feat(ai-tools): install/update AI CLIs, remote catalog sync, cached favicons (#40 A2)

server/lib/update-check.js

@@ -256,6 +256,24 @@ async function fetchLatestRelease(root, timeoutMs = 10_000) {
   return fetchReleaseFromUrl(remoteUrl, timeoutMs);
 }
 
+/**
+ * The repository URL releases are read from: the marketplace manifest for a
+ * plugin-cache install (no git there), else the canonical git remote. Null
+ * when neither answers. Never throws. Used by ai-tools-sync.js, which needs
+ * the repo itself (not just the newest release) to read files at a tag.
+ */
+async function repoUrlFor(root) {
+  const plugin = detectPluginInstall(root);
+  if (plugin) return pluginMarketplaceUrl(plugin.marketplace, plugin.plugin);
+  try {
+    const remote = await pickCanonicalRemote(root);
+    if (!remote) return null;
+    return (await execGit(root, ["remote", "get-url", remote], { timeout: 10_000 })) || null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The HTTP half of the release lookup, split out because a **plugin-cache
  * install has no git remote to derive the URL from** — it is unpacked from an
@@ -821,5 +839,6 @@ module.exports = {
   pluginMarketplaceUrl,
   fetchReleaseFromUrl,
   fetchLatestRelease,
+  repoUrlFor,
   isShallowClone,
 };