magus-cli 7.10.3 → 7.10.4

package/src/__tests__/tool-versions.test.ts

@@ -0,0 +1,164 @@
+// REGRESSION: magus update showed UNKNOWN rows and a "could not be checked" warning for tools installed another way — Fixed in /dev:fix session dev-fix-20261008-133732-7ddf079e
+/**
+ * The magus-owned version table (docs/plans/2026-10-08-magus-update-tool-rows.md,
+ * decision 2): tool name -> argv and an anchored parse. A version is read only
+ * from the installer's own record or from this table — never guessed.
+ *
+ * Every line below is a first line of real `--version` output captured on the
+ * reporting machine (session root-cause.md, localization.md). A tool whose
+ * output was never captured (qwen, cline, aider) must have NO entry.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import {
+	parseToolVersion,
+	presenceArgv,
+	toolVersionCommand,
+} from "../data/tool-versions.js";
+
+function parse(tool: string, stdout: string, stderr = ""): string | null {
+	const cmd = toolVersionCommand(tool);
+	if (!cmd) throw new Error(`no version command for ${tool}`);
+	return parseToolVersion(cmd, stdout, stderr);
+}
+
+describe("parseToolVersion against captured output", () => {
+	const cases: Array<[tool: string, output: string, version: string]> = [
+		["claudish", "claudish version 10.4.1\n", "10.4.1"],
+		["jq", "jq-1.8.2\n", "1.8.2"],
+		["mnemex", "mnemex v0.36.1\nUpdate available: v0.36.2\n", "0.36.1"],
+		["tmux", "tmux 3.7c\n", "3.7c"],
+		[
+			"uv",
+			"uv 0.11.15 (3cffe97c2 2026-05-18 aarch64-apple-darwin)\n",
+			"0.11.15",
+		],
+		// /opt/homebrew/bin/uv --version, captured 2026-10-08.
+		[
+			"uv",
+			"uv 0.12.23 (Homebrew 2026-10-03 aarch64-apple-darwin)\n",
+			"0.12.23",
+		],
+		["zsh", "zsh 5.9 (arm64-apple-darwin26.0)\n", "5.9"],
+		["magus", "magus v7.9.0\n", "7.9.0"],
+		["claude", "2.1.293 (Claude Code)\n", "2.1.293"],
+		["codex", "codex-cli 0.153.2\n", "0.153.2"],
+		["gemini", "0.46.0\n", "0.46.0"],
+		["opencode", "1.17.11\n", "1.17.11"],
+		["crush", "crush version v0.55.0\n", "0.55.0"],
+	];
+
+	for (const [tool, output, version] of cases) {
+		test(`${tool}: ${JSON.stringify(output.split("\n")[0])} -> ${version}`, () => {
+			expect(parse(tool, output)).toBe(version);
+		});
+	}
+
+	test("only the first non-empty line is read (mnemex's update notice is ignored)", () => {
+		expect(
+			parse("mnemex", "\n\nmnemex v0.36.1\nUpdate available: v0.36.2\n"),
+		).toBe("0.36.1");
+	});
+
+	test("stderr is read when stdout is empty", () => {
+		expect(parse("tmux", "", "tmux 3.7c\n")).toBe("3.7c");
+	});
+
+	test("a line the pattern does not anchor gives null, never a guess", () => {
+		expect(parse("tmux", "tmux master\n")).toBeNull();
+		expect(parse("tmux", "tmux next-3.7\n")).toBeNull();
+		expect(parse("jq", "jq version 1.8.2 is great\n")).toBeNull();
+		expect(parse("claudish", "")).toBeNull();
+	});
+});
+
+describe("toolVersionCommand", () => {
+	test("tmux uses -V", () => {
+		expect([...(toolVersionCommand("tmux")?.args ?? [])]).toEqual(["-V"]);
+	});
+
+	test("an Object.prototype key is not a tool", () => {
+		expect(toolVersionCommand("constructor")).toBeUndefined();
+		expect(toolVersionCommand("toString")).toBeUndefined();
+		expect(toolVersionCommand("__proto__")).toBeUndefined();
+	});
+
+	test("tools whose output was never captured have no entry", () => {
+		for (const tool of ["qwen", "cline", "aider"]) {
+			expect(toolVersionCommand(tool)).toBeUndefined();
+		}
+	});
+});
+
+describe("presenceArgv", () => {
+	test("a known tool uses its own args", () => {
+		expect(presenceArgv("tmux")).toEqual(["tmux", "-V"]);
+	});
+
+	test("an unknown tool falls back to --version", () => {
+		expect(presenceArgv("sometool")).toEqual(["sometool", "--version"]);
+	});
+});
+
+// ── coverage: every plugin bin a version-managed installer owns ─────────────
+
+interface InstallOption {
+	via?: string;
+	os?: string[];
+	formula?: string;
+	cask?: string;
+}
+interface BinDecl {
+	name: string;
+	install?: InstallOption[];
+}
+
+const PLUGINS = path.resolve(
+	import.meta.dir,
+	"..",
+	"..",
+	"..",
+	"..",
+	"plugins",
+);
+const VERSION_MANAGED = new Set(["npm", "bun", "pip", "go"]);
+
+/** Bins whose darwin install option is brew (formula, not cask), npm, bun, pip or go. */
+function versionManagedBins(): Map<string, string> {
+	const found = new Map<string, string>();
+	for (const dir of readdirSync(PLUGINS)) {
+		const manifest = path.join(PLUGINS, dir, ".claude-plugin", "plugin.json");
+		if (!existsSync(manifest)) continue;
+		const json = JSON.parse(readFileSync(manifest, "utf8")) as {
+			requires?: { bin?: BinDecl[] };
+		};
+		for (const b of json.requires?.bin ?? []) {
+			const darwin = (b.install ?? []).find(
+				(o) => !o.os || o.os.includes("darwin"),
+			);
+			if (!darwin?.via) continue;
+			const brewFormula = darwin.via === "brew" && !darwin.cask;
+			if (brewFormula || VERSION_MANAGED.has(darwin.via))
+				found.set(b.name, dir);
+		}
+	}
+	return found;
+}
+
+describe("the table covers every plugin-declared, version-managed bin", () => {
+	test("the scan finds the known set (not vacuous)", () => {
+		const names = [...versionManagedBins().keys()];
+		for (const known of ["claudish", "jq", "mnemex", "tmux", "uv", "zsh"]) {
+			expect(names).toContain(known);
+		}
+	});
+
+	test("each has a table entry", () => {
+		const missing = [...versionManagedBins()]
+			.filter(([name]) => toolVersionCommand(name) === undefined)
+			.map(([name, plugin]) => `${name} (${plugin})`);
+		expect(missing).toEqual([]);
+	});
+});

package/src/__tests__/toolchain.test.ts

@@ -220,7 +220,6 @@ describe("managedTool — the version-managed view of a requirement", () => {
 			name: "claudish",
 			via: "bun",
 			package: "claudish",
-			check: "claudish --version",
 			version: "1.2.0",
 		});
 		expect(
@@ -276,7 +275,6 @@ describe("managedTool — the version-managed view of a requirement", () => {
 				name: "a",
 				via: "npm",
 				package: "a",
-				check: "a",
 				sources: ["plugin:p@m"],
 			},
 		]);

package/src/__tests__/update-plan.test.ts

@@ -497,8 +497,9 @@ describe("planIsBehind — the --check gate", () => {
 	});
 
 	test("an UNKNOWN tool does not fail the gate, and is no work", () => {
-		// Tool unknowns are often structural and permanent (another npm owns the
-		// file, go is absent) — counting them makes a gate that never passes.
+		// Tool unknowns are often structural and permanent (the installer cannot
+		// say who owns the file, go is absent) — counting them makes a gate that
+		// never passes.
 		const p = plan({
 			bins: planBinUpdates(
 				[{ name: "crush", via: "npm", sources: [] }],
@@ -510,17 +511,22 @@ describe("planIsBehind — the --check gate", () => {
 		expect(planIsBehind(p)).toBe(false);
 	});
 
-	test("an EXTERNAL tool (another installer's) is no work, and not unknown", () => {
+	test("a tool installed ELSEWHERE does not fail the gate, and is no work", () => {
+		// Another npm owns the file: found and correctly left alone.
 		const p = plan({
 			bins: planBinUpdates(
 				[{ name: "crush", via: "npm", sources: [] }],
-				[toolFacts("crush", { managed: false, behind: true })],
+				[toolFacts("crush", { managed: false, behind: true, latest: "9.9.9" })],
 			),
 		});
 		expect(p.bins[0]!.action).toBe("external");
 		expect(planHasWork(p)).toBe(false);
 		expect(planIsBehind(p)).toBe(false);
-		expect(summarizePlan(p)).toMatchObject({ unknownTools: 0, kept: 1 });
+		expect(summarizePlan(p)).toMatchObject({
+			unknownTools: 0,
+			kept: 0,
+			external: 1,
+		});
 	});
 
 	test("a MISSING binary does fail the gate", () => {
@@ -796,11 +802,12 @@ describe("planBinUpdates", () => {
 
 	test("the note is classifyTool's note, verbatim (the TUI shows the same string)", () => {
 		const f = toolFacts("crush", {
-			managed: false,
+			managed: null,
 			resolvedPath: "/n/crush.js",
-			owner: "npm (root /l)",
+			failure: "npm timed out after 8s",
 		});
 		const [item] = planBinUpdates([bin({ name: "crush", via: "npm" })], [f]);
+		expect(item.note).toBeTruthy();
 		expect(item.note).toBe(
 			classifyTool(bin({ name: "crush", via: "npm" }), f).note,
 		);
@@ -813,6 +820,7 @@ describe("binNeedsWork — one predicate for apply, the meter and 'has work'", (
 		"upgrade",
 		"current",
 		"unknown",
+		"external",
 	];
 	const itemFor = (action: BinUpdateAction): BinUpdateItem => ({
 		name: `t-${action}`,
@@ -824,12 +832,13 @@ describe("binNeedsWork — one predicate for apply, the meter and 'has work'", (
 		sources: [],
 	});
 
-	test("install and upgrade are work; current and unknown are not", () => {
+	test("install and upgrade are work; current, unknown and external are not", () => {
 		expect(actions.map((a) => binNeedsWork(itemFor(a)))).toEqual([
 			true,
 			true,
 			false,
 			false,
+			false,
 		]);
 	});
 
@@ -974,7 +983,29 @@ describe("planHasWork / summarizePlan", () => {
 			unknownTools: 2,
 			unknown: 3,
 			current: 1,
-			kept: 1,
+			kept: 0,
+			external: 1,
+		});
+	});
+
+	test("a tool installed elsewhere is counted apart, never as unknown", () => {
+		const p = plan({
+			bins: planBinUpdates(
+				[
+					{ name: "crush", via: "npm", sources: [] },
+					{ name: "tmux", via: "brew", sources: [] },
+				],
+				[
+					toolFacts("crush", { managed: false }),
+					toolFacts("tmux", { behind: false }),
+				],
+			),
+		});
+		expect(summarizePlan(p)).toMatchObject({
+			unknownTools: 0,
+			unknown: 0,
+			current: 1,
+			external: 1,
 		});
 	});
 });

package/src/cli/update-view.ts

@@ -26,12 +26,14 @@
  * own word, so the report survives NO_COLOR, a pipe, and colour blindness.
  */
 
+import { brewUnpinCommand } from "../services/toolchain.js";
 import { binCommandFor } from "../services/update-engine.js";
 import {
 	type BinUpdateItem,
 	type PluginUpdateItem,
 	type SkillUpdateItem,
 	type UpdatePlan,
+	binHeldBack,
 	isKeptDeprecated,
 } from "../services/update-plan.js";
 import type {
@@ -90,7 +92,7 @@ type ActionKey =
 	| "refresh"
 	| "stale-load"
 	| "remove"
-	| "external"
+	| "held"
 	| "unknown";
 
 const ACTIONS: Record<ActionKey, ActionStyle> = {
@@ -112,9 +114,10 @@ const ACTIONS: Record<ActionKey, ActionStyle> = {
 	// dead weight Claude Code refuses to load, and the row is work, not a shrug.
 	// The plugin table shows the group's DEPRECATED chip, not this label.
 	remove: { glyph: "✗", label: "REMOVE", color: brand.danger },
-	// A tool another installer put on PATH. Settled, so chrome like CURRENT,
-	// and the same word the summary already prints for settled rows.
-	external: { glyph: "=", label: "KEPT", color: brand.muted, chrome: true },
+	// A tool brew reports behind but holds with a pin: checked, behind, and the
+	// user's to release (`brew unpin`). Warning, like a decision waiting. Four
+	// characters, so CHIP_WIDTH is unchanged.
+	held: { glyph: "‖", label: "HELD", color: brand.warning },
 	// Warning, not danger: "cannot tell" is not a failure, and red UNKNOWN read
 	// as "broken". The summary line and the TUI already use warning for it.
 	unknown: { glyph: "?", label: "UNKNOWN", color: brand.warning },
@@ -428,57 +431,125 @@ function pluginDetail(item: PluginUpdateItem): string {
 }
 
 /**
- * What a tool row says on its right.
+ * How the CLI section treats one tool: a ROW kind, which the user can act on,
+ * or a COUNTED kind, which only the header tallies. One word per kind, shared
+ * by the header and the row.
  *
- * A `current` row used to print `pinned —` unconditionally, which was true only
- * while "current" implied "pinned". An unpinned tool can be current now, so the
- * pin is shown only when there is one.
+ * The counted kinds have no {@link ACTIONS} entry on purpose: they are never a
+ * row, and a long label there ("INSTALLED ELSEWHERE") would widen CHIP_WIDTH —
+ * and with it every chip in every section.
  */
-function binDetail(item: BinUpdateItem, plan: UpdatePlan): string {
-	const detail = binStateDetail(item, plan);
-	// A newer copy later on PATH is the one thing here only the user can settle.
-	return item.shadowed
-		? [detail, fg(brand.warning, `⚠ ${item.shadowed}`)]
-				.filter(Boolean)
-				.join("  ")
-		: detail;
+type BinRowKind = "install" | "upgrade" | "held";
+type BinCountedKind = "current" | "elsewhere" | "unchecked";
+type BinKind = BinRowKind | BinCountedKind;
+
+function binKind(item: BinUpdateItem): BinKind {
+	switch (item.action) {
+		case "install":
+			return "install";
+		case "upgrade":
+			return "upgrade";
+		case "current":
+			return "current";
+		case "external":
+			return "elsewhere";
+		case "unknown":
+			return binHeldBack(item) ? "held" : "unchecked";
+	}
+}
+
+const isRowKind = (kind: BinKind): kind is BinRowKind =>
+	kind === "install" || kind === "upgrade" || kind === "held";
+
+/** The header's words for `n` tools of one kind. */
+function binLegend(kind: BinKind, n: number): string {
+	switch (kind) {
+		case "install":
+		case "upgrade":
+		case "current":
+			return fg(
+				ACTIONS[kind].color,
+				`${n} ${ACTIONS[kind].label.toLowerCase()}`,
+			);
+		case "held":
+			return fg(ACTIONS.held.color, `${n} held back`);
+		case "elsewhere":
+			return dim(`${n} installed elsewhere`);
+		case "unchecked":
+			return dim(`${n} not checked`);
+	}
 }
 
-function binStateDetail(item: BinUpdateItem, plan: UpdatePlan): string {
+/** What a tool row says on its right: the command the user would run. */
+function binDetail(
+	kind: BinRowKind,
+	item: BinUpdateItem,
+	plan: UpdatePlan,
+): string {
 	const spec = plan.binSpecs.get(item.name);
+	if (kind === "held") {
+		// magus never runs it: releasing a pin is the user's decision.
+		return `${item.installed ?? "—"}  ${dim(
+			formatCommand(brewUnpinCommand(spec ?? { name: item.name, via: "brew" })),
+		)}`;
+	}
 	// Rendered for the reader's eyes only — this row says what WILL run, while
 	// applyBins runs the argv itself. Same builder, so they cannot differ.
 	const cmd = spec ? binCommandFor(item, spec) : null;
 	const command = cmd ? dim(formatCommand(cmd)) : "";
-	switch (item.action) {
-		case "current":
-			return `${item.installed ?? "—"}${
-				item.version ? `  ${dim(`pinned ${item.version}`)}` : ""
-			}`;
-		case "upgrade":
-			return `${dim(item.installed ?? "—")} ${fg(
-				ACTIONS.upgrade.color,
-				"→",
-			)} ${fg(
-				ACTIONS.upgrade.color,
-				item.target ?? "?",
-			)}${command ? `  ${command}` : ""}${
-				// An upgrade that also changes the tool's owner says so here; a
-				// plain one reads identically to before.
-				item.adopted ? `  ${dim(`(${item.adopted})`)}` : ""
-			}`;
-		case "external":
-			// Kept as is: a missing version is not a finding, so no "—" stands in.
-			return [item.installed, item.note ? dim(`(${item.note})`) : ""]
-				.filter(Boolean)
-				.join("  ");
-		case "unknown":
-			return `${item.installed ?? "—"}${
-				item.note ? `  ${dim(`(${item.note})`)}` : ""
-			}`;
-		case "install":
-			return command;
+	if (kind === "install") return command;
+	return `${dim(item.installed ?? "—")} ${fg(
+		ACTIONS.upgrade.color,
+		"→",
+	)} ${fg(ACTIONS.upgrade.color, item.target ?? "?")}${
+		command ? `  ${command}` : ""
+	}${
+		// An upgrade that also changes the tool's owner says so here; a plain
+		// one reads identically to before.
+		item.adopted ? `  ${dim(`(${item.adopted})`)}` : ""
+	}`;
+}
+
+/**
+ * The CLI section: a header that counts every tool by kind, then a row for
+ * each tool the user can act on — an install, an upgrade, or a held-back tool
+ * whose `brew unpin` is theirs to run.
+ *
+ * A tool the user cannot act on — current, installed elsewhere, not checked —
+ * gets no row, and is never dropped: the header counts it, so the total
+ * matches the tools the profile declares. A pinned current tool's pin is not
+ * shown either; the profile states it.
+ */
+function binSection(plan: UpdatePlan, nameWidth: number): string[] {
+	const items = plan.bins;
+	if (items.length === 0) return [];
+	const counts = new Map<BinKind, number>();
+	const rows: string[] = [];
+	for (const item of items) {
+		const kind = binKind(item);
+		counts.set(kind, (counts.get(kind) ?? 0) + 1);
+		if (!isRowKind(kind)) continue;
+		rows.push(
+			`${PAD}${glyph(kind)}  ${rowText(
+				kind,
+				padEnd(item.name, nameWidth),
+			)}  ${chip(kind)}  ${binDetail(kind, item, plan)}`,
+		);
 	}
+	// Tools with another copy later on PATH: counted, never described. Which
+	// copy to keep is the user's call, and nothing magus could run settles it.
+	const shadowed = items.filter((item) => (item.otherCopies ?? 0) > 0).length;
+	const legend = [
+		...[...counts].map(([kind, n]) => binLegend(kind, n)),
+		...(shadowed > 0 ? [dim(`${shadowed} with another copy on PATH`)] : []),
+	].join(dim(" · "));
+	return [
+		"",
+		`${PAD}${bold(padEnd("CLI", 9))} ${dim(
+			padStart(String(items.length), 3),
+		)}  ${legend}`,
+		...(rows.length > 0 ? ["", ...rows] : []),
+	];
 }
 
 /**
@@ -718,8 +789,8 @@ export function planReport(plan: UpdatePlan): string[] {
 		...plan.skills.map((s) => width(s.name)),
 	);
 
-	// EVERY planned plugin gets a row. There is no filter here and there must
-	// not be one.
+	// EVERY planned plugin gets a row. There is no filter on plugins here and
+	// there must not be one.
 	//
 	// A previous revision dropped unlisted, not-installed rows
 	// — a pin naming a plugin no marketplace offers — on the grounds that a
@@ -728,21 +799,14 @@ export function planReport(plan: UpdatePlan): string[] {
 	// notice, while the closing lines still counted it and said "Reasons are
 	// shown above", pointing at nothing.
 	//
-	// A report may never silently drop a row. That is the whole defect this
-	// file's grouping was written to end, and a filter here reintroduces it in a
-	// form that is harder to see, because the header count agrees with the rows
-	// and only the plan knows something is missing.
+	// A report may never silently drop an item. Tools are the one section that
+	// hides rows — a tool the user cannot act on (current, installed elsewhere,
+	// unknown with no fix) gets none — and it is not silent: `binSection`'s
+	// header counts EVERY tool by state, so the total always matches the plan
+	// and every hidden tool is accounted for by its state.
 	return [
 		...pluginSection(plan.plugins, nameWidth),
-		...section(
-			"CLI",
-			plan.bins.map((item: BinUpdateItem) => ({
-				action: item.action as ActionKey,
-				name: item.name,
-				detail: binDetail(item, plan),
-			})),
-			nameWidth,
-		),
+		...binSection(plan, nameWidth),
 		...section(
 			"Skills",
 			plan.skills.map((item: SkillUpdateItem) => ({
@@ -819,11 +883,13 @@ export function summaryLine(
 	ms: number,
 	unchanged = 0,
 	kept = 0,
+	elsewhere = 0,
+	held = 0,
 ): string[] {
 	const bar = stackedBar(BAR * 2, [
 		{ value: changed, color: brand.success },
-		{ value: current + kept, color: brand.muted },
-		{ value: unchanged + unknown, color: brand.warning },
+		{ value: current + kept + elsewhere, color: brand.muted },
+		{ value: unchanged + held + unknown, color: brand.warning },
 		{ value: failed, color: brand.danger },
 	]);
 	const parts = [
@@ -833,6 +899,10 @@ export function summaryLine(
 		// Deprecated but kept on purpose (moved, still required): settled, so
 		// grey beside `current`, and never folded into "unverified".
 		kept > 0 ? dim(`${kept} kept`) : "",
+		// Tools installed another way: found and left alone, so settled too.
+		elsewhere > 0 ? dim(`${elsewhere} installed elsewhere`) : "",
+		// Behind but pinned by the user: checked, so never "unverified".
+		held > 0 ? fg(brand.warning, `${held} held back`) : "",
 		unknown > 0 ? fg(brand.warning, `${unknown} unverified`) : "",
 		failed > 0 ? fg(brand.danger, `${failed} failed`) : "",
 	].filter(Boolean);
@@ -875,29 +945,63 @@ export function note(text: string): string {
 // false for a plugin whose marketplace publishes no version: re-running changes
 // nothing, and the reader went looking for a network fault that did not exist.
 
-/** Unverified tools, under the plan. */
-export function unknownToolsNotice(count: number, names: string[]): string {
-	return warn(
-		`${bold(String(count))} tool(s) could not be checked: ${names.join(", ")} — not applied. Reasons are shown above.`,
-	);
-}
-
 /**
  * `--check` is about to exit 0 while N items went unchecked.
  *
  * The gate does not fail on an unknown — plugin or tool — because most unknowns
- * are permanent (a marketplace that publishes no version, a tool another npm
- * owns), and a gate that can never pass protects nothing. This line is what
- * keeps the exit 0 honest: it is "nothing is KNOWN to be behind", not
- * "everything was verified". It counts plugins and tools together because the
- * two per-kind notices above already name which is which.
+ * are permanent (a marketplace that publishes no version, a private registry),
+ * and a gate that can never pass protects nothing. This line is what keeps the
+ * exit 0 honest: it is "nothing is KNOWN to be behind", not "everything was
+ * verified".
+ *
+ * Each kind is named with what the report above holds for it, and no more: a
+ * plugin's reason is on its row, while a tool that could not be checked has
+ * no row, only a count in the CLI header. A tool installed another way or held
+ * back was checked, and is never counted here.
  */
-export function uncheckedGateNotice(count: number): string {
+export function uncheckedGateNotice(plugins: number, tools: number): string {
+	const what = [
+		plugins > 0 ? `${bold(String(plugins))} plugin(s)` : "",
+		tools > 0 ? `${bold(String(tools))} tool(s)` : "",
+	]
+		.filter(Boolean)
+		.join(" and ");
 	return warn(
-		`${bold(String(count))} item(s) could not be checked — they do not fail this gate. They are NOT reported as up to date. Reasons are shown above.`,
+		`${what} could not be checked — they do not fail this gate. They are NOT reported as up to date.${
+			plugins > 0 ? " Each plugin's reason is shown above." : ""
+		}`,
 	);
 }
 
+/**
+ * The run's closing line when there is nothing to apply.
+ *
+ * "Everything is up to date." only when it is TRUE: nothing unchecked and
+ * nothing held back. A plugin that could not be checked keeps its warning; a
+ * tool that could not be checked, or one held back, gets a dim note — it is
+ * not a failure, and it is not "up to date" either.
+ */
+export function nothingToApplyLines(counts: {
+	unknownPlugins: number;
+	unknownTools: number;
+	heldBack: number;
+}): string[] {
+	const tools = [
+		counts.unknownTools > 0 ? `${counts.unknownTools} tool(s) not checked` : "",
+		counts.heldBack > 0 ? `${counts.heldBack} held back` : "",
+	]
+		.filter(Boolean)
+		.join(" · ");
+	if (counts.unknownPlugins > 0) {
+		return [
+			nothingToApplyNotice(counts.unknownPlugins),
+			...(tools ? [note(`${tools}.`)] : []),
+		];
+	}
+	if (tools) return [note(`Nothing to apply. ${tools}.`)];
+	return [ok("Everything is up to date.")];
+}
+
 /** The run ends with nothing to apply because every remaining plugin is unverified. */
 export function nothingToApplyNotice(unknownPlugins: number): string {
 	return warn(