Add automatic plugin updates

Plugins can now be automatically updated in the background while the
plugin runs. After the plugin exits, any update output is flushed to
stderr so it never interleaves with plugin output.

- Add `WithBackgroundUpdate` to run a plugin with concurrent update
  checking and installation
- Add `GatedWriter` to buffer output until the gate is opened
- Extend `isTerminal` in ansi to support any writer with an `Fd()`
  method, so the spinner works correctly with `GatedWriter`

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

Author: vcheung-stripe

pkg/ansi/ansi.go

@@ -186,13 +186,13 @@ func StrikeThrough(text string) string {
 // Private functions
 //
 
+type fder interface{ Fd() uintptr }
+
 func isTerminal(w io.Writer) bool {
-	switch v := w.(type) {
-	case *os.File:
-		return term.IsTerminal(int(v.Fd()))
-	default:
-		return false
+	if f, ok := w.(fder); ok {
+		return term.IsTerminal(int(f.Fd()))
 	}
+	return false
 }
 
 func isPlugin() bool {

pkg/cmd/plugin_cmds.go

@@ -12,13 +12,15 @@ import (
 
 	"github.com/stripe/stripe-cli/pkg/config"
 	"github.com/stripe/stripe-cli/pkg/plugins"
+	"github.com/stripe/stripe-cli/pkg/stripe"
 	"github.com/stripe/stripe-cli/pkg/validators"
 )
 
 type pluginTemplateCmd struct {
 	cfg        *config.Config
 	cmd        *cobra.Command
 	fs         afero.Fs
+	baseURL    string
 	ParsedArgs []string
 }
 
@@ -28,6 +30,7 @@ func newPluginTemplateCmd(config *config.Config, plugin *plugins.Plugin) *plugin
 	ptc := &pluginTemplateCmd{}
 	ptc.fs = afero.NewOsFs()
 	ptc.cfg = config
+	ptc.baseURL = stripe.DefaultAPIBaseURL
 
 	ptc.cmd = &cobra.Command{
 		Use:   plugin.Shortname,
@@ -110,8 +113,9 @@ func (ptc *pluginTemplateCmd) runPluginCmd(cmd *cobra.Command, args []string) er
 		"prefix": "cmd.pluginCmd.runPluginCmd",
 	}).Debug("Running plugin...")
 
-	err = plugin.Run(ctx, ptc.cfg, fs, ptc.ParsedArgs)
-	plugins.CleanupAllClients()
+	err = plugins.WithBackgroundUpdate(ctx, ptc.cfg, fs, ptc.baseURL, &plugin, os.Stderr, func() error {
+		return plugin.Run(ctx, ptc.cfg, fs, ptc.ParsedArgs)
+	})
 
 	if err != nil {
 		if err == validators.ErrAPIKeyNotConfigured {

pkg/cmd/plugin_cmds_test.go

@@ -1,18 +1,24 @@
 package cmd
 
 import (
+	"bytes"
 	"context"
+	"errors"
+	"io"
 	"os"
 	"strings"
+	"sync"
 	"testing"
 
+	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/stripe/stripe-cli/pkg/config"
 	"github.com/stripe/stripe-cli/pkg/plugins"
 )
 
-func createPluginCmd() *pluginTemplateCmd {
+func createPluginCmd(cfg *config.Config) *pluginTemplateCmd {
 	plugin := plugins.Plugin{
 		Shortname:        "test",
 		Shortdesc:        "test your stuff",
@@ -26,7 +32,7 @@ func createPluginCmd() *pluginTemplateCmd {
 		}},
 	}
 
-	pluginCmd := newPluginTemplateCmd(&Config, &plugin)
+	pluginCmd := newPluginTemplateCmd(cfg, &plugin)
 
 	return pluginCmd
 }
@@ -35,7 +41,8 @@ func createPluginCmd() *pluginTemplateCmd {
 // This is a complex dance between the CLI itself and the plugin, so the flags come from
 // two different sources as a result. This test is here to catch any non-obvious regressions
 func TestFlagsArePassedAsArgs(t *testing.T) {
-	pluginCmd := createPluginCmd()
+	cfg := &config.Config{}
+	pluginCmd := createPluginCmd(cfg)
 	rootCmd.AddCommand(pluginCmd.cmd)
 
 	Execute(context.Background())
@@ -133,6 +140,105 @@ func TestAddPluginSubcommandStubsSkipsEmptyName(t *testing.T) {
 	assert.Equal(t, "valid", cmds[1].Name())
 }
 
+// TestWithBackgroundUpdate_FnRuns verifies that fn is invoked and completes.
+func TestWithBackgroundUpdate_FnRuns(t *testing.T) {
+	cfg := &config.Config{}
+	fs := afero.NewMemMapFs()
+	plugin := plugins.Plugin{Shortname: "test"}
+
+	called := false
+	err := plugins.WithBackgroundUpdate(context.Background(), cfg, fs, "", &plugin, io.Discard, func() error {
+		called = true
+		return nil
+	})
+
+	assert.NoError(t, err)
+	assert.True(t, called)
+}
+
+// TestWithBackgroundUpdate_PropagatesError verifies that an error returned by fn
+// is returned by WithBackgroundUpdate.
+func TestWithBackgroundUpdate_PropagatesError(t *testing.T) {
+	cfg := &config.Config{}
+	fs := afero.NewMemMapFs()
+	plugin := plugins.Plugin{Shortname: "test"}
+
+	want := errors.New("plugin failed")
+	err := plugins.WithBackgroundUpdate(context.Background(), cfg, fs, "", &plugin, io.Discard, func() error {
+		return want
+	})
+
+	assert.Equal(t, want, err)
+}
+
+// TestWithBackgroundUpdate_UpdateOutputAppearsAfterFn verifies that any output
+// written by the background update goroutine is only flushed to the underlying
+// writer after fn returns — never interleaved with fn's execution.
+func TestWithBackgroundUpdate_UpdateOutputAppearsAfterFn(t *testing.T) {
+	cfg := &config.Config{}
+	fs := afero.NewMemMapFs()
+	plugin := plugins.Plugin{Shortname: "test"}
+
+	var mu sync.Mutex
+	var events []string
+
+	// recordWriter appends each Write as an event.
+	out := &funcWriter{fn: func(p []byte) (int, error) {
+		mu.Lock()
+		events = append(events, "write:"+string(p))
+		mu.Unlock()
+		return len(p), nil
+	}}
+
+	err := plugins.WithBackgroundUpdate(context.Background(), cfg, fs, "", &plugin, out, func() error {
+		mu.Lock()
+		events = append(events, "fn:done")
+		mu.Unlock()
+		return nil
+	})
+
+	require.NoError(t, err)
+
+	mu.Lock()
+	defer mu.Unlock()
+	// If there were any writes (update output), they must come after fn:done.
+	fnIdx := -1
+	for i, e := range events {
+		if e == "fn:done" {
+			fnIdx = i
+		}
+	}
+	// fn must have run
+	require.GreaterOrEqual(t, fnIdx, 0, "fn:done not recorded")
+	for i, e := range events {
+		if strings.HasPrefix(e, "write:") {
+			assert.Greater(t, i, fnIdx, "update write at index %d appeared before fn:done at index %d", i, fnIdx)
+		}
+	}
+}
+
+// TestWithBackgroundUpdate_NilErrorOnSuccess verifies a nil error on clean fn exit.
+func TestWithBackgroundUpdate_NilErrorOnSuccess(t *testing.T) {
+	cfg := &config.Config{}
+	fs := afero.NewMemMapFs()
+	plugin := plugins.Plugin{Shortname: "test"}
+
+	// Provide a non-nil out to ensure the writer path is exercised.
+	var buf bytes.Buffer
+	err := plugins.WithBackgroundUpdate(context.Background(), cfg, fs, "", &plugin, &buf, func() error {
+		return nil
+	})
+
+	assert.NoError(t, err)
+}
+
+// funcWriter is a minimal io.Writer backed by a function, used in tests.
+type funcWriter struct {
+	fn func([]byte) (int, error)
+}
+
+func (f *funcWriter) Write(p []byte) (int, error) { return f.fn(p) }
+
 func TestSubsliceAfter(t *testing.T) {
 	tests := []struct {
 		name     string

pkg/gatedwriter/gatedwriter.go

@@ -0,0 +1,109 @@
+// Package gatedwriter provides a buffered writer that can be opened and closed
+// to control the flow of data to the underlying writer.
+package gatedwriter
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"sync"
+)
+
+// GatedWriter is an io.Writer that buffers writes until opened. Once Open is
+// called, buffered data is flushed and subsequent writes go directly to the
+// underlying writer. Closing the gate resumes buffering. Safe for concurrent use.
+type GatedWriter struct {
+	mu        sync.Mutex
+	out       io.Writer    // underlying destination (must be non-nil)
+	buf       bytes.Buffer // buffered data while closed
+	open      bool         // when true, writes go directly to out
+	maxBuffer int64        // maximum number of bytes to buffer; 0 = defaultMaxBuffer
+}
+
+var _ io.Writer = (*GatedWriter)(nil)
+
+// defaultMaxBuffer is the maximum bytes to buffer while the gate is closed (100 KB).
+// Writes that would exceed this limit are dropped silently.
+const defaultMaxBuffer = 100 * 1024
+
+// NewGatedWriter creates a closed GatedWriter that writes to out once opened.
+// maxBuffer caps the in-memory buffer in bytes; 0 uses defaultMaxBuffer.
+// If out is nil, io.Discard is used.
+func NewGatedWriter(out io.Writer, maxBuffer int64) *GatedWriter {
+	if out == nil {
+		out = io.Discard
+	}
+	if maxBuffer == 0 {
+		maxBuffer = defaultMaxBuffer
+	}
+	return &GatedWriter{out: out, maxBuffer: maxBuffer}
+}
+
+// Write buffers p while the gate is closed. Once open, it writes directly to
+// the underlying writer. Writes that would push the buffer past maxBuffer are
+// dropped silently.
+func (g *GatedWriter) Write(p []byte) (int, error) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.open {
+		return g.out.Write(p)
+	}
+	if g.maxBuffer > 0 && int64(g.buf.Len()+len(p)) > g.maxBuffer {
+		return len(p), nil // drop silently
+	}
+	n, _ := g.buf.Write(p) // bytes.Buffer.Write never returns error
+	return n, nil
+}
+
+// Open flushes any buffered data to the underlying writer and opens the gate
+// so future writes go directly to out. Calling Open on an already-open writer
+// is a no-op.
+func (g *GatedWriter) Open() error {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.open {
+		return nil
+	}
+	data := g.buf.Bytes()
+	g.buf.Reset()
+	g.open = true
+	if len(data) > 0 {
+		_, err := g.out.Write(data)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Close closes the gate, causing subsequent writes to be buffered again.
+func (g *GatedWriter) Close() {
+	g.mu.Lock()
+	g.open = false
+	g.mu.Unlock()
+}
+
+// Fd returns the file descriptor of the underlying writer if it is an *os.File,
+// allowing callers to check whether the destination is a terminal. Returns
+// ^uintptr(0) if the underlying writer is not an *os.File.
+func (g *GatedWriter) Fd() uintptr {
+	g.mu.Lock()
+	out := g.out
+	g.mu.Unlock()
+	if f, ok := out.(*os.File); ok {
+		return f.Fd()
+	}
+	return ^uintptr(0) // invalid fd
+}
+
+// SetOut replaces the underlying writer. If w is nil, io.Discard is used.
+// Takes effect immediately for open writes; buffered data is still flushed
+// to the new writer when Open is called.
+func (g *GatedWriter) SetOut(w io.Writer) {
+	if w == nil {
+		w = io.Discard
+	}
+	g.mu.Lock()
+	g.out = w
+	g.mu.Unlock()
+}