claudeup 4.42.1 → 5.0.0

package/src/cli/update.ts

@@ -1,85 +1,473 @@
 /**
- * `claudeup update` — self-update.
+ * `claudeup update [profile] [--check] [--yes]`
  *
- * Detects claudeup installs across bun + npm global, warns on duplicates
- * (active vs shadowed), then re-installs `claudeup@latest` with whichever
- * package manager owns the active binary. Resolves with the child's exit code.
+ * Dependency management, not package management: no resolver, no lockfile, no
+ * version negotiation. `claudeup install` puts the profile's declared set on
+ * this machine; `claudeup update` keeps it current — anything the profile
+ * declares but the machine lacks is installed, and anything behind the version
+ * its marketplace publishes is advanced to it.
+ *
+ * Scope is the ACTIVE profile, not the union of every profile: "update my
+ * dependencies" means the set actually in use. Pass a name to update another.
+ *
+ * Self-update moved to `claudeup upgrade`.
  */
 
-import { spawn } from "node:child_process";
-
-export async function runUpdateCommand(): Promise<number> {
-	const { execSync } = await import("node:child_process");
-	const { existsSync } = await import("node:fs");
-
-	// Detect all installations of claudeup across package managers
-	const installations: Array<{ manager: "bun" | "npm"; path: string }> = [];
-
-	// Check bun global
-	try {
-		const bunGlobalBin = execSync("bun pm -g bin", {
-			encoding: "utf-8",
-			timeout: 5000,
-		}).trim();
-		const bunPath = `${bunGlobalBin}/claudeup`;
-		if (existsSync(bunPath)) installations.push({ manager: "bun", path: bunPath });
-	} catch {
-		// bun not installed or no global claudeup
-	}
-
-	// Check npm global
-	try {
-		const npmPrefix = execSync("npm prefix -g", {
-			encoding: "utf-8",
-			timeout: 5000,
-		}).trim();
-		const npmPath = `${npmPrefix}/bin/claudeup`;
-		if (existsSync(npmPath)) installations.push({ manager: "npm", path: npmPath });
-	} catch {
-		// npm not installed or no global claudeup
-	}
-
-	// Warn about duplicate installations
-	if (installations.length > 1) {
-		const activePath = execSync("which claudeup", {
-			encoding: "utf-8",
-			timeout: 5000,
-		}).trim();
-
-		console.log(`⚠ claudeup is installed via multiple package managers:\n`);
-		for (const inst of installations) {
-			const tag = inst.path === activePath ? " (active)" : " (shadowed)";
-			console.log(`  ${inst.manager}: ${inst.path}${tag}`);
+import path from "node:path";
+import type { PluginScope } from "../services/claude-cli.js";
+import {
+	isClaudeAvailable,
+	repairPlugin,
+	updatePlugin,
+} from "../services/claude-cli.js";
+import { clearContentDriftCache } from "../services/content-drift.js";
+import { checkBinaries } from "../services/doctor-bins.js";
+import { validateManifest } from "../services/manifest.js";
+import { refreshRegisteredMarketplaces } from "../services/marketplace-refresh.js";
+import { registerClosureMarketplaces } from "../services/marketplace-sync.js";
+import {
+	type PluginInfo,
+	clearMarketplaceCache,
+	getAvailablePlugins,
+	readInstalledVersionForScope,
+	saveInstalledPluginVersionForScope,
+} from "../services/plugin-manager.js";
+import { resolveProfile } from "../services/resolver.js";
+import { installSkill } from "../services/skills-manager.js";
+import { getInstalledSkillNames } from "../services/skills-manager.js";
+import { activeProfile } from "../services/symlink-manager.js";
+import { binInstallCommand, binUpgradeCommand } from "../services/toolchain.js";
+import {
+	type PluginUpdateItem,
+	type UpdatePlan,
+	planBinUpdates,
+	planHasWork,
+	planIsBehind,
+	planPluginUpdates,
+	planSkillUpdates,
+	summarizePlan,
+} from "../services/update-plan.js";
+import type { ProfileSkillRef, SkillInfo } from "../types/index.js";
+import { ensureManifest } from "./bootstrap.js";
+import { confirm, runShell } from "./prompt.js";
+
+interface UpdateFlags {
+	check: boolean;
+	yes: boolean;
+	profile?: string;
+}
+
+function parseArgs(args: string[]): UpdateFlags {
+	return {
+		check: args.includes("--check"),
+		yes: args.includes("--yes") || args.includes("-y"),
+		profile: args.find((a) => !a.startsWith("-")),
+	};
+}
+
+// ── report ───────────────────────────────────────────────────────────────────
+
+/** Left-pad the id column so versions line up in the report. */
+function pad(text: string, width: number): string {
+	return text.length >= width ? text : text + " ".repeat(width - text.length);
+}
+
+function describePlugin(item: PluginUpdateItem): string {
+	// An exact pin that cannot be delivered carries a note on install/update/
+	// current alike. It must ride along on every one of them: the whole point is
+	// that the manifest says one thing and the machine will hold another, and a
+	// row reading a bare "= 9.9.9" against a pin of 4.6.1 hides exactly that.
+	const suffix = item.note ? `  (${item.note})` : "";
+	switch (item.action) {
+		case "install":
+			return `+ install  ${item.target ?? "latest"}${suffix}`;
+		case "update":
+			return `↑ ${item.installed} → ${item.target}${suffix}`;
+		case "repair":
+			return `⟳ repair   ${item.installed} (${item.note})`;
+		case "unknown":
+			return `? unknown  ${item.installed} (${item.note})`;
+		case "current":
+			return `= ${item.installed}${suffix}`;
+	}
+}
+
+function printPlan(plan: UpdatePlan): void {
+	const width = Math.max(
+		12,
+		...plan.plugins.map((p) => p.pluginId.length),
+		...plan.bins.map((b) => b.name.length),
+		...plan.skills.map((s) => s.name.length),
+	);
+
+	if (plan.plugins.length > 0) {
+		console.log("Plugins:");
+		for (const item of plan.plugins) {
+			console.log(`  ${pad(item.pluginId, width)}  ${describePlugin(item)}`);
 		}
-		console.log(`\nTo fix, keep one and remove the other:`);
-		for (const inst of installations) {
-			console.log(`  ${inst.manager} uninstall -g claudeup`);
+	}
+
+	if (plan.bins.length > 0) {
+		console.log("\nCLI tools:");
+		for (const item of plan.bins) {
+			const spec = plan.binSpecs.get(item.name);
+			const verb =
+				item.action === "current" || !spec
+					? `= pinned ${item.version}`
+					: item.action === "install"
+						? `+ install  ${binInstallCommand(spec)}`
+						: `↑ upgrade  ${binUpgradeCommand(spec)}`;
+			console.log(`  ${pad(item.name, width)}  ${verb}`);
 		}
-		console.log();
 	}
 
-	// Determine which package manager to use for the update
-	let usesBun = false;
-	try {
-		const claudeupPath = execSync("which claudeup", {
-			encoding: "utf-8",
-		}).trim();
-		usesBun = claudeupPath.includes(".bun") || claudeupPath.includes("bun/bin");
-	} catch {
-		// If which fails, default to npm
+	if (plan.skills.length > 0) {
+		console.log("\nSkills:");
+		for (const item of plan.skills) {
+			console.log(
+				`  ${pad(item.name, width)}  ${item.action === "install" ? "+ install" : "↑ refresh"}`,
+			);
+		}
 	}
+}
+
+// ── apply ────────────────────────────────────────────────────────────────────
+
+/** Map a manifest skill ref to the SkillInfo shape installSkill expects. */
+function toSkillInfo(ref: ProfileSkillRef): SkillInfo {
+	return {
+		id: `${ref.repo}/${ref.path}`,
+		name: ref.name,
+		source: {
+			label: ref.repo,
+			repo: ref.repo,
+			skillsPath: path.dirname(ref.path),
+		},
+		repoPath: ref.path,
+		gitBlobSha: "",
+		frontmatter: null,
+		installed: false,
+		installedScope: null,
+		hasUpdate: false,
+	};
+}
 
-	const pkgManager = usesBun ? "bun" : "npm";
-	console.log(`Updating claudeup using ${pkgManager}...`);
+interface ApplyResult {
+	ok: number;
+	failed: string[];
+}
+
+/** An exact pin the installer could not deliver, discovered by reading back. */
+export interface PinMismatch {
+	pluginId: string;
+	pinned: string;
+	actual: string | null;
+	scope: PluginScope;
+}
+
+export interface PluginApplyResult extends ApplyResult {
+	mismatches: PinMismatch[];
+}
+
+/**
+ * The four side-effecting calls the plugin apply path makes, injectable so the
+ * path itself can be tested.
+ *
+ * This exists because the apply half shipped with no coverage while the pure
+ * planner had forty tests — and every real defect found in review lived here,
+ * not there. Following the same shape `checkBinaries` and `resolveProfile`
+ * already use for their impure edges.
+ */
+export interface PluginApplyDeps {
+	update: (pluginId: string, scope: PluginScope) => Promise<void>;
+	repair: (
+		pluginId: string,
+		scope: PluginScope,
+		projectPath: string,
+	) => Promise<void>;
+	readInstalled: (
+		pluginId: string,
+		scope: PluginScope,
+		projectPath: string,
+	) => Promise<string | null>;
+	saveInstalled: (
+		pluginId: string,
+		version: string,
+		scope: PluginScope,
+		projectPath: string,
+	) => Promise<void>;
+}
+
+const REAL_PLUGIN_DEPS: PluginApplyDeps = {
+	update: updatePlugin,
+	repair: repairPlugin,
+	readInstalled: readInstalledVersionForScope,
+	saveInstalled: saveInstalledPluginVersionForScope,
+};
 
-	const installArgs = ["install", "-g", "claudeup@latest"];
+export async function applyPlugins(
+	items: PluginUpdateItem[],
+	projectPath: string,
+	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
+): Promise<PluginApplyResult> {
+	const result: PluginApplyResult = { ok: 0, failed: [], mismatches: [] };
 
-	return new Promise<number>((resolve) => {
-		const proc = spawn(pkgManager, installArgs, {
-			stdio: "inherit",
-			shell: false, // Avoid shell for security (fixes DEP0190 warning)
-		});
-		proc.on("exit", (code) => resolve(code ?? 0));
-		proc.on("error", () => resolve(1));
+	for (const item of items) {
+		if (item.action === "current" || item.action === "unknown") continue;
+
+		// A plugin the profile declares but nothing has installed goes in at
+		// PROJECT scope, matching `install`: a profile is a property of one repo,
+		// so its plugins must not be enabled machine-wide.
+		const scopes: PluginScope[] =
+			item.action === "install" ? ["project"] : item.scopes;
+		if (scopes.length === 0) continue;
+
+		try {
+			for (const scope of scopes) {
+				if (item.action === "repair") {
+					await deps.repair(item.pluginId, scope, projectPath);
+				} else {
+					await deps.update(item.pluginId, scope);
+				}
+
+				// Record what LANDED, not what we asked for.
+				//
+				// `claude plugin install` accepts no version, so an exact pin is a
+				// request the installer cannot honour — it fetches whatever the
+				// marketplace publishes now. Writing `item.target` here recorded the
+				// pin as satisfied whatever actually installed, and `install --check`
+				// reads that same field to decide whether the machine has drifted.
+				// The gate would have compared the pin against a copy of itself and
+				// reported clean forever.
+				const actual = await deps.readInstalled(
+					item.pluginId,
+					scope,
+					projectPath,
+				);
+				if (actual) {
+					await deps.saveInstalled(item.pluginId, actual, scope, projectPath);
+				}
+				if (item.pinned !== "latest" && actual !== item.pinned) {
+					result.mismatches.push({
+						pluginId: item.pluginId,
+						pinned: item.pinned,
+						actual,
+						scope,
+					});
+				}
+			}
+			console.log(`✓ ${item.pluginId} (${scopes.join(", ")})`);
+			result.ok++;
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			console.warn(`⚠ ${item.pluginId}: ${msg}`);
+			result.failed.push(item.pluginId);
+		}
+	}
+
+	return result;
+}
+
+async function applyBins(plan: UpdatePlan): Promise<ApplyResult> {
+	const result: ApplyResult = { ok: 0, failed: [] };
+	for (const item of plan.bins) {
+		if (item.action === "current") continue;
+		const bin = plan.binSpecs.get(item.name);
+		if (!bin) continue;
+		const cmd =
+			item.action === "install"
+				? binInstallCommand(bin)
+				: binUpgradeCommand(bin);
+		console.log(`\n$ ${cmd}`);
+		if (await runShell(cmd)) result.ok++;
+		else result.failed.push(item.name);
+	}
+	return result;
+}
+
+async function applySkills(
+	plan: UpdatePlan,
+	projectPath: string,
+): Promise<ApplyResult> {
+	const result: ApplyResult = { ok: 0, failed: [] };
+	for (const item of plan.skills) {
+		try {
+			await installSkill(toSkillInfo(item.ref), "project", projectPath);
+			console.log(`✓ skill ${item.name}`);
+			result.ok++;
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			console.warn(`⚠ skill ${item.name}: ${msg}`);
+			result.failed.push(item.name);
+		}
+	}
+	return result;
+}
+
+// ── entry point ──────────────────────────────────────────────────────────────
+
+export async function runUpdateCommand(
+	args: string[],
+	projectPath: string = process.cwd(),
+): Promise<number> {
+	const flags = parseArgs(args);
+
+	const manifest = await ensureManifest(projectPath, {
+		yes: flags.yes,
+		check: flags.check,
 	});
+	if (!manifest) return 1;
+
+	const errors = validateManifest(manifest);
+	if (errors.length > 0) {
+		console.error("Invalid .claude/profiles.json:");
+		for (const e of errors) console.error(`  ${e.path}: ${e.message}`);
+		return 1;
+	}
+
+	const profileIds = Object.keys(manifest.profiles);
+	if (flags.profile && !manifest.profiles[flags.profile]) {
+		console.error(
+			`Profile "${flags.profile}" not found. Available: ${profileIds.join(", ")}`,
+		);
+		return 1;
+	}
+
+	// Active profile, not the union — "update my dependencies" means the set in
+	// use. A single-profile manifest needs no activation to be unambiguous.
+	const targetId =
+		flags.profile ??
+		(await activeProfile(projectPath)) ??
+		(profileIds.length === 1 ? profileIds[0] : undefined);
+	if (!targetId) {
+		console.error(
+			`No active profile. Pass one: claudeup update <${profileIds.join("|")}>`,
+		);
+		return 1;
+	}
+
+	const closure = await resolveProfile(manifest, targetId);
+
+	// "latest" is only as fresh as the catalog. Fast-forward the marketplace
+	// clones first, then drop every cached answer derived from the old HEAD —
+	// skipping this is how a clone sits days behind while every plugin reads as
+	// up to date.
+	console.log(`Updating profile "${targetId}"…\n`);
+	const refresh = await refreshRegisteredMarketplaces();
+	if (refresh.refreshed.length > 0) {
+		console.log(`✓ Refreshed marketplaces: ${refresh.refreshed.join(", ")}`);
+	}
+	for (const name of refresh.autoUpdateDisabled) {
+		console.log(
+			`⚠ ${name}: auto-update disabled — its catalog will not refresh, so updates stay hidden.`,
+		);
+	}
+	for (const name of refresh.failed) {
+		console.warn(`⚠ Failed to refresh marketplace: ${name}`);
+	}
+	clearMarketplaceCache();
+	clearContentDriftCache();
+
+	const catalog = new Map<string, PluginInfo>(
+		(await getAvailablePlugins(projectPath)).map((p) => [p.id, p]),
+	);
+	const binChecks = await checkBinaries(closure.bins);
+	const installedSkills = await getInstalledSkillNames("project", projectPath);
+
+	const plan: UpdatePlan = {
+		profileId: targetId,
+		plugins: planPluginUpdates(closure.plugins, catalog),
+		bins: planBinUpdates(closure.bins, binChecks),
+		skills: planSkillUpdates(closure.skills, installedSkills),
+		binSpecs: new Map(closure.bins.map((b) => [b.name, b])),
+	};
+
+	console.log();
+	printPlan(plan);
+
+	const counts = summarizePlan(plan);
+	if (counts.unknown > 0) {
+		console.log(
+			`\n⚠ ${counts.unknown} plugin(s) could not be checked. They are NOT reported as up to date — re-run once the catalog is reachable.`,
+		);
+	}
+
+	// `--check` gates on planIsBehind, not planHasWork. An already-installed
+	// skill is re-fetched on every apply because its manifest ref carries no
+	// content hash, and an unpinned binary has no version probe at all — neither
+	// is evidence that anything is out of date, and counting them made the gate
+	// exit 1 forever for any profile declaring a single skill.
+	if (flags.check) {
+		if (!planIsBehind(plan)) {
+			console.log("\n✓ Nothing missing and nothing behind.");
+			return 0;
+		}
+		console.error("\nUpdates available. Run `claudeup update` to apply.");
+		return 1;
+	}
+
+	if (!planHasWork(plan)) {
+		console.log(`\nEverything is up to date (${counts.current} items).`);
+		return 0;
+	}
+
+	if (!flags.yes && !(await confirm("\nApply?"))) {
+		console.log("Aborted.");
+		return 0;
+	}
+
+	if (!(await isClaudeAvailable())) {
+		console.error(
+			"claude CLI not found on PATH — cannot install or update plugins.",
+		);
+		return 1;
+	}
+
+	// Register any marketplace the profile names but this machine does not know.
+	// Without this an install fails with "not found in marketplace" for anything
+	// outside claudeup's built-in list, which is every private or third-party one.
+	await registerClosureMarketplaces(closure.marketplaces);
+
+	console.log();
+	const pluginResult = await applyPlugins(plan.plugins, projectPath);
+	const binResult = await applyBins(plan);
+	const skillResult = await applySkills(plan, projectPath);
+
+	const failed = [
+		...pluginResult.failed,
+		...binResult.failed,
+		...skillResult.failed,
+	];
+	const changed = pluginResult.ok + binResult.ok + skillResult.ok;
+
+	console.log(
+		`\n${changed} updated, ${counts.current} already current${
+			counts.unknown > 0 ? `, ${counts.unknown} unverified` : ""
+		}${failed.length > 0 ? `, ${failed.length} failed` : ""}.`,
+	);
+
+	// An exact pin the installer could not deliver. Reported, never fatal: only
+	// the newest published version is installable, so this is a standing property
+	// of the manifest rather than something this run did wrong, and failing here
+	// would make `claudeup update` exit 1 forever for any profile with a pin.
+	// `install --check` with `strictVersions` is where pin drift is GATED.
+	if (pluginResult.mismatches.length > 0) {
+		console.log(
+			`\nNote — ${pluginResult.mismatches.length} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+		);
+		for (const m of pluginResult.mismatches) {
+			console.log(
+				`  ${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,
+			);
+		}
+		console.log(
+			"Recorded what is actually installed. Update the pin to match, or leave it as a record of intent.",
+		);
+	}
+
+	if (failed.length > 0) {
+		console.error(`Failed: ${failed.join(", ")}`);
+		return 1;
+	}
+	return 0;
 }

package/src/cli/upgrade.ts

@@ -0,0 +1,89 @@
+/**
+ * `claudeup upgrade` — self-update.
+ *
+ * This is what `claudeup update` used to do. `update` now means what it means
+ * in every package manager — bring THIS PROJECT's dependencies up to date —
+ * and advancing the tool itself moved here.
+ *
+ * Detects claudeup installs across bun + npm global, warns on duplicates
+ * (active vs shadowed), then re-installs `claudeup@latest` with whichever
+ * package manager owns the active binary. Resolves with the child's exit code.
+ */
+
+import { spawn } from "node:child_process";
+
+export async function runUpgradeCommand(): Promise<number> {
+	const { execSync } = await import("node:child_process");
+	const { existsSync } = await import("node:fs");
+
+	// Detect all installations of claudeup across package managers
+	const installations: Array<{ manager: "bun" | "npm"; path: string }> = [];
+
+	// Check bun global
+	try {
+		const bunGlobalBin = execSync("bun pm -g bin", {
+			encoding: "utf-8",
+			timeout: 5000,
+		}).trim();
+		const bunPath = `${bunGlobalBin}/claudeup`;
+		if (existsSync(bunPath)) installations.push({ manager: "bun", path: bunPath });
+	} catch {
+		// bun not installed or no global claudeup
+	}
+
+	// Check npm global
+	try {
+		const npmPrefix = execSync("npm prefix -g", {
+			encoding: "utf-8",
+			timeout: 5000,
+		}).trim();
+		const npmPath = `${npmPrefix}/bin/claudeup`;
+		if (existsSync(npmPath)) installations.push({ manager: "npm", path: npmPath });
+	} catch {
+		// npm not installed or no global claudeup
+	}
+
+	// Warn about duplicate installations
+	if (installations.length > 1) {
+		const activePath = execSync("which claudeup", {
+			encoding: "utf-8",
+			timeout: 5000,
+		}).trim();
+
+		console.log(`⚠ claudeup is installed via multiple package managers:\n`);
+		for (const inst of installations) {
+			const tag = inst.path === activePath ? " (active)" : " (shadowed)";
+			console.log(`  ${inst.manager}: ${inst.path}${tag}`);
+		}
+		console.log(`\nTo fix, keep one and remove the other:`);
+		for (const inst of installations) {
+			console.log(`  ${inst.manager} uninstall -g claudeup`);
+		}
+		console.log();
+	}
+
+	// Determine which package manager to use for the update
+	let usesBun = false;
+	try {
+		const claudeupPath = execSync("which claudeup", {
+			encoding: "utf-8",
+		}).trim();
+		usesBun = claudeupPath.includes(".bun") || claudeupPath.includes("bun/bin");
+	} catch {
+		// If which fails, default to npm
+	}
+
+	const pkgManager = usesBun ? "bun" : "npm";
+	console.log(`Updating claudeup using ${pkgManager}...`);
+
+	const installArgs = ["install", "-g", "claudeup@latest"];
+
+	return new Promise<number>((resolve) => {
+		const proc = spawn(pkgManager, installArgs, {
+			stdio: "inherit",
+			shell: false, // Avoid shell for security (fixes DEP0190 warning)
+		});
+		proc.on("exit", (code) => resolve(code ?? 0));
+		proc.on("error", () => resolve(1));
+	});
+}

package/src/prerunner/index.ts

@@ -29,7 +29,7 @@ import {
 	clearMarketplaceCache,
 	compareVersions,
 	getAvailablePlugins,
-	saveInstalledPluginVersion,
+	saveInstalledPluginVersionForScope,
 } from "../services/plugin-manager.js";
 import {
 	checkPluginVersionMismatches,
@@ -41,27 +41,6 @@ export interface PrerunOptions {
 	force?: boolean; // Bypass cache and force update check
 }
 
-/**
- * Record an installed version in the settings file that owns the given scope.
- *
- * Claude Code's CLI does not maintain `installedPluginVersions`, so claudeup
- * keeps its own copy. Writing it at the WRONG scope is worse than not writing
- * it: it makes a scope claim a version it does not have installed.
- */
-async function saveInstalledPluginVersionForScope(
-	pluginId: string,
-	version: string,
-	scope: PluginScope,
-): Promise<void> {
-	if (scope === "user") {
-		await saveGlobalInstalledPluginVersion(pluginId, version);
-	} else if (scope === "local") {
-		await saveLocalInstalledPluginVersion(pluginId, version, process.cwd());
-	} else {
-		await saveInstalledPluginVersion(pluginId, version, process.cwd());
-	}
-}
-
 const CONTINUITY_PLUGIN_SENTINEL = "tmux-claude-continuity";
 const CONTINUITY_PLUGIN_SCRIPT = path.join(
 	os.homedir(),