feat: detect uv, pnpm and bun tool updates

[stanlyzoolo]

What

Adds uv, pnpm and bun to the update-detection chain, requested after the reddit announcement. Chain is now brew → go → cargo → pipx → uv → pnpm → bun → npm.

Along the way it fixes a misdetection that was already live: bun globals resolve into install/global/node_modules/<pkg>/…, so the npm step claimed them and offered npm install -g <pkg> — a duplicate copy under npm's prefix while the bun one keeps shadowing it on PATH.

• uv — <UV_TOOL_DIR>/<pkg>/bin/<bin> → uv tool upgrade <pkg>
• pnpm — globals are cmd-shim shell scripts, not symlinks, so EvalSymlinks resolves them to themselves and the path names nothing. The package comes from the # cmd-shim-target= line Detect reads off the binary (bounded, only under $PNPM_HOME), with the resolved path as the legacy-layout fallback → pnpm add -g <pkg>
• bun — <BUN_INSTALL>/install/global/node_modules/<pkg> → bun add -g <pkg>

pnpm and bun go before npm: both layouts carry node_modules segments npm claims on sight. add -g rather than update -g, since update honours the range saved at install time and can refuse the major bump the card is offering.

npmPackage now skips .pnpm/.bin service segments, and the npm step refuses paths through /node_modules/.pnpm/ — offering npm install -g there is the duplicate install again, so the chain degrades to ErrUnknownManager + the update_cmd hint.

Found in review

Three defects in the change itself, each measured before fixing:

1. Oversized shim parsed truncated. A cut inside the # cmd-shim-target= line shortens the path, and …/node_modules/typescript shortened to …/node_modules/types yields types — a real package on npm, so the chain would have offered a confidently wrong pnpm add -g types. Now reads cap+1 and rejects an overrunning file whole (the getReadme idiom).
2. Manager roots compared unexpanded against a symlink-resolved binary path, so a relocated ~/.bun, a home on a secondary volume or /home under autofs missed silently. Measured across all five layouts: uv and pnpm shim/store degraded honestly, but bun and legacy pnpm fell back to npm install -g <pkg>. resolveManagerDirs now expands symlinks in every root, and managerDirs absorbed cargoBin/pipxVenvs so the fix is symmetrical — which also takes homeDir() out of detectFromPath, making its "no I/O" contract literal.
3. The != "" root guard was six hand-copied copies of one convention, one omission away from claiming any relative path (filepath.Rel("", "bin/exa") succeeds). Moved into underDir/segmentUnder.

Not done, deliberately: $CARGO_HOME/$PIPX_HOME are still not consulted. Honouring them changes behaviour for anyone who sets them and belongs in its own commit.

Checks

• go build / go vet / go test -race ./... (10 packages) / golangci-lint — green
• Cross-compile GOOS=windows (build + vet) and GOOS=linux — green
• internal/updater coverage 85.0% → 86.8%; every new function at 100%, the remaining gaps are pre-existing (brewPrefix, cargoCrate, runProbe)
• Live smoke check against real uv 0.11.32: UV_TOOL_DIR=<tmp> uv tool install cowsay → Detect yields uv tool upgrade cowsay. Temporary test and tmp dirs removed afterwards, $HOME untouched
• Every fix mutation-checked: dropping the dirs threading reproduces Manager = "npm", want "bun"; dropping the symlink expansion, the cap guard, one field in the expansion loop, or either empty-dir guard each fails a specific test
• docs-sync pass over CLAUDE.md / ARCHITECTURE.md / README

Known limits (documented in README)

• Windows: uv/pnpm/bun/npm bins are .cmd shims keepkit does not parse — pre-existing npm limitation, inherited
• A manager's own binary is out of scope (bun upgrade, pnpm self-update); those tools update themselves
• Detection is path-convention based: a future layout change makes its check miss silently and degrade to the hint, never to a wrong command

🤖 Generated with Claude Code