claudeup 6.0.0 → 6.1.0

package/src/cli/update.ts

@@ -34,13 +34,7 @@
  * `cli/update-view.ts` owns every string. Nothing in this file formats.
  */
 
-import path from "node:path";
-import type { PluginScope } from "../services/claude-cli.js";
-import {
-	isClaudeAvailable,
-	repairPlugin,
-	updatePlugin,
-} from "../services/claude-cli.js";
+import { isClaudeAvailable } from "../services/claude-cli.js";
 import { clearContentDriftCache } from "../services/content-drift.js";
 import { checkBinaries } from "../services/doctor-bins.js";
 import { validateManifest } from "../services/manifest.js";
@@ -50,16 +44,18 @@ import {
 	type PluginInfo,
 	clearMarketplaceCache,
 	getAvailablePlugins,
-	readInstalledVersionForScope,
-	saveInstalledPluginVersionForScope,
 } from "../services/plugin-manager.js";
 import { resolveProfile } from "../services/resolver.js";
-import { installSkill } from "../services/skills-manager.js";
 import { getInstalledSkillNames } from "../services/skills-manager.js";
 import { activeProfile } from "../services/symlink-manager.js";
-import { binInstallCommand, binUpgradeCommand } from "../services/toolchain.js";
+// The apply half lives in services/ so the TUI runs the SAME code — see the
+// header of update-engine.ts for what drifted while it did not.
+import {
+	type ApplyReporter,
+	applyPlan,
+	planWorkItems,
+} from "../services/update-engine.js";
 import {
-	type PluginUpdateItem,
 	type UpdatePlan,
 	planBinUpdates,
 	planHasWork,
@@ -68,12 +64,10 @@ import {
 	planSkillUpdates,
 	summarizePlan,
 } from "../services/update-plan.js";
-import type { ProfileSkillRef, SkillInfo } from "../types/index.js";
 import { brand } from "../ui/theme.js";
 import { bold, dim, fg, width } from "./ansi.js";
 import { ensureManifest } from "./bootstrap.js";
 import { LiveRegion, withPaused } from "./live.js";
-import { runShell } from "./prompt.js";
 import {
 	type ApplyState,
 	type Step,
@@ -114,253 +108,6 @@ export function parseArgs(args: string[]): UpdateFlags {
 	};
 }
 
-// -- apply -------------------------------------------------------------------
-
-/** Map a manifest skill ref to the SkillInfo shape installSkill expects. */
-function toSkillInfo(ref: ProfileSkillRef): SkillInfo {
-	return {
-		id: `${ref.repo}/${ref.path}`,
-		name: ref.name,
-		source: {
-			label: ref.repo,
-			repo: ref.repo,
-			skillsPath: path.dirname(ref.path),
-		},
-		repoPath: ref.path,
-		gitBlobSha: "",
-		frontmatter: null,
-		installed: false,
-		installedScope: null,
-		hasUpdate: false,
-	};
-}
-
-interface ApplyResult {
-	ok: number;
-	failed: string[];
-}
-
-/** An exact pin the installer could not deliver, discovered by reading back. */
-export interface PinMismatch {
-	pluginId: string;
-	pinned: string;
-	actual: string | null;
-	scope: PluginScope;
-}
-
-export interface PluginApplyResult extends ApplyResult {
-	mismatches: PinMismatch[];
-}
-
-/**
- * How the apply loop reports itself.
- *
- * Injected rather than hard-coded, because the loop is the same work whether it
- * is driving an animated meter, printing plain lines into a pipe, or running
- * under a test that wants silence. The default prints one line per item, which
- * is what every non-interactive caller wants.
- */
-export interface ApplyReporter {
-	/** An item is starting. Called before any of its work. */
-	begin(name: string): void;
-	/** An item finished. `detail` is already formatted for display. */
-	finish(ok: boolean, name: string, detail: string, ms: number): void;
-	/**
-	 * Run `work` with the terminal released.
-	 *
-	 * A binary upgrade spawns `brew`/`npm` with inherited stdio: it writes and
-	 * moves the cursor itself, so any animated block must be erased first or the
-	 * two interleave into garbage.
-	 */
-	detach<T>(work: () => Promise<T>): Promise<T>;
-}
-
-const PLAIN_REPORTER: ApplyReporter = {
-	begin: () => {},
-	finish: (ok, name, detail) => {
-		const line = `${ok ? "✓" : "⚠"} ${name}${detail ? `  ${detail}` : ""}`;
-		if (ok) console.log(line);
-		else console.warn(line);
-	},
-	detach: (work) => work(),
-};
-
-/**
- * The four side-effecting calls the plugin apply path makes, injectable so the
- * path itself can be tested.
- *
- * This exists because the apply half shipped with no coverage while the pure
- * planner had forty tests — and every real defect found in review lived here,
- * not there. Following the same shape `checkBinaries` and `resolveProfile`
- * already use for their impure edges.
- */
-export interface PluginApplyDeps {
-	update: (pluginId: string, scope: PluginScope) => Promise<void>;
-	repair: (
-		pluginId: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<void>;
-	readInstalled: (
-		pluginId: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<string | null>;
-	saveInstalled: (
-		pluginId: string,
-		version: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<void>;
-}
-
-const REAL_PLUGIN_DEPS: PluginApplyDeps = {
-	update: updatePlugin,
-	repair: repairPlugin,
-	readInstalled: readInstalledVersionForScope,
-	saveInstalled: saveInstalledPluginVersionForScope,
-};
-
-/**
- * Scopes the apply loop would touch for `item`. Empty means it is skipped.
- *
- * A plugin the profile declares but nothing has installed goes in at PROJECT
- * scope, matching `install`: a profile is a property of one repo, so its
- * plugins must not be enabled machine-wide.
- */
-function scopesToApply(item: PluginUpdateItem): PluginScope[] {
-	if (item.action === "current" || item.action === "unknown") return [];
-	return item.action === "install" ? ["project"] : item.scopes;
-}
-
-/**
- * Whether the apply loop will do anything for `item`.
- *
- * Exported shape for ONE reason: the progress meter's denominator must be the
- * same predicate the loop actually applies. It was previously re-derived at the
- * call site and replicated only the first of the two skips — an actionable item
- * with empty `scopes` was counted but never run, so the bar would stop short of
- * full and sit there looking hung at the end of a successful update.
- */
-export function pluginNeedsWork(item: PluginUpdateItem): boolean {
-	return scopesToApply(item).length > 0;
-}
-
-export async function applyPlugins(
-	items: PluginUpdateItem[],
-	projectPath: string,
-	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
-	report: ApplyReporter = PLAIN_REPORTER,
-): Promise<PluginApplyResult> {
-	const result: PluginApplyResult = { ok: 0, failed: [], mismatches: [] };
-
-	for (const item of items) {
-		const scopes = scopesToApply(item);
-		if (scopes.length === 0) continue;
-
-		report.begin(item.pluginId);
-		const startedAt = Date.now();
-
-		try {
-			for (const scope of scopes) {
-				if (item.action === "repair") {
-					await deps.repair(item.pluginId, scope, projectPath);
-				} else {
-					await deps.update(item.pluginId, scope);
-				}
-
-				// Record what LANDED, not what we asked for.
-				//
-				// `claude plugin install` accepts no version, so an exact pin is a
-				// request the installer cannot honour — it fetches whatever the
-				// marketplace publishes now. Writing `item.target` here recorded the
-				// pin as satisfied whatever actually installed, and `install --check`
-				// reads that same field to decide whether the machine has drifted.
-				// The gate would have compared the pin against a copy of itself and
-				// reported clean forever.
-				const actual = await deps.readInstalled(
-					item.pluginId,
-					scope,
-					projectPath,
-				);
-				if (actual) {
-					await deps.saveInstalled(item.pluginId, actual, scope, projectPath);
-				}
-				if (item.pinned !== "latest" && actual !== item.pinned) {
-					result.mismatches.push({
-						pluginId: item.pluginId,
-						pinned: item.pinned,
-						actual,
-						scope,
-					});
-				}
-			}
-			report.finish(
-				true,
-				item.pluginId,
-				`${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`,
-				Date.now() - startedAt,
-			);
-			result.ok++;
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			report.finish(false, item.pluginId, msg, Date.now() - startedAt);
-			result.failed.push(item.pluginId);
-		}
-	}
-
-	return result;
-}
-
-async function applyBins(
-	plan: UpdatePlan,
-	report: ApplyReporter = PLAIN_REPORTER,
-): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
-	for (const item of plan.bins) {
-		if (item.action === "current") continue;
-		const bin = plan.binSpecs.get(item.name);
-		if (!bin) continue;
-		const cmd =
-			item.action === "install"
-				? binInstallCommand(bin)
-				: binUpgradeCommand(bin);
-		report.begin(item.name);
-		const startedAt = Date.now();
-		// The installer owns the terminal for the duration: it streams its own
-		// output through inherited stdio.
-		const succeeded = await report.detach(async () => {
-			console.log(`\n$ ${cmd}`);
-			return runShell(cmd);
-		});
-		report.finish(succeeded, item.name, cmd, Date.now() - startedAt);
-		if (succeeded) result.ok++;
-		else result.failed.push(item.name);
-	}
-	return result;
-}
-
-async function applySkills(
-	plan: UpdatePlan,
-	projectPath: string,
-	report: ApplyReporter = PLAIN_REPORTER,
-): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
-	for (const item of plan.skills) {
-		report.begin(item.name);
-		const startedAt = Date.now();
-		try {
-			await installSkill(toSkillInfo(item.ref), "project", projectPath);
-			report.finish(true, item.name, item.ref.repo, Date.now() - startedAt);
-			result.ok++;
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			report.finish(false, item.name, msg, Date.now() - startedAt);
-			result.failed.push(item.name);
-		}
-	}
-	return result;
-}
 
 // -- phase runner ------------------------------------------------------------
 
@@ -637,14 +384,10 @@ export async function runUpdateCommand(
 		return 1;
 	}
 
-	// Exactly the items the three apply loops will touch. `pluginNeedsWork` is
-	// the SAME predicate applyPlugins uses — re-deriving it is how a meter
-	// drifts from the loop it measures.
-	const workItems = [
-		...plan.plugins.filter(pluginNeedsWork).map((p) => p.pluginId),
-		...plan.bins.filter((b) => b.action !== "current").map((b) => b.name),
-		...plan.skills.map((s) => s.name),
-	];
+	// Exactly the items the engine will touch. Derived by the engine from the
+	// same predicates its loops use, so the meter's denominator cannot drift
+	// from the work — a bar stuck short of full reads as a hang.
+	const workItems = planWorkItems(plan);
 
 	if (!planHasWork(plan) || workItems.length === 0) {
 		for (const line of summaryLine(
@@ -741,26 +484,14 @@ export async function runUpdateCommand(
 	console.log("");
 	applyLive.start((tick) => applyFrame(state, tick, Date.now()));
 
-	const pluginResult = await applyPlugins(
-		plan.plugins,
-		projectPath,
-		REAL_PLUGIN_DEPS,
-		reporter,
-	);
-	const binResult = await applyBins(plan, reporter);
-	const skillResult = await applySkills(plan, projectPath, reporter);
+	const outcome = await applyPlan(plan, projectPath, { report: reporter });
 
 	applyLive.stop();
 
-	const failed = [
-		...pluginResult.failed,
-		...binResult.failed,
-		...skillResult.failed,
-	];
-	const changed = pluginResult.ok + binResult.ok + skillResult.ok;
+	const { failed } = outcome;
 
 	for (const line of summaryLine(
-		changed,
+		outcome.changed,
 		counts.current,
 		counts.unknown,
 		failed.length,
@@ -773,13 +504,13 @@ export async function runUpdateCommand(
 	// of the manifest rather than something this run did wrong, and failing here
 	// would make `claudeup update` exit 1 forever for any profile with a pin.
 	// `install --check` with `strictVersions` is where pin drift is GATED.
-	if (pluginResult.mismatches.length > 0) {
+	if (outcome.plugins.mismatches.length > 0) {
 		console.log(
 			warnLine(
-				`${bold(String(pluginResult.mismatches.length))} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+				`${bold(String(outcome.plugins.mismatches.length))} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
 			),
 		);
-		for (const m of pluginResult.mismatches) {
+		for (const m of outcome.plugins.mismatches) {
 			console.log(
 				noteLine(
 					`${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,

package/src/data/cli-tools.ts

@@ -1,12 +1,30 @@
+import type { BinInstaller } from "../types/index.js";
+
+/**
+ * A CLI tool claudeup can install, check and update.
+ *
+ * There is deliberately NO `installCommand` field. Entries used to carry one
+ * alongside `packageManager` + `packageName`, which describe the same thing —
+ * so the two could disagree, and did: `aider` declared
+ * `packageName: "aider-chat"` while its `installCommand` installed
+ * `aider-install`, and the version check queried the former. The command is
+ * derived by `services/cli-tool-commands.ts` instead, which also means a
+ * catalogue entry can no longer smuggle shell syntax (that same entry's command
+ * was a `&&` chain) into something that gets executed.
+ */
 export interface CliTool {
 	name: string;
 	displayName: string;
 	description: string;
-	installCommand: string;
 	checkCommand: string;
 	website: string;
 	category: "ai-coding" | "utility";
-	packageManager: "bun" | "npm" | "pip" | "brew" | "go";
+	/**
+	 * Reuses `BinInstaller` rather than restating its members, so the
+	 * correspondence with the resolver in `services/toolchain.ts` — which is
+	 * what turns this field into an actual command — is a compile-time fact.
+	 */
+	packageManager: BinInstaller;
 	packageName: string;
 }
 
@@ -16,7 +34,6 @@ export const cliTools: CliTool[] = [
 		displayName: "claudeup",
 		description:
 			"TUI tool for managing Claude Code plugins, MCPs, and configuration",
-		installCommand: "bun install -g claudeup",
 		checkCommand: "claudeup --version",
 		website: "https://github.com/MadAppGang/magus/tree/main/tools/claudeup",
 		category: "ai-coding",
@@ -28,7 +45,6 @@ export const cliTools: CliTool[] = [
 		displayName: "Mnemex",
 		description:
 			"AST-aware code search with PageRank, callers/callees, and semantic embeddings",
-		installCommand: "bun install -g mnemex",
 		checkCommand: "mnemex --version",
 		website: "https://github.com/MadAppGang/mnemex",
 		category: "ai-coding",
@@ -39,7 +55,6 @@ export const cliTools: CliTool[] = [
 		name: "claudish",
 		displayName: "Claudish",
 		description: "Run Claude Code with OpenRouter models (Grok, GPT-5, Gemini)",
-		installCommand: "bun install -g claudish",
 		checkCommand: "claudish --version",
 		website: "https://github.com/MadAppGang/claudish",
 		category: "ai-coding",
@@ -50,7 +65,6 @@ export const cliTools: CliTool[] = [
 		name: "claude",
 		displayName: "Claude Code",
 		description: "Anthropic official agentic coding tool",
-		installCommand: "npm install -g @anthropic-ai/claude-code",
 		checkCommand: "claude --version",
 		website: "https://claude.ai/code",
 		category: "ai-coding",
@@ -62,7 +76,6 @@ export const cliTools: CliTool[] = [
 		displayName: "OpenAI Codex",
 		description:
 			"Lightweight coding agent from OpenAI that runs in your terminal",
-		installCommand: "npm install -g @openai/codex",
 		checkCommand: "codex --version",
 		website: "https://github.com/openai/codex",
 		category: "ai-coding",
@@ -73,7 +86,6 @@ export const cliTools: CliTool[] = [
 		name: "gemini",
 		displayName: "Gemini CLI",
 		description: "Google AI agent with 1M token context, free tier available",
-		installCommand: "npm install -g @google/gemini-cli",
 		checkCommand: "gemini --version",
 		website: "https://github.com/google-gemini/gemini-cli",
 		category: "ai-coding",
@@ -84,7 +96,6 @@ export const cliTools: CliTool[] = [
 		name: "qwen",
 		displayName: "Qwen Code",
 		description: "Alibaba coding agent optimized for Qwen3-Coder models",
-		installCommand: "npm install -g @qwen-code/qwen-code",
 		checkCommand: "qwen --version",
 		website: "https://github.com/QwenLM/qwen-code",
 		category: "ai-coding",
@@ -96,7 +107,6 @@ export const cliTools: CliTool[] = [
 		displayName: "Cline",
 		description:
 			"Autonomous coding agent with plan & act, checkpoints, browser use",
-		installCommand: "npm install -g cline",
 		checkCommand: "cline --version",
 		website: "https://cline.bot",
 		category: "ai-coding",
@@ -107,7 +117,6 @@ export const cliTools: CliTool[] = [
 		name: "opencode",
 		displayName: "OpenCode",
 		description: "Open source AI coding agent trusted by 400k+ developers",
-		installCommand: "npm install -g opencode-ai",
 		checkCommand: "opencode --version",
 		website: "https://opencode.ai",
 		category: "ai-coding",
@@ -118,7 +127,6 @@ export const cliTools: CliTool[] = [
 		name: "aider",
 		displayName: "Aider",
 		description: "AI pair programming - works with Claude, GPT-4, local models",
-		installCommand: "pip install aider-install && aider-install",
 		checkCommand: "aider --version",
 		website: "https://aider.chat",
 		category: "ai-coding",
@@ -129,7 +137,6 @@ export const cliTools: CliTool[] = [
 		name: "crush",
 		displayName: "Crush",
 		description: "AI coding assistant from Charm with terminal-native UX",
-		installCommand: "npm install -g @charmland/crush",
 		checkCommand: "crush --version",
 		website: "https://github.com/charmbracelet/crush",
 		category: "ai-coding",

package/src/services/cli-tool-commands.ts

@@ -0,0 +1,133 @@
+/**
+ * The three commands the CLI-tools screen can run against a catalogue entry:
+ * install, update, uninstall.
+ *
+ * A module rather than helpers inside the screen, for two reasons:
+ *
+ *  - **The duplicate.** Uninstall existed twice — once in `CliToolsScreen.tsx`
+ *    and once in `cliToolRenderers.tsx` (as `getUninstallHint`) — because the
+ *    renderer needs to SHOW it and the screen needs to RUN it. The two copies
+ *    had already drifted: one emitted `pip uninstall`, the other
+ *    `pip uninstall -y`. Both were wrong in the same way, which is the point —
+ *    a bug in a duplicated builder has to be found twice.
+ *  - **Testability.** As `.tsx` helpers these were unreachable from a suite that
+ *    cannot render React. As pure functions over data they are pinned by
+ *    `cli-tool-commands.test.ts`, which is what proves no arm emits a bare
+ *    `pip` — the defect that shipped.
+ *
+ * Import direction stays acyclic: renderer → service, screen → service +
+ * renderer.
+ */
+
+import type { CliTool } from "../data/cli-tools.js";
+import type { Command } from "../utils/command-utils.js";
+import {
+	binInstallCommand,
+	binUninstallCommand,
+	binUpgradeCommand,
+} from "./toolchain.js";
+
+/**
+ * How a tool turned out to be installed, as detected from its path on disk.
+ *
+ * NOT the same question as `CliTool.packageManager`, and deliberately not the
+ * same type. `packageManager` is how claudeup WOULD install the tool; this is
+ * how it IS installed — which may be neither, since a user can `pnpm add -g` or
+ * `yarn global add` something the catalogue calls an npm package. Updating has
+ * to follow what is actually on the machine, or it installs a second copy
+ * beside the first and the screen then reports a conflict it created itself.
+ *
+ * `pnpm`, `yarn` and `unknown` have no `BinInstaller` counterpart, which is why
+ * the two unions stay separate rather than one being widened into the other.
+ */
+export type InstallMethod =
+	| "npm"
+	| "bun"
+	| "pnpm"
+	| "yarn"
+	| "brew"
+	| "pip"
+	| "unknown";
+
+/**
+ * Install a catalogue tool, derived from the entry's own fields.
+ *
+ * Entries used to carry a literal `installCommand` string beside the
+ * `packageManager` and `packageName` that describe the same thing, so the two
+ * could disagree — and did. `aider` declared `packageName: "aider-chat"` and
+ * `checkCommand: "aider --version"`, and its `installCommand` installed
+ * `aider-install`: a bootstrapper whose version nothing in this screen ever
+ * looked at, while the version check queried `aider-chat`. Deriving makes that
+ * disagreement unrepresentable rather than merely fixed.
+ */
+export function cliToolInstall(tool: CliTool): Command {
+	return binInstallCommand({
+		name: tool.name,
+		via: tool.packageManager,
+		package: tool.packageName,
+	});
+}
+
+/**
+ * Update a tool, following the method it was ACTUALLY installed with.
+ *
+ * Returns null when there is nothing sound to run — an `unknown` method means
+ * the detector could not attribute the binary on PATH to any package manager,
+ * and guessing there would install a second copy alongside the one already
+ * there. Callers fall back to installing.
+ */
+export function cliToolUpdate(
+	tool: CliTool,
+	method: InstallMethod,
+	brewFormula?: string,
+): Command | null {
+	switch (method) {
+		// The three the resolver does not model. `pnpm`/`yarn` are not
+		// BinInstallers because claudeup never chooses them — it only finds them.
+		case "pnpm":
+			return { cmd: "pnpm", args: ["install", "-g", tool.packageName] };
+		case "yarn":
+			return { cmd: "yarn", args: ["global", "add", tool.packageName] };
+		case "unknown":
+			return null;
+		default:
+			// TS has narrowed to "npm" | "bun" | "brew" | "pip" here, which is
+			// assignable to BinInstaller — so the four real installers delegate,
+			// and `pip` in particular gets the uv/pipx/python3 resolution instead
+			// of the bare `pip` this switch used to fall through to.
+			return binUpgradeCommand({
+				name: tool.name,
+				via: method,
+				package: tool.packageName,
+				formula: brewFormula,
+			});
+	}
+}
+
+/**
+ * Remove a tool, following the method it was actually installed with.
+ *
+ * Null means "no command to offer": `unknown` for the reason above, and `go`
+ * because a `go install` binary has no uninstaller to call.
+ */
+export function cliToolUninstall(
+	tool: CliTool,
+	method: InstallMethod,
+	brewFormula?: string,
+): Command | null {
+	switch (method) {
+		case "pnpm":
+			return { cmd: "pnpm", args: ["remove", "-g", tool.packageName] };
+		case "yarn":
+			return { cmd: "yarn", args: ["global", "remove", tool.packageName] };
+		case "unknown":
+			return null;
+		default:
+			return binUninstallCommand({
+				name: tool.name,
+				via: method,
+				package: tool.packageName,
+				formula: brewFormula,
+			});
+	}
+}

package/src/services/doctor-bins.ts

@@ -8,13 +8,19 @@
  */
 
 import type { ResolvedBin } from "../types/index.js";
-import { resolveExecutable } from "../utils/command-utils.js";
+import { formatCommand, resolveExecutable } from "../utils/command-utils.js";
 import { binInstallCommand } from "./toolchain.js";
 
 export interface BinCheckResult {
 	name: string;
 	present: boolean;
-	/** The command that would install it, shown when missing. */
+	/**
+	 * The command that would install it, shown when missing.
+	 *
+	 * A rendered string, not a {@link Command}: this is advisory text printed
+	 * after "run:" for a human to copy. Nothing executes it — doctor diagnoses
+	 * and never installs — so there is nothing here for a shell to re-parse.
+	 */
 	installCommand: string;
 	/** Where the requirement came from (profile cliTools / plugin ids). */
 	sources: string[];
@@ -44,7 +50,7 @@ export async function checkBinaries(
 		results.push({
 			name: bin.name,
 			present: await isPresent(bin.name),
-			installCommand: binInstallCommand(bin),
+			installCommand: formatCommand(binInstallCommand(bin)),
 			sources: bin.sources,
 		});
 	}