magus-cli 7.11.4 → 7.11.6

package/src/__tests__/update-removes-deprecated-other-profiles.test.ts

@@ -0,0 +1,401 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import fs from "fs-extra";
+import { setColorEnabled, stripAnsi } from "../cli/ansi.js";
+import { planReport } from "../cli/update-view.js";
+import type { PluginScope } from "../services/claude-cli.js";
+import { readManifest, writeManifest } from "../services/manifest.js";
+import type { PluginInfo } from "../services/plugin-manager.js";
+import { reconcileActiveProfile } from "../services/profile-absorb.js";
+import { activateProfile } from "../services/profile-activate.js";
+import { withCliBookkeeping } from "../services/profile-state.js";
+import {
+	pluginsAnyProfileLists,
+	resolveProfile,
+} from "../services/resolver.js";
+import {
+	type ApplyReporter,
+	type PluginApplyDeps,
+	REAL_REMOVE_DEPS,
+	applyPlugins,
+	describeRemoved,
+} from "../services/update-engine.js";
+import {
+	type PluginUpdateItem,
+	type UpdatePlan,
+	classifyPluginRows,
+	planIsBehind,
+	planPluginUpdates,
+} from "../services/update-plan.js";
+import type { ProfileManifest } from "../types/index.js";
+
+/**
+ * `magus update` and the Plugins screen plan a deprecated plugin that only a
+ * profile which is NOT active lists.
+ *
+ * The profile render writes `"<id>": false` into `.claude/settings.json` for
+ * every id ANY profile lists, and the Plugins screen shows that key as a
+ * deprecated row. The planner used to see only the active profile's pins and
+ * the plugins installed somewhere, so `magus update --check` answered "Nothing
+ * missing and nothing behind." while the row stayed, and `magus update` never
+ * removed it. When the active profile did list it, the removal dropped it from
+ * that profile only, so another profile kept it and the `false` came back on
+ * the next render.
+ *
+ * CONTRACT:
+ *  - `pluginsAnyProfileLists(manifest)` (resolver.ts): every plugin id some
+ *    profile turns on, `extends` resolved.
+ *  - `planPluginUpdates(pins, catalog, requiredBy, listedByProfiles)` and
+ *    `classifyPluginRows(plugins, pins, requiredBy, listedByProfiles)`: an id
+ *    in `listedByProfiles` that is neither pinned nor installed gets a
+ *    `remove` item with `scopes: []` when it is deprecated, and NO item
+ *    otherwise (published, moved, still required, marketplace unread).
+ *  - applying a `remove` drops the id from EVERY profile listing it, absorbing
+ *    the live files first, so the user's live edits survive and the key is
+ *    gone from settings.json afterwards.
+ */
+
+const ID = "code-analysis@magus";
+
+/** The reporter's shape: the active profile does not list it, two others do. */
+const manifest = (activeListsIt = false): ProfileManifest => ({
+	version: 2,
+	profiles: {
+		default: {
+			name: "Default",
+			plugins: {
+				"dev@magus": "latest",
+				...(activeListsIt ? { [ID]: "latest" } : {}),
+			},
+		},
+		maintainer: {
+			name: "Maintainer",
+			plugins: { "dev@magus": "latest", [ID]: "latest" },
+		},
+		lean: { name: "Lean", plugins: { [ID]: "latest" } },
+		minimal: { name: "Minimal", plugins: { "setup@magus": "latest" } },
+	},
+});
+
+function info(over: Partial<PluginInfo> & { id: string }): PluginInfo {
+	return {
+		name: over.id.split("@")[0] as string,
+		version: null,
+		description: "",
+		marketplace: over.id.split("@")[1] ?? "magus",
+		marketplaceDisplay: "",
+		...over,
+	};
+}
+
+/** Published and installed here — what makes "magus" a marketplace we read. */
+const DEV = info({
+	id: "dev@magus",
+	version: "1.0.0",
+	projectScope: { installed: true, version: "1.0.0" },
+});
+/** Published, installed nowhere. */
+const SETUP = info({ id: "setup@magus", version: "2.0.0" });
+
+/** The id's catalog entry as the screen sees it: a `false` key, an orphan. */
+const ORPHAN = info({ id: ID, isOrphaned: true });
+
+const CATALOG: PluginInfo[] = [DEV, SETUP, ORPHAN];
+
+function itemsFor(items: PluginUpdateItem[], id: string): PluginUpdateItem[] {
+	return items.filter((i) => i.pluginId === id);
+}
+
+afterEach(() => setColorEnabled(null));
+
+// ---------------------------------------------------------------------------
+// 1. The planner
+// ---------------------------------------------------------------------------
+
+describe("planner: a plugin only an inactive profile lists", () => {
+	// REGRESSION: `magus update --check` said "Nothing missing and nothing behind." while a deprecated plugin only other profiles list stayed a row — MTL-332
+	test("should plan one remove with no scopes for a deprecated id", () => {
+		const items = planPluginUpdates({ "dev@magus": "latest" }, CATALOG, {}, [
+			ID,
+			"dev@magus",
+			"setup@magus",
+		]);
+
+		const found = itemsFor(items, ID);
+		expect(found).toHaveLength(1);
+		expect({
+			action: found[0]?.action,
+			reason: found[0]?.reason,
+			scopes: found[0]?.scopes,
+		}).toEqual({ action: "remove", reason: "deprecated", scopes: [] });
+	});
+
+	test("should plan a deprecated id with no catalog entry at all", () => {
+		const items = planPluginUpdates({ "dev@magus": "latest" }, [DEV], {}, [ID]);
+		expect(itemsFor(items, ID).map((i) => i.action)).toEqual(["remove"]);
+	});
+
+	test("should plan nothing for a PUBLISHED id only an inactive profile lists", () => {
+		const items = planPluginUpdates({ "dev@magus": "latest" }, CATALOG, {}, [
+			ID,
+			"setup@magus",
+		]);
+		expect(itemsFor(items, "setup@magus")).toEqual([]);
+	});
+
+	test("should not plan a remove for one that moved to another marketplace", () => {
+		const moved = info({ id: "code-analysis@other", version: "3.0.0" });
+		const items = planPluginUpdates(
+			{ "dev@magus": "latest" },
+			[...CATALOG, moved],
+			{},
+			[ID],
+		);
+		expect(itemsFor(items, ID).filter((i) => i.action === "remove")).toEqual(
+			[],
+		);
+		expect(itemsFor(items, ID).filter((i) => i.action === "install")).toEqual(
+			[],
+		);
+	});
+
+	test("should not plan a remove for one a staying plugin still requires", () => {
+		const items = planPluginUpdates(
+			{ "dev@magus": "latest" },
+			CATALOG,
+			{ [ID]: ["dev@magus"] },
+			[ID],
+		);
+		expect(itemsFor(items, ID).filter((i) => i.action === "remove")).toEqual(
+			[],
+		);
+		expect(itemsFor(items, ID).filter((i) => i.action === "install")).toEqual(
+			[],
+		);
+	});
+
+	test("should plan nothing when the id's marketplace was not read", () => {
+		const unread = "thing@unread-market";
+		const items = planPluginUpdates({ "dev@magus": "latest" }, CATALOG, {}, [
+			unread,
+		]);
+		expect(itemsFor(items, unread)).toEqual([]);
+	});
+
+	test("should make --check behind and report it under the removed wording", () => {
+		setColorEnabled(false);
+		const plan: UpdatePlan = {
+			profileId: "default",
+			plugins: planPluginUpdates({ "dev@magus": "latest" }, CATALOG, {}, [ID]),
+			bins: [],
+			skills: [],
+			binSpecs: new Map(),
+		};
+		expect(planIsBehind(plan)).toBe(true);
+		const report = planReport(plan).map(stripAnsi).join("\n");
+		expect(report).toContain("code-analysis");
+		expect(describeRemoved([ID])).toBe(
+			"Removed code-analysis — no longer published",
+		);
+	});
+});
+
+describe("pluginsAnyProfileLists", () => {
+	test("should list every id some profile turns on, and none turned off", () => {
+		const m = manifest();
+		const entry = m.profiles.minimal;
+		if (entry) entry.plugins = { ...entry.plugins, "off@magus": false };
+		expect([...pluginsAnyProfileLists(m)].sort()).toEqual([
+			ID,
+			"dev@magus",
+			"setup@magus",
+		]);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// 2. Parity: the CLI's plan and the screen's rows
+// ---------------------------------------------------------------------------
+
+describe("parity: magus update and the Plugins screen", () => {
+	test("should agree on a deprecated id only an inactive profile lists", () => {
+		const pins = { "dev@magus": "latest" };
+		const listed = pluginsAnyProfileLists(manifest());
+		const cli = planPluginUpdates(pins, CATALOG, {}, listed);
+		const rows = classifyPluginRows(CATALOG, pins, {}, listed);
+
+		expect(rows.get(ID)).toEqual(itemsFor(cli, ID)[0]);
+		expect(rows.get(ID)?.action).toBe("remove");
+		expect(rows.has("setup@magus")).toBe(
+			itemsFor(cli, "setup@magus").length > 0,
+		);
+		expect(rows.has("setup@magus")).toBe(false);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// 3 + 4. Applying the plan on a real project
+// ---------------------------------------------------------------------------
+
+/** Measured, Claude Code 2.1.312, from a folder with no row while others hold PROJECT rows. */
+const wrongScope = (scope: PluginScope) =>
+	new Error(
+		`✘ Failed to uninstall plugin "${ID}": Plugin "${ID}" is installed in project scope, not ${scope}. Use --scope project to uninstall.`,
+	);
+
+const SILENT: ApplyReporter = {
+	begin: () => {},
+	finish: () => {},
+	detach: (work) => work(),
+};
+
+/** The real profile half; Claude Code's commands are doubles. */
+function deps(): PluginApplyDeps {
+	const unused = async () => {
+		throw new Error("a removal must not install, update or repair anything");
+	};
+	return {
+		install: unused,
+		update: unused,
+		repair: unused,
+		readInstalled: unused,
+		saveInstalled: unused,
+		repairStaleLoad: unused,
+		registryRows: async () => [],
+		remove: {
+			...REAL_REMOVE_DEPS,
+			uninstall: async (_id, scope) => {
+				throw wrongScope(scope);
+			},
+			isInstalled: async () => false,
+			forgetVersion: async () => {},
+		},
+	};
+}
+
+/** Both callers: `magus update` (under bookkeeping) and the Plugins screen. */
+const SURFACES = [
+	["magus update", true],
+	["the Plugins screen", false],
+] as const;
+
+describe("applying the plan removes it from every profile", () => {
+	let project: string;
+	let log: ReturnType<typeof spyOn>;
+	const settingsPath = () => join(project, ".claude", "settings.json");
+	const profilesPath = () => join(project, ".claude", "profiles.json");
+
+	async function setUp(activeListsIt: boolean) {
+		await writeManifest(manifest(activeListsIt), project);
+		await activateProfile(manifest(activeListsIt), "default", project, {
+			onDisplace: () => {},
+		});
+	}
+
+	/** The plan exactly as `magus update` makes it. */
+	async function plan(): Promise<PluginUpdateItem[]> {
+		const m = await readManifest(project);
+		const closure = await resolveProfile(m, "default");
+		return planPluginUpdates(
+			closure.plugins,
+			CATALOG,
+			{},
+			pluginsAnyProfileLists(m),
+		).filter((i) => i.action === "remove");
+	}
+
+	async function apply(items: PluginUpdateItem[], bookkept: boolean) {
+		const run = () =>
+			applyPlugins(items, project, deps(), SILENT, { profile: "default" });
+		return bookkept ? withCliBookkeeping(project, run) : run();
+	}
+
+	beforeEach(async () => {
+		project = await mkdtemp(join(tmpdir(), "update-deprecated-others-"));
+		log = spyOn(console, "log").mockImplementation(() => {});
+	});
+	afterEach(async () => {
+		log.mockRestore();
+		await rm(project, { recursive: true, force: true });
+	});
+
+	for (const [surface, bookkept] of SURFACES) {
+		// REGRESSION: `magus update` never removed a deprecated plugin only inactive profiles list; its `false` key stayed in settings.json — MTL-332
+		test(`${surface}: no profile lists it, untouched profiles are byte-equal, no settings key`, async () => {
+			await setUp(false);
+			// Seeded red: the render wrote the key that makes the row.
+			expect((await fs.readJson(settingsPath())).enabledPlugins[ID]).toBe(
+				false,
+			);
+			const before = (await fs.readJson(profilesPath())).profiles;
+
+			const items = await plan();
+			expect(items.map((i) => i.pluginId)).toEqual([ID]);
+			const result = await apply(items, bookkept);
+
+			expect(result.failed).toEqual([]);
+			expect(result.removed).toEqual([ID]);
+			const after = (await readManifest(project)).profiles;
+			for (const id of Object.keys(after)) {
+				expect(after[id]?.plugins?.[ID]).toBeUndefined();
+			}
+			expect(after.maintainer?.plugins).toEqual({ "dev@magus": "latest" });
+			const raw = (await fs.readJson(profilesPath())).profiles;
+			expect(raw.default).toEqual(before.default);
+			expect(raw.minimal).toEqual(before.minimal);
+
+			const live = (await fs.readJson(settingsPath())).enabledPlugins;
+			expect(Object.hasOwn(live, ID)).toBe(false);
+			expect(live["dev@magus"]).toBe(true);
+
+			// It does not come back on the next entry point.
+			await reconcileActiveProfile(project);
+			expect(
+				Object.hasOwn((await fs.readJson(settingsPath())).enabledPlugins, ID),
+			).toBe(false);
+			expect(await plan()).toEqual([]);
+		});
+
+		// REGRESSION: removing a deprecated plugin must not lose live edits made after the profile was activated — MTL-332
+		test(`${surface}: a live edit survives the removal`, async () => {
+			await setUp(false);
+			const settings = await fs.readJson(settingsPath());
+			settings.permissions = { allow: ["Bash(ls:*)"] };
+			settings.enabledPlugins["other@magus"] = true;
+			await fs.writeJson(settingsPath(), settings, { spaces: 2 });
+
+			const result = await apply(await plan(), bookkept);
+
+			expect(result.failed).toEqual([]);
+			const live = await fs.readJson(settingsPath());
+			expect(live.permissions?.allow).toEqual(["Bash(ls:*)"]);
+			expect(live.enabledPlugins["other@magus"]).toBe(true);
+			expect(Object.hasOwn(live.enabledPlugins, ID)).toBe(false);
+			for (const entry of Object.values(
+				(await readManifest(project)).profiles,
+			)) {
+				expect(entry.plugins?.[ID]).toBeUndefined();
+			}
+		});
+
+		// REGRESSION: removing a deprecated plugin the active profile lists dropped it from that profile only, so another profile kept it — MTL-332
+		test(`${surface}: the active profile and another both list it, neither does afterwards`, async () => {
+			await setUp(true);
+			const items = await plan();
+			expect(items.map((i) => i.pluginId)).toEqual([ID]);
+
+			const result = await apply(items, bookkept);
+
+			expect(result.failed).toEqual([]);
+			const after = (await readManifest(project)).profiles;
+			expect(after.default?.plugins?.[ID]).toBeUndefined();
+			expect(after.maintainer?.plugins?.[ID]).toBeUndefined();
+			expect(after.lean?.plugins?.[ID]).toBeUndefined();
+			expect(
+				Object.hasOwn((await fs.readJson(settingsPath())).enabledPlugins, ID),
+			).toBe(false);
+		});
+	}
+});

package/src/cli/update.ts

@@ -63,7 +63,11 @@ import {
 	switchHint,
 	withCliBookkeeping,
 } from "../services/profile-state.js";
-import { requirersHere, resolveProfile } from "../services/resolver.js";
+import {
+	pluginsAnyProfileLists,
+	requirersHere,
+	resolveProfile,
+} from "../services/resolver.js";
 import { getInstalledSkillNames } from "../services/skills-manager.js";
 import { REAL_TOOL_PROBE_IO, probeTools } from "../services/tool-probe.js";
 import { managedBins } from "../services/toolchain.js";
@@ -503,7 +507,15 @@ async function updateProfile(
 	);
 	const plan: UpdatePlan = {
 		profileId: targetId,
-		plugins: planPluginUpdates(closure.plugins, catalog, requiredBy),
+		// Every profile's plugins, not only this one's: a deprecated plugin a
+		// profile that is not active lists is still a row the render keeps, and
+		// is planned for removal.
+		plugins: planPluginUpdates(
+			closure.plugins,
+			catalog,
+			requiredBy,
+			pluginsAnyProfileLists(current),
+		),
 		bins: planBinUpdates(tools, toolFacts),
 		skills: planSkillUpdates(skillRefs, installedSkills),
 		binSpecs: new Map(tools.map((b) => [b.name, b])),

package/src/services/active-closure.ts

@@ -21,7 +21,7 @@ import type {
 } from "../types/index.js";
 import { readManifest, validateManifest } from "./manifest.js";
 import { activeProfile } from "./profile-live.js";
-import { resolveProfile } from "./resolver.js";
+import { pluginsAnyProfileLists, resolveProfile } from "./resolver.js";
 
 /**
  * The profile to use: the explicit one, else the active one, else the only one.
@@ -45,6 +45,12 @@ export function selectProfileId(
 export interface ActiveClosure {
 	profileId: string;
 	closure: ResolvedClosure;
+	/**
+	 * Every plugin id ANY profile in the manifest lists
+	 * (`pluginsAnyProfileLists`) — the planner's `listedByProfiles`, the same
+	 * set `magus update` passes it.
+	 */
+	listedByProfiles: string[];
 }
 
 export interface ActiveClosureDeps {
@@ -110,7 +116,11 @@ export async function loadActiveClosure(
 			profileId,
 			opts.resolveBins === false ? { binResolver: NO_BINS } : {},
 		);
-		return { profileId, closure };
+		return {
+			profileId,
+			closure,
+			listedByProfiles: pluginsAnyProfileLists(manifest),
+		};
 	} catch {
 		return null;
 	}

package/src/services/claude-cli.ts

@@ -271,10 +271,21 @@ export async function uninstallPluginViaCli(
 /**
  * Is `error` the CLI's answer that the plugin is not installed at the scope it
  * was asked about — the one failure of an uninstall that means "nothing to do".
+ *
+ * Claude Code has two wordings for it. With no row anywhere: `Plugin "<id>" is
+ * not installed in <scope> scope`. With rows only at another scope or in other
+ * folders (measured, Claude Code 2.1.312): `Plugin "<id>" is installed in
+ * <other> scope, not <scope>. Use --scope <other> to uninstall.` Both mean the
+ * asked scope holds nothing here; anything else is a real failure.
  */
 export function isNotInstalledAnswer(error: unknown): boolean {
 	const message = error instanceof Error ? error.message : String(error);
-	return /not installed in (user|project|local) scope/i.test(message);
+	return (
+		/not installed in (user|project|local) scope/i.test(message) ||
+		/is installed in (user|project|local) scope, not (user|project|local)\b/i.test(
+			message,
+		)
+	);
 }
 
 /**

package/src/services/mcp-registry.ts

@@ -2,6 +2,7 @@ import type {
 	McpRegistryResponse,
 	McpRegistryServer,
 	McpServer,
+	McpServerConfig,
 } from "../types/index.js";
 
 const DEFAULT_MCP_REGISTRY_API =
@@ -155,6 +156,155 @@ export async function fetchCuratedMcpServers(
 	return servers;
 }
 
+/**
+ * Whether the server is run by the owner of the domain its name claims.
+ * The name is `<reverse-dns namespace>/<slug>`; the server is official when the
+ * namespace labels are a label-boundary prefix of the URL host's reversed labels
+ * (`com.notion` for `mcp.notion.com`). Code-host namespaces (`io.github.*`) name
+ * an account, not an owner, and npm:/pypi:/unparsable sources have no host.
+ * It is official FOR A SEARCH: the brand (the namespace's second label, `notion`
+ * in `com.notion`) must equal, as a whole word, one of the search words.
+ */
+export function isOfficialMcpServer(
+	server: Pick<McpRegistryServer, "name" | "url">,
+	query: string,
+): boolean {
+	const words = query
+		.toLowerCase()
+		.split(/[^\p{L}\p{N}]+/u)
+		.filter(Boolean);
+	if (words.length === 0) return false;
+	const namespace = server.name.split("/")[0]?.toLowerCase() ?? "";
+	const labels = namespace.split(".");
+	if (labels.length < 2 || labels.some((label) => label === "")) return false;
+	if (labels[0] === "io" && labels[1] === "github") return false;
+	if (!words.includes(labels[1] as string)) return false;
+
+	let host: string;
+	try {
+		const url = new URL(server.url);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+		host = url.hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+
+	const hostLabels = host.split(".").reverse();
+	return (
+		labels.length <= hostLabels.length &&
+		labels.every((label, i) => label === hostLabels[i])
+	);
+}
+
+export type RegistryInstallKind = "http" | "pypi" | "npm";
+export type RegistryInstallPlan =
+	| { ok: true; kind: RegistryInstallKind; config: McpServerConfig }
+	| { ok: false; kind: string; reason: string };
+
+// Strict single tokens that cannot start with `-`: registry rows are
+// third-party data and the name becomes an argv element, so `npm:-y` or
+// `npm:--package=evil` must never turn into an option.
+const NPM_PACKAGE =
+	/^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*(?:@[a-z0-9][a-z0-9._+-]*)?$/i;
+const PYPI_PACKAGE =
+	/^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:@[a-z0-9][a-z0-9._+-]*)?$/i;
+
+function refuse(kind: string, reason: string): RegistryInstallPlan {
+	return { ok: false, kind, reason };
+}
+
+function unreadableAddress(): RegistryInstallPlan {
+	return refuse("unknown", "magus can't read this server's address.");
+}
+
+/**
+ * What installing a registry row writes, decided by the row's `url` alone
+ * (`package_registry` is ignored: an `https:` row stays hosted). Expected
+ * refusals are returned, never thrown. No shell: the entry is command + args.
+ */
+export function registryInstallPlan(
+	server: Pick<McpRegistryServer, "url">,
+): RegistryInstallPlan {
+	const raw = (server.url ?? "").trim();
+	const match = /^([a-z][a-z0-9+.-]*):(.*)$/is.exec(raw);
+	if (!match) return unreadableAddress();
+	const scheme = (match[1] as string).toLowerCase();
+	const rest = (match[2] as string).trim();
+	// `localhost:8080` is host:port, not a scheme.
+	if (/^\d+(?:[/?#]|$)/.test(rest)) return unreadableAddress();
+
+	if (scheme === "http" || scheme === "https") {
+		try {
+			if (new URL(raw).hostname) {
+				return {
+					ok: true,
+					kind: "http",
+					config: { type: "http", url: raw },
+				};
+			}
+		} catch {
+			// falls through to the refusal below
+		}
+		return unreadableAddress();
+	}
+
+	if (scheme === "pypi" || scheme === "npm") {
+		if (rest === "") {
+			return refuse(
+				scheme,
+				`This ${scheme} server has no package name, so there's nothing to run.`,
+			);
+		}
+		const pattern = scheme === "pypi" ? PYPI_PACKAGE : NPM_PACKAGE;
+		if (!pattern.test(rest)) {
+			return refuse(
+				scheme,
+				`The package name of this ${scheme} server looks wrong, so magus won't run it.`,
+			);
+		}
+		return {
+			ok: true,
+			kind: scheme,
+			config:
+				scheme === "pypi"
+					? { command: "uvx", args: [rest] }
+					: { command: "npx", args: ["-y", rest] },
+		};
+	}
+
+	return refuse(
+		scheme,
+		`magus can't install ${scheme} servers. It can install https, pypi and npm ones.`,
+	);
+}
+
+/** Official servers first; endpoint order is kept inside each group. */
+export function officialFirst<
+	T extends Pick<McpRegistryServer, "name" | "url">,
+>(servers: readonly T[], query: string): T[] {
+	const official = servers.filter((server) =>
+		isOfficialMcpServer(server, query),
+	);
+	const rest = servers.filter((server) => !isOfficialMcpServer(server, query));
+	return [...official, ...rest];
+}
+
+/**
+ * Last-to-start wins: take a token before each request and apply its response
+ * only while `isLatest(token)` still holds.
+ */
+export function createLatestOnlyGuard(): {
+	next(): number;
+	isLatest(token: number): boolean;
+} {
+	let latest = 0;
+	return {
+		next: () => ++latest,
+		isLatest: (token) => token === latest,
+	};
+}
+
 export function formatDate(dateStr?: string): string {
 	if (!dateStr) return "";
 	const date = new Date(dateStr);

package/src/services/profile-state.ts

@@ -26,7 +26,7 @@
  */
 
 import path from "node:path";
-import type { ProfileManifest, ProfileManifestEntry } from "../types/index.js";
+import type { ProfileManifest } from "../types/index.js";
 import { selectProfileId } from "./active-closure.js";
 import { updateManagedGitignoreBlock } from "./conventions-manager.js";
 import { readManifest, updateProfileEntry, writeManifest } from "./manifest.js";
@@ -74,7 +74,7 @@ import {
 	skillFolder,
 	skillIgnoreLine,
 } from "./profile-skills.js";
-import { resolveExtends } from "./resolver.js";
+import { profileLists } from "./resolver.js";
 import type { SettingsParseError } from "./settings-file.js";
 
 export type ActiveProfileCheck =
@@ -674,16 +674,6 @@ export async function withCliBookkeeping<T>(
 	}
 }
 
-/** Whether a profile entry, `extends` included, turns the plugin on. */
-function profileLists(
-	entry: ProfileManifestEntry | undefined,
-	pluginId: string,
-): boolean {
-	if (!entry) return false;
-	const value = resolveExtends(entry).plugins?.[pluginId];
-	return value !== undefined && value !== false;
-}
-
 /**
  * Stop a profile listing `pluginId`, so its next activation does not turn the
  * plugin back on. Answers whether the profile no longer lists it — read back