fentas
diff --git a/‎pkg/cli/resolve_test.go‎
Lines changed: 203 additions & 0 deletions b/‎pkg/cli/resolve_test.go‎
Lines changed: 203 additions & 0 deletions
diff --git a/‎pkg/cli/shared.go‎
Lines changed: 62 additions & 1 deletion b/‎pkg/cli/shared.go‎
Lines changed: 62 additions & 1 deletion
@@ -2,6 +2,8 @@ package cli
 
 import (
 	"fmt"
+	"os"
+	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
@@ -260,6 +262,207 @@ func TestResolveAmbiguousAssets_TiedScore_QuietPicksFirst(t *testing.T) {
 	if !strings.HasPrefix(b.ResolvedAsset.Name, wantPrefix) {
 		t.Errorf("ResolvedAsset.Name = %q, want prefix %q", b.ResolvedAsset.Name, wantPrefix)
 	}
+	// Quiet/non-TTY auto-picks must NOT persist — user never saw the choice.
+	if b.AssetFilter != "" {
+		t.Errorf("quiet auto-pick should not set AssetFilter, got %q", b.AssetFilter)
+	}
+}
+
+// fakeTrueTieProvider returns two assets that actually tie on score: both
+// have the same OS/arch, neither is an archive, neither contains the repo
+// name — both score 10.
+type fakeTrueTieProvider struct{}
+
+func (f *fakeTrueTieProvider) Name() string { return "faketruetie" }
+func (f *fakeTrueTieProvider) Match(ref string) bool {
+	return strings.HasPrefix(ref, "faketruetie://")
+}
+func (f *fakeTrueTieProvider) LatestVersion(ref string) (string, error) { return "v1.0.0", nil }
+func (f *fakeTrueTieProvider) FetchRelease(ref, version string) (*provider.Release, error) {
+	name1 := fmt.Sprintf("pick-me-%s-%s", runtime.GOOS, runtime.GOARCH)
+	name2 := fmt.Sprintf("or-me-%s-%s", runtime.GOOS, runtime.GOARCH)
+	return &provider.Release{
+		Version: version,
+		Assets: []provider.Asset{
+			{Name: name1, URL: "https://example.com/" + name1, Size: 1024},
+			{Name: name2, URL: "https://example.com/" + name2, Size: 2048},
+		},
+	}, nil
+}
+
+func init() {
+	provider.Register(&fakeTrueTieProvider{})
+}
+
+// TestResolveAmbiguousAssets_QuietAutoPick_DoesNotPersist ensures that a
+// quiet/non-TTY auto-pick of a genuinely tied ambiguity does NOT set
+// AssetFilter — the user never saw the choice so we won't pin it.
+func TestResolveAmbiguousAssets_QuietAutoPick_DoesNotPersist(t *testing.T) {
+	b := &binary.Binary{
+		Name:        "tool",
+		AutoDetect:  true,
+		ProviderRef: "faketruetie://org/unique",
+		Version:     "v1.0.0",
+	}
+	out := &streams.IO{Out: &discardWriter{}, ErrOut: &discardWriter{}}
+	resolveAmbiguousAssets([]*binary.Binary{b}, true, out) // quiet=true
+
+	if b.ResolvedAsset == nil {
+		t.Fatal("expected ResolvedAsset to be set (auto-pick)")
+	}
+	if b.AssetFilter != "" {
+		t.Errorf("quiet auto-pick of tied candidates must not persist, got %q", b.AssetFilter)
+	}
+}
+
+// TestResolveAmbiguousAssets_Interactive_PersistsChoice verifies that when
+// the interactive picker is actually used (TTY + not quiet + user picks),
+// the chosen asset name is stored on AssetFilter so 'b install --add' can
+// persist it to b.yaml and 'b update' keeps using the same asset.
+func TestResolveAmbiguousAssets_Interactive_PersistsChoice(t *testing.T) {
+	// Force the TTY check to true and stdin to a known choice.
+	origTTY := isTTYFunc
+	isTTYFunc = func() bool { return true }
+	defer func() { isTTYFunc = origTTY }()
+
+	origStdin := os.Stdin
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	os.Stdin = r
+	defer func() { os.Stdin = origStdin; r.Close() }()
+	// Pick choice "1" (first listed).
+	go func() {
+		fmt.Fprintln(w, "1")
+		w.Close()
+	}()
+
+	b := &binary.Binary{
+		// Name must not appear in assets so scoring doesn't award repo-name bonus
+		// asymmetrically.
+		Name:        "tool",
+		AutoDetect:  true,
+		ProviderRef: "faketruetie://org/unique",
+		Version:     "v1.0.0",
+	}
+	out := &streams.IO{Out: &discardWriter{}, ErrOut: &discardWriter{}}
+	// quiet=false → interactive prompt is used
+	resolveAmbiguousAssets([]*binary.Binary{b}, false, out)
+
+	if b.ResolvedAsset == nil {
+		t.Fatal("expected ResolvedAsset to be set after interactive pick")
+	}
+	if b.AssetFilter == "" {
+		t.Error("interactive pick should persist to AssetFilter for 'b install --add'")
+	}
+	// AssetFilter may have glob metachars escaped; the correct invariant is
+	// that it matches the chosen asset's filename literally.
+	if m, err := filepath.Match(b.AssetFilter, b.ResolvedAsset.Name); err != nil || !m {
+		t.Errorf("AssetFilter=%q must match ResolvedAsset.Name=%q (matched=%v err=%v)",
+			b.AssetFilter, b.ResolvedAsset.Name, m, err)
+	}
+}
+
+// TestResolveAmbiguousAssets_Interactive_EOFDoesNotPersist verifies that
+// when the user closes stdin without picking (EOF), the default pick is
+// used for this run but NOT persisted to AssetFilter.
+func TestResolveAmbiguousAssets_Interactive_EOFDoesNotPersist(t *testing.T) {
+	origTTY := isTTYFunc
+	isTTYFunc = func() bool { return true }
+	defer func() { isTTYFunc = origTTY }()
+
+	origStdin := os.Stdin
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	os.Stdin = r
+	defer func() { os.Stdin = origStdin; r.Close() }()
+	w.Close() // EOF immediately — no input
+
+	b := &binary.Binary{
+		Name:        "tool",
+		AutoDetect:  true,
+		ProviderRef: "faketruetie://org/unique",
+		Version:     "v1.0.0",
+	}
+	out := &streams.IO{Out: &discardWriter{}, ErrOut: &discardWriter{}}
+	resolveAmbiguousAssets([]*binary.Binary{b}, false, out)
+
+	if b.ResolvedAsset == nil {
+		t.Fatal("expected ResolvedAsset to be set to default on EOF")
+	}
+	if b.AssetFilter != "" {
+		t.Errorf("EOF must not persist: AssetFilter = %q", b.AssetFilter)
+	}
+}
+
+// TestResolveAmbiguousAssets_Interactive_InvalidChoiceDoesNotPersist covers
+// the case where the user types a non-numeric or out-of-range value — the
+// default is used but not persisted.
+func TestResolveAmbiguousAssets_Interactive_InvalidChoiceDoesNotPersist(t *testing.T) {
+	origTTY := isTTYFunc
+	isTTYFunc = func() bool { return true }
+	defer func() { isTTYFunc = origTTY }()
+
+	origStdin := os.Stdin
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	os.Stdin = r
+	defer func() { os.Stdin = origStdin; r.Close() }()
+	go func() {
+		fmt.Fprintln(w, "nope")
+		w.Close()
+	}()
+
+	b := &binary.Binary{
+		Name:        "tool",
+		AutoDetect:  true,
+		ProviderRef: "faketruetie://org/unique",
+		Version:     "v1.0.0",
+	}
+	out := &streams.IO{Out: &discardWriter{}, ErrOut: &discardWriter{}}
+	resolveAmbiguousAssets([]*binary.Binary{b}, false, out)
+
+	if b.ResolvedAsset == nil {
+		t.Fatal("expected ResolvedAsset to be set to default on invalid input")
+	}
+	if b.AssetFilter != "" {
+		t.Errorf("invalid input must not persist: AssetFilter = %q", b.AssetFilter)
+	}
+}
+
+// TestEscapeAssetGlob verifies that glob metacharacters in asset filenames
+// are escaped so filepath.Match treats the persisted AssetFilter as a
+// literal name on subsequent runs.
+func TestEscapeAssetGlob(t *testing.T) {
+	tests := []string{
+		"argsh",          // no metachars
+		"argsh-so-linux", // dashes fine
+		"foo*bar.tar.gz", // star
+		"what?.zip",      // question mark
+		"a[tag]b",        // brackets
+		"mix*of?[all]",   // mix
+	}
+	for _, in := range tests {
+		pattern := escapeAssetGlob(in)
+		matched, err := filepath.Match(pattern, in)
+		if err != nil {
+			t.Errorf("filepath.Match(%q, %q) error: %v", pattern, in, err)
+		}
+		if !matched {
+			t.Errorf("escaped pattern %q must match its original %q", pattern, in)
+		}
+		// And it must not match an altered name (sanity check).
+		if in != "x" {
+			if m, _ := filepath.Match(pattern, "x"+in); m {
+				t.Errorf("pattern %q unexpectedly matched %q", pattern, "x"+in)
+			}
+		}
+	}
 }
 
 // discardWriter implements io.Writer and discards all output.
 
@@ -379,7 +379,21 @@ func resolveAmbiguousAssets(binaries []*binary.Binary, quiet bool, io *streams.I
 			continue
 		}
 
-		// Ambiguous — prompt user (or auto-pick in quiet/non-TTY mode)
+		// Ambiguous — prompt user (or auto-pick in quiet/non-TTY mode).
+		// We persist the chosen asset name as AssetFilter only when the
+		// user explicitly picked it in the interactive prompt (so 'b update'
+		// keeps the same asset). Quiet/non-TTY auto-picks, EOF, and invalid
+		// input all fall through to a default without user consent and must
+		// NOT be persisted.
+		if !quiet && isTTYFunc() {
+			asset, confirmed := promptAssetPick(b, candidates, io)
+			b.ResolvedAsset = asset
+			if confirmed && b.AssetFilter == "" {
+				b.AssetFilter = escapeAssetGlob(asset.Name)
+			}
+			continue
+		}
+		// Non-interactive fallback — warn and pick the first tied candidate.
 		sel := defaultAssetSelector(b, quiet, io)
 		asset, err := sel(candidates)
 		if err != nil {
@@ -389,6 +403,53 @@ func resolveAmbiguousAssets(binaries []*binary.Binary, quiet bool, io *streams.I
 	}
 }
 
+// promptAssetPick displays the interactive picker and returns the chosen
+// asset along with a flag indicating whether the user made an explicit,
+// valid choice. EOF or invalid input returns the default (first) candidate
+// with confirmed=false so callers don't persist an unconfirmed pick.
+func promptAssetPick(bin *binary.Binary, candidates []provider.Scored, io *streams.IO) (*provider.Asset, bool) {
+	fmt.Fprintf(io.ErrOut, "\nMultiple assets match for %s. Select one:\n", color.New(color.Bold).Sprint(bin.Name))
+	topScore := candidates[0].Score
+	var choices []provider.Scored
+	for _, c := range candidates {
+		if c.Score == topScore {
+			choices = append(choices, c)
+		}
+	}
+	for i, c := range choices {
+		fmt.Fprintf(io.ErrOut, "  [%d] %s  (%s)\n", i+1, c.Asset.Name, formatSize(c.Asset.Size))
+	}
+	fmt.Fprintf(io.ErrOut, "Choice [1-%d]: ", len(choices))
+
+	var input string
+	if _, err := fmt.Fscanln(os.Stdin, &input); err != nil {
+		return choices[0].Asset, false // EOF / read error — not confirmed
+	}
+	input = strings.TrimSpace(input)
+	var idx int
+	if _, err := fmt.Sscanf(input, "%d", &idx); err != nil || idx < 1 || idx > len(choices) {
+		fmt.Fprintf(io.ErrOut, "Invalid choice, using %s\n", choices[0].Asset.Name)
+		return choices[0].Asset, false // invalid — not confirmed
+	}
+	return choices[idx-1].Asset, true
+}
+
+// escapeAssetGlob escapes glob metacharacters in an asset filename so that
+// later MatchAssets calls (which use filepath.Match) treat it as a literal
+// name. Without this, an asset whose filename contains '*', '?' or '['
+// could either fail to match or match unintended files on re-install.
+func escapeAssetGlob(name string) string {
+	// filepath.Match recognises '*', '?' and '[...]'. A bare '[' with no
+	// matching ']' makes the pattern invalid. Wrapping each metacharacter
+	// in its own class turns it into a literal.
+	r := strings.NewReplacer(
+		"*", "[*]",
+		"?", "[?]",
+		"[", "[[]",
+	)
+	return r.Replace(name)
+}
+
 // firstLine returns the first line of a string, trimming trailing CR/LF.
 // Used to display clean single-line error messages from multi-line git errors.
 func firstLine(s string) string {