magus-cli 0.0.0-placeholder → 7.1.0

package/src/services/content-drift.ts

@@ -0,0 +1,208 @@
+/**
+ * content-drift.ts — detect a plugin whose files changed without its version.
+ *
+ * The whole update system keys off one signal: the version string.
+ * `hasUpdate` is `compareVersions(catalogVersion, installedVersion) > 0`, so a
+ * marketplace that republishes different content under an unchanged version is
+ * invisible. No update is offered, and the only cure is a reinstall — which is
+ * exactly the "plugin says installed but its skills are missing" report.
+ *
+ * This is not a hypothetical. `publish-dist.sh` pushes a rebuilt tree, so
+ * same-version-different-content is a normal outcome of the release process.
+ * Measured on 2026-08-06: `cache/magus/dev/3.0.1/skills` held
+ * {audit, tui-progress} while `marketplaces/magus/plugins/dev/skills` held
+ * {security-audit} — both stamped 3.0.1.
+ *
+ * The fix uses a signal already present in `installed_plugins.json`: each entry
+ * records `gitCommitSha`, the marketplace commit it was installed from. Asking
+ * git whether THIS PLUGIN'S SUBTREE changed between that commit and the
+ * marketplace's current HEAD answers the question exactly.
+ *
+ * Comparing whole-marketplace SHAs would be wrong: any commit to any plugin
+ * would flag every plugin as drifted. The subtree scope is what makes this
+ * precise enough to act on.
+ */
+
+import { spawn } from "node:child_process";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * Resolved per call, honouring CLAUDE_CONFIG_DIR — the same override Claude
+ * Code uses. A module-level constant would bake in `os.homedir()` at import
+ * time, which on macOS ignores $HOME and makes the service impossible to test
+ * without touching the operator's real marketplaces.
+ */
+function marketplacesDir(): string {
+	const configDir =
+		process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+	return path.join(configDir, "plugins", "marketplaces");
+}
+
+/**
+ * Session cache. Keyed by marketplace + installed sha + plugin, because the
+ * answer cannot change while magus is open — the marketplace clone is only
+ * refreshed by Claude Code, out of process.
+ */
+const cache = new Map<string, boolean>();
+
+export function clearContentDriftCache(): void {
+	cache.clear();
+}
+
+function git(
+	cwd: string,
+	args: string[],
+): Promise<{ code: number; out: string }> {
+	return new Promise((resolve) => {
+		const child = spawn("git", args, {
+			cwd,
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+		let out = "";
+		child.stdout.on("data", (d) => {
+			out += String(d);
+		});
+		child.on("error", () => resolve({ code: -1, out: "" }));
+		child.on("close", (code) => resolve({ code: code ?? -1, out: out.trim() }));
+		// Never let a wedged git block the UI.
+		setTimeout(() => {
+			child.kill();
+			resolve({ code: -1, out: "" });
+		}, 5000).unref?.();
+	});
+}
+
+/**
+ * HEAD of the git repo containing `dir`, or undefined when there is none.
+ *
+ * This is what stamps provenance onto a cache copy: `copyPluginToCache` reads
+ * the plugin's files out of the marketplace clone, so that clone's HEAD is the
+ * commit those files came from. Undefined is a real answer — a directory-type
+ * marketplace has no commit to name, and inventing one would assert a
+ * provenance that is false.
+ */
+export async function repoHeadSha(dir: string): Promise<string | undefined> {
+	const r = await git(dir, ["rev-parse", "HEAD"]);
+	if (r.code !== 0) return undefined;
+	return /^[0-9a-f]{40}$/.test(r.out) ? r.out : undefined;
+}
+
+export interface DriftQuery {
+	marketplace: string;
+	/** Plugin name without the @marketplace suffix. */
+	pluginName: string;
+	/** `gitCommitSha` from the installed_plugins.json entry. */
+	installedSha: string | undefined;
+	/**
+	 * Version currently installed. Required, not optional: the sha alone cannot
+	 * be trusted, and a caller that omitted this would silently get the old
+	 * always-drifted behaviour back.
+	 */
+	installedVersion: string | undefined;
+	/**
+	 * Path of the plugin inside the marketplace repo, from the catalog `source`
+	 * field (e.g. "./plugins/dev"). Defaults to `plugins/<name>`.
+	 */
+	sourcePath?: string;
+}
+
+/** Strip a leading "v" so "v1.2.3" and "1.2.3" compare equal. */
+const normalize = (v: string) => v.trim().replace(/^v/, "");
+
+/**
+ * The version a plugin's manifest declared at a given commit.
+ *
+ * Both layouts are tried because both are real: magus lays plugins out as
+ * `plugins/<name>/plugin.json`, while Claude Code documents
+ * `.claude-plugin/plugin.json`. Reading only one would silence drift detection
+ * for every plugin using the other.
+ */
+async function versionAtSha(
+	repo: string,
+	sha: string,
+	rel: string,
+): Promise<string | undefined> {
+	for (const manifest of [
+		`${rel}/plugin.json`,
+		`${rel}/.claude-plugin/plugin.json`,
+	]) {
+		const r = await git(repo, ["show", `${sha}:${manifest}`]);
+		if (r.code !== 0 || !r.out) continue;
+		try {
+			const v = JSON.parse(r.out)?.version;
+			if (typeof v === "string" && v) return v;
+		} catch {
+			// Unparseable manifest is the same as no manifest: unverifiable.
+		}
+	}
+	return undefined;
+}
+
+/**
+ * True when the plugin's files in the marketplace differ from the commit it was
+ * installed from — i.e. a reinstall would deliver different content.
+ *
+ * Returns false whenever the question cannot be answered honestly: no recorded
+ * sha, no clone, git unavailable, the recorded commit is absent locally
+ * (force-push, shallow clone), or that commit declares a DIFFERENT version than
+ * the one installed. A false negative leaves today's behaviour; a false
+ * positive would nag the user to reinstall for no reason.
+ */
+export async function hasContentDrift(q: DriftQuery): Promise<boolean> {
+	if (!q.installedSha) return false;
+
+	const key = `${q.marketplace}\0${q.pluginName}\0${q.installedSha}\0${q.installedVersion}`;
+	const hit = cache.get(key);
+	if (hit !== undefined) return hit;
+
+	const repo = path.join(marketplacesDir(), q.marketplace);
+	const rel = (q.sourcePath ?? `plugins/${q.pluginName}`).replace(/^\.\//, "");
+
+	// The recorded commit must exist locally, or the diff is meaningless.
+	const known = await git(repo, [
+		"cat-file",
+		"-e",
+		`${q.installedSha}^{commit}`,
+	]);
+	if (known.code !== 0) {
+		cache.set(key, false);
+		return false;
+	}
+
+	// The recorded sha must describe the version actually installed, or the diff
+	// answers a different question than the one asked.
+	//
+	// This is the whole reason the badge fired on every plugin at once:
+	// `updateInstalledPluginsRegistry` bumps `version` on an in-place update but
+	// carries the pre-update `gitCommitSha` forward, so the sha names whichever
+	// commit the plugin was FIRST installed from. Measured 2026-08-22 on one
+	// machine: dev recorded 4.3.0 against a sha holding 3.3.0, browser-use 1.4.1
+	// against 1.1.3. Diffing across those releases is trivially non-empty, so
+	// every plugin rendered "stale — reinstall" while its cached files were in
+	// fact byte-identical to the marketplace.
+	const shaVersion = q.installedVersion
+		? await versionAtSha(repo, q.installedSha, rel)
+		: undefined;
+	if (
+		!q.installedVersion ||
+		!shaVersion ||
+		normalize(shaVersion) !== normalize(q.installedVersion)
+	) {
+		cache.set(key, false);
+		return false;
+	}
+
+	// Exit 0 = no difference, 1 = differs, anything else = could not tell.
+	const diff = await git(repo, [
+		"diff",
+		"--quiet",
+		q.installedSha,
+		"HEAD",
+		"--",
+		rel,
+	]);
+	const drifted = diff.code === 1;
+	cache.set(key, drifted);
+	return drifted;
+}