claudeup 6.0.0 → 6.1.0

package/src/__tests__/toolchain.test.ts

@@ -1,34 +1,101 @@
 import { describe, expect, test } from "bun:test";
 import {
+	PYTHON_CLI_INSTALLERS,
+	type PythonCliInstaller,
 	binInstallCommand,
 	binUpgradeCommand,
 	detectToolchains,
+	resolvePythonCliInstaller,
 } from "../services/toolchain.js";
 import type { ResolvedBin } from "../types/index.js";
+import { formatCommand } from "../utils/command-utils.js";
+
+/**
+ * Pin a Python installer explicitly in every `via: "pip"` assertion.
+ *
+ * The production default is resolved from PATH, so asserting a literal command
+ * would encode whatever happens to be installed on the machine running the
+ * suite — green here, red on a runner without uv.
+ */
+const byProbe = (probe: string): PythonCliInstaller => {
+	const found = PYTHON_CLI_INSTALLERS.find((i) => i.probe === probe);
+	if (!found) throw new Error(`no python installer with probe ${probe}`);
+	return found;
+};
+const UV = byProbe("uv");
+const PIPX = byProbe("pipx");
+const PY = byProbe("python3");
 
 describe("binInstallCommand", () => {
 	test("bun with and without a version pin", () => {
-		expect(binInstallCommand({ name: "claudish", via: "bun", package: "claudish", version: "1.2.0" })).toBe(
-			"bun install -g claudish@1.2.0",
-		);
-		expect(binInstallCommand({ name: "claudish", via: "bun" })).toBe(
-			"bun install -g claudish",
-		);
+		expect(
+			formatCommand(
+				binInstallCommand({
+					name: "claudish",
+					via: "bun",
+					package: "claudish",
+					version: "1.2.0",
+				}),
+			),
+		).toBe("bun install -g claudish@1.2.0");
+		expect(
+			formatCommand(binInstallCommand({ name: "claudish", via: "bun" })),
+		).toBe("bun install -g claudish");
+	});
+
+	test("the package name is ONE argv token, whatever is in it", () => {
+		// `bin.package` is hand-authored data — it arrives from
+		// `.claude/profiles.json` and from plugin `requires.bin`, committed by
+		// teammates and fetched from marketplaces, and nothing validates it.
+		// While commands were strings handed to `/bin/sh`, this string was four
+		// words and a command separator. As argv it cannot be anything but a
+		// (nonexistent) package name, so the install fails instead of running.
+		const evil = "a b; rm -rf /";
+		const cmd = binInstallCommand({ name: "x", via: "bun", package: evil });
+		expect(cmd.cmd).toBe("bun");
+		expect(cmd.args).toEqual(["install", "-g", evil]);
+		expect(cmd.args.at(-1)).toBe(evil); // unsplit: still exactly one token
+		// ...and rendering it for display quotes it rather than emitting syntax.
+		expect(formatCommand(cmd)).toBe("bun install -g 'a b; rm -rf /'");
+	});
+
+	test("a version pin joins the package as one token, not two", () => {
+		// Splitting `pkg@version` would ask the installer for two packages, the
+		// second of which is a version number.
+		const cmd = binInstallCommand({
+			name: "claudish",
+			via: "bun",
+			version: "1.2.0",
+		});
+		expect(cmd.args.at(-1)).toBe("claudish@1.2.0");
 	});
 
 	test("npm, pip, brew, go each render correctly", () => {
-		expect(binInstallCommand({ name: "x", via: "npm", package: "x" })).toBe(
-			"npm install -g x",
-		);
-		expect(binInstallCommand({ name: "aider", via: "pip", package: "aider", version: "0.1" })).toBe(
-			"pip install aider==0.1",
-		);
-		expect(binInstallCommand({ name: "tmux", via: "brew", formula: "tmux" })).toBe(
-			"brew install tmux",
-		);
-		expect(binInstallCommand({ name: "t", via: "go", module: "github.com/x/t" })).toBe(
-			"go install github.com/x/t@latest",
-		);
+		// Rendered, not raw, because these literals are also the display-
+		// neutrality claim: every token here is shell-safe, so `formatCommand`
+		// quotes nothing and the printed line is byte-identical to the string
+		// these builders returned before they returned argv.
+		expect(
+			formatCommand(binInstallCommand({ name: "x", via: "npm", package: "x" })),
+		).toBe("npm install -g x");
+		expect(
+			formatCommand(
+				binInstallCommand(
+					{ name: "aider", via: "pip", package: "aider", version: "0.1" },
+					UV,
+				),
+			),
+		).toBe("uv tool install aider==0.1");
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "tmux", via: "brew", formula: "tmux" }),
+			),
+		).toBe("brew install tmux");
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "t", via: "go", module: "github.com/x/t" }),
+			),
+		).toBe("go install github.com/x/t@latest");
 	});
 });
 
@@ -38,26 +105,104 @@ describe("binUpgradeCommand", () => {
 		// installed formula prints "already installed" and changes nothing, and
 		// `pip install` without --upgrade does the same. Reusing them would let
 		// `claudeup update` report success while advancing nothing.
-		expect(binUpgradeCommand({ name: "tmux", via: "brew", formula: "tmux" })).toBe(
-			"brew upgrade tmux",
-		);
-		expect(binUpgradeCommand({ name: "aider", via: "pip", package: "aider" })).toBe(
-			"pip install --upgrade aider",
-		);
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "tmux", via: "brew", formula: "tmux" }),
+			),
+		).toBe("brew upgrade tmux");
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "aider", via: "pip", package: "aider" }, PY),
+			),
+		).toBe("python3 -m pip install --user --upgrade aider");
+		expect(
+			formatCommand(
+				binUpgradeCommand({ name: "aider", via: "pip", package: "aider" }, UV),
+			),
+		).toBe("uv tool install --force --upgrade aider");
+	});
+
+	test("every Python installer distinguishes install from upgrade", () => {
+		// The same trap as brew: `uv tool install` on an already-installed tool
+		// is a no-op, so reusing the install command would report success while
+		// advancing nothing.
+		for (const python of PYTHON_CLI_INSTALLERS) {
+			const bin = { name: "aider", via: "pip" as const, package: "aider" };
+			// Compared RENDERED. Two `Command` objects are never `toBe`-equal —
+			// they are distinct references — so comparing them directly would be
+			// an assertion that cannot fail.
+			expect(formatCommand(binUpgradeCommand(bin, python))).not.toBe(
+				formatCommand(binInstallCommand(bin, python)),
+			);
+		}
+	});
+});
+
+describe("resolvePythonCliInstaller", () => {
+	test("never emits a bare `pip`", () => {
+		// The bug this exists for: `pip` is frequently a zsh ALIAS for pip3 and
+		// no such executable exists. Commands were spawned through /bin/sh, which
+		// sources no profile, so this died with `/bin/sh: pip: command not found`
+		// on a machine where typing `pip` at a prompt works.
+		//
+		// Now that a command is argv, `cmd` is the exact executable that gets
+		// looked up on PATH — so asserting on it is asserting on the syscall,
+		// not on a string a shell might later re-read.
+		for (const python of PYTHON_CLI_INSTALLERS) {
+			for (const cmd of [python.install("x"), python.upgrade("x")]) {
+				expect(cmd.cmd).not.toBe("pip");
+				expect(cmd.cmd).toBe(python.probe);
+			}
+		}
+	});
+
+	test("prefers an isolated-venv installer over the system interpreter", () => {
+		// `pip install` into a Homebrew interpreter is refused outright by PEP
+		// 668 (`externally-managed-environment`), so uv and pipx must outrank it.
+		const order = PYTHON_CLI_INSTALLERS.map((i) => i.probe);
+		expect(order.indexOf("uv")).toBeLessThan(order.indexOf("python3"));
+		expect(order.indexOf("pipx")).toBeLessThan(order.indexOf("python3"));
+	});
+
+	test("always resolves to something, and to one of the known options", () => {
+		// Returning null would force every caller to handle "no installer",
+		// which in practice means printing nothing and silently skipping.
+		const resolved = resolvePythonCliInstaller();
+		expect(PYTHON_CLI_INSTALLERS).toContain(resolved);
+	});
+
+	test("a version pin is expressed in the installer's own syntax", () => {
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "a", via: "pip", version: "1.2" }, UV),
+			),
+		).toBe("uv tool install a==1.2");
+		expect(
+			formatCommand(
+				binInstallCommand({ name: "a", via: "pip", version: "1.2" }, PIPX),
+			),
+		).toBe("pipx install a==1.2");
+		// `a==1.2` is one token. Two would ask uv to install a package called
+		// "1.2".
+		expect(
+			binInstallCommand({ name: "a", via: "pip", version: "1.2" }, UV).args,
+		).toEqual(["tool", "install", "a==1.2"]);
 	});
 
 	test("bun and npm state @latest explicitly, so the printed command reads true", () => {
-		expect(binUpgradeCommand({ name: "claudish", via: "bun" })).toBe(
-			"bun install -g claudish@latest",
-		);
-		expect(binUpgradeCommand({ name: "x", via: "npm", package: "x" })).toBe(
-			"npm install -g x@latest",
-		);
+		expect(
+			formatCommand(binUpgradeCommand({ name: "claudish", via: "bun" })),
+		).toBe("bun install -g claudish@latest");
+		expect(
+			formatCommand(binUpgradeCommand({ name: "x", via: "npm", package: "x" })),
+		).toBe("npm install -g x@latest");
 	});
 
 	test("go installs the module at latest", () => {
 		expect(
-			binUpgradeCommand({ name: "t", via: "go", module: "github.com/x/t" }),
+			formatCommand(
+				binUpgradeCommand({ name: "t", via: "go", module: "github.com/x/t" }),
+			),
 		).toBe("go install github.com/x/t@latest");
 	});
 });

package/src/__tests__/ui-version-writers.test.ts

@@ -0,0 +1,88 @@
+/**
+ * The UI records a plugin version only through a function that read it back.
+ *
+ * `installedPluginVersions` is claudeup's own bookkeeping — the Claude CLI does
+ * not maintain it — and `install --check` reads it to decide whether a machine
+ * has drifted from its profile. So a version written from an EXPECTATION rather
+ * than from disk is not a cosmetic inaccuracy: the drift gate ends up comparing
+ * a number against a copy of itself and reporting clean forever. That is what
+ * PluginsScreen's install branches did, via a local `saveVersionForScope`
+ * helper that duplicated `plugin-manager.ts`'s scope dispatcher and took the
+ * version as a parameter.
+ *
+ * Deleting the helper removed the UI's *ability* to make that mistake. This
+ * test is what keeps it removed: a screen may still install and update, but
+ * only through `installPluginInScope`, which reads the version off disk and
+ * writes nothing when it cannot.
+ *
+ * A source scan rather than a behavioural test because these are `.tsx` screens
+ * this suite cannot render. It encodes the rule directly instead of the symptom
+ * — the precedent for source-scanning guards here is
+ * `uppercase-keybindings.test.ts`.
+ */
+
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import fs from "fs-extra";
+
+const UI_DIR = path.join(import.meta.dir, "..", "ui");
+
+/** The version writers that take the number on trust from their caller. */
+const RAW_WRITERS = [
+	"saveGlobalInstalledPluginVersion",
+	"saveLocalInstalledPluginVersion",
+	"saveInstalledPluginVersion",
+	"saveInstalledPluginVersionForScope",
+];
+
+async function uiSourceFiles(dir: string): Promise<string[]> {
+	const out: string[] = [];
+	for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+		const full = path.join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...(await uiSourceFiles(full)));
+		else if (/\.tsx?$/.test(entry.name)) out.push(full);
+	}
+	return out;
+}
+
+const isComment = (line: string) => {
+	const t = line.trim();
+	return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
+};
+
+describe("no UI file writes a plugin version it did not read back", () => {
+	test("the raw version writers are absent from src/ui", async () => {
+		const files = await uiSourceFiles(UI_DIR);
+		expect(files.length).toBeGreaterThan(10); // guard: the walk found real files
+
+		const offenders: string[] = [];
+		for (const file of files) {
+			const text = await fs.readFile(file, "utf8");
+			text.split("\n").forEach((line, i) => {
+				if (isComment(line)) return;
+				for (const writer of RAW_WRITERS) {
+					// Word-bounded: `saveInstalledPluginVersion` is a prefix of
+					// `saveInstalledPluginVersionForScope`, and both are banned, so a
+					// substring match would just double-report the same line.
+					if (new RegExp(`\\b${writer}\\b`).test(line)) {
+						offenders.push(
+							`${path.relative(UI_DIR, file)}:${i + 1}  ${line.trim()}`,
+						);
+					}
+				}
+			});
+		}
+
+		expect(offenders).toEqual([]);
+	});
+
+	test("the guard can actually fail", () => {
+		// Negative control. The assertion above passes trivially if the walk or
+		// the pattern is broken, and a guard that cannot fail is not evidence.
+		const line = "\t\t\tawait saveGlobalInstalledPluginVersion(id, version);";
+		expect(isComment(line)).toBe(false);
+		expect(RAW_WRITERS.some((w) => new RegExp(`\\b${w}\\b`).test(line))).toBe(
+			true,
+		);
+	});
+});

package/src/__tests__/update-apply.test.ts

@@ -7,7 +7,11 @@
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
-import { type PluginApplyDeps, applyPlugins } from "../cli/update.js";
+import {
+	type PluginApplyDeps,
+	applyPlugins,
+	installPluginInScope,
+} from "../services/update-engine.js";
 import type { PluginScope } from "../services/claude-cli.js";
 import type { PluginUpdateItem } from "../services/update-plan.js";
 
@@ -221,3 +225,44 @@ describe("failure handling", () => {
 		expect(result.ok).toBe(0);
 	});
 });
+
+describe("installPluginInScope — a fresh install records what landed", () => {
+	// The TUI's install branches called the CLI directly and then wrote the
+	// version they had ASKED for. A marketplace serves whatever it publishes at
+	// the moment of the call, so that number was a guess — and `install --check`
+	// reads back the same field, so it compared the guess against a copy of
+	// itself and reported clean forever. Routing installs through the read-back
+	// the update branches already used is what closes it.
+	//
+	// The read-back semantics are pinned in cli-apply-seams.test.ts
+	// ("installPluginInScope — the scope-targeted path"). What these add is the
+	// property that makes the whole class of bug unrepresentable rather than
+	// merely absent right now.
+
+	test("takes no version parameter, so a caller cannot supply a wrong one", () => {
+		// Arity, not behaviour — and that is the point. Re-adding a `version`
+		// argument would reopen the defect without failing any behavioural test,
+		// because the new parameter would simply be believed.
+		// (pluginId, scope, projectPath, deps = REAL_PLUGIN_DEPS) — the defaulted
+		// parameter is not counted by Function.length.
+		expect(installPluginInScope.length).toBe(3);
+	});
+
+	test("saves the version read back, not one the caller chose", async () => {
+		const { deps, saved } = stubDeps("9.9.9");
+		await installPluginInScope("dev@magus", "user", PROJECT, deps);
+		expect(saved).toEqual([
+			{ id: "dev@magus", version: "9.9.9", scope: "user" },
+		]);
+	});
+
+	test("an unreadable version writes nothing at all", async () => {
+		// Never guess. A missing record is recoverable; a wrong one is not,
+		// because nothing downstream can tell it from a true one.
+		const { deps, saved } = stubDeps(null);
+		expect(
+			await installPluginInScope("dev@magus", "user", PROJECT, deps),
+		).toBeNull();
+		expect(saved).toEqual([]);
+	});
+});

package/src/cli/install.ts

@@ -47,9 +47,10 @@ import type {
 	ResolvedClosure,
 	SkillInfo,
 } from "../types/index.js";
-import { resolveExecutable } from "../utils/command-utils.js";
+import { formatCommand, resolveExecutable } from "../utils/command-utils.js";
 import { ensureManifest } from "./bootstrap.js";
-import { confirm, promptValue, runShell } from "./prompt.js";
+import { confirm, promptValue } from "./prompt.js";
+import { runCommand, runShellScript } from "../utils/run.js";
 
 interface InstallFlags {
 	check: boolean;
@@ -125,7 +126,10 @@ async function ensureToolchains(
 			));
 		if (ok) {
 			console.log(`Installing ${tc.name}…`);
-			if (!(await runShell(bootstrap))) {
+			// A bootstrap line IS shell text — bun's contains a pipe, Homebrew's a
+			// command substitution — and it is a constant in this repo, not
+			// profile data. This is the only legitimate caller.
+			if (!(await runShellScript(bootstrap))) {
 				console.warn(`⚠ Failed to install ${tc.name}. Continuing.`);
 			}
 		}
@@ -163,8 +167,10 @@ async function installBins(bins: ResolvedBin[]): Promise<void> {
 			continue; // already installed and runnable (not a dangling link)
 		}
 		const cmd = binInstallCommand(bin);
-		console.log(`+ ${bin.name}  (${cmd})`);
-		if (!(await runShell(cmd))) {
+		// Printed rendered, executed as argv. The package name in `cmd.args` came
+		// from a profile or a plugin manifest, so it must never reach a shell.
+		console.log(`+ ${bin.name}  (${formatCommand(cmd)})`);
+		if (!(await runCommand(cmd))) {
 			console.warn(`⚠ failed to install ${bin.name} via ${bin.via}`);
 		}
 	}

package/src/cli/prompt.ts

@@ -31,12 +31,3 @@ export async function promptValue(question: string): Promise<string> {
 	}
 }
 
-/** Run a shell command, streaming output; resolve true on exit 0. */
-export async function runShell(command: string): Promise<boolean> {
-	const { spawn } = await import("node:child_process");
-	return new Promise((resolve) => {
-		const child = spawn(command, { stdio: "inherit", shell: true });
-		child.on("exit", (code) => resolve(code === 0));
-		child.on("error", () => resolve(false));
-	});
-}

package/src/cli/update-view.ts

@@ -32,6 +32,7 @@ import type {
 } from "../services/update-plan.js";
 import { binInstallCommand, binUpgradeCommand } from "../services/toolchain.js";
 import { brand } from "../ui/theme.js";
+import { formatCommand } from "../utils/command-utils.js";
 import {
 	badge,
 	bold,
@@ -256,7 +257,9 @@ function binDetail(item: BinUpdateItem, plan: UpdatePlan): string {
 		item.action === "install"
 			? binInstallCommand(spec)
 			: binUpgradeCommand(spec);
-	return dim(cmd);
+	// Rendered for the reader's eyes only — this row says what WILL run, while
+	// applyBins runs the argv itself.
+	return dim(formatCommand(cmd));
 }
 
 /**