claudeup 6.5.1 → 6.7.1

package/src/services/toolchain.ts

@@ -58,6 +58,15 @@ export interface PythonCliInstaller {
 	 * frequently is not an executable at all.
 	 */
 	uninstall(pkg: string): Command;
+	/**
+	 * Move an ALREADY-INSTALLED package to exactly `version`.
+	 *
+	 * Distinct from `install(pkg, version)`, which each of these treats as a
+	 * no-op once the package is present — `uv tool install pkg==v` answers
+	 * "already installed" when any version is there. `--force` is what makes
+	 * the pin land.
+	 */
+	pin(pkg: string, version: string): Command;
 }
 
 export const PYTHON_CLI_INSTALLERS: readonly PythonCliInstaller[] = [
@@ -81,6 +90,10 @@ export const PYTHON_CLI_INSTALLERS: readonly PythonCliInstaller[] = [
 			args: ["tool", "install", "--force", "--upgrade", pkg],
 		}),
 		uninstall: (pkg) => ({ cmd: "uv", args: ["tool", "uninstall", pkg] }),
+		pin: (pkg, version) => ({
+			cmd: "uv",
+			args: ["tool", "install", "--force", `${pkg}==${version}`],
+		}),
 	},
 	{
 		probe: "pipx",
@@ -92,6 +105,10 @@ export const PYTHON_CLI_INSTALLERS: readonly PythonCliInstaller[] = [
 		// manage the package.
 		upgrade: (pkg) => ({ cmd: "pipx", args: ["install", "--force", pkg] }),
 		uninstall: (pkg) => ({ cmd: "pipx", args: ["uninstall", pkg] }),
+		pin: (pkg, version) => ({
+			cmd: "pipx",
+			args: ["install", "--force", `${pkg}==${version}`],
+		}),
 	},
 	{
 		probe: "python3",
@@ -114,6 +131,10 @@ export const PYTHON_CLI_INSTALLERS: readonly PythonCliInstaller[] = [
 			cmd: "python3",
 			args: ["-m", "pip", "uninstall", "-y", pkg],
 		}),
+		pin: (pkg, version) => ({
+			cmd: "python3",
+			args: ["-m", "pip", "install", "--user", `${pkg}==${version}`],
+		}),
 	},
 ];
 
@@ -295,6 +316,82 @@ export function binUpgradeCommand(
 	}
 }
 
+/**
+ * The command that moves an ALREADY-INSTALLED binary to exactly its pin.
+ *
+ * `claudeup update` plans a pinned tool that sits below its pin as an upgrade
+ * TO the pin, and neither of the other two builders delivers that:
+ * {@link binUpgradeCommand} goes to the newest version, past the pin, and a
+ * plain `uv tool install pkg==v` is a no-op once any version is installed.
+ *
+ * bun, npm and go take the version in the same token `binInstallCommand` builds
+ * (`pkg@v`), and each replaces an installed version with it. pip goes through
+ * the resolved installer's own `pin`. brew installs only its newest version, so
+ * there is nothing to return — the planner never asks for it (a brew pin below
+ * the installed version is reported, not planned).
+ *
+ * Null also when the requirement carries no pin.
+ */
+export function binPinCommand(
+	bin: {
+		name: string;
+		via: BinInstaller;
+		package?: string;
+		formula?: string;
+		module?: string;
+		version?: string;
+	},
+	python: PythonCliInstaller = resolvePythonCliInstaller(),
+): Command | null {
+	if (!bin.version) return null;
+	switch (bin.via) {
+		case "bun":
+		case "npm":
+		case "go":
+			return binInstallCommand(bin, python);
+		case "pip":
+			return python.pin(bin.package ?? bin.name, bin.version);
+		case "brew":
+			return null;
+	}
+}
+
+/**
+ * Which of the three builders a requirement in a given state needs.
+ *
+ * THE one rule that turns a state into a command, so a front end cannot show
+ * one target and run another. It was written twice before: `binCommandFor`
+ * (`update-engine.ts`) for `claudeup update`, and the CLI Tools screen's row,
+ * which always built `@latest` — so a row reading `→ v9.0.0` (the pin) ran
+ * `bun install -g pkg@latest` and left the tool permanently ahead of its pin,
+ * a state claudeup cannot leave. Both now come through here.
+ *
+ * `install` → {@link binInstallCommand} (which appends the pin, when there is
+ * one). An upgrade whose target IS the pin → {@link binPinCommand}, because
+ * {@link binUpgradeCommand} would overshoot it. Any other upgrade → the newest
+ * version.
+ *
+ * Null only when no sound command exists: a pinned brew formula, where brew
+ * installs its newest version and nothing else (the pin is advisory).
+ */
+export function binCommandForState(
+	state: "install" | "upgrade",
+	target: string | null,
+	bin: {
+		name: string;
+		via: BinInstaller;
+		package?: string;
+		formula?: string;
+		module?: string;
+		version?: string;
+	},
+	python: PythonCliInstaller = resolvePythonCliInstaller(),
+): Command | null {
+	if (state === "install") return binInstallCommand(bin, python);
+	if (bin.version && target === bin.version) return binPinCommand(bin, python);
+	return binUpgradeCommand(bin, python);
+}
+
 /**
  * The command that REMOVES an installed binary.
  *

package/src/services/update-engine.ts

@@ -30,7 +30,11 @@
  */
 
 import path from "node:path";
-import type { ProfileSkillRef, SkillInfo } from "../types/index.js";
+import type {
+	ProfileSkillRef,
+	ResolvedBin,
+	SkillInfo,
+} from "../types/index.js";
 import type { Command } from "../utils/command-utils.js";
 import { formatCommand } from "../utils/command-utils.js";
 import { runCommand } from "../utils/run.js";
@@ -41,14 +45,34 @@ import {
 	saveInstalledPluginVersionForScope,
 } from "./plugin-manager.js";
 import { installSkill } from "./skills-manager.js";
-import { binInstallCommand, binUpgradeCommand } from "./toolchain.js";
-import type { PluginUpdateItem, UpdatePlan } from "./update-plan.js";
+import {
+	type ToolFacts,
+	compareToolVersions,
+	probeTool,
+} from "./tool-probe.js";
+import { binCommandForState } from "./toolchain.js";
+import {
+	type BinUpdateItem,
+	type PluginUpdateItem,
+	type UpdatePlan,
+	binNeedsWork,
+} from "./update-plan.js";
 
 // -- results -----------------------------------------------------------------
 
 export interface ApplyResult {
+	/** Items that CHANGED — the installer exited 0 and read-back shows movement. */
 	ok: number;
 	failed: string[];
+	/**
+	 * Items whose installer exited 0 but whose read-back shows nothing moved.
+	 *
+	 * Not a failure, and not a change. A stale tap, a PATH that still resolves
+	 * an older copy, a marketplace clone behind its catalog — each "succeeds",
+	 * lands on the same version, and is planned identically next run. Counting
+	 * those as changed is how "3 changed" was printed on every run forever.
+	 */
+	unchanged: string[];
 }
 
 /** An exact pin the installer could not deliver, discovered by reading back. */
@@ -70,6 +94,8 @@ export interface UpdateOutcome {
 	skills: ApplyResult;
 	/** Items that changed, across all three. */
 	changed: number;
+	/** Names whose installer exited 0 but read-back shows no movement. */
+	unchanged: string[];
 	/** Names that failed, across all three. */
 	failed: string[];
 }
@@ -158,10 +184,9 @@ export const REAL_PLUGIN_DEPS: PluginApplyDeps = {
  * scope, matching `install`: a profile is a property of one repo, so its
  * plugins must not be enabled machine-wide.
  *
- * Every scope holding an outdated install is returned, not just one. The
- * prerunner learned this the expensive way: it detected drift, "fixed" it at
- * user scope and reported success, leaving the project row untouched so the
- * same drift reappeared on every run.
+ * Every scope holding an outdated install is returned, not just one. Fixing a
+ * single hardcoded scope does not converge: it reports success while the
+ * project row stays untouched, so the same drift reappears on the next run.
  */
 function scopesToApply(item: PluginUpdateItem): PluginScope[] {
 	if (item.action === "current" || item.action === "unknown") return [];
@@ -219,13 +244,51 @@ async function advanceInScope(
 	else await deps.install(pluginId, scope);
 }
 
+/**
+ * Why nothing moved for `item`, judged by READ-BACK; null when something did.
+ *
+ * No installer output is parsed — "already at the latest version" is
+ * locale- and version-fragile. The registry row the apply loop already reads
+ * back is compared with the before-version the plan carries:
+ *  - update: every touched scope reads back exactly what it held before;
+ *  - install: no touched scope reads back any version at all;
+ *  - repair: never — same version is its definition; the files moved.
+ */
+function pluginNoMove(
+	item: PluginUpdateItem,
+	landed: ReadonlyArray<[PluginScope, string | null]>,
+): string | null {
+	if (landed.length === 0) return null;
+	if (item.action === "update") {
+		const same = landed.every(
+			([scope, actual]) => (actual ?? undefined) === item.beforeVersions[scope],
+		);
+		if (!same) return null;
+		const v = landed.find(([, a]) => a)?.[1];
+		return v
+			? `the installer exited 0 but ${item.pluginId} is still ${v}`
+			: `the installer exited 0 but no version of ${item.pluginId} was recorded`;
+	}
+	if (item.action === "install") {
+		return landed.every(([, actual]) => actual === null)
+			? `the installer exited 0 but no version of ${item.pluginId} was recorded`
+			: null;
+	}
+	return null;
+}
+
 export async function applyPlugins(
 	items: PluginUpdateItem[],
 	projectPath: string,
 	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
 	report: ApplyReporter = SILENT_REPORTER,
 ): Promise<PluginApplyResult> {
-	const result: PluginApplyResult = { ok: 0, failed: [], mismatches: [] };
+	const result: PluginApplyResult = {
+		ok: 0,
+		failed: [],
+		unchanged: [],
+		mismatches: [],
+	};
 
 	for (const item of items) {
 		const scopes = scopesToApply(item);
@@ -233,6 +296,7 @@ export async function applyPlugins(
 
 		report.begin(item.pluginId);
 		const startedAt = Date.now();
+		const landed: Array<[PluginScope, string | null]> = [];
 
 		try {
 			for (const scope of scopes) {
@@ -268,6 +332,7 @@ export async function applyPlugins(
 					scope,
 					projectPath,
 				);
+				landed.push([scope, actual]);
 				if (actual) {
 					await deps.saveInstalled(item.pluginId, actual, scope, projectPath);
 				}
@@ -280,13 +345,24 @@ export async function applyPlugins(
 					});
 				}
 			}
-			report.finish(
-				true,
-				item.pluginId,
-				`${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`,
-				Date.now() - startedAt,
-			);
-			result.ok++;
+			const noMove = pluginNoMove(item, landed);
+			if (noMove) {
+				report.finish(
+					true,
+					item.pluginId,
+					`no change — ${noMove}`,
+					Date.now() - startedAt,
+				);
+				result.unchanged.push(item.pluginId);
+			} else {
+				report.finish(
+					true,
+					item.pluginId,
+					`${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`,
+					Date.now() - startedAt,
+				);
+				result.ok++;
+			}
 		} catch (error) {
 			const msg = error instanceof Error ? error.message : String(error);
 			report.finish(false, item.pluginId, msg, Date.now() - startedAt);
@@ -369,6 +445,74 @@ export async function updatePluginInScope(
 
 // -- binaries ----------------------------------------------------------------
 
+/**
+ * The command a bin item runs, or null when it is not work.
+ *
+ * The state→command rule itself is {@link binCommandForState}, shared with the
+ * TUI's CLI Tools row so the two front ends cannot run different commands for
+ * the same row. The CLI's plan report renders this same function, so what it
+ * shows is what runs.
+ */
+export function binCommandFor(
+	item: BinUpdateItem,
+	spec: ResolvedBin,
+): Command | null {
+	if (!binNeedsWork(item)) return null;
+	return binCommandForState(
+		item.action === "install" ? "install" : "upgrade",
+		item.target,
+		spec,
+	);
+}
+
+/**
+ * Why nothing moved for a bin, judged by RE-PROBING it; null when it moved.
+ *
+ * The re-probe resolves PATH again, so it reads the binary that runs NOW —
+ * which is what catches the no-ops planning cannot see: a stale brew tap, an
+ * installer that wrote a copy PATH does not resolve, `~/.bun/bin` missing from
+ * PATH. Versions are compared with the same comparator the planner used,
+ * because before and after can come from different sources ("v0.13.10" from
+ * `uv tool list` against "0.13.10").
+ *
+ * A read-back that cannot read a version is NOT a no-op: failing to read is not
+ * evidence nothing changed, and saying so would turn every go-less machine's
+ * upgrade into a warning.
+ */
+function binNoMove(item: BinUpdateItem, after: ToolFacts): string | null {
+	if (item.action === "install" && !after.present) {
+		return `the installer exited 0 but ${item.name} is still not on PATH`;
+	}
+	if (after.managed === false) {
+		return `installed, but PATH still runs ${after.resolvedPath ?? "another copy"}`;
+	}
+	if (
+		item.action === "upgrade" &&
+		after.installed !== null &&
+		item.installed !== null &&
+		compareToolVersions(after.installed, item.installed) === 0
+	) {
+		return `the installer exited 0 but ${item.name} is still ${after.installed}`;
+	}
+	return null;
+}
+
+/**
+ * The read-back probe, and the ONLY caller that lets the probe run a tool's
+ * `check` command.
+ *
+ * Planning never does: `check` comes from a marketplace `plugin.json`, and
+ * `--dry-run` / `--check` must execute nothing a catalogue supplied. Here the
+ * installer for this very tool has just run with the user's consent, and the
+ * probe's own narrowing means the only argv that can run is the tool asking
+ * itself its version (`tool-probe.ts`, `versionFromCheck`). Without it a tool
+ * whose installer keeps no readable record reads back as "version unknown",
+ * which R6 counts as changed — the safe answer, but never "no change — still
+ * 3.7c", the one the user needs.
+ */
+const REAL_READ_BACK = (spec: ResolvedBin): Promise<ToolFacts> =>
+	probeTool(spec, undefined, { allowCheckCommand: true });
+
 export async function applyBins(
 	plan: UpdatePlan,
 	report: ApplyReporter = SILENT_REPORTER,
@@ -377,30 +521,69 @@ export async function applyBins(
 	// as an invitation to hand it a string. It takes argv, and nothing here
 	// builds a shell line.
 	run: (command: Command) => Promise<boolean> = runCommand,
+	/** Read-back seam: re-probe ONE tool after its installer ran. */
+	probe: (spec: ResolvedBin) => Promise<ToolFacts> = REAL_READ_BACK,
 ): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
+	const result: ApplyResult = { ok: 0, failed: [], unchanged: [] };
 	for (const item of plan.bins) {
-		if (item.action === "current") continue;
+		// The SAME predicate planWorkItems and planHasWork use. Skipping only
+		// `current` here would apply an `unknown` — "cannot tell" run as an
+		// upgrade.
+		if (!binNeedsWork(item)) continue;
 		const bin = plan.binSpecs.get(item.name);
 		if (!bin) continue;
-		const cmd =
-			item.action === "install"
-				? binInstallCommand(bin)
-				: binUpgradeCommand(bin);
 		report.begin(item.name);
 		const startedAt = Date.now();
+		const cmd = binCommandFor(item, bin);
+		if (!cmd) {
+			// Unreachable from the planner (a brew pin is never planned as work),
+			// but the meter counted this item, so it must finish.
+			report.finish(
+				false,
+				item.name,
+				`no command can move ${bin.via} to ${item.target ?? "the pin"}`,
+				Date.now() - startedAt,
+			);
+			result.failed.push(item.name);
+			continue;
+		}
 		// The installer owns the terminal for the duration: it streams its own
 		// output through inherited stdio.
 		const succeeded = await report.detach(() => run(cmd));
+		if (!succeeded) {
+			report.finish(
+				false,
+				item.name,
+				formatCommand(cmd),
+				Date.now() - startedAt,
+			);
+			result.failed.push(item.name);
+			continue;
+		}
+		let noMove: string | null = null;
+		try {
+			noMove = binNoMove(item, await probe(bin));
+		} catch {
+			// Could not read back: not evidence of a no-op.
+		}
 		// The reporter renders; only the argv above is executed.
-		report.finish(
-			succeeded,
-			item.name,
-			formatCommand(cmd),
-			Date.now() - startedAt,
-		);
-		if (succeeded) result.ok++;
-		else result.failed.push(item.name);
+		if (noMove) {
+			report.finish(
+				true,
+				item.name,
+				`no change — ${noMove}`,
+				Date.now() - startedAt,
+			);
+			result.unchanged.push(item.name);
+		} else {
+			report.finish(
+				true,
+				item.name,
+				formatCommand(cmd),
+				Date.now() - startedAt,
+			);
+			result.ok++;
+		}
 	}
 	return result;
 }
@@ -432,7 +615,7 @@ export async function applySkills(
 	report: ApplyReporter = SILENT_REPORTER,
 	install: typeof installSkill = installSkill,
 ): Promise<ApplyResult> {
-	const result: ApplyResult = { ok: 0, failed: [] };
+	const result: ApplyResult = { ok: 0, failed: [], unchanged: [] };
 	for (const item of plan.skills) {
 		report.begin(item.name);
 		const startedAt = Date.now();
@@ -456,6 +639,8 @@ export interface ApplyPlanOptions {
 	report?: ApplyReporter;
 	/** Installer execution seam — see the note on {@link applyBins}. */
 	run?: (command: Command) => Promise<boolean>;
+	/** Read-back seam — see {@link applyBins}. Default: `probeTool(spec)`. */
+	probe?: (spec: ResolvedBin) => Promise<ToolFacts>;
 }
 
 /**
@@ -478,14 +663,17 @@ export async function applyPlan(
 		opts.deps ?? REAL_PLUGIN_DEPS,
 		report,
 	);
-	const bins = await applyBins(plan, report, opts.run);
+	const bins = await applyBins(plan, report, opts.run, opts.probe);
 	const skills = await applySkills(plan, projectPath, report);
 
 	return {
 		plugins,
 		bins,
 		skills,
+		// `ok` counts only items read-back shows moved, so a no-op installer
+		// run is never "changed".
 		changed: plugins.ok + bins.ok + skills.ok,
+		unchanged: [...plugins.unchanged, ...bins.unchanged, ...skills.unchanged],
 		failed: [...plugins.failed, ...bins.failed, ...skills.failed],
 	};
 }
@@ -497,7 +685,7 @@ export async function applyPlan(
 export function planWorkItems(plan: UpdatePlan): string[] {
 	return [
 		...plan.plugins.filter(pluginNeedsWork).map((p) => p.pluginId),
-		...plan.bins.filter((b) => b.action !== "current").map((b) => b.name),
+		...plan.bins.filter(binNeedsWork).map((b) => b.name),
 		...plan.skills.map((s) => s.name),
 	];
 }