claudeup 4.41.0 → 4.42.1

package/src/__tests__/markdown-renderer.test.ts

@@ -0,0 +1,143 @@
+import { describe, expect, it } from "bun:test";
+import { renderMarkdown } from "../ui/renderers/markdownRenderer.js";
+
+/**
+ * The renderer emits OpenTUI elements, so these assert structure and counts
+ * rather than pixels: how many lines a construct produces, and that the raw
+ * markers (fences, pipes, hashes) do not survive into the output.
+ */
+
+/** Flatten a rendered node tree to the text a reader would see. */
+// biome-ignore lint/suspicious/noExplicitAny: walking opaque element trees
+function textOf(node: any): string {
+	if (node === null || node === undefined || typeof node === "boolean") {
+		return "";
+	}
+	if (typeof node === "string" || typeof node === "number") return String(node);
+	if (Array.isArray(node)) return node.map(textOf).join("");
+	if (node.props) return textOf(node.props.children);
+	return "";
+}
+
+const render = (src: string, width = 80) =>
+	renderMarkdown(src, { width, maxLines: 500 });
+
+describe("renderMarkdown", () => {
+	it("drops the # markers from a heading", () => {
+		const { nodes } = render("## Routing");
+
+		expect(nodes).toHaveLength(1);
+		expect(textOf(nodes[0])).toBe("Routing");
+	});
+
+	it("drops the fence markers and keeps the code", () => {
+		const { nodes } = render(
+			["```bash", "which mnemex && mnemex --version", "```"].join("\n"),
+		);
+
+		const text = nodes.map(textOf).join("\n");
+		expect(text).not.toContain("```");
+		expect(text).toContain("which mnemex && mnemex --version");
+		expect(text).toContain("bash");
+	});
+
+	it("turns a pipe table into aligned columns with a rule, no pipes", () => {
+		const { nodes } = render(
+			[
+				"| Mode | Keywords |",
+				"|------|----------|",
+				"| Bug | debug, error |",
+				"| Test | coverage |",
+			].join("\n"),
+		);
+
+		// header + rule + 2 body rows
+		expect(nodes).toHaveLength(4);
+		const text = nodes.map(textOf).join("\n");
+		expect(text).not.toContain("|");
+		expect(text).toContain("Mode");
+		expect(text).toContain("debug, error");
+		expect(textOf(nodes[1])).toMatch(/^\s*─+\s+─+$/);
+	});
+
+	it("narrows the widest table column instead of overflowing the pane", () => {
+		const { nodes } = render(
+			["| Mode | Notes |", "|---|---|", `| Bug | ${"x".repeat(120)} |`].join(
+				"\n",
+			),
+			40,
+		);
+
+		for (const node of nodes) {
+			expect(textOf(node).length).toBeLessThanOrEqual(41);
+		}
+		expect(nodes.map(textOf).join("")).toContain("…");
+	});
+
+	it("strips inline markers inside table cells", () => {
+		const { nodes } = render(
+			[
+				"| Mode | Primary Commands |",
+				"|---|---|",
+				"| Bug | `context`, `callers` |",
+				"| Arch | **map** |",
+			].join("\n"),
+		);
+
+		const text = nodes.map(textOf).join("\n");
+		expect(text).toContain("context, callers");
+		expect(text).not.toContain("`");
+		expect(text).not.toContain("**");
+	});
+
+	it("draws a rule for --- rather than printing hyphens as text", () => {
+		const { nodes } = render("---", 30);
+
+		expect(textOf(nodes[0])).toMatch(/^─+$/);
+	});
+
+	it("renders a list bullet and keeps ordered markers", () => {
+		const { nodes } = render(["- first", "2. second"].join("\n"));
+
+		expect(textOf(nodes[0])).toContain("•");
+		expect(textOf(nodes[0])).toContain("first");
+		expect(textOf(nodes[1])).toContain("2.");
+	});
+
+	it("strips inline code backticks and bold asterisks", () => {
+		const { nodes } = render("Run `bun test` and **stop**.");
+
+		const text = textOf(nodes[0]);
+		expect(text).toBe("Run bun test and stop.");
+	});
+
+	it("does not read bold markers that sit inside a code span", () => {
+		const { nodes } = render("Use `a**b` here.");
+
+		expect(textOf(nodes[0])).toBe("Use a**b here.");
+	});
+
+	it("marks a blockquote with a bar instead of a > character", () => {
+		const { nodes } = render("> With a sufficient number of users");
+
+		const text = textOf(nodes[0]);
+		expect(text).toContain("│");
+		expect(text).not.toContain(">");
+	});
+
+	it("reports the lines it stopped short of", () => {
+		const long = Array.from({ length: 30 }, (_, i) => `line ${i}`).join("\n");
+
+		const { nodes, withheld } = renderMarkdown(long, {
+			width: 80,
+			maxLines: 10,
+		});
+
+		expect(nodes).toHaveLength(10);
+		expect(withheld).toBe(20);
+	});
+
+	it("withholds nothing when the whole document fits", () => {
+		expect(render("one\ntwo").withheld).toBe(0);
+	});
+});

package/src/__tests__/marketplaces.test.ts

@@ -58,6 +58,10 @@ const COMMUNITY_MARKETPLACES: ReadonlyArray<[name: string, repo: string]> = [
 	["addy-agent-skills", "addyosmani/agent-skills"],
 	["humanizer", "blader/humanizer"],
 	["opendesign", "manalkaff/opendesign"],
+	// A fork, not the original: cursor/plugins keeps every manifest under
+	// `.cursor-plugin/` and carries no `.claude-plugin/marketplace.json`, so
+	// Claude Code cannot resolve it at all.
+	["open-pstack", "ericlitman/open-pstack"],
 ];
 
 describe("community marketplaces", () => {

package/src/__tests__/plugin-checkout.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "bun:test";
+import path from "node:path";
+import {
+	checkoutDirName,
+	checkoutPath,
+	ensureCheckout,
+} from "../services/plugin-checkout.js";
+
+/**
+ * A checkout is a read-only shallow clone claudeup owns, used so that browsing
+ * what a plugin contains never requires installing it and never spends the
+ * GitHub API budget (60 requests an hour, unauthenticated, shared across every
+ * repo on screen).
+ */
+describe("checkoutDirName", () => {
+	it("flattens owner/repo into one filesystem-safe segment", () => {
+		expect(checkoutDirName("addyosmani/agent-skills")).toBe(
+			"addyosmani__agent-skills",
+		);
+		expect(checkoutDirName("MadAppGang/magus")).toBe("MadAppGang__magus");
+	});
+
+	it("never yields a name containing a path separator", () => {
+		for (const repo of [
+			"a/b",
+			"../../etc/passwd",
+			"owner/repo.git",
+			"weird name/with spaces",
+		]) {
+			const name = checkoutDirName(repo);
+			expect(name).not.toContain("/");
+			expect(name).not.toContain("\\");
+			// A traversal attempt must not survive as one: `..` collapses into the
+			// same separator run as everything else, so the result cannot escape
+			// the checkout root.
+			expect(path.basename(name)).toBe(name);
+		}
+	});
+
+	it("keeps dots that are part of a real repo name", () => {
+		expect(checkoutDirName("owner/repo.js")).toBe("owner__repo.js");
+	});
+});
+
+describe("checkoutPath", () => {
+	it("puts every checkout under one root, outside Claude Code's own dirs", () => {
+		const a = checkoutPath("owner/one");
+		const b = checkoutPath("owner/two");
+
+		expect(path.dirname(a)).toBe(path.dirname(b));
+		expect(path.dirname(a)).toContain("claudeup-checkouts");
+		// Claude Code owns `plugins/`; a checkout must not look like installed
+		// state, or a reader could mistake it for something Claude Code loads.
+		expect(a).not.toContain(`${path.sep}plugins${path.sep}`);
+	});
+});
+
+describe("ensureCheckout", () => {
+	it("refuses to clone from a test run", async () => {
+		// Not a precaution. A test that only meant to exercise the tree-API path
+		// shallow-cloned a real GitHub repo, because stubbing `globalThis.fetch`
+		// does not stop `git`.
+		expect(process.env.NODE_ENV).toBe("test");
+		expect(await ensureCheckout("blader/humanizer")).toBeNull();
+	});
+});

package/src/__tests__/plugin-contents.test.ts

@@ -0,0 +1,371 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import type { PluginInfo } from "../services/plugin-manager.js";
+import {
+	fetchPluginContents,
+	splitSkillDocument,
+} from "../services/skills-manager.js";
+import type { Marketplace } from "../types/index.js";
+import {
+	buildPluginBrowserItems,
+	pluginContentsRepo,
+} from "../ui/adapters/pluginsAdapter.js";
+import type { PluginContentsEntry } from "../ui/state/types.js";
+
+// ─── fetchPluginContents ─────────────────────────────────────────────────────
+
+const realFetch = globalThis.fetch;
+
+/**
+ * Serve one canned git-tree response. `fetchGitTree` caches per repo for the
+ * life of the process, so every test must use a repo name of its own.
+ */
+function stubTree(paths: string[]): void {
+	globalThis.fetch = (async () =>
+		new Response(
+			JSON.stringify({
+				sha: "deadbeef",
+				truncated: false,
+				tree: paths.map((path) => ({
+					path,
+					mode: "100644",
+					type: "blob",
+					sha: `sha-${path}`,
+				})),
+			}),
+			{ status: 200, headers: { ETag: '"x"' } },
+		)) as unknown as typeof fetch;
+}
+
+afterEach(() => {
+	globalThis.fetch = realFetch;
+});
+
+describe("fetchPluginContents", () => {
+	it("counts a grouped skills/ tree once per skill, not once per group", async () => {
+		stubTree([
+			"README.md",
+			"skills/engineering/code-review/SKILL.md",
+			"skills/engineering/tdd/SKILL.md",
+			"skills/writing/prd/SKILL.md",
+		]);
+
+		const skills = await fetchPluginContents("fake/grouped", "./");
+
+		expect(skills.map((s) => s.name)).toEqual(["code-review", "tdd", "prd"]);
+		expect(skills.every((s) => s.kind === "skill")).toBe(true);
+		expect(skills[0].group).toBe("engineering");
+		expect(skills[2].group).toBe("writing");
+	});
+
+	it("ignores harness mirrors and translated docs trees", async () => {
+		// everything-claude-code's real shape: 286 skills under skills/, mirrored
+		// into four harness directories and six docs/<lang>/ trees for 898 files.
+		stubTree([
+			"skills/api-design/SKILL.md",
+			"skills/agent-sort/SKILL.md",
+			".agents/skills/api-design/SKILL.md",
+			".kiro/skills/api-design/SKILL.md",
+			".cursor/skills/api-design/SKILL.md",
+			"docs/ja-JP/skills/api-design/SKILL.md",
+			"docs/zh-CN/skills/api-design/SKILL.md",
+		]);
+
+		const skills = await fetchPluginContents("fake/mirrored", "./");
+
+		expect(skills.map((s) => s.name)).toEqual(["agent-sort", "api-design"]);
+	});
+
+	it("finds a plugin that is one skill at its root", async () => {
+		// blader/humanizer: a root SKILL.md and no skills/ directory at all.
+		stubTree([".claude-plugin/plugin.json", "SKILL.md", "README.md"]);
+
+		const skills = await fetchPluginContents("blader/humanizer", "./");
+
+		expect(skills).toHaveLength(1);
+		expect(skills[0].name).toBe("humanizer");
+		expect(skills[0].repoPath).toBe("SKILL.md");
+	});
+
+	it("scopes to one plugin's subtree in a multi-plugin marketplace", async () => {
+		stubTree([
+			"plugins/dev/skills/frontend/design-system/SKILL.md",
+			"plugins/dev/skills/backend/db-branching/SKILL.md",
+			"plugins/seo/skills/audit/SKILL.md",
+		]);
+
+		const skills = await fetchPluginContents("fake/multi", "./plugins/dev");
+
+		expect(skills.map((s) => s.name)).toEqual([
+			"db-branching",
+			"design-system",
+		]);
+	});
+
+	it("still lists commands and agents for a plugin with no skills", async () => {
+		stubTree(["agents/reviewer.md", "commands/go.md"]);
+
+		const found = await fetchPluginContents("fake/no-skills", "./");
+
+		expect(found.filter((c) => c.kind === "skill")).toEqual([]);
+		expect(found.map((c) => `${c.kind}:${c.name}`)).toEqual([
+			"command:go",
+			"agent:reviewer",
+		]);
+	});
+});
+
+// ─── splitSkillDocument ──────────────────────────────────────────────────────
+
+describe("splitSkillDocument", () => {
+	it("keeps frontmatter in file order so description stays near the top", () => {
+		const { frontmatter } = splitSkillDocument(
+			[
+				"---",
+				"name: code-review",
+				"description: Reviews a diff for correctness",
+				"allowed-tools: Read, Grep",
+				"---",
+				"",
+				"# Code review",
+			].join("\n"),
+		);
+
+		expect(frontmatter.map((f) => f.key)).toEqual([
+			"name",
+			"description",
+			"allowed-tools",
+		]);
+		expect(frontmatter[1].value).toBe("Reviews a diff for correctness");
+	});
+
+	it("flattens both list shapes to one display string", () => {
+		const { frontmatter } = splitSkillDocument(
+			[
+				"---",
+				'tags: ["tdd", "testing"]',
+				"allowed-tools:",
+				"  - Read",
+				"  - Bash",
+				"---",
+				"body",
+			].join("\n"),
+		);
+
+		expect(frontmatter[0]).toEqual({ key: "tags", value: "tdd, testing" });
+		expect(frontmatter[1]).toEqual({
+			key: "allowed-tools",
+			value: "Read, Bash",
+		});
+	});
+
+	it("separates the body and counts its lines", () => {
+		const doc = splitSkillDocument(
+			["---", "name: x", "---", "", "# Title", "", "Body text.", ""].join("\n"),
+		);
+
+		expect(doc.body).toBe("# Title\n\nBody text.");
+		expect(doc.bodyLines).toBe(3);
+	});
+
+	it("treats a file with no frontmatter as all body", () => {
+		const doc = splitSkillDocument("# Just markdown\n\nNo frontmatter here.");
+
+		expect(doc.frontmatter).toEqual([]);
+		expect(doc.body).toBe("# Just markdown\n\nNo frontmatter here.");
+	});
+
+	it("reports an empty body rather than a phantom line", () => {
+		const doc = splitSkillDocument("---\nname: x\ndescription: y\n---\n");
+
+		expect(doc.body).toBe("");
+		expect(doc.bodyLines).toBe(0);
+	});
+});
+
+// ─── buildPluginBrowserItems ─────────────────────────────────────────────────
+
+const marketplace: Marketplace = {
+	name: "mattpocock",
+	displayName: "Matt Pocock",
+	source: { source: "github", repo: "mattpocock/skills" },
+	description: "Agent skills for real engineering",
+	featured: true,
+};
+
+function makePlugin(overrides: Partial<PluginInfo> = {}): PluginInfo {
+	return {
+		id: "mattpocock-skills@mattpocock",
+		name: "mattpocock-skills",
+		version: "1.0.0",
+		description: "Matt Pocock's agent skills",
+		marketplace: "mattpocock",
+		marketplaceDisplay: "Matt Pocock",
+		enabled: false,
+		source: "./",
+		...overrides,
+	};
+}
+
+function build(
+	plugin: PluginInfo,
+	expandedPlugins: Set<string>,
+	pluginContents: Map<string, PluginContentsEntry> = new Map(),
+) {
+	return buildPluginBrowserItems({
+		marketplaces: [marketplace],
+		plugins: [plugin],
+		collapsedMarketplaces: new Set(),
+		expandedPlugins,
+		pluginContents,
+	});
+}
+
+describe("buildPluginBrowserItems component rows", () => {
+	it("marks a plugin expandable and emits no component rows while collapsed", () => {
+		const items = build(makePlugin(), new Set());
+
+		expect(items.map((i) => i.kind)).toEqual(["category", "plugin"]);
+		const row = items[1];
+		expect(row.kind === "plugin" && row.isExpandable).toBe(true);
+		expect(row.kind === "plugin" && row.isExpanded).toBe(false);
+	});
+
+	it("emits one row per component when expanded, of every kind", () => {
+		const items = build(
+			makePlugin(),
+			new Set(["mattpocock-skills@mattpocock"]),
+			new Map([
+				[
+					"mattpocock-skills@mattpocock",
+					{
+						status: "success",
+						components: [
+							{
+								kind: "skill",
+								name: "code-review",
+								repoPath: "skills/engineering/code-review/SKILL.md",
+								group: "engineering",
+							},
+							{ kind: "command", name: "go", repoPath: "commands/go.md" },
+							{ kind: "agent", name: "critic", repoPath: "agents/critic.md" },
+							{ kind: "mcp", name: "mnemex", repoPath: ".mcp.json" },
+						],
+					} satisfies PluginContentsEntry,
+				],
+			]),
+		);
+
+		expect(items.map((i) => i.kind)).toEqual([
+			"category",
+			"plugin",
+			"component",
+			"component",
+			"component",
+			"component",
+		]);
+		expect(items.slice(2).map((i) => i.label)).toEqual([
+			"code-review",
+			"go",
+			"critic",
+			"mnemex",
+		]);
+	});
+
+	it("gives an MCP-only plugin a row instead of rendering it as empty", () => {
+		// mnemex: no skills, no commands, no agents, one server. It used to show
+		// nothing at all, which read as a plugin that ships nothing.
+		const items = build(
+			makePlugin({ id: "mnemex@magus", name: "mnemex" }),
+			new Set(["mnemex@magus"]),
+			new Map([
+				[
+					"mnemex@magus",
+					{
+						status: "success",
+						components: [
+							{
+								kind: "mcp",
+								name: "mnemex",
+								repoPath: ".mcp.json",
+								mcpCommand: "mnemex --mcp",
+							},
+						],
+					} satisfies PluginContentsEntry,
+				],
+			]),
+		);
+
+		expect(items[2].kind).toBe("component");
+		expect(items[2].label).toBe("mnemex");
+	});
+
+	it("shows a loading row before the listing arrives", () => {
+		const items = build(
+			makePlugin(),
+			new Set(["mattpocock-skills@mattpocock"]),
+		);
+
+		expect(items[2].kind).toBe("contents-status");
+		expect(items[2].kind === "contents-status" && items[2].status).toBe(
+			"loading",
+		);
+	});
+
+	it("surfaces a failed listing instead of rendering an empty expansion", () => {
+		const items = build(
+			makePlugin(),
+			new Set(["mattpocock-skills@mattpocock"]),
+			new Map([
+				[
+					"mattpocock-skills@mattpocock",
+					{
+						status: "error",
+						error: "GitHub API rate limit exceeded",
+					} satisfies PluginContentsEntry,
+				],
+			]),
+		);
+
+		expect(items[2].kind === "contents-status" && items[2].status).toBe(
+			"error",
+		);
+		expect(items[2].kind === "contents-status" && items[2].error).toBe(
+			"GitHub API rate limit exceeded",
+		);
+	});
+
+	it("does not offer expansion for an orphaned plugin", () => {
+		const items = build(makePlugin({ isOrphaned: true }), new Set());
+
+		expect(items[1].kind === "plugin" && items[1].isExpandable).toBe(false);
+	});
+
+	it("does not offer expansion when the marketplace has no repo to read", () => {
+		const items = buildPluginBrowserItems({
+			marketplaces: [
+				{ ...marketplace, source: { source: "directory", repo: undefined } },
+			],
+			plugins: [makePlugin()],
+			collapsedMarketplaces: new Set(),
+			expandedPlugins: new Set(),
+			pluginContents: new Map(),
+		});
+
+		expect(items[1].kind === "plugin" && items[1].isExpandable).toBe(false);
+	});
+});
+
+describe("pluginContentsRepo", () => {
+	it("prefers a plugin's own repo over its marketplace's", () => {
+		const plugin = makePlugin({ sourceRepo: "addyosmani/agent-skills" });
+		expect(pluginContentsRepo(plugin, marketplace)).toBe(
+			"addyosmani/agent-skills",
+		);
+	});
+
+	it("falls back to the marketplace repo", () => {
+		expect(pluginContentsRepo(makePlugin(), marketplace)).toBe(
+			"mattpocock/skills",
+		);
+	});
+});

package/src/data/marketplaces.ts

@@ -161,6 +161,28 @@ export const defaultMarketplaces: Marketplace[] = [
 			"Designs and redesigns frontend UI and marketing graphics, routing to specialist skills per artifact type",
 		featured: true,
 	},
+	// A community port, deliberately, because the original cannot be installed.
+	// pstack is published by Cursor in cursor/plugins, whose manifests all live
+	// under `.cursor-plugin/` — measured over the whole tree: 61 `.cursor-plugin`
+	// files, 0 `.claude-plugin` files. Claude Code reads
+	// `.claude-plugin/marketplace.json` only, so `claude plugin marketplace add
+	// cursor/plugins` cannot resolve it. Same reason github/spec-kit is absent.
+	//
+	// Of the ports that relocate the manifest, this is the most starred: 95
+	// against pstack-claude's 94. backnotprop/pstack has more (140) but carries
+	// no Claude manifest either, and peadar/pstack (261) is an unrelated C
+	// stack-trace tool.
+	{
+		name: "open-pstack",
+		displayName: "pstack",
+		source: {
+			source: "github",
+			repo: "ericlitman/open-pstack",
+		},
+		description:
+			"Rigorous, parallelizable agent workflows that favour going deep before going fast. Community port of Cursor's pstack",
+		featured: true,
+	},
 	{
 		name: "claude-code-plugins",
 		displayName: "Anthropic Deprecated",

package/src/main.tsx

@@ -6,6 +6,7 @@ import { createRoot } from "@opentui/react";
 // a dynamic require("../package.json") is not resolvable inside the bunfs root.
 import pkg from "../package.json";
 import { route } from "./cli/router.js";
+import { loadProjectDotenv } from "./services/dotenv.js";
 import { App } from "./ui/App.js";
 import { setThemeMode } from "./ui/theme-mode.js";
 
@@ -17,6 +18,23 @@ export const VERSION = (pkg as { version: string }).version;
 async function main(): Promise<void> {
 	const args = process.argv.slice(2);
 
+	// Load the project's .env ourselves. Bun's standalone autoload is compiled OFF
+	// (scripts/build-binaries.ts) because it killed claudeup outright wherever
+	// .env was a symlink to a FIFO — the shape 1Password uses — exiting 1 with no
+	// output at all. services/dotenv.ts does the same job as an ordinary guarded
+	// read: regular files only, and every failure reported rather than fatal.
+	try {
+		for (const warning of loadProjectDotenv().warnings) {
+			console.warn(`claudeup: ${warning}`);
+		}
+	} catch (error) {
+		// Belt and braces. loadProjectDotenv is total, but no future edit to it may
+		// ever be allowed to stop claudeup from starting.
+		console.warn(
+			`claudeup: .env could not be loaded: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+
 	// Dispatch non-interactive subcommands (claude, update, install, …) and
 	// top-level flags (--version/--help). A bare invocation falls through to
 	// the interactive TUI below.