claudeup 4.36.0 → 4.37.0

package/src/__tests__/plugin-manager-fallback.test.ts

@@ -1,13 +1,43 @@
-import { describe, it, expect, beforeEach } from "bun:test";
+import { describe, it, expect, beforeEach, afterAll, beforeAll } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import {
-  resolveMarketplacePlugins,
   clearMarketplaceCache,
+  fetchMarketplacePlugins,
+  getMarketplaceFetchFailures,
+  resolveMarketplacePlugins,
 } from "../services/marketplace-fetcher";
+import { resetGitHubBudget } from "../services/github-budget";
 import type {
   LocalMarketplace,
   LocalMarketplacePlugin,
 } from "../services/local-marketplace";
 
+/**
+ * Point the marketplace-clone lookup at an EMPTY temp directory.
+ *
+ * `resolveMarketplacePlugins` now consults a git remote ref before falling back
+ * to the checked-out clone. Without this, these tests found the operator's real
+ * `magus` clone, performed a live `git fetch`, and asserted against whatever
+ * happened to be published — 17 real plugins instead of the 2 in the fixture, and
+ * three seconds per test.
+ */
+let prevConfigDir: string | undefined;
+let emptyConfigDir: string;
+
+beforeAll(() => {
+  emptyConfigDir = fs.mkdtempSync(path.join(os.tmpdir(), "mp-fallback-"));
+  prevConfigDir = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = emptyConfigDir;
+});
+
+afterAll(() => {
+  if (prevConfigDir === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+  else process.env.CLAUDE_CONFIG_DIR = prevConfigDir;
+  fs.rmSync(emptyConfigDir, { recursive: true, force: true });
+});
+
 /**
  * Regression coverage for the "deprecated everything" bug.
  *
@@ -33,6 +63,10 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
     // Session-level cache could otherwise carry over a previous test's
     // successful fetch and short-circuit the fallback path.
     clearMarketplaceCache();
+    // The per-host cooldown is deliberately NOT cleared by clearMarketplaceCache
+    // — it reflects GitHub's state, not ours — so a 429 in one test would
+    // otherwise gate every fetch in the next for the full backoff.
+    resetGitHubBudget();
   });
 
   it("falls back to the local cache when the remote fetch returns empty", async () => {
@@ -64,18 +98,45 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       local,
     );
 
-    expect(resolved).toHaveLength(2);
-    expect(resolved.map((p) => p.name).sort()).toEqual([
+    expect(resolved.plugins).toHaveLength(2);
+    expect(resolved.plugins.map((p) => p.name).sort()).toEqual([
       "code-analysis",
       "dev",
     ]);
-    const codeAnalysis = resolved.find((p) => p.name === "code-analysis");
+    const codeAnalysis = resolved.plugins.find(
+      (p) => p.name === "code-analysis",
+    );
     expect(codeAnalysis?.version).toBe("5.3.0");
     expect(codeAnalysis?.description).toBe("Codebase investigation tools");
     expect(codeAnalysis?.category).toBe("development");
     expect(codeAnalysis?.author?.name).toBe("Jack Rudenko");
   });
 
+  it("labels the fallback answer as local-clone, not remote", async () => {
+    // The regression this guards: the fallback plugins were returned in the
+    // same shape as a successful remote fetch, so the caller compared installed
+    // versions against a clone nothing refreshes and reported "up to date".
+    // The source must travel with the data.
+    const local = new Map<string, LocalMarketplace>([
+      [
+        "magus",
+        buildLocalMarketplace("magus", [
+          { name: "terminal", version: "4.1.4", description: "" },
+        ]),
+      ],
+    ]);
+    const resolved = await resolveMarketplacePlugins(
+      "magus",
+      "not a valid repo string",
+      local,
+    );
+
+    expect(resolved.source).toBe("local-clone");
+    expect(resolved.failure).toBeDefined();
+    expect(resolved.failure?.kind).toBe("invalid-repo");
+    expect(resolved.failure?.marketplace).toBe("magus");
+  });
+
   it("returns empty when both remote and cache are empty", async () => {
     const local = new Map<string, LocalMarketplace>();
     const resolved = await resolveMarketplacePlugins(
@@ -83,7 +144,9 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       "not a valid repo string",
       local,
     );
-    expect(resolved).toEqual([]);
+    expect(resolved.plugins).toEqual([]);
+    expect(resolved.source).toBe("none");
+    expect(resolved.failure).toBeDefined();
   });
 
   it("returns empty when remote fails AND cache exists but has no plugins", async () => {
@@ -95,7 +158,8 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       "not a valid repo string",
       local,
     );
-    expect(resolved).toEqual([]);
+    expect(resolved.plugins).toEqual([]);
+    expect(resolved.source).toBe("none");
   });
 
   it("does not consult the cache when the remote returns plugins", async () => {
@@ -115,6 +179,134 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       "not a valid repo string",
       local,
     );
-    expect(resolved).toEqual([]);
+    expect(resolved.plugins).toEqual([]);
+    expect(resolved.source).toBe("none");
+  });
+});
+
+/**
+ * The defect class these cover: a failed check that renders as a passed one.
+ *
+ * `fetchMarketplacePlugins` used to return `[]` for a rate limit, a timeout, a
+ * bad repo string and a genuinely empty marketplace alike. Every caller then had
+ * to guess, and all of them guessed "fine".
+ */
+describe("fetchMarketplacePlugins — failures are values", () => {
+  beforeEach(() => {
+    clearMarketplaceCache();
+    resetGitHubBudget();
+  });
+
+  it("classifies a rate limit distinctly from a network problem", async () => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response("rate limited", {
+        status: 429,
+        statusText: "Too Many Requests",
+      })) as typeof globalThis.fetch;
+    try {
+      const result = await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(result.plugins).toEqual([]);
+      expect(result.failure?.kind).toBe("rate-limited");
+      expect(result.failure?.httpStatus).toBe(429);
+      expect(result.failure?.detail).toContain("rate limit");
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("records the failure so the UI can report it without re-fetching", async () => {
+    const original = globalThis.fetch;
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      return new Response("nope", { status: 500, statusText: "Server Error" });
+    }) as typeof globalThis.fetch;
+    try {
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+
+      const failures = getMarketplaceFetchFailures();
+      expect(failures.map((f) => f.marketplace)).toContain("magus");
+      expect(failures.find((f) => f.marketplace === "magus")?.kind).toBe("http");
+
+      // Second call must be served from the negative cache. Re-attempting on
+      // every screen mount is what cost 30-45s of "Loading..." per tab switch.
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(calls).toBe(1);
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("reports no failures when the fetch succeeds", async () => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      Response.json({
+        metadata: { version: "9.0.3" },
+        plugins: [{ name: "terminal", version: "4.1.6" }],
+      })) as typeof globalThis.fetch;
+    try {
+      const result = await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(result.failure).toBeUndefined();
+      expect(result.plugins).toHaveLength(1);
+      expect(getMarketplaceFetchFailures()).toEqual([]);
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("does not send a request while the rate-limit window is still open", async () => {
+    // Deliberate: an explicit refresh clears OUR caches but not GitHub's limit.
+    // Retrying inside a known window cannot succeed, and on some endpoints a
+    // rejected request extends the penalty — so the screen waits and counts down
+    // instead. `clearMarketplaceCache()` must not be a way around that.
+    const original = globalThis.fetch;
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      return new Response("nope", { status: 429 });
+    }) as typeof globalThis.fetch;
+    try {
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(calls).toBe(1);
+
+      clearMarketplaceCache();
+      const second = await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+
+      expect(calls).toBe(1); // no second request went out
+      expect(second.failure?.kind).toBe("rate-limited");
+      expect(second.failure?.retryAt).toBeGreaterThan(Date.now());
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("clears the recorded failure once the window passes and the fetch succeeds", async () => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response("nope", { status: 429 })) as typeof globalThis.fetch;
+    try {
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(getMarketplaceFetchFailures()).toHaveLength(1);
+
+      // The cooldown expiring is what unblocks the retry — this stands in for the
+      // clock reaching `retryAt`, which is when the screen refetches by itself.
+      resetGitHubBudget();
+      clearMarketplaceCache();
+      globalThis.fetch = (async () =>
+        Response.json({
+          plugins: [{ name: "terminal", version: "4.2.0" }],
+        })) as typeof globalThis.fetch;
+
+      const recovered = await fetchMarketplacePlugins(
+        "magus",
+        "MadAppGang/magus",
+      );
+      expect(recovered.failure).toBeUndefined();
+      expect(recovered.plugins).toHaveLength(1);
+      expect(getMarketplaceFetchFailures()).toEqual([]);
+    } finally {
+      globalThis.fetch = original;
+    }
   });
 });

package/src/services/catalog-cache-store.ts

@@ -0,0 +1,218 @@
+/**
+ * catalog-cache-store.ts — the catalog cache and the rate-limit cooldown, on disk.
+ *
+ * Why on disk
+ * -----------
+ * Every cache in this area used to be a module-level `Map`, which for a TUI means
+ * "cleared on every launch". Measured 2026-08-17, two consecutive processes:
+ *
+ *   [process-1] 6 HTTP requests in 13.32s
+ *   [process-2] 6 HTTP requests in 13.01s
+ *
+ * So each launch re-fetched all six catalogs, and the second process had no idea
+ * the first had just been rate-limited — it spent six more requests rediscovering
+ * that. On some endpoints a rejected request extends the penalty, so an in-memory
+ * cooldown is not merely useless across launches, it is counterproductive.
+ *
+ * Persisting the cooldown is the more important half. A stale catalog costs the
+ * user a version number that is an hour old; re-firing six doomed requests on
+ * every launch costs them the ability to check at all.
+ *
+ * Trade-off, stated
+ * -----------------
+ * A cached catalog means a release published inside the TTL is not visible yet.
+ * That is why the TTL is short, why `r` forces a real refetch, and why the age is
+ * available for display. A cache the user cannot see through or override would be
+ * the same trap as a frozen clone.
+ */
+
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { claudeConfigDirOrNull } from "../utils/config-dir.js";
+import { withFileLock } from "../utils/file-locking.js";
+import type { MarketplacePlugin } from "./marketplace-catalog.js";
+
+/**
+ * How long a cached catalog is served before we ask again.
+ *
+ * Matches the hour that `update-cache.ts` already uses for its own check, so the
+ * tool has one refresh rhythm rather than two.
+ */
+export const CATALOG_TTL_MS = 60 * 60 * 1000;
+
+interface StoredCatalog {
+	fetchedAt: number;
+	/** Which transport answered — carried so the UI can still say "unverified". */
+	source: string;
+	plugins: MarketplacePlugin[];
+}
+
+interface StoredCooldown {
+	until: number;
+	exact: boolean;
+	strikes: number;
+}
+
+interface StoreShape {
+	version: 1;
+	catalogs: Record<string, StoredCatalog>;
+	cooldowns: Record<string, StoredCooldown>;
+}
+
+const EMPTY: StoreShape = { version: 1, catalogs: {}, cooldowns: {} };
+
+/**
+ * Resolved per call, honouring CLAUDE_CONFIG_DIR — same reasoning as
+ * content-drift.ts and marketplace-catalog-git.ts.
+ *
+ * Null when a test has not chosen a config dir, which makes this whole store inert
+ * rather than letting an unisolated test read the operator's live cooldown and
+ * decide its own outcome from it. See utils/config-dir.ts.
+ */
+function storePath(): string | null {
+	const configDir = claudeConfigDirOrNull();
+	if (!configDir) return null;
+	return path.join(configDir, "claudeup-catalog-cache.json");
+}
+
+/**
+ * Read-through memo for this process. The disk file is the cross-launch cache;
+ * this just avoids re-reading and re-parsing it on every lookup within one run.
+ */
+let memo: { path: string; data: StoreShape } | null = null;
+
+async function load(): Promise<StoreShape> {
+	const file = storePath();
+	if (!file) return { version: 1, catalogs: {}, cooldowns: {} };
+	if (memo?.path === file) return memo.data;
+	try {
+		const parsed = JSON.parse(await fs.readFile(file, "utf-8")) as StoreShape;
+		// A cache from a future/unknown layout is discarded rather than migrated:
+		// it is regenerable by definition, so guessing at it buys nothing.
+		const data = parsed?.version === 1 ? parsed : { ...EMPTY };
+		data.catalogs ??= {};
+		data.cooldowns ??= {};
+		memo = { path: file, data };
+		return data;
+	} catch {
+		// Absent or corrupt. A cache must never be a failure mode — start empty.
+		const data: StoreShape = { ...EMPTY, catalogs: {}, cooldowns: {} };
+		memo = { path: file, data };
+		return data;
+	}
+}
+
+/**
+ * Apply a mutation and persist it.
+ *
+ * Locked and re-read inside the lock, because two claudeup processes can be open
+ * at once and a blind read-modify-write would drop the other's cooldown — exactly
+ * the record we most need to keep.
+ */
+async function mutate(fn: (data: StoreShape) => void): Promise<void> {
+	const file = storePath();
+	if (!file) return;
+	try {
+		await fs.mkdir(path.dirname(file), { recursive: true });
+		await withFileLock(file, async () => {
+			let onDisk: StoreShape;
+			try {
+				const parsed = JSON.parse(await fs.readFile(file, "utf-8")) as StoreShape;
+				onDisk =
+					parsed?.version === 1
+						? { version: 1, catalogs: parsed.catalogs ?? {}, cooldowns: parsed.cooldowns ?? {} }
+						: { version: 1, catalogs: {}, cooldowns: {} };
+			} catch {
+				onDisk = { version: 1, catalogs: {}, cooldowns: {} };
+			}
+			fn(onDisk);
+			// Temp + rename, so a crash mid-write cannot leave a half-written file
+			// that the next launch has to treat as corrupt.
+			const tmp = `${file}.${process.pid}.tmp`;
+			await fs.writeFile(tmp, JSON.stringify(onDisk), "utf-8");
+			await fs.rename(tmp, file);
+			memo = { path: file, data: onDisk };
+		});
+	} catch {
+		// Never let a cache write break the run. Worst case we re-fetch next time.
+	}
+}
+
+// ─── Catalogs ────────────────────────────────────────────────────────────────
+
+export interface CachedCatalog {
+	plugins: MarketplacePlugin[];
+	source: string;
+	/** Milliseconds since it was fetched — for display, and for the TTL test. */
+	ageMs: number;
+}
+
+/** A cached catalog for this marketplace, if one is present and still fresh. */
+export async function readCachedCatalog(
+	marketplace: string,
+	now: number = Date.now(),
+): Promise<CachedCatalog | null> {
+	const data = await load();
+	const entry = data.catalogs[marketplace];
+	if (!entry) return null;
+	const ageMs = now - entry.fetchedAt;
+	if (ageMs < 0 || ageMs > CATALOG_TTL_MS) return null;
+	return { plugins: entry.plugins, source: entry.source, ageMs };
+}
+
+export async function writeCachedCatalog(
+	marketplace: string,
+	plugins: MarketplacePlugin[],
+	source: string,
+	now: number = Date.now(),
+): Promise<void> {
+	// An empty catalog is never worth caching: it is indistinguishable from a
+	// failure we did not classify, and serving it would resurrect the original bug.
+	if (plugins.length === 0) return;
+	await mutate((data) => {
+		data.catalogs[marketplace] = { fetchedAt: now, source, plugins };
+	});
+}
+
+/** Drop every cached catalog. Backs the explicit refresh (`r`). */
+export async function clearCachedCatalogs(): Promise<void> {
+	await mutate((data) => {
+		data.catalogs = {};
+	});
+}
+
+// ─── Cooldowns ───────────────────────────────────────────────────────────────
+
+export async function readStoredCooldowns(
+	now: number = Date.now(),
+): Promise<Record<string, StoredCooldown>> {
+	const data = await load();
+	const live: Record<string, StoredCooldown> = {};
+	for (const [host, cooldown] of Object.entries(data.cooldowns)) {
+		// Expired entries are dropped on read rather than persisted forever. The
+		// strike count goes with them: a cooldown that lapsed a day ago should not
+		// make today's first failure back off for ten minutes.
+		if (cooldown.until > now) live[host] = cooldown;
+	}
+	return live;
+}
+
+export async function writeStoredCooldown(
+	host: string,
+	cooldown: StoredCooldown,
+): Promise<void> {
+	await mutate((data) => {
+		data.cooldowns[host] = cooldown;
+	});
+}
+
+export async function clearStoredCooldown(host: string): Promise<void> {
+	await mutate((data) => {
+		delete data.cooldowns[host];
+	});
+}
+
+/** Test seam: forget this process's memo so the next read hits disk. */
+export function resetCatalogCacheMemo(): void {
+	memo = null;
+}