magus-cli 0.0.0-placeholder → 7.1.0

package/src/__tests__/registry-version-resolution.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, test } from "bun:test";
+import { pickRegistryEntry } from "../services/claude-settings.js";
+import type { InstalledPluginEntry } from "../types/index.js";
+
+/**
+ * Regression cover for the "no outdated plugins shown" bug.
+ *
+ * magus used to read installed versions from `settings.installedPluginVersions`
+ * only. Claude Code's own `plugin install` writes installed_plugins.json but not
+ * that settings key, so a genuinely installed plugin could be missing from it.
+ * The update check is `installedVersion && compare(latest, installedVersion) > 0`,
+ * so a missing version resolved to `hasUpdate: false` — an available update was
+ * reported as "up to date" rather than "unknown".
+ */
+
+const entry = (
+	scope: InstalledPluginEntry["scope"],
+	version: string,
+	projectPath?: string,
+): InstalledPluginEntry => ({
+	scope,
+	version,
+	projectPath,
+	installPath: `/cache/${version}`,
+	installedAt: "2026-01-01T00:00:00.000Z",
+	lastUpdated: "2026-01-01T00:00:00.000Z",
+});
+
+describe("pickRegistryEntry — scope resolution", () => {
+	test("user scope takes the user entry, ignoring project installs", () => {
+		const entries = [
+			entry("project", "1.0.0", "/proj/a"),
+			entry("user", "2.0.0"),
+			entry("project", "3.0.0", "/proj/b"),
+		];
+		expect(pickRegistryEntry(entries, "user")?.version).toBe("2.0.0");
+	});
+
+	test("project scope prefers the entry pinned to that exact project", () => {
+		const entries = [
+			entry("user", "2.0.0"),
+			entry("project", "1.0.0", "/proj/a"),
+			entry("project", "3.0.0", "/proj/b"),
+		];
+		expect(pickRegistryEntry(entries, "project", "/proj/b")?.version).toBe(
+			"3.0.0",
+		);
+	});
+
+	test("project scope falls back to the user entry when the project has no install", () => {
+		// This is the statusline case: installed at user scope, absent from project
+		// settings, previously surfaced as "no version" and skipped by update checks.
+		const entries = [
+			entry("user", "2.1.2"),
+			entry("project", "1.0.0", "/proj/other"),
+		];
+		expect(pickRegistryEntry(entries, "project", "/proj/mine")?.version).toBe(
+			"2.1.2",
+		);
+	});
+
+	test("project paths are compared resolved, not as raw strings", () => {
+		const entries = [entry("project", "4.2.0", "/proj/a/../a")];
+		expect(pickRegistryEntry(entries, "project", "/proj/a")?.version).toBe(
+			"4.2.0",
+		);
+	});
+
+	test("a local-scope entry satisfies a project lookup for the same path", () => {
+		const entries = [
+			entry("local", "5.0.0", "/proj/a"),
+			entry("user", "1.0.0"),
+		];
+		expect(pickRegistryEntry(entries, "project", "/proj/a")?.version).toBe(
+			"5.0.0",
+		);
+	});
+
+	test("no project path and no user entry yields undefined, not a wrong project's version", () => {
+		const entries = [entry("project", "9.9.9", "/proj/somewhere-else")];
+		expect(pickRegistryEntry(entries, "project")).toBeUndefined();
+	});
+
+	test("empty and missing entry lists are handled", () => {
+		expect(pickRegistryEntry([], "user")).toBeUndefined();
+		expect(pickRegistryEntry(undefined, "user")).toBeUndefined();
+	});
+});

package/src/__tests__/resolve-executable.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { chmod, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveExecutable } from "../utils/command-utils.js";
+
+/**
+ * resolveExecutable must treat a dangling symlink as NOT available — the exact
+ * failure mode behind a plugin's binary looking present (the symlink exists)
+ * while failing at runtime (its target is gone).
+ */
+describe("resolveExecutable — dangling symlink detection", () => {
+	let dir: string;
+	let prevPath: string | undefined;
+
+	beforeEach(async () => {
+		dir = await mkdtemp(join(tmpdir(), "resolveexe-"));
+		prevPath = process.env.PATH;
+		process.env.PATH = `${dir}:${prevPath}`;
+	});
+	afterEach(async () => {
+		process.env.PATH = prevPath;
+		await rm(dir, { recursive: true, force: true });
+	});
+
+	test("a live executable resolves", async () => {
+		const bin = join(dir, "livetool");
+		await writeFile(bin, "#!/bin/sh\necho hi\n");
+		await chmod(bin, 0o755);
+		expect(await resolveExecutable("livetool")).not.toBeNull();
+	});
+
+	test("a dangling symlink resolves to null", async () => {
+		const link = join(dir, "ghosttool");
+		await symlink(join(dir, "does-not-exist"), link);
+		expect(await resolveExecutable("ghosttool")).toBeNull();
+	});
+
+	test("a missing command resolves to null", async () => {
+		expect(await resolveExecutable("definitely-not-a-real-cmd-xyz")).toBeNull();
+	});
+});

package/src/__tests__/resolver.test.ts

@@ -0,0 +1,351 @@
+import { describe, expect, test } from "bun:test";
+import { PREDEFINED_PROFILES } from "../data/predefined-profiles.js";
+import {
+	dedupeBins,
+	resolveAllProfiles,
+	resolveExtends,
+	resolveProfile,
+} from "../services/resolver.js";
+import type {
+	BinRequirement,
+	ProfileManifest,
+	ProfileManifestEntry,
+} from "../types/index.js";
+
+// A binResolver that returns canned requires.bin per plugin — keeps the
+// resolver tests hermetic (no marketplace cache / filesystem).
+function fakeBinResolver(
+	table: Record<string, BinRequirement[]>,
+): (pluginId: string) => Promise<BinRequirement[]> {
+	return async (pluginId) => table[pluginId] ?? [];
+}
+
+function manifestOf(
+	profiles: Record<string, ProfileManifestEntry>,
+): ProfileManifest {
+	return { version: 2, profiles };
+}
+
+describe("dedupeBins — precedence by order", () => {
+	test("first-seen wins installer/version; later contributes only provenance", () => {
+		const claudishPin: BinRequirement = {
+			name: "claudish",
+			via: "bun",
+			package: "claudish",
+			version: "1.2.0",
+		};
+		const claudishLoose: BinRequirement = {
+			name: "claudish",
+			via: "npm",
+			package: "claudish",
+		};
+		const result = dedupeBins([
+			{ bin: claudishPin, source: "profile:x.cliTools" },
+			{ bin: claudishLoose, source: "plugin:foo@magus" },
+		]);
+		expect(result).toHaveLength(1);
+		expect(result[0]!.via).toBe("bun");
+		expect(result[0]!.version).toBe("1.2.0");
+		expect(result[0]!.sources).toEqual([
+			"profile:x.cliTools",
+			"plugin:foo@magus",
+		]);
+	});
+
+	test("a later entry fills a version the winner left unset", () => {
+		const loose: BinRequirement = { name: "tmux", via: "brew" };
+		const pinned: BinRequirement = {
+			name: "tmux",
+			via: "brew",
+			version: "3.4",
+		};
+		const result = dedupeBins([
+			{ bin: loose, source: "plugin:a" },
+			{ bin: pinned, source: "plugin:b" },
+		]);
+		expect(result[0]!.version).toBe("3.4");
+	});
+});
+
+describe("resolveExtends", () => {
+	test("inherits predefined plugins/settings under the entry's own", () => {
+		const entry: ProfileManifestEntry = {
+			name: "Custom",
+			extends: "must-have",
+			plugins: { "dev@magus": "2.9.0" },
+			settings: { effortLevel: "max" },
+		};
+		const merged = resolveExtends(entry);
+		// must-have contributes setup@magus + multimodel@magus at "latest".
+		expect(merged.plugins!["setup@magus"]).toBe("latest");
+		expect(merged.plugins!["multimodel@magus"]).toBe("latest");
+		// Entry's own plugin pin is preserved.
+		expect(merged.plugins!["dev@magus"]).toBe("2.9.0");
+		// Entry setting wins over the inherited one.
+		expect(merged.settings!.effortLevel).toBe("max");
+	});
+
+	test("honors an explicit @marketplace on a predefined plugin name", () => {
+		const entry: ProfileManifestEntry = {
+			name: "Growth",
+			extends: "growth-marketer",
+		};
+		const merged = resolveExtends(entry);
+		// image/video-editing ship on the magus-marketing channel and
+		// pin it explicitly — they must NOT be rewritten to @magus.
+		expect(merged.plugins!["image@magus-marketing"]).toBe("latest");
+		expect(merged.plugins!["video-editing@magus-marketing"]).toBe("latest");
+		expect(merged.plugins!["image-generate@magus"]).toBeUndefined();
+		// Bare names still default to @magus.
+		expect(merged.plugins!["browser-use@magus"]).toBe("latest");
+	});
+
+	test("no extends is a no-op", () => {
+		const entry: ProfileManifestEntry = { name: "Plain", plugins: {} };
+		expect(resolveExtends(entry)).toBe(entry);
+	});
+
+	// `models` inherits like `settings` — later wins — but by WHOLE object: a
+	// ModelsConfig is validated as a unit (every grade present, one effort per
+	// model), so a key-by-key merge could produce a config neither side wrote
+	// and neither side validated.
+	test("the entry's own models win over an inherited one, whole-object", () => {
+		const base = {
+			version: 1,
+			preset: "inherited",
+			main: { model: "sonnet" },
+			grades: {
+				smart: { model: "opus" },
+				normal: { model: "sonnet" },
+				cheap: { model: "haiku" },
+			},
+			agents: {},
+			fallback: "normal",
+		} as ProfileManifestEntry["models"];
+		const own = { ...(base as object), preset: "mine" } as typeof base;
+
+		const withBase = PREDEFINED_PROFILES.find((p) => p.id === "must-have");
+		if (!withBase) throw new Error("must-have preset went missing");
+		withBase.models = base;
+		try {
+			expect(
+				resolveExtends({ name: "X", extends: "must-have" }).models?.preset,
+			).toBe("inherited");
+			expect(
+				resolveExtends({ name: "X", extends: "must-have", models: own }).models
+					?.preset,
+			).toBe("mine");
+		} finally {
+			withBase.models = undefined;
+		}
+	});
+
+	test("unknown extends id is ignored (returns entry unchanged)", () => {
+		const entry: ProfileManifestEntry = { name: "X", extends: "nope" };
+		expect(resolveExtends(entry)).toBe(entry);
+	});
+});
+
+describe("resolveProfile", () => {
+	test("normalizes plugins, unions cliTools with plugin bins (project pin wins)", async () => {
+		const manifest = manifestOf({
+			frontend: {
+				name: "Frontend",
+				plugins: {
+					"terminal@magus": "4.1.0",
+					"dev@magus": true, // → latest
+					"old@magus": false, // → omitted
+				},
+				cliTools: { claudish: "1.2.0" },
+				env: { required: ["FIGMA_ACCESS_TOKEN"] },
+			},
+		});
+
+		const closure = await resolveProfile(manifest, "frontend", {
+			binResolver: fakeBinResolver({
+				"terminal@magus": [
+					{ name: "tmux", via: "brew", formula: "tmux" },
+					// terminal ALSO wants claudish, but the profile pinned it →
+					// profile pin must win.
+					{ name: "claudish", via: "npm", package: "claudish" },
+				],
+			}),
+		});
+
+		expect(closure.plugins).toEqual({
+			"terminal@magus": "4.1.0",
+			"dev@magus": "latest",
+		});
+		expect(closure.env.required).toEqual(["FIGMA_ACCESS_TOKEN"]);
+
+		const claudish = closure.bins.find((b) => b.name === "claudish")!;
+		expect(claudish.via).toBe("bun"); // from the cli-tools catalog, not npm
+		expect(claudish.version).toBe("1.2.0");
+		expect(claudish.sources[0]).toContain("cliTools");
+
+		const tmux = closure.bins.find((b) => b.name === "tmux")!;
+		expect(tmux.via).toBe("brew");
+		expect(tmux.sources).toContain("plugin:terminal@magus");
+	});
+
+	test("throws for an unknown profile id", async () => {
+		await expect(resolveProfile(manifestOf({}), "ghost")).rejects.toThrow(
+			'Profile "ghost" not found',
+		);
+	});
+});
+
+describe("resolveAllProfiles — union", () => {
+	test("unions plugins/bins/skills/env; a pin beats latest across profiles", async () => {
+		const manifest = manifestOf({
+			frontend: {
+				name: "Frontend",
+				plugins: { "dev@magus": "latest", "terminal@magus": "4.1.0" },
+				skills: [{ name: "A", repo: "o/r", path: "skills/a" }],
+				env: { required: ["FIGMA_ACCESS_TOKEN"] },
+			},
+			backend: {
+				name: "Backend",
+				plugins: { "dev@magus": "2.9.0" }, // pin should win over "latest"
+				cliTools: { mnemex: "latest" },
+				skills: [{ name: "A", repo: "o/r", path: "skills/a" }], // dupe
+				env: { required: ["DATABASE_URL"] },
+			},
+		});
+
+		const union = await resolveAllProfiles(manifest, {
+			binResolver: fakeBinResolver({}),
+		});
+
+		expect(union.plugins["dev@magus"]).toBe("2.9.0"); // pin beat latest
+		expect(union.plugins["terminal@magus"]).toBe("4.1.0");
+		expect(union.skills).toHaveLength(1); // deduped by repo#path
+		expect(union.env.required.sort()).toEqual([
+			"DATABASE_URL",
+			"FIGMA_ACCESS_TOKEN",
+		]);
+		expect(union.bins.find((b) => b.name === "mnemex")?.via).toBe("bun");
+		expect(union.conflicts).toBeUndefined(); // latest-vs-pin isn't a conflict
+	});
+
+	test("conflicting explicit pins resolve to the higher semver, order-independent, and are reported", async () => {
+		const mk = (order: "ab" | "ba"): ProfileManifest => {
+			const a: ProfileManifestEntry = {
+				name: "A",
+				plugins: { "dev@magus": "2.9.0" },
+			};
+			const b: ProfileManifestEntry = {
+				name: "B",
+				plugins: { "dev@magus": "2.11.0" },
+			};
+			return manifestOf(order === "ab" ? { a, b } : { b, a });
+		};
+		const ab = await resolveAllProfiles(mk("ab"), {
+			binResolver: fakeBinResolver({}),
+		});
+		const ba = await resolveAllProfiles(mk("ba"), {
+			binResolver: fakeBinResolver({}),
+		});
+
+		// Deterministic: higher pin wins regardless of profile order.
+		expect(ab.plugins["dev@magus"]).toBe("2.11.0");
+		expect(ba.plugins["dev@magus"]).toBe("2.11.0");
+		// And the conflict is surfaced, not silent.
+		expect(ab.conflicts?.some((c) => c.includes("dev@magus"))).toBe(true);
+		expect(ba.conflicts?.some((c) => c.includes("dev@magus"))).toBe(true);
+	});
+
+	test("conflicting bin pins across profiles resolve deterministically + report", async () => {
+		const manifest = manifestOf({
+			a: { name: "A", cliTools: { claudish: "1.2.0" } },
+			b: { name: "B", cliTools: { claudish: "1.5.0" } },
+		});
+		const union = await resolveAllProfiles(manifest, {
+			binResolver: fakeBinResolver({}),
+		});
+		expect(union.bins.find((x) => x.name === "claudish")?.version).toBe(
+			"1.5.0",
+		);
+		expect(union.conflicts?.some((c) => c.includes("claudish"))).toBe(true);
+	});
+});
+
+describe("marketplaces derived from plugin ids", () => {
+	const noBins = { binResolver: fakeBinResolver({}) };
+
+	test("a plugin id registers the marketplace it names", async () => {
+		const manifest = manifestOf({
+			solo: { name: "Solo", plugins: { "dev@magus": "latest" } },
+		});
+		const c = await resolveProfile(manifest, "solo", noBins);
+		expect(c.marketplaces.magus).toEqual({
+			source: "github",
+			repo: "MadAppGang/magus",
+		});
+	});
+
+	test("extends alone is enough — the failure this fixes", async () => {
+		// A profile that only extends a predefined one inherits plugins like
+		// dev@magus and previously NO marketplaces, so install resolved every
+		// plugin against a marketplace that was never registered.
+		const manifest = manifestOf({
+			team: { name: "Team", extends: "developer-essentials" },
+		});
+		const c = await resolveProfile(manifest, "team", noBins);
+		expect(Object.keys(c.plugins).length).toBeGreaterThan(0);
+		expect(c.marketplaces.magus?.repo).toBe("MadAppGang/magus");
+	});
+
+	test("each distinct channel is derived, not just the first", async () => {
+		const manifest = manifestOf({
+			mixed: {
+				name: "Mixed",
+				plugins: {
+					"dev@magus": "latest",
+					"image@magus-marketing": "latest",
+					"feature-dev@claude-plugins-official": "latest",
+				},
+			},
+		});
+		const c = await resolveProfile(manifest, "mixed", noBins);
+		expect(c.marketplaces["magus-marketing"]?.repo).toBe(
+			"MadAppGang/magus-marketing",
+		);
+		expect(c.marketplaces["claude-plugins-official"]?.repo).toBe(
+			"anthropics/claude-plugins-official",
+		);
+	});
+
+	test("an explicit declaration is never overridden", async () => {
+		const manifest = manifestOf({
+			pinned: {
+				name: "Pinned",
+				marketplaces: {
+					magus: { source: "github", repo: "MadAppGang/magus-fork" },
+				},
+				plugins: { "dev@magus": "latest" },
+			},
+		});
+		const c = await resolveProfile(manifest, "pinned", noBins);
+		expect(c.marketplaces.magus?.repo).toBe("MadAppGang/magus-fork");
+	});
+
+	test("an unknown marketplace is left for the manifest to declare", async () => {
+		const manifest = manifestOf({
+			third: {
+				name: "Third",
+				plugins: { "thing@someones-marketplace": "latest" },
+			},
+		});
+		const c = await resolveProfile(manifest, "third", noBins);
+		expect(c.marketplaces["someones-marketplace"]).toBeUndefined();
+	});
+
+	test("a bare plugin id contributes no marketplace", async () => {
+		const manifest = manifestOf({
+			bare: { name: "Bare", plugins: { local: "latest" } },
+		});
+		const c = await resolveProfile(manifest, "bare", noBins);
+		expect(Object.keys(c.marketplaces)).toHaveLength(0);
+	});
+});

package/src/__tests__/scope-action.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, test } from "bun:test";
+import {
+	type PluginInfo,
+	isInstalledInScope,
+	resolveScopeAction,
+} from "../services/plugin-manager.js";
+import { planPluginUpdates, scopeIsBehind } from "../services/update-plan.js";
+
+/**
+ * The scope keys (u / p / l) and the Enter scope picker both decide between
+ * install, update and uninstall. That decision used to read `scope.enabled` —
+ * the `enabledPlugins` flag from a settings file — and ignore `scope.version`,
+ * which is the registry-backed answer to "did Claude Code actually install
+ * this".
+ *
+ * Those two disagree in a real, common state: a plugin listed in
+ * `enabledPlugins` with no entry in `installed_plugins.json` for the current
+ * project path. The list row renders it "not installed" (isEnabledButNotInstalled),
+ * and pressing its scope key ran `claude plugin uninstall`. The user asked to
+ * install the thing the UI told them was missing, and it was removed instead.
+ */
+
+describe("isInstalledInScope", () => {
+	test("enabled with a registry version is installed", () => {
+		expect(isInstalledInScope({ enabled: true, version: "3.0.2" })).toBe(true);
+	});
+
+	test("enabled with NO version is not installed — the broken state", () => {
+		// dev@magus, measured: `.claude/settings.json` had "dev@magus": true while
+		// installed_plugins.json had no entry resolving for the project path.
+		expect(isInstalledInScope({ enabled: true })).toBe(false);
+	});
+
+	test("a registry version with the flag off IS installed", () => {
+		// Installation and enablement are separate facts. This asserted `false`
+		// until it was measured against the other direction: a plugin with a real
+		// registry row that the user had simply switched off reported "not
+		// installed", so its row offered to install what was already on disk, and
+		// the header counted it out.
+		//
+		// The hazard the sibling test above guards — pressing a scope key on
+		// enabled-with-no-version and having it run `uninstall` — is untouched:
+		// that case has no version, so it is still not installed, and still
+		// resolves to `install`.
+		expect(isInstalledInScope({ enabled: false, version: "3.0.2" })).toBe(true);
+	});
+
+	test("an absent scope is not installed", () => {
+		expect(isInstalledInScope(undefined)).toBe(false);
+	});
+
+	test('"0.0.0" counts as installed — Anthropic official plugins record it', () => {
+		expect(isInstalledInScope({ enabled: true, version: "0.0.0" })).toBe(true);
+	});
+});
+
+describe("resolveScopeAction", () => {
+	// The second argument is "is this scope provably behind?", which the screen
+	// takes from the classifier (`scopeIsBehind`). It used to be the catalog
+	// version, compared here with raw string inequality — a fourth rule.
+
+	test("REGRESSION: enabled but not installed resolves to install, never uninstall", () => {
+		// This is the reported bug. Before the fix this returned "uninstall".
+		expect(resolveScopeAction({ enabled: true }, false)).toBe("install");
+		// Whatever the classifier says: the safety branch comes first.
+		expect(resolveScopeAction({ enabled: true }, true)).toBe("install");
+	});
+
+	test("a scope that was never enabled resolves to install", () => {
+		expect(resolveScopeAction(undefined, false)).toBe("install");
+		expect(resolveScopeAction({ enabled: false }, false)).toBe("install");
+	});
+
+	test("a healthy install at the latest version resolves to uninstall (toggle off)", () => {
+		expect(resolveScopeAction({ enabled: true, version: "3.0.2" }, false)).toBe(
+			"uninstall",
+		);
+	});
+
+	test("a healthy install behind the catalog resolves to update", () => {
+		expect(resolveScopeAction({ enabled: true, version: "2.9.0" }, true)).toBe(
+			"update",
+		);
+	});
+});
+
+/** The screen's path: classify, then ask `scopeIsBehind` for the pressed scope. */
+function keyFor(installed: string, catalogVersion: string | null) {
+	const scope = { enabled: true, version: installed };
+	const [status] = planPluginUpdates(
+		{ "x@magus": "latest" },
+		new Map([
+			[
+				"x@magus",
+				{
+					id: "x@magus",
+					name: "x",
+					version: catalogVersion,
+					description: "",
+					marketplace: "magus",
+					marketplaceDisplay: "Magus",
+					enabled: true,
+					projectScope: scope,
+				} as PluginInfo,
+			],
+		]),
+	);
+	return resolveScopeAction(scope, scopeIsBehind(status, "project"));
+}
+
+describe("resolveScopeAction through the classifier — the screen's real path", () => {
+	test('an unknown catalog version ("0.0.0") never fabricates an update', () => {
+		// There is nothing to update *to*, so toggling must still mean uninstall.
+		expect(keyFor("3.0.2", "0.0.0")).toBe("uninstall");
+	});
+
+	test("installed with unknown version resolves to update when a real version is published", () => {
+		// "0.0.0" installed against a real catalog version is a genuine upgrade
+		// path, not the broken state — it must not be treated as uninstall.
+		expect(keyFor("0.0.0", "3.0.2")).toBe("update");
+	});
+
+	test("REGRESSION: a scope AHEAD of the catalog no longer resolves to update", () => {
+		// Raw string inequality called 3.1.0 vs 3.0.2 "behind" and offered an
+		// update that could only reinstall the older version or no-op.
+		expect(keyFor("3.1.0", "3.0.2")).toBe("uninstall");
+	});
+
+	test("REGRESSION: an unorderable scope no longer resolves to update", () => {
+		// A sha against a semver cannot be ordered. The row says "?", so the key
+		// must not act as though it knew the scope was behind.
+		expect(keyFor("3ea32df27be7", "3.0.2")).toBe("uninstall");
+	});
+});