fix(upgrade): resolve 23 issues in make upgrade workflow

- Fix pip installer (was installing python3 instead of pip via brew)
- Fix Python removal detecting wrong binaries (generic python3)
- Fix Node.js install reporting "Failed" then succeeding
- Fix Node.js removal trying to remove other nvm versions
- Add go_install.sh installer for templ and other Go tools
- Fix pnpm reconciliation showing "unknown" install method
- Fix GAM version parsed as Python version instead of GAM version
- Fix semgrep showing <none> for before-version
- Suppress Homebrew auto-update noise during upgrades
- Filter noisy multi-installation detection (WSL Windows paths, conda)
- Clarify "a = all" prompt to "a = all categories"
- Clarify "P" skip option wording for version cycles
- Add normalize_version_output() for consistent version display
- Add final summary with updated/removed/skipped/failed counters
- Fix "<none> via unknown" display for uninstalled tools
- Add SIGINT trap for partial summary on interruption
- Fix terraform unnecessary sudo prompt on non-apt installs
- Fix npm updated at wrong path (add nvm use default)
- Fix uv cascading tool updates during reconciliation
- Fix install_tool.sh uninstall leaking into universal removal

Author: CybotTM

catalog/gam.json

@@ -7,6 +7,8 @@
   "github_repo": "GAM-team/GAM",
   "binary_name": "gam",
   "version_flag": "version",
+  "version_command": "gam version 2>/dev/null | head -1 | grep -oE 'GAM [0-9]+\\.[0-9]+\\.[0-9]+' | awk '{print $2}'",
+  "version_regex": "([0-9]+\\.[0-9]+\\.[0-9]+)",
   "package_name": "gam7",
   "auto_update": true
 }

catalog/pip.json

@@ -1,16 +1,11 @@
 {
   "name": "pip",
   "category": "python",
-  "install_method": "package_manager",
+  "install_method": "dedicated_script",
   "description": "Python package installer",
   "homepage": "https://pip.pypa.io/",
   "package_name": "pip",
   "binary_name": "pip",
-  "packages": {
-    "apt": "python3-pip",
-    "brew": "python3",
-    "dnf": "python3-pip",
-    "pacman": "python-pip"
-  },
-  "notes": "pip typically comes with Python 3. Use python3 -m pip if pip command is not available."
+  "script": "install_pip.sh",
+  "notes": "pip is bundled with Python 3. Use python3 -m pip if pip command is not available."
 }

scripts/guide.sh

@@ -1,16 +1,39 @@
 #!/usr/bin/env bash
 set -euo pipefail
 trap '' PIPE
+# Graceful interrupt handling
+INTERRUPTED=0
+trap 'INTERRUPTED=1; echo; echo "⚠️  Interrupted. Partial summary:"; print_summary; exit 130' INT
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$DIR/.." && pwd)"
 VERBOSE="${VERBOSE:-0}"
+# Suppress Homebrew auto-update during upgrade runs to reduce noise
+export HOMEBREW_NO_AUTO_UPDATE=1
 OFFLINE="${OFFLINE:-0}"
 CLI="${PYTHON:-python3}"
 
 # Ignore pins: IGNORE_PINS=1 to show all tools regardless of pin status
 IGNORE_PINS="${IGNORE_PINS:-0}"
 
+# Summary counters
+SUMMARY_UPDATED=0
+SUMMARY_INSTALLED=0
+SUMMARY_SKIPPED=0
+SUMMARY_FAILED=0
+SUMMARY_REMOVED=0
+
+print_summary() {
+  echo "================================================================================"
+  echo "Summary (interrupted)"
+  echo "================================================================================"
+  printf "  Updated:  %d\n" "$SUMMARY_UPDATED"
+  printf "  Removed:  %d\n" "$SUMMARY_REMOVED"
+  printf "  Skipped:  %d\n" "$SUMMARY_SKIPPED"
+  printf "  Failed:   %d\n" "$SUMMARY_FAILED"
+  echo
+}
+
 # Category filter: CATEGORY=python,go or --category=python
 CATEGORY_FILTER="${CATEGORY:-}"
 for arg in "$@"; do
@@ -241,6 +264,7 @@ process_tool() {
     printf "    installed: %s via %s\n" "$installed" "$method"
     printf "    target:    %s (same)\n" "$(osc8 "$url" "$latest")"
     check_multi_installs "$catalog_tool"
+    SUMMARY_SKIPPED=$((SUMMARY_SKIPPED + 1))
     printf "    up-to-date; skipping.\n"
     return 0
   fi
@@ -264,7 +288,11 @@ process_tool() {
   # BUT: multi-version tools always prompt (more significant operation)
   if [ "$auto_update" = "true" ] && [ -z "$is_multi_version" ]; then
     printf "\n==> %s %s [auto-update]\n" "$icon" "$display"
-    printf "    installed: %s via %s\n" "${installed:-<none>}" "${method:-unknown}"
+    if [ -z "$installed" ]; then
+      printf "    installed: not installed\n"
+    else
+      printf "    installed: %s via %s\n" "$installed" "${method:-unknown}"
+    fi
     printf "    target:    %s\n" "$(osc8 "$url" "${latest:-<unknown>}")"
     check_multi_installs "$catalog_tool"
     printf "    auto-updating...\n"
@@ -297,14 +325,19 @@ process_tool() {
     reload_audit_json
     # Clean up any already-current marker left by installer
     rm -f "/tmp/.cli-audit/${catalog_tool}.already-current"
+    SUMMARY_UPDATED=$((SUMMARY_UPDATED + 1))
     return 0
   fi
 
   # Prompt for installation/update
   printf "\n==> %s %s\n" "$icon" "$display"
   [ -n "$description" ] && printf "    %s\n" "$description"
   [ -n "$homepage" ] && printf "    Homepage: %s\n" "$(osc8 "$homepage" "$homepage")"
-  printf "    installed: %s via %s\n" "${installed:-<none>}" "${method:-unknown}"
+  if [ -z "$installed" ]; then
+    printf "    installed: not installed\n"
+  else
+    printf "    installed: %s via %s\n" "$installed" "${method:-unknown}"
+  fi
 
   check_multi_installs "$catalog_tool"
 
@@ -335,7 +368,7 @@ process_tool() {
     fi
     printf "      r = Remove/uninstall this tool\n"
     if [ -n "$is_multi_version" ]; then
-      printf "      P = Skip ALL %s cycles (never install any %s)\n" "$catalog_tool" "$catalog_tool"
+      printf "      P = Skip ALL outdated %s cycles\n" "$catalog_tool"
     fi
   else
     printf "      y = Install now\n"
@@ -344,7 +377,7 @@ process_tool() {
     printf "      s = Skip only %s (ask again when newer patch available)\n" "$latest"
     if [ -n "$is_multi_version" ]; then
       printf "      p = Never install %s (skip entire %s.x cycle)\n" "$display" "$version_cycle"
-      printf "      P = Skip ALL %s cycles (never install any %s)\n" "$catalog_tool" "$catalog_tool"
+      printf "      P = Skip ALL outdated %s cycles\n" "$catalog_tool"
     else
       printf "      p = Never install (permanently skip this tool)\n"
     fi
@@ -419,6 +452,7 @@ process_tool() {
       if [ "$upgrade_success" = "0" ]; then
         # Install script failed
         printf "\n    ⚠️  Upgrade failed (install script error)\n"
+        SUMMARY_FAILED=$((SUMMARY_FAILED + 1))
         prompt_pin_version "$tool" "$installed"
       elif [ -n "$binary_already_current" ]; then
         # Binary hash matches target release - upgrade succeeded despite version string
@@ -435,6 +469,7 @@ process_tool() {
         fi
       else
         # Upgrade succeeded - remove any existing pin to avoid stale pins
+        SUMMARY_UPDATED=$((SUMMARY_UPDATED + 1))
         local existing_pin="$(pins_get "$tool")"
         if [ -n "$existing_pin" ] && [ "$existing_pin" != "never" ]; then
           "$ROOT"/scripts/unpin_version.sh "$tool" || true
@@ -478,18 +513,23 @@ process_tool() {
       if [ "$upgrade_success_a" = "0" ]; then
         printf "\n    ⚠️  Upgrade failed (install script error)\n"
         printf "    Auto-update is still enabled - will try again next time.\n"
+        SUMMARY_FAILED=$((SUMMARY_FAILED + 1))
       elif [ -n "$binary_already_current_a" ]; then
         printf "    ✓ Auto-update enabled. Binary already matches target release.\n"
+        SUMMARY_UPDATED=$((SUMMARY_UPDATED + 1))
       elif [ "$new_installed_a" = "$installed" ] && [ "$new_installed_a" != "$latest" ]; then
         # Version didn't change - but check for prefix match (e.g., 3.13 vs 3.13.11)
         if [[ "$latest" == "$new_installed_a"* ]] || [[ "$new_installed_a" == "$latest"* ]]; then
           printf "    ✓ Auto-update enabled. This tool will update automatically in future.\n"
+          SUMMARY_UPDATED=$((SUMMARY_UPDATED + 1))
         else
           printf "\n    ⚠️  Upgrade did not succeed (version unchanged)\n"
           printf "    Auto-update is still enabled - will try again next time.\n"
+          SUMMARY_FAILED=$((SUMMARY_FAILED + 1))
         fi
       else
         printf "    ✓ Auto-update enabled. This tool will update automatically in future.\n"
+        SUMMARY_UPDATED=$((SUMMARY_UPDATED + 1))
         # Remove any existing pin
         local existing_pin_a="$(pins_get "$tool")"
         if [ -n "$existing_pin_a" ]; then
@@ -501,6 +541,7 @@ process_tool() {
       # Skip this specific patch version only
       printf "    Skipping only %s (will prompt again when newer patch available)\n" "$latest"
       "$ROOT"/scripts/pin_version.sh "$tool" "$latest" || true
+      SUMMARY_SKIPPED=$((SUMMARY_SKIPPED + 1))
       ;;
     [p])
       if [ -n "$installed" ]; then
@@ -550,6 +591,7 @@ process_tool() {
         local still_installed="$(json_field "$tool" installed)"
         if [ -z "$still_installed" ]; then
           printf "    ✓ %s has been removed\n" "$tool"
+          SUMMARY_REMOVED=$((SUMMARY_REMOVED + 1))
         else
           printf "    ⚠️  %s may not have been fully removed (still detected: %s)\n" "$tool" "$still_installed"
         fi
@@ -570,6 +612,7 @@ process_tool() {
       ;;
     *)
       # User declined (N or empty)
+      SUMMARY_SKIPPED=$((SUMMARY_SKIPPED + 1))
       ;;
   esac
 }
@@ -863,7 +906,7 @@ for category in $(printf '%s\n' "${!CATEGORY_TOOLS[@]}" | while read c; do echo
   # Category-level prompt (skip if auto-yes mode)
   if [ "${AUTO_YES_ALL:-}" != "1" ]; then
     printf "  Tools: %s\n" "$(echo $tools | tr ' ' ', ' | sed 's/^, //')"
-    printf "  Process this category? [Y/n/a=all/s=skip-all] "
+    printf "  Process this category? [Y/n/a=all categories/s=skip-all] "
 
     cat_ans=""
     if [ -t 0 ]; then
@@ -935,5 +978,14 @@ if [ -n "$DEPRECATED_TOOLS" ]; then
   fi
 fi
 
+# Print final summary
+echo
+echo "================================================================================"
+echo "Summary"
+echo "================================================================================"
+printf "  Updated:  %d\n" "$SUMMARY_UPDATED"
+printf "  Removed:  %d\n" "$SUMMARY_REMOVED"
+printf "  Skipped:  %d\n" "$SUMMARY_SKIPPED"
+printf "  Failed:   %d\n" "$SUMMARY_FAILED"
 echo
-echo "All done. Re-run: make audit"
+echo "Re-run: make audit"

scripts/install_node.sh

@@ -38,6 +38,8 @@ get_specific_node_version() {
 install_node() {
   ensure_nvm
   nvm install "$NODE_CHANNEL"
+  # Re-source nvm to ensure the new version is active in this shell
+  ensure_nvm_loaded
 
   # Only set default if this is NOT a multi-version install
   # (multi-version = specific major version like 24, 25)
@@ -66,6 +68,8 @@ install_node() {
 update_node() {
   ensure_nvm
   nvm install "$NODE_CHANNEL"
+  # Re-source nvm to ensure the new version is active in this shell
+  ensure_nvm_loaded
 
   # Only set default and update global packages if NOT a multi-version install
   if [ -z "${NODE_VERSION:-}" ]; then

scripts/install_pip.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# pip installer - ensures pip is available via Python's ensurepip
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$DIR/lib/common.sh"
+. "$DIR/lib/install_strategy.sh"
+
+ACTION="${1:-install}"
+
+get_pip_version() {
+  if command -v pip3 >/dev/null 2>&1; then
+    pip3 --version 2>/dev/null | awk '{print $2}' || true
+  elif command -v pip >/dev/null 2>&1; then
+    pip --version 2>/dev/null | awk '{print $2}' || true
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 -m pip --version 2>/dev/null | awk '{print $2}' || true
+  fi
+}
+
+install_pip() {
+  local before after path
+
+  before="$(get_pip_version)"
+
+  # Ensure Python is available
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "[pip] Error: python3 not found. Install Python first." >&2
+    exit 1
+  fi
+
+  # Use ensurepip to bootstrap pip if not present
+  if ! python3 -m pip --version >/dev/null 2>&1; then
+    echo "[pip] Bootstrapping pip via ensurepip..." >&2
+    python3 -m ensurepip --upgrade 2>&1 || {
+      echo "[pip] ensurepip failed, trying apt..." >&2
+      apt_install_if_missing python3-pip || true
+    }
+  fi
+
+  # Upgrade pip to latest
+  python3 -m pip install --upgrade pip 2>&1 || true
+
+  after="$(get_pip_version)"
+  path="$(command -v pip3 2>/dev/null || command -v pip 2>/dev/null || true)"
+
+  printf "[%s] before: %s\n" "pip" "${before:-<none>}"
+  printf "[%s] after:  %s\n" "pip" "${after:-<none>}"
+  if [ -n "$path" ]; then printf "[%s] path:   %s\n" "pip" "$path"; fi
+
+  refresh_snapshot "pip"
+}
+
+uninstall_pip() {
+  echo "[pip] pip is bundled with Python and cannot be uninstalled separately" >&2
+}
+
+case "$ACTION" in
+  install|update|reconcile) install_pip ;;
+  uninstall) uninstall_pip ;;
+  *) echo "Usage: $0 {install|update|uninstall|reconcile}" ; exit 2 ;;
+esac

scripts/install_python.sh

@@ -210,11 +210,42 @@ update_py_stack() {
 }
 
 uninstall_py_tools() {
-  local tools=(black isort flake8 bandit httpie pre-commit poetry semgrep)
-  if command -v uv >/dev/null 2>&1; then
-    for p in "${tools[@]}"; do uv tool uninstall "$p" >/dev/null 2>&1 || true; done
+  local PY_SPEC="${UV_PYTHON_SPEC:-}"
+
+  if [ -n "$PY_SPEC" ]; then
+    # Version-specific removal (e.g., UV_PYTHON_SPEC=3.10)
+    local short_ver="${PY_SPEC}"
+    # Extract major.minor from full version like 3.10.19
+    case "$PY_SPEC" in
+      *.*.*)  short_ver="${PY_SPEC%.*}" ;;
+    esac
+
+    echo "[python] Removing Python $short_ver..." >&2
+
+    # Remove via uv if available
+    if command -v uv >/dev/null 2>&1; then
+      uv python uninstall "$short_ver" 2>/dev/null || true
+    fi
+
+    # Remove version-specific apt packages (e.g., python3.10)
+    if have apt-get; then
+      apt_remove_if_present "python${short_ver}" "python${short_ver}-venv" "python${short_ver}-dev" 2>/dev/null || true
+    fi
+
+    # Remove version-specific brew formula if it exists
+    if have brew; then
+      brew uninstall "python@${short_ver}" 2>/dev/null || true
+    fi
+
+    echo "[python] Python $short_ver removal complete" >&2
   else
-    for p in "${tools[@]}"; do pipx uninstall "$p" >/dev/null 2>&1 || true; done
+    # Full uninstall: remove all CLI tools
+    local tools=(black isort flake8 bandit httpie pre-commit poetry semgrep)
+    if command -v uv >/dev/null 2>&1; then
+      for p in "${tools[@]}"; do uv tool uninstall "$p" >/dev/null 2>&1 || true; done
+    else
+      for p in "${tools[@]}"; do pipx uninstall "$p" >/dev/null 2>&1 || true; done
+    fi
   fi
 }
 

scripts/install_tool.sh

@@ -48,6 +48,10 @@ if [ "$ACTION" = "uninstall" ]; then
     if [ -n "$script_name" ] && [ -f "$DIR/$script_name" ]; then
       "$DIR/$script_name" uninstall || true
     fi
+    # Dedicated scripts handle their own cleanup completely
+    # Don't try to detect and remove additional installations
+    # (especially important for multi-version tools like node, python, go)
+    exit 0
   fi
 
   binary_name="$(jq -r '.binary_name // ""' "$CATALOG_FILE" 2>/dev/null || echo "$TOOL")"

scripts/install_uv.sh

@@ -62,7 +62,8 @@ self_update_uv() {
 upgrade_uv_tools() {
   command -v uv >/dev/null 2>&1 || return 0
   echo "Checking uv-managed tools..."
-  uv tool upgrade --all || true
+  # Only show tool name and version changes, not dependency details
+  uv tool upgrade --all 2>&1 | grep -E '^(Updated |Modified |Installed |No updates)' || true
 }
 
 reconcile_uv() {
@@ -75,8 +76,6 @@ reconcile_uv() {
   fi
   # Try self-update to latest stable
   self_update_uv || true
-  # Upgrade all uv-managed tools
-  upgrade_uv_tools || true
   # Verify final state
   echo "uv path: $(command -v uv 2>/dev/null || echo '<none>')"
   uv --version 2>/dev/null || true