@devshop/crew 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [0.8.1](https://github.com/devshop-software/crew/compare/v0.8.0...v0.8.1) (2026-04-30)
+
+
+### Bug Fixes
+
+* don't rewrite users' version range on self-update ([a85a3c3](https://github.com/devshop-software/crew/commit/a85a3c38485f9613bb5a3f679dff08d472601568))
+
+# [0.8.0](https://github.com/devshop-software/crew/compare/v0.7.0...v0.8.0) (2026-04-30)
+
+
+### Features
+
+* redesigned crew update — plan, confirm, optional backup, auto-remove ([4859ca0](https://github.com/devshop-software/crew/commit/4859ca0f7a424ab32b14fa8bf3ef5ed83c26a6a1))
+
 # [0.7.0](https://github.com/devshop-software/crew/compare/v0.6.0...v0.7.0) (2026-04-30)
 
 

package/README.md

@@ -17,7 +17,16 @@ pnpm add -D @devshop/crew
 pnpm exec crew init
 ```
 
-To pull newer skill content later, just run `pnpm exec crew update` — it auto-detects the package manager (pnpm/npm/yarn/bun) from your lockfile, runs `<pm> update @devshop/crew` to refresh the local install, then re-execs the freshly-installed CLI to apply the new skills. Pass `--no-self-update` to skip the package bump and only re-apply what's already on disk.
+To pull newer skill content later, run `pnpm exec crew update`. The flow:
+
+1. Auto-detects the package manager (pnpm / npm / yarn / bun) from your lockfile and runs `<pm> update @devshop/crew` to bump the package within the range you've pinned in `package.json`. To always pull the absolute newest (including across major versions), set the range to `"latest"`; for "any 0.x" use `"0.x"`.
+2. Re-execs the freshly-installed CLI.
+3. Computes the diff and prints a plan: which skills will be added, updated, replaced (had local edits), or removed (no longer in the package).
+4. Prompts `Apply these changes? [Y/n]`. Default Y. Press `n` to abort with no writes.
+5. Prompts `Back up current versions to .bak/<utc>/? [y/N]`. Default N. Press `y` to keep a snapshot of the pre-change state.
+6. Applies the changes — including removing skills the package no longer ships.
+
+`--yes` makes it non-interactive and CI-safe (auto-applies, defaults backup to Y to protect against accidentally clobbering edits in CI). `--force` is destructive: auto-applies and skips backup. `--dry-run` shows the plan without writing. `--no-self-update` skips step 1 (only re-applies what's already on disk from the existing local install).
 
 This copies the skills into `./.claude/skills/`, writes a manifest, and appends a `## Workflow Config` block to `CLAUDE.md` (creating it if absent).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devshop/crew",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Project-agnostic Claude Code skills for spec → implement → qa → review → ship",
   "bin": {
     "crew": "scripts/cli.js"

package/scripts/commands/update.js

@@ -1,8 +1,9 @@
 const path = require('path');
+const fs = require('fs');
 const { resolveTarget } = require('../lib/paths');
 const { readManifest, writeManifest, diffSkills, PACKAGE_NAME, SCHEMA_VERSION } = require('../lib/manifest');
-const { copyFolder, backupFolder, backupRoot } = require('../lib/fsx');
-const { chooseEditAction } = require('../lib/prompt');
+const { copyFolder, backupFolder, removeFolder, backupRoot } = require('../lib/fsx');
+const { Prompter } = require('../lib/prompt');
 const { runSelfUpdate } = require('../lib/self-update');
 const log = require('../lib/log');
 
@@ -11,9 +12,8 @@ const PKG_VERSION = require(path.join(PKG_ROOT, 'package.json')).version;
 const PKG_SKILLS = path.join(PKG_ROOT, 'skills');
 
 module.exports = async function update(flags) {
-  // If installed as a local dep, bump the package via the project's package
-  // manager first, then re-exec the freshly-installed CLI to do the actual
-  // skill update. Skipped for global/dlx invocations (no project lockfile).
+  // Self-update via the project's PM (pnpm/npm/yarn/bun) with --latest, then
+  // re-exec the freshly-installed CLI to do the real work.
   const self = runSelfUpdate(flags, log);
   if (self.error) { log.error(self.message); return self.exitCode; }
   if (self.reExec) return self.exitCode;
@@ -33,67 +33,124 @@ module.exports = async function update(flags) {
 
   const manifestVersionBefore = manifest.package_version;
   const diff = diffSkills(PKG_SKILLS, skillsDir, manifest);
-  let bakBase = null;
-  let refused = false;
-  let ioError = false;
-  const now = new Date().toISOString();
-  const interactive = process.stdin.isTTY || process.env.CREW_FAKE_TTY === '1';
-  const stamp = (name, hash) => { manifest.skills[name] = { version: PKG_VERSION, hash, installed_at: now }; };
-  const stats = { added: 0, updated: 0, keptEdited: 0, droppedFromPackage: 0, unchanged: 0 };
 
+  // Categorize per-skill changes the user needs to consent to.
+  // - add:     missing on disk, present in package
+  // - update:  on disk + matches manifest, but package hash differs
+  // - replace: on disk, edited (manifest hash != disk hash) — about to clobber edits
+  // - remove:  in manifest + on disk, package no longer ships it
+  // managed-unchanged with matching hash → no-op (excluded)
+  // foreign with inPkg → leave per spec (excluded)
+  // foreign without inPkg → user's own folder, ignore (excluded)
+  const changes = [];
   for (const s of diff) {
-    // Skill in manifest+disk but no longer in the package — keep it but tell the user.
     if (!s.inPkg && s.inDisk && s.mfHash) {
-      log.warn(`kept (no longer in package): ${s.name}`);
-      stats.droppedFromPackage++;
-      continue;
+      changes.push({ name: s.name, kind: 'remove' });
+    } else if (s.inPkg && s.state === 'missing') {
+      changes.push({ name: s.name, kind: 'add', pkgHash: s.pkgHash });
+    } else if (s.inPkg && s.state === 'managed-unchanged' && s.diskHash !== s.pkgHash) {
+      changes.push({ name: s.name, kind: 'update', pkgHash: s.pkgHash });
+    } else if (s.inPkg && s.state === 'managed-edited') {
+      changes.push({ name: s.name, kind: 'replace', pkgHash: s.pkgHash, edited: true });
+    }
+  }
+
+  // Header
+  if (manifestVersionBefore && manifestVersionBefore !== PKG_VERSION) {
+    log.plain(`${PACKAGE_NAME}: ${manifestVersionBefore} → ${PKG_VERSION}`);
+  } else {
+    log.plain(`${PACKAGE_NAME}: ${PKG_VERSION}`);
+  }
+
+  if (changes.length === 0) {
+    log.plain('all up to date.');
+    if (!flags.dryRun && manifestVersionBefore !== PKG_VERSION) {
+      manifest.package_version = PKG_VERSION;
+      manifest.updated_at = new Date().toISOString();
+      try { writeManifest(skillsDir, manifest); }
+      catch (e) { log.error(`Failed writing manifest: ${e.message}`); return 3; }
+    }
+    return 0;
+  }
+
+  // Show plan
+  log.plain('');
+  log.plain('The following skills will change:');
+  const labelFor = (c) => {
+    if (c.kind === 'add') return 'add';
+    if (c.kind === 'update') return 'update';
+    if (c.kind === 'replace') return c.edited ? 'replace (you have local edits)' : 'replace';
+    if (c.kind === 'remove') return 'remove (no longer in package)';
+    return c.kind;
+  };
+  const w = Math.max(...changes.map(c => c.name.length));
+  for (const c of changes) log.plain(`  - ${c.name.padEnd(w)}  ${labelFor(c)}`);
+  log.plain('');
+
+  const interactive = process.stdin.isTTY || process.env.CREW_FAKE_TTY === '1';
+
+  // Single Prompter shared across the apply + backup prompts so we don't
+  // create/close a readline between them (which can drop buffered stdin).
+  const prompter = (interactive && !flags.force && !flags.yes) ? new Prompter() : null;
+  let apply;
+  let doBackup;
+  try {
+    if (flags.force || flags.yes) {
+      apply = true;
+    } else if (!interactive) {
+      log.error('Cannot prompt: stdin is not a TTY. Re-run with --yes or --force.');
+      return 1;
+    } else {
+      apply = await prompter.confirm('Apply these changes?', true);
+    }
+    if (!apply) {
+      log.plain('Aborted.');
+      return 1;
     }
-    if (!s.inPkg) continue;
+    // Backup prompt — interactive default N (per the new flow).
+    // --yes is CI-safe → backup edits defensively. --force is destructive → no backup.
+    if (flags.force) doBackup = false;
+    else if (flags.yes) doBackup = true;
+    else doBackup = await prompter.confirm('Back up current versions to .bak/<utc>/?', false);
+  } finally {
+    if (prompter) prompter.close();
+  }
+
+  // Apply
+  const now = new Date().toISOString();
+  const stamp = (name, hash) => { manifest.skills[name] = { version: PKG_VERSION, hash, installed_at: now }; };
+  let bakBase = null;
+  let ioError = false;
+
+  for (const c of changes) {
     try {
-      if (s.state === 'missing') {
-        if (flags.dryRun) log.dryRun('copy', s.name);
-        else { copyFolder(path.join(PKG_SKILLS, s.name), path.join(skillsDir, s.name)); log.action('copy', s.name); }
-        stamp(s.name, s.pkgHash);
-        stats.added++;
-      } else if (s.state === 'managed-unchanged') {
-        if (s.diskHash !== s.pkgHash) {
-          if (flags.dryRun) log.dryRun('replace', s.name);
-          else { copyFolder(path.join(PKG_SKILLS, s.name), path.join(skillsDir, s.name)); log.action('replace', s.name); }
-          stamp(s.name, s.pkgHash);
-          stats.updated++;
-        } else {
-          stats.unchanged++;
-        }
-      } else if (s.state === 'managed-edited') {
-        let action;
-        if (flags.force) action = 'replace';
-        else if (flags.yes) action = 'backup';
-        else if (!interactive) {
-          log.error(`Edited skill detected ('${s.name}') and stdin is not a TTY. Re-run with --yes or --force.`);
-          refused = true;
-          continue;
-        } else {
-          action = await chooseEditAction(s.name);
-        }
-        if (action === 'keep') {
-          if (flags.dryRun) log.dryRun('keep', s.name);
-          else log.action('keep', s.name);
-          stats.keptEdited++;
-          continue;
-        }
-        if (action === 'backup') {
-          bakBase = bakBase || backupRoot(skillsDir);
-          if (flags.dryRun) log.dryRun('backup', s.name);
-          else { backupFolder(path.join(skillsDir, s.name), bakBase); log.action('backup', s.name); }
+      const live = path.join(skillsDir, c.name);
+      const src = path.join(PKG_SKILLS, c.name);
+
+      if (doBackup && (c.kind === 'update' || c.kind === 'replace' || c.kind === 'remove')) {
+        bakBase = bakBase || backupRoot(skillsDir);
+        if (flags.dryRun) log.dryRun('backup', c.name);
+        else { backupFolder(live, bakBase); log.action('backup', c.name); }
+      }
+
+      if (c.kind === 'add') {
+        if (flags.dryRun) log.dryRun('add', c.name);
+        else { copyFolder(src, live); log.action('add', c.name); }
+        stamp(c.name, c.pkgHash);
+      } else if (c.kind === 'update' || c.kind === 'replace') {
+        if (!doBackup && fs.existsSync(live) && !flags.dryRun) removeFolder(live);
+        if (flags.dryRun) log.dryRun('replace', c.name);
+        else { copyFolder(src, live); log.action('replace', c.name); }
+        stamp(c.name, c.pkgHash);
+      } else if (c.kind === 'remove') {
+        if (!doBackup) {
+          if (flags.dryRun) log.dryRun('remove', c.name);
+          else { removeFolder(live); log.action('remove', c.name); }
         }
-        if (flags.dryRun) log.dryRun('replace', s.name);
-        else { copyFolder(path.join(PKG_SKILLS, s.name), path.join(skillsDir, s.name)); log.action('replace', s.name); }
-        stamp(s.name, s.pkgHash);
-        stats.updated++;
+        delete manifest.skills[c.name];
       }
-      // foreign: leave (don't touch)
     } catch (e) {
-      log.error(`I/O error on ${s.name}: ${e.message}`);
+      log.error(`I/O error on ${c.name}: ${e.message}`);
       ioError = true;
     }
   }
@@ -110,23 +167,14 @@ module.exports = async function update(flags) {
 
   // Summary
   log.plain('');
-  if (manifestVersionBefore && manifestVersionBefore !== PKG_VERSION) {
-    log.plain(`${PACKAGE_NAME}: ${manifestVersionBefore} → ${PKG_VERSION}`);
-  } else {
-    log.plain(`${PACKAGE_NAME}: ${PKG_VERSION}`);
-  }
+  const counts = changes.reduce((a, c) => (a[c.kind] = (a[c.kind] || 0) + 1, a), {});
   const parts = [];
-  if (stats.added) parts.push(`${stats.added} added`);
-  if (stats.updated) parts.push(`${stats.updated} updated`);
-  if (stats.keptEdited) parts.push(`${stats.keptEdited} edited (kept)`);
-  if (stats.droppedFromPackage) parts.push(`${stats.droppedFromPackage} no longer in package`);
-  if (stats.unchanged) parts.push(`${stats.unchanged} unchanged`);
-  log.plain(parts.length ? parts.join(', ') + '.' : 'nothing to do.');
-  if (stats.droppedFromPackage) {
-    log.plain(`Run \`crew uninstall && crew init\` to drop skills the package no longer ships.`);
-  }
+  if (counts.add) parts.push(`${counts.add} added`);
+  if (counts.update) parts.push(`${counts.update} updated`);
+  if (counts.replace) parts.push(`${counts.replace} replaced`);
+  if (counts.remove) parts.push(`${counts.remove} removed`);
+  log.plain(parts.join(', ') + '.');
 
   if (ioError) return 3;
-  if (refused) return 1;
   return 0;
 };

package/scripts/lib/prompt.js

@@ -1,40 +1,73 @@
 const readline = require('readline');
 
-function chooseEditAction(skillName) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const ask = () => {
+// One-shot confirm — creates and closes its own readline. OK for a single
+// question; if you need several in a row use Prompter so the interface (and
+// stdin's internal buffer) stays alive across them.
+function confirm(question, defaultYes = false) {
+  const p = new Prompter();
+  return p.confirm(question, defaultYes).finally(() => p.close());
+}
+
+class Prompter {
+  constructor() {
+    this._rl = readline.createInterface({ input: process.stdin });
+    this._lines = [];
+    this._waiters = [];
+    this._closed = false;
+    this._rl.on('line', (line) => {
+      if (this._waiters.length) this._waiters.shift()(line);
+      else this._lines.push(line);
+    });
+    this._rl.on('close', () => {
+      this._closed = true;
+      while (this._waiters.length) this._waiters.shift()(null);
+    });
+  }
+  _question(prompt) {
+    process.stdout.write(prompt);
+    if (this._lines.length) return Promise.resolve(this._lines.shift());
+    if (this._closed) return Promise.resolve(null);
+    return new Promise((resolve) => this._waiters.push(resolve));
+  }
+  async confirm(question, defaultYes = false) {
+    const hint = defaultYes ? '[Y/n]' : '[y/N]';
+    const answer = await this._question(`${question} ${hint} > `);
+    if (answer === null) return defaultYes;
+    const a = answer.trim().toLowerCase();
+    if (a === '') return defaultYes;
+    return a === 'y' || a === 'yes';
+  }
+  async chooseEditAction(skillName) {
+    while (true) {
       console.log(`The skill '${skillName}' has local edits.`);
       console.log('  (b) backup edits and replace  [default]');
       console.log('  (k) keep edits, skip update');
       console.log('  (r) replace, discard edits');
-      rl.question('> ', (answer) => {
-        const a = (answer || '').trim().toLowerCase();
-        if (a === '' || a === 'b') { rl.close(); resolve('backup'); }
-        else if (a === 'k') { rl.close(); resolve('keep'); }
-        else if (a === 'r') { rl.close(); resolve('replace'); }
-        else ask();
-      });
-    };
-    ask();
-  });
+      const answer = await this._question('> ');
+      if (answer === null) return 'backup';
+      const a = (answer || '').trim().toLowerCase();
+      if (a === '' || a === 'b') return 'backup';
+      if (a === 'k') return 'keep';
+      if (a === 'r') return 'replace';
+    }
+  }
+  close() { this._rl.close(); }
+}
+
+// Back-compat shims for init.js
+function chooseEditAction(skillName) {
+  const p = new Prompter();
+  return p.chooseEditAction(skillName).finally(() => p.close());
 }
 
 function confirmAbsorbForeign(skillNames) {
-  return new Promise((resolve) => {
-    console.log('');
-    console.log('The following skills already exist in .claude/skills/ but are not tracked by crew:');
-    console.log('');
-    for (const n of skillNames) console.log(`  - ${n}`);
-    console.log('');
-    console.log('Override and absorb them? Originals will be backed up to .claude/skills/.bak/<utc>/.');
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    rl.question('[y/N] > ', (answer) => {
-      rl.close();
-      const a = (answer || '').trim().toLowerCase();
-      resolve(a === 'y' || a === 'yes');
-    });
-  });
+  console.log('');
+  console.log('The following skills already exist in .claude/skills/ but are not tracked by crew:');
+  console.log('');
+  for (const n of skillNames) console.log(`  - ${n}`);
+  console.log('');
+  console.log('Override and absorb them? Originals will be backed up to .claude/skills/.bak/<utc>/.');
+  return confirm('[y/N]', false);
 }
 
-module.exports = { chooseEditAction, confirmAbsorbForeign };
+module.exports = { confirm, chooseEditAction, confirmAbsorbForeign, Prompter };

package/scripts/lib/self-update.js

@@ -38,6 +38,11 @@ function isLocalDep(projectRoot) {
   } catch { return false; }
 }
 
+// Range-respecting update so we don't rewrite the user's package.json
+// version specifier. To always pull the absolute latest across majors,
+// users can pin "@devshop/crew": "latest" in their package.json (a dist-tag,
+// not a semver range — never gets rewritten); for "all 0.x but never 1.x"
+// use "0.x". Any caret/tilde range will be honored as written.
 const UPDATE_ARGS = {
   pnpm: ['update', PACKAGE_NAME],
   npm: ['update', PACKAGE_NAME],