feat(system): add mise system use and mise system upgrade

docs/.vitepress/cli_commands.ts

@@ -322,6 +322,12 @@ export const commands: { [key: string]: Command } = {
       status: {
         hide: false,
       },
+      upgrade: {
+        hide: false,
+      },
+      use: {
+        hide: false,
+      },
     },
   },
   tasks: {

docs/cli/index.md

@@ -167,6 +167,8 @@ Can also use `MISE_NO_HOOKS=1`
 - [`mise system <SUBCOMMAND>`](/cli/system.md)
 - [`mise system install [FLAGS] [PACKAGE]…`](/cli/system/install.md)
 - [`mise system status [-J --json] [--missing]`](/cli/system/status.md)
+- [`mise system upgrade [FLAGS] [PACKAGE]…`](/cli/system/upgrade.md)
+- [`mise system use [FLAGS] <PACKAGE>…`](/cli/system/use.md)
 - [`mise tasks [FLAGS] [TASK] <SUBCOMMAND>`](/cli/tasks.md)
 - [`mise tasks add [FLAGS] <TASK> [-- RUN]…`](/cli/tasks/add.md)
 - [`mise tasks deps [--dot] [--hidden] [TASKS]…`](/cli/tasks/deps.md)

docs/cli/system.md

@@ -15,3 +15,5 @@ ever installed when explicitly requested with `mise system install`.
 
 - [`mise system install [FLAGS] [PACKAGE]…`](/cli/system/install.md)
 - [`mise system status [-J --json] [--missing]`](/cli/system/status.md)
+- [`mise system upgrade [FLAGS] [PACKAGE]…`](/cli/system/upgrade.md)
+- [`mise system use [FLAGS] <PACKAGE>…`](/cli/system/use.md)

docs/cli/system/upgrade.md

@@ -0,0 +1,52 @@
+<!-- @generated by usage-cli from usage spec -->
+# `mise system upgrade`
+
+- **Usage**: `mise system upgrade [FLAGS] [PACKAGE]…`
+- **Aliases**: `up`
+- **Source code**: [`src/cli/system/upgrade.rs`](https://github.com/jdx/mise/blob/main/src/cli/system/upgrade.rs)
+
+Upgrade installed system packages from `[system.packages]`
+
+Refreshes package manager metadata and upgrades the configured packages
+that are already installed: apt/dnf/pacman upgrade to the newest available
+version (apt and dnf honor a version pinned in config), brew pours the
+formula's current bottle and replaces the old keg. Packages that are not
+installed yet are skipped — use `mise system install` for those.
+
+Packages can also be given explicitly in `manager:package` form.
+
+## Arguments
+
+### `[PACKAGE]…`
+
+Packages in `manager:package` form; defaults to everything configured in [system.packages]
+
+## Flags
+
+### `-m --manager <MANAGER>`
+
+Only upgrade packages for this manager, e.g. `apt` or `brew`
+
+**Choices:**
+
+- `apt`
+- `brew`
+- `dnf`
+- `pacman`
+
+### `-n --dry-run`
+
+Print the commands that would run without running them
+
+### `-y --yes`
+
+Skip the confirmation prompt
+
+Examples:
+
+```
+mise system upgrade
+mise system upgrade brew:postgresql@17
+mise system upgrade --manager apt --yes
+mise system upgrade --dry-run
+```

docs/cli/system/use.md

@@ -0,0 +1,53 @@
+<!-- @generated by usage-cli from usage spec -->
+# `mise system use`
+
+- **Usage**: `mise system use [FLAGS] <PACKAGE>…`
+- **Aliases**: `u`
+- **Source code**: [`src/cli/system/use.rs`](https://github.com/jdx/mise/blob/main/src/cli/system/use.rs)
+
+Add system packages to [system.packages] and install them
+
+Like `mise use` for tools: writes `"manager:package" = "version"` entries
+to mise.toml (the local config by default, the global one with `-g`) and
+then installs whatever is missing.
+
+Versions are pinned with `@`: `mise system use apt:curl@8.5.0-2`. Without
+`@` (or with `@latest`) no pin is written. brew formulae version through
+their names instead (`brew:postgresql@17`), so `@` is always part of the
+formula name there.
+
+## Arguments
+
+### `<PACKAGE>…`
+
+Packages in `manager:package[@version]` form
+
+## Flags
+
+### `-e --env <ENV>`
+
+Write to the config file for this environment (mise.&lt;ENV>.toml)
+
+### `-g --global`
+
+Write to the global config (~/.config/mise/config.toml) instead of the local one
+
+### `-n --dry-run`
+
+Print the commands that would run without writing config or installing
+
+### `-p --path <PATH>`
+
+Write to this config file or directory
+
+### `-y --yes`
+
+Skip the confirmation prompt
+
+Examples:
+
+```
+mise system use apt:curl brew:jq
+mise system use -g brew:postgresql@17
+mise system use apt:curl@8.5.0-2
+```

docs/system-packages/apt.md

@@ -18,6 +18,9 @@ System packages for Debian-family Linux (Debian, Ubuntu, Mint, ...).
   `name:arch` qualifiers pass through in the package name.
 - `DEBIAN_FRONTEND=noninteractive` is set so installs never block on
   configuration prompts.
+- `mise system upgrade` runs `apt-get update` and then
+  `apt-get install --only-upgrade` for the configured packages, so nothing
+  not already installed gets pulled in.
 
 ## Metadata refresh
 
@@ -35,4 +38,5 @@ mise system install --update
 A pinned entry (`"apt:curl" = "8.5.0-2ubuntu10"`) shows as `version mismatch`
 in `mise system status` when a different version is installed, and
 `mise system install` passes the pin to apt to correct it. `"latest"` entries
-are satisfied by any installed version — mise does not upgrade them.
+are satisfied by any installed version — use `mise system upgrade` to move
+them to the newest available version.

docs/system-packages/brew.md

@@ -82,6 +82,15 @@ For each formula in the dependency closure (dependencies first):
    [keg-only](https://docs.brew.sh/FAQ#what-does-keg-only-mean) formulae get
    the `opt` link but are not linked into the prefix, same as brew.
 
+## Upgrades
+
+`mise system upgrade` re-resolves the configured formulae against the
+formulae.brew.sh API and pours any whose current version differs from the
+linked keg — the new keg replaces the old one and the links are repointed,
+the same dance `brew upgrade` does. Since bottles only exist for a formula's
+current version, "upgrade" and "install the current bottle" are the same
+operation.
+
 ## Limitations
 
 - **Formulae only.** Casks (GUI apps) and `brew services` are not

docs/system-packages/dnf.md

@@ -20,6 +20,8 @@ Alma, ...).
   release of that version.
 - `mise system install --update` adds `--refresh` to force a metadata
   refresh; otherwise dnf manages its own metadata expiry.
+- `mise system upgrade` runs `dnf upgrade -y --refresh` for the configured
+  packages — only already-installed packages are touched.
 
 ::: info
 Only `dnf` is supported — not legacy `yum`-only systems. On RHEL/CentOS 8+

docs/system-packages/index.md

@@ -63,8 +63,31 @@ mise system install --dry-run # print the commands without running them
 mise system install --yes     # skip the confirmation prompt
 mise system install --manager apt
 mise system install --update  # refresh package manager metadata first
+
+mise system use apt:curl brew:jq   # add to [system.packages] and install
+mise system use -g brew:ffmpeg     # write to the global config instead
+mise system use apt:curl@8.5.0-2   # pin a version (brew pins via the
+                                   # formula name: brew:postgresql@17)
+
+mise system upgrade           # upgrade installed packages to current versions
+mise system upgrade --manager brew
 ```
 
+`mise system use` is `mise use` for system packages: it writes
+`"manager:package" = "version"` entries to mise.toml (the local file by
+default, the global one with `-g`) and installs whatever is missing. Entries
+for managers that aren't available on the current machine are written without
+installing — that's how a shared config picks up `apt:` lines authored on a
+Mac.
+
+`mise system upgrade` refreshes package manager metadata and upgrades the
+configured packages that are already installed to the newest available
+version — apt and dnf also honor a version pinned in config (pacman and brew
+[can't install pins](/system-packages/pacman.html), so pinned entries are
+skipped with a warning). Packages that aren't installed yet are skipped —
+that's `mise system install`'s job. For brew this pours the formula's current
+bottle and replaces the old keg.
+
 `mise doctor` also reports configured system packages and warns when any are
 missing.
 

docs/system-packages/pacman.md

@@ -18,6 +18,11 @@ System packages for Arch-family Linux (Arch, Manjaro, EndeavourOS, ...).
 - If `/var/lib/pacman/sync` contains no databases (fresh containers), mise
   runs `pacman -Sy` automatically before installing. Force a refresh with
   `mise system install --update`.
+- `mise system upgrade` runs `pacman -Sy` and then upgrades only the
+  configured packages. Note that Arch officially supports only full-system
+  upgrades (`pacman -Syu`) — upgrading individual packages is a
+  [partial upgrade](https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported),
+  so prefer running `pacman -Syu` yourself on a rolling-release system.
 
 ::: warning
 Arch repositories only carry the latest version of each package, so pacman

e2e/cli/test_system_install_apt

@@ -33,3 +33,16 @@ assert_succeed "bc --version"
 
 # second install is a no-op
 assert_contains "mise system install --yes 2>&1" "already installed"
+
+# upgrade refreshes lists and only touches installed packages
+assert_contains "mise system upgrade --dry-run" "apt-get update"
+assert_contains "mise system upgrade --dry-run" "apt-get install -y --only-upgrade -- bc"
+assert_succeed "mise system upgrade --yes"
+
+# `use` writes the config entry and installs in one step
+rm mise.toml
+apt-get remove -y bc >/dev/null 2>&1 || true
+assert_succeed "mise system use --yes apt:bc"
+assert_contains "cat mise.toml" '"apt:bc" = "latest"'
+assert_contains "mise system status" "installed"
+assert_succeed "bc --version"

e2e/cli/test_system_use

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+# `mise system use` config-writing works on any platform — managers that
+# aren't available on this machine are added to the config without installing
+# (brew specs are avoided here: even a dry-run resolves the formula closure
+# over the network)
+
+# dry-run prints what would be written without creating the file
+assert_contains "mise system use --dry-run apt:zlib1g-dev" '"apt:zlib1g-dev" = "latest"'
+assert_fail "cat mise.toml"
+
+# version pins use @, like mise use
+assert_contains "mise system use --dry-run apt:curl@8.5.0-2" '"apt:curl" = "8.5.0-2"'
+
+# bad specs and unknown managers fail before anything is written
+assert_fail "mise system use noprefix"
+assert_fail "mise system use not-a-real-manager:pkg"
+assert_fail "cat mise.toml"
+
+# writes the entry even when the manager isn't available on this machine
+# (guarded so a real Arch box doesn't actually install ripgrep)
+if ! command -v pacman >/dev/null; then
+  assert_succeed "mise system use --yes pacman:ripgrep"
+  assert_contains "cat mise.toml" '"pacman:ripgrep" = "latest"'
+fi

man/man1/mise.1

@@ -472,6 +472,18 @@ Show the status of system packages from `[system.packages]`
 \fIAliases: \fRls
 .RE
 .TP
+\fBsystem upgrade\fR
+Upgrade installed system packages from `[system.packages]`
+.RS
+\fIAliases: \fRup
+.RE
+.TP
+\fBsystem use\fR
+Add system packages to [system.packages] and install them
+.RS
+\fIAliases: \fRu
+.RE
+.TP
 \fBtasks\fR
 Manage tasks
 .RS
@@ -2777,6 +2789,71 @@ Output in JSON format
 .TP
 \fB\-\-missing\fR
 Exit with code 1 if any configured packages are missing
+.SH "MISE SYSTEM UPGRADE"
+Upgrade installed system packages from `[system.packages]`
+
+Refreshes package manager metadata and upgrades the configured packages
+that are already installed: apt/dnf/pacman upgrade to the newest available
+version (apt and dnf honor a version pinned in config), brew pours the
+formula's current bottle and replaces the old keg. Packages that are not
+installed yet are skipped — use `mise system install` for those.
+
+Packages can also be given explicitly in `manager:package` form.
+.PP
+\fBUsage:\fR mise system upgrade [OPTIONS] [<PACKAGE>] ...
+.PP
+\fBOptions:\fR
+.PP
+.TP
+\fB\-m, \-\-manager\fR \fI<MANAGER>\fR
+Only upgrade packages for this manager, e.g. `apt` or `brew`
+.TP
+\fB\-n, \-\-dry\-run\fR
+Print the commands that would run without running them
+.TP
+\fB\-y, \-\-yes\fR
+Skip the confirmation prompt
+\fBArguments:\fR
+.PP
+.TP
+\fB<PACKAGE>\fR
+Packages in `manager:package` form; defaults to everything configured in [system.packages]
+.SH "MISE SYSTEM USE"
+Add system packages to [system.packages] and install them
+
+Like `mise use` for tools: writes `"manager:package" = "version"` entries
+to mise.toml (the local config by default, the global one with `\-g`) and
+then installs whatever is missing.
+
+Versions are pinned with `@`: `mise system use apt:curl@8.5.0\-2`. Without
+`@` (or with `@latest`) no pin is written. brew formulae version through
+their names instead (`brew:postgresql@17`), so `@` is always part of the
+formula name there.
+.PP
+\fBUsage:\fR mise system use [OPTIONS] <PACKAGE> ...
+.PP
+\fBOptions:\fR
+.PP
+.TP
+\fB\-e, \-\-env\fR \fI<ENV>\fR
+Write to the config file for this environment (mise.<ENV>.toml)
+.TP
+\fB\-g, \-\-global\fR
+Write to the global config (~/.config/mise/config.toml) instead of the local one
+.TP
+\fB\-n, \-\-dry\-run\fR
+Print the commands that would run without writing config or installing
+.TP
+\fB\-p, \-\-path\fR \fI<PATH>\fR
+Write to this config file or directory
+.TP
+\fB\-y, \-\-yes\fR
+Skip the confirmation prompt
+\fBArguments:\fR
+.PP
+.TP
+\fB<PACKAGE>\fR
+Packages in `manager:package[@version]` form
 .SH "MISE TASKS"
 Manage tasks
 .PP