From 45a387c1dd04a31bb9fe1c2ba57947ebf215a503 Mon Sep 17 00:00:00 2001
From: Bastien Chanot <git@bchanot.fr>
Date: Thu, 2 Jul 2026 14:16:36 +0200
Subject: [PATCH] feat(update-all): bun self-upgrade + documented non-update
 exclusions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Step 6.5: bun upgrade (guarded). Deliberate exclusions documented in
place: magic MCP (npx @latest resolves at invocation), graphify claude
install (rewrites curated configs — BDR-028 territory, manual only),
gsd (lock-pinned: make update reinstalls the pin, note added to
plugins.lock.json so the no-op is explicit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zA3Qh2Q1QpcGXzXxKeDHR
---
 plugins.lock.json |  2 +-
 update-all.sh     | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/plugins.lock.json b/plugins.lock.json
index 853fb7e..ef55a07 100644
--- a/plugins.lock.json
+++ b/plugins.lock.json
@@ -8,7 +8,7 @@
   "gsd": {
     "source": "npm:gsd-pi",
     "version": "2.64.0",
-    "note": "Check latest at https://www.npmjs.com/package/gsd-pi before updating. GSD v2 is a standalone CLI (Pi SDK), not a Claude Code plugin. Run 'gsd' in terminal, not '/gsd' in Claude Code."
+    "note": "Check latest at https://www.npmjs.com/package/gsd-pi before updating. GSD v2 is a standalone CLI (Pi SDK), not a Claude Code plugin. Run 'gsd' in terminal, not '/gsd' in Claude Code. NOTE: update-all.sh honors this pin — 'make update' will NOT advance gsd past it; bump this version deliberately, then re-run."
   },
   "gstack": {
     "source": "https://github.com/garrytan/gstack.git",
diff --git a/update-all.sh b/update-all.sh
index 621e8ed..0eed297 100644
--- a/update-all.sh
+++ b/update-all.sh
@@ -227,6 +227,27 @@ else
   info "graphifyy not installed — skipping"
 fi
 
+# ── 6.5. Update bun ──
+echo ""
+echo "── Updating bun..."
+if command -v bun &>/dev/null; then
+  if bun upgrade >/dev/null 2>&1; then
+    ok "bun $(bun --version 2>/dev/null || echo '?') (self-upgrade)"
+  else
+    warn "bun upgrade failed — try manually: bun upgrade"
+  fi
+else
+  info "bun not installed — skipping"
+fi
+# NOT updated here, deliberately (audit 2026-07-02):
+# - magic MCP: registered as `npx -y @21st-dev/magic@latest` — npx resolves
+#   the latest release at every invocation, nothing to upgrade.
+# - graphify Claude integration (`graphify claude install`): rewrites curated
+#   CLAUDE.md / .claude/settings.json (BDR-028 guard territory) — re-run
+#   MANUALLY only if a graphify upgrade changes its hook format.
+# - gsd: pinned in plugins.lock.json — Step 4 reinstalls the PIN, it does not
+#   advance it. Bump the lock deliberately, then re-run.
+
 # ── 7. Update Emil Design Engineering skill ──
 echo ""
 echo "── Updating Emil Design Engineering..."