claudeup 5.0.0 → 5.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "5.0.0",
-    "claudeup-darwin-x64": "5.0.0",
-    "claudeup-linux-x64": "5.0.0"
+    "claudeup-darwin-arm64": "5.0.1",
+    "claudeup-darwin-x64": "5.0.1",
+    "claudeup-linux-x64": "5.0.1"
   }
 }

package/src/__tests__/dotenv.test.ts

@@ -87,6 +87,11 @@ describe("loadProjectDotenv", () => {
 		expect(r.warnings).toHaveLength(1);
 		expect(r.warnings[0]).toContain(".env");
 		expect(r.warnings[0]).toContain("named pipe");
+		// The warning must give the real reason — the open blocks with no writer.
+		// It must NOT claim reading would steal another process's secrets: a
+		// 1Password pipe re-serves on every open, so that rationale is false.
+		expect(r.warnings[0]).toContain("blocks");
+		expect(r.warnings[0]).not.toContain("consume");
 	});
 
 	it("skips a .env that is a FIFO directly, and warns", () => {

package/src/services/dotenv.ts

@@ -16,9 +16,14 @@ import path from "node:path";
  * Two rules this loader keeps that the autoload did not:
  *
  *   1. Only regular files are read. A FIFO, socket or device is skipped, never
- *      opened. That dodges the crash, and it is right on its own terms: a FIFO
- *      hands its bytes to whoever opens it FIRST, so reading one would swallow
- *      the secrets a dev server or `op run` was waiting for.
+ *      opened, because opening a pipe BLOCKS until some process opens the other
+ *      end — with no writer standing by, claudeup hangs on startup instead of
+ *      running. That is the whole reason. It is NOT that reading would steal
+ *      another process's secrets: 1Password's pipe re-serves its contents on
+ *      every open, and `readFileSync` reads it correctly (`Bun.file().text()`
+ *      is the API that hangs on a FIFO). An earlier version of this comment,
+ *      the warning text, and the 4.42.1 changelog all claimed the one-reader
+ *      story; it is wrong, so do not restore it.
  *   2. Nothing here is fatal. A missing, unreadable or malformed .env produces a
  *      warning and claudeup carries on. Managing ~/.claude must never depend on
  *      the state of whatever directory you happen to be standing in.
@@ -89,7 +94,7 @@ export function parseDotenv(text: string): Record<string, string> {
 /** What a non-regular entry actually is, for a warning a human can act on. */
 function describeKind(info: Stats): string {
 	if (info.isFIFO()) {
-		return "it is a named pipe; reading it would consume another process's secrets";
+		return "it is a named pipe; opening one blocks until a writer appears, and claudeup must not hang before it starts";
 	}
 	if (info.isSocket()) return "it is a socket, not a regular file";
 	if (info.isDirectory()) return "it is a directory, not a regular file";