claudeup 4.40.1 → 4.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.40.1",
+  "version": "4.41.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.40.1",
-    "claudeup-darwin-x64": "4.40.1",
-    "claudeup-linux-x64": "4.40.1"
+    "claudeup-darwin-arm64": "4.41.0",
+    "claudeup-darwin-x64": "4.41.0",
+    "claudeup-linux-x64": "4.41.0"
   }
 }

package/src/__tests__/marketplaces.test.ts

@@ -38,3 +38,87 @@ describe("marketplaces", () => {
 		expect(names).not.toContain("superpowers");
 	});
 });
+
+/**
+ * The community marketplaces added alongside the Magus channels.
+ *
+ * `name` is not cosmetic: plugin ids are built as `${plugin.name}@${mpName}`
+ * (plugin-manager.ts), so it MUST equal the upstream
+ * .claude-plugin/marketplace.json "name" field. A mismatch fails at install
+ * time with "not found in marketplace", nowhere near the typo that caused it.
+ *
+ * Verify against upstream with:
+ *   gh api repos/<repo>/contents/.claude-plugin/marketplace.json \
+ *     -H "Accept: application/vnd.github.raw" | jq -r '.name'
+ */
+const COMMUNITY_MARKETPLACES: ReadonlyArray<[name: string, repo: string]> = [
+	["mattpocock", "mattpocock/skills"],
+	["ecc", "affaan-m/everything-claude-code"],
+	["ponytail", "DietrichGebert/ponytail"],
+	["addy-agent-skills", "addyosmani/agent-skills"],
+	["humanizer", "blader/humanizer"],
+	["opendesign", "manalkaff/opendesign"],
+];
+
+describe("community marketplaces", () => {
+	it.each(COMMUNITY_MARKETPLACES)(
+		"%s points at the repo whose manifest declares that name",
+		(name, repo) => {
+			const mp = defaultMarketplaces.find((m) => m.name === name);
+			expect(mp).toBeDefined();
+			expect(mp?.source.repo).toBe(repo);
+		},
+	);
+
+	it.each(COMMUNITY_MARKETPLACES)(
+		"%s is visible by default via the always-show gate",
+		(name) => {
+			const mp = defaultMarketplaces.find((m) => m.name === name);
+			// plugin-manager's gate: configured || official || featured || owned.
+			// Without one of these the entry is only a name-to-repo mapping and
+			// never appears, which is a silent no-op rather than a failure.
+			expect(mp?.official || mp?.featured || mp?.owned).toBe(true);
+		},
+	);
+
+	it.each(COMMUNITY_MARKETPLACES)(
+		"%s claims neither Anthropic nor MadAppGang ownership",
+		(name) => {
+			const mp = defaultMarketplaces.find((m) => m.name === name);
+			// `official` badges it as Anthropic-managed; `owned` sorts it above
+			// everything as a MadAppGang channel. Both would be a false claim.
+			expect(mp?.official).toBeUndefined();
+			expect(mp?.owned).toBeUndefined();
+		},
+	);
+
+	it("introduces no duplicate marketplace name or repo", () => {
+		const names = defaultMarketplaces.map((m) => m.name);
+		const repos = defaultMarketplaces.map((m) => m.source.repo.toLowerCase());
+
+		expect(new Set(names).size).toBe(names.length);
+		expect(new Set(repos).size).toBe(repos.length);
+	});
+
+	it("surfaces every community marketplace through getAllMarketplaces", () => {
+		const names = getAllMarketplaces().map((mp) => mp.name);
+
+		for (const [name] of COMMUNITY_MARKETPLACES) {
+			expect(names).toContain(name);
+		}
+	});
+
+	it("keeps the Magus channels sorted above the community ones", () => {
+		const order = getAllMarketplaces().map((mp) => mp.name);
+		const lastMagus = Math.max(
+			order.indexOf("magus"),
+			order.indexOf("magus-marketing"),
+			order.indexOf("magus-alpha"),
+		);
+		const firstCommunity = Math.min(
+			...COMMUNITY_MARKETPLACES.map(([name]) => order.indexOf(name)),
+		);
+
+		expect(lastMagus).toBeLessThan(firstCommunity);
+	});
+});

package/src/data/marketplaces.ts

@@ -87,6 +87,80 @@ export const defaultMarketplaces: Marketplace[] = [
 		description: "Curated Claude Code plugins for skills and workflows",
 		featured: true,
 	},
+	// Community marketplaces. Each `name` MUST equal the upstream
+	// .claude-plugin/marketplace.json "name" field — plugin ids are built as
+	// `${plugin.name}@${marketplaceName}`, so a mismatch here breaks install
+	// with a "not found in marketplace" error rather than anything obvious.
+	//
+	// All carry `featured` because that is the only flag that makes a
+	// third-party marketplace visible: the gate in plugin-manager is
+	// `configured || official || featured || owned`, and an unflagged entry is
+	// just a name→repo mapping for auto-recovery. `official` means Anthropic
+	// and `owned` means MadAppGang, so neither applies.
+	{
+		name: "mattpocock",
+		displayName: "Matt Pocock",
+		source: {
+			source: "github",
+			repo: "mattpocock/skills",
+		},
+		description:
+			"Agent skills for real engineering — grilling, spec and ticket flows, TDD, code review, domain modelling",
+		featured: true,
+	},
+	{
+		name: "ecc",
+		displayName: "Everything Claude Code",
+		source: {
+			source: "github",
+			repo: "affaan-m/everything-claude-code",
+		},
+		description:
+			"Operator layer for agent harnesses — 68 agents, 286 skills, and command shims",
+		featured: true,
+	},
+	{
+		name: "ponytail",
+		displayName: "Ponytail",
+		source: {
+			source: "github",
+			repo: "DietrichGebert/ponytail",
+		},
+		description:
+			"Pushes the agent toward the smallest solution that works — YAGNI, and the standard library before custom code",
+		featured: true,
+	},
+	{
+		name: "addy-agent-skills",
+		displayName: "Addy Osmani Skills",
+		source: {
+			source: "github",
+			repo: "addyosmani/agent-skills",
+		},
+		description: "Production-grade engineering skills for AI coding agents",
+		featured: true,
+	},
+	{
+		name: "humanizer",
+		displayName: "Humanizer",
+		source: {
+			source: "github",
+			repo: "blader/humanizer",
+		},
+		description: "Removes signs of AI-generated writing from text",
+		featured: true,
+	},
+	{
+		name: "opendesign",
+		displayName: "OpenDesign",
+		source: {
+			source: "github",
+			repo: "manalkaff/opendesign",
+		},
+		description:
+			"Designs and redesigns frontend UI and marketing graphics, routing to specialist skills per artifact type",
+		featured: true,
+	},
 	{
 		name: "claude-code-plugins",
 		displayName: "Anthropic Deprecated",

package/src/services/conventions-manager.ts

@@ -14,6 +14,7 @@
  */
 
 import { readFile, writeFile, stat, rename, unlink, open } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { dirname, basename, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
@@ -692,7 +693,11 @@ export async function resolveGlobalGitignorePath(): Promise<string | null> {
 export async function resolvePluginConventions(
   pluginPath: string,
 ): Promise<PluginConventions | null> {
-  const manifestPath = join(pluginPath, 'plugin.json');
+  // `.claude-plugin/plugin.json` is the location Claude Code reads; a root-level
+  // manifest is inert to the runtime but still worth reading for a third-party plugin
+  // whose author put it there.
+  const nested = join(pluginPath, '.claude-plugin', 'plugin.json');
+  const manifestPath = existsSync(nested) ? nested : join(pluginPath, 'plugin.json');
 
   try {
     const raw = await readFile(manifestPath, 'utf-8');

package/src/services/plugin-requires.ts

@@ -156,15 +156,19 @@ export function parsePluginRequires(pluginJson: unknown): PluginRequires {
 export async function readPluginRequires(
 	pluginPath: string,
 ): Promise<PluginRequires> {
-	const manifestPath = path.join(pluginPath, "plugin.json");
+	// `.claude-plugin/plugin.json` FIRST — that is the only location Claude Code's
+	// runtime loader reads, and the only one its documentation describes. The root
+	// fallback stays for third-party plugins whose authors put it there; such a manifest
+	// is inert as far as Claude Code is concerned, but claudeup can still read metadata
+	// out of it rather than reporting nothing.
+	const manifestPath = path.join(pluginPath, ".claude-plugin", "plugin.json");
 	try {
 		if (await fs.pathExists(manifestPath)) {
 			return parsePluginRequires(await fs.readJson(manifestPath));
 		}
-		// Some plugins nest the manifest under .claude-plugin/plugin.json.
-		const nested = path.join(pluginPath, ".claude-plugin", "plugin.json");
-		if (await fs.pathExists(nested)) {
-			return parsePluginRequires(await fs.readJson(nested));
+		const rootLevel = path.join(pluginPath, "plugin.json");
+		if (await fs.pathExists(rootLevel)) {
+			return parsePluginRequires(await fs.readJson(rootLevel));
 		}
 	} catch {
 		// Unreadable/malformed — treat as no requirements.