claudeup 6.3.2 → 6.5.0

package/src/main.tsx

@@ -1,29 +1,68 @@
 #!/usr/bin/env bun
 
-import { RGBA, createCliRenderer } from "@opentui/core";
-import { createRoot } from "@opentui/react";
 // Static import so `bun build --compile` embeds package.json into the binary;
 // a dynamic require("../package.json") is not resolvable inside the bunfs root.
 import pkg from "../package.json";
-import { route } from "./cli/router.js";
 import { loadProjectDotenv } from "./services/dotenv.js";
-import { App } from "./ui/App.js";
-import { setThemeMode } from "./ui/theme-mode.js";
-import { resolveTheme, snapshotThemeEnv } from "./ui/theme-resolve.js";
 
 export const VERSION = (pkg as { version: string }).version;
 
 // Note: OpenTUI renderer handles alternate screen buffer automatically
 // No need for manual ANSI escape codes
+//
+// NOTHING in this file may statically import @opentui/* or ./ui/*. `claudeup
+// hook …` runs on every matching Claude Code tool call, and a static import
+// would load the whole TUI module graph before the hook could answer. The TUI
+// (./tui.js), the router (./cli/router.js, which reaches @opentui through
+// cli/update.ts → ui/theme.ts) and the hook itself are all imported on demand,
+// after the branch that decides which one is needed.
+// Pinned by __tests__/hook-import-policy.test.ts.
+
+/**
+ * `hook` as the first non-theme token → the argv the hook command should see.
+ * Anything else → null.
+ *
+ * A leading `--theme light|dark` (or `--theme=…`) pair is skipped so this
+ * matches the router's own dispatch, which drops the theme tokens before
+ * looking at the command. Deliberately NOT `parseThemeFlag` from the router:
+ * importing that module is the cost this branch exists to avoid, and a hook
+ * has no use for a validated theme.
+ */
+function hookArgv(argv: string[]): string[] | null {
+	let i = 0;
+	while (i < argv.length) {
+		const token = argv[i] as string;
+		if (token === "--theme") {
+			i += 2;
+		} else if (token.startsWith("--theme=")) {
+			i += 1;
+		} else {
+			break;
+		}
+	}
+	return argv[i] === "hook" ? argv.slice(i + 1) : null;
+}
 
 async function main(): Promise<void> {
 	// FIRST, before anything can touch process.env: the theme is read from the
 	// environment claudeup was started with, never from a project's .env. The
 	// dotenv load below merges into process.env, so the only thing separating
 	// the two is that this line runs before it (pinned by theme-env.test.ts).
+	const { snapshotThemeEnv } = await import("./ui/theme-resolve.js");
 	const themeEnv = snapshotThemeEnv();
 	const args = process.argv.slice(2);
 
+	// Hooks answer here and go no further. This runs BEFORE loadProjectDotenv()
+	// on purpose: a hook must never open a project's .env, because that file is
+	// often a symlink to a 1Password FIFO and reading one BLOCKS until a human
+	// approves it — on every tool call. The hook needs no .env, so it never
+	// touches one.
+	const hookRest = hookArgv(args);
+	if (hookRest !== null) {
+		const { runHookCommand } = await import("./cli/hook.js");
+		process.exit(await runHookCommand(hookRest));
+	}
+
 	// Load the project's .env ourselves. Bun's standalone autoload is compiled OFF
 	// (scripts/build-binaries.ts) because it killed claudeup outright wherever
 	// .env was a symlink to a FIFO — the shape 1Password uses — exiting 1 with no
@@ -44,6 +83,7 @@ async function main(): Promise<void> {
 	// Dispatch non-interactive subcommands (claude, update, install, …) and
 	// top-level flags (--version/--help). A bare invocation falls through to
 	// the interactive TUI below.
+	const { route } = await import("./cli/router.js");
 	const outcome = await route(args, VERSION);
 	if (outcome.handled) {
 		process.exit(outcome.exitCode ?? 0);
@@ -54,85 +94,14 @@ async function main(): Promise<void> {
 	const isInteractive =
 		process.stdin.isTTY === true && process.stdout.isTTY === true;
 
-	// Create OpenTUI renderer (handles alternate screen buffer automatically).
-	//
-	// The background is the terminal's own, not a colour of ours: painting an
-	// absolute fill would box the UI into whatever theme we guessed. OpenTUI's
-	// built-in default for unstyled cells is truecolor white, which is why every
-	// element now names an adaptive colour explicitly — see src/ui/theme.ts.
-	// The mouse is ON, everywhere — it carries real features now: the wheel
-	// scrolls the pane under the cursor, and a drag selects text from ONE pane
-	// at a time (terminal-native selection is a screen-wide rectangle that
-	// grabs both columns), OSC 52-copied on release below.
-	//
-	// This deliberately includes tmux. Two earlier revisions got this wrong in
-	// opposite directions: one disabled the mouse everywhere on the theory that
-	// capture breaks tmux-level pane clicking, the next kept it off only inside
-	// tmux. Both dated from when claudeup had no mouse features, so disabling
-	// cost nothing. MEASURED on a heavily tmux'd machine: tmux forwards mouse
-	// to a pane application that asks for it (htop in the same session took
-	// clicks and wheel fine while claudeup sat inert), and tmux's own `mouse`
-	// option keeps governing pane management. Terminal-native selection stays
-	// reachable via Shift+drag in most terminals.
-	//
-	// enableMouseMovement (mode-1003 "report all motion") stays off — selection
-	// needs only button-held drag events, which button reporting delivers.
-	const renderer = await createCliRenderer({
-		backgroundColor: RGBA.defaultBackground(),
-		useMouse: true,
-		enableMouseMovement: false,
-	});
-
-	// Mouse selection → system clipboard, on release. OSC 52 survives SSH;
-	// terminals that block it simply ignore the sequence. Never fires where the
-	// mouse is off, so the tmux path pays nothing.
-	renderer.on("selection", (selection: { getSelectedText(): string }) => {
-		const text = selection?.getSelectedText() ?? "";
-		if (text.length > 0) renderer.copyToClipboardOSC52(text);
-	});
-
-	// Resolve light vs dark once: --theme, CLAUDEUP_THEME, TERM_THEME, the OSC
-	// probe, COLORFGBG, dark — see src/ui/theme-resolve.ts. Only the disabled-row
-	// tint and the chips need this (src/ui/theme-mode.ts explains why that one
-	// case cannot be solved the way the rest of the palette is).
-	//
-	// The renderer sends OSC 10/11 at creation regardless: @opentui/core 0.1.107
-	// has no option to suppress it. So the rule "TERM_THEME skips the probe" is
-	// satisfied by NOT AWAITING — when steps 1-3 answer, `probe` is never called,
-	// `waitForThemeMode(250)` never runs, first paint is not delayed, and
-	// `renderer.themeMode` is never read anywhere in claudeup. Any late reply the
-	// terminal sends is consumed by OpenTUI's own handleSequence and ignored here.
-	const { mode } = await resolveTheme({
-		flag: outcome.theme,
+	// Last possible moment: this is the import that pulls in @opentui and the
+	// whole ui/ tree. Everything above runs without them.
+	const { startTui } = await import("./tui.js");
+	await startTui({
+		theme: outcome.theme,
 		env: themeEnv,
 		isInteractive,
-		probe: () => renderer.waitForThemeMode(250).catch(() => null),
 	});
-	setThemeMode(mode);
-
-	const root = createRoot(renderer);
-
-	// Cleanup function to restore terminal
-	const cleanup = () => {
-		root.unmount();
-		renderer.destroy(); // CRITICAL: Never use process.exit() directly
-	};
-
-	// Handle cleanup on exit signals
-	const handleExit = () => {
-		cleanup();
-		// Exit after cleanup completes
-		process.exit(0);
-	};
-
-	process.on("SIGINT", handleExit);
-	process.on("SIGTERM", handleExit);
-
-	// Render the OpenTUI app with exit handler
-	root.render(<App onExit={handleExit} />);
-
-	// Wait indefinitely (app runs until user exits)
-	await new Promise(() => {});
 }
 
 main().catch((error) => {

package/src/services/hook-registration.ts

@@ -0,0 +1,218 @@
+/**
+ * Register `claudeup hook agent-model` as a `PreToolUse` hook on the Agent tool.
+ *
+ * The hook is what makes per-subagent routing exist at all: Claude Code has no
+ * per-agent model knob, and a PreToolUse hook rewriting the Agent tool's input
+ * is the only dynamic seam (measured — see `models-core.ts`). A config with no
+ * hook registered routes NOTHING, which is why `computeModelsStatus` reports
+ * `unhooked` ahead of any drift.
+ *
+ * Three rules, each earned:
+ *
+ *  1. **Identity is the command string.** Registration is idempotent because it
+ *     looks for the command, not for a block shape. An existing `Agent` matcher
+ *     block gets the command APPENDED rather than a second block created, so a
+ *     user's own Agent hooks keep running alongside this one.
+ *  2. **The command is BARE, never an absolute path.** `claudeup upgrade`
+ *     replaces the binary, and on npm the path carries a version directory — an
+ *     absolute path recorded today is a dead path after the next upgrade, and
+ *     the failure is invisible (a hook that cannot start is a hook that
+ *     silently does not route).
+ *  3. **User scope, through `updateSettingsFile`.** NOT
+ *     `readGlobalSettings`/`writeGlobalSettings`: those swallow a parse error
+ *     and return `{}`, so a settings file a human is mid-edit in would be
+ *     overwritten with one hook and nothing else. `updateSettingsFile` refuses
+ *     a file it cannot parse.
+ */
+
+import path from "node:path";
+import { claudeConfigDirOrNull } from "../utils/config-dir.js";
+import { readSettingsFile, updateSettingsFile } from "./settings-file.js";
+
+/** The command Claude Code runs. Bare — see rule 2 above. */
+export const AGENT_MODEL_HOOK_COMMAND = "claudeup hook agent-model";
+
+/** The tool whose input the hook rewrites. */
+const MATCHER = "Agent";
+
+/**
+ * Seconds. Generous for a process that reads one small JSON file and exits, and
+ * deliberately finite: Claude Code waits for this on every Agent call.
+ */
+const TIMEOUT_SECONDS = 5;
+
+interface HookCommand {
+	type: "command";
+	command: string;
+	timeout?: number;
+}
+
+const isRec = (v: unknown): v is Record<string, unknown> =>
+	typeof v === "object" && v !== null && !Array.isArray(v);
+
+/** The `hooks.PreToolUse` array, or [] for any shape that is not one. */
+function preToolUseBlocks(
+	settings: Record<string, unknown>,
+): Record<string, unknown>[] {
+	const hooks = settings.hooks;
+	if (!isRec(hooks)) return [];
+	const blocks = hooks.PreToolUse;
+	if (!Array.isArray(blocks)) return [];
+	return blocks.filter(isRec);
+}
+
+/** The command entries inside one matcher block. */
+function commandsIn(block: Record<string, unknown>): Record<string, unknown>[] {
+	return Array.isArray(block.hooks) ? block.hooks.filter(isRec) : [];
+}
+
+function isOurCommand(entry: Record<string, unknown>): boolean {
+	return (
+		typeof entry.command === "string" &&
+		entry.command.trim() === AGENT_MODEL_HOOK_COMMAND
+	);
+}
+
+/** Is the agent-model hook already registered in this settings object? */
+export function isHookRegistered(settings: Record<string, unknown>): boolean {
+	return preToolUseBlocks(settings).some((block) =>
+		commandsIn(block).some(isOurCommand),
+	);
+}
+
+function newCommandEntry(): HookCommand {
+	return {
+		type: "command",
+		command: AGENT_MODEL_HOOK_COMMAND,
+		timeout: TIMEOUT_SECONDS,
+	};
+}
+
+/**
+ * Add the hook if it is missing. Returns a NEW settings object — the input is
+ * never mutated, so a caller can diff before deciding to write.
+ */
+export function ensureHookRegistered(settings: Record<string, unknown>): {
+	settings: Record<string, unknown>;
+	changed: boolean;
+} {
+	if (isHookRegistered(settings)) return { settings, changed: false };
+
+	const next = structuredClone(settings);
+	const hooks = isRec(next.hooks) ? next.hooks : {};
+	const blocks = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
+
+	// Append into an existing Agent block rather than adding a second one: two
+	// blocks with the same matcher both fire, which works, but it makes the
+	// user's settings file progressively less readable and is indistinguishable
+	// from a bug when they open it.
+	const existing = blocks.findIndex(
+		(b) => isRec(b) && b.matcher === MATCHER && Array.isArray(b.hooks),
+	);
+	if (existing >= 0) {
+		const block = blocks[existing] as Record<string, unknown>;
+		blocks[existing] = {
+			...block,
+			hooks: [...(block.hooks as unknown[]), newCommandEntry()],
+		};
+	} else {
+		blocks.push({ matcher: MATCHER, hooks: [newCommandEntry()] });
+	}
+
+	next.hooks = { ...hooks, PreToolUse: blocks };
+	return { settings: next, changed: true };
+}
+
+/**
+ * Remove every registration of the hook. An Agent block left with no commands
+ * is dropped, so uninstalling leaves no trace; other blocks and other commands
+ * inside a shared Agent block are untouched.
+ */
+export function removeHookRegistration(settings: Record<string, unknown>): {
+	settings: Record<string, unknown>;
+	changed: boolean;
+} {
+	if (!isHookRegistered(settings)) return { settings, changed: false };
+
+	const next = structuredClone(settings);
+	const hooks = next.hooks as Record<string, unknown>;
+	const blocks: unknown[] = [];
+	for (const block of hooks.PreToolUse as unknown[]) {
+		if (!isRec(block) || !Array.isArray(block.hooks)) {
+			blocks.push(block);
+			continue;
+		}
+		const kept = block.hooks.filter((e) => !(isRec(e) && isOurCommand(e)));
+		if (kept.length === 0 && block.matcher === MATCHER) continue;
+		blocks.push({ ...block, hooks: kept });
+	}
+
+	if (blocks.length > 0) {
+		hooks.PreToolUse = blocks;
+	} else {
+		// biome-ignore lint/performance/noDelete: an empty PreToolUse array is noise in a file people read
+		delete hooks.PreToolUse;
+	}
+	if (Object.keys(hooks).length === 0) {
+		// biome-ignore lint/performance/noDelete: same reason — leave no empty husk
+		delete next.hooks;
+	}
+	return { settings: next, changed: true };
+}
+
+/**
+ * The user-scope settings file this writes to.
+ *
+ * `claudeConfigDirOrNull` honours `CLAUDE_CONFIG_DIR` and returns null under
+ * `bun test` when no test has chosen a directory — which is a refusal, not a
+ * fallback: writing a hook into the operator's real `~/.claude/settings.json`
+ * from a test run is exactly the damage that guard exists to prevent.
+ */
+function userSettingsPath(configDir?: string): string {
+	const dir = configDir ?? claudeConfigDirOrNull();
+	if (!dir) {
+		throw new Error(
+			"No Claude config directory resolved. Set CLAUDE_CONFIG_DIR (a test must isolate it) before registering the agent-model hook.",
+		);
+	}
+	return path.join(dir, "settings.json");
+}
+
+/**
+ * Register the hook at user scope, once.
+ *
+ * User scope on purpose: routing is configured per project, but the hook that
+ * applies it has to be running in whatever session opens that project, and a
+ * project-scope hook would only exist for projects claudeup had already
+ * touched. The hook itself is a no-op for a project with no `models.json`, so
+ * one global registration costs nothing everywhere else.
+ */
+export async function registerAgentModelHook(
+	opts: { configDir?: string } = {},
+): Promise<"registered" | "already"> {
+	const settingsPath = userSettingsPath(opts.configDir);
+	// Read first so an unchanged file is not rewritten (and its mtime not
+	// touched) on every `models use`.
+	if (isHookRegistered(await readSettingsFile(settingsPath))) return "already";
+
+	await updateSettingsFile(settingsPath, (settings) => {
+		return ensureHookRegistered(settings).settings;
+	});
+	return "registered";
+}
+
+/** Is the hook registered in the user-scope settings file? */
+export async function isAgentModelHookRegistered(
+	opts: { configDir?: string } = {},
+): Promise<boolean> {
+	try {
+		return isHookRegistered(
+			await readSettingsFile(userSettingsPath(opts.configDir)),
+		);
+	} catch {
+		// No config dir, or a settings file we cannot parse. Either way we cannot
+		// claim it is registered — and the caller (doctor / status) reports that
+		// as "not routed", which is the honest answer.
+		return false;
+	}
+}

package/src/services/manifest.ts

@@ -10,6 +10,7 @@
 import path from "node:path";
 import fs from "fs-extra";
 import type { ProfileManifest, ProfileManifestEntry } from "../types/index.js";
+import { validateModelsConfig } from "./models-core.js";
 
 const PROFILES_FILE = "profiles.json";
 
@@ -160,7 +161,90 @@ export function validateManifest(
 				}
 			});
 		}
+		// Model routing is the one field here whose bad value does not degrade:
+		// MEASURED (benches/agent-model-routing, `bogus-model` 5/5), a model the
+		// Agent tool does not accept refuses the spawn outright, so EVERY subagent
+		// dispatch fails for everyone who pulled the manifest. This is the gate
+		// that stops a hand-edited entry reaching a session.
+		if (entry.models !== undefined) {
+			for (const e of validateModelsConfig(entry.models)) {
+				errors.push({
+					path: e.path ? `${base}.models.${e.path}` : `${base}.models`,
+					message: e.message,
+				});
+			}
+		}
 	}
 
 	return errors;
 }
+
+/**
+ * Read/modify/write ONE profile entry in the committed manifest.
+ *
+ * Returns false when there is nothing to record against (no profile named, no
+ * manifest file, or no entry for that profile) — all three are normal states,
+ * and `mutate` is not called.
+ *
+ * THROWS when the manifest exists and cannot be read as JSON. `readManifest`
+ * degrades a corrupt file to an empty manifest, which here would mean silently
+ * recording nothing and reporting success — the caller has just written a live
+ * setting the next `claudeup install` will revert, and would never learn.
+ */
+export async function updateProfileEntry(
+	projectPath: string,
+	profile: string | null,
+	mutate: (entry: ProfileManifestEntry) => void,
+): Promise<boolean> {
+	if (!profile) return false;
+	const filePath = getManifestPath(projectPath);
+	if (!(await fs.pathExists(filePath))) return false;
+
+	// Read directly rather than through readManifest: its `catch` is exactly
+	// what turns a corrupt file into a silent no-op.
+	let raw: unknown;
+	try {
+		raw = await fs.readJson(filePath);
+	} catch (error) {
+		throw new Error(
+			`${filePath} is not valid JSON, refusing to write to it: ${String(error)}`,
+		);
+	}
+
+	const manifest = migrateToV2(raw);
+	const entry = manifest.profiles[profile];
+	if (!entry) return false;
+
+	mutate(entry);
+	entry.updatedAt = new Date().toISOString();
+	await writeManifest(manifest, projectPath);
+	return true;
+}
+
+/**
+ * Merge `patch` into `profiles.<profile>.settings`, optionally removing the
+ * keys named in `unset`.
+ *
+ * Why this exists: `.claude/settings.json` is a symlink into the active
+ * profile's materialized directory, so a live write lands in the right place —
+ * but `materializeProfile` REWRITES that file from the manifest on every
+ * `claudeup install`, so the live write alone silently regresses. The manifest
+ * is the durable half of every settings write claudeup makes.
+ */
+export async function mergeManifestSettings(
+	projectPath: string,
+	profile: string | null,
+	patch: Record<string, unknown>,
+	opts: { unset?: readonly string[] } = {},
+): Promise<boolean> {
+	return updateProfileEntry(projectPath, profile, (entry) => {
+		const settings = { ...(entry.settings ?? {}), ...patch };
+		for (const key of opts.unset ?? []) {
+			// The key must be ABSENT, not present-and-undefined: an `= undefined`
+			// assignment still answers `in` checks, so the next call would read it
+			// as already handled and skip work it still owes.
+			delete settings[key];
+		}
+		entry.settings = settings;
+	});
+}