claudeup 5.0.1 → 6.1.0

package/src/__tests__/cli-update-view.test.ts

@@ -0,0 +1,286 @@
+/**
+ * Tests for the `claudeup update` report.
+ *
+ * These assert the things a screenshot cannot: that every row lines up at every
+ * data shape, that turning colour off leaves a report someone can still read,
+ * and that no bar lies about what it measures.
+ *
+ * The alignment tests exist because the old report built each row with string
+ * concatenation and `String.padEnd`, which counts escape bytes as columns. Add
+ * one colour to one cell and every column below it shifts — invisible to a
+ * character-level assertion, obvious and ugly on screen.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { setColorEnabled, stripAnsi, width } from "../cli/ansi.js";
+import type { UpdatePlan } from "../services/update-plan.js";
+import {
+	type ApplyState,
+	type Step,
+	applyFrame,
+	applyRow,
+	header,
+	planReport,
+	stepFrame,
+	stepRecord,
+	summaryLine,
+} from "../cli/update-view.js";
+
+afterEach(() => setColorEnabled(null));
+
+// -- fixtures -----------------------------------------------------------------
+
+function plan(over: Partial<UpdatePlan> = {}): UpdatePlan {
+	return {
+		profileId: "default",
+		plugins: [
+			{
+				pluginId: "agentdev@magus",
+				pinned: "latest",
+				installed: "1.7.0",
+				available: "1.7.0",
+				target: null,
+				action: "current",
+				scopes: ["project"],
+			},
+			{
+				pluginId: "dev@magus",
+				pinned: "latest",
+				installed: "4.6.1",
+				available: "5.0.0",
+				target: "5.0.0",
+				action: "update",
+				scopes: ["project"],
+			},
+			{
+				pluginId: "feature-dev@claude-plugins-official",
+				pinned: "latest",
+				installed: null,
+				available: null,
+				target: null,
+				action: "install",
+				scopes: [],
+			},
+			{
+				pluginId: "seo@magus",
+				pinned: "latest",
+				installed: "1.8.0",
+				available: null,
+				target: null,
+				action: "unknown",
+				scopes: ["project"],
+				note: "catalog unreachable",
+			},
+		],
+		bins: [
+			{ name: "tmux-mcp", action: "current", version: "v1.7.1", sources: [] },
+			{ name: "tmux", action: "upgrade", sources: [] },
+		],
+		skills: [
+			{
+				name: "release",
+				action: "install",
+				ref: { name: "release", repo: "MadAppGang/magus", path: "s/SKILL.md" },
+			},
+		],
+		binSpecs: new Map([
+			["tmux-mcp", { name: "tmux-mcp", via: "bun", sources: [] }],
+			["tmux", { name: "tmux", via: "brew", formula: "tmux", sources: [] }],
+		]),
+		...over,
+	} as UpdatePlan;
+}
+
+function steps(): Step[] {
+	return [
+		{
+			label: "profile",
+			state: "done",
+			detail: "4 plugins",
+			startedAt: 0,
+			endedAt: 100,
+		},
+		{
+			label: "marketplaces",
+			state: "running",
+			detail: "pulling magus",
+			startedAt: 100,
+			progress: { done: 1, total: 4 },
+		},
+		{ label: "catalog", state: "pending", detail: "" },
+	];
+}
+
+// -- alignment ----------------------------------------------------------------
+
+describe("alignment", () => {
+	test("every plugin row shares one column layout, colour or not", () => {
+		setColorEnabled(true);
+		const rows = planReport(plan())
+			.filter((l) => /@/.test(stripAnsi(l)))
+			.map((l) => stripAnsi(l));
+		// Every row's version column starts at the same visible offset, whatever
+		// mix of badges, dim text and notes the rows carry.
+		const offsets = rows.map((r) => r.indexOf("1.") + r.indexOf("latest"));
+		expect(offsets.length).toBeGreaterThan(0);
+		const versionCol = rows.map((r) =>
+			r.search(/(1\.7\.0|4\.6\.1|latest|1\.8\.0)/),
+		);
+		expect(new Set(versionCol).size).toBe(1);
+	});
+
+	test("the same row is the same visible width with colour on and off", () => {
+		setColorEnabled(false);
+		const plain = planReport(plan()).map((l) => width(l));
+		setColorEnabled(true);
+		const painted = planReport(plan()).map((l) => width(l));
+		expect(painted).toEqual(plain);
+	});
+
+	test("a very long plugin id widens the column for every row", () => {
+		setColorEnabled(false);
+		const long = "a-very-long-plugin-name-indeed@some-marketplace";
+		const p = plan();
+		p.plugins[0]!.pluginId = long;
+		const rows = planReport(p).filter((l) => l.includes("@"));
+		const cols = rows.map((r) => r.search(/(1\.7\.0|4\.6\.1|latest|1\.8\.0)/));
+		expect(new Set(cols).size).toBe(1);
+		expect(rows[0]).toContain(long);
+	});
+});
+
+// -- readability without colour ----------------------------------------------
+
+describe("NO_COLOR", () => {
+	test("the report emits no escape sequence at all", () => {
+		setColorEnabled(false);
+		const out = [
+			...header("default"),
+			...stepFrame(steps(), 3, 500),
+			...stepRecord(steps(), 500),
+			...planReport(plan()),
+			...applyFrame({ done: 1, total: 4, current: "dev@magus", startedAt: 0 }, 2, 900),
+			applyRow(true, "dev@magus", 20, "project", 400),
+			...summaryLine(2, 5, 1, 0, 9000),
+		].join("\n");
+		expect(out).not.toContain("\x1b");
+	});
+
+	test("every action stays distinguishable without colour", () => {
+		setColorEnabled(false);
+		const out = planReport(plan()).join("\n");
+		// Colour never carries meaning alone: each action has its own word AND
+		// its own glyph, so the report survives a pipe and colour blindness.
+		for (const label of ["CURRENT", "UPDATE", "INSTALL", "UNKNOWN", "UPGRADE"])
+			expect(out).toContain(label);
+		for (const glyph of ["=", "↑", "+", "?"]) expect(out).toContain(glyph);
+	});
+
+	test("a note rides along on the row it explains", () => {
+		setColorEnabled(false);
+		const row = planReport(plan()).find((l) => l.includes("seo@magus"))!;
+		expect(row).toContain("catalog unreachable");
+	});
+});
+
+// -- the bars tell the truth --------------------------------------------------
+
+describe("bars", () => {
+	test("a running step with a denominator gets a determinate meter", () => {
+		setColorEnabled(false);
+		const frame = stepFrame(steps(), 0, 500);
+		// 1 of 4 → a quarter of the 18-cell bar filled.
+		const bar = frame[1]!.match(/[█░]+/)?.[0] ?? "";
+		expect(bar).toHaveLength(18);
+		expect(bar.split("█").length - 1).toBe(5);
+	});
+
+	test("a running step with no denominator gets a sweep, not a fake meter", () => {
+		setColorEnabled(false);
+		const s = steps();
+		s[1]!.progress = undefined;
+		const bar = stepFrame(s, 3, 500)[1]!.match(/[█░]+/)?.[0] ?? "";
+		expect(bar).toHaveLength(18);
+		// A sweep is partly filled at every tick; a "0%" meter would be all track.
+		expect(bar).toContain("█");
+		expect(bar).toContain("░");
+	});
+
+	test("only the running row carries a bar in the live frame", () => {
+		setColorEnabled(false);
+		const frame = stepFrame(steps(), 0, 500);
+		expect(frame[0]).not.toMatch(/[█░]/);
+		expect(frame[1]).toMatch(/[█░]/);
+		expect(frame[2]).not.toMatch(/[█░]/);
+	});
+
+	test("the record scales each step against the slowest, not the total", () => {
+		setColorEnabled(false);
+		const record = stepRecord(
+			[
+				{ label: "fast", state: "done", detail: "", startedAt: 0, endedAt: 100 },
+				{ label: "slow", state: "done", detail: "", startedAt: 0, endedAt: 1000 },
+			],
+			1000,
+		);
+		const bars = record.map((r) => r.match(/[█░]+/)![0]);
+		expect(bars[1]!.split("█").length - 1).toBe(18);
+		expect(bars[0]!.split("█").length - 1).toBe(2);
+	});
+
+	test("a step that never ran does not divide by zero", () => {
+		setColorEnabled(false);
+		const record = stepRecord([{ label: "x", state: "pending", detail: "" }], 0);
+		expect(record[0]).toContain("░");
+	});
+
+	test("the apply meter is full exactly when the work is done", () => {
+		setColorEnabled(false);
+		const state: ApplyState = { done: 4, total: 4, current: "", startedAt: 0 };
+		const bar = applyFrame(state, 0, 100)[1]!.match(/[█░]+/)![0];
+		expect(bar).toBe("█".repeat(36));
+	});
+
+	test("an empty apply reads as complete rather than as stuck at zero", () => {
+		setColorEnabled(false);
+		const state: ApplyState = { done: 0, total: 0, current: "", startedAt: 0 };
+		expect(applyFrame(state, 0, 100)[1]).toContain("█".repeat(36));
+	});
+
+	test("the summary bar survives an all-zero run", () => {
+		setColorEnabled(false);
+		const line = summaryLine(0, 0, 0, 0, 100)[1]!;
+		expect(line.match(/[█░]+/)![0]).toHaveLength(36);
+	});
+});
+
+// -- misc ---------------------------------------------------------------------
+
+describe("sections", () => {
+	test("an empty section is omitted entirely, not printed as a heading", () => {
+		setColorEnabled(false);
+		const out = planReport(
+			plan({ bins: [], skills: [] }) as UpdatePlan,
+		).join("\n");
+		expect(out).toContain("Plugins");
+		expect(out).not.toContain("CLI");
+		expect(out).not.toContain("Skills");
+	});
+
+	test("a section legend counts every action it contains", () => {
+		setColorEnabled(false);
+		const line = planReport(plan()).find((l) => l.includes("Plugins"))!;
+		expect(line).toContain("1 current");
+		expect(line).toContain("1 update");
+		expect(line).toContain("1 install");
+		expect(line).toContain("1 unknown");
+	});
+
+	test("a CLI upgrade shows the command that will run", () => {
+		setColorEnabled(false);
+		const row = planReport(plan()).find(
+			(l) => l.includes("tmux ") && l.includes("UPGRADE"),
+		)!;
+		expect(row).toContain("brew upgrade tmux");
+	});
+});

package/src/__tests__/format-command.test.ts

@@ -0,0 +1,78 @@
+/**
+ * `formatCommand` renders a Command for a human, and must not lie.
+ *
+ * Two properties, and they pull in opposite directions:
+ *
+ *  1. **Display neutrality.** Every token claudeup actually builds is
+ *     shell-safe, so the rendered line must be byte-identical to the string
+ *     these builders produced before commands became argv. That is what lets
+ *     item 3 land without touching `install`/`doctor` output.
+ *     `doctor-bins.test.ts` is the end-to-end gate on that; these are the unit.
+ *  2. **A dangerous token must LOOK dangerous.** If a package name ever did
+ *     contain shell syntax, printing it bare would show the reader a command
+ *     that does something other than what runs. Quoting it makes the
+ *     one-token-ness visible.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { type Command, formatCommand } from "../utils/command-utils.js";
+
+const c = (cmd: string, ...args: string[]): Command => ({ cmd, args });
+
+describe("formatCommand — display neutrality", () => {
+	test("every token this codebase really builds renders unquoted", () => {
+		// Sampled from the actual builders: npm scopes, version pins in both
+		// syntaxes, go module paths, long flags. If quoting ever fires for one of
+		// these, some install/doctor output changed.
+		expect(formatCommand(c("bun", "install", "-g", "claudish@1.2.0"))).toBe(
+			"bun install -g claudish@1.2.0",
+		);
+		expect(
+			formatCommand(c("npm", "install", "-g", "@anthropic-ai/claude-code")),
+		).toBe("npm install -g @anthropic-ai/claude-code");
+		expect(formatCommand(c("uv", "tool", "install", "aider==0.1"))).toBe(
+			"uv tool install aider==0.1",
+		);
+		expect(formatCommand(c("go", "install", "github.com/x/t@latest"))).toBe(
+			"go install github.com/x/t@latest",
+		);
+		expect(
+			formatCommand(
+				c("python3", "-m", "pip", "install", "--user", "--upgrade", "aider"),
+			),
+		).toBe("python3 -m pip install --user --upgrade aider");
+		expect(formatCommand(c("brew", "install", "tmux"))).toBe(
+			"brew install tmux",
+		);
+	});
+
+	test("a command with no arguments renders as just the executable", () => {
+		expect(formatCommand(c("brew"))).toBe("brew");
+	});
+});
+
+describe("formatCommand — a dangerous token is made visible", () => {
+	test("shell metacharacters are single-quoted", () => {
+		expect(formatCommand(c("bun", "install", "-g", "a b; rm -rf /"))).toBe(
+			"bun install -g 'a b; rm -rf /'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "$(id)"))).toBe(
+			"bun install -g '$(id)'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "a|b"))).toBe(
+			"bun install -g 'a|b'",
+		);
+	});
+
+	test("an embedded single quote closes, escapes and reopens", () => {
+		// `'\''` is the only POSIX-portable way: a single-quoted string has no
+		// escape character at all, so the quote must be left and re-entered.
+		expect(formatCommand(c("x", "it's"))).toBe(`x 'it'\\''s'`);
+	});
+
+	test("an empty argument is quoted so it does not vanish", () => {
+		// Unquoted it would render as nothing, and the reader would be shown a
+		// command with fewer arguments than the one that runs.
+		expect(formatCommand(c("x", "", "y"))).toBe("x '' y");
+	});
+});

package/src/__tests__/gitignore-fixer.test.ts

@@ -10,8 +10,27 @@ import {
 } from "../services/gitignore-fixer";
 import type { Violation } from "../types/gitignore";
 
+// `commit.gpgsign=false` is not tidiness — without it these tests HANG.
+//
+// Two tests here run `git commit` in a temp repo, which inherits the
+// developer's global config. On any machine with commit signing enabled and a
+// GUI signer (`gpg.format=ssh` pointing at 1Password's `op-ssh-sign` is the
+// common setup here), the commit blocks waiting for an approval dialog nobody
+// is watching, and both tests fail on a 5s timeout. It presents as a flake
+// because the approval is cached once granted, so the suite goes green until
+// the cache expires. `marketplace-refresh.test.ts` already guards this the same
+// way; this file did not.
+const GIT_CFG = [
+  "-c",
+  "core.excludesFile=/dev/null",
+  "-c",
+  "commit.gpgsign=false",
+  "-c",
+  "init.defaultBranch=main",
+];
+
 function git(cwd: string, ...args: string[]): { stdout: string; status: number } {
-  const r = spawnSync("git", ["-c", "core.excludesFile=/dev/null", ...args], {
+  const r = spawnSync("git", [...GIT_CFG, ...args], {
     cwd,
     encoding: "utf8",
   });

package/src/__tests__/marketplace-refresh.test.ts

@@ -243,6 +243,69 @@ describe("refreshRegisteredMarketplaces — selection & skips", () => {
 	});
 });
 
+describe("refreshRegisteredMarketplaces — progress taps", () => {
+	it("reports the eligible set before pulling, then each clone as it settles", async () => {
+		// The whole reason these exist: this call is the slowest thing on the
+		// update path and used to report only once every clone had settled.
+		installClone("magus");
+		installClone("other");
+		publishV2();
+		configured = { magus: gh(), other: gh("x/y") };
+
+		const started: string[][] = [];
+		const settled: Array<[string, string]> = [];
+		const r = await refreshRegisteredMarketplaces([], {
+			onStart: (names) => started.push([...names]),
+			onSettled: (name, status) => settled.push([name, status]),
+		});
+
+		expect(started).toHaveLength(1);
+		expect(started[0]!.sort()).toEqual(["magus", "other"]);
+		// One event per eligible clone, and the statuses agree with the result.
+		expect(settled.map(([n]) => n).sort()).toEqual(["magus", "other"]);
+		expect(settled.every(([, s]) => s === "refreshed")).toBe(true);
+		expect(r.refreshed.sort()).toEqual(["magus", "other"]);
+	});
+
+	it("excludes an autoUpdate-disabled marketplace from the denominator", async () => {
+		// The progress meter's total comes from onStart. Counting a marketplace
+		// that is never pulled would leave the bar permanently short.
+		installClone("magus");
+		installClone("other");
+		publishV2();
+		configured = { magus: gh(), other: gh("x/y") };
+		autoUpdate = { magus: false };
+
+		const started: string[][] = [];
+		await refreshRegisteredMarketplaces([], {
+			onStart: (names) => started.push([...names]),
+		});
+
+		expect(started[0]).toEqual(["other"]);
+	});
+
+	it("a throwing observer cannot fail the refresh", async () => {
+		// onSettled fires inside the Promise.all fan-out, so an unguarded throw
+		// would reject the batch — turning a display bug into a failed refresh
+		// and breaking this function's documented "never throws" contract.
+		installClone("magus");
+		publishV2();
+		configured = { magus: gh() };
+
+		const r = await refreshRegisteredMarketplaces([], {
+			onStart: () => {
+				throw new Error("display exploded");
+			},
+			onSettled: () => {
+				throw new Error("display exploded again");
+			},
+		});
+
+		expect(r.refreshed).toEqual(["magus"]);
+		expect(r.failed).toEqual([]);
+	});
+});
+
 describe("fastForwardCloneIfPresent — single-clone helper (shared with claude-cli recovery)", () => {
 	it("returns 'absent' when no clone is on disk (caller then clones via add)", async () => {
 		expect(await fastForwardCloneIfPresent("magus")).toBe("absent");

package/src/__tests__/shell-script-callers.test.ts

@@ -0,0 +1,92 @@
+/**
+ * `runShellScript` has exactly one legitimate caller, and this pins it.
+ *
+ * The whole of item 3 is the split between two ways of running a child process:
+ * argv (`runCommand`), which no shell ever sees, and a script (`runShellScript`),
+ * which `/bin/sh` parses. Every installer command belongs to the first, because
+ * it is assembled from package names that arrive in `.claude/profiles.json` and
+ * plugin `requires.bin` — hand-authored, committed by teammates, fetched from
+ * marketplaces, validated by nothing. The second exists only for the two
+ * `TOOLCHAIN_BOOTSTRAP` values, which are constants in this repo copied from
+ * bun.sh and brew.sh and which genuinely contain a pipe and a command
+ * substitution.
+ *
+ * Nothing in the type system distinguishes them — both are strings — so after
+ * the commit lands, the design decision is enforced by this test or by nothing.
+ * A branded `ShellScript` type would enforce it at compile time and was
+ * considered; for one map, two entries and one call site it is more machinery
+ * than the rule is worth, and unlike a brand this is greppable.
+ *
+ * Source-scanning precedent in this suite: `uppercase-keybindings.test.ts`.
+ */
+
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import fs from "fs-extra";
+
+const SRC_DIR = path.join(import.meta.dir, "..");
+
+/** Files permitted to call `runShellScript`, relative to `src/`. */
+const ALLOWED = ["cli/install.ts"];
+
+/** The definition itself, plus this test, are not callers. */
+const NOT_CALLERS = ["utils/run.ts", "__tests__/shell-script-callers.test.ts"];
+
+async function sourceFiles(dir: string): Promise<string[]> {
+	const out: string[] = [];
+	for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+		const full = path.join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...(await sourceFiles(full)));
+		else if (/\.tsx?$/.test(entry.name)) out.push(full);
+	}
+	return out;
+}
+
+const isComment = (line: string) => {
+	const t = line.trim();
+	return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
+};
+
+async function callersOf(pattern: RegExp): Promise<string[]> {
+	const found = new Set<string>();
+	for (const file of await sourceFiles(SRC_DIR)) {
+		const rel = path.relative(SRC_DIR, file);
+		if (NOT_CALLERS.includes(rel)) continue;
+		const text = await fs.readFile(file, "utf8");
+		for (const line of text.split("\n")) {
+			if (isComment(line)) continue;
+			if (pattern.test(line)) found.add(rel);
+		}
+	}
+	return [...found].sort();
+}
+
+describe("only the toolchain bootstrap goes through a shell", () => {
+	test("runShellScript is called from exactly the allowed files", async () => {
+		expect(await callersOf(/\brunShellScript\(/)).toEqual(ALLOWED);
+	});
+
+	test("nothing spawns with `shell: true` outside utils/run.ts", async () => {
+		// Catches someone reaching for `spawn`/`exec` directly rather than
+		// through the seam — a second shell path that never names
+		// `runShellScript`.
+		//
+		// Scope, stated honestly: this checks `shell: true` only. Several
+		// version-DETECTION helpers in CliToolsScreen still pass
+		// `shell: "/bin/bash"` to run pipelines like `which -a x 2>/dev/null`.
+		// Those interpolate a catalogue `name`, not an installer command, and
+		// were out of scope here — so this assertion would be false if it
+		// claimed no shell exists anywhere.
+		expect(await callersOf(/shell:\s*true/)).toEqual([]);
+	});
+
+	test("the scan can actually fail", async () => {
+		// Negative control. The two assertions above pass trivially if the walk
+		// finds nothing or the pattern never matches, and a check that cannot
+		// fail is not evidence. `runCommand(` is known to be called from several
+		// files, so a working scan must find them.
+		const runCommandCallers = await callersOf(/\brunCommand\(/);
+		expect(runCommandCallers.length).toBeGreaterThan(0);
+		expect(runCommandCallers).toContain("cli/install.ts");
+	});
+});