version: "3.3.0",
+				date: "2026-07-29",
+				kinds: ["Changed", "Fixed"],
+				summary: "Model resolution is now live",
+			},
+		]);
+	});
+
+	test("omits optional fields rather than emitting undefined", () => {
+		const [entry] = expectEntries([
+			{ version: "1.0.0", summary: "First release" },
+		]);
+		expect(entry).toEqual({ version: "1.0.0", summary: "First release" });
+		expect("date" in entry).toBe(false);
+		expect("kinds" in entry).toBe(false);
+	});
+
+	test("returns undefined for anything that is not an array", () => {
+		for (const input of [undefined, null, "3.3.0", 7, {}, true]) {
+			expect(normalizeReleases(input)).toBeUndefined();
+		}
+	});
+
+	// The manifest is fetched over the network, so no field's type can be assumed.
+	test("drops entries missing or mistyping the required fields", () => {
+		expect(
+			normalizeReleases([
+				{ version: "1.0.0", summary: "kept" },
+				{ version: "1.0.1" }, // no summary
+				{ summary: "no version" },
+				{ version: 2, summary: "version is a number" },
+				{ version: "1.0.2", summary: 42 },
+				{ version: "  ", summary: "blank version" },
+				{ version: "1.0.3", summary: "   " },
+				null,
+				"not an object",
+			]),
+		).toEqual([{ version: "1.0.0", summary: "kept" }]);
+	});
+
+	test("returns undefined when every entry is unusable", () => {
+		expect(normalizeReleases([{ nope: true }, null])).toBeUndefined();
+		expect(normalizeReleases([])).toBeUndefined();
+	});
+
+	test("caps the list so one manifest cannot flood the panel", () => {
+		const many = Array.from({ length: 500 }, (_, i) => ({
+			version: `1.0.${i}`,
+			summary: `entry ${i}`,
+		}));
+		const out = expectEntries(many);
+		expect(out).toHaveLength(MAX_RELEASES);
+		// Newest-first ordering is preserved — the cap takes the head, not the tail.
+		expect(out[0].version).toBe("1.0.0");
+	});
+
+	test("keeps only string members of kinds", () => {
+		const [entry] = expectEntries([
+			{ version: "1.0.0", summary: "x", kinds: ["Added", 3, null, "Fixed"] },
+		]);
+		expect(entry.kinds).toEqual(["Added", "Fixed"]);
+	});
+
+	test("trims surrounding whitespace", () => {
+		expect(
+			normalizeReleases([
+				{ version: " 1.0.0 ", date: " 2026-07-29 ", summary: "  padded  " },
+			]),
+		).toEqual([{ version: "1.0.0", date: "2026-07-29", summary: "padded" }]);
+	});
+});

package/src/__tests__/version-check-refresh.test.ts

@@ -0,0 +1,45 @@
+/**
+ * Guards the update-check refresh fix. checkForUpdates caches within a session
+ * (so we don't hammer the registry), but `force` bypasses that cache so a
+ * release landing mid-session is actually seen — the 4.25-vs-4.26 banner
+ * staleness. (The fetch itself also sets `cache: "no-store"` so a CDN-stale
+ * response can't mask a fresh release.)
+ */
+import { afterEach, describe, expect, it } from "bun:test";
+import { checkForUpdates } from "../services/version-check.js";
+
+describe("checkForUpdates — session cache vs forced re-check", () => {
+	const realFetch = globalThis.fetch;
+	afterEach(() => {
+		globalThis.fetch = realFetch;
+	});
+
+	it("serves the session cache by default and re-fetches only when forced", async () => {
+		let calls = 0;
+		let latest = "9.9.9";
+		globalThis.fetch = (async () => {
+			calls++;
+			return new Response(JSON.stringify({ version: latest }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}) as typeof fetch;
+
+		// Force the first call so the test is independent of any cache another
+		// test in the same process may have primed.
+		const first = await checkForUpdates(true);
+		expect(calls).toBe(1);
+		expect(first.latestVersion).toBe("9.9.9");
+
+		// Default call is served from the session cache — no new fetch.
+		const cached = await checkForUpdates();
+		expect(calls).toBe(1);
+		expect(cached.latestVersion).toBe("9.9.9");
+
+		// A release lands; a forced re-check bypasses the cache and sees it.
+		latest = "9.9.10";
+		const forced = await checkForUpdates(true);
+		expect(calls).toBe(2);
+		expect(forced.latestVersion).toBe("9.9.10");
+	});
+});

package/src/services/local-marketplace.ts

@@ -2,6 +2,8 @@ import fs from "fs-extra";
 import path from "node:path";
 import os from "node:os";
 import { execSync } from "node:child_process";
+import type { PluginRelease } from "../types/index.js";
+import { normalizeReleases } from "./plugin-releases.js";
 
 export interface LocalMarketplacePlugin {
 	name: string;
@@ -10,6 +12,8 @@ export interface LocalMarketplacePlugin {
 	source?: string;
 	category?: string;
 	author?: { name: string; email?: string };
+	/** Recent release history, as published in the marketplace manifest. */
+	releases?: PluginRelease[];
 	// Extended info from plugin.json or marketplace.json
 	strict?: boolean;
 	lspServers?: Record<string, unknown>;
@@ -185,6 +189,7 @@ async function scanSingleMarketplace(
 					source: plugin.source,
 					category: plugin.category,
 					author: plugin.author,
+					releases: normalizeReleases(plugin.releases),
 					strict: plugin.strict,
 					lspServers: plugin.lspServers,
 					agents,

package/src/services/marketplace-fetcher.ts

@@ -7,8 +7,10 @@
  * imported via plugin-manager.ts).
  */
 
+import type { PluginRelease } from "../types/index.js";
 import { isValidGitHubRepo } from "../utils/string-utils.js";
 import type { LocalMarketplace } from "./local-marketplace.js";
+import { normalizeReleases } from "./plugin-releases.js";
 
 export interface MarketplacePlugin {
   name: string;
@@ -18,6 +20,7 @@ export interface MarketplacePlugin {
   author?: { name: string; email?: string };
   homepage?: string;
   tags?: string[];
+  releases?: PluginRelease[];
 }
 
 // Session-level cache for fetched marketplace data (no TTL - persists until explicit refresh)
@@ -92,6 +95,7 @@ export async function fetchMarketplacePlugins(
       author?: { name: string; email?: string };
       homepage?: string;
       tags?: string[];
+      releases?: unknown;
     }
     const data = (await response.json()) as {
       plugins?: RawPlugin[];
@@ -116,6 +120,7 @@ export async function fetchMarketplacePlugins(
           author: plugin.author,
           homepage: plugin.homepage,
           tags: plugin.tags,
+          releases: normalizeReleases(plugin.releases),
         });
       }
     }
@@ -161,5 +166,6 @@ export async function resolveMarketplacePlugins(
     description: p.description,
     category: p.category,
     author: p.author,
+    releases: p.releases,
   }));
 }

package/src/services/plugin-manager.ts

@@ -16,6 +16,7 @@ import {
 	removeFromInstalledPluginsRegistry,
 } from "./claude-settings.js";
 import { defaultMarketplaces } from "../data/marketplaces.js";
+import type { PluginRelease } from "../types/index.js";
 import {
 	scanLocalMarketplaces,
 	repairAllMarketplaces,
@@ -66,6 +67,8 @@ export interface PluginInfo {
 	author?: { name: string; email?: string };
 	homepage?: string;
 	tags?: string[];
+	/** Recent release history, newest first. Absent when the manifest publishes none. */
+	releases?: PluginRelease[];
 	agents?: string[];
 	commands?: string[];
 	skills?: string[];
@@ -215,6 +218,7 @@ export async function getAvailablePlugins(
 				author: plugin.author,
 				homepage: plugin.homepage,
 				tags: plugin.tags,
+				releases: plugin.releases,
 			});
 		}
 	}
@@ -253,6 +257,7 @@ export async function getAvailablePlugins(
 				skills: localPlugin.skills,
 				mcpServers: localPlugin.mcpServers,
 				lspServers: localPlugin.lspServers,
+				releases: localPlugin.releases,
 			});
 		}
 	}
@@ -405,6 +410,7 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 				author: plugin.author,
 				homepage: plugin.homepage,
 				tags: plugin.tags,
+				releases: plugin.releases,
 			});
 		}
 	}
@@ -443,6 +449,7 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 				skills: localPlugin.skills,
 				mcpServers: localPlugin.mcpServers,
 				lspServers: localPlugin.lspServers,
+				releases: localPlugin.releases,
 			});
 		}
 	}

package/src/services/plugin-releases.ts

@@ -0,0 +1,47 @@
+/**
+ * Normalisation for the `releases` array published in marketplace manifests.
+ *
+ * Lives apart from both readers because both need it: `marketplace-fetcher.ts`
+ * (manifest over the network) and `local-marketplace.ts` (same manifest from the
+ * on-disk cache). Putting it in either would make one import the other, and
+ * marketplace-fetcher was split out precisely to avoid importing local-marketplace,
+ * whose module-level `os.homedir()` constants contaminate the test suite.
+ */
+
+import type { PluginRelease } from "../types/index.js";
+
+/** Most release entries the panel will show, however many the manifest declares. */
+export const MAX_RELEASES = 5;
+
+/**
+ * Coerce a manifest `releases` value into renderable shape, or undefined.
+ *
+ * The remote manifest is fetched over the network from a repo whose contents we do
+ * not control at read time, so nothing about its shape may be assumed — a number
+ * where a string belongs, or a ten-thousand-entry array, would otherwise reach the
+ * renderer. Entries missing a version or summary are dropped rather than rendered
+ * blank, and the array is capped so one manifest cannot flood the detail panel.
+ */
+export function normalizeReleases(input: unknown): PluginRelease[] | undefined {
+	if (!Array.isArray(input)) return undefined;
+
+	const out: PluginRelease[] = [];
+	for (const raw of input.slice(0, MAX_RELEASES)) {
+		if (!raw || typeof raw !== "object") continue;
+		const r = raw as Record<string, unknown>;
+		if (typeof r.version !== "string" || typeof r.summary !== "string")
+			continue;
+		if (!r.version.trim() || !r.summary.trim()) continue;
+		out.push({
+			version: r.version.trim(),
+			...(typeof r.date === "string" && r.date.trim()
+				? { date: r.date.trim() }
+				: {}),
+			...(Array.isArray(r.kinds)
+				? { kinds: r.kinds.filter((k): k is string => typeof k === "string") }
+				: {}),
+			summary: r.summary.trim(),
+		});
+	}
+	return out.length > 0 ? out : undefined;
+}

package/src/services/version-check.ts

@@ -33,6 +33,9 @@ async function fetchLatestVersion(): Promise<string | null> {
 			signal: controller.signal,
 			headers: {
 				Accept: "application/json",
+				// Always revalidate — a CDN/HTTP-cached response serves a stale
+				// "latest" right after a release (the 4.25-vs-4.26 flicker).
+				"Cache-Control": "no-cache",
 			},
 		});
 
@@ -70,12 +73,15 @@ function getUpdateType(
 }
 
 /**
- * Check if a new version is available
- * Returns cached result if already checked this session
+ * Check if a new version is available.
+ * Returns the session-cached result unless `force` requests a fresh check.
  */
-export async function checkForUpdates(): Promise<VersionCheckResult> {
-	// Return cached result if available
-	if (cachedResult) {
+export async function checkForUpdates(
+	force = false,
+): Promise<VersionCheckResult> {
+	// Return the session-cached result unless a fresh check is forced — a periodic
+	// re-check passes force:true so a release landing mid-session updates the banner.
+	if (!force && cachedResult) {
 		return cachedResult;
 	}
 

package/src/types/index.ts

@@ -51,6 +51,23 @@ export interface DiscoveredMarketplace {
 	config?: MarketplaceSource;
 }
 
+/**
+ * One entry of a plugin's recent release history, as published in marketplace.json.
+ *
+ * Kept separate from `description` on purpose: `description` says what a plugin *is*
+ * and changes rarely, while this says what *changed* and turns over every release.
+ * Folding the second into the first is what left plugin panels showing a changelog
+ * line where the plugin's purpose should be.
+ */
+export interface PluginRelease {
+	version: string;
+	/** ISO date (YYYY-MM-DD). Absent on entries whose heading carried no date. */
+	date?: string;
+	/** Change categories in the entry — "Added", "Changed", "Fixed", … */
+	kinds?: string[];
+	summary: string;
+}
+
 export interface Plugin {
 	name: string;
 	version: string;

package/src/ui/App.tsx

@@ -348,11 +348,22 @@ function AppContent({ onExit }: AppContentProps) {
 	} | null>(null);
 	const gitignoreModal = useGitignoreModal();
 
-	// Check for updates on startup (non-blocking)
+	// Check for updates on startup, then re-check periodically (force-bypassing
+	// the session cache) so the banner reflects a release that lands while
+	// claudeup is left open — otherwise it shows the stale startup value.
 	useEffect(() => {
 		checkForUpdates()
 			.then(setUpdateInfo)
 			.catch(() => {});
+		const id = setInterval(
+			() => {
+				checkForUpdates(true)
+					.then(setUpdateInfo)
+					.catch(() => {});
+			},
+			15 * 60 * 1000, // 15 min
+		);
+		return () => clearInterval(id);
 	}, []);
 
 	// Auto-dismiss recovery banner after 5 seconds

package/src/ui/renderers/pluginRenderers.tsx

@@ -18,6 +18,7 @@ import { highlightMatches } from "../../utils/fuzzy-search.js";
 import { getMarketplaceVersion } from "../../services/marketplace-fetcher.js";
 import { isEnabledButNotInstalled } from "../../services/plugin-manager.js";
 import { isKnownVersion } from "../../services/version-snapshot.js";
+import type { PluginRelease } from "../../types/index.js";
 
 // ─── Category renderers ───────────────────────────────────────────────────────
 
@@ -358,6 +359,9 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
         </box>
       </DetailSection>
 
+      {/* Recent releases */}
+      <ReleaseHistory releases={plugin.releases} installedVersion={plugin.installedVersion} />
+
       {/* Update action */}
       {isInstalled && plugin.hasUpdate ? (
         <ActionHints
@@ -368,6 +372,73 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
   );
 }
 
+/**
+ * Recent release history, newest first.
+ *
+ * Releases the user does not have yet are marked and coloured; the installed one is
+ * flagged; older ones are dimmed. The list is already ordered newest-first, so the
+ * installed entry's index is all that's needed to tell those three groups apart —
+ * no version comparison, and no way for it to disagree with the published order.
+ * When the installed version isn't in the window (unknown "0.0.0", or older than the
+ * releases published), everything renders neutrally rather than guessing.
+ */
+function ReleaseHistory({
+  releases,
+  installedVersion,
+}: {
+  releases?: PluginRelease[];
+  installedVersion?: string;
+}): React.ReactNode {
+  if (!releases?.length) return null;
+
+  const installedAt = installedVersion
+    ? releases.findIndex((r) => r.version === installedVersion)
+    : -1;
+
+  return (
+    <DetailSection>
+      <text>{"─".repeat(24)}</text>
+      <text>
+        <strong>Recent releases:</strong>
+      </text>
+      <box marginTop={1} flexDirection="column">
+        {releases.map((release, i) => {
+          const isNewer = installedAt > 0 && i < installedAt;
+          const isInstalled = installedAt >= 0 && i === installedAt;
+          const versionColor = isNewer
+            ? theme.colors.warning
+            : isInstalled
+              ? theme.colors.success
+              : theme.colors.link;
+
+          return (
+            <box key={release.version} flexDirection="column" marginBottom={1}>
+              <text>
+                <span fg={versionColor}>
+                  {isNewer ? "▲ " : isInstalled ? "● " : "  "}v{release.version}
+                </span>
+                {release.date ? (
+                  <span fg={theme.colors.muted}> {release.date}</span>
+                ) : null}
+                {release.kinds?.length ? (
+                  <span fg={theme.colors.dim}> {release.kinds.join(" · ")}</span>
+                ) : null}
+                {isInstalled ? (
+                  <span fg={theme.colors.success}> installed</span>
+                ) : null}
+              </text>
+              <text fg={isNewer ? theme.colors.text : theme.colors.muted}>
+                {"  "}
+                {release.summary}
+              </text>
+            </box>
+          );
+        })}
+      </box>
+    </DetailSection>
+  );
+}
+
 // ─── Public dispatch functions ────────────────────────────────────────────────
 
 /**