claudeup 4.32.0 → 4.33.0

package/src/services/mcp-registry.ts

@@ -1,31 +1,107 @@
-import type { McpRegistryServer, McpRegistryResponse } from "../types/index.js";
+import type {
+	McpRegistryResponse,
+	McpRegistryServer,
+	McpServer,
+} from "../types/index.js";
 
-// Official Model Context Protocol Registry
-// API Docs: https://registry.modelcontextprotocol.io
-const MCP_REGISTRY_API = "https://registry.modelcontextprotocol.io/v0";
+const DEFAULT_MCP_REGISTRY_API =
+	"https://us-central1-claudish-6da10.cloudfunctions.net/mcpRegistry";
 
 export interface SearchOptions {
 	query?: string;
 	limit?: number;
 	cursor?: string;
+	signal?: AbortSignal;
+}
+
+function getMcpRegistryApiUrl(): string {
+	return (process.env.MCP_REGISTRY_API_URL || DEFAULT_MCP_REGISTRY_API).replace(
+		/\/+$/,
+		"",
+	);
+}
+
+function isOptionalString(value: unknown): value is string | undefined {
+	return value === undefined || typeof value === "string";
+}
+
+function isMcpRegistryServer(value: unknown): value is McpRegistryServer {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+
+	const server = value as Record<string, unknown>;
+	return (
+		typeof server.name === "string" &&
+		server.name.length > 0 &&
+		typeof server.url === "string" &&
+		server.url.length > 0 &&
+		typeof server.short_description === "string" &&
+		isOptionalString(server.version) &&
+		isOptionalString(server.source_code_url) &&
+		isOptionalString(server.package_registry) &&
+		isOptionalString(server.published_at)
+	);
+}
+
+function isMcpServer(value: unknown): value is McpServer {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const server = value as Record<string, unknown>;
+	const isHttp = server.type === "http";
+	return (
+		typeof server.name === "string" &&
+		server.name.length > 0 &&
+		typeof server.description === "string" &&
+		typeof server.category === "string" &&
+		(isHttp
+			? typeof server.url === "string" && server.url.length > 0
+			: typeof server.command === "string" && server.command.length > 0) &&
+		(server.args === undefined ||
+			(Array.isArray(server.args) &&
+				server.args.every((arg) => typeof arg === "string"))) &&
+		(server.env === undefined ||
+			(typeof server.env === "object" && !Array.isArray(server.env))) &&
+		(server.configFields === undefined || Array.isArray(server.configFields))
+	);
+}
+
+function parseMcpRegistryResponse(value: unknown): McpRegistryResponse {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("MCP Registry API returned a malformed response");
+	}
+
+	const response = value as Record<string, unknown>;
+	if (
+		!Array.isArray(response.servers) ||
+		!response.servers.every(isMcpRegistryServer) ||
+		!isOptionalString(response.next_cursor)
+	) {
+		throw new Error("MCP Registry API returned a malformed response");
+	}
+
+	return {
+		servers: response.servers,
+		...(response.next_cursor === undefined
+			? {}
+			: { next_cursor: response.next_cursor }),
+	};
 }
 
 export async function searchMcpServers(
 	options: SearchOptions = {},
 ): Promise<McpRegistryResponse> {
-	const { query = "", limit = 20, cursor } = options;
+	const { query = "", limit = 20, cursor, signal } = options;
 
 	const params = new URLSearchParams();
-	if (query) params.set("query", query);
+	if (query) params.set("q", query);
 	params.set("limit", String(limit));
 	if (cursor) params.set("cursor", cursor);
 
-	const url = `${MCP_REGISTRY_API}/servers?${params.toString()}`;
+	const url = `${getMcpRegistryApiUrl()}/search?${params.toString()}`;
 
 	const response = await fetch(url, {
 		headers: {
 			Accept: "application/json",
 		},
+		signal,
 	});
 
 	if (!response.ok) {
@@ -34,61 +110,51 @@ export async function searchMcpServers(
 		);
 	}
 
-	const data: any = await response.json();
-
-	// The official registry returns data in a nested format:
-	// { servers: [{ server: {...}, _meta: {...} }] }
-	// Convert it to match our expected McpRegistryResponse format
-	const servers: McpRegistryServer[] = (data.servers || [])
-		.map((item: any) => {
-			const server = item.server || item; // Handle both nested and flat structures
-			const meta = item._meta?.["io.modelcontextprotocol.registry/official"];
-
-			// Get URL from remotes (HTTP) or construct from packages
-			let url = "";
-			if (server.remotes?.length > 0) {
-				url = server.remotes[0].url;
-			} else if (server.packages?.length > 0) {
-				// For package-based servers, use the package identifier as reference
-				const pkg = server.packages[0];
-				url = `${pkg.registryType}:${pkg.identifier}`;
-			}
-
-			return {
-				name: server.name,
-				url,
-				short_description: server.description || "No description",
-				version: server.version,
-				source_code_url: server.repository?.url,
-				package_registry: server.packages?.[0]?.registryType,
-				published_at: meta?.publishedAt,
-			};
-		})
-		// Filter out servers without name or URL
-		.filter((s: McpRegistryServer) => s.name && s.url)
-		// Sort by publish date (newest first)
-		.sort((a: McpRegistryServer, b: McpRegistryServer) => {
-			if (!a.published_at) return 1;
-			if (!b.published_at) return -1;
-			return (
-				new Date(b.published_at).getTime() - new Date(a.published_at).getTime()
-			);
-		});
+	let data: unknown;
+	try {
+		data = await response.json();
+	} catch {
+		throw new Error("MCP Registry API returned a malformed response");
+	}
 
-	return {
-		servers,
-		next_cursor: data.metadata?.nextCursor || data.next_cursor,
-	};
+	return parseMcpRegistryResponse(data);
 }
 
 export async function getPopularServers(
 	limit = 20,
 ): Promise<McpRegistryServer[]> {
 	const response = await searchMcpServers({ limit });
-	// Already sorted by publish date in searchMcpServers
 	return response.servers;
 }
 
+/** Fetch the install-ready catalog. This is separate from dynamic Registry search. */
+export async function fetchCuratedMcpServers(
+	signal?: AbortSignal,
+): Promise<McpServer[]> {
+	const response = await fetch(`${getMcpRegistryApiUrl()}/recommended`, {
+		headers: { Accept: "application/json" },
+		signal,
+	});
+	if (!response.ok) {
+		throw new Error(`MCP catalog API error: ${response.status}`);
+	}
+
+	let data: unknown;
+	try {
+		data = await response.json();
+	} catch {
+		throw new Error("MCP catalog API returned a malformed response");
+	}
+	if (!data || typeof data !== "object" || Array.isArray(data)) {
+		throw new Error("MCP catalog API returned a malformed response");
+	}
+	const servers = (data as Record<string, unknown>).servers;
+	if (!Array.isArray(servers) || !servers.every(isMcpServer)) {
+		throw new Error("MCP catalog API returned a malformed response");
+	}
+	return servers;
+}
+
 export function formatDate(dateStr?: string): string {
 	if (!dateStr) return "";
 	const date = new Date(dateStr);

package/src/services/plugin-manager.ts

@@ -135,6 +135,48 @@ export function isEnabledButNotInstalled(plugin: PluginInfo): boolean {
 	return enabledSomewhere && !plugin.installedVersion;
 }
 
+/**
+ * True when a scope genuinely has the plugin installed.
+ *
+ * `enabled` on its own is not proof. It is the `enabledPlugins` flag out of a
+ * settings file, and only claudeup and the user maintain it; `version` comes
+ * from `installed_plugins.json` via `overlayRegistryVersions`, which is what
+ * Claude Code actually loaded. When the two disagree — flag set, no registry
+ * entry — the plugin is in the broken enabled-but-not-installed state that the
+ * list already renders as "not installed".
+ *
+ * Every action that touches the filesystem must use this, not the flag alone.
+ * Deciding on the flag is what made the scope keys uninstall a plugin the row
+ * had just labelled "not installed".
+ *
+ * A version of "0.0.0" still counts as installed — Anthropic's official plugins
+ * record exactly that — which is why this tests presence, not `isKnownVersion`.
+ */
+export function isInstalledInScope(scope: ScopeStatus | undefined): boolean {
+	return !!scope?.enabled && !!scope.version;
+}
+
+/**
+ * What a scope toggle (`u` / `p` / `l`, or the Enter scope picker) should do.
+ *
+ * `install` doubles as the repair for enabled-but-not-installed. Measured
+ * against Claude Code 2.1.223 in exactly that state — `dev@magus` flagged in
+ * `.claude/settings.json` with no registry entry for the project path —
+ * `claude plugin install dev@magus --scope project` installed it normally and
+ * wrote the registry entry. It does not report "already installed", so this
+ * needs no uninstall-first dance (unlike content drift, see repairPlugin).
+ */
+export function resolveScopeAction(
+	scope: ScopeStatus | undefined,
+	latestVersion: string,
+): "install" | "update" | "uninstall" {
+	if (!isInstalledInScope(scope)) return "install";
+	const installed = scope?.version;
+	const hasUpdate =
+		!!installed && latestVersion !== "0.0.0" && installed !== latestVersion;
+	return hasUpdate ? "update" : "uninstall";
+}
+
 
 export async function getAvailablePlugins(
 	projectPath?: string,

package/src/services/skills-manager.ts

@@ -7,7 +7,7 @@ import type {
 	SkillFrontmatter,
 	GitTreeResponse,
 } from "../types/index.js";
-import { RECOMMENDED_SKILLS, classifyStarReliability } from "../data/skill-repos.js";
+import { classifyStarReliability, type RecommendedSkill } from "../data/skill-repos.js";
 
 const SKILLS_API_BASE =
 	"https://us-central1-claudish-6da10.cloudfunctions.net/skills";
@@ -286,6 +286,7 @@ export async function fetchPopularSkills(limit = 30): Promise<SkillInfo[]> {
 export async function fetchAvailableSkills(
 	_repos: SkillSource[],
 	projectPath?: string,
+	recommended: RecommendedSkill[] = [],
 ): Promise<SkillInfo[]> {
 	const userInstalled = await getInstalledSkillNames("user");
 	const projectInstalled = await getInstalledSkillNames("project", projectPath);
@@ -306,8 +307,8 @@ export async function fetchAvailableSkills(
 		return { ...skill, installed, installedScope };
 	};
 
-	// 1. Recommended skills from RECOMMENDED_SKILLS constant (no API call)
-	const recommendedSkills: SkillInfo[] = RECOMMENDED_SKILLS.map((rec) => {
+	// 1. Recommended skills from the versioned models-index catalog.
+	const recommendedSkills: SkillInfo[] = recommended.map((rec) => {
 		const source: SkillSource = {
 			label: rec.repo,
 			repo: rec.repo,
@@ -334,52 +335,7 @@ export async function fetchAvailableSkills(
 	const popular = await fetchPopularSkills(30);
 	const popularSkills = popular.map((s) => markInstalled({ ...s, isRecommended: false }));
 
-	// 3. Enrich recommended skills with GitHub repo stars (cached to disk)
-	const starsCachePath = path.join(os.homedir(), ".claude", "skill-stars-cache.json");
-	let starsCache: Record<string, { stars: number; fetchedAt: string }> = {};
-	try { starsCache = await fs.readJson(starsCachePath); } catch { /* no cache yet */ }
-
-	const uniqueRepos = [...new Set(recommendedSkills.map((s) => s.source.repo))];
-	const repoStars = new Map<string, number>();
-	const cacheMaxAge = 24 * 60 * 60 * 1000; // 24 hours
-	let cacheUpdated = false;
-
-	for (const repo of uniqueRepos) {
-		const cached = starsCache[repo];
-		if (cached && Date.now() - new Date(cached.fetchedAt).getTime() < cacheMaxAge) {
-			repoStars.set(repo, cached.stars);
-			continue;
-		}
-		// Try fetching from GitHub (may be rate limited)
-		try {
-			const res = await fetch(`https://api.github.com/repos/${repo}`, {
-				headers: { Accept: "application/vnd.github+json" },
-				signal: AbortSignal.timeout(5000),
-			});
-			if (res.ok) {
-				const data = (await res.json()) as { stargazers_count?: number };
-				if (data.stargazers_count) {
-					repoStars.set(repo, data.stargazers_count);
-					starsCache[repo] = { stars: data.stargazers_count, fetchedAt: new Date().toISOString() };
-					cacheUpdated = true;
-				}
-			} else if (cached) {
-				// Rate limited but have stale cache — use it
-				repoStars.set(repo, cached.stars);
-			}
-		} catch {
-			if (cached) repoStars.set(repo, cached.stars);
-		}
-	}
-	if (cacheUpdated) {
-		try { await fs.writeJson(starsCachePath, starsCache); } catch { /* ignore */ }
-	}
-
-	for (const rec of recommendedSkills) {
-		rec.stars = repoStars.get(rec.source.repo) || rec.stars || undefined;
-	}
-
-	// 4. Combine: recommended first, then popular (dedup by name)
+	// 3. Combine: recommended first, then popular (dedup by name)
 	const seen = new Set<string>(recommendedSkills.map((s) => s.name));
 	const deduped = popularSkills.filter((s) => !seen.has(s.name));
 

package/src/services/skillsmp-client.ts

@@ -11,7 +11,8 @@
 // Deployed `skills` Gen2 Cloud Function (project claudish-6da10, us-central1).
 // Firebase keeps this cloudfunctions.net alias stable for the function.
 const SKILLS_API_BASE =
-	process.env.SKILLS_API_URL || "https://us-central1-claudish-6da10.cloudfunctions.net/skills";
+	process.env.SKILLS_API_URL ||
+	"https://us-central1-claudish-6da10.cloudfunctions.net/skills";
 
 export interface SkillSearchResult {
 	name: string;
@@ -31,6 +32,54 @@ export interface RepoSkillResult {
 	description?: string;
 }
 
+export interface CuratedSkillSetResult {
+	name: string;
+	repo: string;
+	description: string;
+	icon: string;
+	stars?: number;
+	skillCount?: number;
+}
+
+export interface CuratedSkillResult extends SkillSearchResult {
+	description: string;
+	category: string;
+}
+
+export interface CuratedSkillsCatalogResult {
+	schemaVersion: number;
+	version: number;
+	generatedAt: string;
+	skills: CuratedSkillResult[];
+	skillSets: CuratedSkillSetResult[];
+}
+
+function isCuratedSkill(value: unknown): value is CuratedSkillResult {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const skill = value as Record<string, unknown>;
+	return (
+		typeof skill.name === "string" &&
+		typeof skill.repo === "string" &&
+		typeof skill.skillPath === "string" &&
+		typeof skill.description === "string" &&
+		typeof skill.category === "string" &&
+		(skill.stars === undefined || typeof skill.stars === "number")
+	);
+}
+
+function isCuratedSkillSet(value: unknown): value is CuratedSkillSetResult {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const set = value as Record<string, unknown>;
+	return (
+		typeof set.name === "string" &&
+		typeof set.repo === "string" &&
+		typeof set.description === "string" &&
+		typeof set.icon === "string" &&
+		(set.stars === undefined || typeof set.stars === "number") &&
+		(set.skillCount === undefined || typeof set.skillCount === "number")
+	);
+}
+
 /**
  * Thrown when the skills API is unreachable or returns a non-OK status.
  * Lets callers distinguish "search service is down" from "no skills matched",
@@ -106,14 +155,39 @@ export async function fetchRepoSkills(
  * Get recommended skills list (curated, server-side)
  */
 export async function fetchRecommendedSkills(): Promise<SkillSearchResult[]> {
+	return (await fetchCuratedSkillsCatalog()).skills;
+}
+
+/** Load the versioned install-ready catalog and skill-set definitions. */
+export async function fetchCuratedSkillsCatalog(): Promise<CuratedSkillsCatalogResult> {
+	let res: Response;
 	try {
-		const res = await fetch(`${SKILLS_API_BASE}/recommended`, {
-			signal: AbortSignal.timeout(5000),
+		res = await fetch(`${SKILLS_API_BASE}/recommended`, {
+			signal: AbortSignal.timeout(10000),
 		});
-		if (!res.ok) return [];
-		const data = (await res.json()) as { skills: SkillSearchResult[] };
-		return data.skills || [];
-	} catch {
-		return [];
+	} catch (cause) {
+		throw new SkillsApiError(
+			`Curated skills request failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+		);
+	}
+	if (!res.ok) {
+		throw new SkillsApiError(
+			`Curated skills returned HTTP ${res.status}`,
+			res.status,
+		);
+	}
+
+	const data = (await res.json()) as Partial<CuratedSkillsCatalogResult>;
+	if (
+		typeof data.schemaVersion !== "number" ||
+		typeof data.version !== "number" ||
+		typeof data.generatedAt !== "string" ||
+		!Array.isArray(data.skills) ||
+		!data.skills.every(isCuratedSkill) ||
+		!Array.isArray(data.skillSets) ||
+		!data.skillSets.every(isCuratedSkillSet)
+	) {
+		throw new SkillsApiError("Curated skills returned a malformed response");
 	}
+	return data as CuratedSkillsCatalogResult;
 }

package/src/ui/renderers/pluginRenderers.tsx

@@ -16,9 +16,13 @@ import {
 import { theme } from "../theme.js";
 import { highlightMatches } from "../../utils/fuzzy-search.js";
 import { getMarketplaceVersion } from "../../services/marketplace-fetcher.js";
-import { isEnabledButNotInstalled } from "../../services/plugin-manager.js";
+import {
+  isEnabledButNotInstalled,
+  isInstalledInScope,
+} from "../../services/plugin-manager.js";
 import { isKnownVersion } from "../../services/version-snapshot.js";
 import type { PluginRelease } from "../../types/index.js";
+import type { ScopeStatus } from "../../services/plugin-manager.js";
 
 // ─── Category renderers ───────────────────────────────────────────────────────
 
@@ -223,10 +227,14 @@ function pluginRow(item: PluginPluginItem, isSelected: boolean): React.ReactNode
 
 function pluginDetail(item: PluginPluginItem): React.ReactNode {
   const { plugin } = item;
+  // "Installed" has to mean the same thing here as in the list row. Reading the
+  // `enabledPlugins` flag alone made this panel print "● Installed" for the
+  // exact plugin the row beside it was labelling "not installed".
   const isInstalled =
-    plugin.userScope?.enabled ||
-    plugin.projectScope?.enabled ||
-    plugin.localScope?.enabled;
+    isInstalledInScope(plugin.userScope) ||
+    isInstalledInScope(plugin.projectScope) ||
+    isInstalledInScope(plugin.localScope);
+  const brokenInstall = isEnabledButNotInstalled(plugin);
 
   // Orphaned/deprecated plugin
   if (plugin.isOrphaned) {
@@ -284,10 +292,30 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
 
       {/* Status line */}
       <box marginTop={1}>
-        <text fg={isInstalled ? theme.colors.success : theme.colors.muted}>
-          {isInstalled ? "● Installed" : "○ Not installed"}
+        <text
+          fg={
+            isInstalled
+              ? theme.colors.success
+              : brokenInstall
+                ? theme.colors.warning
+                : theme.colors.muted
+          }
+        >
+          {isInstalled
+            ? "● Installed"
+            : brokenInstall
+              ? "○ Not installed — enabled in settings, no files on disk"
+              : "○ Not installed"}
         </text>
       </box>
+      {brokenInstall ? (
+        <box>
+          <text fg={theme.colors.muted}>
+            Claude Code cannot load it in this state. Press the scope key to
+            repair.
+          </text>
+        </box>
+      ) : null}
 
       {/* Description */}
       <box marginTop={1} marginBottom={1}>
@@ -331,48 +359,27 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
           <strong>Scopes:</strong>
         </text>
         <box marginTop={1} flexDirection="column">
-          <text>
-            <span bg={theme.scopes.user} fg="black">
-              {" "}
-              u{" "}
-            </span>
-            <span fg={plugin.userScope?.enabled ? theme.scopes.user : theme.colors.muted}>
-              {plugin.userScope?.enabled ? " ● " : " ○ "}
-            </span>
-            <span fg={theme.scopes.user}>User</span>
-            <span> global</span>
-            {plugin.userScope?.version ? (
-              <span fg={theme.scopes.user}> v{plugin.userScope.version}</span>
-            ) : null}
-          </text>
-          <text>
-            <span bg={theme.scopes.project} fg="black">
-              {" "}
-              p{" "}
-            </span>
-            <span fg={plugin.projectScope?.enabled ? theme.scopes.project : theme.colors.muted}>
-              {plugin.projectScope?.enabled ? " ● " : " ○ "}
-            </span>
-            <span fg={theme.scopes.project}>Project</span>
-            <span> team</span>
-            {plugin.projectScope?.version ? (
-              <span fg={theme.scopes.project}> v{plugin.projectScope.version}</span>
-            ) : null}
-          </text>
-          <text>
-            <span bg={theme.scopes.local} fg="black">
-              {" "}
-              l{" "}
-            </span>
-            <span fg={plugin.localScope?.enabled ? theme.scopes.local : theme.colors.muted}>
-              {plugin.localScope?.enabled ? " ● " : " ○ "}
-            </span>
-            <span fg={theme.scopes.local}>Local</span>
-            <span> private</span>
-            {plugin.localScope?.version ? (
-              <span fg={theme.scopes.local}> v{plugin.localScope.version}</span>
-            ) : null}
-          </text>
+          <ScopeLine
+            keyHint="u"
+            name="User"
+            qualifier="global"
+            color={theme.scopes.user}
+            scope={plugin.userScope}
+          />
+          <ScopeLine
+            keyHint="p"
+            name="Project"
+            qualifier="team"
+            color={theme.scopes.project}
+            scope={plugin.projectScope}
+          />
+          <ScopeLine
+            keyHint="l"
+            name="Local"
+            qualifier="private"
+            color={theme.scopes.local}
+            scope={plugin.localScope}
+          />
         </box>
       </DetailSection>
 
@@ -389,6 +396,47 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
   );
 }
 
+/**
+ * One line of the detail panel's scope breakdown.
+ *
+ * The filled dot means installed — registry-backed, same as everywhere else.
+ * A scope that is enabled with nothing installed is called out explicitly
+ * rather than shown as a plain empty dot, because those two states need
+ * different actions from the user and used to look identical.
+ */
+function ScopeLine({
+  keyHint,
+  name,
+  qualifier,
+  color,
+  scope,
+}: {
+  keyHint: string;
+  name: string;
+  qualifier: string;
+  color: string;
+  scope?: ScopeStatus;
+}): React.ReactNode {
+  const installed = isInstalledInScope(scope);
+  return (
+    <text>
+      <span bg={color} fg="black">
+        {" "}
+        {keyHint}{" "}
+      </span>
+      <span fg={installed ? color : theme.colors.muted}>
+        {installed ? " ● " : " ○ "}
+      </span>
+      <span fg={color}>{name}</span>
+      <span> {qualifier}</span>
+      {scope?.version ? <span fg={color}> v{scope.version}</span> : null}
+      {!installed && scope?.enabled ? (
+        <span fg={theme.colors.warning}> enabled, not installed</span>
+      ) : null}
+    </text>
+  );
+}
+
 /**
  * Recent release history, newest first.
  *