claudeup 6.5.1 → 6.7.1

package/src/__tests__/version-unknown-state.test.ts

@@ -0,0 +1,388 @@
+import { describe, expect, test } from "bun:test";
+import {
+	buildScopeStatus,
+	compareVersions,
+	isBehind,
+	isInstalledInScope,
+	resolveScopeAction,
+} from "../services/plugin-manager.js";
+import type { PluginInfo } from "../services/plugin-manager.js";
+import { planPluginUpdates } from "../services/update-plan.js";
+
+/**
+ * REGRESSION: claudeup renders "I cannot tell" as "nothing there" in three
+ * separate places — Fixed in /dev:fix session dev-fix-20260910-claudeup.
+ *
+ * Measured before the fix, against the real function and real registry values:
+ *
+ *   compareVersions("517b2fcd1b60", "b819188d2eea") = 0   hasUpdate=false
+ *   compareVersions("7.2.0",        "517b2fcd1b60") = 1   hasUpdate=true
+ *
+ * Two different git commits compared EQUAL, so a sha-versioned plugin could
+ * never report an update; and a sha compared against a semver reported a
+ * spurious one. `feature-dev@claude-plugins-official` is 517b2fcd1b60 in one
+ * project and b819188d2eea in another on the reporter's machine.
+ *
+ * The rule this file pins: an unorderable pair is `null` (unknown), never 0
+ * (equal) and never a direction.
+ */
+
+const SHA_A = "517b2fcd1b60";
+const SHA_B = "b819188d2eea";
+
+describe("compareVersions — orderable pairs", () => {
+	test("semver ordering is unchanged", () => {
+		expect(compareVersions("7.2.0", "7.1.0")).toBe(1);
+		expect(compareVersions("7.1.0", "7.2.0")).toBe(-1);
+		expect(compareVersions("7.1.0", "7.1.0")).toBe(0);
+	});
+
+	test("a leading v is still stripped", () => {
+		expect(compareVersions("v2.0.0", "1.9.9")).toBe(1);
+	});
+
+	test("uneven part counts still compare", () => {
+		expect(compareVersions("1.2", "1.2.0")).toBe(0);
+		expect(compareVersions("1.2.1", "1.2")).toBe(1);
+	});
+});
+
+describe("compareVersions — unorderable pairs are null, not 0", () => {
+	test("two DIFFERENT commit shas are not equal", () => {
+		// The bug: this returned 0, so nothing downstream could see a difference.
+		expect(compareVersions(SHA_A, SHA_B)).toBeNull();
+		expect(compareVersions(SHA_B, SHA_A)).toBeNull();
+	});
+
+	test("the same commit sha is genuinely equal", () => {
+		expect(compareVersions(SHA_A, SHA_A)).toBe(0);
+	});
+
+	test("a sha against a semver is not orderable in either direction", () => {
+		// The bug: these returned 1 and -1, a fabricated ordering.
+		expect(compareVersions("7.2.0", SHA_A)).toBeNull();
+		expect(compareVersions(SHA_A, "7.2.0")).toBeNull();
+	});
+
+	test("a missing side is unknown, not equal", () => {
+		// The bug: `if (!a || !b) return 0` claimed two absent versions matched.
+		expect(compareVersions(undefined, "1.0.0")).toBeNull();
+		expect(compareVersions("1.0.0", null)).toBeNull();
+		expect(compareVersions(undefined, undefined)).toBeNull();
+	});
+
+	test("the 0.0.0 sentinel is comparable — official plugins record it", () => {
+		expect(compareVersions("0.0.0", "0.0.0")).toBe(0);
+		expect(compareVersions("1.0.0", "0.0.0")).toBe(1);
+	});
+});
+
+describe("isBehind — the question callers actually ask", () => {
+	test("semver behind, ahead, level", () => {
+		expect(isBehind("7.2.0", "7.1.0")).toBe(true);
+		expect(isBehind("7.1.0", "7.2.0")).toBe(false);
+		expect(isBehind("7.1.0", "7.1.0")).toBe(false);
+	});
+
+	test("a different published sha means the install is not current", () => {
+		// The catalog is authoritative for what is published NOW. An installed
+		// commit that differs from it is not current, even though the two shas
+		// carry no ordering between them.
+		expect(isBehind(SHA_B, SHA_A)).toBe(true);
+		expect(isBehind(SHA_A, SHA_A)).toBe(false);
+	});
+
+	test("a sha against a semver is unknown, never a silent false", () => {
+		expect(isBehind("7.2.0", SHA_A)).toBeNull();
+		expect(isBehind(SHA_A, "7.2.0")).toBeNull();
+	});
+
+	test("not installed is unknown, not up to date", () => {
+		// The bug: `installedVersion && compare(...)` yielded false, so a plugin
+		// that was not installed at all was excluded from the update count and
+		// read as up to date.
+		expect(isBehind("7.2.0", undefined)).toBeNull();
+		expect(isBehind("7.2.0", null)).toBeNull();
+	});
+});
+
+describe("buildScopeStatus — installation is a registry fact, not a settings key", () => {
+	test("an installed but NOT enabled plugin still reports its scope", () => {
+		// The bug: scope was `enabledPlugins[id] !== undefined ? {...} : undefined`,
+		// so a plugin with a real registry row but no settings key rendered
+		// identically to one that was never installed.
+		const scope = buildScopeStatus({}, { "dev@magus": "7.2.0" }, "dev@magus");
+		expect(scope).toBeDefined();
+		expect(scope?.version).toBe("7.2.0");
+		expect(scope?.enabled).toBe(false);
+		expect(isInstalledInScope(scope)).toBe(true);
+	});
+
+	test("enabled with no install is still reported, as a broken state", () => {
+		const scope = buildScopeStatus({ "dev@magus": true }, {}, "dev@magus");
+		expect(scope).toBeDefined();
+		expect(scope?.enabled).toBe(true);
+		expect(scope?.version).toBeUndefined();
+		expect(isInstalledInScope(scope)).toBe(false);
+	});
+
+	test("neither enabled nor installed has no scope at all", () => {
+		expect(buildScopeStatus({}, {}, "dev@magus")).toBeUndefined();
+	});
+});
+
+describe("isInstalledInScope — presence of files, not permission to load", () => {
+	test("installed and disabled is still installed", () => {
+		// The old rule was `!!scope?.enabled && !!scope.version`, which made
+		// disabling a plugin look like uninstalling it.
+		expect(isInstalledInScope({ enabled: false, version: "7.2.0" })).toBe(true);
+	});
+
+	test("the 0.0.0 sentinel counts as installed", () => {
+		expect(isInstalledInScope({ enabled: true, version: "0.0.0" })).toBe(true);
+	});
+
+	test("enabled with no version is not installed", () => {
+		expect(isInstalledInScope({ enabled: true, version: undefined })).toBe(
+			false,
+		);
+	});
+});
+
+const info = (over: Partial<PluginInfo>): PluginInfo =>
+	({
+		id: "x@magus",
+		name: "x",
+		version: "1.0.0",
+		description: "",
+		marketplace: "magus",
+		marketplaceDisplay: "Magus",
+		enabled: true,
+		...over,
+	}) as PluginInfo;
+
+/**
+ * A catalog that HAS been read for @magus — it lists other magus plugins. That
+ * distinction is load-bearing: an empty catalog means "this marketplace was
+ * never read", where absence proves nothing, and installing is what registers
+ * it. Only a catalog we demonstrably hold entries from can turn absence into
+ * the answer "that plugin is not published".
+ */
+const magusCatalog = (...extra: PluginInfo[]) =>
+	new Map(
+		[
+			info({ id: "dev@magus", version: "7.2.0" }),
+			info({ id: "terminal@magus", version: "5.0.1" }),
+			...extra,
+		].map((p) => [p.id, p]),
+	);
+
+describe("planPluginUpdates — a pin its own marketplace does not offer", () => {
+	test("declared, not installed, marketplace read, plugin absent → unknown", () => {
+		// The bug: the !installed branch ran before any catalog guard, so
+		// `agentdev@magus` (retired) and `seo@magus` (moved to magus-marketing)
+		// planned as `install` with the literal pin as target on every run,
+		// forever, and every apply failed. The installed path already answered
+		// this correctly further down; the two are now consistent.
+		const items = planPluginUpdates(
+			{ "agentdev@magus": "latest" },
+			magusCatalog(),
+		);
+		expect(items).toHaveLength(1);
+		expect(items[0]?.action).toBe("unknown");
+		expect(items[0]?.target).toBeNull();
+		expect(items[0]?.note).toContain(
+			"not offered by any configured marketplace",
+		);
+		expect(items[0]?.reason).toBe("not-offered");
+	});
+
+	test("an exact pin its marketplace does not offer is also unknown", () => {
+		const items = planPluginUpdates({ "gone@magus": "3.0.0" }, magusCatalog());
+		expect(items[0]?.action).toBe("unknown");
+		expect(items[0]?.target).toBeNull();
+		expect(items[0]?.reason).toBe("not-offered");
+	});
+
+	test("declared, not installed, and the catalog does offer it → install", () => {
+		const items = planPluginUpdates(
+			{ "kanban@magus": "latest" },
+			magusCatalog(info({ id: "kanban@magus", version: "1.6.2" })),
+		);
+		expect(items[0]?.action).toBe("install");
+		expect(items[0]?.target).toBe("1.6.2");
+		expect(items[0]?.reason).toBe("absent");
+	});
+
+	test("a marketplace we have NOT read still plans an install", () => {
+		// Not the dead-pin case: with no entries from @newmp we never read its
+		// catalog, so absence is not evidence — and installing is what registers
+		// the marketplace in the first place. Guarding on `available === null`
+		// alone broke exactly this, which the existing suite caught.
+		const items = planPluginUpdates(
+			{ "thing@newmp": "latest" },
+			magusCatalog(),
+		);
+		expect(items[0]?.action).toBe("install");
+		expect(items[0]?.reason).toBe("absent");
+	});
+});
+
+describe("REVIEW-B regressions — found by the patch-quality panel", () => {
+	test("a catalog entry with NO version is offered, not unknown", () => {
+		// Measured: 278 of the 292 plugins in claude-plugins-official declare no
+		// version at all, `feature-dev` among them. Keying "not offered" on
+		// `available === null` planned `unknown` for every one of them and never
+		// installed. Membership in the catalog is the real test.
+		const items = planPluginUpdates(
+			{ "feature-dev@official": "latest" },
+			new Map(
+				[
+					info({ id: "feature-dev@official", version: null }),
+					info({ id: "github@official", version: null }),
+				].map((p) => [p.id, p]),
+			),
+		);
+		expect(items[0]?.action).toBe("install");
+		expect(items[0]?.reason).toBe("absent");
+	});
+
+	test("an installed version that cannot be compared is unknown, not current", () => {
+		// 21 registry rows carry the literal string "unknown" as their version.
+		// Against a semver catalog they are unorderable, so no scope is provably
+		// behind — and falling through to `current` claims they are up to date.
+		const items = planPluginUpdates(
+			{ "playground@official": "latest" },
+			new Map([
+				[
+					"playground@official",
+					info({
+						id: "playground@official",
+						version: "7.3.0",
+						projectScope: { enabled: true, version: "unknown" },
+					}),
+				],
+			]),
+		);
+		expect(items[0]?.action).toBe("unknown");
+		expect(items[0]?.note).toContain("cannot be compared");
+		expect(items[0]?.reason).toBe("unorderable");
+	});
+
+	test("a genuinely current install is still current", () => {
+		const items = planPluginUpdates(
+			{ "dev@magus": "latest" },
+			new Map([
+				[
+					"dev@magus",
+					info({
+						id: "dev@magus",
+						version: "7.3.0",
+						projectScope: { enabled: true, version: "7.3.0" },
+					}),
+				],
+			]),
+		);
+		expect(items[0]?.action).toBe("current");
+		expect(items[0]?.reason).toBe("up-to-date");
+	});
+});
+
+describe("resolveScopeAction — the scope key must never silently uninstall", () => {
+	test("installed but DISABLED resolves to install, not uninstall", () => {
+		// The hazard: the scope key runs cliUninstallPlugin with no confirmation.
+		// Relaxing isInstalledInScope made this combination fall through to
+		// "uninstall", so pressing the key on a plugin the user had merely
+		// switched off would delete it.
+		expect(
+			resolveScopeAction({ enabled: false, version: "3.0.2" }, false),
+		).toBe("install");
+	});
+
+	test("installed AND enabled at the latest version still offers uninstall", () => {
+		expect(resolveScopeAction({ enabled: true, version: "3.0.2" }, false)).toBe(
+			"uninstall",
+		);
+	});
+
+	test("installed, enabled, and behind still offers update", () => {
+		expect(resolveScopeAction({ enabled: true, version: "3.0.1" }, true)).toBe(
+			"update",
+		);
+	});
+
+	test("not installed at all resolves to install", () => {
+		expect(resolveScopeAction(undefined, false)).toBe("install");
+	});
+});
+
+describe("installed with no comparable catalog version — two different causes", () => {
+	test("in the catalog but declaring no version is NOT 'withdrawn'", () => {
+		// feature-dev@claude-plugins-official, measured live: installed, listed by
+		// its marketplace, and declaring no version. Reporting it as "not offered
+		// by any configured marketplace" told the user a working, currently
+		// published plugin had been withdrawn.
+		const items = planPluginUpdates(
+			{ "feature-dev@official": "latest" },
+			new Map([
+				[
+					"feature-dev@official",
+					info({
+						id: "feature-dev@official",
+						version: null,
+						projectScope: { enabled: true, version: "3ea32df27be7" },
+					}),
+				],
+			]),
+		);
+		expect(items[0]?.action).toBe("unknown");
+		expect(items[0]?.note).toContain("publishes no version");
+		expect(items[0]?.note).not.toContain("not offered");
+		expect(items[0]?.reason).toBe("no-published-version");
+	});
+
+	test("absent from the catalog entirely IS 'not offered'", () => {
+		const items = planPluginUpdates(
+			{ "gone@magus": "latest" },
+			new Map([
+				[
+					"other@magus",
+					info({
+						id: "other@magus",
+						version: "1.0.0",
+						projectScope: { enabled: true, version: "1.0.0" },
+					}),
+				],
+			]),
+		);
+		expect(items[0]?.action).toBe("unknown");
+		expect(items[0]?.note).toContain(
+			"not offered by any configured marketplace",
+		);
+		expect(items[0]?.reason).toBe("not-offered");
+	});
+});
+
+describe('the "0.0.0" registry value is unknown, never healthy', () => {
+	test("installed at 0.0.0 with no published version is no-published-version", () => {
+		// Real: explanatory-output-style@claude-plugins-official is recorded as
+		// "0.0.0" in the registry for many project paths, and its marketplace
+		// publishes no version. The TUI row hid every status suffix behind a
+		// displayable version, so this row rendered with none at all.
+		const items = planPluginUpdates(
+			{ "explanatory-output-style@official": "latest" },
+			new Map([
+				[
+					"explanatory-output-style@official",
+					info({
+						id: "explanatory-output-style@official",
+						version: null,
+						projectScope: { enabled: true, version: "0.0.0" },
+					}),
+				],
+			]),
+		);
+		expect(items[0]?.action).toBe("unknown");
+		expect(items[0]?.reason).toBe("no-published-version");
+	});
+});

package/src/cli/router.ts

@@ -9,7 +9,6 @@
 import type { ThemeMode } from "@opentui/core";
 import { checkForUpdates } from "../services/version-check.js";
 import { parseThemeWord } from "../ui/theme-resolve.js";
-import { runClaudeCommand } from "./claude.js";
 import { runDoctorCommand } from "./doctor.js";
 import { runInstallCommand } from "./install.js";
 import { runModelsCommand } from "./models.js";
@@ -116,8 +115,6 @@ export async function route(
 	const [command, ...rest] = themeFlag.rest;
 
 	switch (command) {
-		case "claude":
-			return HANDLED(await runClaudeCommand(rest));
 		case "update":
 			return HANDLED(await runUpdateCommand(rest));
 		case "upgrade":
@@ -193,8 +190,6 @@ applied by a PreToolUse hook claudeup registers at user scope.
   models off         Stop routing; subagents inherit the session model again
 
 Other commands:
-  claude [args...]   Check for plugin updates (1h cache), then run claude
-    -f, --force      Force update check (bypass 1h cache)
   upgrade            Update claudeup ITSELF to the latest version
 
 Navigation (TUI):

package/src/cli/update-view.ts

@@ -24,7 +24,7 @@
  * own word, so the report survives NO_COLOR, a pipe, and colour blindness.
  */
 
-import { binInstallCommand, binUpgradeCommand } from "../services/toolchain.js";
+import { binCommandFor } from "../services/update-engine.js";
 import type {
 	BinUpdateItem,
 	PluginUpdateItem,
@@ -88,7 +88,9 @@ const ACTIONS: Record<ActionKey, ActionStyle> = {
 	upgrade: { glyph: "↑", label: "UPGRADE", color: brand.warning },
 	repair: { glyph: "⟳", label: "REPAIR", color: brand.info },
 	refresh: { glyph: "⟳", label: "REFRESH", color: brand.info },
-	unknown: { glyph: "?", label: "UNKNOWN", color: brand.danger },
+	// Warning, not danger: "cannot tell" is not a failure, and red UNKNOWN read
+	// as "broken". The summary line and the TUI already use warning for it.
+	unknown: { glyph: "?", label: "UNKNOWN", color: brand.warning },
 };
 
 /** Widest label plus the badge's own two spaces of padding. */
@@ -251,17 +253,40 @@ function pluginDetail(item: PluginUpdateItem): string {
 	}
 }
 
+/**
+ * What a tool row says on its right.
+ *
+ * A `current` row used to print `pinned —` unconditionally, which was true only
+ * while "current" implied "pinned". An unpinned tool can be current now, so the
+ * pin is shown only when there is one.
+ */
 function binDetail(item: BinUpdateItem, plan: UpdatePlan): string {
 	const spec = plan.binSpecs.get(item.name);
-	if (item.action === "current" || !spec)
-		return `pinned ${item.version ?? "—"}`;
-	const cmd =
-		item.action === "install"
-			? binInstallCommand(spec)
-			: binUpgradeCommand(spec);
 	// Rendered for the reader's eyes only — this row says what WILL run, while
-	// applyBins runs the argv itself.
-	return dim(formatCommand(cmd));
+	// applyBins runs the argv itself. Same builder, so they cannot differ.
+	const cmd = spec ? binCommandFor(item, spec) : null;
+	const command = cmd ? dim(formatCommand(cmd)) : "";
+	switch (item.action) {
+		case "current":
+			return `${item.installed ?? "—"}${
+				item.version ? `  ${dim(`pinned ${item.version}`)}` : ""
+			}`;
+		case "upgrade":
+			return `${dim(item.installed ?? "—")} ${fg(brand.warning, "→")} ${fg(
+				brand.warning,
+				item.target ?? "?",
+			)}${command ? `  ${command}` : ""}${
+				// An upgrade that also changes the tool's owner says so here; a
+				// plain one reads identically to before.
+				item.adopted ? `  ${dim(`(${item.adopted})`)}` : ""
+			}`;
+		case "unknown":
+			return `${item.installed ?? "—"}${
+				item.note ? `  ${dim(`(${item.note})`)}` : ""
+			}`;
+		case "install":
+			return command;
+	}
 }
 
 /**
@@ -396,22 +421,30 @@ export function applyRow(
 	)}`;
 }
 
-/** Closing line: the run's shape as a bar, then the counts that label it. */
+/**
+ * Closing line: the run's shape as a bar, then the counts that label it.
+ *
+ * `unchanged` is its own count: an installer that exited 0 while read-back
+ * shows nothing moved. Folding it into `changed` is how every run printed
+ * "3 changed" while changing nothing; it is not a failure either.
+ */
 export function summaryLine(
 	changed: number,
 	current: number,
 	unknown: number,
 	failed: number,
 	ms: number,
+	unchanged = 0,
 ): string[] {
 	const bar = stackedBar(BAR * 2, [
 		{ value: changed, color: brand.success },
 		{ value: current, color: brand.muted },
-		{ value: unknown, color: brand.warning },
+		{ value: unchanged + unknown, color: brand.warning },
 		{ value: failed, color: brand.danger },
 	]);
 	const parts = [
 		changed > 0 ? fg(brand.success, `${changed} changed`) : "",
+		unchanged > 0 ? fg(brand.warning, `${unchanged} unchanged`) : "",
 		current > 0 ? dim(`${current} current`) : "",
 		unknown > 0 ? fg(brand.warning, `${unknown} unverified`) : "",
 		failed > 0 ? fg(brand.danger, `${failed} failed`) : "",
@@ -444,3 +477,50 @@ export function info(text: string): string {
 export function note(text: string): string {
 	return `${PAD}   ${dim(text)}`;
 }
+
+// -- unverified items ----------------------------------------------------------
+//
+// A plugin is `unknown` for several distinct reasons — its marketplace publishes
+// no version, the two versions cannot be ordered, no marketplace offers it, its
+// marketplace was not read, or the catalog fetch failed — and every row above
+// already prints its own. These lines therefore claim only what holds for EVERY
+// reason. They once advised "re-run once the catalog is reachable", which is
+// false for a plugin whose marketplace publishes no version: re-running changes
+// nothing, and the reader went looking for a network fault that did not exist.
+
+/** Unverified plugins, under the plan. Never "up to date" — that is the point. */
+export function unknownPluginsNotice(count: number): string {
+	return warn(
+		`${bold(String(count))} plugin(s) could not be checked — not applied. They are NOT reported as up to date. Reasons are shown above.`,
+	);
+}
+
+/** Unverified tools, under the plan. */
+export function unknownToolsNotice(count: number, names: string[]): string {
+	return warn(
+		`${bold(String(count))} tool(s) could not be checked: ${names.join(", ")} — not applied. Reasons are shown above.`,
+	);
+}
+
+/**
+ * `--check` is about to exit 0 while N items went unchecked.
+ *
+ * The gate does not fail on an unknown — plugin or tool — because most unknowns
+ * are permanent (a marketplace that publishes no version, a tool another npm
+ * owns), and a gate that can never pass protects nothing. This line is what
+ * keeps the exit 0 honest: it is "nothing is KNOWN to be behind", not
+ * "everything was verified". It counts plugins and tools together because the
+ * two per-kind notices above already name which is which.
+ */
+export function uncheckedGateNotice(count: number): string {
+	return warn(
+		`${bold(String(count))} item(s) could not be checked — they do not fail this gate. They are NOT reported as up to date. Reasons are shown above.`,
+	);
+}
+
+/** The run ends with nothing to apply because every remaining plugin is unverified. */
+export function nothingToApplyNotice(unknownPlugins: number): string {
+	return warn(
+		`Nothing to apply. ${unknownPlugins} plugin(s) could not be checked. They are NOT reported as up to date. Reasons are shown above.`,
+	);
+}