feat: live plugin ops — outdated badges, streamed install/update, doctor copy-fix, leaner nav

[0xLeif]

Summary

Push toward "best tool for fledge" — make the hub feel alive and tighten its scope around plugin management. Four threads in one PR.

1. Outdated detection

Every installed plugin now reveals whether a newer release exists, with a one-click update.

• src/semver.ts + 12 unit tests — lenient comparator (handles v prefix, missing patch segments, pre-release suffixes).
• src/github.ts fetchLatestVersion(owner, repo) — tries /releases/latest then falls back to most-recent tag. 404s cached so missing-release repos don't hammer GitHub.
• GET /api/plugins/outdated — runs lookups in parallel, returns [{ name, source, current, latest, outdated }].
• Frontend lazily fetches outdated info after the initial render so neither Installed nor Store is blocked by GitHub. Cards get a blue accent stripe + "v0.6.0 → v0.7.0" badge; Update button becomes primary.

2. SSE streaming for plugin operations

You can now watch installs / updates / removes happen live instead of waiting on a blocking POST.

• src/fledge.ts spawnStream / fledgeStream — pumps stdout/stderr line-by-line from a Bun.spawn process.
• Three new SSE endpoints: `GET /api/plugins/{install,update,remove}/stream`. Source/name params validated against allowlist regex (`/^[A-Za-z0-9_./@:-]+$/` and `/^[A-Za-z0-9_-]+$/` respectively).
• Old non-streaming POST endpoints (`/plugins/install|update|remove`) deleted — only consumer was the hub itself.
• New fixed-bottom ops console drawer in the UI: opens automatically on each operation, shows colour-coded stdout/stderr/error lines, status pulse → success/failure dot. Collapsible and dismissable.

3. Doctor: copy + rerun

Fix strings are arbitrary shell commands, not safely auto-runnable — so we don't try.

• One-click Copy button on every fix command (with secure-context fallback for non-HTTPS).
• Re-run button + last-run timestamp at the top of the page.

4. Navigation cleanup

Earlier conversation: the hub is the plugin hub, not a project IDE. Cut what didn't earn its place.

• Lanes page removed from Global — Overview already shows project lanes; the standalone page was duplicate data living under the wrong section. `/api/lanes` endpoint gone.
• Installed trimmed to plugins only. The Templates tab (which actually called `templates search`, not "installed") moves implicitly to Store. The Commands tab (full `fledge introspect` tree) was redundant — plugin commands already render as badges. `/api/templates` endpoint gone.
• Stats grid + section-tabs CSS dropped.

Test plan

• `bun test` — 29 pass / 0 fail (12 new semver tests added).
• `bun run typecheck` clean.
• Open `/` → Installed. Confirm outdated badges appear after a brief delay; Update button labels include the target version.
• Click Update — ops console drawer opens, stdout streams live, finishes with success dot. Plugin list refreshes; outdated badge clears.
• Repeat for Install (from Store) and Remove. Bad inputs (`source=foo;bar`) return 400.
• Doctor → Re-run reloads checks; Copy button on a fix line copies the exact command and flashes "Copied".
• Sidebar shows just Project / Overview + Global / Store / Installed / Config / Doctor.
• Navigate to Project Overview — lanes still render there from `/api/project`.

🤖 Generated with Claude Code

[corvid-agent]

👋 CorvidAgent is looking into this.

[corvid-agent]

Good PR — four coherent threads tied together well. The streaming migration, outdated detection, and nav cleanup all land cleanly. A few notes:

Semver (src/semver.ts) — clean implementation, good test coverage. One pedantic note: the regex (?:[-+](.+))? conflates build metadata (+build.5) with pre-release (-rc1). Per semver spec, build metadata should be ignored for precedence, so 1.0.0+build.5 and 1.0.0 should compare equal — but the code treats the former as less than the latter. Unlikely to bite in practice for fledge plugins, but worth knowing.

Unhandled rejections — refreshOutdated() in both the store and installed loaders fires as a .then() without a .catch(). If the /plugins/outdated endpoint 500s or the network drops, that's a silent unhandled promise rejection. Easy fix: .catch(() => {}) like you already do inside streamPluginOp.

Input validation — VALID_SOURCE and VALID_NAME regexes look correct for keeping metacharacters out of argv. SSE endpoints being GET means they're theoretically CSRF-reachable, but this is a localhost dev tool so it's fine.

Streaming — pumpLines + opsConsole.attach handles the EventSource lifecycle well. The done → close → error race is handled correctly by nulling this.current before the error handler fires.

Minor — the timeout kill in spawnStream doesn't surface a "timed out" message to the client; the process just dies and the exit code reflects the signal. Not blocking but a future nice-to-have.

Tests pass, types check, removals are clean. Ship it.