claudeup 4.42.0 → 5.0.0

package/src/cli/bootstrap.ts

@@ -0,0 +1,140 @@
+/**
+ * Manifest bootstrap — the "this repo has no profiles yet" path.
+ *
+ * `install` and `update` both require `.claude/profiles.json`. Rather than
+ * giving each a manifest-free fallback (two behaviours to keep in step, and a
+ * repo that never gets a committed manifest), a repo without one is offered
+ * adoption: claudeup writes the manifest that describes the project as it
+ * stands, then the original command proceeds against it normally.
+ */
+
+import {
+	getManifestPath,
+	readManifest,
+	writeManifest,
+} from "../services/manifest.js";
+import {
+	type AdoptResult,
+	adoptCurrentProject,
+} from "../services/profile-adopt.js";
+import type { ProfileManifest } from "../types/index.js";
+import { confirm } from "./prompt.js";
+
+/** Print what adoption would capture, so the user can judge it before writing. */
+function printAdoptionPlan(result: AdoptResult): void {
+	console.log(
+		"\nThis project has no .claude/profiles.json — claudeup can create one from its current setup.\n",
+	);
+	console.log(`  profile      ${result.profileId} (${result.entry.name})`);
+	console.log(
+		`  plugins      ${result.counts.plugins} enabled, adopted as "latest"`,
+	);
+	if (result.source === "user") {
+		// Never let this be invisible: the generated file is meant to be committed,
+		// and these came from ~/.claude/settings.json — this machine's personal
+		// global set, not anything this repo chose.
+		console.log(
+			"               ⚠ read from ~/.claude/settings.json (user scope) — this project",
+		);
+		console.log(
+			"                 enables none of its own. Review before committing.",
+		);
+	}
+	if (result.counts.mcpServers > 0) {
+		console.log(`  mcp servers  ${result.counts.mcpServers} from .mcp.json`);
+	}
+	if (result.counts.settingsKeys > 0) {
+		console.log(
+			`  settings     ${result.counts.settingsKeys} keys carried over`,
+		);
+	}
+	for (const id of result.skipped) {
+		console.log(
+			`  ⚠ skipped ${id} — no marketplace in its id, not reproducible`,
+		);
+	}
+	for (const hit of result.machinePaths) {
+		console.log(`  ⚠ machine path  ${hit}`);
+	}
+	if (result.machinePaths.length > 0) {
+		console.log(
+			"    Those name a directory on THIS machine and will not resolve on another.",
+		);
+	}
+	console.log(
+		"\nCommit the file to share this setup with the team; edit it to pin versions.",
+	);
+}
+
+export interface EnsureManifestOptions {
+	/**
+	 * Skip confirmation prompts. Deliberately does NOT authorize adoption —
+	 * `--yes` means "I already know what this will do", and nobody passing it to
+	 * an install has decided what their team's committed manifest should contain.
+	 */
+	yes?: boolean;
+	/** Read-only mode: never write, just report that adoption is needed. */
+	check?: boolean;
+	/**
+	 * Adopt without prompting. Set only by `claudeup profile init`, where
+	 * creating the manifest IS the command the user asked for.
+	 */
+	allowAdopt?: boolean;
+}
+
+/**
+ * Return the project's manifest, creating one by adoption if it has none.
+ *
+ * Resolves to null when there is no manifest and none was created — the caller
+ * should exit non-zero. Anything it prints has already explained why.
+ */
+export async function ensureManifest(
+	projectPath: string,
+	opts: EnsureManifestOptions = {},
+): Promise<ProfileManifest | null> {
+	const manifest = await readManifest(projectPath);
+	if (Object.keys(manifest.profiles).length > 0) return manifest;
+
+	const result = await adoptCurrentProject(projectPath);
+
+	if (result.counts.plugins === 0) {
+		console.error(
+			`No .claude/profiles.json in ${projectPath}, and no enabled plugins to adopt one from.`,
+		);
+		console.error(
+			"Open claudeup and select the plugins this project needs, then re-run.",
+		);
+		return null;
+	}
+
+	printAdoptionPlan(result);
+
+	if (opts.check) {
+		console.error(
+			"\n--check is read-only and will not create the manifest. Run `claudeup install` once to adopt.",
+		);
+		return null;
+	}
+
+	// `--yes` alone is NOT consent to author this file. It means "do not ask me
+	// about the thing I invoked", and someone running `claudeup update --yes` in
+	// CI invoked an update, not the creation of their team's committed contract —
+	// which this would otherwise write unreviewed, possibly from the machine's
+	// user-scope plugin set. Creating it needs either a human at the prompt or
+	// the command whose whole purpose is to create it.
+	if (opts.allowAdopt) {
+		// fall through to the write
+	} else if (!process.stdin.isTTY) {
+		console.error(
+			"\nRefusing to create .claude/profiles.json without a human: run `claudeup profile init` to create it deliberately.",
+		);
+		return null;
+	} else if (!(await confirm("\nCreate .claude/profiles.json?"))) {
+		console.log("Aborted — nothing written.");
+		return null;
+	}
+
+	await writeManifest(result.manifest, projectPath);
+	console.log(`✓ Wrote ${getManifestPath(projectPath)}\n`);
+	return result.manifest;
+}

package/src/cli/install.ts

@@ -13,46 +13,43 @@
  */
 
 import path from "node:path";
-import { createInterface } from "node:readline/promises";
-import type {
-	ProfileSkillRef,
-	ResolvedBin,
-	ResolvedClosure,
-	SkillInfo,
-} from "../types/index.js";
-import { readManifest, validateManifest } from "../services/manifest.js";
-import { resolveAllProfiles, resolveProfile } from "../services/resolver.js";
+import { installPlugin, isClaudeAvailable } from "../services/claude-cli.js";
+import {
+	readInstalledPluginsRegistry,
+	readLocalSettings,
+	writeLocalSettings,
+} from "../services/claude-settings.js";
+import { ensureGitignoreEntries } from "../services/conventions-manager.js";
 import {
 	computeEnvStatus,
 	computeVersionDrift,
 	summarizeClosure,
 } from "../services/install-plan.js";
-import {
-	binInstallCommand,
-	detectToolchains,
-	TOOLCHAIN_BOOTSTRAP,
-} from "../services/toolchain.js";
+import { validateManifest } from "../services/manifest.js";
+import { registerClosureMarketplaces } from "../services/marketplace-sync.js";
 import { materializeProfile } from "../services/profile-materializer.js";
+import { detectProfileDrift } from "../services/profile-sync.js";
+import { resolveAllProfiles, resolveProfile } from "../services/resolver.js";
+import { installSkill } from "../services/skills-manager.js";
 import {
+	PROFILE_GITIGNORE_ENTRIES,
 	activateProfile,
 	activeProfile,
-	PROFILE_GITIGNORE_ENTRIES,
 } from "../services/symlink-manager.js";
-import { ensureGitignoreEntries } from "../services/conventions-manager.js";
-import { detectProfileDrift } from "../services/profile-sync.js";
-import { resolveExecutable } from "../utils/command-utils.js";
 import {
-	addMarketplace,
-	installPlugin,
-	isClaudeAvailable,
-} from "../services/claude-cli.js";
-import {
-	isMarketplaceRegistered,
-	readInstalledPluginsRegistry,
-	readLocalSettings,
-	writeLocalSettings,
-} from "../services/claude-settings.js";
-import { installSkill } from "../services/skills-manager.js";
+	TOOLCHAIN_BOOTSTRAP,
+	binInstallCommand,
+	detectToolchains,
+} from "../services/toolchain.js";
+import type {
+	ProfileSkillRef,
+	ResolvedBin,
+	ResolvedClosure,
+	SkillInfo,
+} from "../types/index.js";
+import { resolveExecutable } from "../utils/command-utils.js";
+import { ensureManifest } from "./bootstrap.js";
+import { confirm, promptValue, runShell } from "./prompt.js";
 
 interface InstallFlags {
 	check: boolean;
@@ -70,35 +67,6 @@ function parseArgs(args: string[]): InstallFlags {
 	};
 }
 
-async function confirm(question: string): Promise<boolean> {
-	const rl = createInterface({ input: process.stdin, output: process.stdout });
-	try {
-		const answer = (await rl.question(`${question} [Y/n] `)).trim().toLowerCase();
-		return answer === "" || answer === "y" || answer === "yes";
-	} finally {
-		rl.close();
-	}
-}
-
-async function promptValue(question: string): Promise<string> {
-	const rl = createInterface({ input: process.stdin, output: process.stdout });
-	try {
-		return (await rl.question(question)).trim();
-	} finally {
-		rl.close();
-	}
-}
-
-/** Run a shell command, streaming output; resolve true on exit 0. */
-async function runShell(command: string): Promise<boolean> {
-	const { spawn } = await import("node:child_process");
-	return new Promise((resolve) => {
-		const child = spawn(command, { stdio: "inherit", shell: true });
-		child.on("exit", (code) => resolve(code === 0));
-		child.on("error", () => resolve(false));
-	});
-}
-
 // ── --check: read-only drift gate ───────────────────────────────────────────
 
 async function runCheck(
@@ -113,7 +81,9 @@ async function runCheck(
 	}
 	console.log("Plugin version drift:");
 	for (const d of drift) {
-		console.log(`  ✗ ${d.pluginId}  pinned ${d.pinned}, installed ${d.installed ?? "none"}`);
+		console.log(
+			`  ✗ ${d.pluginId}  pinned ${d.pinned}, installed ${d.installed ?? "none"}`,
+		);
 	}
 	if (strict) {
 		console.error("\nstrictVersions is on — failing.");
@@ -125,7 +95,10 @@ async function runCheck(
 
 // ── install steps ───────────────────────────────────────────────────────────
 
-async function ensureToolchains(closure: ResolvedClosure, yes: boolean): Promise<void> {
+async function ensureToolchains(
+	closure: ResolvedClosure,
+	yes: boolean,
+): Promise<void> {
 	// Only the binaries actually missing can need a toolchain. Checking all of
 	// them warns "pip isn't installed" on a machine whose pip-provided binaries
 	// are already on PATH — an alarming message about work that will not happen.
@@ -145,7 +118,11 @@ async function ensureToolchains(closure: ResolvedClosure, yes: boolean): Promise
 			);
 			continue;
 		}
-		const ok = yes || (await confirm(`${tc.name} is missing (needed by ${tc.requiredBy.join(", ")}). Install it?`));
+		const ok =
+			yes ||
+			(await confirm(
+				`${tc.name} is missing (needed by ${tc.requiredBy.join(", ")}). Install it?`,
+			));
 		if (ok) {
 			console.log(`Installing ${tc.name}…`);
 			if (!(await runShell(bootstrap))) {
@@ -155,20 +132,6 @@ async function ensureToolchains(closure: ResolvedClosure, yes: boolean): Promise
 	}
 }
 
-async function registerMarketplaces(closure: ResolvedClosure): Promise<void> {
-	for (const [name, ref] of Object.entries(closure.marketplaces)) {
-		try {
-			if (await isMarketplaceRegistered(name)) continue;
-			const source = ref.source === "github" ? ref.repo : ref.path;
-			if (!source) continue;
-			console.log(`+ marketplace ${name} (${source})`);
-			await addMarketplace(source);
-		} catch (e) {
-			console.warn(`⚠ marketplace ${name}: ${(e as Error).message}`);
-		}
-	}
-}
-
 /**
  * Install the closure's plugins at PROJECT scope.
  *
@@ -212,7 +175,11 @@ function toSkillInfo(ref: ProfileSkillRef): SkillInfo {
 	return {
 		id: `${ref.repo}/${ref.path}`,
 		name: ref.name,
-		source: { label: ref.repo, repo: ref.repo, skillsPath: path.dirname(ref.path) },
+		source: {
+			label: ref.repo,
+			repo: ref.repo,
+			skillsPath: path.dirname(ref.path),
+		},
 		repoPath: ref.path,
 		gitBlobSha: "",
 		frontmatter: null,
@@ -246,8 +213,11 @@ async function collectEnv(
 
 	console.log("\nMissing required environment variables:");
 	if (yes) {
-		for (const name of status.missingRequired) console.log(`  ! ${name} (unset)`);
-		console.log("Run without --yes to enter values, or set them in .claude/settings.local.json.");
+		for (const name of status.missingRequired)
+			console.log(`  ! ${name} (unset)`);
+		console.log(
+			"Run without --yes to enter values, or set them in .claude/settings.local.json.",
+		);
 		return;
 	}
 
@@ -269,7 +239,14 @@ export async function runInstallCommand(
 ): Promise<number> {
 	const flags = parseArgs(args);
 
-	const manifest = await readManifest(projectPath);
+	// A repo with no manifest is offered adoption rather than an error — see
+	// cli/bootstrap.ts for why there is no manifest-free install path.
+	const manifest = await ensureManifest(projectPath, {
+		yes: flags.yes,
+		check: flags.check,
+	});
+	if (!manifest) return 1;
+
 	const errors = validateManifest(manifest);
 	if (errors.length > 0) {
 		console.error("Invalid .claude/profiles.json:");
@@ -318,7 +295,9 @@ export async function runInstallCommand(
 	console.log(`\nPlan for ${flags.profile ?? "all profiles"}:`);
 	for (const line of summarizeClosure(closure)) console.log(`  ${line}`);
 	if (closure.conflicts?.length) {
-		console.log("\n⚠ Version conflicts across profiles (resolved to the higher pin):");
+		console.log(
+			"\n⚠ Version conflicts across profiles (resolved to the higher pin):",
+		);
 		for (const c of closure.conflicts) console.log(`  ${c}`);
 	}
 	console.log();
@@ -329,12 +308,14 @@ export async function runInstallCommand(
 	}
 
 	if (!(await isClaudeAvailable())) {
-		console.error("claude CLI not found on PATH — cannot install plugins/marketplaces.");
+		console.error(
+			"claude CLI not found on PATH — cannot install plugins/marketplaces.",
+		);
 		return 1;
 	}
 
 	await ensureToolchains(closure, flags.yes);
-	await registerMarketplaces(closure);
+	await registerClosureMarketplaces(closure.marketplaces);
 	await installPlugins(closure);
 	await installBins(closure.bins);
 
@@ -362,7 +343,8 @@ export async function runInstallCommand(
 		"# claudeup: generated profile build output + active-profile symlinks",
 	);
 
-	const activeId = flags.profile ?? (await pickActiveProfile(profileIds, flags.yes));
+	const activeId =
+		flags.profile ?? (await pickActiveProfile(profileIds, flags.yes));
 	if (activeId) {
 		await activateProfile(activeId, projectPath);
 		console.log(`\n✓ Active profile: ${activeId}`);

package/src/cli/profile.ts

@@ -8,19 +8,20 @@
  */
 
 import path from "node:path";
-import { readManifest } from "../services/manifest.js";
-import { resolveProfile } from "../services/resolver.js";
+import fs from "fs-extra";
+import { ensureGitignoreEntries } from "../services/conventions-manager.js";
+import { checkBinaries, missingBinaries } from "../services/doctor-bins.js";
 import { summarizeClosure } from "../services/install-plan.js";
+import { getManifestPath, readManifest } from "../services/manifest.js";
+import { syncProfile } from "../services/profile-sync.js";
+import { resolveProfile } from "../services/resolver.js";
 import {
+	PROFILE_GITIGNORE_ENTRIES,
 	activateProfile,
 	activeProfile,
 	profileDir,
-	PROFILE_GITIGNORE_ENTRIES,
 } from "../services/symlink-manager.js";
-import { ensureGitignoreEntries } from "../services/conventions-manager.js";
-import { syncProfile } from "../services/profile-sync.js";
-import { checkBinaries, missingBinaries } from "../services/doctor-bins.js";
-import fs from "fs-extra";
+import { ensureManifest } from "./bootstrap.js";
 
 export async function runProfileCommand(args: string[]): Promise<number> {
 	const [sub, ...rest] = args;
@@ -34,16 +35,46 @@ export async function runProfileCommand(args: string[]): Promise<number> {
 			return showProfile(rest[0], projectPath);
 		case "switch":
 			return switchProfile(rest[0], projectPath);
+		case "init":
+			return initProfile(
+				args.includes("--yes") || args.includes("-y"),
+				projectPath,
+			);
 		case "sync":
 			return syncActiveProfile(rest[0], projectPath);
 		default:
 			console.error(
-				`Unknown profile command "${sub}". Use: list | show <name> | switch <name> | sync`,
+				`Unknown profile command "${sub}". Use: list | show <name> | switch <name> | init | sync`,
 			);
 			return 1;
 	}
 }
 
+/**
+ * `profile init` — write a manifest describing this project as it stands.
+ *
+ * The same adoption `install`/`update` offer, available on its own so a repo
+ * can be brought under profile management without installing anything.
+ */
+export async function initProfile(
+	yes: boolean,
+	projectPath: string,
+): Promise<number> {
+	const existing = await readManifest(projectPath);
+	if (Object.keys(existing.profiles).length > 0) {
+		console.error(
+			`${getManifestPath(projectPath)} already defines: ${Object.keys(existing.profiles).join(", ")}`,
+		);
+		console.error(
+			`Use \`claudeup profile sync\` to promote local edits into it.`,
+		);
+		return 1;
+	}
+	// `profile init` exists to create the manifest, so it is the one caller that
+	// may do so unattended.
+	return (await ensureManifest(projectPath, { yes, allowAdopt: yes })) ? 0 : 1;
+}
+
 export async function listProfiles(projectPath: string): Promise<number> {
 	const manifest = await readManifest(projectPath);
 	const ids = Object.keys(manifest.profiles);
@@ -129,7 +160,8 @@ export async function switchProfile(
 			console.log(
 				`\n⚠ ${missing.length} binary dependenc${missing.length === 1 ? "y is" : "ies are"} missing:`,
 			);
-			for (const m of missing) console.log(`  ✗ ${m.name} — run: ${m.installCommand}`);
+			for (const m of missing)
+				console.log(`  ✗ ${m.name} — run: ${m.installCommand}`);
 			console.log(`Run \`claudeup install ${name}\` to install them.`);
 		}
 	} catch {

package/src/cli/prompt.ts

@@ -0,0 +1,42 @@
+/**
+ * Terminal prompting shared by the non-interactive commands.
+ *
+ * These lived inside cli/install.ts until `update` and the adopt flow needed
+ * the same three. One copy, so a fix to (say) the Y/n default reaches every
+ * command at once.
+ */
+
+import { createInterface } from "node:readline/promises";
+
+/** Y/n prompt. Empty input means yes. */
+export async function confirm(question: string): Promise<boolean> {
+	const rl = createInterface({ input: process.stdin, output: process.stdout });
+	try {
+		const answer = (await rl.question(`${question} [Y/n] `))
+			.trim()
+			.toLowerCase();
+		return answer === "" || answer === "y" || answer === "yes";
+	} finally {
+		rl.close();
+	}
+}
+
+/** Free-text prompt, trimmed. */
+export async function promptValue(question: string): Promise<string> {
+	const rl = createInterface({ input: process.stdin, output: process.stdout });
+	try {
+		return (await rl.question(question)).trim();
+	} finally {
+		rl.close();
+	}
+}
+
+/** Run a shell command, streaming output; resolve true on exit 0. */
+export async function runShell(command: string): Promise<boolean> {
+	const { spawn } = await import("node:child_process");
+	return new Promise((resolve) => {
+		const child = spawn(command, { stdio: "inherit", shell: true });
+		child.on("exit", (code) => resolve(code === 0));
+		child.on("error", () => resolve(false));
+	});
+}

package/src/cli/router.ts

@@ -8,10 +8,11 @@
 
 import { checkForUpdates } from "../services/version-check.js";
 import { runClaudeCommand } from "./claude.js";
-import { runUpdateCommand } from "./update.js";
+import { runDoctorCommand } from "./doctor.js";
 import { runInstallCommand } from "./install.js";
 import { runProfileCommand } from "./profile.js";
-import { runDoctorCommand } from "./doctor.js";
+import { runUpdateCommand } from "./update.js";
+import { runUpgradeCommand } from "./upgrade.js";
 
 export interface RouteOutcome {
 	/** A subcommand (or top-level flag) handled the invocation. */
@@ -39,7 +40,7 @@ export async function route(
 		const result = await checkForUpdates();
 		if (result.updateAvailable) {
 			console.log(`\nUpdate available: v${result.latestVersion}`);
-			console.log("Run: claudeup update");
+			console.log("Run: claudeup upgrade");
 		}
 		return HANDLED(0);
 	}
@@ -55,7 +56,9 @@ export async function route(
 		case "claude":
 			return HANDLED(await runClaudeCommand(rest));
 		case "update":
-			return HANDLED(await runUpdateCommand());
+			return HANDLED(await runUpdateCommand(rest));
+		case "upgrade":
+			return HANDLED(await runUpgradeCommand());
 		case "install":
 			return HANDLED(await runInstallCommand(rest));
 		case "profile":
@@ -81,16 +84,27 @@ Options:
   -h, --help     Show this help message
   --no-refresh   Skip auto-refresh of marketplaces on startup
 
-Team profiles — reproduce this repo's Claude Code setup on any machine.
-The manifest is .claude/profiles.json, committed. See docs/team-configuration.md.
-  install [profile]  Install the profile's plugins, binaries, skills and env,
-                     then activate it. No argument installs every profile.
+Dependency management — keep this project's plugins, CLI tools and skills
+installed and current. The manifest is .claude/profiles.json, committed; a repo
+without one is offered adoption on first run. See docs/team-configuration.md.
+  install [profile]  Install the profile's plugins, binaries, skills and env at
+                     the manifest's PINNED versions, then activate it.
+                     No argument installs every profile.
     --check          Report drift only, write nothing (exits 1 in strict mode)
     --yes, -y        Skip the confirmation prompt
     --force          Discard unsynced local edits instead of refusing
+  update [profile]   Keep the ACTIVE profile current: install whatever it
+                     declares but this machine lacks, and advance anything
+                     behind the version its marketplace publishes. Only the
+                     newest version is installable, so a pin naming an older
+                     one is reported, not chased.
+    --check          Report only, write nothing (exits 1 if anything is
+                     missing or known to be behind)
+    --yes, -y        Skip the confirmation prompt
   profile list       Show every profile; ● marks the active one
   profile show <n>   Print a profile's fully resolved closure
   profile switch <n> Repoint the active profile — offline, no reinstall
+  profile init       Write .claude/profiles.json from this project's setup
   profile sync       Promote local edits back into .claude/profiles.json
   doctor             Check binary deps, profile symlinks, and conventions
     --fix            Apply the repairs it can make itself
@@ -98,7 +112,7 @@ The manifest is .claude/profiles.json, committed. See docs/team-configuration.md
 Other commands:
   claude [args...]   Check for plugin updates (1h cache), then run claude
     -f, --force      Force update check (bypass 1h cache)
-  update             Update claudeup itself to latest version
+  upgrade            Update claudeup ITSELF to the latest version
 
 Navigation (TUI):
   [1] Plugins    [4] Settings   [7] Git State