magus-cli 7.10.2 → 7.10.4

package/src/services/tool-probe.ts

@@ -12,18 +12,26 @@
  * Now both front ends read tools through here, in two halves:
  *
  *  - {@link probeTools} gathers FACTS through an injected {@link ToolProbeIO}.
- *    Each tool is read through the installer that owns the binary PATH actually
- *    runs, and `managed` says whether the upgrade command magus would run
- *    replaces THAT file. brew and uv answer "is it behind?" themselves; bun, npm
- *    and go fall back to a registry lookup.
+ *    Each tool is read through the installer the spec names, and `managed`
+ *    says whether the upgrade command magus would run replaces the file PATH
+ *    actually runs. brew is ASKED (`brew list`), never second-guessed
+ *    by rebuilding its install layout; the npm, bun, pip and go probes ask their
+ *    installer where it keeps globals and test against that answer. brew and uv
+ *    answer "is it behind?" themselves; bun, npm and go fall back to a registry
+ *    lookup. A version comes from the installer's record or from magus's own
+ *    version command (`data/tool-versions.ts`) — never guessed from files, and
+ *    never from a plugin's `check` string.
  *  - {@link classifyTool} turns facts into a state, purely. The rules are in
  *    order and the vetoes that make an upgrade unsafe come before every rule
  *    that can produce one.
  *
  * Asking the installer that will perform the upgrade, about the file that will
  * run, is what makes plan, upgrade and PATH agree — which is what convergence
- * means. A tool whose state cannot be established is `unknown`, and `unknown`
- * is never applied.
+ * means. When the spec's installer does not have the file PATH runs, the other
+ * installers magus drives (bun, npm, Homebrew) are asked the same way, and the
+ * one that has it is the owner: the update runs through IT. A tool none of them
+ * has is `external`: installed another way, found, and correctly left alone. A
+ * tool whose state cannot be established is `unknown`. Neither is ever applied.
  *
  * NOTHING HERE PRINTS, and every subprocess runs through `execFile` (argv, no
  * shell) with its stdio CAPTURED: the probe runs under the CLI's animated live
@@ -43,14 +51,11 @@ import os from "node:os";
 import path from "node:path";
 import semver from "semver";
 import { CLAUDE_CODE_NPM_PACKAGE, type CliTool } from "../data/cli-tools.js";
+import { parseToolVersion, toolVersionCommand } from "../data/tool-versions.js";
 import type { BinInstaller, ManagedBin, ManagedTool } from "../types/index.js";
 import type { Command } from "../utils/command-utils.js";
 import type { InstallMethod } from "./cli-tool-commands.js";
-import {
-	readPackageVersionForBin,
-	readVersionDirForBin,
-	versionFromVersionedPath,
-} from "./cli-tool-version.js";
+import { versionFromVersionedPath } from "./cli-tool-version.js";
 import {
 	binPinCommand,
 	binUpgradeCommand,
@@ -61,10 +66,10 @@ import {
 // ── Types ────────────────────────────────────────────────────────────────────
 
 /**
- * `external` is a determined fact, not a failure to check: the tool is on
- * PATH, and something other than the installer magus would use put it there
- * (bun, an official installer, the OS). magus leaves it as is, so it is
- * neither work nor "could not be checked".
+ * `external`: on PATH, and no installer magus drives has it — or the one that
+ * does has a different copy than the one PATH runs. Installed another way,
+ * found, and left alone. Never work, never a warning, never "could not be
+ * checked".
  */
 export type ToolState =
 	| "install"
@@ -82,7 +87,10 @@ export type ToolReason =
 	| "ahead-of-pin"
 	| "pin-not-installable"
 	| "held-back"
-	| "not-managed"
+	/** `external`: the spec's installer does not own the file PATH runs. */
+	| "installed-elsewhere"
+	/** `unknown`: whether the spec's installer owns it could not be determined. */
+	| "owner-unknown"
 	| "version-unreadable"
 	| "latest-unavailable"
 	| "unorderable"
@@ -102,11 +110,12 @@ export type ToolFactSource =
 	| "pypi"
 	| "npm-registry"
 	| "go-proxy"
-	/** the package.json of the npm/bun package the PATH binary lives in. */
-	| "package-json"
-	/** the file name of a versioned install (`…/versions/2.1.276`). */
+	/** the file name of Claude Code's native install (`…/versions/2.1.276`). */
 	| "version-dir"
-	| "check-command";
+	/** magus's own version command for the tool (`data/tool-versions.ts`). */
+	| "version-command"
+	/** a standalone installer's own receipt (`~/.config/uv/uv-receipt.json`). */
+	| "installer-receipt";
 
 export interface ToolFacts {
 	name: string;
@@ -125,16 +134,14 @@ export interface ToolFacts {
 	/** The owning installer's own verdict; null = it gave none. */
 	behind: boolean | null;
 	/**
-	 * The upgrade command for this spec replaces `resolvedPath` (containment in
-	 * the package's own directory, or pip adoption). false = another owner;
-	 * null = the owner directory could not be determined.
+	 * The upgrade command for this spec replaces the file PATH runs. For brew:
+	 * the file PATH runs is one `brew list <formula>` prints, and (when magus
+	 * can read the tool's version) one of brew's versions is the one PATH runs. For npm/bun/pip/go: containment in
+	 * the directory the installer reports, or pip adoption. false = the spec's
+	 * installer does not have it, or has another copy (`external`); null = it
+	 * could not be determined (the installer timed out or failed).
 	 */
 	managed: boolean | null;
-	/**
-	 * Where the installer keeps what it owns, for the human note — e.g.
-	 * "npm (root /Users/x/.local/lib/node_modules)". Diagnostic only.
-	 */
-	owner?: string;
 	/** e.g. "held by brew pin". */
 	heldBack?: string;
 	/**
@@ -168,13 +175,19 @@ export interface ToolFacts {
 	failure?: string;
 	/** Where each fact came from, for diagnostics. */
 	sources: ToolFactSource[];
+	/**
+	 * How many OTHER files of this name sit later on PATH, which nothing runs.
+	 * A count only: telling which copy is whose, or which is newer, would mean
+	 * reading installers' layouts or running files magus did not choose.
+	 */
+	otherCopies?: number;
 }
 
 export interface ToolStatus {
 	name: string;
 	state: ToolState;
 	reason: ToolReason;
-	/** Set for every state except plain current/install. */
+	/** Set for every state except plain current/install and `external`. */
 	note?: string;
 	/** {@link ToolFacts.adopted}, carried when this state plans work. */
 	adopted?: string;
@@ -228,68 +241,29 @@ function withFailure(text: string, failure: string | undefined): string {
 	return failure ? `${text} (${failure})` : text;
 }
 
-/** The installer as the user knows it. */
-export function installerWord(via: ManagedTool["via"]): string {
-	return via === "brew" ? "Homebrew" : via;
-}
-
-/** The directories the operating system itself installs programs into. */
-const SYSTEM_DIRS = ["/bin", "/sbin", "/usr/bin", "/usr/sbin", "/System"];
-
-function isSystemPath(resolved: string | null): boolean {
-	return (
-		resolved !== null && SYSTEM_DIRS.some((dir) => isInside(resolved, dir))
-	);
-}
-
-/**
- * The `not-managed` sentence, in the user's terms: who did not install it,
- * and what magus does about it. Never the path or the installer's directory:
- * the user acts on neither.
- */
-function notManagedNote(spec: ManagedTool, facts: ToolFacts): string {
-	const pin = pinOf(spec);
-	if (facts.managed === false && pin) {
-		return `installed outside ${installerWord(spec.via)}, so magus cannot move it to the pin ${pin}`;
-	}
-	// The KEPT chip already says magus leaves it as is; the note says only who
-	// installed it.
-	return facts.managed === false
-		? isSystemPath(facts.resolvedPath)
-			? "comes with the operating system"
-			: `installed outside ${installerWord(spec.via)}`
-		: withFailure(
-				`could not tell whether ${installerWord(spec.via)} installed it`,
-				facts.failure,
-			);
-}
-
-/**
- * Another installer's file is `external`, settled, only while nothing is
- * asked of it. With a pin the profile declares a version magus cannot deliver
- * without a second copy, so that is still a warning: `unknown`.
- */
-function externalOr(pin: string | undefined): ToolState {
-	return pin ? "unknown" : "external";
-}
-
 /**
  * THE tool classifier. Pure. The first matching rule wins, and each branch
  * returns, so reading top to bottom is reading the precedence.
  *
- * The vetoes (`not-managed`, `held-back`) come before every rule that can yield
- * `upgrade`, pinned or not: an upgrade through an installer that does not own
- * the running file installs a second copy PATH never runs, and one through a
- * held formula is a no-op. Both would be replanned forever. The pin rules that
- * plan no work (at-pin, unorderable, ahead-of-pin) come before the vetoes,
- * because ownership cannot make a "nothing to do" answer wrong.
+ * The vetoes (installed elsewhere, owner unknown, `held-back`) come before
+ * every rule that can yield `upgrade`, pinned or not: an upgrade through an
+ * installer that does not own the running file installs a second copy PATH
+ * never runs, and one through a held formula is a no-op. Both would be
+ * replanned forever. The pin rules that plan no work (at-pin, unorderable,
+ * ahead-of-pin) come before the vetoes, because ownership cannot make a
+ * "nothing to do" answer wrong.
  *
  * One ownership answer comes earlier still: a file KNOWN to be nobody's the
- * spec's installer reaches (`managed === false`) is `not-managed` even when no
- * version could be read. That is where an unreadable version usually comes
- * from, and "does not own it" is the sentence the user can act on. The pin
- * rules are not displaced by it — they need a version to compare, and there is
- * none.
+ * spec's installer reaches (`managed === false`) is `external` even when no
+ * version could be read. It was found and is correctly left alone, so a
+ * missing version is not a finding about it. The pin rules are not displaced by
+ * it — they need a version to compare, and there is none.
+ *
+ * The other answer that needs no version: an unpinned tool its installer owns
+ * (`managed === true`) and has judged itself (`behind` not null) — a brew dev
+ * build whose output does not parse, or several kegs with no table entry. The
+ * veto `held-back` still comes first, and a pinned tool still needs a version:
+ * without one it cannot be compared with the pin, so it plans nothing.
  */
 export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 	const pin = pinOf(spec);
@@ -299,6 +273,29 @@ export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 		latest: facts.latest,
 		...(pin ? { pin } : {}),
 	};
+	// A row that can plan work carries its adoption with it.
+	const adopted = facts.adopted ? { adopted: facts.adopted } : {};
+	const heldBack = (note: string): ToolStatus => ({
+		...base,
+		state: "unknown",
+		reason: "held-back",
+		target: null,
+		note,
+	});
+	/** The owning installer's own verdict, which needs no version of ours. */
+	const ownerVerdict = (behind: boolean): ToolStatus =>
+		behind
+			? {
+					...base,
+					...adopted,
+					state: "upgrade",
+					reason: "behind",
+					target: facts.latest,
+					note: facts.latest
+						? `${facts.latest} is available`
+						: "a newer version is available",
+				}
+			: { ...base, state: "current", reason: "up-to-date", target: null };
 
 	// 1. Not on PATH.
 	if (!facts.present) {
@@ -310,23 +307,35 @@ export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 		};
 	}
 
-	// 2. Present, owned by nobody the spec's installer is — and no version read.
-	// The ownership answer is the actionable one: the version is unreadable
-	// BECAUSE no installer's record covers the file (and check commands are off
-	// while planning), so "could not read its version" would hide the reason.
-	// Only a DEFINITE `false`; an undetermined owner (null) is not a finding.
+	// 2. Present, installed another way — and no version read. The version is
+	// unreadable BECAUSE no installer's record covers the file and magus has no
+	// version command for it; "could not read its version" would misreport a
+	// tool that is simply someone else's. Only a DEFINITE `false`; an
+	// undetermined owner (null) is not this answer.
 	const installed = facts.installed;
 	if (installed === null && facts.managed === false) {
 		return {
 			...base,
-			state: externalOr(pin),
-			reason: "not-managed",
+			state: "external",
+			reason: "installed-elsewhere",
 			target: null,
-			note: notManagedNote(spec, facts),
 		};
 	}
 
-	// 3. Present, but we could not read what version runs.
+	// 3. Present and owned, no version read, but the owner judged it itself and
+	// there is no pin to compare: the owner's verdict, behind the held-back veto.
+	if (
+		installed === null &&
+		facts.managed === true &&
+		!pin &&
+		facts.behind !== null
+	) {
+		if (facts.heldBack) return heldBack(facts.heldBack);
+		return ownerVerdict(facts.behind);
+	}
+
+	// 4. Present, but we could not read what version runs. Every note states
+	// the tool's state, never where it lives or how magus looked.
 	if (installed === null) {
 		return {
 			...base,
@@ -334,13 +343,13 @@ export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 			reason: "version-unreadable",
 			target: null,
 			note: withFailure(
-				`on PATH${facts.resolvedPath ? ` at ${facts.resolvedPath}` : ""}, but its version could not be read`,
+				"installed, but its version could not be read",
 				facts.failure,
 			),
 		};
 	}
 
-	// 4–6. Pin rules that plan no work.
+	// 5–7. Pin rules that plan no work.
 	const vsPin = pin ? compareToolVersions(installed, pin) : undefined;
 	if (pin && vsPin === 0) {
 		return { ...base, state: "current", reason: "at-pin", target: null };
@@ -365,34 +374,38 @@ export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 		};
 	}
 
-	// 7. The veto: the upgrade would not replace the file PATH runs. Known to be
-	// another installer's file: `external`. Not known either way: `unknown`.
-	if (facts.managed !== true) {
+	// 8. The vetoes: the upgrade would not replace the file PATH runs, or
+	// whether it would could not be told.
+	if (facts.managed === false) {
 		return {
 			...base,
-			state: facts.managed === false ? externalOr(pin) : "unknown",
-			reason: "not-managed",
+			state: "external",
+			reason: "installed-elsewhere",
 			target: null,
-			note: notManagedNote(spec, facts),
 		};
 	}
-
-	// 8. The veto: the installer will refuse to move it.
-	if (facts.heldBack) {
+	if (facts.managed === null) {
 		return {
 			...base,
 			state: "unknown",
-			reason: "held-back",
+			reason: "owner-unknown",
 			target: null,
-			note: facts.heldBack,
+			note: withFailure(
+				"could not tell which installer owns it",
+				facts.failure,
+			),
 		};
 	}
 
-	// 9–10. Pinned and behind the pin (every other pinned case returned above).
-	// From here on a row can plan work, so an adoption must travel with it.
-	const adopted = facts.adopted ? { adopted: facts.adopted } : {};
+	// 9. The veto: the installer will refuse to move it.
+	if (facts.heldBack) return heldBack(facts.heldBack);
+
+	// 10–11. Pinned and behind the pin (every other pinned case returned above).
 	if (pin) {
-		if (spec.via === "brew") {
+		// Homebrew cannot install a chosen version — but the spec's installer
+		// is not always the owner, and an owner's own command (`uv self update
+		// <pin>`, `bun install -g <pkg>@<pin>`) is already aimed at the pin.
+		if (spec.via === "brew" && !facts.upgradeCommand) {
 			return {
 				...base,
 				state: "unknown",
@@ -411,22 +424,8 @@ export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 		};
 	}
 
-	// 11–12. The owning installer's own verdict.
-	if (facts.behind === true) {
-		return {
-			...base,
-			...adopted,
-			state: "upgrade",
-			reason: "behind",
-			target: facts.latest,
-			note: facts.latest
-				? `${facts.latest} is available`
-				: "a newer version is available",
-		};
-	}
-	if (facts.behind === false) {
-		return { ...base, state: "current", reason: "up-to-date", target: null };
-	}
+	// 12. The owning installer's own verdict.
+	if (facts.behind !== null) return ownerVerdict(facts.behind);
 
 	// 13. Nothing to compare against.
 	const latest = facts.latest;
@@ -466,12 +465,25 @@ export function classifyTool(spec: ManagedTool, facts: ToolFacts): ToolStatus {
 
 // ── Parsers (pure; tested against captured real output) ──────────────────────
 
-/** `brew list --versions <f>` → the last version token ("tmux 3.7c" → "3.7c"). */
-export function parseBrewListVersions(stdout: string): string | null {
+/**
+ * `brew list --versions <f>` → EVERY version brew still has on disk
+ * ("tmux 3.7b 3.7c" → ["3.7b", "3.7c"]). With cleanup off brew keeps old kegs,
+ * and the line does not say which one is linked, so none is dropped: the
+ * caller matches the version PATH runs against all of them. [] = none listed.
+ */
+export function parseBrewListVersions(stdout: string): string[] {
 	const line = stdout.split("\n").find((l) => l.trim().length > 0);
-	if (!line) return null;
-	const tokens = line.trim().split(/\s+/);
-	return tokens.length >= 2 ? (tokens[tokens.length - 1] ?? null) : null;
+	if (!line) return [];
+	return line.trim().split(/\s+/).slice(1);
+}
+
+/**
+ * A brew version without its leading `v` or its `_N` rebuild suffix: brew
+ * appends `_1` when it rebuilds a formula (`1.8.2_1`), while the tool itself
+ * prints `1.8.2`.
+ */
+function stripBrewRevision(v: string): string {
+	return v.trim().replace(/^v/i, "").replace(/_\d+$/, "");
 }
 
 /**
@@ -525,22 +537,6 @@ export function parseBrewOutdatedJson(
 	};
 }
 
-/**
- * The keg version from a realpath under `<cellar>/<formula>/<version>/`
- * (".../Cellar/tmux/3.7c/bin/tmux" → "3.7c"). This is the LINKED version, which
- * `brew list --versions` cannot give when several kegs are kept.
- */
-export function brewKegVersion(
-	realPath: string,
-	cellar: string,
-	formula: string,
-): string | null {
-	const prefix = `${path.join(cellar, formula)}${path.sep}`;
-	if (!realPath.startsWith(prefix)) return null;
-	const segment = realPath.slice(prefix.length).split(path.sep)[0];
-	return segment ? segment : null;
-}
-
 /** PEP 503 normalisation: lowercase, runs of `-_.` collapse to `-`. */
 export function normalizePythonPackageName(name: string): string {
 	return name.toLowerCase().replace(/[-_.]+/g, "-");
@@ -679,17 +675,6 @@ export function versionFromNpmDistTags(body: unknown): string | undefined {
 	return typeof latest === "string" ? latest : undefined;
 }
 
-/**
- * The first version-like token in a `--version` output ("tmux 3.7c" → "3.7c",
- * "2.1.268 (Claude Code)" → "2.1.268", "v2.0.0" → "2.0.0"). Needs at least one
- * dot, so a bare number (a year, a count) is not mistaken for a version.
- */
-export function parseVersionToken(output: string): string | null {
-	const m = /(?:^|[^\w.])v?(\d+(?:\.\d+)+[0-9A-Za-z.+-]*)/.exec(output);
-	if (!m?.[1]) return null;
-	return m[1].replace(/[.+-]+$/, "");
-}
-
 /** true when `resolved` lies inside `ownerDir` (compared with a trailing separator). */
 export function isInside(resolved: string, ownerDir: string): boolean {
 	const dir = path.resolve(ownerDir);
@@ -758,6 +743,11 @@ export interface ToolProbeIO {
 	 * null. A dangling symlink is not executable and does not count.
 	 */
 	resolveExecutable(name: string): Promise<string | null>;
+	/**
+	 * Every executable `name` on PATH, in PATH order, as found. Optional: an IO
+	 * without it reports no other copies.
+	 */
+	resolveAllExecutables?(name: string): Promise<string[]>;
 	env: Readonly<Record<string, string | undefined>>;
 	homedir: string;
 }
@@ -876,6 +866,16 @@ export const REAL_TOOL_PROBE_IO: ToolProbeIO = {
 		}
 		return null;
 	},
+	resolveAllExecutables: async (name) => {
+		const found: string[] = [];
+		for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
+			if (!dir) continue;
+			const candidate = path.join(dir, name);
+			if (!found.includes(candidate) && (await isExecutable(candidate)))
+				found.push(candidate);
+		}
+		return found;
+	},
 	env: process.env,
 	homedir: os.homedir(),
 };
@@ -900,14 +900,6 @@ export interface ProbeOptions {
 	 * must use.
 	 */
 	onResult?: (facts: ToolFacts, progress: ProbeProgress) => void;
-	/**
-	 * Run a spec's `check` command when no installer record can give the
-	 * version. Default FALSE, and every planning caller leaves it so: `check`
-	 * is a string a third-party `plugin.json` supplied, and planning — which
-	 * includes `--dry-run` and `--check` — executes nothing a catalogue wrote.
-	 * See {@link versionFromCheck} for what is still bounded when it is on.
-	 */
-	allowCheckCommand?: boolean;
 }
 
 // ── Probe session: memoised batch and location queries ──────────────────────
@@ -935,11 +927,17 @@ function firstLine(text: string): string {
 	);
 }
 
+/**
+ * What went wrong, in words. Never the installer's own stderr: brew's names
+ * lock files, Cellar folders and its own internal calls, and this text reaches
+ * every front end as a note.
+ */
 function execFailure(cmd: string, r: ExecResult, timeoutMs: number): string {
 	if (r.missing) return `${cmd} is not installed`;
 	if (r.timedOut)
 		return `${cmd} timed out after ${Math.round(timeoutMs / 1000)}s`;
-	return firstLine(r.stderr) || `${cmd} exited ${r.code ?? "abnormally"}`;
+	if (r.stderr.trim()) return `${cmd} reported an error`;
+	return `${cmd} exited ${r.code ?? "abnormally"}`;
 }
 
 /**
@@ -953,8 +951,6 @@ class ProbeSession {
 	constructor(
 		readonly io: ToolProbeIO,
 		readonly timeoutMs: number,
-		/** See {@link versionFromCheck}. Off unless the caller opted in. */
-		readonly allowCheckCommand: boolean = false,
 	) {}
 
 	once<T>(key: string, work: () => Promise<T>): Promise<T> {
@@ -985,12 +981,6 @@ class ProbeSession {
 		});
 	}
 
-	brewPrefix(): Promise<Located> {
-		const fromEnv = this.io.env.HOMEBREW_PREFIX;
-		if (fromEnv) return Promise.resolve({ dir: fromEnv });
-		return this.locate("brew --prefix", "brew", ["--prefix"]);
-	}
-
 	uvToolDir(): Promise<Located & { missing?: boolean }> {
 		return this.once("uv tool dir", async () => {
 			const r = await this.run("uv", ["tool", "dir"], PLAIN_ENV);
@@ -1062,9 +1052,6 @@ class ProbeSession {
 
 // ── Probing one tool ─────────────────────────────────────────────────────────
 
-/** Characters that make a check command something only a shell could run. */
-const SHELL_META = /[|&;<>()$`\\"'*?{}[\]~!#\n\r]/;
-
 /**
  * Refuse a name that could be read as an option, carries a NUL, or (for a
  * value joined into a path) climbs out of its directory. Null when fine.
@@ -1117,62 +1104,45 @@ async function packageJsonVersion(
 }
 
 /**
- * Last resort for the installed version: run the tool's own check command and
- * take the first version token.
+ * The version of the file PATH runs, from magus's OWN version command for the
+ * tool (`data/tool-versions.ts`), or null — when the table has no entry, the
+ * command could not run, or its first line is not one the pattern anchors.
  *
- * NOT REACHED WHILE PLANNING. `spec.check` is copied verbatim out of a
- * marketplace plugin's `plugin.json` (`plugin-requires.ts`), so it is a string
- * a third party wrote. Before this probe existed nothing in magus ever ran
- * it; running it to PLAN would have meant `magus update`, `--dry-run`,
- * `--check` in CI and merely opening the TUI's Tools screen each executing a
- * catalogue-supplied argv — and `--dry-run` is documented as writing nothing.
- * So the planner does not opt in: a version that could only come from a check
- * command stays null, which classifies as `unknown / version-unreadable`,
- * never as an upgrade. The one caller that opts in is the post-install
- * read-back (`update-engine.ts`), where the user has already consented to run
- * that tool's installer.
+ * Runs while planning, `--dry-run` and `--check` included, because magus wrote
+ * the argv: argv[0] is the bare `spec.name` (which {@link refusal} has already
+ * vetted), resolved by the same PATH `resolveExecutable` reads, so it asks the
+ * very file `resolvedPath` names. argv only, never a shell, under the session's
+ * timeout, with stdio captured through the IO seam. A plugin's `check` string
+ * is never consulted.
  *
- * Where it does run it is bounded on every axis:
- *  - argv only, split on whitespace, never a shell (a `SHELL_META` character
- *    refuses the whole string);
- *  - argv[0] must be the tool itself — its name, its path on PATH, or the
- *    realpath behind it. The probe's purpose is "ask the running file its
- *    version", so anything else is refused unrun, and the version reported can
- *    only have come from the binary `resolvedPath` names;
- *  - the session's `timeoutMs` (8s by default), through the injected IO seam,
- *    which captures stdio rather than inheriting the terminal.
+ * Memoised per tool, so the brew cross-check and the fallback in
+ * {@link probeInto} run it at most once.
  */
-async function versionFromCheck(
+function versionFromTable(
 	s: ProbeSession,
 	spec: ManagedTool,
 	f: ToolFacts,
-	onPath: string,
-): Promise<void> {
-	if (!s.allowCheckCommand) {
-		noteFailure(f, "no installer record, and check commands are not run here");
-		return;
-	}
-	const check = spec.check?.trim() || `${spec.name} --version`;
-	if (SHELL_META.test(check)) {
-		noteFailure(f, "check command needs a shell; not run");
-		return;
-	}
-	const [cmd, ...args] = check.split(/\s+/);
-	if (!cmd) return;
-	if (cmd !== spec.name && cmd !== onPath && cmd !== f.resolvedPath) {
-		noteFailure(f, `check command does not run ${spec.name}; not run`);
-		return;
-	}
-	const r = await s.run(cmd, args, PLAIN_ENV);
-	if (r.missing || r.timedOut) {
-		noteFailure(f, execFailure(cmd, r, s.timeoutMs));
-		return;
-	}
-	const v = parseVersionToken(`${r.stdout}\n${r.stderr}`);
-	if (v) {
-		f.installed = v;
-		addSource(f, "check-command");
-	}
+): Promise<string | null> {
+	const cmd = toolVersionCommand(spec.name);
+	if (!cmd) return Promise.resolve(null);
+	return s
+		.once<{ failure: string } | { version: string | null }>(
+			`version ${spec.name}`,
+			async () => {
+				const r = await s.run(spec.name, [...cmd.args], PLAIN_ENV);
+				if (r.missing || r.timedOut)
+					return { failure: execFailure(spec.name, r, s.timeoutMs) };
+				return { version: parseToolVersion(cmd, r.stdout, r.stderr) };
+			},
+		)
+		.then((out) => {
+			if ("failure" in out) {
+				noteFailure(f, out.failure);
+				return null;
+			}
+			if (out.version) addSource(f, "version-command");
+			return out.version;
+		});
 }
 
 /** The npm registry's `latest` dist-tag for a package. */
@@ -1231,31 +1201,127 @@ async function containedIn(
 	return { inside: real !== null && isInside(resolvedPath, real), real };
 }
 
+/**
+ * brew's own answer about THE FILE: `brew list <formula>` prints the
+ * formula's installed files, one absolute path per line. True when the PATH
+ * entry or its realpath is one of them; false when brew lists neither; null
+ * (with the failure noted) when brew could not answer.
+ */
+async function brewListsFile(
+	s: ProbeSession,
+	formula: string,
+	onPath: string,
+	resolvedPath: string,
+	f?: ToolFacts,
+): Promise<boolean | null> {
+	const r = await s.run("brew", ["list", formula], BREW_ENV);
+	if (r.timedOut || r.missing || r.code !== 0) {
+		if (f) noteFailure(f, execFailure("brew", r, s.timeoutMs));
+		return null;
+	}
+	const files = new Set(
+		r.stdout
+			.split("\n")
+			.map((line) => line.trim())
+			.filter(Boolean),
+	);
+	return files.has(resolvedPath) || files.has(onPath);
+}
+
+/**
+ * Ask brew whether it has the formula, and at which versions — never compute
+ * where it installs. magus used to build `<prefix>/Cellar/<formula>` itself and
+ * test the PATH binary's realpath against it, which is wrong for a tap formula
+ * (`madappgang/tap/claudish` lives under `Cellar/claudish`) and reimplements a
+ * layout that is brew's to define.
+ *
+ *  - `brew` not installed: brew cannot have it — installed elsewhere. A Mac
+ *    without Homebrew must not report every declared tool as "not checked".
+ *  - exit 1 with nothing on stdout or stderr: brew does not have it (measured:
+ *    `zsh`, `madappgang/tap/claudish` when not installed).
+ *  - exit 1 that says anything, `Error: No available formula …` for an
+ *    untapped tap among them: brew failed, so the owner could not be
+ *    determined. brew exits 1 for almost every error, so silence is the only
+ *    exit 1 that means "not installed".
+ *  - a timeout or any other exit: the owner could not be determined.
+ *
+ * When brew has it and magus can read the tool's version, the version PATH
+ * runs must be one of brew's versions; otherwise PATH runs another copy, and
+ * upgrading brew's would not move it. A matching version is still not
+ * ownership — a same-version copy elsewhere is another copy too. brew owns the
+ * tool only if the file PATH runs is one brew lists as the formula's: `brew
+ * list <formula>` prints its installed files, one absolute path per line, and
+ * the PATH entry or its realpath must be among them ({@link brewListsFile}).
+ * Comparing a path against the list brew printed asks brew; magus builds no
+ * Cellar path. When the version cannot be read (no table entry, or output the
+ * pattern does not anchor), brew listing the file stands: managed, judged by
+ * brew's own `outdated` verdict, its version shown only when brew lists exactly
+ * one and the table does not know the tool.
+ */
 async function probeBrew(
 	s: ProbeSession,
 	spec: ManagedTool,
 	f: ToolFacts,
+	pathEntry: string,
 	resolvedPath: string,
 ): Promise<void> {
 	const formula = spec.formula ?? spec.name;
-	// A tap formula ("user/tap/f") keeps its keg under the short name, so the
-	// full name never matched and a Homebrew mnemex read as installed outside it.
-	const keg = formula.slice(formula.lastIndexOf("/") + 1);
-	const prefix = await s.brewPrefix();
-	if ("failure" in prefix) {
+	const list = await s.run("brew", ["list", "--versions", formula], BREW_ENV);
+	if (list.missing) {
+		f.managed = false;
+		return;
+	}
+	const silent = !list.stdout.trim() && !list.stderr.trim();
+	if (
+		list.timedOut ||
+		(list.code !== 0 && list.code !== 1) ||
+		(list.code === 1 && !silent)
+	) {
 		f.managed = null;
-		noteFailure(f, prefix.failure);
+		noteFailure(f, execFailure("brew", list, s.timeoutMs));
 		return;
 	}
-	const cellar =
-		(await s.io.realpath(path.join(prefix.dir, "Cellar"))) ??
-		path.join(prefix.dir, "Cellar");
-	const ownerDir = path.join(cellar, keg);
-	f.owner = `brew (Cellar ${ownerDir})`;
-	f.managed = isInside(resolvedPath, ownerDir);
-	if (!f.managed) return;
-	f.installed = brewKegVersion(resolvedPath, cellar, keg);
-	if (f.installed) addSource(f, "brew");
+	const kegs = list.code === 0 ? parseBrewListVersions(list.stdout) : [];
+	if (kegs.length === 0) {
+		f.managed = false;
+		return;
+	}
+	addSource(f, "brew");
+
+	const inTable = toolVersionCommand(spec.name) !== undefined;
+	const onPath = inTable ? await versionFromTable(s, spec, f) : null;
+	if (onPath !== null) {
+		f.installed = onPath;
+		const hit = kegs.some(
+			(k) => compareToolVersions(stripBrewRevision(k), onPath) === 0,
+		);
+		// A version none of brew's is already another copy: no file list needed.
+		if (!hit) {
+			f.managed = false;
+			return;
+		}
+	}
+
+	// A matching version is not ownership; brew listing the file is.
+	const owns = await brewListsFile(s, formula, pathEntry, resolvedPath, f);
+	if (owns !== true) {
+		f.managed = owns;
+		return;
+	}
+
+	if (onPath !== null) {
+		f.managed = true;
+	} else {
+		// brew's answer stands, and its `outdated` verdict below says whether it
+		// is behind. The version is shown only when the table does not know the
+		// tool and brew lists exactly one: with several kegs kept, brew list
+		// cannot say which is linked, and a tool whose own answer does not parse
+		// (`tmux next-3.7` from a `HEAD-…` keg) is not the version brew names.
+		// Never guess.
+		f.managed = true;
+		const only = !inTable && kegs.length === 1 ? kegs[0] : undefined;
+		f.installed = only ? stripBrewRevision(only) : null;
+	}
 
 	const r = await s.run("brew", ["outdated", "--json=v2", formula], BREW_ENV);
 	if (r.code !== 0) {
@@ -1287,7 +1353,6 @@ async function probePip(
 	const uvDir = await s.uvToolDir();
 	if ("dir" in uvDir) {
 		const ownerDir = path.join(uvDir.dir, norm);
-		f.owner = `uv (tool dir ${uvDir.dir})`;
 		const { inside, real } = await containedIn(s, resolvedPath, ownerDir);
 		// Adoption: `uv tool install --force` overwrites the very file PATH runs
 		// when it sits in uv's bin dir, whoever put it there.
@@ -1301,7 +1366,7 @@ async function probePip(
 			// plan row is an ordinary upgrade, so without this it never says that
 			// the owning installer changes — and pipx, say, goes on claiming a
 			// venv nothing runs until its next `upgrade-all` writes back over it.
-			f.adopted = `installed by another tool in uv's bin dir (${bin.dir}); upgrading adopts it into uv`;
+			f.adopted = "installed another way; upgrading through uv takes it over";
 			addSource(f, "uv-adopted");
 		}
 
@@ -1371,7 +1436,6 @@ async function probePip(
 		const binDir =
 			s.io.env.PIPX_BIN_DIR ?? path.join(s.io.homedir, ".local", "bin");
 		const ownerDir = path.join(home, "venvs", norm);
-		f.owner = `pipx (venvs ${path.join(home, "venvs")})`;
 		const { inside } = await containedIn(s, resolvedPath, ownerDir);
 		f.managed =
 			inside || path.resolve(path.dirname(onPath)) === path.resolve(binDir);
@@ -1404,129 +1468,6 @@ async function readNodePackage(
 	if (!pinned) await npmLatest(s, pkg, f);
 }
 
-/** Where `bun add -g` puts packages: `$BUN_INSTALL/install/global/node_modules`. */
-function bunGlobalRoot(io: ToolProbeIO): string {
-	return path.join(
-		io.env.BUN_INSTALL ?? path.join(io.homedir, ".bun"),
-		"install",
-		"global",
-		"node_modules",
-	);
-}
-
-/** The package a path names, from its segments under `node_modules`. */
-function packageFromSegments(rel: string): string | null {
-	const [first, second] = rel.split(path.sep);
-	if (!first || first.startsWith(".")) return null;
-	if (!first.startsWith("@")) return first;
-	return second ? `${first}/${second}` : null;
-}
-
-/**
- * The bun or npm global package that holds `resolvedPath`, read from the path
- * alone. Null when the file lies in neither tree (a Homebrew keg included:
- * `npmGlobalPrefixOf` refuses one).
- */
-async function nodeGlobalOwner(
-	s: ProbeSession,
-	resolvedPath: string,
-): Promise<{ via: "bun" | "npm"; pkg: string } | null> {
-	const bunRoot = await s.io.realpath(bunGlobalRoot(s.io));
-	if (bunRoot && isInside(resolvedPath, bunRoot)) {
-		const pkg = packageFromSegments(path.relative(bunRoot, resolvedPath));
-		return pkg ? { via: "bun", pkg } : null;
-	}
-	const marker = `${path.sep}${path.join("lib", "node_modules")}${path.sep}`;
-	const at = resolvedPath.lastIndexOf(marker);
-	if (at < 0) return null;
-	const pkg = packageFromSegments(resolvedPath.slice(at + marker.length));
-	return pkg && npmGlobalPrefixOf(resolvedPath, pkg) !== null
-		? { via: "npm", pkg }
-		: null;
-}
-
-/**
- * The formula whose keg holds `resolvedPath` (`…/Cellar/<formula>/<version>/…`),
- * read from the path alone. `probeBrew` then checks that this Cellar is brew's.
- */
-function kegFormulaOf(resolvedPath: string): string | null {
-	const parts = resolvedPath.split(path.sep);
-	const at = parts.lastIndexOf("Cellar");
-	return at >= 0 && parts.length > at + 2 ? (parts[at + 1] ?? null) : null;
-}
-
-/**
- * The spec as the installer that actually holds `resolvedPath` would state it,
- * or null when that is the spec's own installer or none magus drives.
- */
-async function actualOwnerSpec(
-	s: ProbeSession,
-	spec: ManagedTool,
-	resolvedPath: string,
-): Promise<ManagedTool | null> {
-	const base = {
-		name: spec.name,
-		...(spec.check ? { check: spec.check } : {}),
-		...(spec.version ? { version: spec.version } : {}),
-	};
-	const node = await nodeGlobalOwner(s, resolvedPath);
-	if (node) {
-		return node.via === spec.via
-			? null
-			: { ...base, via: node.via, package: node.pkg };
-	}
-	const formula = kegFormulaOf(resolvedPath);
-	// Homebrew takes no version, so it cannot honour a pin: such a tool stays
-	// "installed outside", which the classifier reports as unknown.
-	if (!formula || spec.via === "brew" || spec.version) return null;
-	return { ...base, via: "brew", formula };
-}
-
-/**
- * The spec's installer does not own the file PATH runs, but bun's or npm's
- * global tree or a Homebrew keg does: re-read the tool through THAT installer.
- *
- * A plugin's `requires` lists its install options in preference order for a
- * FRESH install, and magus plans through the first. That order says how to
- * install a missing tool, not which owner an installed one must have. A
- * mnemex from `bun add -g` or from Homebrew has a version, a registry and an
- * upgrade command like any other. Reading it as "installed outside" the
- * first option's installer showed a settled, upgradeable tool as one magus
- * could not touch.
- *
- * The catalogue's tools already follow how a tool IS installed
- * (`specForCatalogTool`); this gives a plugin's requirements the same rule.
- * The upgrade command is carried on the facts, so `magus update` and the TUI
- * run the owner's command rather than the spec's.
- */
-async function adoptActualOwner(
-	s: ProbeSession,
-	spec: ManagedTool,
-	f: ToolFacts,
-	resolvedPath: string,
-): Promise<void> {
-	const actual = await actualOwnerSpec(s, spec, resolvedPath);
-	if (!actual) return;
-	const read = blankFacts(spec.name);
-	if (actual.via === "brew") await probeBrew(s, actual, read, resolvedPath);
-	else await probeNodeGlobal(s, actual, read, resolvedPath);
-	if (read.managed !== true) return;
-	f.managed = true;
-	f.owner = read.owner;
-	f.installed = read.installed;
-	f.latest = read.latest;
-	f.behind = read.behind;
-	// What the spec's installer could not answer is moot once the owner is
-	// known: only the owner's own failure describes this tool.
-	f.failure = read.failure;
-	for (const source of read.sources) addSource(f, source);
-	f.upgradeCommand =
-		read.upgradeCommand ??
-		(spec.version
-			? (binPinCommand(actual) ?? undefined)
-			: binUpgradeCommand(actual));
-}
-
 async function probeNodeGlobal(
 	s: ProbeSession,
 	spec: ManagedTool,
@@ -1538,7 +1479,6 @@ async function probeNodeGlobal(
 	const pinned = pin !== undefined;
 	if (spec.via === "bun") {
 		const root = bunGlobalRoot(s.io);
-		f.owner = `bun (global ${root})`;
 		const { inside, real } = await containedIn(
 			s,
 			resolvedPath,
@@ -1553,7 +1493,6 @@ async function probeNodeGlobal(
 	// The root the npm first on PATH installs into.
 	const npmRoot = await s.npmRoot();
 	if ("dir" in npmRoot) {
-		f.owner = `npm (root ${npmRoot.dir})`;
 		const { inside, real } = await containedIn(
 			s,
 			resolvedPath,
@@ -1568,7 +1507,7 @@ async function probeNodeGlobal(
 
 	// Not under that root — but perhaps under ANOTHER npm's. The file's own
 	// path names the prefix that owns it, and `--prefix` upgrades exactly that
-	// tree, so this is npm-managed, never the "second copy" veto.
+	// tree, so this is npm-managed, never installed elsewhere.
 	const prefix = npmGlobalPrefixOf(resolvedPath, pkg);
 	if (prefix === null) {
 		if ("failure" in npmRoot) {
@@ -1578,7 +1517,6 @@ async function probeNodeGlobal(
 		return;
 	}
 	f.managed = true;
-	f.owner = `npm (prefix ${prefix})`;
 	// Reached with the default root only when containment could not resolve the
 	// package directory; the plain command is right then, and --prefix is noise.
 	if (!(await isNpmDefaultPrefix(s, npmRoot, prefix))) {
@@ -1652,7 +1590,7 @@ async function isNativeLauncher(
  * on running the other file at the old version. Every run would find it behind
  * and plan the same no-op again. So the check is on `onPath`, the unresolved
  * entry, and a copy that is not the launcher falls through to the spec's own
- * installer — which reports it as a second copy it does not own.
+ * installer — which reports it installed elsewhere.
  *
  * True when it recognised the layout; `f` then holds the whole answer.
  */
@@ -1685,7 +1623,6 @@ async function probeClaudeNative(
 
 	const pin = pinOf(spec);
 	f.managed = true;
-	f.owner = `Claude Code's native installer (${dir})`;
 	f.installed = version;
 	addSource(f, "version-dir");
 	f.upgradeCommand = claudeNativeUpgradeCommand(pin);
@@ -1723,7 +1660,6 @@ async function probeGo(
 		return;
 	}
 	const realBin = (await s.io.realpath(gobin.dir)) ?? gobin.dir;
-	f.owner = `go (GOBIN ${realBin})`;
 	const sameModule =
 		want === info.module ||
 		want === info.path ||
@@ -1776,7 +1712,7 @@ async function probeInto(
 	const via: BinInstaller = spec.via;
 	switch (via) {
 		case "brew":
-			await probeBrew(s, spec, f, resolvedPath);
+			await probeBrew(s, spec, f, onPath, resolvedPath);
 			break;
 		case "pip":
 			await probePip(s, spec, f, onPath, resolvedPath, pinned);
@@ -1790,52 +1726,255 @@ async function probeInto(
 			break;
 	}
 
-	// Not the spec's installer's file, or it could not tell (npm with no `npm`
-	// to ask), but the path names bun's, npm's or Homebrew's tree: then that is
-	// the owner, and it can upgrade the file PATH runs.
-	if (f.managed !== true) await adoptActualOwner(s, spec, f, resolvedPath);
+	// Not the spec's installer's file, or it could not tell: perhaps another
+	// installer magus drives has it, and then that installer updates it.
+	if (f.managed !== true)
+		await adoptActualOwner(s, spec, f, onPath, resolvedPath);
 
-	// The method's own record was silent. Before anything runs, read what the
-	// installed files already say about themselves.
-	if (f.installed === null) versionFromFiles(f, resolvedPath);
+	await countOtherCopies(s, spec.name, f, onPath, resolvedPath);
 
-	// Still nothing: read the running file itself — but only where the caller
-	// opted into running a check command (see there).
-	if (f.installed === null) await versionFromCheck(s, spec, f, onPath);
+	// The installer's own record was silent — usually because the tool on PATH
+	// came some other way (a pnpm global, a system copy, its own installer).
+	// Ask the running file, through magus's own version command. A tool magus
+	// has no command for shows no version: never a guess.
+	if (f.installed === null) f.installed = await versionFromTable(s, spec, f);
+}
+
+// ── Adoption: the installer that actually has the tool ──────────────────────
+//
+// A plugin's `requires` lists install options in preference order for a FRESH
+// install, and magus plans through the first. That order says how to install a
+// missing tool, not which installer an installed one must have: a mnemex from
+// `bun add -g` or from Homebrew has a version, a registry and an upgrade
+// command like any other. So when the spec's installer does not have the file
+// PATH runs, magus asks the other installers it can drive, each the same way
+// its own probe does, and plans the update through the one that has it. Only
+// a tool none of them has is `external`.
+
+/** Where `bun add -g` puts packages: `$BUN_INSTALL/install/global/node_modules`. */
+function bunGlobalRoot(io: ToolProbeIO): string {
+	return path.join(
+		io.env.BUN_INSTALL ?? path.join(io.homedir, ".bun"),
+		"install",
+		"global",
+		"node_modules",
+	);
+}
+
+/** The package directory `rel` (relative to a `node_modules`) starts with. */
+function packageFromSegments(rel: string): string | null {
+	const [first, second] = rel.split(path.sep);
+	if (!first || first.startsWith(".") || first === "..") return null;
+	if (!first.startsWith("@")) return first;
+	return second ? `${first}/${second}` : null;
+}
+
+/** bun's global tree (realpath'd) when `resolvedPath` is inside it, else null. */
+async function inBunGlobalTree(
+	s: ProbeSession,
+	resolvedPath: string,
+): Promise<string | null> {
+	const bunRoot = await s.io.realpath(bunGlobalRoot(s.io));
+	return bunRoot && isInside(resolvedPath, bunRoot) ? bunRoot : null;
 }
 
 /**
- * The installed version, from files next to the binary — never by running it.
- *
- * The method's record is keyed to where THIS spec's installer keeps things, so
- * it is silent whenever the tool on PATH came some other way: magus installed
- * with bun while the catalogue says npm, a pnpm or yarn global. (An npm global
- * under another prefix and Claude Code's native installer are recognised as
- * OWNED before this runs.) Each of those still says what it is. A binary inside
- * `node_modules` belongs to a package whose `package.json` carries the version;
- * a versioned install names the file after it. Neither says who OWNS the file,
- * so `managed` is left as the method found it — the classifier still refuses to
- * plan an upgrade it cannot land — but the row can show a version instead of
- * "could not be read".
- *
- * Reads the real filesystem rather than the IO seam: `resolvedPath` already
- * came through the seam's `realpath`, and a path a test invented does not
- * exist, so this answers null there exactly as a missing record does.
+ * The bun or npm spec whose global tree holds `resolvedPath`, or null. bun's
+ * tree is the one bun installs globals into; an npm prefix is recognised the
+ * way the npm probe recognises one ({@link npmGlobalPrefixOf}, which refuses a
+ * Homebrew keg's private `node_modules`). Either way the package's own
+ * `package.json` is then read by {@link probeNodeGlobal}, as for any bun or
+ * npm spec.
  */
-function versionFromFiles(f: ToolFacts, resolvedPath: string): void {
-	if (resolvedPath.split(path.sep).includes("node_modules")) {
-		const version = readPackageVersionForBin(resolvedPath);
-		if (version) {
-			f.installed = version;
-			addSource(f, "package-json");
-			return;
-		}
+async function nodeOwnerSpec(
+	s: ProbeSession,
+	spec: ManagedTool,
+	resolvedPath: string,
+): Promise<ManagedTool | null> {
+	const base = {
+		name: spec.name,
+		...(spec.version ? { version: spec.version } : {}),
+	};
+	const bunRoot = await inBunGlobalTree(s, resolvedPath);
+	if (bunRoot) {
+		const pkg = packageFromSegments(path.relative(bunRoot, resolvedPath));
+		return pkg && spec.via !== "bun"
+			? { ...base, via: "bun", package: pkg }
+			: null;
 	}
-	const version = readVersionDirForBin(resolvedPath);
-	if (version) {
-		f.installed = version;
-		addSource(f, "version-dir");
+	if (spec.via === "npm") return null;
+	const marker = `${path.sep}${path.join("lib", "node_modules")}${path.sep}`;
+	const at = resolvedPath.lastIndexOf(marker);
+	if (at < 0) return null;
+	const pkg = packageFromSegments(resolvedPath.slice(at + marker.length));
+	return pkg && npmGlobalPrefixOf(resolvedPath, pkg) !== null
+		? { ...base, via: "npm", package: pkg }
+		: null;
+}
+
+/**
+ * Standalone installers that update their own copy in place, keyed by the app
+ * their receipt names: the arguments after the program, and the PyPI project
+ * that publishes it. uv's own installer writes a receipt and ships
+ * `uv self update`, so a uv from it is as upgradeable as one from Homebrew.
+ */
+const SELF_UPDATERS: Readonly<
+	Record<string, { args: readonly string[]; pypi: string }>
+> = {
+	uv: { args: ["self", "update"], pypi: "uv" },
+};
+
+/**
+ * The receipt a standalone installer (cargo-dist's format, which uv's uses)
+ * left for `name`, when it covers `resolvedPath`. The receipt is that
+ * installer's OWN record: it names the folder it installed into
+ * (`install_prefix`) and the programs it put there (`binaries`). It is the
+ * only record such an installer keeps — there is no command to ask — so magus
+ * reads it, and tests the file against the folder the receipt names, exactly
+ * as the npm probe tests against `npm root -g`. A receipt for another folder
+ * is another copy and says nothing about this one.
+ */
+async function installerReceipt(
+	s: ProbeSession,
+	name: string,
+	resolvedPath: string,
+): Promise<{ app: string; version: string } | null> {
+	const config = s.io.env.XDG_CONFIG_HOME || path.join(s.io.homedir, ".config");
+	const body = await s.io.readJson(
+		path.join(config, name, `${name}-receipt.json`),
+	);
+	if (!body || typeof body !== "object") return null;
+	const r = body as {
+		version?: unknown;
+		install_prefix?: unknown;
+		binaries?: unknown;
+		source?: { app_name?: unknown } | null;
+	};
+	if (typeof r.version !== "string" || typeof r.install_prefix !== "string")
+		return null;
+	if (
+		!Array.isArray(r.binaries) ||
+		!r.binaries.includes(path.basename(resolvedPath))
+	)
+		return null;
+	const prefix = (await s.io.realpath(r.install_prefix)) ?? r.install_prefix;
+	if (!isInside(resolvedPath, prefix)) return null;
+	const app = typeof r.source?.app_name === "string" ? r.source.app_name : name;
+	return { app, version: r.version };
+}
+
+/**
+ * The file is a standalone installer's: its receipt gives the version, and
+ * when that installer updates itself ({@link SELF_UPDATERS}) it is the owner
+ * `magus update` drives — latest from PyPI, `uv self update [<pin>]`.
+ * Otherwise the tool is installed elsewhere, with the receipt's version.
+ * True when a receipt answered, so no other installer is asked.
+ */
+async function adoptOwnInstaller(
+	s: ProbeSession,
+	spec: ManagedTool,
+	f: ToolFacts,
+	resolvedPath: string,
+): Promise<boolean> {
+	const receipt = await installerReceipt(s, spec.name, resolvedPath);
+	if (!receipt) return false;
+	f.installed = receipt.version;
+	addSource(f, "installer-receipt");
+	const updater = SELF_UPDATERS[receipt.app];
+	if (!updater) {
+		f.managed = false;
+		return true;
+	}
+	f.managed = true;
+	f.latest = null;
+	f.behind = null;
+	// What the spec's installer could not answer is moot: the owner is known.
+	f.failure = undefined;
+	const pin = pinOf(spec);
+	f.upgradeCommand = {
+		cmd: spec.name,
+		args: [...updater.args, ...(pin ? [pin] : [])],
+	};
+	if (!pin) await pypiLatest(s, updater.pypi, f);
+	return true;
+}
+
+/**
+ * How many other files of this name come later on PATH (distinct real files;
+ * a link to the one that runs is the same copy). Only counted: the CLI header
+ * says how many tools have one, and nothing is guessed about whose they are.
+ */
+async function countOtherCopies(
+	s: ProbeSession,
+	name: string,
+	f: ToolFacts,
+	onPath: string,
+	resolvedPath: string,
+): Promise<void> {
+	if (!s.io.resolveAllExecutables) return;
+	const seen = new Set([resolvedPath]);
+	for (const candidate of await s.io.resolveAllExecutables(name)) {
+		if (candidate === onPath) continue;
+		const real = await s.io.realpath(candidate);
+		if (!real || seen.has(real)) continue;
+		seen.add(real);
 	}
+	if (seen.size > 1) f.otherCopies = seen.size - 1;
+}
+
+/**
+ * Re-read the tool through the installer that has it — bun's or npm's global
+ * tree, else Homebrew — and, when one does, carry its answer and its upgrade
+ * command onto `f`. `magus update` and the TUI then run that installer's
+ * command rather than the spec's.
+ *
+ * Homebrew is ASKED, exactly as for a brew spec ({@link probeBrew}, by the
+ * tool's name): it is credited only when the file PATH runs is one brew lists
+ * as the formula's (`brew list <formula>`) and the version PATH runs, read with
+ * magus's own version command, is one of brew's. A same-version copy brew does
+ * not list is another copy. Not for a pinned spec: brew installs only its
+ * newest version. Not for a file in bun's global tree either: that file is
+ * bun's, whichever package holds it, so brew is never asked about it.
+ */
+async function adoptActualOwner(
+	s: ProbeSession,
+	spec: ManagedTool,
+	f: ToolFacts,
+	onPath: string,
+	resolvedPath: string,
+): Promise<void> {
+	let actual = await nodeOwnerSpec(s, spec, resolvedPath);
+	if (!actual && (await adoptOwnInstaller(s, spec, f, resolvedPath))) return;
+	const read = blankFacts(spec.name);
+	if (actual) {
+		await probeNodeGlobal(s, actual, read, resolvedPath);
+	} else if (
+		spec.via !== "brew" &&
+		pinOf(spec) === undefined &&
+		(await inBunGlobalTree(s, resolvedPath)) === null &&
+		// Without a version command nothing could confirm PATH runs brew's
+		// copy, so brew is not even asked.
+		toolVersionCommand(spec.name) !== undefined
+	) {
+		actual = { name: spec.name, via: "brew", formula: spec.name };
+		await probeBrew(s, actual, read, onPath, resolvedPath);
+		if (!read.sources.includes("version-command")) return;
+	}
+	if (!actual || read.managed !== true) return;
+	f.managed = true;
+	f.installed = read.installed;
+	f.latest = read.latest;
+	f.behind = read.behind;
+	if (read.heldBack) f.heldBack = read.heldBack;
+	// What the spec's installer could not answer is moot once the owner is
+	// known: only the owner's own failure describes this tool.
+	f.failure = read.failure;
+	for (const source of read.sources) addSource(f, source);
+	f.upgradeCommand =
+		read.upgradeCommand ??
+		(pinOf(spec)
+			? (binPinCommand(actual) ?? undefined)
+			: binUpgradeCommand(actual));
 }
 
 /** A copy, with the verdict fields cleared: a timed-out tool is never "behind". */
@@ -1896,11 +2035,7 @@ export async function probeTools(
 	const timeoutMs = opts.timeoutMs ?? PROBE_TIMEOUT_MS;
 	const deadlineMs = opts.deadlineMs ?? PROBE_DEADLINE_MS;
 	const concurrency = Math.max(1, opts.concurrency ?? PROBE_CONCURRENCY);
-	const session = new ProbeSession(
-		io,
-		timeoutMs,
-		opts.allowCheckCommand === true,
-	);
+	const session = new ProbeSession(io, timeoutMs);
 	const deadlineAt = Date.now() + deadlineMs;
 	const results: ToolFacts[] = new Array(specs.length);
 	let next = 0;
@@ -1978,7 +2113,7 @@ function isBinInstaller(m: InstallMethod): m is BinInstaller & InstallMethod {
  *     installed", the rule `cliToolUpdate` follows, so the row's state and the
  *     command Enter offers name the same installer;
  *  3. the catalogue's own mapping. For a pnpm/yarn install this probes a
- *     manager that does not own the file, which is reported as `not-managed`.
+ *     manager that does not own the file, which is reported as `external`.
  */
 export function specForCatalogTool(
 	tool: CliTool,
@@ -1992,7 +2127,6 @@ export function specForCatalogTool(
 			name: tool.name,
 			via: install.primary,
 			package: tool.packageName,
-			check: tool.checkCommand,
 			...(install.brewFormula ? { formula: install.brewFormula } : {}),
 		};
 	}
@@ -2000,7 +2134,6 @@ export function specForCatalogTool(
 		name: tool.name,
 		via: tool.packageManager,
 		package: tool.packageName,
-		check: tool.checkCommand,
 	};
 }