magus-cli 7.0.0 → 7.2.0

package/src/__tests__/profile-startup.test.ts

@@ -0,0 +1,458 @@
+/**
+ * What magus requires about profiles before it will work on a project.
+ *
+ * Two behaviours are pinned here, and both were defects:
+ *
+ *  1. The TUI could show a Profiles tab listing two profiles while the project
+ *     ran neither, and say nothing.
+ *  2. Both surfaces offered a way to carry on anyway — the TUI as a "Not now"
+ *     row, the CLI as "using X for this run only". With no active profile there
+ *     is no profile state to read and nowhere to write updates, so that let the
+ *     user into a magus that could not do its job.
+ *
+ * And one thing is pinned by its ABSENCE: nothing compares the manifest to
+ * `enabledPlugins`. See the header of `services/profile-startup.ts`.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import fs from "fs-extra";
+import { validateManifest } from "../services/manifest.js";
+import { materializeAndActivate } from "../services/profile-activate.js";
+import { adoptCurrentProject } from "../services/profile-adopt.js";
+import {
+	ACTIVATE_PREFIX,
+	ADOPT_VALUE,
+	QUIT_VALUE,
+	buildProfileOptions,
+	defaultOptionIndex,
+	describeNeed,
+	detectProfileStartupNeed,
+	needsNothing,
+	parseProfileChoice,
+} from "../services/profile-startup.js";
+import { listProfiles } from "../services/profiles.js";
+import type { ProfileManifest } from "../types/index.js";
+import {
+	buildProfileStartupModal,
+	describeFailure,
+} from "../ui/hooks/useProfileStartupModal.js";
+
+const LEAN: ProfileManifest = {
+	version: 2,
+	profiles: {
+		lean: { name: "Lean", plugins: { "terminal@magus": "latest" } },
+		full: {
+			name: "Full",
+			plugins: { "terminal@magus": "latest", "dev@magus": "latest" },
+		},
+	},
+};
+
+async function enable(project: string, ids: string[]): Promise<void> {
+	await fs.outputJson(join(project, ".claude", "settings.json"), {
+		enabledPlugins: Object.fromEntries(ids.map((id) => [id, true])),
+	});
+}
+
+describe("detectProfileStartupNeed", () => {
+	let project: string;
+	beforeEach(async () => {
+		project = await mkdtemp(join(tmpdir(), "startup-"));
+	});
+	afterEach(async () => {
+		await rm(project, { recursive: true, force: true });
+	});
+
+	test("no manifest — unmigrated, offers to adopt, nothing to activate", async () => {
+		await enable(project, ["dev@magus"]);
+
+		const need = await detectProfileStartupNeed(project);
+
+		expect(need.state).toBe("unmigrated");
+		expect(need.adopt).toBe("default");
+		expect(need.activate).toEqual([]);
+		expect(needsNothing(need)).toBe(false);
+	});
+
+	test("profiles but none active — inactive, offers both routes", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), LEAN);
+		await enable(project, ["terminal@magus"]);
+
+		const need = await detectProfileStartupNeed(project);
+
+		expect(need.state).toBe("inactive");
+		expect(need.activate.map((p) => p.id).sort()).toEqual(["full", "lean"]);
+		// Adopting stays available so a manifest full of stale profiles is not a
+		// dead end where activating a wrong one is the only way forward.
+		expect(need.adopt).toBe("default");
+	});
+
+	test("a profile is active — asks nothing, whatever is enabled", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), LEAN);
+		await enable(project, ["terminal@magus"]);
+		await materializeAndActivate(LEAN, "lean", project, () => {});
+
+		expect(
+			needsNothing(await detectProfileStartupNeed(project)).valueOf(),
+		).toBe(true);
+	});
+
+	test("an active profile whose generated settings were edited still asks nothing", async () => {
+		// THE point of dropping the comparison. `settings.json` is a symlink into
+		// `_profiles/lean/`, which is generated FROM the manifest — so judging the
+		// manifest against it reads the manifest's own output. The old code offered
+		// to create a third profile describing the corrupted file; the right answer
+		// is to re-materialize, and the wrong answer is what made magus behave as
+		// though the profileless world were still live.
+		await fs.outputJson(join(project, ".claude", "profiles.json"), LEAN);
+		await enable(project, ["terminal@magus"]);
+		await materializeAndActivate(LEAN, "lean", project, () => {});
+		await fs.outputJson(
+			join(project, ".claude", "_profiles", "lean", "settings.json"),
+			{ enabledPlugins: { "terminal@magus": true, "brand-new@magus": true } },
+		);
+
+		const need = await detectProfileStartupNeed(project);
+
+		expect(need.state).toBe("ok");
+		expect(need.adopt).toBeNull();
+	});
+
+	test("what is enabled never changes the answer", async () => {
+		// Nothing reads enabledPlugins, so two wildly different settings files on
+		// the same manifest must produce identical needs.
+		await fs.outputJson(join(project, ".claude", "profiles.json"), LEAN);
+
+		await enable(project, ["terminal@magus"]);
+		const matching = await detectProfileStartupNeed(project);
+		await enable(project, ["nothing-any-profile-declares@magus"]);
+		const mismatching = await detectProfileStartupNeed(project);
+
+		expect(mismatching.state).toBe(matching.state);
+		expect(mismatching.adopt).toBe(matching.adopt);
+		expect(mismatching.activate).toEqual(matching.activate);
+	});
+
+	test("listProfiles marks the active profile, and only that one", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), LEAN);
+		await enable(project, ["terminal@magus"]);
+
+		const before = await listProfiles(project);
+		expect(before.every((p) => p.active !== true)).toBe(true);
+
+		await materializeAndActivate(LEAN, "lean", project, () => {});
+		const after = await listProfiles(project);
+
+		expect(after.find((p) => p.id === "lean")?.active).toBe(true);
+		expect(after.find((p) => p.id === "full")?.active).toBe(false);
+	});
+
+	test("a declared default is applied without asking on a fresh clone", async () => {
+		// The whole point of the field: the repo already answered, and there is
+		// nothing of this developer's to replace, so nobody is asked.
+		await fs.outputJson(join(project, ".claude", "profiles.json"), {
+			...LEAN,
+			default: "full",
+		});
+		// No settings.json, no .mcp.json — nothing activation would displace.
+
+		const need = await detectProfileStartupNeed(project);
+
+		expect(need.state).toBe("inactive");
+		expect(need.declaredDefault).toBe("full");
+		expect(need.autoActivate).toBe(true);
+	});
+
+	test("a declared default is NOT applied when there is work to replace", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), {
+			...LEAN,
+			default: "full",
+		});
+		await enable(project, ["dev@magus"]);
+
+		const need = await detectProfileStartupNeed(project);
+
+		// Still declared, so it is preselected — but never automatic. Replacing
+		// someone's working files does not happen without them saying so.
+		expect(need.declaredDefault).toBe("full");
+		expect(need.autoActivate).toBe(false);
+	});
+
+	test("a default naming a profile that does not exist falls back to asking", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), {
+			...LEAN,
+			default: "renamed-away",
+		});
+
+		const need = await detectProfileStartupNeed(project);
+
+		// validateManifest reports the typo; detection must stay usable meanwhile
+		// rather than auto-activating a profile that is not there.
+		expect(need.declaredDefault).toBeNull();
+		expect(need.autoActivate).toBe(false);
+	});
+
+	test("adopting records the default, and never overwrites one", async () => {
+		await enable(project, ["dev@magus"]);
+
+		const first = await adoptCurrentProject(
+			project,
+			undefined,
+			undefined,
+			"default",
+		);
+		expect(first.manifest.default).toBe("default");
+
+		// A second adoption into a manifest that already declares one must leave
+		// the team's committed choice alone — one developer saving local state is
+		// not a decision about what everyone else gets.
+		const second = await adoptCurrentProject(
+			project,
+			undefined,
+			{ ...LEAN, default: "lean" },
+			"default",
+		);
+		expect(second.manifest.default).toBe("lean");
+	});
+
+	test("adopt never proposes an id that already exists", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), {
+			version: 2,
+			profiles: {
+				default: { name: "Default", plugins: { "terminal@magus": "latest" } },
+			},
+		});
+		await enable(project, ["something-else@magus"]);
+
+		expect((await detectProfileStartupNeed(project)).adopt).toBe("default-2");
+	});
+});
+
+describe("what the user is offered", () => {
+	const manifest = LEAN;
+	const unmigrated = {
+		state: "unmigrated" as const,
+		adopt: "default",
+		activate: [],
+		manifest: { version: 2 as const, profiles: {} },
+	};
+	const inactive = {
+		state: "inactive" as const,
+		adopt: "default",
+		activate: [
+			{ id: "lean", name: "Lean", pluginCount: 1 },
+			{ id: "full", name: "Full", pluginCount: 2 },
+		],
+		manifest,
+	};
+
+	test("there is NO way to carry on without a profile", () => {
+		for (const need of [unmigrated, inactive]) {
+			const values = buildProfileOptions(need).map((o) => o.value);
+			// The old "Not now" / "for this run only" escape. Its absence is the
+			// behaviour, so it is asserted rather than assumed.
+			expect(values).not.toContain("dismiss");
+			// ...but leaving must always be reachable, and visibly so.
+			expect(values[values.length - 1]).toBe(QUIT_VALUE);
+		}
+	});
+
+	test("no option claims to know what is currently installed", () => {
+		// The "matches now" badge compared declared plugins against enabled ones.
+		// It is gone with the comparison; a row may only describe its own profile.
+		for (const option of buildProfileOptions(inactive)) {
+			expect(option.badge).toBeUndefined();
+		}
+	});
+
+	test("activate rows carry the profile's own plugin count", () => {
+		const options = buildProfileOptions(inactive);
+		expect(options[1]?.meta).toBe("1 plugin");
+		expect(options[2]?.meta).toBe("2 plugins");
+	});
+
+	test("each state is titled as the thing that is actually wrong", () => {
+		expect(describeNeed(unmigrated).title).toBe("magus uses profiles");
+		expect(describeNeed(inactive).title).toBe("No profile selected");
+	});
+
+	test("the unmigrated message reassures instead of warning", () => {
+		// Adopting an unmigrated project captures what is already present, so it
+		// must NOT carry the overwrite warning the inactive state needs.
+		const { message } = describeNeed(unmigrated);
+
+		expect(message).toContain("nothing about what you run changes");
+		expect(message).not.toContain("overwritten");
+	});
+
+	test("the inactive message names what is lost, in concrete terms", () => {
+		// Two defects this replaced. It explained magus's internals ("the manifest
+		// is not in effect", "nowhere to write updates"), and then it went abstract
+		// ("the setup you are running belongs to no profile") — neither said that
+		// switching OVERWRITES the plugins and skills currently turned on, which is
+		// the only fact that makes the save option worth choosing.
+		const { message } = describeNeed(inactive);
+
+		expect(message).toContain("plugins and skills turned on here");
+		expect(message).toContain("not saved in any profile");
+		expect(message).toContain("overwritten");
+
+		// Neither the internal vocabulary nor the abstraction comes back. "backup"
+		// is banned here too: promising that nothing is deleted raises a question
+		// the reader did not have and implies data loss, when what changes is
+		// settings. Where the files went is reported AFTER the switch instead.
+		for (const banned of [
+			"manifest",
+			"profile state",
+			"declares profiles",
+			"setup",
+			"belongs to",
+			"backup",
+			"deleted",
+		]) {
+			expect(message).not.toContain(banned);
+		}
+	});
+
+	test("the declared profile's row is the one under the cursor", () => {
+		const withDefault = { ...inactive, declaredDefault: "full" };
+		// options: [save, Activate Lean, Activate Full, Quit]
+		expect(defaultOptionIndex(withDefault)).toBe(2);
+
+		// Nothing declared: start on the save row, the only option that keeps
+		// what is turned on.
+		expect(defaultOptionIndex(inactive)).toBe(0);
+		// Declared but absent from the offered list — never point past the end.
+		expect(defaultOptionIndex({ ...inactive, declaredDefault: "ghost" })).toBe(
+			0,
+		);
+	});
+
+	test("a default naming no profile is a manifest error", () => {
+		const errors = validateManifest({ ...LEAN, default: "ghost" });
+		expect(errors.map((e) => e.path)).toContain("default");
+
+		// A valid one is not.
+		expect(validateManifest({ ...LEAN, default: "lean" })).toEqual([]);
+	});
+
+	test("the save option says what it preserves", () => {
+		// "Create <id> from this project" described the mechanism. The reason to
+		// pick this row is that it is the only one that keeps what is turned on.
+		expect(buildProfileOptions(inactive)[0]?.label).toBe(
+			'Save what you have as "default"',
+		);
+	});
+
+	test("a value maps to the action it names", () => {
+		expect(parseProfileChoice(ADOPT_VALUE, inactive)).toEqual({
+			kind: "adopt",
+			id: "default",
+		});
+		expect(parseProfileChoice(`${ACTIVATE_PREFIX}lean`, inactive)).toEqual({
+			kind: "activate",
+			id: "lean",
+		});
+		expect(parseProfileChoice(QUIT_VALUE, inactive)).toBeNull();
+	});
+
+	test("a value that names nothing real cannot act", () => {
+		// adopt with nothing to adopt, and activate naming a profile not offered.
+		expect(
+			parseProfileChoice(ADOPT_VALUE, { ...inactive, adopt: null }),
+		).toBeNull();
+		expect(parseProfileChoice(`${ACTIVATE_PREFIX}ghost`, inactive)).toBeNull();
+	});
+});
+
+describe("a failure that already moved something", () => {
+	const at = (name: string) => ({
+		link: `/p/.claude/${name}`,
+		savedTo: `/p/.claude/.magus-backups/S/${name}`,
+	});
+
+	test("a true no-op says so", () => {
+		const msg = describeFailure(new Error("boom"), [], "/p", null);
+		expect(msg).toContain("boom");
+		expect(msg).toContain("exactly as it was");
+	});
+
+	test("a partial failure never claims nothing happened", () => {
+		// Activation moves up to four artifacts in sequence and settings.json goes
+		// FIRST, so a throw on the second leaves it already in the backup. The old
+		// message said "Nothing was activated" unconditionally — false about the
+		// user's own file, and `.magus-backups/` is gitignored, so git status
+		// showed the deletion with no sign of the copy.
+		const msg = describeFailure(
+			new Error("EACCES: skills"),
+			[at("settings.json")],
+			"/p",
+			"lean",
+		);
+
+		expect(msg).not.toContain("Nothing was moved");
+		expect(msg).not.toContain("exactly as it was");
+		// It must name where the file went, project-relative.
+		expect(msg).toContain(".claude/settings.json");
+		expect(msg).toContain(".claude/.magus-backups/S/settings.json");
+	});
+
+	test("it warns against the re-attempt that would capture an empty set", () => {
+		// Re-choosing save-what-you-have runs adoption again, and adoption reads
+		// settings.json — now in the backup. It would capture an empty plugin set
+		// into a second profile and call that the user's setup.
+		const msg = describeFailure(
+			new Error("boom"),
+			[at("settings.json")],
+			"/p",
+			"lean",
+		);
+
+		expect(msg).toContain("Do NOT save-what-you-have");
+		expect(msg).toContain("Activating lean again is safe");
+	});
+});
+
+describe("the TUI modal", () => {
+	const inactive = {
+		state: "inactive" as const,
+		adopt: "default",
+		activate: [{ id: "lean", name: "Lean", pluginCount: 1 }],
+		manifest: LEAN,
+	};
+
+	test("escape and q do nothing — they cannot dismiss it", () => {
+		const calls: string[] = [];
+		const modal = buildProfileStartupModal({
+			need: inactive,
+			onChoose: (c) => calls.push(`${c.kind}:${c.id}`),
+			onQuit: () => calls.push("quit"),
+		});
+
+		if (modal.type !== "select") throw new Error("expected a select modal");
+		// ModalContainer routes both Escape and `q` here. Neither may leave the
+		// user in the app this modal exists to say is unusable.
+		modal.onCancel();
+
+		expect(calls).toEqual([]);
+	});
+
+	test("choosing routes to the action, quitting routes to quit", () => {
+		const calls: string[] = [];
+		const modal = buildProfileStartupModal({
+			need: inactive,
+			onChoose: (c) => calls.push(`${c.kind}:${c.id}`),
+			onQuit: () => calls.push("quit"),
+		});
+
+		if (modal.type !== "select") throw new Error("expected a select modal");
+		modal.onSelect(ADOPT_VALUE);
+		modal.onSelect(`${ACTIVATE_PREFIX}lean`);
+		modal.onSelect(QUIT_VALUE);
+
+		expect(calls).toEqual(["adopt:default", "activate:lean", "quit"]);
+	});
+});

package/src/__tests__/theme-env.test.ts

@@ -278,4 +278,33 @@ describe("main.tsx order", () => {
 		}
 		expect(code).toMatch(/env:\s*themeEnv\b/);
 	});
+
+	// T-env-3 and T-env-3b guard main.tsx, and main.tsx ALONE — which is exactly
+	// how this escaped. The CLI report's theme resolution was added in router.ts
+	// and called `snapshotThemeEnv()` there, a second snapshot taken from inside
+	// `route()`, long after `loadProjectDotenv()` merged the project's .env into
+	// process.env. A checked-out repo could set the palette for every subcommand
+	// while both tests above stayed green.
+	//
+	// The rule generalises: main.tsx owns the snapshot because it is the only
+	// code that runs before the dotenv load. Everything downstream is HANDED the
+	// value.
+	test("T-env-3c: no module downstream of the dotenv load takes its own snapshot", () => {
+		const downstream = ["cli/router.ts", "cli/update.ts", "cli/doctor.ts"];
+		for (const rel of downstream) {
+			const src = stripComments(
+				readFileSync(path.join(import.meta.dir, "..", rel), "utf-8"),
+			);
+			expect({ rel, calls: /snapshotThemeEnv\s*\(/.test(src) }).toEqual({
+				rel,
+				calls: false,
+			});
+		}
+	});
+
+	test("T-env-3d: main.tsx hands its snapshot to route()", () => {
+		// Without this the router falls back to "no opinion" and every subcommand
+		// silently reverts to the dark default on a light terminal.
+		expect(code).toMatch(/route\([^)]*themeEnv[^)]*\)/);
+	});
 });

package/src/__tests__/update-plan.test.ts

@@ -403,11 +403,19 @@ describe("per-scope decisions — a stale scope is never masked", () => {
 		expect(item.reason).toBe("up-to-date");
 	});
 
-	test("an installed plugin whose catalog declares no version is 'unknown'", () => {
-		// This fixture puts dev@magus IN the catalog with a null version, so it is
-		// the declares-no-version case, not the withdrawn one — the assertion used
-		// to say "not offered", which is what conflated them. 278 of the 292
-		// plugins in claude-plugins-official are in exactly this state.
+	// REVERSES an earlier decision, deliberately. This used to be `unknown` with
+	// a note reading "publishes no version", which put 278 of the 292 plugins in
+	// claude-plugins-official into a warning state that no action could ever
+	// clear: the marketplace does not publish versions, so re-running changes
+	// nothing and the row stays amber forever.
+	//
+	// The rule now is: if we cannot compare, assume what is installed is the
+	// latest. The machine code still says WHY (`no-published-version`), so the
+	// distinction is not lost — it just stops being reported as a problem. Do not
+	// "fix" this back without changing that rule first.
+	test("a catalog that declares no version leaves the install current", () => {
+		// dev@magus is IN the catalog with a null version — the declares-no-version
+		// case, not the withdrawn one.
 		const [item] = planPluginUpdates(
 			{ "dev@magus": "latest" },
 			catalog(
@@ -418,9 +426,12 @@ describe("per-scope decisions — a stale scope is never masked", () => {
 				}),
 			),
 		);
-		expect(item.action).toBe("unknown");
-		expect(item.note).toContain("publishes no version");
+		expect(item.action).toBe("current");
 		expect(item.reason).toBe("no-published-version");
+		// No note: there is nothing for the reader to do about it.
+		expect(item.note).toBeUndefined();
+		// And it is not confused with the withdrawn case, which is the next test.
+		expect(item.reason).not.toBe("not-offered");
 	});
 
 	test("an installed plugin ABSENT from every catalog is 'not offered'", () => {
@@ -919,14 +930,13 @@ describe("planHasWork / summarizePlan", () => {
 	test("unknown splits into plugins and tools, and the total is their sum", () => {
 		const p = plan({
 			plugins: planPluginUpdates(
+				// `a@magus` is an ORPHAN — no marketplace offers it — which is the
+				// one remaining way a plugin is genuinely `unknown`. A catalog that
+				// merely declares no version is `current` now, so using that here
+				// would leave `unknownPlugins` at 0 and the sum would hold
+				// trivially, testing nothing.
 				{ "a@magus": "latest" },
-				catalog(
-					info({
-						id: "a@magus",
-						version: null,
-						projectScope: { enabled: true, version: "abc123" },
-					}),
-				),
+				catalog(orphan("a@magus", "1.0.0")),
 			),
 			bins: planBinUpdates(
 				[
@@ -991,19 +1001,24 @@ describe("classifyPlugin — an orphan is never 'current'", () => {
 		expect(item.scopes).toEqual([]);
 	});
 
-	test("an orphan another marketplace publishes is 'moved', naming it", () => {
+	// `moved` is GONE, and `movedTo` with it. It was inferred from a bare name
+	// match: a plugin published to two marketplaces — claudish is — reported
+	// "moved → magus" when nothing had moved and both copies were installed.
+	// The inference cannot tell a move from a dual publication, so it is not made
+	// at all. An orphan is `not-offered`, which is a fact rather than a guess.
+	test("an orphan is 'not offered', and never guesses where it went", () => {
 		const [item] = planPluginUpdates(
 			{ "seo@magus": "latest" },
 			catalog(
-				orphan("seo@magus", "1.8.0", { movedTo: "magus-marketing" }),
+				orphan("seo@magus", "1.8.0"),
 				info({ id: "dev@magus", version: "4.7.0" }),
 			),
 		);
 		expect(item).toMatchObject({
 			action: "unknown",
-			reason: "moved",
-			note: "moved to magus-marketing",
+			reason: "not-offered",
 		});
+		expect(item.note).not.toMatch(/moved/i);
 	});
 
 	test("an orphan whose marketplace we DID read is 'not offered'", () => {
@@ -1060,9 +1075,17 @@ describe("classifyPlugin — an orphan is never 'current'", () => {
 	});
 });
 
-describe("classifyPlugin — an exact pin that cannot be ordered is unknown (F3)", () => {
-	test("REGRESSION: a pinned plugin at an unorderable version used to be current", () => {
-		// The "latest" path already refused this; the exact-pin path did not.
+// REVERSES F3, deliberately. `unorderable` is gone as a state: when two
+// versions cannot be ordered we assume what is installed IS the latest, rather
+// than raising a warning nothing can clear.
+//
+// F3's premise was that "cannot compare" might hide a plugin that is behind.
+// True, but the cost was paid on every run by rows that were fine — an install
+// recorded as a commit sha can never be ordered against a semver pin, so the
+// warning was permanent and unactionable. Do not restore `unorderable` without
+// changing that rule first.
+describe("classifyPlugin — an unorderable version is assumed current", () => {
+	test("a pinned plugin whose install cannot be ordered is current", () => {
 		const [item] = planPluginUpdates(
 			{ "playground@official": "7.3.0" },
 			catalog(
@@ -1073,16 +1096,13 @@ describe("classifyPlugin — an exact pin that cannot be ordered is unknown (F3)
 				}),
 			),
 		);
-		expect(item).toMatchObject({
-			action: "unknown",
-			reason: "unorderable",
-			target: null,
-			scopes: [],
-			note: "installed version cannot be compared with the published 7.3.0",
-		});
+		expect(item.action).toBe("current");
+		expect(item.reason).not.toBe("unorderable");
+		// Nothing is planned against it, which is the part F3 actually protected.
+		expect(item.scopes).toEqual([]);
 	});
 
-	test("with no published version the note names the pin instead", () => {
+	test("no published version, under an exact pin, is also current", () => {
 		const [item] = planPluginUpdates(
 			{ "playground@official": "7.3.0" },
 			catalog(
@@ -1093,11 +1113,14 @@ describe("classifyPlugin — an exact pin that cannot be ordered is unknown (F3)
 				}),
 			),
 		);
-		expect(item).toMatchObject({
-			action: "unknown",
-			reason: "unorderable",
-			note: "installed version cannot be compared with the pin 7.3.0",
-		});
+		expect(item.action).toBe("current");
+		expect(item.note).toBeUndefined();
+		// The exact-pin path reports `up-to-date` here where the "latest" path
+		// reports `no-published-version` — same verdict, different machine code.
+		// Asserted as observed rather than as preferred: nothing renders the two
+		// differently today, and forcing them to agree is a change to the
+		// classifier, not to this test.
+		expect(item.reason).toBe("up-to-date");
 	});
 
 	test("a scope that IS behind still wins: it is planned, not hidden", () => {