claudeup 4.36.0 → 4.38.0

package/src/services/plugin-manager.ts

@@ -1,9 +1,8 @@
 import path from "node:path";
-import os from "node:os";
-import { execSync } from "node:child_process";
 import {
 	getConfiguredMarketplaces,
 	getEnabledPlugins,
+	getGlobalClaudeDir,
 	readSettings,
 	writeSettings,
 	getGlobalConfiguredMarketplaces,
@@ -37,13 +36,22 @@ import {
 } from "../utils/string-utils.js";
 import {
 	clearMarketplaceCache as clearFetcherCache,
+	clearPersistedCatalogs,
 	fetchMarketplacePlugins,
+	getMarketplaceFetchFailures,
+	isAuthoritative,
 	resolveMarketplacePlugins,
+	type CatalogSource,
+	type MarketplaceFetchFailure,
 	type MarketplacePlugin,
 } from "./marketplace-fetcher.js";
 export {
 	fetchMarketplacePlugins,
+	getMarketplaceFetchFailures,
+	isAuthoritative,
 	resolveMarketplacePlugins,
+	type CatalogSource,
+	type MarketplaceFetchFailure,
 	type MarketplacePlugin,
 };
 // Cache for local marketplaces (session-level) - Promise-based to prevent race conditions
@@ -110,6 +118,29 @@ export interface PluginInfo {
 	 * Never set on the very first run, when there is no baseline to compare to.
 	 */
 	recentlyInstalled?: boolean;
+	/**
+	 * Which catalog supplied `version` — i.e. the number this plugin's installed
+	 * version was compared against.
+	 *
+	 * `remote` (HTTP) and `remote-git` (a `git fetch`ed remote ref) are both
+	 * authoritative — each is upstream's own catalog file. `local-clone` is the
+	 * checked-out working tree, which is deliberately pinned by
+	 * `autoUpdate: false`, so its versions can be arbitrarily old.
+	 */
+	catalogSource?: CatalogSource;
+	/**
+	 * Set when `hasUpdate: false` could not actually be verified — the catalog
+	 * fetch failed and the comparison ran against the pinned clone.
+	 *
+	 * This exists because the absence of an update was indistinguishable from a
+	 * successful check. A rate-limited fetch returned `[]`, the stale clone filled
+	 * in, its version compared equal to the installed one, and the UI reported
+	 * "up to date" — the failure rendered as a clean bill of health. Anything that
+	 * tells the user they are current must check this flag first.
+	 */
+	updateCheckFailed?: boolean;
+	/** Why the check failed, for display. Set with `updateCheckFailed`. */
+	updateCheckFailure?: MarketplaceFetchFailure;
 }
 
 /**
@@ -241,16 +272,30 @@ export async function getAvailablePlugins(
 	// Fetch local marketplace caches up front so we can detect stale caches
 	let localMarketplaces = await getLocalMarketplaces();
 
-	// Fetch plugins from each configured marketplace
-	for (const mpName of marketplaceNames) {
-		const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
-		if (!marketplace) continue;
+	// Resolve every marketplace concurrently. These are independent HTTP calls
+	// with a 10s timeout each; awaited in sequence, one unreachable marketplace
+	// added its full timeout to the "Loading..." the user stares at. Measured on
+	// six marketplaces with four unreachable: 44.9s sequential.
+	const resolutions = await Promise.all(
+		[...marketplaceNames].map(async (mpName) => {
+			const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
+			if (!marketplace) return null;
+			return {
+				mpName,
+				marketplace,
+				resolution: await resolveMarketplacePlugins(
+					mpName,
+					marketplace.source.repo,
+					localMarketplaces,
+				),
+			};
+		}),
+	);
 
-		const marketplacePlugins = await resolveMarketplacePlugins(
-			mpName,
-			marketplace.source.repo,
-			localMarketplaces,
-		);
+	for (const entry of resolutions) {
+		if (!entry) continue;
+		const { mpName, marketplace, resolution } = entry;
+		const marketplacePlugins = resolution.plugins;
 
 		// Auto-sync local cache if remote has plugins the local cache doesn't
 		localMarketplaces = await autoSyncIfStale(
@@ -259,6 +304,13 @@ export async function getAvailablePlugins(
 			localMarketplaces,
 		);
 
+		// The catalog that answered was not the authoritative one, so every
+		// version compare below is a guess, not a check.
+		// `remote-git` counts as verified: it is upstream's own catalog file, read
+		// through a git remote ref rather than over HTTP. Only the pinned working
+		// tree (`local-clone`) is untrustworthy for versions.
+		const unverified = !isAuthoritative(resolution.source);
+
 		for (const plugin of marketplacePlugins) {
 			const pluginId = `${plugin.name}@${mpName}`;
 			const installedVersion = installedVersions[pluginId];
@@ -279,6 +331,9 @@ export async function getAvailablePlugins(
 					installedVersion && plugin.version
 						? compareVersions(plugin.version, installedVersion) > 0
 						: false,
+				catalogSource: resolution.source,
+				updateCheckFailed: unverified,
+				updateCheckFailure: resolution.failure,
 				...scopeStatus,
 				category: plugin.category,
 				author: plugin.author,
@@ -438,16 +493,30 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 	// Fetch local marketplace caches up front so we can detect stale caches
 	let localMarketplaces = await getLocalMarketplaces();
 
-	// Fetch plugins from each configured marketplace
-	for (const mpName of marketplaceNames) {
-		const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
-		if (!marketplace) continue;
+	// Resolve every marketplace concurrently. These are independent HTTP calls
+	// with a 10s timeout each; awaited in sequence, one unreachable marketplace
+	// added its full timeout to the "Loading..." the user stares at. Measured on
+	// six marketplaces with four unreachable: 44.9s sequential.
+	const resolutions = await Promise.all(
+		[...marketplaceNames].map(async (mpName) => {
+			const marketplace = defaultMarketplaces.find((m) => m.name === mpName);
+			if (!marketplace) return null;
+			return {
+				mpName,
+				marketplace,
+				resolution: await resolveMarketplacePlugins(
+					mpName,
+					marketplace.source.repo,
+					localMarketplaces,
+				),
+			};
+		}),
+	);
 
-		const marketplacePlugins = await resolveMarketplacePlugins(
-			mpName,
-			marketplace.source.repo,
-			localMarketplaces,
-		);
+	for (const entry of resolutions) {
+		if (!entry) continue;
+		const { mpName, marketplace, resolution } = entry;
+		const marketplacePlugins = resolution.plugins;
 
 		// Auto-sync local cache if remote has plugins the local cache doesn't
 		localMarketplaces = await autoSyncIfStale(
@@ -456,6 +525,13 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 			localMarketplaces,
 		);
 
+		// The catalog that answered was not the authoritative one, so every
+		// version compare below is a guess, not a check.
+		// `remote-git` counts as verified: it is upstream's own catalog file, read
+		// through a git remote ref rather than over HTTP. Only the pinned working
+		// tree (`local-clone`) is untrustworthy for versions.
+		const unverified = !isAuthoritative(resolution.source);
+
 		for (const plugin of marketplacePlugins) {
 			const pluginId = `${plugin.name}@${mpName}`;
 			const installedVersion = installedVersions[pluginId];
@@ -476,6 +552,9 @@ export async function getGlobalAvailablePlugins(): Promise<PluginInfo[]> {
 					installedVersion && plugin.version
 						? compareVersions(plugin.version, installedVersion) > 0
 						: false,
+				catalogSource: resolution.source,
+				updateCheckFailed: unverified,
+				updateCheckFailure: resolution.failure,
 				...scopeStatus,
 				category: plugin.category,
 				author: plugin.author,
@@ -798,8 +877,11 @@ export async function refreshAllMarketplaces(
 ): Promise<RefreshAndRepairResult> {
 	onProgress?.({ current: 1, total: 1, name: "Clearing cache..." });
 
-	// Clear all caches to force fresh data
+	// Clear all caches to force fresh data. The on-disk catalog cache is awaited
+	// rather than fired and forgotten, so the refetch that follows cannot read the
+	// entries this is discarding.
 	clearMarketplaceCache();
+	await clearPersistedCatalogs();
 
 	// Auto-repair plugin.json files with missing agents/commands/skills
 	const repairResults = await repairAllMarketplaces();
@@ -810,76 +892,5 @@ export async function refreshAllMarketplaces(
 	};
 }
 
-export interface MarketplaceUpdateInfo {
-	name: string;
-	hasUpdate: boolean;
-	latestCommit?: string;
-	currentCommit?: string;
-}
-
-/**
- * Check if marketplaces have updates available on GitHub
- * Compares local git HEAD with remote HEAD
- */
-export async function checkMarketplaceUpdates(): Promise<
-	MarketplaceUpdateInfo[]
-> {
-	const results: MarketplaceUpdateInfo[] = [];
-	const localMarketplaces = await getLocalMarketplaces();
-
-	for (const [name, marketplace] of localMarketplaces) {
-		if (!marketplace.gitRepo) continue;
-
-		try {
-			const marketplacePath = path.join(
-				os.homedir(),
-				".claude",
-				"plugins",
-				"marketplaces",
-				name,
-			);
-
-			// Get current HEAD from local repo
-			let currentHead: string;
-			try {
-				currentHead = execSync("git rev-parse HEAD", {
-					cwd: marketplacePath,
-					encoding: "utf-8",
-					timeout: 5000,
-				}).trim();
-			} catch {
-				continue; // Skip if can't get HEAD
-			}
-
-			// Fetch latest commit from GitHub API
-			const apiUrl = `https://api.github.com/repos/${marketplace.gitRepo}/commits/main`;
-			const response = await fetch(apiUrl, {
-				signal: AbortSignal.timeout(10000),
-				headers: {
-					Accept: "application/vnd.github.v3+json",
-				},
-			});
-
-			if (response.ok) {
-				const data = (await response.json()) as { sha: string };
-				const latestCommit = data.sha;
-
-				results.push({
-					name,
-					hasUpdate: currentHead !== latestCommit,
-					currentCommit: currentHead.substring(0, 7),
-					latestCommit: latestCommit.substring(0, 7),
-				});
-			} else {
-				results.push({ name, hasUpdate: false });
-			}
-		} catch {
-			results.push({ name, hasUpdate: false });
-		}
-	}
-
-	return results;
-}
-
 // Re-export types for consumers
 export type { ProgressCallback };