magus-cli 7.1.0 → 7.3.0

package/src/cli/prompt.ts

@@ -8,25 +8,57 @@
 
 import { createInterface } from "node:readline/promises";
 
-/** Y/n prompt. Empty input means yes. */
-export async function confirm(question: string): Promise<boolean> {
-	const rl = createInterface({ input: process.stdin, output: process.stdout });
-	try {
-		const answer = (await rl.question(`${question} [Y/n] `))
-			.trim()
-			.toLowerCase();
-		return answer === "" || answer === "y" || answer === "yes";
-	} finally {
-		rl.close();
+/**
+ * Ctrl+C at a prompt.
+ *
+ * `readline/promises` rejects `question()` with an `AbortError` carrying
+ * `code: "ABORT_ERR"`. That is a Node internal, and letting it escape printed
+ * nine frames of `internal:repl/node-errors` under "Error starting magus:" —
+ * a stack trace for the one input every terminal user knows how to give.
+ *
+ * It is converted here rather than at each call site so no future prompt can
+ * forget, and it stays a throw rather than a sentinel return so a caller that
+ * ignores it aborts instead of proceeding with a missing answer.
+ */
+export class PromptAborted extends Error {
+	constructor() {
+		super("Aborted with Ctrl+C");
+		this.name = "PromptAborted";
 	}
 }
 
-/** Free-text prompt, trimmed. */
-export async function promptValue(question: string): Promise<string> {
+/** True for a Ctrl+C at a prompt, ours or readline's own. */
+export function isPromptAborted(error: unknown): boolean {
+	if (error instanceof PromptAborted) return true;
+	// Belt and braces: an abort raised somewhere that does not route through
+	// `ask` still reads as a cancellation rather than a crash.
+	return (
+		typeof error === "object" &&
+		error !== null &&
+		(error as { code?: unknown }).code === "ABORT_ERR"
+	);
+}
+
+/** One readline question, with Ctrl+C normalised. */
+async function ask(question: string): Promise<string> {
 	const rl = createInterface({ input: process.stdin, output: process.stdout });
 	try {
 		return (await rl.question(question)).trim();
+	} catch (error) {
+		if (isPromptAborted(error)) throw new PromptAborted();
+		throw error;
 	} finally {
 		rl.close();
 	}
 }
+
+/** Y/n prompt. Empty input means yes. */
+export async function confirm(question: string): Promise<boolean> {
+	const answer = (await ask(`${question} [Y/n] `)).toLowerCase();
+	return answer === "" || answer === "y" || answer === "yes";
+}
+
+/** Free-text prompt, trimmed. */
+export async function promptValue(question: string): Promise<string> {
+	return ask(question);
+}

package/src/cli/tui-prompt.tsx

@@ -0,0 +1,143 @@
+/**
+ * One OpenTUI dialog, for a command that is otherwise not a TUI.
+ *
+ * `magus update` prints a report and exits; it is not the interactive app. But
+ * a question it must ask deserves the same dialog the TUI asks with, so this
+ * mounts the REAL `SelectModal` — the component tab 5 and tab 0 use — for the
+ * length of one question, then tears the renderer down and lets the command
+ * carry on printing. Nothing here re-draws a list, a border or a highlight: the
+ * component and the theme own all of that, and a second implementation is how
+ * the two surfaces drift apart.
+ *
+ * Every import of `@opentui/*` and `ui/` is DYNAMIC. `main.tsx` splits the TUI
+ * out precisely so `magus hook …`, which Claude Code runs on every matching
+ * tool call, never pays to load the renderer — a static import here would undo
+ * that for every command that imports this module's file, whether or not it
+ * ever asks a question.
+ *
+ * `screenMode: "main-screen"` keeps the dialog in the scrollback beside the
+ * report. The alternate screen would take the terminal over and then hand back
+ * a screen with no trace the question was ever asked.
+ */
+
+import type { SelectOption } from "../ui/state/types.js";
+
+export interface SelectDialogInput {
+	title: string;
+	message: string;
+	options: SelectOption[];
+	/** Row to start on. Defaults to the first. */
+	defaultIndex?: number;
+}
+
+/**
+ * Ask the user to pick one option. Resolves to the chosen value, or null when
+ * they cancel with Esc or Ctrl+C — the caller decides whether that is fatal.
+ *
+ * Falls back to `null` when stdin or stdout is not a TTY. A renderer needs both:
+ * `magus update > file` has a TTY stdin and a pipe for stdout, and mounting
+ * there writes escape sequences into the file.
+ */
+export async function selectDialog(
+	input: SelectDialogInput,
+): Promise<string | null> {
+	if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+		return null;
+	}
+
+	const [{ createCliRenderer }, { createRoot }, React, modals, dimensions] =
+		await Promise.all([
+			import("@opentui/core"),
+			import("@opentui/react"),
+			import("react"),
+			import("../ui/components/modals/index.js"),
+			import("../ui/state/DimensionsContext.js"),
+		]);
+
+	const renderer = await createCliRenderer({
+		screenMode: "main-screen",
+		// BOTH, so the renderer registers no handler of its own and teardown
+		// below is the only path. With either left at its default, a Ctrl+C
+		// destroys the renderer underneath this promise and it never settles.
+		exitSignals: [],
+		exitOnCtrlC: false,
+	});
+
+	const root = createRoot(renderer);
+
+	return await new Promise<string | null>((resolve) => {
+		// Clamped, not trusted: a caller computing an index from a list it built
+		// separately could hand over one that is out of range, and a cursor
+		// pointing past the end makes Enter resolve to null.
+		let index = Math.min(
+			Math.max(0, input.defaultIndex ?? 0),
+			Math.max(0, input.options.length - 1),
+		);
+		let done = false;
+
+		const finish = (value: string | null): void => {
+			if (done) return;
+			done = true;
+			renderer.keyInput.off("keypress", onKey);
+			root.unmount();
+			renderer.destroy();
+			resolve(value);
+		};
+
+		function onKey(key: {
+			name?: string;
+			ctrl?: boolean;
+			sequence?: string;
+		}): void {
+			if ((key.ctrl && key.name === "c") || key.name === "escape") {
+				finish(null);
+				return;
+			}
+			if (key.name === "return" || key.name === "enter") {
+				finish(input.options[index]?.value ?? null);
+				return;
+			}
+			if (key.name === "up" || key.name === "k") {
+				index = (index - 1 + input.options.length) % input.options.length;
+				draw();
+				return;
+			}
+			if (key.name === "down" || key.name === "j") {
+				index = (index + 1) % input.options.length;
+				draw();
+				return;
+			}
+			// The numbers stay live: the list is short, and the plain-text prompt
+			// this replaced numbered it, so the habit already exists.
+			const digit = Number(key.sequence);
+			if (
+				Number.isInteger(digit) &&
+				digit >= 1 &&
+				digit <= input.options.length
+			) {
+				index = digit - 1;
+				finish(input.options[index]?.value ?? null);
+			}
+		}
+
+		const draw = (): void => {
+			root.render(
+				React.createElement(
+					dimensions.DimensionsProvider,
+					null,
+					React.createElement(modals.SelectModal, {
+						title: input.title,
+						message: input.message,
+						options: input.options,
+						defaultIndex: index,
+						onSelect: finish,
+						onCancel: () => finish(null),
+					}),
+				),
+			);
+		};
+
+		renderer.keyInput.on("keypress", onKey);
+		draw();
+	});
+}

package/src/cli/update-view.ts

@@ -37,6 +37,7 @@ import { formatCommand } from "../utils/command-utils.js";
 import {
 	badge,
 	bold,
+	dialog,
 	dim,
 	elapsed,
 	fg,
@@ -80,6 +81,7 @@ type ActionKey =
 	| "upgrade"
 	| "repair"
 	| "refresh"
+	| "stale-load"
 	| "unknown";
 
 const ACTIONS: Record<ActionKey, ActionStyle> = {
@@ -92,6 +94,11 @@ const ACTIONS: Record<ActionKey, ActionStyle> = {
 	upgrade: { glyph: "↑", label: "UPGRADE", color: brand.success },
 	repair: { glyph: "⟳", label: "REPAIR", color: brand.info },
 	refresh: { glyph: "⟳", label: "REFRESH", color: brand.info },
+	// The installed version is right and an older one loads, so this session runs
+	// a version nobody installed. Danger, and the word is BROKEN: "STALE" read as
+	// a mild version of `repair`, and this is not that. Six characters, one under
+	// UNKNOWN, so CHIP_WIDTH is unchanged and no other section pays for it.
+	"stale-load": { glyph: "✗", label: "BROKEN", color: brand.danger },
 	// Warning, not danger: "cannot tell" is not a failure, and red UNKNOWN read
 	// as "broken". The summary line and the TUI already use warning for it.
 	unknown: { glyph: "?", label: "UNKNOWN", color: brand.warning },
@@ -248,8 +255,12 @@ function pluginDetail(item: PluginUpdateItem): string {
 	// The note stays on the item. The TUI has no heading to lean on and renders
 	// it as that row's only explanation — this is a rendering decision about a
 	// table that carries the fact twice, not a change to what is known.
+	// `older-version-loads` is excluded for the same reason: its note says
+	// "loads v0.3.0, installed v0.5.0" and the two columns beside it already do.
 	const note =
-		item.note && item.reason !== "not-offered"
+		item.note &&
+		item.reason !== "not-offered" &&
+		item.reason !== "older-version-loads"
 			? `  ${dim(`(${item.note})`)}`
 			: "";
 	switch (item.action) {
@@ -267,6 +278,16 @@ function pluginDetail(item: PluginUpdateItem): string {
 		case "repair":
 		case "unknown":
 			return `${item.installed ?? "—"}${note}`;
+		case "stale-load":
+			// Both versions, in the order the reader needs them: what runs, then
+			// what is installed. This is a report, not a one-line picker row — the
+			// TUI's row deliberately shows neither, because there the verdict and
+			// the key are all that fit. The note says the same thing in words; the
+			// columns are what makes a table of these scannable.
+			return `${fg(
+				groupStyle("Broken").text,
+				item.loaded ?? "?",
+			)} ${dim("≠")} ${item.installed ?? "—"}${note}`;
 		case "current":
 			return `${item.installed ?? "—"}${note}`;
 	}
@@ -346,6 +367,10 @@ function binDetail(item: BinUpdateItem, plan: UpdatePlan): string {
 function pluginGroup(item: PluginUpdateItem): string {
 	if (item.action === "update" || item.action === "repair") return "Update";
 	if (item.action === "install") return "Fix required";
+	// Never "Current". The installed version matching is exactly what makes this
+	// state deceptive, and a row that reads as up to date under a CURRENT
+	// heading is the defect this state was added to end.
+	if (item.action === "stale-load") return "Broken";
 	if (item.action === "unknown") {
 		return item.reason === "not-offered" ? "Deprecated" : "Unverified";
 	}
@@ -353,6 +378,7 @@ function pluginGroup(item: PluginUpdateItem): string {
 }
 
 const GROUP_ORDER = [
+	"Broken",
 	"Update",
 	"Deprecated",
 	"Fix required",
@@ -372,6 +398,11 @@ const GROUP_KIND: Record<string, ReportBadgeKind> = {
 	Update: "update",
 	Deprecated: "deprecated",
 	"Fix required": "fix",
+	// Red earth, borrowed from `deprecated`. The kinds are measured contrast
+	// pairs, not meanings — "Hue, not meaning; the badge says the word", as
+	// theme-mode.ts puts it — so an unmeasured fourth palette would be the only
+	// thing here nobody had checked against both pages.
+	Broken: "deprecated",
 };
 
 interface GroupStyle {

package/src/cli/update.ts

@@ -70,8 +70,9 @@ import {
 } from "../services/update-plan.js";
 import { brand } from "../ui/theme.js";
 import { bold, dim, fg, width } from "./ansi.js";
-import { ensureManifest } from "./bootstrap.js";
+import { ensureManifest, requireActiveProfile } from "./bootstrap.js";
 import { LiveRegion, withPaused } from "./live.js";
+import { selectDialog } from "./tui-prompt.js";
 import {
 	type ApplyState,
 	type Step,
@@ -190,8 +191,42 @@ export async function runUpdateCommand(
 		return 1;
 	}
 
-	const profileIds = Object.keys(manifest.profiles);
-	if (flags.profile && !manifest.profiles[flags.profile]) {
+	// No active profile, no update: that is where plugin state is read from and
+	// where changes are written. Asked before the profile is resolved, so what
+	// the user activates here is what this run uses.
+	//
+	// BOTH `--check` and `--dry-run` are read-only here. An earlier version let
+	// `--dry-run` activate, reasoning that a preview needs a real profile to
+	// report against — but activating writes symlinks and edits a TRACKED
+	// `.gitignore`, and `--dry-run` promises to write nothing and exit 0. A
+	// preview that mutates the repo is not a preview.
+	//
+	// So a read-only run refuses instead, and the two flags differ only in what
+	// that refusal MEANS: `--check` is a gate, so it fails; `--dry-run` is a
+	// preview, and "nothing to preview until a profile is active" is a legitimate
+	// preview result rather than an error.
+	//
+	// NAMING A PROFILE SKIPS THE GATE. `magus update lean` says which profile to
+	// update, and updating it needs the manifest, not the symlink — installs go
+	// to project scope either way. Gating it would refuse a question the user
+	// already answered on the command line, and would break `magus update lean`
+	// and `--check lean` in CI, both of which worked before this gate existed.
+	// ANY positional argument skips it, not just a valid one. A wrong name has to
+	// reach the "Profile not found. Available: …" check below, which says what
+	// the user got wrong; gating it first answers a different question — "no
+	// profile is selected" — which is true, unhelpful, and not the mistake.
+	const current =
+		flags.profile !== undefined
+			? manifest
+			: await requireActiveProfile(projectPath, manifest, {
+					check: flags.check || flags.dryRun,
+				});
+	// A refused dry run exits 0: it wrote nothing and previewed nothing, which is
+	// what it promised. A refused `--check` exits 1, because that is a gate.
+	if (!current) return flags.dryRun ? 0 : 1;
+
+	const profileIds = Object.keys(current.profiles);
+	if (flags.profile && !current.profiles[flags.profile]) {
 		console.error(
 			failLine(
 				`Profile "${flags.profile}" not found. Available: ${profileIds.join(", ")}`,
@@ -204,19 +239,27 @@ export async function runUpdateCommand(
 	// use. A single-profile manifest needs no activation to be unambiguous.
 	// Chosen through the same function the TUI uses, so both judge a plugin
 	// against the same pin.
-	const targetId = selectProfileId(
+	const resolvedId = selectProfileId(
 		profileIds,
 		flags.profile,
 		await activeProfile(projectPath),
 	);
-	if (!targetId) {
+
+	// `requireActiveProfile` above has already guaranteed one is active, so rule
+	// 2 of `selectProfileId` resolves and this is only unreachable-guard. There
+	// is deliberately no "pick one for this run" fallback any more: it used to
+	// ask here and then update a profile the project was not running, which is
+	// the two-worlds behaviour the gate exists to end. An explicit argument is
+	// still honoured — naming a profile is naming intent.
+	if (!resolvedId) {
 		console.error(
 			failLine(
-				`No active profile. Pass one: magus update <${profileIds.join("|")}>`,
+				`No active profile. Run \`magus profile switch <${profileIds.join("|")}>\`.`,
 			),
 		);
 		return 1;
 	}
+	const targetId = resolvedId;
 
 	for (const line of header(targetId)) console.log(line);
 
@@ -243,7 +286,7 @@ export async function runUpdateCommand(
 
 	const closure = await runStep(steps.profile, async (say) => {
 		say(`resolving "${targetId}"`);
-		const resolved = await resolveProfile(manifest, targetId);
+		const resolved = await resolveProfile(current, targetId);
 		steps.profile.detail = [
 			`${Object.keys(resolved.plugins).length} plugins`,
 			`${resolved.bins.length} tools`,

package/src/main.tsx

@@ -104,7 +104,16 @@ async function main(): Promise<void> {
 	});
 }
 
-main().catch((error) => {
+main().catch(async (error) => {
+	// Ctrl+C at a prompt is an answer — "stop" — not a failure. 130 is the
+	// shell's own convention for SIGINT (128 + 2), so `magus update && next`
+	// stops rather than running `next`. The newline lands the shell prompt on
+	// its own line instead of against the half-finished question.
+	const { isPromptAborted } = await import("./cli/prompt.js");
+	if (isPromptAborted(error)) {
+		process.stderr.write("\n");
+		process.exit(130);
+	}
 	console.error("Error starting magus:", error);
 	process.exit(1);
 });

package/src/services/active-closure.ts

@@ -115,3 +115,26 @@ export async function loadActiveClosure(
 		return null;
 	}
 }
+
+/**
+ * The active profile's plugin pins — `pluginId -> exact version | "latest"` — and
+ * `{}` when no profile resolves.
+ *
+ * The one shape every surface that judges a plugin needs: `classifyPlugin`'s
+ * `pin`, the Plugins screen's `pins`, and the ceiling `findStaleLoads` caps its
+ * repair target at. Reading it through one helper is what keeps the startup popup
+ * and the Plugins header from capping differently — a pinned plugin read as
+ * BROKEN in one and current in the other is exactly the drift the classifier was
+ * centralised to end.
+ *
+ * `{}` means "latest for everything", which is what `pinForRow` assumes for an
+ * installed plugin no profile declares. `resolveBins: false` because no caller of
+ * this needs a plugin's binary requirements, and the default resolver reads every
+ * declared plugin's `plugin.json` to build them.
+ */
+export async function activePluginPins(
+	projectPath: string,
+): Promise<Readonly<Record<string, string>>> {
+	const active = await loadActiveClosure(projectPath, { resolveBins: false });
+	return active?.closure.plugins ?? {};
+}