claudeup 4.36.0 → 4.38.0

package/src/__tests__/github-budget.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect, beforeEach } from "bun:test";
+import {
+  activeCooldowns,
+  cooldownFor,
+  describeCooldown,
+  formatWait,
+  hostOf,
+  recordRateLimit,
+  recordSuccess,
+  remainingFromHeaders,
+  resetGitHubBudget,
+  waitMs,
+} from "../services/github-budget";
+
+/**
+ * The design hinges on one measured asymmetry (2026-08-17):
+ *
+ *   api.github.com            429/403 carries x-ratelimit-reset and retry-after
+ *   raw.githubusercontent.com 429 carries NEITHER — only a request id and a date
+ *
+ * So the module must be able to say "resets in 4m" when GitHub said so, and must
+ * NOT say it otherwise. Fabricating a reset time would be the same sin as the
+ * original bug: reporting a guess as a fact.
+ */
+
+const NOW = 1_786_980_000_000;
+
+beforeEach(() => {
+  resetGitHubBudget();
+});
+
+describe("hostOf", () => {
+  it("recognises the two budgeted hosts and nothing else", () => {
+    expect(hostOf("https://api.github.com/repos/x/y")).toBe("api.github.com");
+    expect(hostOf("https://raw.githubusercontent.com/x/y/main/f.json")).toBe(
+      "raw.githubusercontent.com",
+    );
+    expect(hostOf("https://github.com/x/y")).toBeNull();
+    expect(hostOf("not a url")).toBeNull();
+  });
+});
+
+describe("recordRateLimit — exact timing when GitHub provides it", () => {
+  it("honours retry-after in seconds", () => {
+    const cooldown = recordRateLimit(
+      "api.github.com",
+      new Headers({ "retry-after": "120" }),
+      NOW,
+    );
+    expect(cooldown.exact).toBe(true);
+    expect(cooldown.until).toBe(NOW + 120_000);
+    expect(describeCooldown(cooldown, NOW)).toBe(
+      "GitHub rate limit resets in 2m",
+    );
+  });
+
+  it("honours retry-after as an HTTP date", () => {
+    const when = new Date(NOW + 300_000).toUTCString();
+    const cooldown = recordRateLimit(
+      "api.github.com",
+      new Headers({ "retry-after": when }),
+      NOW,
+    );
+    expect(cooldown.exact).toBe(true);
+    // UTCString drops sub-second precision, so allow a second of slack.
+    expect(Math.abs(cooldown.until - (NOW + 300_000))).toBeLessThanOrEqual(1000);
+  });
+
+  it("reads x-ratelimit-reset as epoch SECONDS, not milliseconds", () => {
+    // Treating it as ms lands in 1970, so the cooldown expires instantly and the
+    // UI reports "not rate limited" while GitHub is still refusing every call.
+    const resetEpochSeconds = Math.floor(NOW / 1000) + 600;
+    const cooldown = recordRateLimit(
+      "api.github.com",
+      new Headers({ "x-ratelimit-reset": String(resetEpochSeconds) }),
+      NOW,
+    );
+    expect(cooldown.exact).toBe(true);
+    expect(cooldown.until).toBe(resetEpochSeconds * 1000);
+    expect(waitMs("api.github.com", NOW)).toBeGreaterThan(0);
+  });
+
+  it("caps an implausible server window so a bad header cannot wedge the UI", () => {
+    const cooldown = recordRateLimit(
+      "api.github.com",
+      new Headers({ "retry-after": String(60 * 60 * 24 * 30) }),
+      NOW,
+    );
+    expect(cooldown.until - NOW).toBeLessThanOrEqual(60 * 60_000);
+  });
+});
+
+describe("recordRateLimit — backoff when GitHub provides nothing", () => {
+  it("does not claim a reset time it was never told", () => {
+    // This is the raw.githubusercontent.com case, measured: a bare 429.
+    const cooldown = recordRateLimit(
+      "raw.githubusercontent.com",
+      new Headers(),
+      NOW,
+    );
+    expect(cooldown.exact).toBe(false);
+    expect(describeCooldown(cooldown, NOW)).toContain("next attempt in");
+    expect(describeCooldown(cooldown, NOW)).not.toContain("resets in");
+  });
+
+  it("backs off further on each consecutive failure", () => {
+    const first = recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+    const second = recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+    const third = recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+    expect(second.until).toBeGreaterThan(first.until);
+    expect(third.until).toBeGreaterThan(second.until);
+    expect(third.strikes).toBe(3);
+  });
+
+  it("ignores a retry-after that is garbage or already past", () => {
+    const garbage = recordRateLimit(
+      "raw.githubusercontent.com",
+      new Headers({ "retry-after": "soon-ish" }),
+      NOW,
+    );
+    expect(garbage.exact).toBe(false);
+    expect(garbage.until).toBeGreaterThan(NOW);
+  });
+});
+
+describe("the gate", () => {
+  it("blocks while cooling and clears when the window passes", () => {
+    const cooldown = recordRateLimit(
+      "raw.githubusercontent.com",
+      undefined,
+      NOW,
+    );
+    expect(cooldownFor("raw.githubusercontent.com", NOW)).not.toBeNull();
+    expect(
+      cooldownFor("raw.githubusercontent.com", cooldown.until + 1),
+    ).toBeNull();
+    expect(waitMs("raw.githubusercontent.com", cooldown.until + 1)).toBe(0);
+  });
+
+  it("keeps the two hosts on separate budgets", () => {
+    // They are separate buckets upstream. Blocking raw because the API is
+    // exhausted would stop work that would have succeeded.
+    recordRateLimit("api.github.com", new Headers({ "retry-after": "60" }), NOW);
+    expect(cooldownFor("api.github.com", NOW)).not.toBeNull();
+    expect(cooldownFor("raw.githubusercontent.com", NOW)).toBeNull();
+  });
+
+  it("clears the cooldown and the strike count on success", () => {
+    // Without resetting strikes, one bad afternoon pins the backoff at ten
+    // minutes for the rest of the session even though calls are succeeding.
+    recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+    recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+    recordSuccess("raw.githubusercontent.com");
+    expect(cooldownFor("raw.githubusercontent.com", NOW)).toBeNull();
+
+    const afterRecovery = recordRateLimit(
+      "raw.githubusercontent.com",
+      undefined,
+      NOW,
+    );
+    expect(afterRecovery.strikes).toBe(1);
+  });
+
+  it("lists active cooldowns soonest first", () => {
+    recordRateLimit(
+      "api.github.com",
+      new Headers({ "retry-after": "600" }),
+      NOW,
+    );
+    recordRateLimit(
+      "raw.githubusercontent.com",
+      new Headers({ "retry-after": "30" }),
+      NOW,
+    );
+    const active = activeCooldowns(NOW);
+    expect(active.map((c) => c.host)).toEqual([
+      "raw.githubusercontent.com",
+      "api.github.com",
+    ]);
+  });
+});
+
+describe("remainingFromHeaders", () => {
+  it("reads the budget so a caller can stop before tripping the limit", () => {
+    expect(
+      remainingFromHeaders(new Headers({ "x-ratelimit-remaining": "51" })),
+    ).toBe(51);
+    expect(remainingFromHeaders(new Headers())).toBeNull();
+  });
+});
+
+describe("formatWait", () => {
+  it("reads naturally at every scale", () => {
+    expect(formatWait(0)).toBe("0s");
+    expect(formatWait(45_000)).toBe("45s");
+    expect(formatWait(90_000)).toBe("2m");
+    expect(formatWait(3_600_000)).toBe("1h 0m");
+    expect(formatWait(4_320_000)).toBe("1h 12m");
+  });
+});

package/src/__tests__/open-file.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, test } from "bun:test";
+import { openInDefaultApp, openerFor } from "../utils/open-file.js";
+
+describe("openerFor", () => {
+	test("uses the macOS opener on darwin", () => {
+		expect(openerFor("darwin")).toEqual({ command: "open", args: [] });
+	});
+
+	test("uses xdg-open on linux", () => {
+		// claudeup ships a linux-x64 binary, and the pre-existing `open "${url}"`
+		// call elsewhere in the UI silently does nothing there.
+		expect(openerFor("linux")).toEqual({ command: "xdg-open", args: [] });
+	});
+
+	test("passes an empty window title to cmd start on windows", () => {
+		// `start` treats its first quoted argument as the window title, so
+		// without the empty string a quoted path is consumed as one.
+		expect(openerFor("win32")).toEqual({
+			command: "cmd",
+			args: ["/c", "start", ""],
+		});
+	});
+
+	test("falls back to xdg-open on anything else", () => {
+		expect(openerFor("freebsd").command).toBe("xdg-open");
+	});
+});
+
+describe("openInDefaultApp", () => {
+	const missingOpener = {
+		command: "claudeup-test-opener-that-cannot-exist",
+		args: [],
+	};
+
+	test("reports a missing opener rather than failing silently", async () => {
+		// An injected command that cannot exist, NOT a real platform's opener.
+		// The first version assumed `xdg-open` was absent — true on a Mac dev
+		// box, false on the Ubuntu CI runner, where it both failed the
+		// assertion and spawned a real opener on the build machine.
+		await expect(
+			openInDefaultApp("/tmp/whatever.md", "linux", missingOpener),
+		).rejects.toThrow(/not on PATH/);
+	});
+
+	test("settles promptly instead of hanging", async () => {
+		// The promise must settle when the child is spawned, not when the viewer
+		// is closed — waiting for exit would freeze the TUI for as long as the
+		// user's editor stayed open. Asserted on the error path so the suite
+		// never launches a real application on the developer's desktop.
+		const settled = await Promise.race([
+			openInDefaultApp("/tmp/whatever.md", "linux", missingOpener).then(
+				() => "resolved",
+				() => "rejected",
+			),
+			new Promise((resolve) => setTimeout(() => resolve("timeout"), 2000)),
+		]);
+		expect(settled).not.toBe("timeout");
+	});
+});

package/src/__tests__/plugin-manager-fallback.test.ts

@@ -1,13 +1,43 @@
-import { describe, it, expect, beforeEach } from "bun:test";
+import { describe, it, expect, beforeEach, afterAll, beforeAll } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import {
-  resolveMarketplacePlugins,
   clearMarketplaceCache,
+  fetchMarketplacePlugins,
+  getMarketplaceFetchFailures,
+  resolveMarketplacePlugins,
 } from "../services/marketplace-fetcher";
+import { resetGitHubBudget } from "../services/github-budget";
 import type {
   LocalMarketplace,
   LocalMarketplacePlugin,
 } from "../services/local-marketplace";
 
+/**
+ * Point the marketplace-clone lookup at an EMPTY temp directory.
+ *
+ * `resolveMarketplacePlugins` now consults a git remote ref before falling back
+ * to the checked-out clone. Without this, these tests found the operator's real
+ * `magus` clone, performed a live `git fetch`, and asserted against whatever
+ * happened to be published — 17 real plugins instead of the 2 in the fixture, and
+ * three seconds per test.
+ */
+let prevConfigDir: string | undefined;
+let emptyConfigDir: string;
+
+beforeAll(() => {
+  emptyConfigDir = fs.mkdtempSync(path.join(os.tmpdir(), "mp-fallback-"));
+  prevConfigDir = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = emptyConfigDir;
+});
+
+afterAll(() => {
+  if (prevConfigDir === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+  else process.env.CLAUDE_CONFIG_DIR = prevConfigDir;
+  fs.rmSync(emptyConfigDir, { recursive: true, force: true });
+});
+
 /**
  * Regression coverage for the "deprecated everything" bug.
  *
@@ -33,6 +63,10 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
     // Session-level cache could otherwise carry over a previous test's
     // successful fetch and short-circuit the fallback path.
     clearMarketplaceCache();
+    // The per-host cooldown is deliberately NOT cleared by clearMarketplaceCache
+    // — it reflects GitHub's state, not ours — so a 429 in one test would
+    // otherwise gate every fetch in the next for the full backoff.
+    resetGitHubBudget();
   });
 
   it("falls back to the local cache when the remote fetch returns empty", async () => {
@@ -64,18 +98,45 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       local,
     );
 
-    expect(resolved).toHaveLength(2);
-    expect(resolved.map((p) => p.name).sort()).toEqual([
+    expect(resolved.plugins).toHaveLength(2);
+    expect(resolved.plugins.map((p) => p.name).sort()).toEqual([
       "code-analysis",
       "dev",
     ]);
-    const codeAnalysis = resolved.find((p) => p.name === "code-analysis");
+    const codeAnalysis = resolved.plugins.find(
+      (p) => p.name === "code-analysis",
+    );
     expect(codeAnalysis?.version).toBe("5.3.0");
     expect(codeAnalysis?.description).toBe("Codebase investigation tools");
     expect(codeAnalysis?.category).toBe("development");
     expect(codeAnalysis?.author?.name).toBe("Jack Rudenko");
   });
 
+  it("labels the fallback answer as local-clone, not remote", async () => {
+    // The regression this guards: the fallback plugins were returned in the
+    // same shape as a successful remote fetch, so the caller compared installed
+    // versions against a clone nothing refreshes and reported "up to date".
+    // The source must travel with the data.
+    const local = new Map<string, LocalMarketplace>([
+      [
+        "magus",
+        buildLocalMarketplace("magus", [
+          { name: "terminal", version: "4.1.4", description: "" },
+        ]),
+      ],
+    ]);
+    const resolved = await resolveMarketplacePlugins(
+      "magus",
+      "not a valid repo string",
+      local,
+    );
+
+    expect(resolved.source).toBe("local-clone");
+    expect(resolved.failure).toBeDefined();
+    expect(resolved.failure?.kind).toBe("invalid-repo");
+    expect(resolved.failure?.marketplace).toBe("magus");
+  });
+
   it("returns empty when both remote and cache are empty", async () => {
     const local = new Map<string, LocalMarketplace>();
     const resolved = await resolveMarketplacePlugins(
@@ -83,7 +144,9 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       "not a valid repo string",
       local,
     );
-    expect(resolved).toEqual([]);
+    expect(resolved.plugins).toEqual([]);
+    expect(resolved.source).toBe("none");
+    expect(resolved.failure).toBeDefined();
   });
 
   it("returns empty when remote fails AND cache exists but has no plugins", async () => {
@@ -95,7 +158,8 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       "not a valid repo string",
       local,
     );
-    expect(resolved).toEqual([]);
+    expect(resolved.plugins).toEqual([]);
+    expect(resolved.source).toBe("none");
   });
 
   it("does not consult the cache when the remote returns plugins", async () => {
@@ -115,6 +179,134 @@ describe("resolveMarketplacePlugins — offline fallback", () => {
       "not a valid repo string",
       local,
     );
-    expect(resolved).toEqual([]);
+    expect(resolved.plugins).toEqual([]);
+    expect(resolved.source).toBe("none");
+  });
+});
+
+/**
+ * The defect class these cover: a failed check that renders as a passed one.
+ *
+ * `fetchMarketplacePlugins` used to return `[]` for a rate limit, a timeout, a
+ * bad repo string and a genuinely empty marketplace alike. Every caller then had
+ * to guess, and all of them guessed "fine".
+ */
+describe("fetchMarketplacePlugins — failures are values", () => {
+  beforeEach(() => {
+    clearMarketplaceCache();
+    resetGitHubBudget();
+  });
+
+  it("classifies a rate limit distinctly from a network problem", async () => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response("rate limited", {
+        status: 429,
+        statusText: "Too Many Requests",
+      })) as typeof globalThis.fetch;
+    try {
+      const result = await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(result.plugins).toEqual([]);
+      expect(result.failure?.kind).toBe("rate-limited");
+      expect(result.failure?.httpStatus).toBe(429);
+      expect(result.failure?.detail).toContain("rate limit");
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("records the failure so the UI can report it without re-fetching", async () => {
+    const original = globalThis.fetch;
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      return new Response("nope", { status: 500, statusText: "Server Error" });
+    }) as typeof globalThis.fetch;
+    try {
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+
+      const failures = getMarketplaceFetchFailures();
+      expect(failures.map((f) => f.marketplace)).toContain("magus");
+      expect(failures.find((f) => f.marketplace === "magus")?.kind).toBe("http");
+
+      // Second call must be served from the negative cache. Re-attempting on
+      // every screen mount is what cost 30-45s of "Loading..." per tab switch.
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(calls).toBe(1);
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("reports no failures when the fetch succeeds", async () => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      Response.json({
+        metadata: { version: "9.0.3" },
+        plugins: [{ name: "terminal", version: "4.1.6" }],
+      })) as typeof globalThis.fetch;
+    try {
+      const result = await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(result.failure).toBeUndefined();
+      expect(result.plugins).toHaveLength(1);
+      expect(getMarketplaceFetchFailures()).toEqual([]);
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("does not send a request while the rate-limit window is still open", async () => {
+    // Deliberate: an explicit refresh clears OUR caches but not GitHub's limit.
+    // Retrying inside a known window cannot succeed, and on some endpoints a
+    // rejected request extends the penalty — so the screen waits and counts down
+    // instead. `clearMarketplaceCache()` must not be a way around that.
+    const original = globalThis.fetch;
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      return new Response("nope", { status: 429 });
+    }) as typeof globalThis.fetch;
+    try {
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(calls).toBe(1);
+
+      clearMarketplaceCache();
+      const second = await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+
+      expect(calls).toBe(1); // no second request went out
+      expect(second.failure?.kind).toBe("rate-limited");
+      expect(second.failure?.retryAt).toBeGreaterThan(Date.now());
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
+
+  it("clears the recorded failure once the window passes and the fetch succeeds", async () => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response("nope", { status: 429 })) as typeof globalThis.fetch;
+    try {
+      await fetchMarketplacePlugins("magus", "MadAppGang/magus");
+      expect(getMarketplaceFetchFailures()).toHaveLength(1);
+
+      // The cooldown expiring is what unblocks the retry — this stands in for the
+      // clock reaching `retryAt`, which is when the screen refetches by itself.
+      resetGitHubBudget();
+      clearMarketplaceCache();
+      globalThis.fetch = (async () =>
+        Response.json({
+          plugins: [{ name: "terminal", version: "4.2.0" }],
+        })) as typeof globalThis.fetch;
+
+      const recovered = await fetchMarketplacePlugins(
+        "magus",
+        "MadAppGang/magus",
+      );
+      expect(recovered.failure).toBeUndefined();
+      expect(recovered.plugins).toHaveLength(1);
+      expect(getMarketplaceFetchFailures()).toEqual([]);
+    } finally {
+      globalThis.fetch = original;
+    }
   });
 });