claudeup 5.0.0 → 6.0.0

package/src/cli/update.ts

@@ -11,6 +11,27 @@
  * dependencies" means the set actually in use. Pass a name to update another.
  *
  * Self-update moved to `claudeup upgrade`.
+ *
+ * ## Why this file drives a live region
+ *
+ * Most of an update's wall clock is spent inside four calls that print nothing:
+ * a git fetch per marketplace, a catalog read, a serial PATH probe per binary,
+ * then an install per plugin. The command used to print its first line after
+ * all of the first three had finished, and one line per plugin only once that
+ * plugin was already installed. On a slow network that is thirty seconds of a
+ * dead terminal, which reads as a hang, not as work.
+ *
+ * So every phase reports while it runs. `cli/live.ts` owns the mechanism. A
+ * line printed while a region is painting must go through the region, or it
+ * lands inside the animated block and the next repaint's cursor-up arithmetic
+ * erases it along with part of the frame. Prefer `live.note` here for anything
+ * this file emits deliberately — but the region also CAPTURES `console` while
+ * it paints, so a write from deeper in the call graph is routed rather than
+ * corrupting the display. That capture is not belt-and-braces: it is the only
+ * thing that covers `getAvailablePlugins`, which reaches a stale-marketplace
+ * advisory two layers down and used to erase itself mid-frame.
+ *
+ * `cli/update-view.ts` owns every string. Nothing in this file formats.
  */
 
 import path from "node:path";
@@ -48,90 +69,52 @@ import {
 	summarizePlan,
 } from "../services/update-plan.js";
 import type { ProfileSkillRef, SkillInfo } from "../types/index.js";
+import { brand } from "../ui/theme.js";
+import { bold, dim, fg, width } from "./ansi.js";
 import { ensureManifest } from "./bootstrap.js";
-import { confirm, runShell } from "./prompt.js";
+import { LiveRegion, withPaused } from "./live.js";
+import { runShell } from "./prompt.js";
+import {
+	type ApplyState,
+	type Step,
+	applyFrame,
+	applyRow,
+	fail as failLine,
+	header,
+	info,
+	note as noteLine,
+	ok as okLine,
+	planReport,
+	stepFrame,
+	stepRecord,
+	summaryLine,
+	warn as warnLine,
+} from "./update-view.js";
 
 interface UpdateFlags {
+	/** Report drift and exit 1 if anything is behind. The CI gate. */
 	check: boolean;
-	yes: boolean;
+	/** Show the plan and stop. Always exits 0 — it is a preview, not a gate. */
+	dryRun: boolean;
 	profile?: string;
 }
 
-function parseArgs(args: string[]): UpdateFlags {
+/**
+ * `--yes` / `-y` are gone, and are silently ignored rather than rejected.
+ *
+ * They existed to skip a confirmation that no longer exists: `update` applies
+ * its plan. Both start with `-`, so an old script or a habit still runs and
+ * still does the right thing; there is no flag kept alive to mean nothing.
+ */
+export function parseArgs(args: string[]): UpdateFlags {
 	return {
 		check: args.includes("--check"),
-		yes: args.includes("--yes") || args.includes("-y"),
+		dryRun: args.includes("--dry-run"),
 		profile: args.find((a) => !a.startsWith("-")),
 	};
 }
 
-// ── report ───────────────────────────────────────────────────────────────────
-
-/** Left-pad the id column so versions line up in the report. */
-function pad(text: string, width: number): string {
-	return text.length >= width ? text : text + " ".repeat(width - text.length);
-}
-
-function describePlugin(item: PluginUpdateItem): string {
-	// An exact pin that cannot be delivered carries a note on install/update/
-	// current alike. It must ride along on every one of them: the whole point is
-	// that the manifest says one thing and the machine will hold another, and a
-	// row reading a bare "= 9.9.9" against a pin of 4.6.1 hides exactly that.
-	const suffix = item.note ? `  (${item.note})` : "";
-	switch (item.action) {
-		case "install":
-			return `+ install  ${item.target ?? "latest"}${suffix}`;
-		case "update":
-			return `↑ ${item.installed} → ${item.target}${suffix}`;
-		case "repair":
-			return `⟳ repair   ${item.installed} (${item.note})`;
-		case "unknown":
-			return `? unknown  ${item.installed} (${item.note})`;
-		case "current":
-			return `= ${item.installed}${suffix}`;
-	}
-}
-
-function printPlan(plan: UpdatePlan): void {
-	const width = Math.max(
-		12,
-		...plan.plugins.map((p) => p.pluginId.length),
-		...plan.bins.map((b) => b.name.length),
-		...plan.skills.map((s) => s.name.length),
-	);
-
-	if (plan.plugins.length > 0) {
-		console.log("Plugins:");
-		for (const item of plan.plugins) {
-			console.log(`  ${pad(item.pluginId, width)}  ${describePlugin(item)}`);
-		}
-	}
-
-	if (plan.bins.length > 0) {
-		console.log("\nCLI tools:");
-		for (const item of plan.bins) {
-			const spec = plan.binSpecs.get(item.name);
-			const verb =
-				item.action === "current" || !spec
-					? `= pinned ${item.version}`
-					: item.action === "install"
-						? `+ install  ${binInstallCommand(spec)}`
-						: `↑ upgrade  ${binUpgradeCommand(spec)}`;
-			console.log(`  ${pad(item.name, width)}  ${verb}`);
-		}
-	}
-
-	if (plan.skills.length > 0) {
-		console.log("\nSkills:");
-		for (const item of plan.skills) {
-			console.log(
-				`  ${pad(item.name, width)}  ${item.action === "install" ? "+ install" : "↑ refresh"}`,
-			);
-		}
-	}
-}
-
-// ── apply ────────────────────────────────────────────────────────────────────
+// -- apply -------------------------------------------------------------------
 
 /** Map a manifest skill ref to the SkillInfo shape installSkill expects. */
 function toSkillInfo(ref: ProfileSkillRef): SkillInfo {
@@ -169,6 +152,39 @@ export interface PluginApplyResult extends ApplyResult {
 	mismatches: PinMismatch[];
 }
 
+/**
+ * How the apply loop reports itself.
+ *
+ * Injected rather than hard-coded, because the loop is the same work whether it
+ * is driving an animated meter, printing plain lines into a pipe, or running
+ * under a test that wants silence. The default prints one line per item, which
+ * is what every non-interactive caller wants.
+ */
+export interface ApplyReporter {
+	/** An item is starting. Called before any of its work. */
+	begin(name: string): void;
+	/** An item finished. `detail` is already formatted for display. */
+	finish(ok: boolean, name: string, detail: string, ms: number): void;
+	/**
+	 * Run `work` with the terminal released.
+	 *
+	 * A binary upgrade spawns `brew`/`npm` with inherited stdio: it writes and
+	 * moves the cursor itself, so any animated block must be erased first or the
+	 * two interleave into garbage.
+	 */
+	detach<T>(work: () => Promise<T>): Promise<T>;
+}
+
+const PLAIN_REPORTER: ApplyReporter = {
+	begin: () => {},
+	finish: (ok, name, detail) => {
+		const line = `${ok ? "✓" : "⚠"} ${name}${detail ? `  ${detail}` : ""}`;
+		if (ok) console.log(line);
+		else console.warn(line);
+	},
+	detach: (work) => work(),
+};
+
 /**
  * The four side-effecting calls the plugin apply path makes, injectable so the
  * path itself can be tested.
@@ -205,23 +221,46 @@ const REAL_PLUGIN_DEPS: PluginApplyDeps = {
 	saveInstalled: saveInstalledPluginVersionForScope,
 };
 
+/**
+ * Scopes the apply loop would touch for `item`. Empty means it is skipped.
+ *
+ * A plugin the profile declares but nothing has installed goes in at PROJECT
+ * scope, matching `install`: a profile is a property of one repo, so its
+ * plugins must not be enabled machine-wide.
+ */
+function scopesToApply(item: PluginUpdateItem): PluginScope[] {
+	if (item.action === "current" || item.action === "unknown") return [];
+	return item.action === "install" ? ["project"] : item.scopes;
+}
+
+/**
+ * Whether the apply loop will do anything for `item`.
+ *
+ * Exported shape for ONE reason: the progress meter's denominator must be the
+ * same predicate the loop actually applies. It was previously re-derived at the
+ * call site and replicated only the first of the two skips — an actionable item
+ * with empty `scopes` was counted but never run, so the bar would stop short of
+ * full and sit there looking hung at the end of a successful update.
+ */
+export function pluginNeedsWork(item: PluginUpdateItem): boolean {
+	return scopesToApply(item).length > 0;
+}
+
 export async function applyPlugins(
 	items: PluginUpdateItem[],
 	projectPath: string,
 	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
+	report: ApplyReporter = PLAIN_REPORTER,
 ): Promise<PluginApplyResult> {
 	const result: PluginApplyResult = { ok: 0, failed: [], mismatches: [] };
 
 	for (const item of items) {
-		if (item.action === "current" || item.action === "unknown") continue;
-
-		// A plugin the profile declares but nothing has installed goes in at
-		// PROJECT scope, matching `install`: a profile is a property of one repo,
-		// so its plugins must not be enabled machine-wide.
-		const scopes: PluginScope[] =
-			item.action === "install" ? ["project"] : item.scopes;
+		const scopes = scopesToApply(item);
 		if (scopes.length === 0) continue;
 
+		report.begin(item.pluginId);
+		const startedAt = Date.now();
+
 		try {
 			for (const scope of scopes) {
 				if (item.action === "repair") {
@@ -256,11 +295,16 @@ export async function applyPlugins(
 					});
 				}
 			}
-			console.log(`✓ ${item.pluginId} (${scopes.join(", ")})`);
+			report.finish(
+				true,
+				item.pluginId,
+				`${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`,
+				Date.now() - startedAt,
+			);
 			result.ok++;
 		} catch (error) {
 			const msg = error instanceof Error ? error.message : String(error);
-			console.warn(`⚠ ${item.pluginId}: ${msg}`);
+			report.finish(false, item.pluginId, msg, Date.now() - startedAt);
 			result.failed.push(item.pluginId);
 		}
 	}
@@ -268,7 +312,10 @@ export async function applyPlugins(
 	return result;
 }
 
-async function applyBins(plan: UpdatePlan): Promise<ApplyResult> {
+async function applyBins(
+	plan: UpdatePlan,
+	report: ApplyReporter = PLAIN_REPORTER,
+): Promise<ApplyResult> {
 	const result: ApplyResult = { ok: 0, failed: [] };
 	for (const item of plan.bins) {
 		if (item.action === "current") continue;
@@ -278,8 +325,16 @@ async function applyBins(plan: UpdatePlan): Promise<ApplyResult> {
 			item.action === "install"
 				? binInstallCommand(bin)
 				: binUpgradeCommand(bin);
-		console.log(`\n$ ${cmd}`);
-		if (await runShell(cmd)) result.ok++;
+		report.begin(item.name);
+		const startedAt = Date.now();
+		// The installer owns the terminal for the duration: it streams its own
+		// output through inherited stdio.
+		const succeeded = await report.detach(async () => {
+			console.log(`\n$ ${cmd}`);
+			return runShell(cmd);
+		});
+		report.finish(succeeded, item.name, cmd, Date.now() - startedAt);
+		if (succeeded) result.ok++;
 		else result.failed.push(item.name);
 	}
 	return result;
@@ -288,47 +343,106 @@ async function applyBins(plan: UpdatePlan): Promise<ApplyResult> {
 async function applySkills(
 	plan: UpdatePlan,
 	projectPath: string,
+	report: ApplyReporter = PLAIN_REPORTER,
 ): Promise<ApplyResult> {
 	const result: ApplyResult = { ok: 0, failed: [] };
 	for (const item of plan.skills) {
+		report.begin(item.name);
+		const startedAt = Date.now();
 		try {
 			await installSkill(toSkillInfo(item.ref), "project", projectPath);
-			console.log(`✓ skill ${item.name}`);
+			report.finish(true, item.name, item.ref.repo, Date.now() - startedAt);
 			result.ok++;
 		} catch (error) {
 			const msg = error instanceof Error ? error.message : String(error);
-			console.warn(`⚠ skill ${item.name}: ${msg}`);
+			report.finish(false, item.name, msg, Date.now() - startedAt);
 			result.failed.push(item.name);
 		}
 	}
 	return result;
 }
 
-// ── entry point ──────────────────────────────────────────────────────────────
+// -- phase runner ------------------------------------------------------------
+
+/**
+ * Run one checklist step, keeping its row and the animation truthful.
+ *
+ * `work` gets a `say` callback so a long step can narrate what it is currently
+ * blocked on — the marketplace step names the clone it is pulling, the binary
+ * step names the binary it is probing. That detail is the difference between
+ * "something is happening" and "the network call to THIS marketplace is slow".
+ *
+ * A step that throws is marked `fail` and RE-THROWN. Marking it matters: the
+ * record printed on the way out then names the step that died, instead of a
+ * stack trace landing under a checklist whose last row is still spinning.
+ */
+function makeStepRunner(live: LiveRegion, all: Step[]) {
+	return async function runStep<T>(
+		step: Step,
+		work: (say: (detail: string) => void) => Promise<T>,
+	): Promise<T> {
+		step.state = "running";
+		step.startedAt = Date.now();
+		step.detail = step.detail || "…";
+		live.refresh();
+		const say = (detail: string) => {
+			step.detail = detail;
+			live.refresh();
+		};
+		try {
+			return await work(say);
+		} catch (error) {
+			step.state = "fail";
+			step.detail = error instanceof Error ? error.message : String(error);
+			step.endedAt = Date.now();
+			step.progress = undefined;
+			// Collapse to the record on the way out. Without this the exception
+			// surfaces under a checklist frozen mid-spin, with the cursor still
+			// hidden — the process-exit hook restores the cursor but cannot know
+			// what the last frame should have said.
+			live.stop(stepRecord(all, Date.now()));
+			throw error;
+		} finally {
+			step.endedAt = Date.now();
+			step.progress = undefined;
+			if (step.state === "running") step.state = "done";
+			live.refresh();
+		}
+	};
+}
+
+// -- entry point -------------------------------------------------------------
 
 export async function runUpdateCommand(
 	args: string[],
 	projectPath: string = process.cwd(),
 ): Promise<number> {
 	const flags = parseArgs(args);
+	const startedAt = Date.now();
 
+	// The ONE prompt that survives, and only in a repo that has no manifest yet.
+	// Writing `.claude/profiles.json` is not part of updating: it authors the
+	// file a team commits and shares, possibly derived from this machine's
+	// personal user-scope plugin set. That is worth a human, once per repo,
+	// forever. Everything after it applies without asking.
 	const manifest = await ensureManifest(projectPath, {
-		yes: flags.yes,
-		check: flags.check,
+		check: flags.check || flags.dryRun,
 	});
 	if (!manifest) return 1;
 
 	const errors = validateManifest(manifest);
 	if (errors.length > 0) {
-		console.error("Invalid .claude/profiles.json:");
-		for (const e of errors) console.error(`  ${e.path}: ${e.message}`);
+		console.error(failLine("Invalid .claude/profiles.json:"));
+		for (const e of errors) console.error(noteLine(`${e.path}: ${e.message}`));
 		return 1;
 	}
 
 	const profileIds = Object.keys(manifest.profiles);
 	if (flags.profile && !manifest.profiles[flags.profile]) {
 		console.error(
-			`Profile "${flags.profile}" not found. Available: ${profileIds.join(", ")}`,
+			failLine(
+				`Profile "${flags.profile}" not found. Available: ${profileIds.join(", ")}`,
+			),
 		);
 		return 1;
 	}
@@ -341,38 +455,150 @@ export async function runUpdateCommand(
 		(profileIds.length === 1 ? profileIds[0] : undefined);
 	if (!targetId) {
 		console.error(
-			`No active profile. Pass one: claudeup update <${profileIds.join("|")}>`,
+			failLine(
+				`No active profile. Pass one: claudeup update <${profileIds.join("|")}>`,
+			),
 		);
 		return 1;
 	}
 
-	const closure = await resolveProfile(manifest, targetId);
+	for (const line of header(targetId)) console.log(line);
+
+	// ---- resolve phase, under one animated checklist -------------------------
+
+	const steps: Record<
+		"profile" | "marketplaces" | "catalog" | "binaries" | "skills",
+		Step
+	> = {
+		profile: { label: "profile", state: "pending", detail: "" },
+		marketplaces: { label: "marketplaces", state: "pending", detail: "" },
+		catalog: { label: "catalog", state: "pending", detail: "" },
+		binaries: { label: "binaries", state: "pending", detail: "" },
+		skills: { label: "skills", state: "pending", detail: "" },
+	};
+	const stepList = Object.values(steps);
+
+	const live = new LiveRegion();
+	live.start((tick) => stepFrame(stepList, tick, Date.now()));
+	const runStep = makeStepRunner(live, stepList);
+
+	/** Notices worth keeping, flushed after the checklist collapses. */
+	const notices: string[] = [];
+
+	const closure = await runStep(steps.profile, async (say) => {
+		say(`resolving "${targetId}"`);
+		const resolved = await resolveProfile(manifest, targetId);
+		steps.profile.detail = [
+			`${Object.keys(resolved.plugins).length} plugins`,
+			`${resolved.bins.length} tools`,
+			`${resolved.skills.length} skills`,
+		].join(" · ");
+		return resolved;
+	});
 
 	// "latest" is only as fresh as the catalog. Fast-forward the marketplace
 	// clones first, then drop every cached answer derived from the old HEAD —
 	// skipping this is how a clone sits days behind while every plugin reads as
 	// up to date.
-	console.log(`Updating profile "${targetId}"…\n`);
-	const refresh = await refreshRegisteredMarketplaces();
-	if (refresh.refreshed.length > 0) {
-		console.log(`✓ Refreshed marketplaces: ${refresh.refreshed.join(", ")}`);
-	}
+	const refresh = await runStep(steps.marketplaces, async (say) => {
+		let settled = 0;
+		return refreshRegisteredMarketplaces([], {
+			onStart: (names) => {
+				// Only now is there a denominator; until `onStart` fires the step
+				// shows a sweep rather than a meter that would have to guess one.
+				steps.marketplaces.progress = { done: 0, total: names.length };
+				say(names.length === 0 ? "none eligible" : `pulling ${names.join(", ")}`);
+			},
+			onSettled: (name, status) => {
+				settled++;
+				if (steps.marketplaces.progress)
+					steps.marketplaces.progress.done = settled;
+				say(`${name} ${status}`);
+			},
+		});
+	});
+	steps.marketplaces.detail = [
+		`${refresh.refreshed.length} refreshed`,
+		refresh.autoUpdateDisabled.length > 0
+			? `${refresh.autoUpdateDisabled.length} auto-update off`
+			: "",
+		refresh.failed.length > 0 ? `${refresh.failed.length} failed` : "",
+		refresh.skipped.length > 0 ? `${refresh.skipped.length} skipped` : "",
+	]
+		.filter(Boolean)
+		.join(" · ");
+	if (refresh.failed.length > 0) steps.marketplaces.state = "fail";
+	else if (refresh.autoUpdateDisabled.length > 0)
+		steps.marketplaces.state = "warn";
+
 	for (const name of refresh.autoUpdateDisabled) {
-		console.log(
-			`⚠ ${name}: auto-update disabled — its catalog will not refresh, so updates stay hidden.`,
+		notices.push(
+			warnLine(
+				`${bold(name)}: auto-update disabled — its catalog will not refresh, so updates stay hidden.`,
+			),
+		);
+		notices.push(
+			noteLine(`claude plugin marketplace update ${name}  # to refresh it once`),
 		);
 	}
 	for (const name of refresh.failed) {
-		console.warn(`⚠ Failed to refresh marketplace: ${name}`);
+		notices.push(
+			failLine(
+				`${bold(name)}: refresh failed — clone left intact but stale, so its versions may be behind.`,
+			),
+		);
 	}
+
 	clearMarketplaceCache();
 	clearContentDriftCache();
 
-	const catalog = new Map<string, PluginInfo>(
-		(await getAvailablePlugins(projectPath)).map((p) => [p.id, p]),
-	);
-	const binChecks = await checkBinaries(closure.bins);
-	const installedSkills = await getInstalledSkillNames("project", projectPath);
+	const catalog = await runStep(steps.catalog, async (say) => {
+		say("reading installed and available plugins");
+		const map = new Map<string, PluginInfo>(
+			(await getAvailablePlugins(projectPath)).map((p) => [p.id, p]),
+		);
+		steps.catalog.detail = `${map.size} plugins known`;
+		return map;
+	});
+
+	const binChecks = await runStep(steps.binaries, async (say) => {
+		if (closure.bins.length === 0) {
+			steps.binaries.detail = "none declared";
+			return [];
+		}
+		steps.binaries.progress = { done: 0, total: closure.bins.length };
+		const results = await checkBinaries(
+			closure.bins,
+			undefined,
+			(name, index, total) => {
+				steps.binaries.progress = { done: index, total };
+				say(name);
+			},
+		);
+		const missing = results.filter((r) => !r.present).length;
+		steps.binaries.detail = `${results.length} checked${
+			missing > 0 ? ` · ${missing} missing` : ""
+		}`;
+		if (missing > 0) steps.binaries.state = "warn";
+		return results;
+	});
+
+	const installedSkills = await runStep(steps.skills, async (say) => {
+		say("reading .claude/skills");
+		const names = await getInstalledSkillNames("project", projectPath);
+		steps.skills.detail =
+			closure.skills.length === 0
+				? "none declared"
+				: `${names.size} installed of ${closure.skills.length} declared`;
+		return names;
+	});
+
+	// Collapse the animation into its permanent record, then flush the notices
+	// underneath it — a warning printed mid-checklist would have scrolled past.
+	live.stop(stepRecord(stepList, Date.now()));
+	for (const line of notices) console.log(line);
+
+	// ---- plan ----------------------------------------------------------------
 
 	const plan: UpdatePlan = {
 		profileId: targetId,
@@ -382,13 +608,15 @@ export async function runUpdateCommand(
 		binSpecs: new Map(closure.bins.map((b) => [b.name, b])),
 	};
 
-	console.log();
-	printPlan(plan);
+	for (const line of planReport(plan)) console.log(line);
 
 	const counts = summarizePlan(plan);
 	if (counts.unknown > 0) {
+		console.log("");
 		console.log(
-			`\n⚠ ${counts.unknown} plugin(s) could not be checked. They are NOT reported as up to date — re-run once the catalog is reachable.`,
+			warnLine(
+				`${bold(String(counts.unknown))} plugin(s) could not be checked. They are NOT reported as up to date — re-run once the catalog is reachable.`,
+			),
 		);
 	}
 
@@ -398,27 +626,77 @@ export async function runUpdateCommand(
 	// is evidence that anything is out of date, and counting them made the gate
 	// exit 1 forever for any profile declaring a single skill.
 	if (flags.check) {
+		console.log("");
 		if (!planIsBehind(plan)) {
-			console.log("\n✓ Nothing missing and nothing behind.");
+			console.log(okLine("Nothing missing and nothing behind."));
 			return 0;
 		}
-		console.error("\nUpdates available. Run `claudeup update` to apply.");
+		console.error(
+			failLine(`Updates available. Run ${bold("claudeup update")} to apply.`),
+		);
 		return 1;
 	}
 
-	if (!planHasWork(plan)) {
-		console.log(`\nEverything is up to date (${counts.current} items).`);
+	// Exactly the items the three apply loops will touch. `pluginNeedsWork` is
+	// the SAME predicate applyPlugins uses — re-deriving it is how a meter
+	// drifts from the loop it measures.
+	const workItems = [
+		...plan.plugins.filter(pluginNeedsWork).map((p) => p.pluginId),
+		...plan.bins.filter((b) => b.action !== "current").map((b) => b.name),
+		...plan.skills.map((s) => s.name),
+	];
+
+	if (!planHasWork(plan) || workItems.length === 0) {
+		for (const line of summaryLine(
+			0,
+			counts.current,
+			counts.unknown,
+			0,
+			Date.now() - startedAt,
+		))
+			console.log(line);
+		// `planHasWork` counts an `unknown` plugin as work, because from the
+		// planner's side "we could not check this" is genuinely not "this is
+		// fine". But nothing is APPLIED for an unknown — the apply loop skips it —
+		// so reporting on `planHasWork` alone claimed a run had happened when it
+		// had not. Say what is actually true instead.
+		if (counts.unknown > 0) {
+			console.log(
+				warnLine(
+					`Nothing to apply. ${counts.unknown} plugin(s) could not be checked — re-run once the catalog is reachable.`,
+				),
+			);
+			return 0;
+		}
+		console.log(okLine("Everything is up to date."));
 		return 0;
 	}
 
-	if (!flags.yes && !(await confirm("\nApply?"))) {
-		console.log("Aborted.");
+	// `--dry-run` stops here: the plan is printed above, nothing is written, and
+	// it exits 0. That is the difference from `--check`, which is a CI gate and
+	// exits 1 precisely when there IS something to do.
+	if (flags.dryRun) {
+		console.log("");
+		console.log(
+			info(
+				`Dry run — ${workItems.length} item(s) would be applied. Nothing written.`,
+			),
+		);
 		return 0;
 	}
 
+	// No confirmation. `update` moves the machine toward what the profile
+	// declares and can only go FORWARD: `claude plugin install` takes no version
+	// and installs the newest published one, so there is no downgrade and no
+	// delete for a prompt to protect against. The plan is printed above, so the
+	// run is still legible after the fact — and `--dry-run` shows it beforehand.
+	//
+	// Note this also runs a profile's CLI-tool installers unattended (`brew
+	// upgrade`, `bun install -g`). That is the deliberate cost of the choice.
+
 	if (!(await isClaudeAvailable())) {
 		console.error(
-			"claude CLI not found on PATH — cannot install or update plugins.",
+			failLine("claude CLI not found on PATH — cannot install or update plugins."),
 		);
 		return 1;
 	}
@@ -428,10 +706,51 @@ export async function runUpdateCommand(
 	// outside claudeup's built-in list, which is every private or third-party one.
 	await registerClosureMarketplaces(closure.marketplaces);
 
-	console.log();
-	const pluginResult = await applyPlugins(plan.plugins, projectPath);
-	const binResult = await applyBins(plan);
-	const skillResult = await applySkills(plan, projectPath);
+	// ---- apply phase, under an animated meter --------------------------------
+
+	const nameWidth = Math.max(12, ...workItems.map((n) => width(n)));
+
+	const state: ApplyState = {
+		done: 0,
+		total: workItems.length,
+		current: "starting",
+		startedAt: Date.now(),
+	};
+
+	const applyLive = new LiveRegion();
+	const reporter: ApplyReporter = {
+		begin: (name) => {
+			state.current = name;
+			applyLive.refresh();
+		},
+		finish: (succeeded, name, detail, ms) => {
+			state.done++;
+			applyLive.note(
+				applyRow(
+					succeeded,
+					name,
+					nameWidth,
+					succeeded ? dim(detail) : fg(brand.danger, detail),
+					ms,
+				),
+			);
+		},
+		detach: (work) => withPaused(applyLive, work),
+	};
+
+	console.log("");
+	applyLive.start((tick) => applyFrame(state, tick, Date.now()));
+
+	const pluginResult = await applyPlugins(
+		plan.plugins,
+		projectPath,
+		REAL_PLUGIN_DEPS,
+		reporter,
+	);
+	const binResult = await applyBins(plan, reporter);
+	const skillResult = await applySkills(plan, projectPath, reporter);
+
+	applyLive.stop();
 
 	const failed = [
 		...pluginResult.failed,
@@ -440,11 +759,14 @@ export async function runUpdateCommand(
 	];
 	const changed = pluginResult.ok + binResult.ok + skillResult.ok;
 
-	console.log(
-		`\n${changed} updated, ${counts.current} already current${
-			counts.unknown > 0 ? `, ${counts.unknown} unverified` : ""
-		}${failed.length > 0 ? `, ${failed.length} failed` : ""}.`,
-	);
+	for (const line of summaryLine(
+		changed,
+		counts.current,
+		counts.unknown,
+		failed.length,
+		Date.now() - startedAt,
+	))
+		console.log(line);
 
 	// An exact pin the installer could not deliver. Reported, never fatal: only
 	// the newest published version is installable, so this is a standing property
@@ -453,20 +775,26 @@ export async function runUpdateCommand(
 	// `install --check` with `strictVersions` is where pin drift is GATED.
 	if (pluginResult.mismatches.length > 0) {
 		console.log(
-			`\nNote — ${pluginResult.mismatches.length} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+			warnLine(
+				`${bold(String(pluginResult.mismatches.length))} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+			),
 		);
 		for (const m of pluginResult.mismatches) {
 			console.log(
-				`  ${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,
+				noteLine(
+					`${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,
+				),
 			);
 		}
 		console.log(
-			"Recorded what is actually installed. Update the pin to match, or leave it as a record of intent.",
+			noteLine(
+				"Recorded what is actually installed. Update the pin to match, or leave it as a record of intent.",
+			),
 		);
 	}
 
 	if (failed.length > 0) {
-		console.error(`Failed: ${failed.join(", ")}`);
+		console.error(failLine(`Failed: ${failed.join(", ")}`));
 		return 1;
 	}
 	return 0;