claudeup 4.37.0 → 4.38.1

package/src/services/catalog-cache-store.ts

@@ -53,13 +53,48 @@ interface StoredCooldown {
 	strikes: number;
 }
 
+/**
+ * What the last upstream check learned about one community-styles repository.
+ *
+ * Lives here rather than in a fourth cache file so it inherits this store's file
+ * lock, atomic write and CLAUDE_CONFIG_DIR test isolation — and, more to the
+ * point, so it sits beside the rate-limit cooldowns it is budgeted against.
+ *
+ * `dirHeadSha` is the pivot of the two-phase check: one API call per REPO
+ * answers "did anything in its styles directory move", and only a repo that
+ * moved is drilled into with free raw fetches. Per-style API calls would spend
+ * the machine's whole hourly budget on first use.
+ */
+export interface StoredCommunityCheck {
+	/** Wall-clock ms of the last successful phase A. Drives the 24h TTL. */
+	checkedAt: number;
+	/** Latest commit touching the repo's styles directory, as of that check. */
+	dirHeadSha: string;
+	/** Per coordinate id: the bytes we hold, and any update sitting in .pending/. */
+	styles: Record<
+		string,
+		{
+			sha256: string;
+			pendingSha256?: string;
+			/** Changed-line count of that pending update, so it survives a restart. */
+			pendingLines?: number;
+		}
+	>;
+}
+
 interface StoreShape {
 	version: 1;
 	catalogs: Record<string, StoredCatalog>;
 	cooldowns: Record<string, StoredCooldown>;
+	communityStyles: Record<string, StoredCommunityCheck>;
 }
 
-const EMPTY: StoreShape = { version: 1, catalogs: {}, cooldowns: {} };
+const EMPTY: StoreShape = {
+	version: 1,
+	catalogs: {},
+	cooldowns: {},
+	communityStyles: {},
+};
 
 /**
  * Resolved per call, honouring CLAUDE_CONFIG_DIR — same reasoning as
@@ -83,7 +118,8 @@ let memo: { path: string; data: StoreShape } | null = null;
 
 async function load(): Promise<StoreShape> {
 	const file = storePath();
-	if (!file) return { version: 1, catalogs: {}, cooldowns: {} };
+	if (!file)
+		return { version: 1, catalogs: {}, cooldowns: {}, communityStyles: {} };
 	if (memo?.path === file) return memo.data;
 	try {
 		const parsed = JSON.parse(await fs.readFile(file, "utf-8")) as StoreShape;
@@ -92,11 +128,19 @@ async function load(): Promise<StoreShape> {
 		const data = parsed?.version === 1 ? parsed : { ...EMPTY };
 		data.catalogs ??= {};
 		data.cooldowns ??= {};
+		// Absent in every file written before community styles existed, so this
+		// default is the migration — an upgrade must not read as a corrupt cache.
+		data.communityStyles ??= {};
 		memo = { path: file, data };
 		return data;
 	} catch {
 		// Absent or corrupt. A cache must never be a failure mode — start empty.
-		const data: StoreShape = { ...EMPTY, catalogs: {}, cooldowns: {} };
+		const data: StoreShape = {
+			...EMPTY,
+			catalogs: {},
+			cooldowns: {},
+			communityStyles: {},
+		};
 		memo = { path: file, data };
 		return data;
 	}
@@ -117,13 +161,27 @@ async function mutate(fn: (data: StoreShape) => void): Promise<void> {
 		await withFileLock(file, async () => {
 			let onDisk: StoreShape;
 			try {
-				const parsed = JSON.parse(await fs.readFile(file, "utf-8")) as StoreShape;
+				const parsed = JSON.parse(
+					await fs.readFile(file, "utf-8"),
+				) as StoreShape;
+				// Every section is named explicitly: a key omitted here is silently
+				// dropped on the next write of any OTHER section.
 				onDisk =
 					parsed?.version === 1
-						? { version: 1, catalogs: parsed.catalogs ?? {}, cooldowns: parsed.cooldowns ?? {} }
-						: { version: 1, catalogs: {}, cooldowns: {} };
+						? {
+								version: 1,
+								catalogs: parsed.catalogs ?? {},
+								cooldowns: parsed.cooldowns ?? {},
+								communityStyles: parsed.communityStyles ?? {},
+							}
+						: { version: 1, catalogs: {}, cooldowns: {}, communityStyles: {} };
 			} catch {
-				onDisk = { version: 1, catalogs: {}, cooldowns: {} };
+				onDisk = {
+					version: 1,
+					catalogs: {},
+					cooldowns: {},
+					communityStyles: {},
+				};
 			}
 			fn(onDisk);
 			// Temp + rename, so a crash mid-write cannot leave a half-written file
@@ -212,6 +270,42 @@ export async function clearStoredCooldown(host: string): Promise<void> {
 	});
 }
 
+// ─── Community style checks ──────────────────────────────────────────────────
+
+/**
+ * Every recorded upstream check, keyed by community source id.
+ *
+ * Deliberately NOT expired on read, unlike cooldowns. An expired cooldown means
+ * "you may call again"; an expired CHECK still carries the shas we compare
+ * against, and only its `checkedAt` has gone stale. Dropping it would throw away
+ * the one thing that makes the next check cheap, and would make a 25-hour-old
+ * result indistinguishable from never having looked. Freshness is judged by the
+ * reader, which is what lets an expired check present as `unknown` rather than
+ * as up to date.
+ */
+export async function readCommunityChecks(): Promise<
+	Record<string, StoredCommunityCheck>
+> {
+	return { ...(await load()).communityStyles };
+}
+
+export async function writeCommunityCheck(
+	sourceId: string,
+	check: StoredCommunityCheck,
+): Promise<void> {
+	await mutate((data) => {
+		data.communityStyles ??= {};
+		data.communityStyles[sourceId] = check;
+	});
+}
+
+/** Drop every recorded check. Backs an explicit refresh. */
+export async function clearCommunityChecks(): Promise<void> {
+	await mutate((data) => {
+		data.communityStyles = {};
+	});
+}
+
 /** Test seam: forget this process's memo so the next read hits disk. */
 export function resetCatalogCacheMemo(): void {
 	memo = null;

package/src/services/community-fetcher.ts

@@ -0,0 +1,90 @@
+/**
+ * community-fetcher.ts — the one thing in the community-styles feature that
+ * knows `fetch` exists.
+ *
+ * ## Why a port at all
+ *
+ * Exactly one boundary gets an interface: the network. The domain here is thin,
+ * and an interface-per-class reflex would be waste — so there is no Strategy
+ * registry, no adapter factory, and nothing else in the feature is abstracted.
+ * The gain is the one the constraints demand: no test can reach GitHub, because
+ * every exported function in `community-styles.ts` takes a `StyleFetcher` as a
+ * REQUIRED argument. Omitting it is a type error, not a forgotten mock.
+ *
+ * ## Why it does not speak `Response`
+ *
+ * The classic way a port leaks its adapter. A `Response` drags in streaming
+ * semantics, a body that can only be read once, and a `fetch`-shaped mental
+ * model into every test fake. `{ status, body, etag }` is what the caller
+ * actually uses.
+ *
+ * `headers` is the one deliberate exception. `github-budget.ts` parses
+ * `retry-after` / `x-ratelimit-reset` / `x-ratelimit-remaining` itself, and it
+ * is the module that knows the two hosts differ in what they report. Re-deriving
+ * that here would fork the rate-limit logic, which is precisely what §5.3 of the
+ * design forbids. A fake supplies `new Headers({...})`, which is a standard
+ * built-in, not a fetch import.
+ */
+
+/** What the application needs from an HTTP response. Never a `Response`. */
+export interface StyleFetchResponse {
+	status: number;
+	/** Empty for a 304 and for any status with no body. */
+	body: string;
+	etag: string | null;
+	contentType: string | null;
+	/** Handed to `github-budget` unchanged — see the header note. */
+	headers: Headers;
+}
+
+export type StyleFetcher = (
+	url: string,
+	opts?: { etag?: string | null; timeoutMs?: number; accept?: string },
+) => Promise<StyleFetchResponse>;
+
+/**
+ * 10s, matching `marketplace-fetcher.ts`. A style is a few kilobytes over a CDN
+ * — measured at ~340ms — so anything past ten seconds is a broken route rather
+ * than a slow one, and the user is waiting on a keypress they just made.
+ */
+export const FETCH_TIMEOUT_MS = 10_000;
+
+/**
+ * The real adapter. Wraps global `fetch` and nothing more: no retry, no
+ * classification, no budget check. Those are policy and belong in the service,
+ * where they can be tested without a network.
+ *
+ * Sends `GITHUB_TOKEN` / `GITHUB_PERSONAL_ACCESS_TOKEN` to `api.github.com`
+ * ONLY — exactly as `skills-manager.ts` already does. The token raises that
+ * host's 60/hr unauthenticated budget to 5000/hr and is the documented escape
+ * hatch when the advisory says the budget is spent. It is never sent to
+ * `raw.githubusercontent.com`, which needs no auth and would receive a
+ * credential it has no business seeing.
+ */
+export const githubFetcher: StyleFetcher = async (url, opts = {}) => {
+	const headers: Record<string, string> = {
+		accept: opts.accept ?? "text/plain, */*",
+		"user-agent": "claudeup",
+	};
+	if (opts.etag) headers["if-none-match"] = opts.etag;
+
+	if (new URL(url).hostname === "api.github.com") {
+		const token =
+			process.env.GITHUB_TOKEN || process.env.GITHUB_PERSONAL_ACCESS_TOKEN;
+		if (token) headers.authorization = `Bearer ${token}`;
+	}
+
+	const response = await fetch(url, {
+		headers,
+		signal: AbortSignal.timeout(opts.timeoutMs ?? FETCH_TIMEOUT_MS),
+	});
+
+	return {
+		status: response.status,
+		// 304 carries no body; reading it is still safe and yields "".
+		body: response.status === 304 ? "" : await response.text(),
+		etag: response.headers.get("etag"),
+		contentType: response.headers.get("content-type"),
+		headers: response.headers,
+	};
+};