claudeup 4.36.0 → 4.37.0

package/src/services/plugin-manager.ts

@@ -1,9 +1,8 @@
 import path from "node:path";
-import os from "node:os";
-import { execSync } from "node:child_process";
 import {
 	getConfiguredMarketplaces,
 	getEnabledPlugins,
+	getGlobalClaudeDir,
 	readSettings,
 	writeSettings,
 	getGlobalConfiguredMarketplaces,
@@ -37,13 +36,22 @@ import {
 } from "../utils/string-utils.js";
 import {
 	clearMarketplaceCache as clearFetcherCache,
+	clearPersistedCatalogs,
 	fetchMarketplacePlugins,
+	getMarketplaceFetchFailures,
+	isAuthoritative,
 	resolveMarketplacePlugins,
+	type CatalogSource,
+	type MarketplaceFetchFailure,
 	type MarketplacePlugin,
 } from "./marketplace-fetcher.js";
 export {
 	fetchMarketplacePlugins,
+	getMarketplaceFetchFailures,
+	isAuthoritative,
 	resolveMarketplacePlugins,
+	type CatalogSource,
+	type MarketplaceFetchFailure,
 	type MarketplacePlugin,
 };
 // Cache for local marketplaces (session-level) - Promise-based to prevent race conditions
@@ -110,6 +118,29 @@ export interface PluginInfo {
 	 * Never set on the very first run, when there is no baseline to compare to.
 	 */
 	recentlyInstalled?: boolean;
+	/**
+	 * Which catalog supplied `version` — i.e. the number this plugin's installed
+	 * version was compared against.
+	 *
+	 * `remote` (HTTP) and `remote-git` (a `git fetch`ed remote ref) are both
+	 * authoritative — each is upstream's own catalog file. `local-clone` is the
+	 * checked-out working tree, which is deliberately pinned by
+	 * `autoUpdate: false`, so its versions can be arbitrarily old.
+	 */
+	catalogSource?: CatalogSource;
+	/**
+	 * Set when `hasUpdate: false` could not actually be verified — the catalog
+	 * fetch failed and the comparison ran against the pinned clone.
+	 *
+	 * This exists because the absence of an update was indistinguishable from a
+	 * successful check. A rate-limited fetch returned `[]`, the stale clone filled
+	 * in, its version compared equal to the installed one, and the UI reported
+	 * "up to date" — the failure rendered as a clean bill of health. Anything that
+	 * tells the user they are current must check this flag first.
+	 */
+	updateCheckFailed?: boolean;
+	/** Why the check failed, for display. Set with `updateCheckFailed`. */
+	updateCheckFailure?: MarketplaceFetchFailure;
 }
 
 /**
@@ -241,16 +272,30 @@ export async function getAvailablePlugins(
 	// Fetch local marketplace caches up front so we can detect stale caches
 	let localMarketplaces = await getLocalMarketplaces();
 
-	// Fetch plugins from each configured marketplace
-	for (const mpName of marketplaceNames) {
-		const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
-		if (!marketplace) continue;
+	// Resolve every marketplace concurrently. These are independent HTTP calls
+	// with a 10s timeout each; awaited in sequence, one unreachable marketplace
+	// added its full timeout to the "Loading..." the user stares at. Measured on
+	// six marketplaces with four unreachable: 44.9s sequential.
+	const resolutions = await Promise.all(
+		[...marketplaceNames].map(async (mpName) => {
+			const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
+			if (!marketplace) return null;
+			return {
+				mpName,
+				marketplace,
+				resolution: await resolveMarketplacePlugins(
+					mpName,
+					marketplace.source.repo,
+					localMarketplaces,
+				),
+			};
+		}),
+	);
 
-		const marketplacePlugins = await resolveMarketplacePlugins(
-			mpName,
-			marketplace.source.repo,
-			localMarketplaces,
-		);
+	for (const entry of resolutions) {
+		if (!entry) continue;
+		const { mpName, marketplace, resolution } = entry;
+		const marketplacePlugins = resolution.plugins;
 
 		// Auto-sync local cache if remote has plugins the local cache doesn't
 		localMarketplaces = await autoSyncIfStale(
@@ -259,6 +304,13 @@ export async function getAvailablePlugins(
 			localMarketplaces,
 		);
 
+		// The catalog that answered was not the authoritative one, so every
+		// version compare below is a guess, not a check.
+		// `remote-git` counts as verified: it is upstream's own catalog file, read
+		// through a git remote ref rather than over HTTP. Only the pinned working
+		// tree (`local-clone`) is untrustworthy for versions.
+		const unverified = !isAuthoritative(resolution.source);
+
 		for (const plugin of marketplacePlugins) {
 			const pluginId = `${plugin.name}@${mpName}`;
 			const installedVersion = installedVersions[pluginId];
@@ -279,6 +331,9 @@ export async function getAvailablePlugins(
 					installedVersion && plugin.version
 						? compareVersions(plugin.version, installedVersion) > 0
 						: false,
+				catalogSource: resolution.source,
+				updateCheckFailed: unverified,
+				updateCheckFailure: resolution.failure,
 				...scopeStatus,
 				category: plugin.category,
 				author: plugin.author,
@@ -438,16 +493,30 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 	// Fetch local marketplace caches up front so we can detect stale caches
 	let localMarketplaces = await getLocalMarketplaces();
 
-	// Fetch plugins from each configured marketplace
-	for (const mpName of marketplaceNames) {
-		const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
-		if (!marketplace) continue;
+	// Resolve every marketplace concurrently. These are independent HTTP calls
+	// with a 10s timeout each; awaited in sequence, one unreachable marketplace
+	// added its full timeout to the "Loading..." the user stares at. Measured on
+	// six marketplaces with four unreachable: 44.9s sequential.
+	const resolutions = await Promise.all(
+		[...marketplaceNames].map(async (mpName) => {
+			const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
+			if (!marketplace) return null;
+			return {
+				mpName,
+				marketplace,
+				resolution: await resolveMarketplacePlugins(
+					mpName,
+					marketplace.source.repo,
+					localMarketplaces,
+				),
+			};
+		}),
+	);
 
-		const marketplacePlugins = await resolveMarketplacePlugins(
-			mpName,
-			marketplace.source.repo,
-			localMarketplaces,
-		);
+	for (const entry of resolutions) {
+		if (!entry) continue;
+		const { mpName, marketplace, resolution } = entry;
+		const marketplacePlugins = resolution.plugins;
 
 		// Auto-sync local cache if remote has plugins the local cache doesn't
 		localMarketplaces = await autoSyncIfStale(
@@ -456,6 +525,13 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 			localMarketplaces,
 		);
 
+		// The catalog that answered was not the authoritative one, so every
+		// version compare below is a guess, not a check.
+		// `remote-git` counts as verified: it is upstream's own catalog file, read
+		// through a git remote ref rather than over HTTP. Only the pinned working
+		// tree (`local-clone`) is untrustworthy for versions.
+		const unverified = !isAuthoritative(resolution.source);
+
 		for (const plugin of marketplacePlugins) {
 			const pluginId = `${plugin.name}@${mpName}`;
 			const installedVersion = installedVersions[pluginId];
@@ -476,6 +552,9 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 					installedVersion && plugin.version
 						? compareVersions(plugin.version, installedVersion) > 0
 						: false,
+				catalogSource: resolution.source,
+				updateCheckFailed: unverified,
+				updateCheckFailure: resolution.failure,
 				...scopeStatus,
 				category: plugin.category,
 				author: plugin.author,
@@ -798,8 +877,11 @@ export async function refreshAllMarketplaces(
 ): Promise<RefreshAndRepairResult> {
 	onProgress?.({ current: 1, total: 1, name: "Clearing cache..." });
 
-	// Clear all caches to force fresh data
+	// Clear all caches to force fresh data. The on-disk catalog cache is awaited
+	// rather than fired and forgotten, so the refetch that follows cannot read the
+	// entries this is discarding.
 	clearMarketplaceCache();
+	await clearPersistedCatalogs();
 
 	// Auto-repair plugin.json files with missing agents/commands/skills
 	const repairResults = await repairAllMarketplaces();
@@ -810,76 +892,5 @@ export async function refreshAllMarketplaces(
 	};
 }
 
-export interface MarketplaceUpdateInfo {
-	name: string;
-	hasUpdate: boolean;
-	latestCommit?: string;
-	currentCommit?: string;
-}
-
-/**
- * Check if marketplaces have updates available on GitHub
- * Compares local git HEAD with remote HEAD
- */
-export async function checkMarketplaceUpdates(): Promise<
-	MarketplaceUpdateInfo[]
-> {
-	const results: MarketplaceUpdateInfo[] = [];
-	const localMarketplaces = await getLocalMarketplaces();
-
-	for (const [name, marketplace] of localMarketplaces) {
-		if (!marketplace.gitRepo) continue;
-
-		try {
-			const marketplacePath = path.join(
-				os.homedir(),
-				".claude",
-				"plugins",
-				"marketplaces",
-				name,
-			);
-
-			// Get current HEAD from local repo
-			let currentHead: string;
-			try {
-				currentHead = execSync("git rev-parse HEAD", {
-					cwd: marketplacePath,
-					encoding: "utf-8",
-					timeout: 5000,
-				}).trim();
-			} catch {
-				continue; // Skip if can't get HEAD
-			}
-
-			// Fetch latest commit from GitHub API
-			const apiUrl = `https://api.github.com/repos/${marketplace.gitRepo}/commits/main`;
-			const response = await fetch(apiUrl, {
-				signal: AbortSignal.timeout(10000),
-				headers: {
-					Accept: "application/vnd.github.v3+json",
-				},
-			});
-
-			if (response.ok) {
-				const data = (await response.json()) as { sha: string };
-				const latestCommit = data.sha;
-
-				results.push({
-					name,
-					hasUpdate: currentHead !== latestCommit,
-					currentCommit: currentHead.substring(0, 7),
-					latestCommit: latestCommit.substring(0, 7),
-				});
-			} else {
-				results.push({ name, hasUpdate: false });
-			}
-		} catch {
-			results.push({ name, hasUpdate: false });
-		}
-	}
-
-	return results;
-}
-
 // Re-export types for consumers
 export type { ProgressCallback };

package/src/ui/adapters/catalogNotice.ts

@@ -0,0 +1,122 @@
+/**
+ * catalogNotice.ts — the text of the Plugins screen's warning line.
+ *
+ * Extracted from PluginsScreen for the same reason as pluginsAdapter: so it can
+ * be tested without importing a React/OpenTUI screen. That is not merely tidier —
+ * importing the screen into a test pulls the renderer into the shared test process
+ * and broke fifteen unrelated tests.
+ *
+ * What this does NOT warn about, deliberately
+ * -------------------------------------------
+ * `autoUpdate: false` and a marketplace clone sitting behind its remote are both
+ * NORMAL here. Plugins are not auto-updated by policy; the UI's job is to show
+ * that an update exists, not to advance the install source. An earlier version of
+ * this banner reported both as problems and suggested
+ * `claude plugin marketplace update`, which would have defeated the policy it was
+ * complaining about. A warning that fires on intended behaviour trains the user to
+ * ignore the line.
+ *
+ * The one thing worth warning about is an update check that did not happen —
+ * because the alternative is claiming a plugin is current when nobody looked.
+ */
+
+import { formatWait } from "../../services/github-budget.js";
+import type { MarketplaceFetchFailure } from "../../services/marketplace-fetcher.js";
+
+export interface CatalogNoticeInput {
+	/** Catalogs that could not be read from any authoritative source. */
+	failures: MarketplaceFetchFailure[];
+	/** Installed plugins whose version could not be verified against upstream. */
+	unverifiedPlugins: number;
+	/** Terminal columns available for the line. */
+	width: number;
+	/** For the countdown; injected so tests are not clock-dependent. */
+	now?: number;
+}
+
+/**
+ * One line naming why some versions on screen could not be verified — or `null`
+ * when everything was actually checked.
+ *
+ * Returns `null` when there is nothing wrong: a banner that is always present is
+ * a banner nobody reads.
+ *
+ * Segments are added in priority order and dropped from the end when they do not
+ * fit `width`. Listing every failing marketplace overflowed an 80-column pane and
+ * took the retry hint with it — a warning truncated mid-sentence is barely better
+ * than no warning.
+ */
+export function buildCatalogNoticeText({
+	failures,
+	unverifiedPlugins,
+	width,
+	now = Date.now(),
+}: CatalogNoticeInput): string | null {
+	if (failures.length === 0) return null;
+
+	const segments: string[] = [];
+
+	// Lead with the reason, not the names: "rate limit" tells the user to wait,
+	// "timed out" tells them to check the network. That distinction is the whole
+	// value of classifying the failure, and it costs few characters.
+	const kinds = new Set(failures.map((f) => f.kind));
+	const rateLimited = kinds.has("rate-limited");
+	const reason = rateLimited
+		? "GitHub rate limit"
+		: kinds.has("timeout")
+			? "GitHub timed out"
+			: (failures[0]?.detail ?? "fetch failed");
+
+	const noun = failures.length === 1 ? "catalog" : "catalogs";
+	// Naming them only pays off when there are one or two; past that the count
+	// carries the same information in a fraction of the width.
+	const named =
+		failures.length <= 2
+			? `: ${failures.map((f) => f.marketplace).join(", ")}`
+			: "";
+	segments.push(`${failures.length} ${noun} unchecked (${reason})${named}`);
+
+	if (unverifiedPlugins > 0) {
+		segments.push(
+			`${unverifiedPlugins} version${unverifiedPlugins === 1 ? "" : "s"} unverified`,
+		);
+	}
+
+	// The countdown replaces the bare retry hint when we know when the window
+	// reopens. Answering "when can I try again" is the point: "try later" leaves
+	// the user to guess, and guessing wrong spends another request against the
+	// limit. Soonest retry across all failures, since that is when anything at all
+	// becomes possible again.
+	const retryAt = failures
+		.map((f) => f.retryAt)
+		.filter((t): t is number => typeof t === "number" && t > now)
+		.sort((a, b) => a - b)[0];
+
+	const hint = retryAt
+		? ` · retrying in ${formatWait(retryAt - now)}`
+		: " · r to retry";
+
+	// Column budget. `⚠` renders double-width in most terminals while
+	// `String.length` counts it as one, so one column is held back for it.
+	const maxColumns = Math.max(1, width - 1);
+
+	// The retry affordance is reserved out of the budget rather than appended: it
+	// is the only action the line offers, so it is the last thing that may be cut.
+	// No floor on what remains — a floor is what let a 40-column pane overflow by
+	// two, which is the whole failure mode this budget exists to prevent.
+	const messageBudget = maxColumns - hint.length;
+
+	let line = `⚠ ${segments[0]}`;
+	for (const segment of segments.slice(1)) {
+		const candidate = `${line} · ${segment}`;
+		if (candidate.length > messageBudget) break;
+		line = candidate;
+	}
+	if (line.length > messageBudget) {
+		line = messageBudget > 1 ? `${line.slice(0, messageBudget - 1)}…` : "";
+	}
+
+	// Absurdly narrow pane: the hint alone does not fit. Truncate it rather than
+	// return a line that overflows and corrupts the layout.
+	return `${line}${hint}`.slice(0, maxColumns);
+}

package/src/ui/components/layout/ScreenLayout.tsx

@@ -23,6 +23,15 @@ interface ScreenLayoutProps {
 	};
 	/** Status line content (for screens without search) - shown in second row */
 	statusLine?: React.ReactNode;
+	/**
+	 * One-line warning shown under the header, above the content.
+	 *
+	 * For conditions that make the data on screen untrustworthy — not for
+	 * transient progress. It sits in the fixed chrome rather than in a panel so it
+	 * cannot be scrolled out of view, and it takes a row from the panels only
+	 * while it is present.
+	 */
+	notice?: React.ReactNode;
 	/** Footer hints (left side). Pass a FooterHint[] to render key badges
 	 *  (the standard look). A string or ReactNode is still accepted for
 	 *  free-form footers. */
@@ -41,6 +50,7 @@ export function ScreenLayout({
 	currentScreen,
 	search,
 	statusLine,
+	notice,
 	footerHints,
 	listPanel,
 	detailPanel,
@@ -50,8 +60,8 @@ export function ScreenLayout({
 	const hasSearchBar = search && (search.isActive || search.query);
 
 	// Fixed chrome: top line + tabs + line + header + separator + footer = 6
-	// Search bar adds 1 when active
-	const fixedHeight = 6 + (hasSearchBar ? 1 : 0);
+	// Search bar adds 1 when active; the notice adds 1 while present.
+	const fixedHeight = 6 + (hasSearchBar ? 1 : 0) + (notice ? 1 : 0);
 	const panelHeight = Math.max(5, dimensions.contentHeight - fixedHeight);
 	const lineWidth = Math.max(10, dimensions.terminalWidth - 4);
 
@@ -108,6 +118,13 @@ export function ScreenLayout({
 				</box>
 			)}
 
+			{/* Warning line — only when the data on screen cannot be trusted */}
+			{notice && (
+				<box height={1} paddingLeft={1} paddingRight={1}>
+					{notice}
+				</box>
+			)}
+
 			{/* Separator below header */}
 			<box height={1} paddingLeft={1} paddingRight={1}>
 				<text fg={theme.colors.border}>{"─".repeat(lineWidth)}</text>

package/src/ui/renderers/pluginRenderers.tsx

@@ -181,6 +181,12 @@ function pluginRow(
 			// Same version, different files. The version compare says "up to date"
 			// and is wrong — only a reinstall delivers the current content.
 			versionStr += " stale — reinstall";
+		} else if (plugin.updateCheckFailed && versionStr) {
+			// No update to show — but we never confirmed there wasn't one. Neither
+			// upstream source could be read, so the compare ran against the pinned
+			// clone, which by policy never advances. A bare version here reads as
+			// "current", which is the exact claim we cannot make.
+			versionStr += " ? unverified";
 		}
 	}
 
@@ -247,7 +253,12 @@ function pluginRow(
 							? "danger"
 							: plugin.hasUpdate
 								? "warning"
-								: "muted"
+								: plugin.updateCheckFailed
+									? // Dimmer than a real update: nothing is known to be
+										// wrong. But not `muted` either, which is the colour
+										// of a verified-current plugin.
+										"warning"
+									: "muted"
 				}
 			/>
 		</text>
@@ -376,6 +387,33 @@ function pluginDetail(item: PluginPluginItem): React.ReactNode {
 					}
 				/>
 			) : null}
+			{/*
+			 * Name the source of the version above whenever it is not authoritative.
+			 * Without this the panel showed a version and an installed version that
+			 * happened to match, and the user reasonably read that as "current" —
+			 * when in fact GitHub was never reached and the number came off a clone
+			 * that had not moved in days.
+			 */}
+			{plugin.updateCheckFailed ? (
+				<>
+					<KeyValueLine
+						label="Latest"
+						value={
+							<span fg={theme.colors.warning}>unverified — not checked</span>
+						}
+					/>
+					<box>
+						<text fg={theme.colors.muted}>
+							{plugin.updateCheckFailure
+								? `  ${plugin.updateCheckFailure.detail}. `
+								: "  "}
+							{plugin.catalogSource === "local-clone"
+								? "Version shown is from the pinned marketplace clone, so a newer release may exist. Press r to retry."
+								: "Press r to retry."}
+						</text>
+					</box>
+				</>
+			) : null}
 			{plugin.category ? (
 				<KeyValueLine
 					label="Category"