claudeup 6.0.0 → 6.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "6.0.0",
+  "version": "6.2.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "6.0.0",
-    "claudeup-darwin-x64": "6.0.0",
-    "claudeup-linux-x64": "6.0.0"
+    "claudeup-darwin-arm64": "6.2.0",
+    "claudeup-darwin-x64": "6.2.0",
+    "claudeup-linux-x64": "6.2.0"
   }
 }

package/scripts/test-isolated.ts

@@ -19,7 +19,13 @@ function findTests(dir: string): string[] {
 	for (const entry of readdirSync(dir)) {
 		const p = join(dir, entry);
 		if (statSync(p).isDirectory()) out.push(...findTests(p));
-		else if (p.endsWith(".test.ts")) out.push(p);
+		// `.tsx` as well as `.ts`. The suffix was written when no `.tsx` test
+		// existed, so it silently excluded the only file testing a UI primitive
+		// — the class of test most likely to be `.tsx` and least likely to be
+		// noticed missing, because a file that is never collected reports
+		// nothing at all. The printed `N/N` count below is the guard: it moves
+		// when collection changes.
+		else if (/\.test\.tsx?$/.test(p)) out.push(p);
 	}
 	return out;
 }

package/src/__tests__/catalog-cache-store.test.ts

@@ -152,19 +152,57 @@ describe("rate-limit cooldown — survives a relaunch", () => {
     base = Date.now();
   });
 
-  /** Let a write-behind cooldown reach disk. */
-  const flush = () => new Promise((r) => setTimeout(r, 80));
-
-  // Only this block triggers write-behind, so only this block pays for draining
-  // it. Held here rather than in the outer afterEach so the catalog tests — which
-  // await every write — are not each charged the delay too.
-  afterEach(flush);
+  /**
+   * Wait until a write-behind cooldown has actually reached disk.
+   *
+   * This used to be `setTimeout(80)` — a guess at how long an unawaited write
+   * takes, which is not a synchronisation point. `recordRateLimit` persists
+   * fire-and-forget by design (`github-budget.ts` explains why), so on a loaded
+   * runner the write had not landed when the next `hydrateGitHubBudget()` read,
+   * and the restored strike count came back low. That failed CI as
+   * `Expected: 3, Received: 2` on Linux while passing 15/15 on a quiet macOS
+   * laptop — the signature of a timing guess, not of a real defect.
+   *
+   * Polling the store itself removes the guess: it returns as soon as the value
+   * is observable, and only gives up after a deadline no healthy machine
+   * reaches. `expected` is the strike count the caller just recorded; passing
+   * nothing waits for any persisted entry at all.
+   */
+  const flush = async (
+    host: string,
+    expected?: number,
+  ): Promise<void> => {
+    const deadline = Date.now() + 5000;
+    for (;;) {
+      // `base` keeps the read on the same clock the writes used: cooldowns are
+      // dropped on read once expired, so reading with a later `now` could hide
+      // an entry that is genuinely there.
+      const stored = (await readStoredCooldowns(base))[host];
+      if (stored && (expected === undefined || stored.strikes >= expected)) {
+        return;
+      }
+      if (Date.now() > deadline) {
+        throw new Error(
+          `cooldown for ${host} never reached disk (wanted strikes >= ${expected ?? "any"}, got ${stored?.strikes ?? "nothing"})`,
+        );
+      }
+      await new Promise((r) => setTimeout(r, 10));
+    }
+  };
+
+  // Teardown hygiene, NOT a synchronisation point — which is why it is a plain
+  // sleep and `flush` is not. Its only job is to let an in-flight write land
+  // before the temp config dir is removed; a write that arrives afterwards
+  // recreates a file in a deleted directory and harms nothing. Polling for a
+  // specific host here would be wrong: several tests in this block end with
+  // nothing on disk on purpose.
+  afterEach(() => new Promise((r) => setTimeout(r, 50)));
 
   it("is still in force in the next process", async () => {
     // THE defect this store exists to fix. Without persistence, launch two fired
     // six more doomed requests at a host it had already been refused by.
     recordRateLimit("raw.githubusercontent.com", new Headers(), base);
-    await flush();
+    await flush("raw.githubusercontent.com");
 
     resetGitHubBudget();
     resetCatalogCacheMemo();
@@ -185,7 +223,7 @@ describe("rate-limit cooldown — survives a relaunch", () => {
     // requests, learns it is limited once, and exits.
     const first = recordRateLimit("raw.githubusercontent.com", undefined, base);
     expect(first.strikes).toBe(1);
-    await flush();
+    await flush("raw.githubusercontent.com", 1);
 
     resetGitHubBudget();
     resetCatalogCacheMemo();
@@ -194,7 +232,7 @@ describe("rate-limit cooldown — survives a relaunch", () => {
     const second = recordRateLimit("raw.githubusercontent.com", undefined, base);
     expect(second.strikes).toBe(2);
     expect(second.until).toBeGreaterThan(first.until);
-    await flush();
+    await flush("raw.githubusercontent.com", 2);
 
     resetGitHubBudget();
     resetCatalogCacheMemo();
@@ -213,7 +251,7 @@ describe("rate-limit cooldown — survives a relaunch", () => {
       new Headers({ "retry-after": "600" }),
       base,
     );
-    await flush();
+    await flush("api.github.com");
 
     resetGitHubBudget();
     await hydrateGitHubBudget();

package/src/__tests__/cli-apply-seams.test.ts

@@ -15,9 +15,10 @@ import {
 	type ApplyReporter,
 	type PluginApplyDeps,
 	applyPlugins,
-	parseArgs,
 	pluginNeedsWork,
-} from "../cli/update.js";
+	installPluginInScope,
+} from "../services/update-engine.js";
+import { parseArgs } from "../cli/update.js";
 import { checkBinaries } from "../services/doctor-bins.js";
 import type { PluginScope } from "../services/claude-cli.js";
 import type { PluginUpdateItem } from "../services/update-plan.js";
@@ -40,6 +41,7 @@ function item(over: Partial<PluginUpdateItem> = {}): PluginUpdateItem {
 
 function deps(): PluginApplyDeps {
 	return {
+		install: mock(async () => {}),
 		update: mock(async () => {}),
 		repair: mock(async () => {}),
 		readInstalled: mock(async () => "2.0.0"),
@@ -174,6 +176,53 @@ describe("flags", () => {
 	});
 });
 
+describe("installPluginInScope — the scope-targeted path", () => {
+	test("records the version READ BACK, not the one expected", async () => {
+		// This is the bug the TUI's per-scope menu carried after the CLI had
+		// fixed it: it wrote the version it *expected*, so `install --check`
+		// compared a pin against a copy of itself and reported clean forever.
+		const d = deps();
+		d.readInstalled = mock(async () => "9.9.9");
+		const saved: unknown[] = [];
+		d.saveInstalled = mock(async (id, version, scope) => {
+			saved.push({ id, version, scope });
+		});
+
+		const actual = await installPluginInScope("dev@magus", "user", PROJECT, d);
+
+		expect(actual).toBe("9.9.9");
+		expect(saved).toEqual([
+			{ id: "dev@magus", version: "9.9.9", scope: "user" },
+		]);
+	});
+
+	test("honours the caller's scope rather than fanning out", async () => {
+		// The whole reason this exists beside applyPlugins: the user picked a
+		// scope from a menu, so "every scope that is behind" would override them.
+		const d = deps();
+		const installed: Array<[string, string]> = [];
+		d.install = mock(async (id, scope) => {
+			installed.push([id, scope]);
+		});
+
+		await installPluginInScope("dev@magus", "local", PROJECT, d);
+
+		expect(installed).toEqual([["dev@magus", "local"]]);
+	});
+
+	test("an unreadable version is reported, never guessed", async () => {
+		const d = deps();
+		d.readInstalled = mock(async () => null);
+		const saved: unknown[] = [];
+		d.saveInstalled = mock(async () => {
+			saved.push(1);
+		});
+
+		expect(await installPluginInScope("x", "user", PROJECT, d)).toBeNull();
+		expect(saved).toEqual([]);
+	});
+});
+
 describe("checkBinaries onProbe", () => {
 	const bins: ResolvedBin[] = [
 		{ name: "tmux", via: "brew", sources: [] } as unknown as ResolvedBin,

package/src/__tests__/cli-tool-commands.test.ts

@@ -0,0 +1,239 @@
+/**
+ * The CLI-tools catalogue can no longer emit a bare `pip`, or shell syntax.
+ *
+ * Two defects lived in this screen, and both were data problems dressed as code
+ * problems:
+ *
+ *  1. **Bare `pip`.** `getUpdateCommand`'s `pip` and `default` arms returned the
+ *     catalogue's `installCommand` verbatim, and `getUninstallCommand` emitted
+ *     `pip uninstall -y`. `pip` is frequently a zsh alias rather than an
+ *     executable, and a machine that manages Python tools with uv or pipx may
+ *     have no `pip` at all. `services/toolchain.ts` already knew how to answer
+ *     "how does Python work here"; this screen was not asking it.
+ *  2. **Shell syntax in data.** `aider`'s entry was
+ *     `pip install aider-install && aider-install` — a `&&` chain in a catalogue
+ *     field that got handed to `/bin/bash`.
+ *
+ * Both are now unrepresentable: the field is gone and the command is derived.
+ * These tests assert that over the whole catalogue rather than over an example,
+ * so a new entry cannot reintroduce either.
+ *
+ * Pure — no React, no network, no PATH dependency. Every Python installer is
+ * pinned explicitly, per the convention `toolchain.test.ts` established: the
+ * production default is resolved from PATH, so an unpinned assertion would
+ * encode whatever happens to be installed on the machine running the suite.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { cliTools } from "../data/cli-tools.js";
+import {
+	type InstallMethod,
+	cliToolInstall,
+	cliToolUninstall,
+	cliToolUpdate,
+} from "../services/cli-tool-commands.js";
+import {
+	PYTHON_CLI_INSTALLERS,
+	type PythonCliInstaller,
+	resolvePythonCliInstaller,
+} from "../services/toolchain.js";
+import { versionFromPypiJson } from "../ui/screens/CliToolsScreen.js";
+import { type Command, formatCommand } from "../utils/command-utils.js";
+
+const byProbe = (probe: string): PythonCliInstaller => {
+	const found = PYTHON_CLI_INSTALLERS.find((i) => i.probe === probe);
+	if (!found) throw new Error(`no python installer with probe ${probe}`);
+	return found;
+};
+const PYTHON_PROBES = PYTHON_CLI_INSTALLERS.map((i) => i.probe);
+
+/** The methods the resolver models, i.e. the ones that reach toolchain.ts. */
+const RESOLVED_METHODS: InstallMethod[] = ["npm", "bun", "brew", "pip"];
+
+describe("the catalogue is well-formed", () => {
+	test("it has entries, and each names a package manager and a package", () => {
+		// Guard: every assertion below iterates the catalogue, so an empty or
+		// malformed one would make them all pass vacuously.
+		expect(cliTools.length).toBeGreaterThan(5);
+		for (const tool of cliTools) {
+			expect(typeof tool.packageName).toBe("string");
+			expect(tool.packageName.length).toBeGreaterThan(0);
+			expect(["bun", "npm", "pip", "brew", "go"]).toContain(
+				tool.packageManager,
+			);
+		}
+	});
+});
+
+describe("no builder ever emits a bare `pip`", () => {
+	test("install: cmd is the resolver's probe, never `pip`", () => {
+		for (const tool of cliTools) {
+			const cmd = cliToolInstall(tool);
+			expect(cmd.cmd).not.toBe("pip");
+			if (tool.packageManager === "pip") {
+				// Whatever the machine running this resolved to, it must be one of
+				// the three modelled installers — and `cmd` must BE that probe,
+				// since that is the executable the syscall looks up.
+				expect(PYTHON_PROBES).toContain(cmd.cmd);
+				expect(cmd.cmd).toBe(resolvePythonCliInstaller().probe);
+			}
+		}
+	});
+
+	test("update and uninstall: cmd is never `pip`, for any method", () => {
+		for (const tool of cliTools) {
+			for (const method of RESOLVED_METHODS) {
+				for (const cmd of [
+					cliToolUpdate(tool, method),
+					cliToolUninstall(tool, method),
+				]) {
+					if (!cmd) continue;
+					expect(cmd.cmd).not.toBe("pip");
+				}
+			}
+		}
+	});
+
+	test("each pinned Python installer drives all three of its own commands", () => {
+		// Pinned explicitly so this holds on a runner with no uv. The `pip`
+		// method must route to the SAME executable for install, update and
+		// uninstall — installing with uv and uninstalling with python3 would look
+		// like it worked and leave the tool on disk.
+		for (const probe of PYTHON_PROBES) {
+			const python = byProbe(probe);
+			expect(python.install("x").cmd).toBe(probe);
+			expect(python.upgrade("x").cmd).toBe(probe);
+			expect(python.uninstall("x").cmd).toBe(probe);
+		}
+	});
+});
+
+describe("no builder can emit shell syntax", () => {
+	test("no argv element of any command contains &&, | or ;", () => {
+		// The catalogue's only `&&` chain was aider's installCommand. With the
+		// field gone there is nowhere left for shell syntax to enter, and this
+		// asserts that over every entry and every method rather than over that
+		// one case.
+		const all: Command[] = [];
+		for (const tool of cliTools) {
+			all.push(cliToolInstall(tool));
+			for (const method of [
+				...RESOLVED_METHODS,
+				"pnpm" as const,
+				"yarn" as const,
+			]) {
+				const u = cliToolUpdate(tool, method);
+				const r = cliToolUninstall(tool, method);
+				if (u) all.push(u);
+				if (r) all.push(r);
+			}
+		}
+		expect(all.length).toBeGreaterThan(0);
+
+		for (const cmd of all) {
+			for (const token of [cmd.cmd, ...cmd.args]) {
+				expect(token).not.toContain("&&");
+				expect(token).not.toContain("|");
+				expect(token).not.toContain(";");
+			}
+		}
+	});
+});
+
+describe("the detected method is followed, not the catalogue's", () => {
+	test("pnpm and yarn keep their own shapes", () => {
+		// A tool the catalogue calls npm can still have been installed with
+		// pnpm. Updating it as npm would install a second copy beside the first,
+		// which is the conflict this screen exists to report.
+		const tool = cliTools.find((t) => t.packageManager === "npm")!;
+		expect(cliToolUpdate(tool, "pnpm")).toEqual({
+			cmd: "pnpm",
+			args: ["install", "-g", tool.packageName],
+		});
+		expect(cliToolUpdate(tool, "yarn")).toEqual({
+			cmd: "yarn",
+			args: ["global", "add", tool.packageName],
+		});
+		expect(cliToolUninstall(tool, "pnpm")).toEqual({
+			cmd: "pnpm",
+			args: ["remove", "-g", tool.packageName],
+		});
+		expect(cliToolUninstall(tool, "yarn")).toEqual({
+			cmd: "yarn",
+			args: ["global", "remove", tool.packageName],
+		});
+	});
+
+	test("`unknown` returns null rather than guessing", () => {
+		// Preserves the observable behaviour: handleInstall reads
+		// `installed && updateCommand ? updateCommand : install…`, so null falls
+		// back to a plain install — which is what the old `default:` arm did by
+		// returning `tool.installCommand`.
+		const tool = cliTools[0]!;
+		expect(cliToolUpdate(tool, "unknown")).toBeNull();
+		expect(cliToolUninstall(tool, "unknown")).toBeNull();
+	});
+
+	test("brew and go arms are pinned, since no catalogue entry exercises them", () => {
+		// Every entry today is bun/npm/pip, so these two ship untouched by real
+		// data. `go` has no uninstaller — `go install` writes a binary and
+		// records nothing — so null is correct rather than an invented `rm`.
+		const tool = cliTools[0]!;
+		expect(cliToolUpdate(tool, "brew", "some-formula")).toEqual({
+			cmd: "brew",
+			args: ["upgrade", "some-formula"],
+		});
+		expect(cliToolUninstall(tool, "brew", "some-formula")).toEqual({
+			cmd: "brew",
+			args: ["uninstall", "some-formula"],
+		});
+	});
+});
+
+describe("derived commands still read as they did", () => {
+	test("claude renders exactly the literal the catalogue used to carry", () => {
+		// The entry whose command SHOULD not change. Its old
+		// `installCommand: "npm install -g @anthropic-ai/claude-code"` is now
+		// derived from packageManager + packageName, and must render identically.
+		const claude = cliTools.find((t) => t.name === "claude")!;
+		expect(formatCommand(cliToolInstall(claude))).toBe(
+			"npm install -g @anthropic-ai/claude-code",
+		);
+	});
+
+	test("aider now installs the package its own fields already named", () => {
+		// The one deliberate behaviour change. The old command installed
+		// `aider-install`, a bootstrapper whose version nothing here ever read,
+		// while `packageName`, `checkCommand` and the PyPI query all said
+		// `aider-chat`. The installCommand was the field that was out of step.
+		const aider = cliTools.find((t) => t.name === "aider")!;
+		expect(aider.packageName).toBe("aider-chat");
+		expect(cliToolInstall(aider).args).toContain("aider-chat");
+		expect(formatCommand(cliToolInstall(aider))).not.toContain("aider-install");
+	});
+});
+
+describe("versionFromPypiJson", () => {
+	// The shape of a real https://pypi.org/pypi/<pkg>/json body, trimmed to the
+	// two fields that matter. Captured rather than mocked so the parser is
+	// tested against what the endpoint actually returns.
+	const body = {
+		info: { name: "aider-chat", version: "0.86.1" },
+		releases: {},
+	};
+
+	test("reads info.version", () => {
+		expect(versionFromPypiJson(body)).toBe("0.86.1");
+	});
+
+	test("anything unexpected yields undefined, never a throw", () => {
+		// A version check is advisory: it must degrade to "no update badge",
+		// never take the screen down. PyPI returning an error object, a 404 body,
+		// or nothing at all all land here.
+		expect(versionFromPypiJson({})).toBeUndefined();
+		expect(versionFromPypiJson({ info: {} })).toBeUndefined();
+		expect(versionFromPypiJson({ info: { version: 42 } })).toBeUndefined();
+		expect(versionFromPypiJson(null)).toBeUndefined();
+		expect(versionFromPypiJson("not json at all")).toBeUndefined();
+	});
+});

package/src/__tests__/format-command.test.ts

@@ -0,0 +1,78 @@
+/**
+ * `formatCommand` renders a Command for a human, and must not lie.
+ *
+ * Two properties, and they pull in opposite directions:
+ *
+ *  1. **Display neutrality.** Every token claudeup actually builds is
+ *     shell-safe, so the rendered line must be byte-identical to the string
+ *     these builders produced before commands became argv. That is what lets
+ *     item 3 land without touching `install`/`doctor` output.
+ *     `doctor-bins.test.ts` is the end-to-end gate on that; these are the unit.
+ *  2. **A dangerous token must LOOK dangerous.** If a package name ever did
+ *     contain shell syntax, printing it bare would show the reader a command
+ *     that does something other than what runs. Quoting it makes the
+ *     one-token-ness visible.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { type Command, formatCommand } from "../utils/command-utils.js";
+
+const c = (cmd: string, ...args: string[]): Command => ({ cmd, args });
+
+describe("formatCommand — display neutrality", () => {
+	test("every token this codebase really builds renders unquoted", () => {
+		// Sampled from the actual builders: npm scopes, version pins in both
+		// syntaxes, go module paths, long flags. If quoting ever fires for one of
+		// these, some install/doctor output changed.
+		expect(formatCommand(c("bun", "install", "-g", "claudish@1.2.0"))).toBe(
+			"bun install -g claudish@1.2.0",
+		);
+		expect(
+			formatCommand(c("npm", "install", "-g", "@anthropic-ai/claude-code")),
+		).toBe("npm install -g @anthropic-ai/claude-code");
+		expect(formatCommand(c("uv", "tool", "install", "aider==0.1"))).toBe(
+			"uv tool install aider==0.1",
+		);
+		expect(formatCommand(c("go", "install", "github.com/x/t@latest"))).toBe(
+			"go install github.com/x/t@latest",
+		);
+		expect(
+			formatCommand(
+				c("python3", "-m", "pip", "install", "--user", "--upgrade", "aider"),
+			),
+		).toBe("python3 -m pip install --user --upgrade aider");
+		expect(formatCommand(c("brew", "install", "tmux"))).toBe(
+			"brew install tmux",
+		);
+	});
+
+	test("a command with no arguments renders as just the executable", () => {
+		expect(formatCommand(c("brew"))).toBe("brew");
+	});
+});
+
+describe("formatCommand — a dangerous token is made visible", () => {
+	test("shell metacharacters are single-quoted", () => {
+		expect(formatCommand(c("bun", "install", "-g", "a b; rm -rf /"))).toBe(
+			"bun install -g 'a b; rm -rf /'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "$(id)"))).toBe(
+			"bun install -g '$(id)'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "a|b"))).toBe(
+			"bun install -g 'a|b'",
+		);
+	});
+
+	test("an embedded single quote closes, escapes and reopens", () => {
+		// `'\''` is the only POSIX-portable way: a single-quoted string has no
+		// escape character at all, so the quote must be left and re-entered.
+		expect(formatCommand(c("x", "it's"))).toBe(`x 'it'\\''s'`);
+	});
+
+	test("an empty argument is quoted so it does not vanish", () => {
+		// Unquoted it would render as nothing, and the reader would be shown a
+		// command with fewer arguments than the one that runs.
+		expect(formatCommand(c("x", "", "y"))).toBe("x '' y");
+	});
+});

package/src/__tests__/plugin-cli-argv.test.ts

@@ -0,0 +1,109 @@
+/**
+ * What `claude` subcommand does each plugin operation actually run?
+ *
+ * This file exists because the answer was wrong for a long time and nothing
+ * could see it. `updatePlugin` ran `claude plugin install`, on a comment that
+ * asserted install "handles both fresh installs and re-installs (upgrades)".
+ * It does not. Measured against Claude Code 2.1.252, with designer@magus
+ * installed at 0.6.0 and 0.6.1 published:
+ *
+ *     $ claude plugin install designer@magus --scope project
+ *     ✔ Plugin "designer@magus" is already installed (scope: project)   # exit 0
+ *
+ *     $ claude plugin update designer@magus --scope project
+ *     ✔ Plugin "designer" updated from 0.6.0 to 0.6.1 for scope project # exit 0
+ *
+ * Both exit 0. The no-op is indistinguishable from success at every layer
+ * above, so every claudeup update path — the TUI's `U`, "update all", the
+ * scope menu, `claudeup update`, the prerunner's auto-update — reported
+ * success and changed nothing, for ever.
+ *
+ * Mocking the CLI cannot catch that: a stub answers whatever the test asks it
+ * to. Only the argv is checkable here, so the argv is what these assert, with a
+ * real `claude` shim on PATH recording what it was called with.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+	chmodSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	rmSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import {
+	installPlugin,
+	repairPlugin,
+	updatePlugin,
+} from "../services/claude-cli.js";
+
+let root: string;
+let logFile: string;
+let savedPath: string | undefined;
+
+beforeEach(() => {
+	root = mkdtempSync(path.join(tmpdir(), "claude-argv-"));
+	const bin = path.join(root, "bin");
+	mkdirSync(bin);
+	logFile = path.join(root, "argv.log");
+
+	// A real executable, so this goes through which(1), execFile and the whole
+	// wrapper rather than a module double.
+	const shim = path.join(bin, "claude");
+	writeFileSync(shim, `#!/bin/sh\necho "$@" >> "${logFile}"\nexit 0\n`);
+	chmodSync(shim, 0o755);
+
+	savedPath = process.env.PATH;
+	// The shim dir goes FIRST so it shadows a real claude, but the system dirs
+	// stay: `getClaudePath` resolves through which(1), which lives in /usr/bin.
+	process.env.PATH = [bin, "/usr/bin", "/bin"].join(path.delimiter);
+});
+
+afterEach(() => {
+	process.env.PATH = savedPath ?? "";
+	rmSync(root, { recursive: true, force: true });
+});
+
+/** Every argv the shim saw, one line per invocation. */
+function calls(): string[] {
+	try {
+		return readFileSync(logFile, "utf8").trim().split("\n").filter(Boolean);
+	} catch {
+		return [];
+	}
+}
+
+describe("which claude subcommand each operation runs", () => {
+	test("updatePlugin runs `plugin update` — NOT `plugin install`", async () => {
+		await updatePlugin("designer@magus", "project");
+		expect(calls()).toEqual(["plugin update designer@magus --scope project"]);
+	});
+
+	test("installPlugin runs `plugin install`", async () => {
+		await installPlugin("designer@magus", "project");
+		expect(calls()).toEqual(["plugin install designer@magus --scope project"]);
+	});
+
+	test("repairPlugin uninstalls then installs, in that order", async () => {
+		// Content drift under an unchanged version: `update` has no version bump
+		// to act on and `install` answers "already installed", so only the
+		// uninstall+install pair re-copies the files.
+		await repairPlugin("designer@magus", "project", root);
+		expect(calls()).toEqual([
+			"plugin uninstall designer@magus --scope project",
+			"plugin install designer@magus --scope project",
+		]);
+	});
+
+	test("the scope reaches the CLI verbatim, at every scope", async () => {
+		await updatePlugin("dev@magus", "user");
+		await updatePlugin("dev@magus", "local");
+		expect(calls()).toEqual([
+			"plugin update dev@magus --scope user",
+			"plugin update dev@magus --scope local",
+		]);
+	});
+});