Skip to content

Phase 2: view-only inventory and duplicate detection across package managers - #117

Merged
fuad-daoud merged 17 commits into
mainfrom
phase-2
Oct 17, 2026
Merged

fuad-daoud merged 17 commits into
mainfrom
phase-2

Conversation

@fuad-daoud

Copy link
Copy Markdown
Owner

Phase 2: pkgmate becomes a view-only inventory tool and gains duplicate detection across package managers.

View-only

  • Removed the update flow and all privilege escalation: privileges.go, Backend.Update() on all backends, UpdateAll, the command viewer, and the never-enabled delete key / select mode. pkgmate never calls sudo or pkexec and still refuses to start as root.
  • pacman "update available" markers stay fresh without root: when checkupdates (pacman-contrib) is installed it runs as the user (30 s timeout); the list is shown immediately from pacman -Qu and markers are updated when the fresh check returns. Absent/failed → keeps the -Qu data.
  • README: "Privileged commands" replaced by a "Security model" section listing every read-only query and which ones touch the network.

Duplicate detection

Design: docs/superpowers/specs/2026-10-17-duplicate-detection-design.md.

  • backend/identity.go: IdentityKeys (per-ecosystem rules: python-X/python3-X ↔ pip/pipx, AUR -bin/-git/-appimage, Flatpak ID last segment + an 18-entry alias table, npm by name, Go by binary name), FindDuplicates (union-find; at least two manager families; at least one explicitly installed copy; largest groups first).
  • UI: fifth "Duplicates" tab, pacman (+flatpak) marker in the Package Manager column, "N apps installed more than once" in the footer, "No duplicates found" empty state.
  • Fixes needed for it: table rows are keyed by manager + name (same-name packages from different managers no longer overwrite each other in "All Packages"); Flatpak keeps its application ID and looks up install dates by it; pip lists only distributions whose INSTALLER is pip/uv (distro Python packages were shown as pip packages); Go packages carry the binary file name.

Verification

  • go build/vet -tags=all_backends, go test -race -tags=all_backends ./..., untagged go test ./..., gofmt
  • End-to-end test over the parser fixtures asserts the exact duplicate groups
  • Real-machine run (1,281 packages: pacman, AUR, npm, Go, Flatpak) — caught and fixed a Go module-path false positive (protoc-gen-go vs pacman protobuf); now 0 false groups
  • Manual: look at the Duplicates tab on a machine with a real duplicate (e.g. Firefox from pacman and Flatpak)

🤖 Generated with Claude Code

https://claude.ai/code/session_01TK3QqnmonpAJZpVuxwJ1Vo

fuad-daoud and others added 17 commits October 17, 2026 21:20
Delete Backend.Update, UpdateAll, the privileges helpers, the command
viewer and the commented-out update palette entries. pkgmate only reads.

BREAKING CHANGE: pkgmate no longer refreshes package databases and never escalates privileges

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The D binding was always disabled, so select mode was unreachable.
Remove the binding, the select mode, and the styles only it used.

BREAKING CHANGE: pkgmate no longer refreshes package databases and never escalates privileges

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Emit every package at once with the local pacman -Qu data, and run
checkupdates (as the user, --nocolor, 30s timeout) concurrently. Repo
packages whose fresh version differs are emitted again. Failures keep
the -Qu data; markers are never removed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TK3QqnmonpAJZpVuxwJ1Vo
The model keeps every loaded package in a map keyed by the row identity
key and, on FinishedLoadingPackagesMsg, computes the duplicate groups
once and applies them: the groups fill a fifth Duplicates tab and the
Package Manager cell of every grouped package in the four loading tabs
carries a (+family) marker with the other families sorted
alphabetically.
…em in the footer

The footer's right section now also reads "N apps installed more than
once" when at least one duplicate group was found, and says "app" in
the singular.
A real-machine check matched golang google.golang.org/protobuf (the
protoc-gen-go binary) with pacman protobuf (protoc and the C++ library).
The Go backend now records the binary's file name in Package.ID and
IdentityKeys uses it; the module-path rule remains the fallback when ID is
empty. Also fixes modules whose last element is not the command
(mvdan.cc/sh/v3 -> shfmt, golang.org/x/tools -> goimports).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TK3QqnmonpAJZpVuxwJ1Vo
@github-actions

Copy link
Copy Markdown
Contributor

@coderabbitai summary

@fuad-daoud
fuad-daoud merged commit 3025bcc into main Oct 17, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant