claudeup 6.0.0 → 6.2.0

package/src/cli/update.ts

@@ -34,13 +34,7 @@
  * `cli/update-view.ts` owns every string. Nothing in this file formats.
  */
 
-import path from "node:path";
-import type { PluginScope } from "../services/claude-cli.js";
-import {
-	isClaudeAvailable,
-	repairPlugin,
-	updatePlugin,
-} from "../services/claude-cli.js";
+import { isClaudeAvailable } from "../services/claude-cli.js";
 import { clearContentDriftCache } from "../services/content-drift.js";
 import { checkBinaries } from "../services/doctor-bins.js";
 import { validateManifest } from "../services/manifest.js";
@@ -50,16 +44,18 @@ import {
 	type PluginInfo,
 	clearMarketplaceCache,
 	getAvailablePlugins,
-	readInstalledVersionForScope,
-	saveInstalledPluginVersionForScope,
 } from "../services/plugin-manager.js";
 import { resolveProfile } from "../services/resolver.js";
-import { installSkill } from "../services/skills-manager.js";
 import { getInstalledSkillNames } from "../services/skills-manager.js";
 import { activeProfile } from "../services/symlink-manager.js";
-import { binInstallCommand, binUpgradeCommand } from "../services/toolchain.js";
+// The apply half lives in services/ so the TUI runs the SAME code — see the
+// header of update-engine.ts for what drifted while it did not.
+import {
+	type ApplyReporter,
+	applyPlan,
+	planWorkItems,
+} from "../services/update-engine.js";
 import {
-	type PluginUpdateItem,
 	type UpdatePlan,
 	planBinUpdates,
 	planHasWork,
@@ -68,12 +64,10 @@ import {
 	planSkillUpdates,
 	summarizePlan,
 } from "../services/update-plan.js";
-import type { ProfileSkillRef, SkillInfo } from "../types/index.js";
 import { brand } from "../ui/theme.js";
 import { bold, dim, fg, width } from "./ansi.js";
 import { ensureManifest } from "./bootstrap.js";
 import { LiveRegion, withPaused } from "./live.js";
-import { runShell } from "./prompt.js";
 import {
 	type ApplyState,
 	type Step,
@@ -114,253 +108,6 @@ export function parseArgs(args: string[]): UpdateFlags {
 	};
 }
 
-// -- apply -------------------------------------------------------------------
-
-/** Map a manifest skill ref to the SkillInfo shape installSkill expects. */
-function toSkillInfo(ref: ProfileSkillRef): SkillInfo {
-	return {
-		id: `${ref.repo}/${ref.path}`,
-		name: ref.name,
-		source: {
-			label: ref.repo,
-			repo: ref.repo,
-			skillsPath: path.dirname(ref.path),
-		},
-		repoPath: ref.path,
-		gitBlobSha: "",
-		frontmatter: null,
-		installed: false,
-		installedScope: null,
-		hasUpdate: false,
-	};
-}
-
-interface ApplyResult {
-	ok: number;
-	failed: string[];
-}
-
-/** An exact pin the installer could not deliver, discovered by reading back. */
-export interface PinMismatch {
-	pluginId: string;
-	pinned: string;
-	actual: string | null;
-	scope: PluginScope;
-}
-
-export interface PluginApplyResult extends ApplyResult {
-	mismatches: PinMismatch[];
-}
-
-/**
- * How the apply loop reports itself.
- *
- * Injected rather than hard-coded, because the loop is the same work whether it
- * is driving an animated meter, printing plain lines into a pipe, or running
- * under a test that wants silence. The default prints one line per item, which
- * is what every non-interactive caller wants.
- */
-export interface ApplyReporter {
-	/** An item is starting. Called before any of its work. */
-	begin(name: string): void;
-	/** An item finished. `detail` is already formatted for display. */
-	finish(ok: boolean, name: string, detail: string, ms: number): void;
-	/**
-	 * Run `work` with the terminal released.
-	 *
-	 * A binary upgrade spawns `brew`/`npm` with inherited stdio: it writes and
-	 * moves the cursor itself, so any animated block must be erased first or the
-	 * two interleave into garbage.
-	 */
-	detach<T>(work: () => Promise<T>): Promise<T>;
-}
-
-const PLAIN_REPORTER: ApplyReporter = {
-	begin: () => {},
-	finish: (ok, name, detail) => {
-		const line = `${ok ? "✓" : "⚠"} ${name}${detail ? `  ${detail}` : ""}`;
-		if (ok) console.log(line);
-		else console.warn(line);
-	},
-	detach: (work) => work(),
-};
-
-/**
- * The four side-effecting calls the plugin apply path makes, injectable so the
- * path itself can be tested.
- *
- * This exists because the apply half shipped with no coverage while the pure
- * planner had forty tests — and every real defect found in review lived here,
- * not there. Following the same shape `checkBinaries` and `resolveProfile`
- * already use for their impure edges.
- */
-export interface PluginApplyDeps {
-	update: (pluginId: string, scope: PluginScope) => Promise<void>;
-	repair: (
-		pluginId: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<void>;
-	readInstalled: (
-		pluginId: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<string | null>;
-	saveInstalled: (
-		pluginId: string,
-		version: string,
-		scope: PluginScope,
-		projectPath: string,
-	) => Promise<void>;
-}
-
-const REAL_PLUGIN_DEPS: PluginApplyDeps = {
-	update: updatePlugin,
-	repair: repairPlugin,
-	readInstalled: readInstalledVersionForScope,
-	saveInstalled: saveInstalledPluginVersionForScope,
-};
-
-/**
- * Scopes the apply loop would touch for `item`. Empty means it is skipped.
- *
- * A plugin the profile declares but nothing has installed goes in at PROJECT
- * scope, matching `install`: a profile is a property of one repo, so its
- * plugins must not be enabled machine-wide.
- */
-function scopesToApply(item: PluginUpdateItem): PluginScope[] {
-	if (item.action === "current" || item.action === "unknown") return [];
-	return item.action === "install" ? ["project"] : item.scopes;
-}
-
-/**
- * Whether the apply loop will do anything for `item`.
- *
- * Exported shape for ONE reason: the progress meter's denominator must be the
- * same predicate the loop actually applies. It was previously re-derived at the
- * call site and replicated only the first of the two skips — an actionable item
- * with empty `scopes` was counted but never run, so the bar would stop short of
- * full and sit there looking hung at the end of a successful update.
- */
-export function pluginNeedsWork(item: PluginUpdateItem): boolean {
-	return scopesToApply(item).length > 0;
-}
-
-export async function applyPlugins(
-	items: PluginUpdateItem[],
-	projectPath: string,
-	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
-	report: ApplyReporter = PLAIN_REPORTER,
-): Promise<PluginApplyResult> {
-	const result: PluginApplyResult = { ok: 0, failed: [], mismatches: [] };
-
-	for (const item of items) {
-		const scopes = scopesToApply(item);
-		if (scopes.length === 0) continue;
-
-		report.begin(item.pluginId);
-		const startedAt = Date.now();
-
-		try {
-			for (const scope of scopes) {
-				if (item.action === "repair") {
-					await deps.repair(item.pluginId, scope, projectPath);
-				} else {
-					await deps.update(item.pluginId, scope);
-				}
-
-				// Record what LANDED, not what we asked for.
-				//
-				// `claude plugin install` accepts no version, so an exact pin is a
-				// request the installer cannot honour — it fetches whatever the
-				// marketplace publishes now. Writing `item.target` here recorded the
-				// pin as satisfied whatever actually installed, and `install --check`
-				// reads that same field to decide whether the machine has drifted.
-				// The gate would have compared the pin against a copy of itself and
-				// reported clean forever.
-				const actual = await deps.readInstalled(
-					item.pluginId,
-					scope,
-					projectPath,
-				);
-				if (actual) {
-					await deps.saveInstalled(item.pluginId, actual, scope, projectPath);
-				}
-				if (item.pinned !== "latest" && actual !== item.pinned) {
-					result.mismatches.push({
-						pluginId: item.pluginId,
-						pinned: item.pinned,
-						actual,
-						scope,
-					});
-				}
-			}
-			report.finish(
-				true,
-				item.pluginId,
-				`${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`,
-				Date.now() - startedAt,
-			);
-			result.ok++;
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			report.finish(false, item.pluginId, msg, Date.now() - startedAt);
-			result.failed.push(item.pluginId);
-		}
-	}
-
-	return result;
-}
-
-async function applyBins(
-	plan: UpdatePlan,
-	report: ApplyReporter = PLAIN_REPORTER,
-): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
-	for (const item of plan.bins) {
-		if (item.action === "current") continue;
-		const bin = plan.binSpecs.get(item.name);
-		if (!bin) continue;
-		const cmd =
-			item.action === "install"
-				? binInstallCommand(bin)
-				: binUpgradeCommand(bin);
-		report.begin(item.name);
-		const startedAt = Date.now();
-		// The installer owns the terminal for the duration: it streams its own
-		// output through inherited stdio.
-		const succeeded = await report.detach(async () => {
-			console.log(`\n$ ${cmd}`);
-			return runShell(cmd);
-		});
-		report.finish(succeeded, item.name, cmd, Date.now() - startedAt);
-		if (succeeded) result.ok++;
-		else result.failed.push(item.name);
-	}
-	return result;
-}
-
-async function applySkills(
-	plan: UpdatePlan,
-	projectPath: string,
-	report: ApplyReporter = PLAIN_REPORTER,
-): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
-	for (const item of plan.skills) {
-		report.begin(item.name);
-		const startedAt = Date.now();
-		try {
-			await installSkill(toSkillInfo(item.ref), "project", projectPath);
-			report.finish(true, item.name, item.ref.repo, Date.now() - startedAt);
-			result.ok++;
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			report.finish(false, item.name, msg, Date.now() - startedAt);
-			result.failed.push(item.name);
-		}
-	}
-	return result;
-}
 
 // -- phase runner ------------------------------------------------------------
 
@@ -637,14 +384,10 @@ export async function runUpdateCommand(
 		return 1;
 	}
 
-	// Exactly the items the three apply loops will touch. `pluginNeedsWork` is
-	// the SAME predicate applyPlugins uses — re-deriving it is how a meter
-	// drifts from the loop it measures.
-	const workItems = [
-		...plan.plugins.filter(pluginNeedsWork).map((p) => p.pluginId),
-		...plan.bins.filter((b) => b.action !== "current").map((b) => b.name),
-		...plan.skills.map((s) => s.name),
-	];
+	// Exactly the items the engine will touch. Derived by the engine from the
+	// same predicates its loops use, so the meter's denominator cannot drift
+	// from the work — a bar stuck short of full reads as a hang.
+	const workItems = planWorkItems(plan);
 
 	if (!planHasWork(plan) || workItems.length === 0) {
 		for (const line of summaryLine(
@@ -741,26 +484,14 @@ export async function runUpdateCommand(
 	console.log("");
 	applyLive.start((tick) => applyFrame(state, tick, Date.now()));
 
-	const pluginResult = await applyPlugins(
-		plan.plugins,
-		projectPath,
-		REAL_PLUGIN_DEPS,
-		reporter,
-	);
-	const binResult = await applyBins(plan, reporter);
-	const skillResult = await applySkills(plan, projectPath, reporter);
+	const outcome = await applyPlan(plan, projectPath, { report: reporter });
 
 	applyLive.stop();
 
-	const failed = [
-		...pluginResult.failed,
-		...binResult.failed,
-		...skillResult.failed,
-	];
-	const changed = pluginResult.ok + binResult.ok + skillResult.ok;
+	const { failed } = outcome;
 
 	for (const line of summaryLine(
-		changed,
+		outcome.changed,
 		counts.current,
 		counts.unknown,
 		failed.length,
@@ -773,13 +504,13 @@ export async function runUpdateCommand(
 	// of the manifest rather than something this run did wrong, and failing here
 	// would make `claudeup update` exit 1 forever for any profile with a pin.
 	// `install --check` with `strictVersions` is where pin drift is GATED.
-	if (pluginResult.mismatches.length > 0) {
+	if (outcome.plugins.mismatches.length > 0) {
 		console.log(
 			warnLine(
-				`${bold(String(pluginResult.mismatches.length))} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
+				`${bold(String(outcome.plugins.mismatches.length))} pinned version(s) are not what is installed. Only the newest published version can be installed:`,
 			),
 		);
-		for (const m of pluginResult.mismatches) {
+		for (const m of outcome.plugins.mismatches) {
 			console.log(
 				noteLine(
 					`${m.pluginId} (${m.scope}): manifest pins ${m.pinned}, installed ${m.actual ?? "unknown"}`,

package/src/data/cli-tools.ts

@@ -1,12 +1,30 @@
+import type { BinInstaller } from "../types/index.js";
+
+/**
+ * A CLI tool claudeup can install, check and update.
+ *
+ * There is deliberately NO `installCommand` field. Entries used to carry one
+ * alongside `packageManager` + `packageName`, which describe the same thing —
+ * so the two could disagree, and did: `aider` declared
+ * `packageName: "aider-chat"` while its `installCommand` installed
+ * `aider-install`, and the version check queried the former. The command is
+ * derived by `services/cli-tool-commands.ts` instead, which also means a
+ * catalogue entry can no longer smuggle shell syntax (that same entry's command
+ * was a `&&` chain) into something that gets executed.
+ */
 export interface CliTool {
 	name: string;
 	displayName: string;
 	description: string;
-	installCommand: string;
 	checkCommand: string;
 	website: string;
 	category: "ai-coding" | "utility";
-	packageManager: "bun" | "npm" | "pip" | "brew" | "go";
+	/**
+	 * Reuses `BinInstaller` rather than restating its members, so the
+	 * correspondence with the resolver in `services/toolchain.ts` — which is
+	 * what turns this field into an actual command — is a compile-time fact.
+	 */
+	packageManager: BinInstaller;
 	packageName: string;
 }
 
@@ -16,7 +34,6 @@ export const cliTools: CliTool[] = [
 		displayName: "claudeup",
 		description:
 			"TUI tool for managing Claude Code plugins, MCPs, and configuration",
-		installCommand: "bun install -g claudeup",
 		checkCommand: "claudeup --version",
 		website: "https://github.com/MadAppGang/magus/tree/main/tools/claudeup",
 		category: "ai-coding",
@@ -28,7 +45,6 @@ export const cliTools: CliTool[] = [
 		displayName: "Mnemex",
 		description:
 			"AST-aware code search with PageRank, callers/callees, and semantic embeddings",
-		installCommand: "bun install -g mnemex",
 		checkCommand: "mnemex --version",
 		website: "https://github.com/MadAppGang/mnemex",
 		category: "ai-coding",
@@ -39,7 +55,6 @@ export const cliTools: CliTool[] = [
 		name: "claudish",
 		displayName: "Claudish",
 		description: "Run Claude Code with OpenRouter models (Grok, GPT-5, Gemini)",
-		installCommand: "bun install -g claudish",
 		checkCommand: "claudish --version",
 		website: "https://github.com/MadAppGang/claudish",
 		category: "ai-coding",
@@ -50,7 +65,6 @@ export const cliTools: CliTool[] = [
 		name: "claude",
 		displayName: "Claude Code",
 		description: "Anthropic official agentic coding tool",
-		installCommand: "npm install -g @anthropic-ai/claude-code",
 		checkCommand: "claude --version",
 		website: "https://claude.ai/code",
 		category: "ai-coding",
@@ -62,7 +76,6 @@ export const cliTools: CliTool[] = [
 		displayName: "OpenAI Codex",
 		description:
 			"Lightweight coding agent from OpenAI that runs in your terminal",
-		installCommand: "npm install -g @openai/codex",
 		checkCommand: "codex --version",
 		website: "https://github.com/openai/codex",
 		category: "ai-coding",
@@ -73,7 +86,6 @@ export const cliTools: CliTool[] = [
 		name: "gemini",
 		displayName: "Gemini CLI",
 		description: "Google AI agent with 1M token context, free tier available",
-		installCommand: "npm install -g @google/gemini-cli",
 		checkCommand: "gemini --version",
 		website: "https://github.com/google-gemini/gemini-cli",
 		category: "ai-coding",
@@ -84,7 +96,6 @@ export const cliTools: CliTool[] = [
 		name: "qwen",
 		displayName: "Qwen Code",
 		description: "Alibaba coding agent optimized for Qwen3-Coder models",
-		installCommand: "npm install -g @qwen-code/qwen-code",
 		checkCommand: "qwen --version",
 		website: "https://github.com/QwenLM/qwen-code",
 		category: "ai-coding",
@@ -96,7 +107,6 @@ export const cliTools: CliTool[] = [
 		displayName: "Cline",
 		description:
 			"Autonomous coding agent with plan & act, checkpoints, browser use",
-		installCommand: "npm install -g cline",
 		checkCommand: "cline --version",
 		website: "https://cline.bot",
 		category: "ai-coding",
@@ -107,7 +117,6 @@ export const cliTools: CliTool[] = [
 		name: "opencode",
 		displayName: "OpenCode",
 		description: "Open source AI coding agent trusted by 400k+ developers",
-		installCommand: "npm install -g opencode-ai",
 		checkCommand: "opencode --version",
 		website: "https://opencode.ai",
 		category: "ai-coding",
@@ -118,7 +127,6 @@ export const cliTools: CliTool[] = [
 		name: "aider",
 		displayName: "Aider",
 		description: "AI pair programming - works with Claude, GPT-4, local models",
-		installCommand: "pip install aider-install && aider-install",
 		checkCommand: "aider --version",
 		website: "https://aider.chat",
 		category: "ai-coding",
@@ -129,7 +137,6 @@ export const cliTools: CliTool[] = [
 		name: "crush",
 		displayName: "Crush",
 		description: "AI coding assistant from Charm with terminal-native UX",
-		installCommand: "npm install -g @charmland/crush",
 		checkCommand: "crush --version",
 		website: "https://github.com/charmbracelet/crush",
 		category: "ai-coding",

package/src/services/claude-cli.ts

@@ -109,25 +109,28 @@ async function recoverMissingMarketplace(
 }
 
 /**
- * Install a plugin using claude CLI
- * Handles enabling + version tracking + cache copy in one shot.
+ * Run a `claude plugin` subcommand, recovering once from a missing or stale
+ * marketplace.
  *
- * If the install fails because the plugin is "not found in marketplace",
- * attempts to recover (add the marketplace if missing, or refresh it if
- * stale) and retries once.
+ * Shared by install and update because the recovery is identical and the two
+ * had already been written twice; a third copy for `update` is how the next
+ * divergence starts.
  */
-export async function installPlugin(
+async function execPluginCommand(
+	verb: "install" | "update",
 	pluginId: string,
-	scope: PluginScope = "user",
+	scope: PluginScope,
+	timeoutMs?: number,
 ): Promise<void> {
+	const argv = ["plugin", verb, pluginId, "--scope", scope];
 	try {
-		await execClaude(["plugin", "install", pluginId, "--scope", scope]);
+		await execClaude(argv, timeoutMs);
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
 		if (msg.includes("not found in marketplace")) {
 			const marketplace = pluginId.split("@")[1];
 			if (marketplace && (await recoverMissingMarketplace(marketplace))) {
-				await execClaude(["plugin", "install", pluginId, "--scope", scope]);
+				await execClaude(argv, timeoutMs);
 				return;
 			}
 		}
@@ -135,6 +138,29 @@ export async function installPlugin(
 	}
 }
 
+/**
+ * Install a plugin using claude CLI
+ * Handles enabling + version tracking + cache copy in one shot.
+ *
+ * ONLY for a plugin that is not installed at this scope yet. On one already
+ * installed there, `claude plugin install` is a no-op that ignores the version
+ * — see {@link updatePlugin}.
+ *
+ * If the install fails because the plugin is "not found in marketplace",
+ * attempts to recover (add the marketplace if missing, or refresh it if
+ * stale) and retries once.
+ */
+export async function installPlugin(
+	pluginId: string,
+	scope: PluginScope = "user",
+): Promise<void> {
+	// 60s, matching update and repair. Before the install/update split this path
+	// ran through `updatePlugin`'s 60s budget; leaving it on the 30s default
+	// would have quietly halved the time a fresh install — the SLOWEST of the
+	// three, since it downloads and copies — is allowed to take.
+	await execPluginCommand("install", pluginId, scope, 60000);
+}
+
 /**
  * Uninstall a plugin using claude CLI.
  * Falls back to direct settings removal if CLI uninstall fails
@@ -212,11 +238,37 @@ export async function disablePlugin(
 }
 
 /**
- * Update a plugin to the latest version.
- * Uses `install` as primary method since `update` only works for plugins
- * originally installed via the CLI. `install` handles both fresh installs
- * and re-installs (upgrades) of existing plugins regardless of how they
- * were originally added.
+ * Update an ALREADY-INSTALLED plugin to the latest version.
+ *
+ * Runs `claude plugin update`, not `claude plugin install`.
+ *
+ * This used to run `install`, on the documented premise that it "handles both
+ * fresh installs and re-installs (upgrades) of existing plugins". That premise
+ * is false, and every claudeup update path was silently doing nothing because
+ * of it. Measured against Claude Code 2.1.252, with designer@magus at 0.6.0 and
+ * 0.6.1 published:
+ *
+ *     $ claude plugin install designer@magus --scope project
+ *     Installing plugin "designer@magus"...
+ *     ✔ Plugin "designer@magus" is already installed (scope: project)
+ *     EXIT: 0
+ *
+ *     $ claude plugin update designer@magus --scope project
+ *     Checking for updates for plugin "designer@magus" at project scope…
+ *     ✔ Plugin "designer" updated from 0.6.0 to 0.6.1 for scope project. Restart to apply.
+ *     EXIT: 0
+ *
+ * `install` is idempotent on (plugin, scope) and never looks at the version, so
+ * it exits 0 having done nothing — indistinguishable from success to every
+ * caller. The registry keeps the old version, the read-back in `update-engine`
+ * records that old version as "what landed", and the same update is offered
+ * again on the next run, for ever.
+ *
+ * The two commands are NOT interchangeable in the other direction either:
+ * `claude plugin update` on a plugin absent from this scope reports "already at
+ * the latest version" and installs nothing. A fresh install must go through
+ * {@link installPlugin}, and content drift under an unchanged version still
+ * needs {@link repairPlugin} — `update` has no version bump to act on there.
  *
  * Retries with marketplace update on "not found" errors (same as installPlugin).
  */
@@ -224,22 +276,7 @@ export async function updatePlugin(
 	pluginId: string,
 	scope: PluginScope = "user",
 ): Promise<void> {
-	try {
-		await execClaude(["plugin", "install", pluginId, "--scope", scope], 60000);
-	} catch (error) {
-		const msg = error instanceof Error ? error.message : String(error);
-		if (msg.includes("not found in marketplace")) {
-			const marketplace = pluginId.split("@")[1];
-			if (marketplace && (await recoverMissingMarketplace(marketplace))) {
-				await execClaude(
-					["plugin", "install", pluginId, "--scope", scope],
-					60000,
-				);
-				return;
-			}
-		}
-		throw error;
-	}
+	await execPluginCommand("update", pluginId, scope, 60000);
 }
 
 /**