claudeup 4.30.0 → 4.32.0

package/src/services/claude-settings.ts

@@ -302,7 +302,23 @@ async function overlayRegistryVersions(
 	const merged = { ...base };
 	for (const [pluginId, entries] of Object.entries(registry.plugins ?? {})) {
 		const pick = pickRegistryEntry(entries, scope, projectPath);
-		if (pick?.version) merged[pluginId] = pick.version;
+		if (pick?.version) {
+			merged[pluginId] = pick.version;
+			continue;
+		}
+
+		// The registry knows this plugin but has no entry for this scope, so it
+		// is NOT installed here. Any leftover `installedPluginVersions` value is
+		// a claim about an install that does not exist.
+		//
+		// Claude Code never writes that field — it appears 0 times in the 2.1.223
+		// binary, and `claude plugin install` writes it at no scope — so only
+		// claudeup's own past writes can be in there, and they go stale silently.
+		// Measured: user settings claimed browser-use 1.1.2 / terminal 4.0.2 /
+		// code-analysis 5.1.0 while the registry said 1.4.0 / 4.1.4 / 5.3.1, and
+		// none of the claimed versions had a cache directory. Keeping the stale
+		// value made every one of them read as a permanent pending update.
+		if (entries && entries.length > 0) delete merged[pluginId];
 	}
 	return merged;
 }

package/src/services/content-drift.ts

@@ -0,0 +1,121 @@
+/**
+ * content-drift.ts — detect a plugin whose files changed without its version.
+ *
+ * The whole update system keys off one signal: the version string.
+ * `hasUpdate` is `compareVersions(catalogVersion, installedVersion) > 0`, so a
+ * marketplace that republishes different content under an unchanged version is
+ * invisible. No update is offered, and the only cure is a reinstall — which is
+ * exactly the "plugin says installed but its skills are missing" report.
+ *
+ * This is not a hypothetical. `publish-dist.sh` force-pushes a rebuilt tree, so
+ * same-version-different-content is a normal outcome of the release process.
+ * Measured on 2026-08-06: `cache/magus/dev/3.0.1/skills` held
+ * {audit, tui-progress} while `marketplaces/magus/plugins/dev/skills` held
+ * {security-audit} — both stamped 3.0.1.
+ *
+ * The fix uses a signal already present in `installed_plugins.json`: each entry
+ * records `gitCommitSha`, the marketplace commit it was installed from. Asking
+ * git whether THIS PLUGIN'S SUBTREE changed between that commit and the
+ * marketplace's current HEAD answers the question exactly.
+ *
+ * Comparing whole-marketplace SHAs would be wrong: any commit to any plugin
+ * would flag every plugin as drifted. The subtree scope is what makes this
+ * precise enough to act on.
+ */
+
+import { spawn } from "node:child_process";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * Resolved per call, honouring CLAUDE_CONFIG_DIR — the same override Claude
+ * Code uses. A module-level constant would bake in `os.homedir()` at import
+ * time, which on macOS ignores $HOME and makes the service impossible to test
+ * without touching the operator's real marketplaces.
+ */
+function marketplacesDir(): string {
+	const configDir =
+		process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+	return path.join(configDir, "plugins", "marketplaces");
+}
+
+/**
+ * Session cache. Keyed by marketplace + installed sha + plugin, because the
+ * answer cannot change while claudeup is open — the marketplace clone is only
+ * refreshed by Claude Code, out of process.
+ */
+const cache = new Map<string, boolean>();
+
+export function clearContentDriftCache(): void {
+	cache.clear();
+}
+
+function git(cwd: string, args: string[]): Promise<{ code: number; out: string }> {
+	return new Promise((resolve) => {
+		const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "ignore"] });
+		let out = "";
+		child.stdout.on("data", (d) => {
+			out += String(d);
+		});
+		child.on("error", () => resolve({ code: -1, out: "" }));
+		child.on("close", (code) => resolve({ code: code ?? -1, out: out.trim() }));
+		// Never let a wedged git block the UI.
+		setTimeout(() => {
+			child.kill();
+			resolve({ code: -1, out: "" });
+		}, 5000).unref?.();
+	});
+}
+
+export interface DriftQuery {
+	marketplace: string;
+	/** Plugin name without the @marketplace suffix. */
+	pluginName: string;
+	/** `gitCommitSha` from the installed_plugins.json entry. */
+	installedSha: string | undefined;
+	/**
+	 * Path of the plugin inside the marketplace repo, from the catalog `source`
+	 * field (e.g. "./plugins/dev"). Defaults to `plugins/<name>`.
+	 */
+	sourcePath?: string;
+}
+
+/**
+ * True when the plugin's files in the marketplace differ from the commit it was
+ * installed from — i.e. a reinstall would deliver different content.
+ *
+ * Returns false whenever the question cannot be answered honestly: no recorded
+ * sha, no clone, git unavailable, or the recorded commit is absent locally
+ * (force-push, shallow clone). A false negative leaves today's behaviour; a
+ * false positive would nag the user to reinstall for no reason.
+ */
+export async function hasContentDrift(q: DriftQuery): Promise<boolean> {
+	if (!q.installedSha) return false;
+
+	const key = `${q.marketplace}\0${q.pluginName}\0${q.installedSha}`;
+	const hit = cache.get(key);
+	if (hit !== undefined) return hit;
+
+	const repo = path.join(marketplacesDir(), q.marketplace);
+	const rel = (q.sourcePath ?? `plugins/${q.pluginName}`).replace(/^\.\//, "");
+
+	// The recorded commit must exist locally, or the diff is meaningless.
+	const known = await git(repo, ["cat-file", "-e", `${q.installedSha}^{commit}`]);
+	if (known.code !== 0) {
+		cache.set(key, false);
+		return false;
+	}
+
+	// Exit 0 = no difference, 1 = differs, anything else = could not tell.
+	const diff = await git(repo, [
+		"diff",
+		"--quiet",
+		q.installedSha,
+		"HEAD",
+		"--",
+		rel,
+	]);
+	const drifted = diff.code === 1;
+	cache.set(key, drifted);
+	return drifted;
+}

package/src/services/marketplace-refresh.ts

@@ -34,8 +34,19 @@ export interface RefreshResult {
 	refreshed: string[];
 	/** Pull errored (network, diverged, timeout) — clone left intact and stale. */
 	failed: string[];
-	/** Nothing to do: no clone on disk, not a git repo, dirty tree, or opted out. */
+	/** Nothing to do: no clone on disk, not a git repo, or dirty tree. */
 	skipped: string[];
+	/**
+	 * Skipped specifically because `autoUpdate: false` in known_marketplaces.json.
+	 *
+	 * Called out separately from `skipped` because the consequence is invisible
+	 * and open-ended: the clone is the catalog, so a marketplace opted out here
+	 * never learns about new plugin versions, and every plugin from it reads as
+	 * up to date forever. The reporter's `magus` clone sat 11 days behind this
+	 * way — Claude Code would not refresh it, and this function skipped it too,
+	 * with nothing printed either time.
+	 */
+	autoUpdateDisabled: string[];
 }
 
 function cloneDir(name: string): string {
@@ -136,6 +147,7 @@ export async function refreshRegisteredMarketplaces(
 	const refreshed: string[] = [];
 	const failed: string[] = [];
 	const skipped: string[] = [];
+	const autoUpdateDisabled: string[] = [];
 
 	const configured = await getConfiguredMarketplaces();
 	const skipSet = new Set(skip);
@@ -149,7 +161,7 @@ export async function refreshRegisteredMarketplaces(
 			continue;
 		}
 		if ((await getMarketplaceAutoUpdate(name)) === false) {
-			skipped.push(name);
+			autoUpdateDisabled.push(name);
 			continue;
 		}
 		eligible.push(name);
@@ -169,5 +181,5 @@ export async function refreshRegisteredMarketplaces(
 		else skipped.push(name); // absent | skipped
 	});
 
-	return { refreshed, failed, skipped };
+	return { refreshed, failed, skipped, autoUpdateDisabled };
 }

package/src/services/plugin-manager.ts

@@ -12,11 +12,17 @@ import {
 	getLocalEnabledPlugins,
 	getLocalInstalledPluginVersions,
 	getProjectInstalledPluginVersions,
+	pickRegistryEntry,
+	readInstalledPluginsRegistry,
 	updateInstalledPluginsRegistry,
 	removeFromInstalledPluginsRegistry,
 } from "./claude-settings.js";
+import { hasContentDrift } from "./content-drift.js";
 import { defaultMarketplaces } from "../data/marketplaces.js";
-import type { PluginRelease } from "../types/index.js";
+import type {
+	InstalledPluginsRegistry,
+	PluginRelease,
+} from "../types/index.js";
 import {
 	scanLocalMarketplaces,
 	repairAllMarketplaces,
@@ -75,6 +81,23 @@ export interface PluginInfo {
 	mcpServers?: string[];
 	lspServers?: Record<string, unknown>;
 	isOrphaned?: boolean;
+	/**
+	 * Set when the installed version equals the catalog version, but the
+	 * plugin's files in the marketplace have changed since the commit it was
+	 * installed from. The version compare says "up to date" and is wrong: only
+	 * a reinstall delivers the current content. See content-drift.ts.
+	 */
+	contentStale?: boolean;
+	/**
+	 * For an orphaned plugin: another configured marketplace that publishes a
+	 * plugin of the same name — i.e. it did not disappear, it moved.
+	 *
+	 * Splitting `magus` into `magus` + `magus-marketing` left seo, instantly,
+	 * video-editing and image-generate installed under a namespace that no
+	 * longer lists them. Rendered as bare "deprecated", the only offered action
+	 * was deletion, which silently drops a plugin that is still published.
+	 */
+	movedTo?: string;
 	/**
 	 * Set when this plugin's installed version changed since claudeup last
 	 * rendered it — including updates made by Claude Code or the prerunner
@@ -282,6 +305,9 @@ export async function getAvailablePlugins(
 		// Try to get plugin info from local marketplace cache (fallback)
 		const localMp = localMarketplaces.get(mpName);
 		const localPlugin = localMp?.plugins.find((p) => p.name === pluginName);
+		const movedTo = localPlugin
+			? undefined
+			: findPluginInOtherMarketplace(pluginName, mpName, localMarketplaces);
 
 		const latestVersion = localPlugin?.version || installedVersion || "unknown";
 		const description = localPlugin?.description || "Installed plugin";
@@ -301,10 +327,12 @@ export async function getAvailablePlugins(
 			installedVersion: installedVersion,
 			hasUpdate,
 			isOrphaned: true,
+			movedTo,
 			...scopeStatus,
 		});
 	}
 
+	await annotateContentDrift(plugins, "project", projectPath);
 	return plugins;
 }
 
@@ -474,6 +502,9 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 		// Try to get plugin info from local marketplace cache (fallback)
 		const localMp = localMarketplaces.get(mpName);
 		const localPlugin = localMp?.plugins.find((p) => p.name === pluginName);
+		const movedTo = localPlugin
+			? undefined
+			: findPluginInOtherMarketplace(pluginName, mpName, localMarketplaces);
 
 		const latestVersion = localPlugin?.version || installedVersion || "unknown";
 		const description = localPlugin?.description || "Installed plugin";
@@ -494,14 +525,83 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 			installedVersion: installedVersion,
 			hasUpdate,
 			isOrphaned: true,
+			movedTo,
 		});
 	}
 
+	await annotateContentDrift(plugins, "user");
 	return plugins;
 }
 
+/**
+ * Find another configured marketplace that still publishes this plugin name.
+ *
+ * Answers "did it disappear, or did it move?" for an orphaned plugin, so the
+ * UI can offer migration rather than only deletion.
+ */
+function findPluginInOtherMarketplace(
+	pluginName: string,
+	currentMarketplace: string,
+	localMarketplaces: Map<string, LocalMarketplace>,
+): string | undefined {
+	for (const [name, mp] of localMarketplaces) {
+		if (name === currentMarketplace) continue;
+		if (mp.plugins.some((p) => p.name === pluginName)) return name;
+	}
+	return undefined;
+}
+
+/**
+ * Flag plugins whose files moved without their version moving.
+ *
+ * Runs after the plugin list is assembled so every code path that builds a
+ * PluginInfo gets the same treatment. Only plugins that already look "up to
+ * date" are worth checking — anything with a pending version bump will be
+ * reinstalled by that update anyway.
+ *
+ * Best-effort throughout: a plugin whose drift cannot be determined is left
+ * exactly as it is today.
+ */
+async function annotateContentDrift(
+	plugins: PluginInfo[],
+	scope: "user" | "project" | "local",
+	projectPath?: string,
+): Promise<void> {
+	let registry: InstalledPluginsRegistry;
+	try {
+		registry = await readInstalledPluginsRegistry();
+	} catch {
+		return;
+	}
+
+	await Promise.all(
+		plugins.map(async (plugin) => {
+			if (plugin.hasUpdate || plugin.isOrphaned) return;
+			if (!plugin.installedVersion || !plugin.version) return;
+			if (compareVersions(plugin.version, plugin.installedVersion) !== 0) return;
+
+			const entry = pickRegistryEntry(
+				registry.plugins[plugin.id],
+				scope,
+				projectPath,
+			);
+			if (!entry?.gitCommitSha) return;
+
+			try {
+				plugin.contentStale = await hasContentDrift({
+					marketplace: plugin.marketplace,
+					pluginName: plugin.name,
+					installedSha: entry.gitCommitSha,
+				});
+			} catch {
+				/* leave unflagged */
+			}
+		}),
+	);
+}
+
 // Simple version comparison (returns 1 if a > b, -1 if a < b, 0 if equal)
-function compareVersions(
+export function compareVersions(
 	a: string | null | undefined,
 	b: string | null | undefined,
 ): number {

package/src/services/profile-materializer.ts

@@ -21,11 +21,26 @@ import { profileDir } from "./symlink-manager.js";
  * enabled, merged with the profile's declared settings. The profile's settings
  * win over the derived enabledPlugins only if it explicitly sets that key
  * (it normally won't).
+ *
+ * `allPluginIds` is the manifest-wide union of plugins across every profile.
+ * Plugins in the union that this profile does NOT want are written as an
+ * explicit `false`, which is what makes `profile switch` exclusive rather than
+ * additive. Claude Code resolves enabledPlugins **per plugin id**, walking from
+ * the highest-precedence scope down and taking the first scope that mentions
+ * the id — an id a scope omits falls through to the next one. Since
+ * `claudeup install` installs the union at user scope, every non-member would
+ * otherwise inherit that user-scope `true` and stay enabled while a profile
+ * that excludes it is active. Omitting the union (the default) preserves the
+ * old additive behavior for callers that have no cross-profile view.
  */
 export function buildProfileSettings(
 	closure: ResolvedClosure,
+	allPluginIds: readonly string[] = [],
 ): Record<string, unknown> {
 	const enabledPlugins: Record<string, boolean> = {};
+	for (const pluginId of allPluginIds) {
+		enabledPlugins[pluginId] = false;
+	}
 	for (const pluginId of Object.keys(closure.plugins)) {
 		enabledPlugins[pluginId] = true;
 	}
@@ -39,6 +54,37 @@ export function buildProfileMcp(
 	return { mcpServers: { ...closure.mcpServers } };
 }
 
+/**
+ * Seed a profile's skills/ dir from the project's pre-existing `.claude/skills/`.
+ *
+ * Activating a profile replaces `.claude/skills` with a symlink into the profile
+ * dir, and replacing means `fs.remove` first. A project that committed its own
+ * skills before adopting profiles would lose them at that moment. So the first
+ * time a profile's skills/ dir is created, any real (non-symlink) project skills
+ * are copied in — every profile inherits what the project already had, and the
+ * link swap destroys nothing.
+ *
+ * Only runs when the profile's skills/ dir does not exist yet, so it never
+ * fights a later `skills-manager` install or re-adds a skill the user removed.
+ */
+async function seedSkillsFromProject(
+	skillsDir: string,
+	projectPath?: string,
+): Promise<void> {
+	if (await fs.pathExists(skillsDir)) return;
+
+	const projectSkills = path.join(projectPath ?? process.cwd(), ".claude", "skills");
+	try {
+		// lstat, not pathExists: an existing profile symlink is not a source.
+		const stat = await fs.lstat(projectSkills);
+		if (!stat.isDirectory() || stat.isSymbolicLink()) return;
+		if ((await fs.readdir(projectSkills)).length === 0) return;
+		await fs.copy(projectSkills, skillsDir, { dereference: true });
+	} catch {
+		// No project skills dir (or unreadable) — nothing to carry over.
+	}
+}
+
 /**
  * Write `_profiles/<name>/` from a resolved closure. Idempotent: overwrites
  * settings.json / mcp.json and ensures skills/ exists. Returns the dir path.
@@ -47,15 +93,20 @@ export async function materializeProfile(
 	name: string,
 	closure: ResolvedClosure,
 	projectPath?: string,
+	allPluginIds: readonly string[] = [],
 ): Promise<string> {
 	const dir = profileDir(name, projectPath);
 	await fs.ensureDir(dir);
-	await fs.writeJson(path.join(dir, "settings.json"), buildProfileSettings(closure), {
-		spaces: 2,
-	});
+	await fs.writeJson(
+		path.join(dir, "settings.json"),
+		buildProfileSettings(closure, allPluginIds),
+		{ spaces: 2 },
+	);
 	await fs.writeJson(path.join(dir, "mcp.json"), buildProfileMcp(closure), {
 		spaces: 2,
 	});
-	await fs.ensureDir(path.join(dir, "skills"));
+	const skillsDir = path.join(dir, "skills");
+	await seedSkillsFromProject(skillsDir, projectPath);
+	await fs.ensureDir(skillsDir);
 	return dir;
 }

package/src/services/version-snapshot.ts

@@ -42,22 +42,50 @@ export interface PluginChange {
 }
 
 interface SnapshotFile {
-  /** pluginId -> installedVersion as of the last time claudeup rendered it. */
-  seen: Record<string, string>;
+  /**
+   * Legacy flat baseline: pluginId -> version, with no record of which project
+   * it was observed from. Kept only so an existing file can be migrated.
+   */
+  seen?: Record<string, string>;
+  /**
+   * projectPath -> (pluginId -> installedVersion) as of the last time claudeup
+   * rendered that project.
+   *
+   * Versions are per-project (installed_plugins.json keys installs by
+   * projectPath), but this file is global. A single flat map therefore let two
+   * projects legitimately on different versions overwrite each other's
+   * baseline, and every differing plugin was badged "updated" on the next
+   * render — a change that never happened. Keying by project removes the
+   * cross-talk entirely.
+   */
+  byProject?: Record<string, Record<string, string>>;
   /** Set on the run that first created the baseline. */
   seededAt: string;
   updatedAt: string;
 }
 
+/**
+ * Honour CLAUDE_CONFIG_DIR — the same override Claude Code itself uses.
+ *
+ * `os.homedir()` reads the passwd database on macOS and ignores $HOME, so a
+ * test that only overrides HOME writes to the operator's real snapshot file.
+ * That is not hypothetical: it happened while building the tests for this fix.
+ */
 function snapshotPath(): string {
-  return path.join(os.homedir(), ".claude", "claudeup-version-snapshot.json");
+  const configDir =
+    process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+  return path.join(configDir, "claudeup-version-snapshot.json");
 }
 
 async function read(): Promise<SnapshotFile | null> {
   try {
     const raw = await fs.readFile(snapshotPath(), "utf-8");
     const data = JSON.parse(raw) as SnapshotFile;
-    if (!data || typeof data.seen !== "object" || data.seen === null) return null;
+    if (!data) return null;
+    const hasFlat = typeof data.seen === "object" && data.seen !== null;
+    const hasByProject =
+      typeof data.byProject === "object" && data.byProject !== null;
+    if (!hasFlat && !hasByProject) return null;
     return data;
   } catch {
     return null; // absent or corrupt — treated as "no baseline yet"
@@ -109,10 +137,28 @@ export function diffVersions(
   return changes;
 }
 
-/** Load the previous snapshot's version map, or null when no baseline exists. */
-export async function loadSeenVersions(): Promise<Record<string, string> | null> {
+/**
+ * Load the baseline for one project, or null when that project has none.
+ *
+ * A project seen for the first time returns null, so `diffVersions` stays
+ * silent — the same rule as a first ever run. That is deliberate: opening
+ * claudeup in a new project must not badge every plugin as "updated" just
+ * because this file has never seen that path before.
+ *
+ * A pre-migration flat file is adopted as the baseline for whichever project
+ * asks first, which is the closest thing to the truth it contains.
+ */
+export async function loadSeenVersions(
+  projectPath: string,
+): Promise<Record<string, string> | null> {
   const data = await read();
-  return data ? data.seen : null;
+  if (!data) return null;
+  const scoped = data.byProject?.[projectPath];
+  if (scoped) return scoped;
+  // Legacy flat baseline, project unknown — use it once, then it is replaced
+  // by per-project entries on save.
+  if (data.seen && !data.byProject) return data.seen;
+  return null;
 }
 
 /**
@@ -121,6 +167,7 @@ export async function loadSeenVersions(): Promise<Record<string, string> | null>
  * shows again next launch.
  */
 export async function saveSeenVersions(
+  projectPath: string,
   current: Record<string, string>,
 ): Promise<void> {
   try {
@@ -129,7 +176,9 @@ export async function saveSeenVersions(
     const existing = await read();
     const now = new Date().toISOString();
     const payload: SnapshotFile = {
-      seen: current,
+      // Other projects' baselines are preserved — writing only this project's
+      // slot is the entire point of the fix.
+      byProject: { ...(existing?.byProject ?? {}), [projectPath]: current },
       seededAt: existing?.seededAt ?? now,
       updatedAt: now,
     };

package/src/ui/renderers/pluginRenderers.tsx

@@ -136,10 +136,20 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
 
   let versionStr = "";
   if (plugin.isOrphaned) {
-    versionStr = " deprecated";
+    // "deprecated" alone reads as "delete me" — but a plugin that merely moved
+    // marketplace is still published, and deleting it loses it for no reason.
+    versionStr = plugin.movedTo
+      ? ` moved → ${plugin.movedTo}`
+      : " deprecated";
   } else if (notInstalled) {
     versionStr = " not installed";
   } else if (hasAnyScope) {
+    // "what just changed" and "what is still available" are independent facts,
+    // and both can be true at once: the prerunner can move a plugin 2.9.0→3.0.1
+    // while the marketplace already offers 3.3.1. These used to share one
+    // if/else chain, so the "updated" badge silently swallowed the pending
+    // update — and the update only reappeared on the next refresh, which read
+    // as the state spontaneously changing. Render them as separate clauses.
     if (plugin.recentlyUpdatedFrom && shownVersion) {
       // Show what actually happened, not just where it landed — the update may
       // have come from Claude Code or the prerunner without ever telling us.
@@ -150,9 +160,15 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
       versionStr = shownVersion ? ` v${shownVersion} new` : " new";
     } else if (shownVersion) {
       versionStr = ` v${shownVersion}`;
-      if (plugin.hasUpdate && plugin.version) {
-        versionStr += ` → v${plugin.version}`;
-      }
+    }
+
+    // Pending update, regardless of which badge above applied.
+    if (plugin.hasUpdate && plugin.version && versionStr) {
+      versionStr += ` → v${plugin.version} available`;
+    } else if (plugin.contentStale && versionStr) {
+      // Same version, different files. The version compare says "up to date"
+      // and is wrong — only a reinstall delivers the current content.
+      versionStr += " stale — reinstall";
     }
   }