lshed 0.14.0 → 0.14.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.14.2 — 2026-09-08
+
+`lshed update --dry-run` now asks upstream instead of guessing.
+
+- It printed `~ package X (… update)` for every installed package without looking anywhere, so on a real shed nine packages all looked stale while `status` said `= lock` for each. Now each installer that can look does: git packages run `git ls-remote` against the source branch (or tag) and compare with the clone's HEAD; marketplaces Claude Code cloned with git (`installLocation` is a repository) compare with their origin. The line reads `= 0d1bd56 (최신)`, `~ 0d1bd56 → 0530392`, or `? …` when it cannot be known (Claude plugins, and the official marketplace, which is not a git clone). A lookup failure is reported on that line and does not stop the others. Nothing is written in either case.
+- Installer interface: optional `upstream(ctx, pkg)` returning `{ current, latest }`; `git.ts` gains `lsRemote(url, ref?)`, which names `refs/heads/<ref>`, `refs/tags/<ref>^{}` and `refs/tags/<ref>` explicitly so an annotated tag resolves to its commit and a branch wins over a tag of the same name.
+
+Also in this release (2026-09-08):
+
+- Re-ran everything that runs on the development machine against 0.14.1: unit tests (147), the CLI smoke suite with `dist/cli.js` and with the compiled Linux binary, all five `bun` binaries, `restore --pick` through a real pseudo-terminal, and `status`/`diff`/`restore --dry-run`/`update --dry-run`/`sync --dry-run` against the real shed for `claude-code`, `codex` and `agy`. The VM probe passes in full for Codex 0.153.2 and Antigravity CLI 1.1.27; Gemini, Copilot, Cursor, `agents` and `claude-code` pass the placement-only run. `scripts/vm/README.md` now says how to run the model questions from a scratch `HOME` without touching the real config.
+- `test/sync.test.ts` gets a 30 s budget per test and hook, and its cleanup retries on `EBUSY`. Each of those tests spawns git about ten times; on the Windows CI runner that occasionally exceeded vitest's 5 s default (run 33976665907 failed that way on a docs-only commit while the Node 20 Windows job of the same run passed). Test-only change.
+- No other code changes; the two items above are the whole diff since 0.14.1.
+
+## 0.14.1 — 2026-09-05
+
+Two things `lshed status` got wrong on a real machine after a one-plugin marketplace was added.
+
+- A marketplace and a plugin with the same name (`llm-guidelines` from `llm-guidelines@llm-guidelines`) were both recorded as `packages/llm-guidelines`. The marketplace keeps the name (its own commands need it); the plugin becomes `llm-guidelines@llm-guidelines`. Installer order is fixed, so every machine derives the same ids.
+- `extraKnownMarketplaces` in `settings.json` is state Claude Code writes when a marketplace is added, like `enabledPlugins`; `init` and `add` no longer offer it. The `claude-marketplace:` package brings it back on `restore`.
+- An empty JSON entry file (Antigravity creates `mcp_config.json` with no content) reads as `{}` instead of failing `status` and `restore`.
+
 ## 0.14.0 — 2026-09-05
 
 `--agent codex` now puts skills in `~/.agents/skills/`, the location Codex documents, instead of `~/.codex/skills/`.

package/README.md

@@ -395,6 +395,7 @@ $ lshed add paper-review mcp/linear
 
 ```
 lshed status                # shows "253d1df ≠ lock 0d1bd56 → lshed update" when a clone moved  ·  clone 이 움직였으면 알림
+lshed update --dry-run      # asks upstream what would move, touches nothing  ·  업스트림에 물어만 보고 아무것도 안 바꿈
 lshed update                # fast-forward every package in the profile, refresh lshed.lock  ·  프로필의 모든 패키지를 당기고 lock 갱신
 lshed update gstack --yes   # one package, and run its install: afterwards  ·  하나만, 그리고 install: 실행
 ```
@@ -403,6 +404,10 @@ Git packages are pinned by commit in `lshed.lock`; a new machine gets exactly th
 
 git 패키지는 `lshed.lock`에 커밋으로 고정되어 새 기기도 정확히 그 커밋을 받습니다. 플러그인은 고정할 수 없으므로 lock에는 설치된 버전을 적고, 이전 기기와 다르면 `status`가 알려 줍니다.
 
+`update --dry-run` reads upstream without changing anything: `= (최신)` when the clone already sits on the remote tip, `~ 0d1bd56 → 0530392` when a pull would move it, `?` when that cannot be known in advance. Git packages and marketplaces Claude Code cloned with git can be checked; Claude plugins and the official marketplace (not a git clone) cannot, so they show `?` and only a real `update` tells.
+
+`update --dry-run`은 아무것도 바꾸지 않고 업스트림만 읽습니다. clone이 이미 원격 끝에 있으면 `= (최신)`, pull이 옮길 것이면 `~ 0d1bd56 → 0530392`, 미리 알 수 없으면 `?`입니다. git 패키지와 Claude Code가 git으로 받은 마켓플레이스는 확인할 수 있고, Claude 플러그인과 공식 마켓플레이스(git clone이 아님)는 알 수 없어 `?`로 표시되며 실제 `update`만이 답합니다.
+
 ### Housekeeping · 정리
 
 ```
@@ -553,8 +558,8 @@ $ lshed add
     settings/theme
 ```
 
-- `enabledPlugins` is never taken: the plugin packages own it, and `restore` rebuilds it by installing them.
-  `enabledPlugins`는 담지 않습니다. 플러그인 패키지의 몫이고, `restore`가 설치하면서 다시 만듭니다.
+- `enabledPlugins` and `extraKnownMarketplaces` are never taken: the plugin and marketplace packages own them, and `restore` rebuilds them by installing those.
+  `enabledPlugins`와 `extraKnownMarketplaces`는 담지 않습니다. 플러그인·마켓플레이스 패키지의 몫이고, `restore`가 설치하면서 다시 만듭니다.
 - Absolute paths under your home directory become `${HOME}/…` in the shed, so a hook command written on one machine works on another. Claude Code does not expand variables in `settings.json`, so `restore` fills `${HOME}` and any `${VAR}` itself from your shell; unset variables are reported and left as placeholders.
   홈 아래 절대 경로는 창고에서 `${HOME}/…`가 되어, 한 기기에서 쓴 훅 명령이 다른 기기에서도 돕니다. Claude Code는 `settings.json`의 변수를 채우지 않으므로 `restore`가 `${HOME}`과 `${VAR}`를 셸에서 직접 채우고, 없는 변수는 알린 뒤 자리표시자로 둡니다.
 - `env` is treated as a secret map: keys that look secret are masked, the rest (`CLAUDE_CODE_MAX_OUTPUT_TOKENS`, …) travel as they are.
@@ -574,7 +579,7 @@ lshed status                                    applied profile, drift, packages
 lshed diff                                      files (or JSON keys) that differ between local and shed  ·  로컬과 창고가 다른 파일(또는 JSON 키)
 lshed save [ids...]                             copy local edits back into the shed  ·  로컬 편집을 창고로
 lshed sync [-m <msg>] [--no-push] [--dry-run]   commit the shed, pull --rebase, push
-lshed update [ids...] [--dry-run] [--yes]       pull packages forward, refresh lshed.lock  ·  패키지 당기고 lock 갱신
+lshed update [ids...] [--dry-run] [--yes]       pull packages forward, refresh lshed.lock; --dry-run asks upstream only  ·  패키지 당기고 lock 갱신, --dry-run 은 업스트림에 묻기만
 lshed list [--unused]                           what is in the shed, and which profiles use it  ·  창고의 내용과 그것을 쓰는 프로필
 lshed remove <key>                              drop a component or package from the shed  ·  창고에서 삭제
 lshed prune [--yes]                             drop everything no profile uses  ·  안 쓰는 것 전부 삭제
@@ -656,8 +661,10 @@ The shed is the source of truth for authored parts: `save` copies local edits ba
 
 - Tests, a CLI smoke run and the standalone binaries run on every push on **Ubuntu, macOS and Windows** (Node 20 and 22). Windows uses junctions for `--link` and `claude.cmd` for plugin installs.
   테스트, CLI 스모크, 단독 실행파일이 push마다 **Ubuntu, macOS, Windows**(Node 20, 22)에서 돕니다. Windows는 `--link`에 junction을, 플러그인 설치에 `claude.cmd`를 씁니다.
-- The other agents are checked against the tools themselves, not just their docs. `scripts/vm/probe.sh` restores a throwaway shed into a tool's real root and asks the tool, non-interactively, for a passphrase kept in a skill, a codeword kept in the instructions file, and the same skill again through a `--link` symlink. Codex 0.153.2 and Antigravity CLI 1.1.26 pass every check; Gemini CLI, Copilot CLI and Cursor are verified for file placement and format so far. `scripts/vm/README.md` has the details and a cloud-init file for running the whole thing on a fresh VM.
-  다른 에이전트는 문서만이 아니라 도구 자체로 확인합니다. `scripts/vm/probe.sh`는 임시 창고를 도구의 실제 루트에 복원한 뒤, 스킬에 든 암호어, 지침 파일에 든 코드워드, `--link` 링크를 거친 같은 스킬을 비대화형으로 물어봅니다. Codex 0.153.2와 Antigravity CLI 1.1.26은 모든 검사를 통과했고, Gemini CLI·Copilot CLI·Cursor는 아직 파일 배치와 형식까지만 확인했습니다. 자세한 내용과 새 VM에서 전부 돌리는 cloud-init 파일은 `scripts/vm/README.md`에 있습니다.
+- The other agents are checked against the tools themselves, not just their docs. `scripts/vm/probe.sh` restores a throwaway shed into a tool's real root and asks the tool, non-interactively, for a passphrase kept in a skill, a codeword kept in the instructions file, and the same skill again through a `--link` symlink. Codex 0.153.2 and Antigravity CLI 1.1.27 pass every check (last run 2026-09-08 with lshed 0.14.1); Gemini CLI, Copilot CLI and Cursor are verified for file placement and format so far. `scripts/vm/README.md` has the details and a cloud-init file for running the whole thing on a fresh VM.
+  다른 에이전트는 문서만이 아니라 도구 자체로 확인합니다. `scripts/vm/probe.sh`는 임시 창고를 도구의 실제 루트에 복원한 뒤, 스킬에 든 암호어, 지침 파일에 든 코드워드, `--link` 링크를 거친 같은 스킬을 비대화형으로 물어봅니다. Codex 0.153.2와 Antigravity CLI 1.1.27은 모든 검사를 통과했고(마지막 실행 2026-09-08, lshed 0.14.1), Gemini CLI·Copilot CLI·Cursor는 아직 파일 배치와 형식까지만 확인했습니다. 자세한 내용과 새 VM에서 전부 돌리는 cloud-init 파일은 `scripts/vm/README.md`에 있습니다.
+- One real shed is in daily use on the machine this is developed on: Claude Code, Codex and Antigravity all read it through `--link`, and `status` reports no drift for any of the three.
+  개발하는 기기에서는 실제 창고 하나를 매일 씁니다. Claude Code, Codex, Antigravity가 모두 `--link`로 그 창고를 읽고, 셋 다 `status`에 드리프트가 없습니다.
 
 ## Not in scope (yet) · 아직 범위 밖