claudeup 4.29.0 → 4.31.0

package/src/__tests__/plugin-setup.test.ts

@@ -6,7 +6,10 @@
  * and `required` setup keys.
  */
 
-import { describe, it, expect, mock, beforeEach } from "bun:test";
+import { describe, it, expect, mock, beforeEach, afterEach } from "bun:test";
+import { mkdtemp, mkdir, writeFile, chmod, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
 // Real modules captured before the mock.module() overrides, so the mocks spread
 // the full surface instead of stripping exports (e.g. resolveExecutable) that
 // bun's global, non-restored mock.module would otherwise remove for later files.
@@ -81,7 +84,13 @@ mock.module("node:child_process", () => ({
 const {
 	extractGoBinaryName,
 	extractGoVersion,
+	extractBinaryName,
+	parseAtSpec,
+	parsePipSpec,
 	goDepNeedsInstall,
+	goDepDecision,
+	parseGoEnv,
+	classifyInstallReach,
 	installPluginDeps,
 	checkMissingDeps,
 } = await import("../services/plugin-setup.js");
@@ -296,7 +305,10 @@ describe("goDepNeedsInstall — version awareness", () => {
 
 	it("reinstalls when the pinned version differs from the installed one", async () => {
 		availableBinaries.add("tmux-mcp");
-		execResults.set("tmux-mcp --version", { stdout: "v1.6.1", stderr: "" });
+		execResults.set("/usr/bin/tmux-mcp --version", {
+			stdout: "v1.6.1",
+			stderr: "",
+		});
 
 		expect(
 			await goDepNeedsInstall("github.com/MadAppGang/tmux-mcp@v1.6.2"),
@@ -305,7 +317,10 @@ describe("goDepNeedsInstall — version awareness", () => {
 
 	it("skips when the installed version matches the pin (v-prefix insensitive)", async () => {
 		availableBinaries.add("tmux-mcp");
-		execResults.set("tmux-mcp --version", { stdout: "1.6.2", stderr: "" });
+		execResults.set("/usr/bin/tmux-mcp --version", {
+			stdout: "1.6.2",
+			stderr: "",
+		});
 
 		expect(
 			await goDepNeedsInstall("github.com/MadAppGang/tmux-mcp@v1.6.2"),
@@ -314,7 +329,7 @@ describe("goDepNeedsInstall — version awareness", () => {
 
 	it("reinstalls when the binary can't report its version", async () => {
 		availableBinaries.add("tmux-mcp");
-		execResults.set("tmux-mcp --version", {
+		execResults.set("/usr/bin/tmux-mcp --version", {
 			stdout: "",
 			stderr: "flag provided but not defined: -version",
 			error: true,
@@ -346,7 +361,10 @@ describe("checkMissingDeps — pinned go version mismatch", () => {
 	});
 
 	it("reports a present-but-outdated pinned binary as missing", async () => {
-		execResults.set("tmux-mcp --version", { stdout: "v1.6.1", stderr: "" });
+		execResults.set("/usr/bin/tmux-mcp --version", {
+			stdout: "v1.6.1",
+			stderr: "",
+		});
 
 		const missing = await checkMissingDeps({
 			go: ["github.com/MadAppGang/tmux-mcp@v1.6.2"],
@@ -363,7 +381,10 @@ describe("installPluginDeps — reinstalls an outdated pinned go binary", () =>
 	});
 
 	it("runs go install when the pinned version is newer than installed", async () => {
-		execResults.set("tmux-mcp --version", { stdout: "v1.6.1", stderr: "" });
+		execResults.set("/usr/bin/tmux-mcp --version", {
+			stdout: "v1.6.1",
+			stderr: "",
+		});
 		execResults.set("/usr/bin/go install", { stdout: "", stderr: "" });
 
 		const result = await installPluginDeps({
@@ -377,6 +398,481 @@ describe("installPluginDeps — reinstalls an outdated pinned go binary", () =>
 	});
 });
 
+// ---------------------------------------------------------------------------
+// 4c. Install reach — a version check is worthless if the install lands
+//     somewhere PATH never looks. Pure ordering rules, no mocking needed.
+// ---------------------------------------------------------------------------
+
+describe("parseGoEnv", () => {
+	it("reads GOBIN and GOPATH", () => {
+		expect(
+			parseGoEnv('{"GOBIN": "/custom/gobin", "GOPATH": "/home/u/go"}'),
+		).toEqual({ gobin: "/custom/gobin", gopath: "/home/u/go" });
+	});
+
+	// The line-oriented `go env GOBIN GOPATH` puts an EMPTY line first when GOBIN
+	// is unset. run() trims stdout, which used to shift GOPATH into GOBIN's slot
+	// and aim the install dir at ~/go instead of ~/go/bin. Keyed JSON can't shift.
+	it("keeps an unset GOBIN empty even though output gets trimmed", () => {
+		expect(parseGoEnv('{"GOBIN": "", "GOPATH": "/Users/jack/go"}')).toEqual({
+			gobin: "",
+			gopath: "/Users/jack/go",
+		});
+	});
+
+	it("survives empty output", () => {
+		expect(parseGoEnv("")).toEqual({ gobin: "", gopath: "" });
+	});
+
+	it("survives non-JSON output", () => {
+		expect(parseGoEnv("go: unknown flag -json")).toEqual({
+			gobin: "",
+			gopath: "",
+		});
+	});
+
+	it("ignores non-string values", () => {
+		expect(parseGoEnv('{"GOBIN": null, "GOPATH": 7}')).toEqual({
+			gobin: "",
+			gopath: "",
+		});
+	});
+});
+
+describe("classifyInstallReach", () => {
+	it("wins when the install dir is the first PATH entry holding it", () => {
+		expect(
+			classifyInstallReach(
+				["/home/u/go/bin", "/usr/bin"],
+				[],
+				"/home/u/go/bin",
+			),
+		).toEqual({ reach: "wins" });
+	});
+
+	it("wins when the install dir precedes another copy", () => {
+		expect(
+			classifyInstallReach(
+				["/home/u/go/bin", "/opt/homebrew/bin"],
+				["/opt/homebrew/bin"],
+				"/home/u/go/bin",
+			),
+		).toEqual({ reach: "wins" });
+	});
+
+	it("is shadowed when another copy precedes the install dir", () => {
+		expect(
+			classifyInstallReach(
+				["/home/u/.local/bin", "/home/u/go/bin"],
+				["/home/u/.local/bin"],
+				"/home/u/go/bin",
+			),
+		).toEqual({ reach: "shadowed", byDir: "/home/u/.local/bin" });
+	});
+
+	// The generalisation of the tmux-mcp incident: no foreign package needed,
+	// just Homebrew ahead of GOPATH/bin. go install writes one file, the version
+	// probe reads another, and the mismatch never resolves.
+	it("is shadowed by a homebrew copy ordered ahead of the go bin dir", () => {
+		expect(
+			classifyInstallReach(
+				["/opt/homebrew/bin", "/home/u/go/bin"],
+				["/opt/homebrew/bin"],
+				"/home/u/go/bin",
+			),
+		).toEqual({ reach: "shadowed", byDir: "/opt/homebrew/bin" });
+	});
+
+	it("reports off-path when the install dir is absent from PATH", () => {
+		expect(
+			classifyInstallReach(["/usr/bin", "/bin"], [], "/home/u/go/bin"),
+		).toEqual({ reach: "off-path" });
+	});
+
+	it("normalises trailing slashes and redundant segments", () => {
+		expect(
+			classifyInstallReach(["/home/u/go/bin/"], [], "/home/u/go/./bin"),
+		).toEqual({ reach: "wins" });
+	});
+
+	it("lets the first of several duplicate PATH entries decide", () => {
+		expect(
+			classifyInstallReach(
+				["/home/u/.local/bin", "/home/u/go/bin", "/home/u/.local/bin"],
+				["/home/u/.local/bin"],
+				"/home/u/go/bin",
+			),
+		).toEqual({ reach: "shadowed", byDir: "/home/u/.local/bin" });
+	});
+});
+
+// ---------------------------------------------------------------------------
+// 4d. End-to-end shadowing — real directories on a real PATH, so the fs scan
+//     is exercised rather than stubbed. Mirrors the tmux-mcp incident: a
+//     foreign binary earlier in PATH that cannot report a version.
+// ---------------------------------------------------------------------------
+
+describe("go deps shadowed by an earlier PATH entry", () => {
+	let tmpRoot: string;
+	let shadowDir: string;
+	let goBinDir: string;
+	let originalPath: string | undefined;
+
+	beforeEach(async () => {
+		availableBinaries = new Set(["go", "tmux-mcp"]);
+		execResults = new Map();
+
+		tmpRoot = await mkdtemp(path.join(tmpdir(), "claudeup-shadow-"));
+		shadowDir = path.join(tmpRoot, "shadow");
+		goBinDir = path.join(tmpRoot, "gobin");
+		await mkdir(shadowDir);
+		await mkdir(goBinDir);
+
+		// A foreign `tmux-mcp` earlier in PATH than the go install target.
+		const shim = path.join(shadowDir, "tmux-mcp");
+		await writeFile(shim, "#!/bin/sh\nexit 1\n");
+		await chmod(shim, 0o755);
+
+		originalPath = process.env.PATH;
+		process.env.PATH = [shadowDir, goBinDir].join(path.delimiter);
+
+		// GOBIN points at the (later) go bin dir.
+		execResults.set("/usr/bin/go env -json GOBIN GOPATH", {
+			stdout: JSON.stringify({ GOBIN: goBinDir, GOPATH: tmpRoot }),
+			stderr: "",
+		});
+		// The shim chokes on --version, exactly like the npm package did.
+		execResults.set("/usr/bin/tmux-mcp --version", {
+			stdout: "",
+			stderr: "ERR_PARSE_ARGS_UNKNOWN_OPTION",
+			error: true,
+		});
+	});
+
+	afterEach(async () => {
+		process.env.PATH = originalPath ?? "";
+		await rm(tmpRoot, { recursive: true, force: true });
+	});
+
+	it("reports blocked instead of asking for a futile install", async () => {
+		const decision = await goDepDecision(
+			"github.com/MadAppGang/tmux-mcp@v1.6.2",
+		);
+
+		expect(decision.action).toBe("blocked");
+		if (decision.action !== "blocked") return;
+		expect(decision.reason).toBe("shadowed");
+		expect(decision.detail).toContain(path.join(shadowDir, "tmux-mcp"));
+		expect(decision.detail).toContain(goBinDir);
+		expect(decision.detail).toContain("cannot change what runs");
+	});
+
+	it("fails the install rather than reporting a success that changes nothing", async () => {
+		execResults.set("/usr/bin/go install", { stdout: "", stderr: "" });
+
+		const result = await installPluginDeps({
+			go: ["github.com/MadAppGang/tmux-mcp@v1.6.2"],
+		});
+
+		expect(result.installed).toHaveLength(0);
+		expect(result.skipped).toHaveLength(0);
+		expect(result.failed).toHaveLength(1);
+		expect(result.failed[0].pkg).toBe(
+			"go:github.com/MadAppGang/tmux-mcp@v1.6.2",
+		);
+		expect(result.failed[0].error).toContain("cannot change what runs");
+	});
+
+	it("still counts as needing attention, so the UI surfaces it", async () => {
+		expect(
+			await goDepNeedsInstall("github.com/MadAppGang/tmux-mcp@v1.6.2"),
+		).toBe(true);
+
+		const missing = await checkMissingDeps({
+			go: ["github.com/MadAppGang/tmux-mcp@v1.6.2"],
+		});
+		expect(missing.go).toEqual(["github.com/MadAppGang/tmux-mcp@v1.6.2"]);
+	});
+
+	it("installs normally once the shadow is out of the way", async () => {
+		process.env.PATH = [goBinDir, shadowDir].join(path.delimiter);
+		execResults.set("/usr/bin/go install", { stdout: "", stderr: "" });
+
+		const result = await installPluginDeps({
+			go: ["github.com/MadAppGang/tmux-mcp@v1.6.2"],
+		});
+
+		expect(result.installed).toContain(
+			"go:github.com/MadAppGang/tmux-mcp@v1.6.2",
+		);
+		expect(result.failed).toHaveLength(0);
+	});
+
+	it("reports off-path when the go bin dir is not in PATH at all", async () => {
+		process.env.PATH = path.join(tmpRoot, "elsewhere");
+		availableBinaries.delete("tmux-mcp");
+
+		const decision = await goDepDecision(
+			"github.com/MadAppGang/tmux-mcp@v1.6.2",
+		);
+
+		expect(decision.action).toBe("blocked");
+		if (decision.action !== "blocked") return;
+		expect(decision.reason).toBe("install-dir-off-path");
+		expect(decision.detail).toContain("not in PATH");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// 4e. Spec parsing — the root of both bug directions. Go never reinstalled
+//     because the pin was never compared; npm/cargo/pip always reinstalled
+//     because the raw spec was used as a lookup key.
+// ---------------------------------------------------------------------------
+
+describe("parseAtSpec", () => {
+	it("splits name and pinned version", () => {
+		expect(parseAtSpec("ripgrep@14.1.0")).toEqual({
+			spec: "ripgrep@14.1.0",
+			name: "ripgrep",
+			version: "14.1.0",
+		});
+	});
+
+	it("treats a leading @ as an npm scope, not a version", () => {
+		expect(parseAtSpec("@babel/cli")).toEqual({
+			spec: "@babel/cli",
+			name: "cli",
+			version: null,
+		});
+	});
+
+	it("pins a scoped npm package", () => {
+		expect(parseAtSpec("@babel/cli@7.0.0")).toEqual({
+			spec: "@babel/cli@7.0.0",
+			name: "cli",
+			version: "7.0.0",
+		});
+	});
+
+	it("keeps go module paths working", () => {
+		expect(parseAtSpec("github.com/MadAppGang/tmux-mcp@v1.6.2")).toEqual({
+			spec: "github.com/MadAppGang/tmux-mcp@v1.6.2",
+			name: "tmux-mcp",
+			version: "v1.6.2",
+		});
+	});
+
+	it("treats @latest as unpinned", () => {
+		expect(parseAtSpec("tool@latest").version).toBeNull();
+	});
+
+	it("treats a bare name as unpinned", () => {
+		expect(parseAtSpec("tool")).toEqual({
+			spec: "tool",
+			name: "tool",
+			version: null,
+		});
+	});
+});
+
+describe("parsePipSpec", () => {
+	it("reads an == pin", () => {
+		expect(parsePipSpec("mcp==1.2.3")).toEqual({
+			spec: "mcp==1.2.3",
+			name: "mcp",
+			version: "1.2.3",
+		});
+	});
+
+	it("tolerates whitespace around ==", () => {
+		expect(parsePipSpec("mcp == 1.2.3").version).toBe("1.2.3");
+	});
+
+	// A range is not a single version, so there is nothing to verify against.
+	it("treats >= as unpinned but still reads the name", () => {
+		expect(parsePipSpec("browser-use>=0.1.0")).toEqual({
+			spec: "browser-use>=0.1.0",
+			name: "browser-use",
+			version: null,
+		});
+	});
+
+	it("strips extras from the name", () => {
+		expect(parsePipSpec("uvicorn[standard]").name).toBe("uvicorn");
+	});
+
+	it("handles a bare distribution name", () => {
+		expect(parsePipSpec("browser-use")).toEqual({
+			spec: "browser-use",
+			name: "browser-use",
+			version: null,
+		});
+	});
+});
+
+describe("extractBinaryName — brew", () => {
+	it("drops the tap prefix", () => {
+		expect(extractBinaryName("memextech/tap/ht-mcp")).toBe("ht-mcp");
+	});
+
+	// brew's @ is part of the formula name, but the binary it provides is not
+	// called "node@18" — the old code looked for exactly that and never found it.
+	it("drops a versioned-formula suffix from the binary name", () => {
+		expect(extractBinaryName("node@18")).toBe("node");
+	});
+
+	it("leaves a plain formula alone", () => {
+		expect(extractBinaryName("ripgrep")).toBe("ripgrep");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// 4f. Version awareness across the other managers
+// ---------------------------------------------------------------------------
+
+describe("pipDepNeedsInstall — via installPluginDeps", () => {
+	const PIP_VERSION = /^python3 -c import importlib\.metadata/;
+
+	beforeEach(() => {
+		availableBinaries = new Set(["uv"]);
+		execResults = new Map();
+	});
+
+	function pipVersion(stdout: string, error = false) {
+		// The probe is `python3 -c "...m.version('mcp')"`, matched by prefix.
+		execResults.set("python3 -c import importlib.metadata as m", {
+			stdout,
+			stderr: error ? "no such distribution" : "",
+			error,
+		});
+	}
+
+	it("skips a pinned package already at that version", async () => {
+		pipVersion("1.2.3");
+		const result = await installPluginDeps({ pip: ["mcp==1.2.3"] });
+
+		expect(result.skipped).toContain("pip:mcp==1.2.3");
+		expect(result.installed).toHaveLength(0);
+	});
+
+	it("reinstalls a pinned package sitting at another version", async () => {
+		pipVersion("1.2.2");
+		execResults.set("/usr/bin/uv pip install", { stdout: "", stderr: "" });
+
+		const result = await installPluginDeps({ pip: ["mcp==1.2.3"] });
+
+		expect(result.installed).toContain("pip:mcp==1.2.3");
+		expect(result.skipped).toHaveLength(0);
+	});
+
+	it("skips an unpinned package that is present", async () => {
+		pipVersion("0.9.0");
+		const result = await installPluginDeps({ pip: ["browser-use"] });
+
+		expect(result.skipped).toContain("pip:browser-use");
+	});
+
+	it("installs when the distribution is absent", async () => {
+		pipVersion("", true);
+		execResults.set("/usr/bin/uv pip install", { stdout: "", stderr: "" });
+
+		const result = await installPluginDeps({ pip: ["browser-use"] });
+
+		expect(result.installed).toContain("pip:browser-use");
+	});
+
+	it("reports a pinned mismatch through checkMissingDeps too", async () => {
+		pipVersion("1.2.2");
+		const missing = await checkMissingDeps({ pip: ["mcp==1.2.3"] });
+		expect(missing.pip).toEqual(["mcp==1.2.3"]);
+		expect(PIP_VERSION.test("python3 -c import importlib.metadata")).toBe(true);
+	});
+});
+
+describe("npm and cargo version awareness", () => {
+	// The reach check consults the real PATH and filesystem, so both are pinned
+	// to a temp dir here. Without that these tests would pass or fail depending
+	// on whether the machine running them happens to have ~/.cargo/bin on PATH.
+	let envRoot: string;
+	let savedPath: string | undefined;
+	let savedCargoRoot: string | undefined;
+
+	beforeEach(async () => {
+		availableBinaries = new Set(["bun", "cargo", "ripgrep"]);
+		execResults = new Map();
+
+		envRoot = await mkdtemp(path.join(tmpdir(), "claudeup-env-"));
+		await mkdir(path.join(envRoot, "bin"));
+		savedPath = process.env.PATH;
+		savedCargoRoot = process.env.CARGO_INSTALL_ROOT;
+		process.env.PATH = path.join(envRoot, "bin");
+		process.env.CARGO_INSTALL_ROOT = envRoot;
+	});
+
+	afterEach(async () => {
+		process.env.PATH = savedPath ?? "";
+		if (savedCargoRoot === undefined) process.env.CARGO_INSTALL_ROOT = "";
+		else process.env.CARGO_INSTALL_ROOT = savedCargoRoot;
+		await rm(envRoot, { recursive: true, force: true });
+	});
+
+	// The old code passed "ripgrep@14.1.0" to which(), never matched, and
+	// reinstalled on every single run.
+	it("skips a pinned npm package already at that version", async () => {
+		execResults.set("/usr/bin/ripgrep --version", {
+			stdout: "14.1.0",
+			stderr: "",
+		});
+		execResults.set("/usr/bin/bun pm bin -g", { stdout: "", stderr: "" });
+
+		const result = await installPluginDeps({ npm: ["ripgrep@14.1.0"] });
+
+		expect(result.skipped).toContain("npm:ripgrep@14.1.0");
+		expect(result.installed).toHaveLength(0);
+	});
+
+	it("reinstalls a pinned npm package at the wrong version", async () => {
+		execResults.set("/usr/bin/ripgrep --version", {
+			stdout: "14.0.0",
+			stderr: "",
+		});
+		execResults.set("/usr/bin/bun install -g", { stdout: "", stderr: "" });
+
+		const result = await installPluginDeps({ npm: ["ripgrep@14.1.0"] });
+
+		expect(result.installed).toContain("bun:ripgrep@14.1.0");
+	});
+
+	it("skips a pinned cargo crate already at that version", async () => {
+		execResults.set("/usr/bin/ripgrep --version", {
+			stdout: "ripgrep 14.1.0",
+			stderr: "",
+		});
+
+		const result = await installPluginDeps({ cargo: ["ripgrep@14.1.0"] });
+
+		expect(result.skipped).toContain("cargo:ripgrep@14.1.0");
+	});
+
+	it("installs a pinned cargo crate with --version, not crate@ver", async () => {
+		execResults.set("/usr/bin/ripgrep --version", {
+			stdout: "ripgrep 14.0.0",
+			stderr: "",
+		});
+		execResults.set("/usr/bin/cargo install ripgrep --version 14.1.0", {
+			stdout: "",
+			stderr: "",
+		});
+
+		const result = await installPluginDeps({ cargo: ["ripgrep@14.1.0"] });
+
+		// Only the exact `--version` invocation is stubbed as success, so this
+		// passing proves the argv shape.
+		expect(result.installed).toContain("cargo:ripgrep@14.1.0");
+		expect(result.failed).toHaveLength(0);
+	});
+});
+
 // ---------------------------------------------------------------------------
 // 5. checkMissingDeps tests — required binaries
 // ---------------------------------------------------------------------------

package/src/__tests__/profile-materializer.test.ts

@@ -38,6 +38,36 @@ describe("buildProfileSettings", () => {
 		});
 		expect(s.enableAllProjectMcpServers).toBe(true);
 	});
+
+	// Regression: `install` enables the manifest-wide union at USER scope, and
+	// Claude Code resolves enabledPlugins per plugin id — an id the project
+	// scope omits falls through to the user scope's `true`. A profile that
+	// merely omits another profile's plugins therefore never disables them, so
+	// `profile switch` silently becomes additive instead of exclusive.
+	test("explicitly disables union plugins the profile excludes", () => {
+		const s = buildProfileSettings(
+			closure({ plugins: { "designer@magus": "latest" } }),
+			["designer@magus", "terminal@magus", "gtd@magus"],
+		);
+		expect(s.enabledPlugins).toEqual({
+			"designer@magus": true,
+			"terminal@magus": false,
+			"gtd@magus": false,
+		});
+	});
+
+	test("a profile's own plugin wins over its union entry", () => {
+		const s = buildProfileSettings(
+			closure({ plugins: { "terminal@magus": "4.1.4" } }),
+			["terminal@magus"],
+		);
+		expect(s.enabledPlugins).toEqual({ "terminal@magus": true });
+	});
+
+	test("no union given -> no false entries (unchanged legacy shape)", () => {
+		const s = buildProfileSettings(closure({ plugins: { "dev@magus": "latest" } }));
+		expect(s.enabledPlugins).toEqual({ "dev@magus": true });
+	});
 });
 
 describe("buildProfileMcp", () => {
@@ -79,4 +109,61 @@ describe("materializeProfile", () => {
 		const settings = await fs.readJson(join(dir, "settings.json"));
 		expect(settings.enabledPlugins).toEqual({ "b@m": true });
 	});
+
+	// Regression: activating a profile replaces .claude/skills with a symlink,
+	// and replacing means fs.remove first. A repo that committed its own project
+	// skills before adopting profiles would lose them at that moment.
+	test("seeds skills/ from the project's pre-existing .claude/skills", async () => {
+		const src = join(project, ".claude", "skills", "systematic-debugging");
+		await fs.outputFile(join(src, "SKILL.md"), "# committed project skill\n");
+
+		const dir = await materializeProfile("p", closure(), project);
+
+		expect(
+			await fs.readFile(join(dir, "skills", "systematic-debugging", "SKILL.md"), "utf8"),
+		).toContain("committed project skill");
+	});
+
+	test("does not re-seed skills/ once the profile dir exists", async () => {
+		await fs.outputFile(
+			join(project, ".claude", "skills", "gone", "SKILL.md"),
+			"# removed later\n",
+		);
+		const dir = await materializeProfile("p", closure(), project);
+		await fs.remove(join(dir, "skills", "gone"));
+
+		await materializeProfile("p", closure(), project);
+
+		expect(await fs.pathExists(join(dir, "skills", "gone"))).toBe(false);
+	});
+
+	test("still creates an empty skills/ when the project has none", async () => {
+		const dir = await materializeProfile("p", closure(), project);
+		expect(await fs.pathExists(join(dir, "skills"))).toBe(true);
+		expect(await fs.readdir(join(dir, "skills"))).toEqual([]);
+	});
+
+	test("two profiles from one union each disable the other's plugins", async () => {
+		const union = ["designer@magus", "terminal@magus"];
+		const fe = await materializeProfile(
+			"frontend",
+			closure({ plugins: { "designer@magus": "latest" } }),
+			project,
+			union,
+		);
+		const be = await materializeProfile(
+			"backend",
+			closure({ plugins: { "terminal@magus": "latest" } }),
+			project,
+			union,
+		);
+		expect((await fs.readJson(join(fe, "settings.json"))).enabledPlugins).toEqual({
+			"designer@magus": true,
+			"terminal@magus": false,
+		});
+		expect((await fs.readJson(join(be, "settings.json"))).enabledPlugins).toEqual({
+			"designer@magus": false,
+			"terminal@magus": true,
+		});
+	});
 });