chore: v2.8.21 — update progress steps, clone in background, extra SSH keys inline, today's spend

- Plugin update reports its running step (plugin-update-progress.json →
  plugin_update_progress); a hidden update or clone leaves a progress chip.
- Clone here can run in the background.
- Git identity: extra SSH keys are added inline per host (no More keys tab).
- Users: spend today (viewer's local day, ?tz_offset=).
- Prettier on the files touched since v2.8.20.

scripts/plugin-update-helper.js

@@ -28,6 +28,10 @@
  * refused on STDOUT (`bootstrap: locked`), and execFileSync's own message is
  * only "Command failed: <argv>".
  *
+ * While a step runs, `plugin-update-progress.json` beside it names that step
+ * (`progress`), so the dashboard can say how far the chain got rather than
+ * only that it is busy; a final verdict removes it.
+ *
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -43,6 +47,10 @@ const [, , marketplace, plugin, oldRoot, runtimeDirArg] = process.argv;
 // main() — which a require never runs — writes these.
 const RESULT_FILE = path.join(runtimeDirArg || "", "plugin-update.json");
 const LOG_FILE = path.join(runtimeDirArg || "", "plugin-update.log");
+const PROGRESS_FILE = path.join(runtimeDirArg || "", "plugin-update-progress.json");
+
+/** The chain's steps, in order, as `progress` reports them. */
+const STEPS = ["marketplace_update", "plugin_update", "bootstrap"];
 
 // Names come from the local cache PATH, never from an HTTP body, but they still
 // reach an argv — so they are re-validated here rather than trusted across the
@@ -59,13 +67,34 @@ function log(line) {
   }
 }
 
-function record(result) {
+/** Every verdict but the pre-written handover one (`final: false`) ends the
+ *  chain, so its progress record goes with it. */
+function record(result, { final = true } = {}) {
   try {
     fs.mkdirSync(runtimeDirArg, { recursive: true });
     fs.writeFileSync(
       RESULT_FILE,
       JSON.stringify({ ...result, finished_at: new Date().toISOString() }, null, 2)
     );
+    if (final) fs.rmSync(PROGRESS_FILE, { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
+/** Say which step is running now — a courtesy for the UI, never a verdict. */
+function progress(step) {
+  try {
+    fs.mkdirSync(runtimeDirArg, { recursive: true });
+    fs.writeFileSync(
+      PROGRESS_FILE,
+      JSON.stringify({
+        step,
+        index: STEPS.indexOf(step) + 1,
+        total: STEPS.length,
+        started_at: new Date().toISOString(),
+      })
+    );
   } catch {
     /* best effort */
   }
@@ -182,6 +211,7 @@ function main() {
     return;
   }
 
+  progress("marketplace_update");
   try {
     run(claude, ["plugin", "marketplace", "update", marketplace], 300_000);
   } catch (err) {
@@ -189,6 +219,7 @@ function main() {
     return;
   }
 
+  progress("plugin_update");
   try {
     run(claude, ["plugin", "update", `${plugin}@${marketplace}`, "-y"], 600_000);
   } catch (err) {
@@ -219,12 +250,16 @@ function main() {
   // `last_plugin_update: null` for an update that had in fact succeeded. A
   // pre-written record is overwritten by the real outcome when this survives,
   // and is the outcome when it does not.
-  record({
-    ok: true,
-    step: "bootstrap",
-    plugin_root: newRoot,
-    note: "the new plugin version is installed; the server is being handed over",
-  });
+  record(
+    {
+      ok: true,
+      step: "bootstrap",
+      plugin_root: newRoot,
+      note: "the new plugin version is installed; the server is being handed over",
+    },
+    { final: false }
+  );
+  progress("bootstrap");
   try {
     // Foreground and blocking: this stops the old server (us), waits for the
     // ports, then starts the new one. It must finish before we record success.