fix(web): report a no-op plugin update as already up to date

update_plugin() returns True both for a real update and for "nothing to
do" (a ZIP-installed monorepo plugin already at the registry version, a
bundled plugin). With no git commit to compare, POST /plugins/update
called every such success "updated successfully", so Check & Update All
counted most official plugins as updated on every run.

The route now reads what changed off the plugin itself (commit, else
manifest version, else last_updated) and returns data.update_status
(updated / up_to_date / local_only). The update-all toast is summarised
by PluginInstallManager.summarizeUpdateResults from that status, falling
back to the message for older servers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/js/unit/test_update_all.js

@@ -146,6 +146,33 @@ const noSleep = { sleep: async () => {} };
     ok('...and is reported as a failure', results.find(x => x.pluginId === 'static-image').success === false);
   }
 
+  console.log('\nsummary: a no-op update is not counted as updated');
+  {
+    const answer = (update_status, message) => ({ success: true, result: { status: 'success', message, data: { update_status } } });
+    const results = [
+      answer('updated', 'Plugin a updated to version 2.8.0'),
+      // ZIP-installed monorepo plugin already at the registry version: the
+      // route used to call this "updated successfully".
+      answer('up_to_date', 'Plugin stock-news already up to date (version 2.8.0)'),
+      answer('up_to_date', 'Plugin clock already up to date (commit abcdef1)'),
+      answer('local_only', 'Plugin mine is managed locally and does not receive registry updates'),
+      { success: false, error: { error_code: 'PLUGIN_UPDATE_FAILED' } },
+    ];
+    const s = Manager.summarizeUpdateResults(results);
+    ok('counts come from update_status',
+       s.updated === 1 && s.upToDate === 2 && s.localOnly === 1 && s.failed === 1, s);
+    ok('toast text names each outcome',
+       s.text === '1 updated, 2 already up to date, 1 managed locally, 1 failed', s.text);
+    ok('a failure alongside an update is a warning', s.type === 'warning', s.type);
+    ok('an older server that only says so in the message is still up to date',
+       Manager.updateOutcome({ success: true, result: { message: 'Plugin x already up to date (commit 1234567)' } }) === 'up_to_date');
+    ok('a success without a status or telltale message counts as updated',
+       Manager.updateOutcome({ success: true, result: { message: 'Plugin x updated successfully' } }) === 'updated');
+    const allNoop = Manager.summarizeUpdateResults([answer('up_to_date', ''), answer('up_to_date', '')]);
+    ok('nothing to do is a success toast with no "updated"',
+       allNoop.type === 'success' && allNoop.text === '2 already up to date', allNoop);
+  }
+
   console.log(`\n${pass} passed, ${fail} failed`);
   process.exit(fail ? 1 : 0);
 })().catch(e => { console.error(e); process.exit(1); });

test/web_interface/test_update_all_plugins.py

@@ -80,6 +80,67 @@ class TestUpdateRouteRejectsStarlarkIds:
         assert [c.args[0] for c in store.update_plugin.call_args_list] == ['stock-news', 'starlark-apps']
 
 
+class TestUpdateRouteReportsNoOps:
+    """update_plugin() answers True when there was nothing to do.
+
+    A ZIP-installed monorepo plugin (no .git) already at the registry version
+    is the common case for official plugins. The route used to call that
+    "updated successfully", so Check & Update All counted it as updated.
+    """
+
+    def _install(self, tmp_path, pid, version, last_updated='2026-09-01'):
+        (tmp_path / pid).mkdir()
+        (tmp_path / pid / 'manifest.json').write_text(
+            '{"id": "%s", "version": "%s", "last_updated": "%s"}' % (pid, version, last_updated),
+            encoding='utf-8')
+
+    def test_a_zip_plugin_already_at_the_registry_version_is_up_to_date(self, client, store, tmp_path):
+        self._install(tmp_path, 'stock-news', '2.8.0')
+        body = client.post('/api/v3/plugins/update', json={'plugin_id': 'stock-news'}).get_json()
+        assert body['status'] == 'success'
+        assert body['data']['update_status'] == 'up_to_date'
+        assert 'already up to date' in body['message'], body
+        assert 'updated successfully' not in body['message']
+
+    def test_a_zip_plugin_reinstalled_at_a_new_version_is_updated(self, client, store, tmp_path):
+        self._install(tmp_path, 'stock-news', '2.6.2')
+
+        def reinstall(pid):
+            (tmp_path / pid / 'manifest.json').write_text(
+                '{"id": "%s", "version": "2.8.0", "last_updated": "2026-09-01"}' % pid,
+                encoding='utf-8')
+            return True
+        store.update_plugin.side_effect = reinstall
+
+        body = client.post('/api/v3/plugins/update', json={'plugin_id': 'stock-news'}).get_json()
+        assert body['data']['update_status'] == 'updated'
+        assert '2.8.0' in body['message'], body
+
+    def test_a_git_plugin_whose_commit_is_unchanged_is_up_to_date(self, client, store, tmp_path):
+        self._install(tmp_path, 'clock', '1.0.0')
+        store._get_local_git_info.return_value = {'sha': 'abcdef1234567', 'branch': 'main'}
+        body = client.post('/api/v3/plugins/update', json={'plugin_id': 'clock'}).get_json()
+        assert body['data']['update_status'] == 'up_to_date'
+
+    def test_a_git_plugin_that_moved_is_updated(self, client, store, tmp_path):
+        self._install(tmp_path, 'clock', '1.0.0')
+        store._get_local_git_info.side_effect = [
+            {'sha': 'aaaaaaa000', 'branch': 'main'},   # before
+            {'sha': 'aaaaaaa000', 'branch': 'main'},   # is-git check
+            {'sha': 'bbbbbbb111', 'branch': 'main'},   # after
+        ]
+        body = client.post('/api/v3/plugins/update', json={'plugin_id': 'clock'}).get_json()
+        assert body['data']['update_status'] == 'updated', body
+
+    def test_a_local_only_plugin_says_so(self, client, store, tmp_path):
+        (tmp_path / 'mine').mkdir()
+        (tmp_path / 'mine' / 'manifest.json').write_text(
+            '{"id": "mine", "version": "0.1.0", "local_only": true}', encoding='utf-8')
+        body = client.post('/api/v3/plugins/update', json={'plugin_id': 'mine'}).get_json()
+        assert body['data']['update_status'] == 'local_only'
+        store.update_plugin.assert_not_called()
+
+
 class TestInstalledListContract:
     """What update-all filters on is what /plugins/installed publishes."""