magus-cli 7.1.0 → 7.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magus-cli",
-  "version": "7.1.0",
+  "version": "7.2.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "magus-cli-darwin-arm64": "7.1.0",
-    "magus-cli-darwin-x64": "7.1.0",
-    "magus-cli-linux-x64": "7.1.0"
+    "magus-cli-darwin-arm64": "7.2.0",
+    "magus-cli-darwin-x64": "7.2.0",
+    "magus-cli-linux-x64": "7.2.0"
   }
 }

package/src/__tests__/profile-migration-offer.test.ts

@@ -0,0 +1,211 @@
+/**
+ * The CLI gate: no active profile, no command.
+ *
+ * This replaces `offerAdoptionOnDrift`, which asked only when the manifest had
+ * drifted from `enabledPlugins`, let the user decline, and then let `magus
+ * update` carry on with a profile "for this run only" — resolving against a
+ * manifest the project was not running. Two worlds live at once.
+ *
+ * The interactive path mounts a real OpenTUI renderer and cannot run here; what
+ * IS testable is every path that must refuse, which is the behaviour that
+ * changed. `selectDialog` returns null without a TTY, so a non-TTY run takes
+ * the refusal branch by construction — which is also what CI does.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import fs from "fs-extra";
+import { requireActiveProfile } from "../cli/bootstrap.js";
+import { runUpdateCommand } from "../cli/update.js";
+import { materializeAndActivate } from "../services/profile-activate.js";
+import { activeProfile } from "../services/symlink-manager.js";
+import type { ProfileManifest } from "../types/index.js";
+
+const MANIFEST: ProfileManifest = {
+	version: 2,
+	profiles: {
+		lean: { name: "Lean", plugins: { "terminal@magus": "latest" } },
+		full: { name: "Full", plugins: { "dev@magus": "latest" } },
+	},
+};
+
+describe("requireActiveProfile", () => {
+	let project: string;
+	let wasTTY: boolean | undefined;
+
+	beforeEach(async () => {
+		project = await mkdtemp(join(tmpdir(), "gate-"));
+		await fs.outputJson(join(project, ".claude", "settings.json"), {
+			enabledPlugins: { "dev@magus": true },
+		});
+		wasTTY = process.stdin.isTTY;
+	});
+	afterEach(async () => {
+		Object.defineProperty(process.stdin, "isTTY", {
+			value: wasTTY,
+			configurable: true,
+		});
+		await rm(project, { recursive: true, force: true });
+	});
+
+	/** Force the non-interactive path, as CI has. */
+	function noTTY(): void {
+		Object.defineProperty(process.stdin, "isTTY", {
+			value: false,
+			configurable: true,
+		});
+	}
+
+	test("refuses when profiles exist but none is active", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), MANIFEST);
+		noTTY();
+
+		// null is the caller's signal to exit non-zero. The old code returned the
+		// manifest here and the command went on to update a profile the project
+		// was not running.
+		expect(await requireActiveProfile(project, MANIFEST)).toBeNull();
+		expect(await activeProfile(project)).toBeNull();
+	});
+
+	test("refuses when the project has no manifest at all", async () => {
+		noTTY();
+		expect(
+			await requireActiveProfile(project, { version: 2, profiles: {} }),
+		).toBeNull();
+	});
+
+	test("refusing writes nothing", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), MANIFEST);
+		noTTY();
+
+		await requireActiveProfile(project, MANIFEST);
+
+		// No profile materialized, no backups taken, settings left exactly as it
+		// was: a refusal is not allowed to half-migrate anything.
+		expect(await fs.pathExists(join(project, ".claude", "_profiles"))).toBe(
+			false,
+		);
+		expect(
+			await fs.pathExists(join(project, ".claude", ".magus-backups")),
+		).toBe(false);
+		expect(
+			(
+				await fs.lstat(join(project, ".claude", "settings.json"))
+			).isSymbolicLink(),
+		).toBe(false);
+		expect(
+			await fs.readJson(join(project, ".claude", "profiles.json")),
+		).toEqual(MANIFEST);
+	});
+
+	test("--check refuses too, and never repairs", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), MANIFEST);
+
+		// Even at a TTY: `--check` is a read-only CI gate, and "this project is not
+		// on a profile" is a legitimate failure for it rather than a prompt.
+		Object.defineProperty(process.stdin, "isTTY", {
+			value: true,
+			configurable: true,
+		});
+		expect(
+			await requireActiveProfile(project, MANIFEST, { check: true }),
+		).toBeNull();
+		expect(await fs.pathExists(join(project, ".claude", "_profiles"))).toBe(
+			false,
+		);
+	});
+
+	test("passes straight through when a profile IS active", async () => {
+		await fs.outputJson(join(project, ".claude", "profiles.json"), MANIFEST);
+		await materializeAndActivate(MANIFEST, "lean", project, () => {});
+		noTTY();
+
+		// No prompt, no refusal: the one state where there is nothing to ask.
+		const carried = await requireActiveProfile(project, MANIFEST);
+
+		expect(carried).toEqual(MANIFEST);
+		expect(await activeProfile(project)).toBe("lean");
+	});
+
+	test("naming a profile skips the gate entirely", async () => {
+		// `magus update lean` says which profile to update, and updating it needs
+		// the manifest rather than the symlink — installs go to project scope
+		// either way. Gating it would refuse a question already answered on the
+		// command line, and would break `magus update lean` and `--check lean` in
+		// CI, both of which worked before the gate existed. Caught in release
+		// preflight, when the version bump had to be justified.
+		await fs.outputJson(join(project, ".claude", "profiles.json"), MANIFEST);
+		noTTY();
+
+		// The gate itself still refuses without an argument...
+		expect(await requireActiveProfile(project, MANIFEST)).toBeNull();
+
+		// ...and a named profile must not reach it. Exit code alone cannot show
+		// that — an unknown name exits 1 either way — so this asserts on WHICH
+		// error was printed. The gate's own wording must be absent, and the
+		// unknown-profile error (which lives past the gate) must be present.
+		const said: string[] = [];
+		const realError = console.error;
+		const realLog = console.log;
+		console.error = (...a: unknown[]) => said.push(a.join(" "));
+		console.log = () => {};
+		try {
+			expect(await runUpdateCommand(["no-such-profile"], project)).toBe(1);
+		} finally {
+			console.error = realError;
+			console.log = realLog;
+		}
+		const output = said.join("\n");
+
+		expect(output).toContain("no-such-profile");
+		expect(output).not.toContain("No profile selected");
+	});
+
+	test("--dry-run writes nothing and exits 0", async () => {
+		// `--dry-run` promises to write nothing and exit 0. An earlier version
+		// passed only `check: flags.check`, so a dry run reached `autoActivate`,
+		// wrote symlinks and appended to the TRACKED `.gitignore`. A preview that
+		// mutates the repo is not a preview. Refusing is the right outcome, and
+		// for a preview it is not a failure — hence 0, where `--check` gives 1.
+		await fs.outputJson(join(project, ".claude", "profiles.json"), {
+			...MANIFEST,
+			default: "lean",
+		});
+		// No settings.json at all: the fresh-clone shape, where auto-activation
+		// would otherwise fire with nothing to displace.
+		await fs.remove(join(project, ".claude", "settings.json"));
+
+		const realLog = console.log;
+		const realError = console.error;
+		console.log = () => {};
+		console.error = () => {};
+		try {
+			expect(await runUpdateCommand(["--dry-run"], project)).toBe(0);
+		} finally {
+			console.log = realLog;
+			console.error = realError;
+		}
+
+		expect(await activeProfile(project)).toBeNull();
+		expect(await fs.pathExists(join(project, ".claude", "_profiles"))).toBe(
+			false,
+		);
+		expect(await fs.pathExists(join(project, ".gitignore"))).toBe(false);
+	});
+
+	test("an active profile passes even with unrelated plugins enabled", async () => {
+		// The gate must not consult enabledPlugins. A project running a profile is
+		// usable regardless of what its generated settings currently say.
+		await fs.outputJson(join(project, ".claude", "profiles.json"), MANIFEST);
+		await materializeAndActivate(MANIFEST, "lean", project, () => {});
+		await fs.outputJson(
+			join(project, ".claude", "_profiles", "lean", "settings.json"),
+			{ enabledPlugins: { "something-else@magus": true } },
+		);
+		noTTY();
+
+		expect(await requireActiveProfile(project, MANIFEST)).not.toBeNull();
+	});
+});

package/src/__tests__/profile-migration.test.ts

@@ -0,0 +1,242 @@
+/**
+ * Migration = adopt AND activate, without destroying what it replaces.
+ *
+ * REGRESSION: adopting a project wrote `.claude/profiles.json` and stopped, so
+ * `activeProfile()` still returned null and every later run asked which profile
+ * to use. The manifest changed; nothing the user could feel did. Fixed in
+ * /dev:fix session dev-fix-20260918-migration.
+ *
+ * The second half is the reason activation was left out in the first place:
+ * activating replaces four real paths with symlinks, and the replacement used
+ * `fs.remove` with no backup. A migration that loses a hand-written
+ * `.claude/settings.json` is worse than one that does nothing.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { lstat, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import fs from "fs-extra";
+import { materializeAndActivate } from "../services/profile-activate.js";
+import { adoptCurrentProject } from "../services/profile-adopt.js";
+import {
+	activateProfile,
+	activeProfile,
+	backupRoot,
+	profileDir,
+	profilesRoot,
+} from "../services/symlink-manager.js";
+import type { ProfileManifest } from "../types/index.js";
+
+/** Materialize a fake profile dir, as `magus install` would have. */
+async function materialize(
+	project: string,
+	name: string,
+	settings: object,
+): Promise<void> {
+	const dir = profileDir(name, project);
+	await fs.ensureDir(dir);
+	await fs.writeJson(join(dir, "settings.json"), settings);
+	await fs.writeJson(join(dir, "mcp.json"), { mcpServers: {} });
+}
+
+describe("activation never deletes a real file", () => {
+	let project: string;
+	beforeEach(async () => {
+		project = await mkdtemp(join(tmpdir(), "migrate-"));
+	});
+	afterEach(async () => {
+		await rm(project, { recursive: true, force: true });
+	});
+
+	test("a hand-written settings.json is moved aside, not destroyed", async () => {
+		const settingsPath = join(project, ".claude", "settings.json");
+		await fs.outputJson(settingsPath, { hand: "written", keep: "me" });
+		await materialize(project, "team", { enabledPlugins: {} });
+
+		const backups = await activateProfile("team", project);
+
+		// The link is live...
+		expect((await lstat(settingsPath)).isSymbolicLink()).toBe(true);
+		// ...and the file it displaced is still readable somewhere.
+		const saved = backups.find((b) => b.link === settingsPath);
+		expect(saved).toBeDefined();
+		expect(await fs.readJson(saved?.savedTo ?? "")).toEqual({
+			hand: "written",
+			keep: "me",
+		});
+	});
+
+	test("switching between profiles reports no backups", async () => {
+		await materialize(project, "a", { enabledPlugins: {} });
+		await materialize(project, "b", { enabledPlugins: {} });
+
+		await activateProfile("a", project);
+		// Everything at the link paths is now a symlink magus itself wrote.
+		// Backing those up on every switch would fill the repo with copies of
+		// generated state that the manifest can regenerate at any time.
+		const second = await activateProfile("b", project);
+
+		expect(second).toEqual([]);
+	});
+
+	test("a symlink magus does not own is preserved too", async () => {
+		// Someone pointed .mcp.json at a shared config outside the project. It is
+		// not generated state, so it gets the same protection a real file gets.
+		const outside = join(project, "shared-mcp.json");
+		await fs.writeJson(outside, { mcpServers: { shared: {} } });
+		await fs.symlink(outside, join(project, ".mcp.json"));
+		await materialize(project, "team", { enabledPlugins: {} });
+
+		const backups = await activateProfile("team", project);
+
+		expect(backups.map((b) => b.link)).toContain(join(project, ".mcp.json"));
+		// The target was never touched — only the link moved.
+		expect(await fs.readJson(outside)).toEqual({ mcpServers: { shared: {} } });
+	});
+
+	test("a RELATIVE user symlink still resolves from the backup", async () => {
+		// A symlink's target resolves against the directory the link sits in, so
+		// moving the link into a backup two levels deeper silently repoints it.
+		// Preserving a link that no longer resolves preserves nothing.
+		await fs.writeJson(join(project, "shared-mcp.json"), { mcpServers: {} });
+		await fs.symlink("shared-mcp.json", join(project, ".mcp.json"));
+		await materialize(project, "team", { enabledPlugins: {} });
+
+		const backups = await activateProfile("team", project);
+		const saved = backups.find((b) => b.link === join(project, ".mcp.json"));
+
+		expect(saved).toBeDefined();
+		// readJson follows the link: if it were still relative this would throw.
+		expect(await fs.readJson(saved?.savedTo ?? "")).toEqual({ mcpServers: {} });
+	});
+
+	test("backups live OUTSIDE the regenerable _profiles/ tree", async () => {
+		// `_profiles/` is generated and documented as safe to delete. A backup kept
+		// there is the only copy of a hand-written file, stored in the one
+		// directory everybody is told they can remove.
+		await fs.outputJson(join(project, ".claude", "settings.json"), { a: 1 });
+		await materialize(project, "team", { enabledPlugins: {} });
+
+		const backups = await activateProfile("team", project);
+		const saved = backups[0]?.savedTo ?? "";
+
+		expect(saved.startsWith(profilesRoot(project))).toBe(false);
+		expect(saved.startsWith(backupRoot(project))).toBe(true);
+
+		await fs.remove(profilesRoot(project));
+		expect(await fs.readJson(saved)).toEqual({ a: 1 });
+	});
+
+	test("every displaced artifact is announced as it moves", async () => {
+		// The returned array is lost if a later link throws, and `magus install`
+		// and `profile switch` discard it outright. The callback is what makes the
+		// move visible at the moment it happens.
+		await fs.outputJson(join(project, ".claude", "settings.json"), { a: 1 });
+		await fs.writeJson(join(project, ".mcp.json"), { mcpServers: {} });
+		await materialize(project, "team", { enabledPlugins: {} });
+
+		const announced: string[] = [];
+		const returned = await activateProfile("team", project, (d) =>
+			announced.push(d.link),
+		);
+
+		expect(announced.sort()).toEqual(returned.map((d) => d.link).sort());
+		expect(announced).toHaveLength(2);
+	});
+});
+
+describe("migration leaves the project ON the profile it created", () => {
+	let project: string;
+	beforeEach(async () => {
+		project = await mkdtemp(join(tmpdir(), "migrate-"));
+	});
+	afterEach(async () => {
+		await rm(project, { recursive: true, force: true });
+	});
+
+	test("after adopting, activeProfile() names the adopted profile", async () => {
+		await fs.outputJson(join(project, ".claude", "settings.json"), {
+			enabledPlugins: { "dev@magus": true, "code-search@magus": true },
+		});
+
+		const result = await adoptCurrentProject(
+			project,
+			undefined,
+			undefined,
+			"default",
+		);
+		await materializeAndActivate(result.manifest, "default", project);
+
+		// The whole point: the question "which profile?" now has an answer.
+		expect(await activeProfile(project)).toBe("default");
+	});
+
+	test("the adopted profile enables exactly what the project had", async () => {
+		await fs.outputJson(join(project, ".claude", "settings.json"), {
+			enabledPlugins: { "dev@magus": true, "code-search@magus": true },
+			someOtherSetting: 42,
+		});
+
+		const result = await adoptCurrentProject(
+			project,
+			undefined,
+			undefined,
+			"default",
+		);
+		await materializeAndActivate(result.manifest, "default", project);
+
+		// Read through the live symlink — this is what Claude Code will load.
+		const live = await fs.readJson(join(project, ".claude", "settings.json"));
+		expect(live.enabledPlugins).toEqual({
+			"dev@magus": true,
+			"code-search@magus": true,
+		});
+		expect(live.someOtherSetting).toBe(42);
+	});
+
+	test("adopting into a manifest that already has profiles keeps them excluded", async () => {
+		await fs.outputJson(join(project, ".claude", "settings.json"), {
+			enabledPlugins: { "dev@magus": true },
+		});
+		const existing: ProfileManifest = {
+			version: 2,
+			profiles: {
+				lean: { name: "Lean", plugins: { "terminal@magus": "latest" } },
+			},
+		};
+
+		const result = await adoptCurrentProject(
+			project,
+			undefined,
+			existing,
+			"default",
+		);
+		await materializeAndActivate(result.manifest, "default", project);
+
+		const live = await fs.readJson(join(project, ".claude", "settings.json"));
+		// `terminal@magus` belongs to another profile, so this one must say so
+		// explicitly — an omitted id falls through to user scope and stays on.
+		expect(live.enabledPlugins["terminal@magus"]).toBe(false);
+		expect(live.enabledPlugins["dev@magus"]).toBe(true);
+	});
+
+	test("the generated dir and the symlinks are gitignored", async () => {
+		await fs.outputJson(join(project, ".claude", "settings.json"), {
+			enabledPlugins: { "dev@magus": true },
+		});
+		const result = await adoptCurrentProject(
+			project,
+			undefined,
+			undefined,
+			"default",
+		);
+		await materializeAndActivate(result.manifest, "default", project);
+
+		const gitignore = await fs.readFile(join(project, ".gitignore"), "utf8");
+		// `.claude/` is committed, so a symlink into generated state that lands in
+		// git breaks every teammate who does not have that profile materialized.
+		expect(gitignore).toContain(".claude/_profiles/");
+		expect(gitignore).toContain(".claude/settings.json");
+	});
+});