magus-cli 0.0.0-placeholder → 7.1.0

package/src/__tests__/cache-provenance.test.ts

@@ -0,0 +1,84 @@
+/**
+ * REGRESSION: every installed plugin rendered "stale — reinstall" at once.
+ *
+ * `updateInstalledPluginsRegistry` re-copies a plugin's files out of the
+ * marketplace clone on every in-place update, but used to carry the pre-update
+ * `gitCommitSha` forward verbatim. The recorded commit therefore named whichever
+ * release the plugin was FIRST installed from — measured 2026-08-22 on one
+ * machine: dev claimed 4.3.0 against a sha holding 3.3.0, browser-use 1.4.1
+ * against 1.1.3 — and the subtree diff across those releases is always
+ * non-empty. Fixed in /dev:fix session dev-fix-20260822-125510-03db093b.
+ *
+ * Hermetic: exercises the provenance rule directly, with a real git repo. The
+ * registry write itself resolves through os.homedir() and is not sandboxable
+ * without new test infrastructure, so the decision is tested where it lives.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { resolveCacheProvenance } from "../services/claude-settings.js";
+
+let repo: string;
+let plain: string;
+
+const git = (args: string[]) =>
+	spawnSync("git", ["-c", "commit.gpgsign=false", ...args], {
+		cwd: repo,
+		encoding: "utf-8",
+	});
+
+beforeEach(async () => {
+	repo = await fs.mkdtemp(path.join(os.tmpdir(), "provenance-repo-"));
+	plain = await fs.mkdtemp(path.join(os.tmpdir(), "provenance-plain-"));
+	await fs.mkdir(path.join(repo, "plugins", "alpha"), { recursive: true });
+	await fs.writeFile(path.join(repo, "plugins", "alpha", "plugin.json"), "{}");
+	git(["init", "-q", "-b", "main"]);
+	git(["config", "user.email", "probe@example.invalid"]);
+	git(["config", "user.name", "probe"]);
+	git(["add", "-A"]);
+	git(["commit", "-q", "-m", "release"]);
+});
+
+afterEach(async () => {
+	await fs.rm(repo, { recursive: true, force: true });
+	await fs.rm(plain, { recursive: true, force: true });
+});
+
+describe("resolveCacheProvenance", () => {
+	test("stamps the source repo's HEAD when files were copied", async () => {
+		const head = git(["rev-parse", "HEAD"]).stdout.trim();
+		const stale = "0".repeat(40);
+
+		expect(
+			await resolveCacheProvenance(path.join(repo, "plugins", "alpha"), stale),
+		).toBe(head);
+	});
+
+	test("does NOT carry a stale sha forward after a successful copy", async () => {
+		// The bug in one line: the old code returned `stale` here, so the
+		// recorded commit fell further behind with every release.
+		const stale = "0".repeat(40);
+		expect(
+			await resolveCacheProvenance(path.join(repo, "plugins", "alpha"), stale),
+		).not.toBe(stale);
+	});
+
+	test("keeps the previous sha when nothing was copied", async () => {
+		// A failed copy leaves the cache untouched, so the old sha still
+		// describes it. Advancing it would claim the cache holds newer files
+		// than it does, which hides real drift.
+		const previous = "a".repeat(40);
+		expect(await resolveCacheProvenance(null, previous)).toBe(previous);
+		expect(await resolveCacheProvenance(null, undefined)).toBeUndefined();
+	});
+
+	test("records no sha for a source outside any git repo", async () => {
+		// Directory-type marketplaces have no commit to name. Inventing one
+		// would assert a provenance that is false; content-drift reads an
+		// absent sha as "cannot answer" and stays silent.
+		expect(await resolveCacheProvenance(plain, "b".repeat(40))).toBeUndefined();
+	});
+});

package/src/__tests__/capture-builtin.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+	extractSection,
+	normalizeVersion,
+	slugFor,
+	stripSectionHeader,
+	toStyleFile,
+} from "../../scripts/capture-builtin.ts";
+import { splitFrontmatter } from "../services/styles-manager.js";
+
+const MARKER = "# Output Style: X";
+
+const BASELINE = "# First\nalpha\n\n# Second\nbeta";
+
+describe("extractSection", () => {
+	test("stops at the next structural heading", () => {
+		const styled = `# First\nalpha\n\n${MARKER}\nbody\n\n# Second\nbeta`;
+		expect(extractSection(BASELINE, styled, MARKER)).toBe(`${MARKER}\nbody`);
+	});
+
+	test("keeps an H1 that belongs to the style, not to the harness", () => {
+		// Explanatory really does ship "# Explanatory Style Active" inside its
+		// own body. Splitting on the next "# " truncates it.
+		const styled = `# First\nalpha\n\n${MARKER}\nbody\n\n# X Style Active\nmore\n\n# Second\nbeta`;
+		const got = extractSection(BASELINE, styled, MARKER);
+		expect(got).toContain("# X Style Active");
+		expect(got).toContain("more");
+		expect(got).not.toContain("beta");
+	});
+
+	test("does not truncate when the section ends the way the tail ends", () => {
+		// A character-level suffix walk cut Explanatory mid-sentence here.
+		const styled = `# First\nalpha\n\n${MARKER}\nProvide them as you write code.\n\n# Second\nbeta`;
+		expect(extractSection(BASELINE, styled, MARKER)).toBe(
+			`${MARKER}\nProvide them as you write code.`,
+		);
+	});
+
+	test("runs to the end when the section is last", () => {
+		const styled = `# First\nalpha\n\n${MARKER}\nbody`;
+		expect(extractSection(BASELINE, styled, MARKER)).toBe(`${MARKER}\nbody`);
+	});
+
+	test("returns empty when the marker is absent", () => {
+		expect(extractSection(BASELINE, BASELINE, MARKER)).toBe("");
+	});
+});
+
+describe("stripSectionHeader", () => {
+	test("removes the harness header and keeps H1s belonging to the style", () => {
+		const block =
+			"# Output Style: Explanatory\nBody line.\n\n# Explanatory Style Active\n\nMore.";
+		const body = stripSectionHeader(block, "Explanatory");
+		expect(body.startsWith("Body line.")).toBe(true);
+		// A heading-based split would have cut here; the style owns this H1.
+		expect(body).toContain("# Explanatory Style Active");
+	});
+
+	test("passes the block through when the header is absent", () => {
+		expect(stripSectionHeader("  no header here  ", "Explanatory")).toBe(
+			"no header here",
+		);
+	});
+});
+
+describe("toStyleFile", () => {
+	test("produces an importable file with coding instructions kept", () => {
+		const file = toStyleFile("Explanatory", "Body text.", "2.1.233");
+		const { frontmatter, body } = splitFrontmatter(file);
+		expect(frontmatter.name).toBe("builtin-explanatory");
+		expect(frontmatter["keep-coding-instructions"]).toBe("true");
+		expect(frontmatter.description).toBe(
+			"Captured built-in output style: Explanatory",
+		);
+		expect(frontmatter["captured-from"]).toBe("2.1.233");
+		expect(frontmatter["captured-style"]).toBe("Explanatory");
+		expect(body).toBe("Body text.");
+	});
+
+	test("slugs a multi-word style name into a usable filename", () => {
+		expect(slugFor("Explanatory")).toBe("builtin-explanatory");
+		expect(slugFor("Deep Research")).toBe("builtin-deep-research");
+	});
+});
+
+describe("normalizeVersion", () => {
+	test("reduces the CLI banner to a bare version so --check can compare it", () => {
+		expect(normalizeVersion("2.1.233 (Claude Code)")).toBe("2.1.233");
+		expect(normalizeVersion("2.1.233")).toBe("2.1.233");
+	});
+});

package/src/__tests__/catalog-cache-store.test.ts

@@ -0,0 +1,309 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	CATALOG_TTL_MS,
+	clearCachedCatalogs,
+	clearStoredCooldown,
+	readCachedCatalog,
+	readStoredCooldowns,
+	resetCatalogCacheMemo,
+	writeCachedCatalog,
+	writeStoredCooldown,
+} from "../services/catalog-cache-store";
+import {
+	cooldownFor,
+	hydrateGitHubBudget,
+	recordRateLimit,
+	resetGitHubBudget,
+} from "../services/github-budget";
+import type { MarketplacePlugin } from "../services/marketplace-catalog";
+
+/**
+ * These cover the cross-LAUNCH behaviour, which is the only kind that matters for
+ * a TUI. Measured before this store existed, two consecutive processes:
+ *
+ *   [process-1] 6 HTTP requests in 13.32s
+ *   [process-2] 6 HTTP requests in 13.01s
+ *
+ * Every cache was a module-level Map, so a relaunch re-fetched all six catalogs —
+ * and, worse, forgot that the previous launch had just been rate-limited and spent
+ * six more requests rediscovering it.
+ *
+ * A fresh module registry is the closest a unit test gets to a fresh process, so
+ * `resetGitHubBudget()` + `resetCatalogCacheMemo()` stand in for a relaunch: they
+ * drop all in-memory state while leaving the file on disk.
+ */
+
+let configDir: string;
+let prevConfigDir: string | undefined;
+
+const NOW = 1_786_980_000_000;
+
+function plugin(name: string, version: string): MarketplacePlugin {
+	return { name, version, description: "" };
+}
+
+beforeEach(() => {
+	configDir = fs.mkdtempSync(path.join(os.tmpdir(), "catalog-cache-"));
+	prevConfigDir = process.env.CLAUDE_CONFIG_DIR;
+	process.env.CLAUDE_CONFIG_DIR = configDir;
+	resetCatalogCacheMemo();
+	resetGitHubBudget();
+});
+
+afterEach(() => {
+	// biome-ignore lint/performance/noDelete: assigning undefined to process.env stores the string "undefined"; only delete unsets the variable
+	if (prevConfigDir === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+	else process.env.CLAUDE_CONFIG_DIR = prevConfigDir;
+	fs.rmSync(configDir, { recursive: true, force: true });
+});
+
+describe("catalog cache — survives a relaunch", () => {
+	it("serves a catalog written by a previous process", async () => {
+		await writeCachedCatalog("magus", [plugin("terminal", "4.1.6")], "remote");
+
+		// Stand in for a relaunch: in-memory state gone, file intact.
+		resetCatalogCacheMemo();
+
+		const cached = await readCachedCatalog("magus");
+		expect(cached).not.toBeNull();
+		expect(cached?.plugins).toHaveLength(1);
+		expect(cached?.plugins[0]?.version).toBe("4.1.6");
+		expect(cached?.source).toBe("remote");
+	});
+
+	it("keeps the source, so a cached answer is still labelled honestly", async () => {
+		// A `remote-git` answer stays `remote-git` after a round trip through disk.
+		// Flattening it to "cached" would lose the authoritative/unverified
+		// distinction the whole fix rests on.
+		await writeCachedCatalog("magus", [plugin("dev", "4.0.1")], "remote-git");
+		resetCatalogCacheMemo();
+		expect((await readCachedCatalog("magus"))?.source).toBe("remote-git");
+	});
+
+	it("expires once past the TTL", async () => {
+		await writeCachedCatalog(
+			"magus",
+			[plugin("terminal", "4.1.6")],
+			"remote",
+			NOW,
+		);
+		resetCatalogCacheMemo();
+
+		expect(
+			await readCachedCatalog("magus", NOW + CATALOG_TTL_MS - 1000),
+		).not.toBeNull();
+		expect(
+			await readCachedCatalog("magus", NOW + CATALOG_TTL_MS + 1000),
+		).toBeNull();
+	});
+
+	it("ignores an entry stamped in the future", async () => {
+		// A clock that jumped backwards must not pin a cache entry forever.
+		await writeCachedCatalog("magus", [plugin("dev", "4.0.1")], "remote", NOW);
+		resetCatalogCacheMemo();
+		expect(await readCachedCatalog("magus", NOW - 60_000)).toBeNull();
+	});
+
+	it("never caches an empty catalog", async () => {
+		// An empty list is indistinguishable from an unclassified failure. Caching it
+		// would serve "this marketplace has no plugins" for an hour — the original bug
+		// with a longer memory.
+		await writeCachedCatalog("magus", [], "remote");
+		resetCatalogCacheMemo();
+		expect(await readCachedCatalog("magus")).toBeNull();
+	});
+
+	it("is dropped by an explicit refresh", async () => {
+		await writeCachedCatalog("magus", [plugin("terminal", "4.1.6")], "remote");
+		await clearCachedCatalogs();
+		resetCatalogCacheMemo();
+		expect(await readCachedCatalog("magus")).toBeNull();
+	});
+
+	it("survives a corrupt cache file instead of throwing", async () => {
+		fs.writeFileSync(
+			path.join(configDir, "magus-catalog-cache.json"),
+			"{ not json",
+		);
+		resetCatalogCacheMemo();
+		expect(await readCachedCatalog("magus")).toBeNull();
+
+		// And it must recover: a bad file cannot poison later writes.
+		await writeCachedCatalog("magus", [plugin("dev", "4.0.1")], "remote");
+		resetCatalogCacheMemo();
+		expect(await readCachedCatalog("magus")).not.toBeNull();
+	});
+});
+
+describe("rate-limit cooldown — survives a relaunch", () => {
+	/**
+	 * Anchored to the real clock, not the fixed NOW the catalog tests use.
+	 * `hydrateGitHubBudget()` takes no clock parameter — it filters expired entries
+	 * against `Date.now()`, exactly as it does in production — so a cooldown stamped
+	 * relative to a fixed past NOW would be discarded as expired before the
+	 * assertion ever ran.
+	 */
+	let base: number;
+	beforeEach(() => {
+		base = Date.now();
+	});
+
+	/**
+	 * Wait until a write-behind cooldown has actually reached disk.
+	 *
+	 * This used to be `setTimeout(80)` — a guess at how long an unawaited write
+	 * takes, which is not a synchronisation point. `recordRateLimit` persists
+	 * fire-and-forget by design (`github-budget.ts` explains why), so on a loaded
+	 * runner the write had not landed when the next `hydrateGitHubBudget()` read,
+	 * and the restored strike count came back low. That failed CI as
+	 * `Expected: 3, Received: 2` on Linux while passing 15/15 on a quiet macOS
+	 * laptop — the signature of a timing guess, not of a real defect.
+	 *
+	 * Polling the store itself removes the guess: it returns as soon as the value
+	 * is observable, and only gives up after a deadline no healthy machine
+	 * reaches. `expected` is the strike count the caller just recorded; passing
+	 * nothing waits for any persisted entry at all.
+	 */
+	const flush = async (host: string, expected?: number): Promise<void> => {
+		const deadline = Date.now() + 5000;
+		for (;;) {
+			// `base` keeps the read on the same clock the writes used: cooldowns are
+			// dropped on read once expired, so reading with a later `now` could hide
+			// an entry that is genuinely there.
+			const stored = (await readStoredCooldowns(base))[host];
+			if (stored && (expected === undefined || stored.strikes >= expected)) {
+				return;
+			}
+			if (Date.now() > deadline) {
+				throw new Error(
+					`cooldown for ${host} never reached disk (wanted strikes >= ${expected ?? "any"}, got ${stored?.strikes ?? "nothing"})`,
+				);
+			}
+			await new Promise((r) => setTimeout(r, 10));
+		}
+	};
+
+	// Teardown hygiene, NOT a synchronisation point — which is why it is a plain
+	// sleep and `flush` is not. Its only job is to let an in-flight write land
+	// before the temp config dir is removed; a write that arrives afterwards
+	// recreates a file in a deleted directory and harms nothing. Polling for a
+	// specific host here would be wrong: several tests in this block end with
+	// nothing on disk on purpose.
+	afterEach(() => new Promise((r) => setTimeout(r, 50)));
+
+	it("is still in force in the next process", async () => {
+		// THE defect this store exists to fix. Without persistence, launch two fired
+		// six more doomed requests at a host it had already been refused by.
+		recordRateLimit("raw.githubusercontent.com", new Headers(), base);
+		await flush("raw.githubusercontent.com");
+
+		resetGitHubBudget();
+		resetCatalogCacheMemo();
+		expect(cooldownFor("raw.githubusercontent.com", base)).toBeNull(); // memory only
+
+		await hydrateGitHubBudget();
+		const restored = cooldownFor("raw.githubusercontent.com", base);
+		expect(restored).not.toBeNull();
+		expect(restored?.until).toBeGreaterThan(base);
+	});
+
+	it("keeps escalating the backoff across relaunches", async () => {
+		// Without the strike count surviving, every relaunch restarts the backoff at
+		// 30s — so a tool that is relaunched often never actually backs off, which is
+		// the behaviour that got the IP rate-limited in the first place.
+		//
+		// Written as one strike per launch, which is the real shape: a launch makes its
+		// requests, learns it is limited once, and exits.
+		const first = recordRateLimit("raw.githubusercontent.com", undefined, base);
+		expect(first.strikes).toBe(1);
+		await flush("raw.githubusercontent.com", 1);
+
+		resetGitHubBudget();
+		resetCatalogCacheMemo();
+		await hydrateGitHubBudget();
+
+		const second = recordRateLimit(
+			"raw.githubusercontent.com",
+			undefined,
+			base,
+		);
+		expect(second.strikes).toBe(2);
+		expect(second.until).toBeGreaterThan(first.until);
+		await flush("raw.githubusercontent.com", 2);
+
+		resetGitHubBudget();
+		resetCatalogCacheMemo();
+		await hydrateGitHubBudget();
+
+		const third = recordRateLimit("raw.githubusercontent.com", undefined, base);
+		expect(third.strikes).toBe(3);
+		expect(third.until).toBeGreaterThan(second.until);
+	});
+
+	it("preserves whether the timing was GitHub's or ours", async () => {
+		// `exact` decides between "resets in 4m" and "next attempt in 4m". Losing it
+		// across a relaunch would make the UI state a claim GitHub never made.
+		recordRateLimit(
+			"api.github.com",
+			new Headers({ "retry-after": "600" }),
+			base,
+		);
+		await flush("api.github.com");
+
+		resetGitHubBudget();
+		await hydrateGitHubBudget();
+		expect(cooldownFor("api.github.com", base)?.exact).toBe(true);
+	});
+
+	it("drops an expired cooldown rather than restoring it", async () => {
+		await writeStoredCooldown("raw.githubusercontent.com", {
+			until: NOW - 1000,
+			exact: false,
+			strikes: 4,
+		});
+		resetCatalogCacheMemo();
+
+		// Expired entries are not returned, so a stale strike count from yesterday
+		// cannot make today's first failure back off for ten minutes.
+		expect(Object.keys(await readStoredCooldowns(NOW))).toEqual([]);
+	});
+
+	it("is cleared for a host that recovers", async () => {
+		await writeStoredCooldown("raw.githubusercontent.com", {
+			until: NOW + 60_000,
+			exact: false,
+			strikes: 1,
+		});
+		await clearStoredCooldown("raw.githubusercontent.com");
+		resetCatalogCacheMemo();
+		expect(Object.keys(await readStoredCooldowns(NOW))).toEqual([]);
+	});
+
+	it("keeps catalogs when only the cooldown is cleared, and vice versa", async () => {
+		// They share one file; a write to either must not clobber the other.
+		await writeCachedCatalog("magus", [plugin("dev", "4.0.1")], "remote");
+		await writeStoredCooldown("raw.githubusercontent.com", {
+			until: NOW + 60_000,
+			exact: false,
+			strikes: 1,
+		});
+
+		await clearStoredCooldown("raw.githubusercontent.com");
+		resetCatalogCacheMemo();
+		expect(await readCachedCatalog("magus")).not.toBeNull();
+
+		await writeStoredCooldown("raw.githubusercontent.com", {
+			until: NOW + 60_000,
+			exact: false,
+			strikes: 1,
+		});
+		await clearCachedCatalogs();
+		resetCatalogCacheMemo();
+		expect(Object.keys(await readStoredCooldowns(NOW))).toEqual([
+			"raw.githubusercontent.com",
+		]);
+	});
+});

package/src/__tests__/catalog-notice.test.ts

@@ -0,0 +1,155 @@
+import { describe, expect, it } from "bun:test";
+import type { MarketplaceFetchFailure } from "../services/marketplace-fetcher";
+import { buildCatalogNoticeText } from "../ui/adapters/catalogNotice";
+
+/**
+ * The banner is the only thing standing between the user and a screen that
+ * silently claims every plugin is up to date. So it has three obligations:
+ * appear whenever a check did not actually happen, stay silent when it did or
+ * when the state is intended, and stay legible either way.
+ *
+ * "Stay silent when intended" is not politeness. `autoUpdate: false` and a clone
+ * behind its remote are deliberate policy here — plugins are not auto-updated.
+ * An earlier version warned about both and suggested the command that would undo
+ * the policy, which trains the user to ignore the line.
+ */
+
+const NOW = 1_786_980_000_000;
+
+function failure(
+	marketplace: string,
+	kind: MarketplaceFetchFailure["kind"] = "rate-limited",
+	retryAt?: number,
+): MarketplaceFetchFailure {
+	return { marketplace, kind, detail: `${kind} detail`, retryAt };
+}
+
+describe("buildCatalogNoticeText", () => {
+	it("says nothing when every catalog was actually checked", () => {
+		// The negative control. A banner that is always on carries no information.
+		expect(
+			buildCatalogNoticeText({
+				failures: [],
+				unverifiedPlugins: 0,
+				width: 120,
+				now: NOW,
+			}),
+		).toBeNull();
+	});
+
+	it("names the reason, because it determines what the user should do", () => {
+		const rate = buildCatalogNoticeText({
+			failures: [failure("magus")],
+			unverifiedPlugins: 3,
+			width: 120,
+			now: NOW,
+		});
+		expect(rate).toContain("GitHub rate limit");
+
+		const slow = buildCatalogNoticeText({
+			failures: [failure("magus", "timeout")],
+			unverifiedPlugins: 3,
+			width: 120,
+			now: NOW,
+		});
+		expect(slow).toContain("GitHub timed out");
+	});
+
+	it("names one or two failing marketplaces but only counts many", () => {
+		const few = buildCatalogNoticeText({
+			failures: [failure("magus"), failure("magus-alpha")],
+			unverifiedPlugins: 0,
+			width: 160,
+			now: NOW,
+		});
+		expect(few).toContain("magus-alpha");
+
+		const many = buildCatalogNoticeText({
+			failures: ["a", "b", "c", "d", "e", "f"].map((n) => failure(n)),
+			unverifiedPlugins: 0,
+			width: 160,
+			now: NOW,
+		});
+		expect(many).toContain("6 catalogs unchecked");
+	});
+
+	it("counts down to the retry instead of saying 'later'", () => {
+		// Answering "when can I try again" is the point. Guessing costs another
+		// request against the very limit the user is waiting out.
+		const line = buildCatalogNoticeText({
+			failures: [failure("magus", "rate-limited", NOW + 240_000)],
+			unverifiedPlugins: 17,
+			width: 160,
+			now: NOW,
+		}) as string;
+		expect(line).toContain("retrying in 4m");
+	});
+
+	it("uses the soonest retry when several catalogs are waiting", () => {
+		const line = buildCatalogNoticeText({
+			failures: [
+				failure("magus", "rate-limited", NOW + 600_000),
+				failure("magus-alpha", "rate-limited", NOW + 45_000),
+			],
+			unverifiedPlugins: 2,
+			width: 160,
+			now: NOW,
+		}) as string;
+		expect(line).toContain("retrying in 45s");
+	});
+
+	it("falls back to the manual hint when no retry time is known", () => {
+		// raw.githubusercontent.com sends no retry-after, so for some failures there
+		// is genuinely no time to show. Inventing one would be worse than omitting it.
+		const line = buildCatalogNoticeText({
+			failures: [failure("magus", "network")],
+			unverifiedPlugins: 1,
+			width: 160,
+			now: NOW,
+		}) as string;
+		expect(line).toContain("r to retry");
+		expect(line).not.toContain("retrying in");
+	});
+
+	it("ignores a retry time that has already passed", () => {
+		const line = buildCatalogNoticeText({
+			failures: [failure("magus", "rate-limited", NOW - 5_000)],
+			unverifiedPlugins: 1,
+			width: 160,
+			now: NOW,
+		}) as string;
+		expect(line).toContain("r to retry");
+	});
+
+	it("keeps a retry affordance at every width, however narrow", () => {
+		const failures = ["a", "b", "c", "d", "e", "f"].map((n) =>
+			failure(n, "rate-limited", NOW + 90_000),
+		);
+		for (const width of [40, 60, 80, 100, 120, 200]) {
+			const line = buildCatalogNoticeText({
+				failures,
+				unverifiedPlugins: 331,
+				width,
+				now: NOW,
+			}) as string;
+			expect(line).not.toBeNull();
+			expect(line).toContain("retrying in");
+		}
+	});
+
+	it("never renders wider than the pane", () => {
+		const failures = ["a", "b", "c", "d", "e", "f"].map((n) =>
+			failure(n, "rate-limited", NOW + 90_000),
+		);
+		for (const width of [40, 60, 80, 100, 120, 200]) {
+			const line = buildCatalogNoticeText({
+				failures,
+				unverifiedPlugins: 331,
+				width,
+				now: NOW,
+			}) as string;
+			// +1 for `⚠` rendering double-width while String.length counts it once.
+			expect(line.length + 1).toBeLessThanOrEqual(width);
+		}
+	});
+});