claudeup 5.0.1 → 6.1.0

package/src/cli/update.ts

@@ -11,15 +11,30 @@
  * dependencies" means the set actually in use. Pass a name to update another.
  *
  * Self-update moved to `claudeup upgrade`.
+ *
+ * ## Why this file drives a live region
+ *
+ * Most of an update's wall clock is spent inside four calls that print nothing:
+ * a git fetch per marketplace, a catalog read, a serial PATH probe per binary,
+ * then an install per plugin. The command used to print its first line after
+ * all of the first three had finished, and one line per plugin only once that
+ * plugin was already installed. On a slow network that is thirty seconds of a
+ * dead terminal, which reads as a hang, not as work.
+ *
+ * So every phase reports while it runs. `cli/live.ts` owns the mechanism. A
+ * line printed while a region is painting must go through the region, or it
+ * lands inside the animated block and the next repaint's cursor-up arithmetic
+ * erases it along with part of the frame. Prefer `live.note` here for anything
+ * this file emits deliberately — but the region also CAPTURES `console` while
+ * it paints, so a write from deeper in the call graph is routed rather than
+ * corrupting the display. That capture is not belt-and-braces: it is the only
+ * thing that covers `getAvailablePlugins`, which reaches a stale-marketplace
+ * advisory two layers down and used to erase itself mid-frame.
+ *
+ * `cli/update-view.ts` owns every string. Nothing in this file formats.
  */
 
-import path from "node:path";
-import type { PluginScope } from "../services/claude-cli.js";
-import {
-	isClaudeAvailable,
-	repairPlugin,
-	updatePlugin,
-} from "../services/claude-cli.js";
+import { isClaudeAvailable } from "../services/claude-cli.js";
 import { clearContentDriftCache } from "../services/content-drift.js";
 import { checkBinaries } from "../services/doctor-bins.js";
 import { validateManifest } from "../services/manifest.js";
@@ -29,16 +44,18 @@ import {
 	type PluginInfo,
 	clearMarketplaceCache,
 	getAvailablePlugins,
-	readInstalledVersionForScope,
-	saveInstalledPluginVersionForScope,
 } from "../services/plugin-manager.js";
 import { resolveProfile } from "../services/resolver.js";
-import { installSkill } from "../services/skills-manager.js";
 import { getInstalledSkillNames } from "../services/skills-manager.js";
 import { activeProfile } from "../services/symlink-manager.js";
-import { binInstallCommand, binUpgradeCommand } from "../services/toolchain.js";
+// The apply half lives in services/ so the TUI runs the SAME code — see the
+// header of update-engine.ts for what drifted while it did not.
+import {
+	type ApplyReporter,
+	applyPlan,
+	planWorkItems,
+} from "../services/update-engine.js";
 import {
-	type PluginUpdateItem,
 	type UpdatePlan,
 	planBinUpdates,
 	planHasWork,
@@ -47,288 +64,132 @@ import {
 	planSkillUpdates,
 	summarizePlan,
 } from "../services/update-plan.js";
-import type { ProfileSkillRef, SkillInfo } from "../types/index.js";
+import { brand } from "../ui/theme.js";
+import { bold, dim, fg, width } from "./ansi.js";
 import { ensureManifest } from "./bootstrap.js";
-import { confirm, runShell } from "./prompt.js";
+import { LiveRegion, withPaused } from "./live.js";
+import {
+	type ApplyState,
+	type Step,
+	applyFrame,
+	applyRow,
+	fail as failLine,
+	header,
+	info,
+	note as noteLine,
+	ok as okLine,
+	planReport,
+	stepFrame,
+	stepRecord,
+	summaryLine,
+	warn as warnLine,
+} from "./update-view.js";
 
 interface UpdateFlags {
+	/** Report drift and exit 1 if anything is behind. The CI gate. */
 	check: boolean;
-	yes: boolean;
+	/** Show the plan and stop. Always exits 0 — it is a preview, not a gate. */
+	dryRun: boolean;
 	profile?: string;
 }
 
-function parseArgs(args: string[]): UpdateFlags {
+/**
+ * `--yes` / `-y` are gone, and are silently ignored rather than rejected.
+ *
+ * They existed to skip a confirmation that no longer exists: `update` applies
+ * its plan. Both start with `-`, so an old script or a habit still runs and
+ * still does the right thing; there is no flag kept alive to mean nothing.
+ */
+export function parseArgs(args: string[]): UpdateFlags {
 	return {
 		check: args.includes("--check"),
-		yes: args.includes("--yes") || args.includes("-y"),
+		dryRun: args.includes("--dry-run"),
 		profile: args.find((a) => !a.startsWith("-")),
 	};
 }
 
-// ── report ───────────────────────────────────────────────────────────────────
-
-/** Left-pad the id column so versions line up in the report. */
-function pad(text: string, width: number): string {
-	return text.length >= width ? text : text + " ".repeat(width - text.length);
-}
-
-function describePlugin(item: PluginUpdateItem): string {
-	// An exact pin that cannot be delivered carries a note on install/update/
-	// current alike. It must ride along on every one of them: the whole point is
-	// that the manifest says one thing and the machine will hold another, and a
-	// row reading a bare "= 9.9.9" against a pin of 4.6.1 hides exactly that.
-	const suffix = item.note ? `  (${item.note})` : "";
-	switch (item.action) {
-		case "install":
-			return `+ install  ${item.target ?? "latest"}${suffix}`;
-		case "update":
-			return `↑ ${item.installed} → ${item.target}${suffix}`;
-		case "repair":
-			return `⟳ repair   ${item.installed} (${item.note})`;
-		case "unknown":
-			return `? unknown  ${item.installed} (${item.note})`;
-		case "current":
-			return `= ${item.installed}${suffix}`;
-	}
-}
-
-function printPlan(plan: UpdatePlan): void {
-	const width = Math.max(
-		12,
-		...plan.plugins.map((p) => p.pluginId.length),
-		...plan.bins.map((b) => b.name.length),
-		...plan.skills.map((s) => s.name.length),
-	);
-
-	if (plan.plugins.length > 0) {
-		console.log("Plugins:");
-		for (const item of plan.plugins) {
-			console.log(`  ${pad(item.pluginId, width)}  ${describePlugin(item)}`);
-		}
-	}
-
-	if (plan.bins.length > 0) {
-		console.log("\nCLI tools:");
-		for (const item of plan.bins) {
-			const spec = plan.binSpecs.get(item.name);
-			const verb =
-				item.action === "current" || !spec
-					? `= pinned ${item.version}`
-					: item.action === "install"
-						? `+ install  ${binInstallCommand(spec)}`
-						: `↑ upgrade  ${binUpgradeCommand(spec)}`;
-			console.log(`  ${pad(item.name, width)}  ${verb}`);
-		}
-	}
-
-	if (plan.skills.length > 0) {
-		console.log("\nSkills:");
-		for (const item of plan.skills) {
-			console.log(
-				`  ${pad(item.name, width)}  ${item.action === "install" ? "+ install" : "↑ refresh"}`,
-			);
-		}
-	}
-}
-
-// ── apply ────────────────────────────────────────────────────────────────────
-
-/** Map a manifest skill ref to the SkillInfo shape installSkill expects. */
-function toSkillInfo(ref: ProfileSkillRef): SkillInfo {
-	return {
-		id: `${ref.repo}/${ref.path}`,
-		name: ref.name,
-		source: {
-			label: ref.repo,
-			repo: ref.repo,
-			skillsPath: path.dirname(ref.path),
-		},
-		repoPath: ref.path,
-		gitBlobSha: "",
-		frontmatter: null,
-		installed: false,
-		installedScope: null,
-		hasUpdate: false,
-	};
-}
-
-interface ApplyResult {
-	ok: number;
-	failed: string[];
-}
-
-/** An exact pin the installer could not deliver, discovered by reading back. */
-export interface PinMismatch {
-	pluginId: string;
-	pinned: string;
-	actual: string | null;
-	scope: PluginScope;
-}
 
-export interface PluginApplyResult extends ApplyResult {
-	mismatches: PinMismatch[];
-}
+// -- phase runner ------------------------------------------------------------
 
 /**
- * The four side-effecting calls the plugin apply path makes, injectable so the
- * path itself can be tested.
+ * Run one checklist step, keeping its row and the animation truthful.
+ *
+ * `work` gets a `say` callback so a long step can narrate what it is currently
+ * blocked on — the marketplace step names the clone it is pulling, the binary
+ * step names the binary it is probing. That detail is the difference between
+ * "something is happening" and "the network call to THIS marketplace is slow".
  *
- * This exists because the apply half shipped with no coverage while the pure
- * planner had forty tests — and every real defect found in review lived here,
- * not there. Following the same shape `checkBinaries` and `resolveProfile`
- * already use for their impure edges.
+ * A step that throws is marked `fail` and RE-THROWN. Marking it matters: the
+ * record printed on the way out then names the step that died, instead of a
+ * stack trace landing under a checklist whose last row is still spinning.
  */
-export interface PluginApplyDeps {
-	update: (pluginId: string, scope: PluginScope) => Promise<void>;
-	repair: (
-		pluginId: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<void>;
-	readInstalled: (
-		pluginId: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<string | null>;
-	saveInstalled: (
-		pluginId: string,
-		version: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<void>;
-}
-
-const REAL_PLUGIN_DEPS: PluginApplyDeps = {
-	update: updatePlugin,
-	repair: repairPlugin,
-	readInstalled: readInstalledVersionForScope,
-	saveInstalled: saveInstalledPluginVersionForScope,
-};
-
-export async function applyPlugins(
-	items: PluginUpdateItem[],
-	projectPath: string,
-	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
-): Promise<PluginApplyResult> {
-	const result: PluginApplyResult = { ok: 0, failed: [], mismatches: [] };
-
-	for (const item of items) {
-		if (item.action === "current" || item.action === "unknown") continue;
-
-		// A plugin the profile declares but nothing has installed goes in at
-		// PROJECT scope, matching `install`: a profile is a property of one repo,
-		// so its plugins must not be enabled machine-wide.
-		const scopes: PluginScope[] =
-			item.action === "install" ? ["project"] : item.scopes;
-		if (scopes.length === 0) continue;
-
+function makeStepRunner(live: LiveRegion, all: Step[]) {
+	return async function runStep<T>(
+		step: Step,
+		work: (say: (detail: string) => void) => Promise<T>,
+	): Promise<T> {
+		step.state = "running";
+		step.startedAt = Date.now();
+		step.detail = step.detail || "…";
+		live.refresh();
+		const say = (detail: string) => {
+			step.detail = detail;
+			live.refresh();
+		};
 		try {
-			for (const scope of scopes) {
-				if (item.action === "repair") {
-					await deps.repair(item.pluginId, scope, projectPath);
-				} else {
-					await deps.update(item.pluginId, scope);
-				}
-
-				// Record what LANDED, not what we asked for.
-				//
-				// `claude plugin install` accepts no version, so an exact pin is a
-				// request the installer cannot honour — it fetches whatever the
-				// marketplace publishes now. Writing `item.target` here recorded the
-				// pin as satisfied whatever actually installed, and `install --check`
-				// reads that same field to decide whether the machine has drifted.
-				// The gate would have compared the pin against a copy of itself and
-				// reported clean forever.
-				const actual = await deps.readInstalled(
-					item.pluginId,
-					scope,
-					projectPath,
-				);
-				if (actual) {
-					await deps.saveInstalled(item.pluginId, actual, scope, projectPath);
-				}
-				if (item.pinned !== "latest" && actual !== item.pinned) {
-					result.mismatches.push({
-						pluginId: item.pluginId,
-						pinned: item.pinned,
-						actual,
-						scope,
-					});
-				}
-			}
-			console.log(`✓ ${item.pluginId} (${scopes.join(", ")})`);
-			result.ok++;
+			return await work(say);
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			console.warn(`⚠ ${item.pluginId}: ${msg}`);
-			result.failed.push(item.pluginId);
+			step.state = "fail";
+			step.detail = error instanceof Error ? error.message : String(error);
+			step.endedAt = Date.now();
+			step.progress = undefined;
+			// Collapse to the record on the way out. Without this the exception
+			// surfaces under a checklist frozen mid-spin, with the cursor still
+			// hidden — the process-exit hook restores the cursor but cannot know
+			// what the last frame should have said.
+			live.stop(stepRecord(all, Date.now()));
+			throw error;
+		} finally {
+			step.endedAt = Date.now();
+			step.progress = undefined;
+			if (step.state === "running") step.state = "done";
+			live.refresh();
 		}
-	}
-
-	return result;
-}
-
-async function applyBins(plan: UpdatePlan): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
-	for (const item of plan.bins) {
-		if (item.action === "current") continue;
-		const bin = plan.binSpecs.get(item.name);
-		if (!bin) continue;
-		const cmd =
-			item.action === "install"
-				? binInstallCommand(bin)
-				: binUpgradeCommand(bin);
-		console.log(`\n$ ${cmd}`);
-		if (await runShell(cmd)) result.ok++;
-		else result.failed.push(item.name);
-	}
-	return result;
-}
-
-async function applySkills(
-	plan: UpdatePlan,
-	projectPath: string,
-): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
-	for (const item of plan.skills) {
-		try {
-			await installSkill(toSkillInfo(item.ref), "project", projectPath);
-			console.log(`✓ skill ${item.name}`);
-			result.ok++;
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			console.warn(`⚠ skill ${item.name}: ${msg}`);
-			result.failed.push(item.name);
-		}
-	}
-	return result;
+	};
 }
 
-// ── entry point ──────────────────────────────────────────────────────────────
+// -- entry point -------------------------------------------------------------
 
 export async function runUpdateCommand(
 	args: string[],
 	projectPath: string = process.cwd(),
 ): Promise<number> {
 	const flags = parseArgs(args);
+	const startedAt = Date.now();
 
+	// The ONE prompt that survives, and only in a repo that has no manifest yet.
+	// Writing `.claude/profiles.json` is not part of updating: it authors the
+	// file a team commits and shares, possibly derived from this machine's
+	// personal user-scope plugin set. That is worth a human, once per repo,
+	// forever. Everything after it applies without asking.
 	const manifest = await ensureManifest(projectPath, {
-		yes: flags.yes,
-		check: flags.check,
+		check: flags.check || flags.dryRun,
 	});
 	if (!manifest) return 1;
 
 	const errors = validateManifest(manifest);
 	if (errors.length > 0) {
-		console.error("Invalid .claude/profiles.json:");
-		for (const e of errors) console.error(`  ${e.path}: ${e.message}`);
+		console.error(failLine("Invalid .claude/profiles.json:"));
+		for (const e of errors) console.error(noteLine(`${e.path}: ${e.message}`));
 		return 1;
 	}
 
 	const profileIds = Object.keys(manifest.profiles);
 	if (flags.profile && !manifest.profiles[flags.profile]) {
 		console.error(
-			`Profile "${flags.profile}" not found. Available: ${profileIds.join(", ")}`,
+			failLine(
+				`Profile "${flags.profile}" not found. Available: ${profileIds.join(", ")}`,
+			),
 		);
 		return 1;
 	}
@@ -341,38 +202,150 @@ export async function runUpdateCommand(
 		(profileIds.length === 1 ? profileIds[0] : undefined);
 	if (!targetId) {
 		console.error(
-			`No active profile. Pass one: claudeup update <${profileIds.join("|")}>`,
+			failLine(
+				`No active profile. Pass one: claudeup update <${profileIds.join("|")}>`,
+			),
 		);
 		return 1;
 	}
 
-	const closure = await resolveProfile(manifest, targetId);
+	for (const line of header(targetId)) console.log(line);
+
+	// ---- resolve phase, under one animated checklist -------------------------
+
+	const steps: Record<
+		"profile" | "marketplaces" | "catalog" | "binaries" | "skills",
+		Step
+	> = {
+		profile: { label: "profile", state: "pending", detail: "" },
+		marketplaces: { label: "marketplaces", state: "pending", detail: "" },
+		catalog: { label: "catalog", state: "pending", detail: "" },
+		binaries: { label: "binaries", state: "pending", detail: "" },
+		skills: { label: "skills", state: "pending", detail: "" },
+	};
+	const stepList = Object.values(steps);
+
+	const live = new LiveRegion();
+	live.start((tick) => stepFrame(stepList, tick, Date.now()));
+	const runStep = makeStepRunner(live, stepList);
+
+	/** Notices worth keeping, flushed after the checklist collapses. */
+	const notices: string[] = [];
+
+	const closure = await runStep(steps.profile, async (say) => {
+		say(`resolving "${targetId}"`);
+		const resolved = await resolveProfile(manifest, targetId);
+		steps.profile.detail = [
+			`${Object.keys(resolved.plugins).length} plugins`,
+			`${resolved.bins.length} tools`,
+			`${resolved.skills.length} skills`,
+		].join(" · ");
+		return resolved;
+	});
 
 	// "latest" is only as fresh as the catalog. Fast-forward the marketplace
 	// clones first, then drop every cached answer derived from the old HEAD —
 	// skipping this is how a clone sits days behind while every plugin reads as
 	// up to date.
-	console.log(`Updating profile "${targetId}"…\n`);
-	const refresh = await refreshRegisteredMarketplaces();
-	if (refresh.refreshed.length > 0) {
-		console.log(`✓ Refreshed marketplaces: ${refresh.refreshed.join(", ")}`);
-	}
+	const refresh = await runStep(steps.marketplaces, async (say) => {
+		let settled = 0;
+		return refreshRegisteredMarketplaces([], {
+			onStart: (names) => {
+				// Only now is there a denominator; until `onStart` fires the step
+				// shows a sweep rather than a meter that would have to guess one.
+				steps.marketplaces.progress = { done: 0, total: names.length };
+				say(names.length === 0 ? "none eligible" : `pulling ${names.join(", ")}`);
+			},
+			onSettled: (name, status) => {
+				settled++;
+				if (steps.marketplaces.progress)
+					steps.marketplaces.progress.done = settled;
+				say(`${name} ${status}`);
+			},
+		});
+	});
+	steps.marketplaces.detail = [
+		`${refresh.refreshed.length} refreshed`,
+		refresh.autoUpdateDisabled.length > 0
+			? `${refresh.autoUpdateDisabled.length} auto-update off`
+			: "",
+		refresh.failed.length > 0 ? `${refresh.failed.length} failed` : "",
+		refresh.skipped.length > 0 ? `${refresh.skipped.length} skipped` : "",
+	]
+		.filter(Boolean)
+		.join(" · ");
+	if (refresh.failed.length > 0) steps.marketplaces.state = "fail";
+	else if (refresh.autoUpdateDisabled.length > 0)
+		steps.marketplaces.state = "warn";
+
 	for (const name of refresh.autoUpdateDisabled) {
-		console.log(
-			`⚠ ${name}: auto-update disabled — its catalog will not refresh, so updates stay hidden.`,
+		notices.push(
+			warnLine(
+				`${bold(name)}: auto-update disabled — its catalog will not refresh, so updates stay hidden.`,
+			),
+		);
+		notices.push(
+			noteLine(`claude plugin marketplace update ${name}  # to refresh it once`),
 		);
 	}
 	for (const name of refresh.failed) {
-		console.warn(`⚠ Failed to refresh marketplace: ${name}`);
+		notices.push(
+			failLine(
+				`${bold(name)}: refresh failed — clone left intact but stale, so its versions may be behind.`,
+			),
+		);
 	}
+
 	clearMarketplaceCache();
 	clearContentDriftCache();
 
-	const catalog = new Map<string, PluginInfo>(
-		(await getAvailablePlugins(projectPath)).map((p) => [p.id, p]),
-	);
-	const binChecks = await checkBinaries(closure.bins);
-	const installedSkills = await getInstalledSkillNames("project", projectPath);
+	const catalog = await runStep(steps.catalog, async (say) => {
+		say("reading installed and available plugins");
+		const map = new Map<string, PluginInfo>(
+			(await getAvailablePlugins(projectPath)).map((p) => [p.id, p]),
+		);
+		steps.catalog.detail = `${map.size} plugins known`;
+		return map;
+	});
+
+	const binChecks = await runStep(steps.binaries, async (say) => {
+		if (closure.bins.length === 0) {
+			steps.binaries.detail = "none declared";
+			return [];
+		}
+		steps.binaries.progress = { done: 0, total: closure.bins.length };
+		const results = await checkBinaries(
+			closure.bins,
+			undefined,
+			(name, index, total) => {
+				steps.binaries.progress = { done: index, total };
+				say(name);
+			},
+		);
+		const missing = results.filter((r) => !r.present).length;
+		steps.binaries.detail = `${results.length} checked${
+			missing > 0 ? ` · ${missing} missing` : ""
+		}`;
+		if (missing > 0) steps.binaries.state = "warn";
+		return results;
+	});
+
+	const installedSkills = await runStep(steps.skills, async (say) => {
+		say("reading .claude/skills");
+		const names = await getInstalledSkillNames("project", projectPath);
+		steps.skills.detail =
+			closure.skills.length === 0
+				? "none declared"
+				: `${names.size} installed of ${closure.skills.length} declared`;
+		return names;
+	});
+
+	// Collapse the animation into its permanent record, then flush the notices
+	// underneath it — a warning printed mid-checklist would have scrolled past.
+	live.stop(stepRecord(stepList, Date.now()));
+	for (const line of notices) console.log(line);
+
+	// ---- plan ----------------------------------------------------------------
 
 	const plan: UpdatePlan = {
 		profileId: targetId,
@@ -382,13 +355,15 @@ export async function runUpdateCommand(
 		binSpecs: new Map(closure.bins.map((b) => [b.name, b])),
 	};
 
-	console.log();
-	printPlan(plan);
+	for (const line of planReport(plan)) console.log(line);
 
 	const counts = summarizePlan(plan);
 	if (counts.unknown > 0) {
+		console.log("");
 		console.log(
-			`\n⚠ ${counts.unknown} plugin(s) could not be checked. They are NOT reported as up to date — re-run once the catalog is reachable.`,
+			warnLine(
+				`${bold(String(counts.unknown))} plugin(s) could not be checked. They are NOT reported as up to date — re-run once the catalog is reachable.`,
+			),
 		);
 	}
 
@@ -398,27 +373,73 @@ export async function runUpdateCommand(
 	// is evidence that anything is out of date, and counting them made the gate
 	// exit 1 forever for any profile declaring a single skill.
 	if (flags.check) {
+		console.log("");
 		if (!planIsBehind(plan)) {
-			console.log("\n✓ Nothing missing and nothing behind.");
+			console.log(okLine("Nothing missing and nothing behind."));
 			return 0;
 		}
-		console.error("\nUpdates available. Run `claudeup update` to apply.");
+		console.error(
+			failLine(`Updates available. Run ${bold("claudeup update")} to apply.`),
+		);
 		return 1;
 	}
 
-	if (!planHasWork(plan)) {
-		console.log(`\nEverything is up to date (${counts.current} items).`);
+	// Exactly the items the engine will touch. Derived by the engine from the
+	// same predicates its loops use, so the meter's denominator cannot drift
+	// from the work — a bar stuck short of full reads as a hang.
+	const workItems = planWorkItems(plan);
+
+	if (!planHasWork(plan) || workItems.length === 0) {
+		for (const line of summaryLine(
+			0,
+			counts.current,
+			counts.unknown,
+			0,
+			Date.now() - startedAt,
+		))
+			console.log(line);
+		// `planHasWork` counts an `unknown` plugin as work, because from the
+		// planner's side "we could not check this" is genuinely not "this is
+		// fine". But nothing is APPLIED for an unknown — the apply loop skips it —
+		// so reporting on `planHasWork` alone claimed a run had happened when it
+		// had not. Say what is actually true instead.
+		if (counts.unknown > 0) {
+			console.log(
+				warnLine(
+					`Nothing to apply. ${counts.unknown} plugin(s) could not be checked — re-run once the catalog is reachable.`,
+				),
+			);
+			return 0;
+		}
+		console.log(okLine("Everything is up to date."));
 		return 0;
 	}
 
-	if (!flags.yes && !(await confirm("\nApply?"))) {
-		console.log("Aborted.");
+	// `--dry-run` stops here: the plan is printed above, nothing is written, and
+	// it exits 0. That is the difference from `--check`, which is a CI gate and
+	// exits 1 precisely when there IS something to do.
+	if (flags.dryRun) {
+		console.log("");
+		console.log(
+			info(
+				`Dry run — ${workItems.length} item(s) would be applied. Nothing written.`,
+			),
+		);
 		return 0;
 	}
 
+	// No confirmation. `update` moves the machine toward what the profile
+	// declares and can only go FORWARD: `claude plugin install` takes no version
+	// and installs the newest published one, so there is no downgrade and no
+	// delete for a prompt to protect against. The plan is printed above, so the
+	// run is still legible after the fact — and `--dry-run` shows it beforehand.
+	//
+	// Note this also runs a profile's CLI-tool installers unattended (`brew
+	// upgrade`, `bun install -g`). That is the deliberate cost of the choice.
+
 	if (!(await isClaudeAvailable())) {
 		console.error(
-			"claude CLI not found on PATH — cannot install or update plugins.",
+			failLine("claude CLI not found on PATH — cannot install or update plugins."),
 		);
 		return 1;
 	}
@@ -428,45 +449,83 @@ export async function runUpdateCommand(
 	// outside claudeup's built-in list, which is every private or third-party one.
 	await registerClosureMarketplaces(closure.marketplaces);
 
-	console.log();
-	const pluginResult = await applyPlugins(plan.plugins, projectPath);
-	const binResult = await applyBins(plan);
-	const skillResult = await applySkills(plan, projectPath);
+	// ---- apply phase, under an animated meter --------------------------------
+
+	const nameWidth = Math.max(12, ...workItems.map((n) => width(n)));
+
+	const state: ApplyState = {
+		done: 0,
+		total: workItems.length,
+		current: "starting",
+		startedAt: Date.now(),
+	};
+
+	const applyLive = new LiveRegion();
+	const reporter: ApplyReporter = {
+		begin: (name) => {
+			state.current = name;
+			applyLive.refresh();
+		},
+		finish: (succeeded, name, detail, ms) => {
+			state.done++;
+			applyLive.note(
+				applyRow(
+					succeeded,
+					name,
+					nameWidth,
+					succeeded ? dim(detail) : fg(brand.danger, detail),
+					ms,
+				),
+			);
+		},
+		detach: (work) => withPaused(applyLive, work),
+	};
+
+	console.log("");
+	applyLive.start((tick) => applyFrame(state, tick, Date.now()));
+
+	const outcome = await applyPlan(plan, projectPath, { report: reporter });
+
+	applyLive.stop();
 
-	const failed = [
-		...pluginResult.failed,
-		...binResult.failed,
-		...skillResult.failed,
-	];
-	const changed = pluginResult.ok + binResult.ok + skillResult.ok;
+	const { failed } = outcome;
 
-	console.log(
-		`\n${changed} updated, ${counts.current} already current${
-			counts.unknown > 0 ? `, ${counts.unknown} unverified` : ""
-		}${failed.length > 0 ? `, ${failed.length} failed` : ""}.`,
-	);
+	for (const line of summaryLine(
+		outcome.changed,
+		counts.current,
+		counts.unknown,
+		failed.length,
+		Date.now() - startedAt,
+	))
+		console.log(line);
 
 	// An exact pin the installer could not deliver. Reported, never fatal: only
 	// the newest published version is installable, so this is a standing property
 	// of the manifest rather than something this run did wrong, and failing here
 	// would make `claudeup update` exit 1 forever for any profile with a pin.
 	// `install --check` with `strictVersions` is where pin drift is GATED.
-	if (pluginResult.mismatches.length > 0) {
+	if (outcome.plugins.mismatches.length > 0) {
 		console.log(
-			`\nNote — ${pluginResult.mismatches.length} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+			warnLine(
+				`${bold(String(outcome.plugins.mismatches.length))} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+			),
 		);
-		for (const m of pluginResult.mismatches) {
+		for (const m of outcome.plugins.mismatches) {
 			console.log(
-				`  ${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,
+				noteLine(
+					`${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,
+				),
 			);
 		}
 		console.log(
-			"Recorded what is actually installed. Update the pin to match, or leave it as a record of intent.",
+			noteLine(
+				"Recorded what is actually installed. Update the pin to match, or leave it as a record of intent.",
+			),
 		);
 	}
 
 	if (failed.length > 0) {
-		console.error(`Failed: ${failed.join(", ")}`);
+		console.error(failLine(`Failed: ${failed.join(", ")}`));
 		return 1;
 	}
 	return 0;