claudeup 6.0.0 → 6.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "6.0.0",
-    "claudeup-darwin-x64": "6.0.0",
-    "claudeup-linux-x64": "6.0.0"
+    "claudeup-darwin-arm64": "6.1.0",
+    "claudeup-darwin-x64": "6.1.0",
+    "claudeup-linux-x64": "6.1.0"
   }
 }

package/scripts/test-isolated.ts

@@ -19,7 +19,13 @@ function findTests(dir: string): string[] {
 	for (const entry of readdirSync(dir)) {
 		const p = join(dir, entry);
 		if (statSync(p).isDirectory()) out.push(...findTests(p));
-		else if (p.endsWith(".test.ts")) out.push(p);
+		// `.tsx` as well as `.ts`. The suffix was written when no `.tsx` test
+		// existed, so it silently excluded the only file testing a UI primitive
+		// — the class of test most likely to be `.tsx` and least likely to be
+		// noticed missing, because a file that is never collected reports
+		// nothing at all. The printed `N/N` count below is the guard: it moves
+		// when collection changes.
+		else if (/\.test\.tsx?$/.test(p)) out.push(p);
 	}
 	return out;
 }

package/src/__tests__/cli-apply-seams.test.ts

@@ -15,9 +15,10 @@ import {
 	type ApplyReporter,
 	type PluginApplyDeps,
 	applyPlugins,
-	parseArgs,
 	pluginNeedsWork,
-} from "../cli/update.js";
+	installPluginInScope,
+} from "../services/update-engine.js";
+import { parseArgs } from "../cli/update.js";
 import { checkBinaries } from "../services/doctor-bins.js";
 import type { PluginScope } from "../services/claude-cli.js";
 import type { PluginUpdateItem } from "../services/update-plan.js";
@@ -174,6 +175,53 @@ describe("flags", () => {
 	});
 });
 
+describe("installPluginInScope — the scope-targeted path", () => {
+	test("records the version READ BACK, not the one expected", async () => {
+		// This is the bug the TUI's per-scope menu carried after the CLI had
+		// fixed it: it wrote the version it *expected*, so `install --check`
+		// compared a pin against a copy of itself and reported clean forever.
+		const d = deps();
+		d.readInstalled = mock(async () => "9.9.9");
+		const saved: unknown[] = [];
+		d.saveInstalled = mock(async (id, version, scope) => {
+			saved.push({ id, version, scope });
+		});
+
+		const actual = await installPluginInScope("dev@magus", "user", PROJECT, d);
+
+		expect(actual).toBe("9.9.9");
+		expect(saved).toEqual([
+			{ id: "dev@magus", version: "9.9.9", scope: "user" },
+		]);
+	});
+
+	test("honours the caller's scope rather than fanning out", async () => {
+		// The whole reason this exists beside applyPlugins: the user picked a
+		// scope from a menu, so "every scope that is behind" would override them.
+		const d = deps();
+		const updated: Array<[string, string]> = [];
+		d.update = mock(async (id, scope) => {
+			updated.push([id, scope]);
+		});
+
+		await installPluginInScope("dev@magus", "local", PROJECT, d);
+
+		expect(updated).toEqual([["dev@magus", "local"]]);
+	});
+
+	test("an unreadable version is reported, never guessed", async () => {
+		const d = deps();
+		d.readInstalled = mock(async () => null);
+		const saved: unknown[] = [];
+		d.saveInstalled = mock(async () => {
+			saved.push(1);
+		});
+
+		expect(await installPluginInScope("x", "user", PROJECT, d)).toBeNull();
+		expect(saved).toEqual([]);
+	});
+});
+
 describe("checkBinaries onProbe", () => {
 	const bins: ResolvedBin[] = [
 		{ name: "tmux", via: "brew", sources: [] } as unknown as ResolvedBin,

package/src/__tests__/cli-tool-commands.test.ts

@@ -0,0 +1,239 @@
+/**
+ * The CLI-tools catalogue can no longer emit a bare `pip`, or shell syntax.
+ *
+ * Two defects lived in this screen, and both were data problems dressed as code
+ * problems:
+ *
+ *  1. **Bare `pip`.** `getUpdateCommand`'s `pip` and `default` arms returned the
+ *     catalogue's `installCommand` verbatim, and `getUninstallCommand` emitted
+ *     `pip uninstall -y`. `pip` is frequently a zsh alias rather than an
+ *     executable, and a machine that manages Python tools with uv or pipx may
+ *     have no `pip` at all. `services/toolchain.ts` already knew how to answer
+ *     "how does Python work here"; this screen was not asking it.
+ *  2. **Shell syntax in data.** `aider`'s entry was
+ *     `pip install aider-install && aider-install` — a `&&` chain in a catalogue
+ *     field that got handed to `/bin/bash`.
+ *
+ * Both are now unrepresentable: the field is gone and the command is derived.
+ * These tests assert that over the whole catalogue rather than over an example,
+ * so a new entry cannot reintroduce either.
+ *
+ * Pure — no React, no network, no PATH dependency. Every Python installer is
+ * pinned explicitly, per the convention `toolchain.test.ts` established: the
+ * production default is resolved from PATH, so an unpinned assertion would
+ * encode whatever happens to be installed on the machine running the suite.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { cliTools } from "../data/cli-tools.js";
+import {
+	type InstallMethod,
+	cliToolInstall,
+	cliToolUninstall,
+	cliToolUpdate,
+} from "../services/cli-tool-commands.js";
+import {
+	PYTHON_CLI_INSTALLERS,
+	type PythonCliInstaller,
+	resolvePythonCliInstaller,
+} from "../services/toolchain.js";
+import { versionFromPypiJson } from "../ui/screens/CliToolsScreen.js";
+import { type Command, formatCommand } from "../utils/command-utils.js";
+
+const byProbe = (probe: string): PythonCliInstaller => {
+	const found = PYTHON_CLI_INSTALLERS.find((i) => i.probe === probe);
+	if (!found) throw new Error(`no python installer with probe ${probe}`);
+	return found;
+};
+const PYTHON_PROBES = PYTHON_CLI_INSTALLERS.map((i) => i.probe);
+
+/** The methods the resolver models, i.e. the ones that reach toolchain.ts. */
+const RESOLVED_METHODS: InstallMethod[] = ["npm", "bun", "brew", "pip"];
+
+describe("the catalogue is well-formed", () => {
+	test("it has entries, and each names a package manager and a package", () => {
+		// Guard: every assertion below iterates the catalogue, so an empty or
+		// malformed one would make them all pass vacuously.
+		expect(cliTools.length).toBeGreaterThan(5);
+		for (const tool of cliTools) {
+			expect(typeof tool.packageName).toBe("string");
+			expect(tool.packageName.length).toBeGreaterThan(0);
+			expect(["bun", "npm", "pip", "brew", "go"]).toContain(
+				tool.packageManager,
+			);
+		}
+	});
+});
+
+describe("no builder ever emits a bare `pip`", () => {
+	test("install: cmd is the resolver's probe, never `pip`", () => {
+		for (const tool of cliTools) {
+			const cmd = cliToolInstall(tool);
+			expect(cmd.cmd).not.toBe("pip");
+			if (tool.packageManager === "pip") {
+				// Whatever the machine running this resolved to, it must be one of
+				// the three modelled installers — and `cmd` must BE that probe,
+				// since that is the executable the syscall looks up.
+				expect(PYTHON_PROBES).toContain(cmd.cmd);
+				expect(cmd.cmd).toBe(resolvePythonCliInstaller().probe);
+			}
+		}
+	});
+
+	test("update and uninstall: cmd is never `pip`, for any method", () => {
+		for (const tool of cliTools) {
+			for (const method of RESOLVED_METHODS) {
+				for (const cmd of [
+					cliToolUpdate(tool, method),
+					cliToolUninstall(tool, method),
+				]) {
+					if (!cmd) continue;
+					expect(cmd.cmd).not.toBe("pip");
+				}
+			}
+		}
+	});
+
+	test("each pinned Python installer drives all three of its own commands", () => {
+		// Pinned explicitly so this holds on a runner with no uv. The `pip`
+		// method must route to the SAME executable for install, update and
+		// uninstall — installing with uv and uninstalling with python3 would look
+		// like it worked and leave the tool on disk.
+		for (const probe of PYTHON_PROBES) {
+			const python = byProbe(probe);
+			expect(python.install("x").cmd).toBe(probe);
+			expect(python.upgrade("x").cmd).toBe(probe);
+			expect(python.uninstall("x").cmd).toBe(probe);
+		}
+	});
+});
+
+describe("no builder can emit shell syntax", () => {
+	test("no argv element of any command contains &&, | or ;", () => {
+		// The catalogue's only `&&` chain was aider's installCommand. With the
+		// field gone there is nowhere left for shell syntax to enter, and this
+		// asserts that over every entry and every method rather than over that
+		// one case.
+		const all: Command[] = [];
+		for (const tool of cliTools) {
+			all.push(cliToolInstall(tool));
+			for (const method of [
+				...RESOLVED_METHODS,
+				"pnpm" as const,
+				"yarn" as const,
+			]) {
+				const u = cliToolUpdate(tool, method);
+				const r = cliToolUninstall(tool, method);
+				if (u) all.push(u);
+				if (r) all.push(r);
+			}
+		}
+		expect(all.length).toBeGreaterThan(0);
+
+		for (const cmd of all) {
+			for (const token of [cmd.cmd, ...cmd.args]) {
+				expect(token).not.toContain("&&");
+				expect(token).not.toContain("|");
+				expect(token).not.toContain(";");
+			}
+		}
+	});
+});
+
+describe("the detected method is followed, not the catalogue's", () => {
+	test("pnpm and yarn keep their own shapes", () => {
+		// A tool the catalogue calls npm can still have been installed with
+		// pnpm. Updating it as npm would install a second copy beside the first,
+		// which is the conflict this screen exists to report.
+		const tool = cliTools.find((t) => t.packageManager === "npm")!;
+		expect(cliToolUpdate(tool, "pnpm")).toEqual({
+			cmd: "pnpm",
+			args: ["install", "-g", tool.packageName],
+		});
+		expect(cliToolUpdate(tool, "yarn")).toEqual({
+			cmd: "yarn",
+			args: ["global", "add", tool.packageName],
+		});
+		expect(cliToolUninstall(tool, "pnpm")).toEqual({
+			cmd: "pnpm",
+			args: ["remove", "-g", tool.packageName],
+		});
+		expect(cliToolUninstall(tool, "yarn")).toEqual({
+			cmd: "yarn",
+			args: ["global", "remove", tool.packageName],
+		});
+	});
+
+	test("`unknown` returns null rather than guessing", () => {
+		// Preserves the observable behaviour: handleInstall reads
+		// `installed && updateCommand ? updateCommand : install…`, so null falls
+		// back to a plain install — which is what the old `default:` arm did by
+		// returning `tool.installCommand`.
+		const tool = cliTools[0]!;
+		expect(cliToolUpdate(tool, "unknown")).toBeNull();
+		expect(cliToolUninstall(tool, "unknown")).toBeNull();
+	});
+
+	test("brew and go arms are pinned, since no catalogue entry exercises them", () => {
+		// Every entry today is bun/npm/pip, so these two ship untouched by real
+		// data. `go` has no uninstaller — `go install` writes a binary and
+		// records nothing — so null is correct rather than an invented `rm`.
+		const tool = cliTools[0]!;
+		expect(cliToolUpdate(tool, "brew", "some-formula")).toEqual({
+			cmd: "brew",
+			args: ["upgrade", "some-formula"],
+		});
+		expect(cliToolUninstall(tool, "brew", "some-formula")).toEqual({
+			cmd: "brew",
+			args: ["uninstall", "some-formula"],
+		});
+	});
+});
+
+describe("derived commands still read as they did", () => {
+	test("claude renders exactly the literal the catalogue used to carry", () => {
+		// The entry whose command SHOULD not change. Its old
+		// `installCommand: "npm install -g @anthropic-ai/claude-code"` is now
+		// derived from packageManager + packageName, and must render identically.
+		const claude = cliTools.find((t) => t.name === "claude")!;
+		expect(formatCommand(cliToolInstall(claude))).toBe(
+			"npm install -g @anthropic-ai/claude-code",
+		);
+	});
+
+	test("aider now installs the package its own fields already named", () => {
+		// The one deliberate behaviour change. The old command installed
+		// `aider-install`, a bootstrapper whose version nothing here ever read,
+		// while `packageName`, `checkCommand` and the PyPI query all said
+		// `aider-chat`. The installCommand was the field that was out of step.
+		const aider = cliTools.find((t) => t.name === "aider")!;
+		expect(aider.packageName).toBe("aider-chat");
+		expect(cliToolInstall(aider).args).toContain("aider-chat");
+		expect(formatCommand(cliToolInstall(aider))).not.toContain("aider-install");
+	});
+});
+
+describe("versionFromPypiJson", () => {
+	// The shape of a real https://pypi.org/pypi/<pkg>/json body, trimmed to the
+	// two fields that matter. Captured rather than mocked so the parser is
+	// tested against what the endpoint actually returns.
+	const body = {
+		info: { name: "aider-chat", version: "0.86.1" },
+		releases: {},
+	};
+
+	test("reads info.version", () => {
+		expect(versionFromPypiJson(body)).toBe("0.86.1");
+	});
+
+	test("anything unexpected yields undefined, never a throw", () => {
+		// A version check is advisory: it must degrade to "no update badge",
+		// never take the screen down. PyPI returning an error object, a 404 body,
+		// or nothing at all all land here.
+		expect(versionFromPypiJson({})).toBeUndefined();
+		expect(versionFromPypiJson({ info: {} })).toBeUndefined();
+		expect(versionFromPypiJson({ info: { version: 42 } })).toBeUndefined();
+		expect(versionFromPypiJson(null)).toBeUndefined();
+		expect(versionFromPypiJson("not json at all")).toBeUndefined();
+	});
+});

package/src/__tests__/format-command.test.ts

@@ -0,0 +1,78 @@
+/**
+ * `formatCommand` renders a Command for a human, and must not lie.
+ *
+ * Two properties, and they pull in opposite directions:
+ *
+ *  1. **Display neutrality.** Every token claudeup actually builds is
+ *     shell-safe, so the rendered line must be byte-identical to the string
+ *     these builders produced before commands became argv. That is what lets
+ *     item 3 land without touching `install`/`doctor` output.
+ *     `doctor-bins.test.ts` is the end-to-end gate on that; these are the unit.
+ *  2. **A dangerous token must LOOK dangerous.** If a package name ever did
+ *     contain shell syntax, printing it bare would show the reader a command
+ *     that does something other than what runs. Quoting it makes the
+ *     one-token-ness visible.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { type Command, formatCommand } from "../utils/command-utils.js";
+
+const c = (cmd: string, ...args: string[]): Command => ({ cmd, args });
+
+describe("formatCommand — display neutrality", () => {
+	test("every token this codebase really builds renders unquoted", () => {
+		// Sampled from the actual builders: npm scopes, version pins in both
+		// syntaxes, go module paths, long flags. If quoting ever fires for one of
+		// these, some install/doctor output changed.
+		expect(formatCommand(c("bun", "install", "-g", "claudish@1.2.0"))).toBe(
+			"bun install -g claudish@1.2.0",
+		);
+		expect(
+			formatCommand(c("npm", "install", "-g", "@anthropic-ai/claude-code")),
+		).toBe("npm install -g @anthropic-ai/claude-code");
+		expect(formatCommand(c("uv", "tool", "install", "aider==0.1"))).toBe(
+			"uv tool install aider==0.1",
+		);
+		expect(formatCommand(c("go", "install", "github.com/x/t@latest"))).toBe(
+			"go install github.com/x/t@latest",
+		);
+		expect(
+			formatCommand(
+				c("python3", "-m", "pip", "install", "--user", "--upgrade", "aider"),
+			),
+		).toBe("python3 -m pip install --user --upgrade aider");
+		expect(formatCommand(c("brew", "install", "tmux"))).toBe(
+			"brew install tmux",
+		);
+	});
+
+	test("a command with no arguments renders as just the executable", () => {
+		expect(formatCommand(c("brew"))).toBe("brew");
+	});
+});
+
+describe("formatCommand — a dangerous token is made visible", () => {
+	test("shell metacharacters are single-quoted", () => {
+		expect(formatCommand(c("bun", "install", "-g", "a b; rm -rf /"))).toBe(
+			"bun install -g 'a b; rm -rf /'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "$(id)"))).toBe(
+			"bun install -g '$(id)'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "a|b"))).toBe(
+			"bun install -g 'a|b'",
+		);
+	});
+
+	test("an embedded single quote closes, escapes and reopens", () => {
+		// `'\''` is the only POSIX-portable way: a single-quoted string has no
+		// escape character at all, so the quote must be left and re-entered.
+		expect(formatCommand(c("x", "it's"))).toBe(`x 'it'\\''s'`);
+	});
+
+	test("an empty argument is quoted so it does not vanish", () => {
+		// Unquoted it would render as nothing, and the reader would be shown a
+		// command with fewer arguments than the one that runs.
+		expect(formatCommand(c("x", "", "y"))).toBe("x '' y");
+	});
+});

package/src/__tests__/shell-script-callers.test.ts

@@ -0,0 +1,92 @@
+/**
+ * `runShellScript` has exactly one legitimate caller, and this pins it.
+ *
+ * The whole of item 3 is the split between two ways of running a child process:
+ * argv (`runCommand`), which no shell ever sees, and a script (`runShellScript`),
+ * which `/bin/sh` parses. Every installer command belongs to the first, because
+ * it is assembled from package names that arrive in `.claude/profiles.json` and
+ * plugin `requires.bin` — hand-authored, committed by teammates, fetched from
+ * marketplaces, validated by nothing. The second exists only for the two
+ * `TOOLCHAIN_BOOTSTRAP` values, which are constants in this repo copied from
+ * bun.sh and brew.sh and which genuinely contain a pipe and a command
+ * substitution.
+ *
+ * Nothing in the type system distinguishes them — both are strings — so after
+ * the commit lands, the design decision is enforced by this test or by nothing.
+ * A branded `ShellScript` type would enforce it at compile time and was
+ * considered; for one map, two entries and one call site it is more machinery
+ * than the rule is worth, and unlike a brand this is greppable.
+ *
+ * Source-scanning precedent in this suite: `uppercase-keybindings.test.ts`.
+ */
+
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import fs from "fs-extra";
+
+const SRC_DIR = path.join(import.meta.dir, "..");
+
+/** Files permitted to call `runShellScript`, relative to `src/`. */
+const ALLOWED = ["cli/install.ts"];
+
+/** The definition itself, plus this test, are not callers. */
+const NOT_CALLERS = ["utils/run.ts", "__tests__/shell-script-callers.test.ts"];
+
+async function sourceFiles(dir: string): Promise<string[]> {
+	const out: string[] = [];
+	for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+		const full = path.join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...(await sourceFiles(full)));
+		else if (/\.tsx?$/.test(entry.name)) out.push(full);
+	}
+	return out;
+}
+
+const isComment = (line: string) => {
+	const t = line.trim();
+	return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
+};
+
+async function callersOf(pattern: RegExp): Promise<string[]> {
+	const found = new Set<string>();
+	for (const file of await sourceFiles(SRC_DIR)) {
+		const rel = path.relative(SRC_DIR, file);
+		if (NOT_CALLERS.includes(rel)) continue;
+		const text = await fs.readFile(file, "utf8");
+		for (const line of text.split("\n")) {
+			if (isComment(line)) continue;
+			if (pattern.test(line)) found.add(rel);
+		}
+	}
+	return [...found].sort();
+}
+
+describe("only the toolchain bootstrap goes through a shell", () => {
+	test("runShellScript is called from exactly the allowed files", async () => {
+		expect(await callersOf(/\brunShellScript\(/)).toEqual(ALLOWED);
+	});
+
+	test("nothing spawns with `shell: true` outside utils/run.ts", async () => {
+		// Catches someone reaching for `spawn`/`exec` directly rather than
+		// through the seam — a second shell path that never names
+		// `runShellScript`.
+		//
+		// Scope, stated honestly: this checks `shell: true` only. Several
+		// version-DETECTION helpers in CliToolsScreen still pass
+		// `shell: "/bin/bash"` to run pipelines like `which -a x 2>/dev/null`.
+		// Those interpolate a catalogue `name`, not an installer command, and
+		// were out of scope here — so this assertion would be false if it
+		// claimed no shell exists anywhere.
+		expect(await callersOf(/shell:\s*true/)).toEqual([]);
+	});
+
+	test("the scan can actually fail", async () => {
+		// Negative control. The two assertions above pass trivially if the walk
+		// finds nothing or the pattern never matches, and a check that cannot
+		// fail is not evidence. `runCommand(` is known to be called from several
+		// files, so a working scan must find them.
+		const runCommandCallers = await callersOf(/\brunCommand\(/);
+		expect(runCommandCallers.length).toBeGreaterThan(0);
+		expect(runCommandCallers).toContain("cli/install.ts");
+	});
+});