magus-cli 7.12.2 → 7.14.0

package/README.md

@@ -146,6 +146,27 @@ or `magus profile init`.
 `magus doctor` exits non-zero when it finds a problem, so it works as a CI
 check. So does `magus install --check`.
 
+## Company marketplaces
+
+A company marketplace is your team's own Claude Code plugin marketplace on GitHub.
+magus lists it first, shown as "by" its company name, and `magus edit` (its screens) or
+the `magus market` commands manage it: create or connect one, add
+plugins and skills (a skill of your own, or a plugin folder of your own with
+`market plugin add`), copy a skill here with `market skill edit`, and send the edits
+back with `market publish` as the plugin's next version, one skill or every edited
+skill of a plugin at once. Every change prints its
+plan and asks first; `--yes=<planId>` applies exactly that plan in a script.
+Teammates get the marketplace and every new version through `magus update` with
+the project's profile.
+
+```
+magus edit               Open the company marketplace screens
+magus market --help      Every market command, its flags and exit codes
+```
+
+The [company marketplaces guide](../../userdocs/guides/company-marketplace.md)
+walks through it end to end, including conflicts and protected branches.
+
 ## What the TUI covers
 
 | Screen | What it manages |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magus-cli",
-  "version": "7.12.2",
+  "version": "7.14.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -65,8 +65,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "magus-cli-darwin-arm64": "7.12.2",
-    "magus-cli-darwin-x64": "7.12.2",
-    "magus-cli-linux-x64": "7.12.2"
+    "magus-cli-darwin-arm64": "7.14.0",
+    "magus-cli-darwin-x64": "7.14.0",
+    "magus-cli-linux-x64": "7.14.0"
   }
 }

package/src/__tests__/market-bases.test.ts

@@ -0,0 +1,112 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, readFileSync, rmSync, symlinkSync } from "node:fs";
+import { join } from "node:path";
+import { MarketFixture, sourceModule, write } from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+const base = {
+	marketplace: "acme",
+	repo: "acme/market",
+	plugin: "review-kit",
+	skill: "review",
+	commit: "a".repeat(40),
+	tree: "tree-a",
+};
+function useBases(body: string) {
+	return `const b = await import(${JSON.stringify(sourceModule("services/market-bases.js"))}); const folder = ${JSON.stringify(f!.folder())}; ${body}`;
+}
+
+test("TEST-13 REQ-29 a missing/mismatched token cannot attach a base by path", () => {
+	f = new MarketFixture(true);
+	mkdirSync(f.folder(), { recursive: true });
+	const record = f.value<Record<string, string>>(
+		useBases(
+			`console.log(JSON.stringify(b.recordBase(folder, ${JSON.stringify(base)})));`,
+		),
+	);
+	expect(readFileSync(join(f.folder(), ".magus-origin"), "utf8").trim()).toBe(
+		record.token,
+	);
+	expect(
+		f.value(useBases("console.log(JSON.stringify(b.readBase(folder)));")),
+	).toEqual(record);
+
+	rmSync(join(f.folder(), ".magus-origin"));
+	expect(
+		f.value(useBases("console.log(JSON.stringify(b.readBase(folder)));")),
+	).toBeNull();
+	write(join(f.folder(), ".magus-origin"), "wrong-token\n");
+	expect(
+		f.value(useBases("console.log(JSON.stringify(b.readBase(folder)));")),
+	).toBeNull();
+	write(join(f.folder(), ".magus-origin"), `${record.token}\n`);
+	expect(
+		f.value(useBases("console.log(JSON.stringify(b.readBase(folder)));")),
+	).toEqual(record);
+});
+
+test("TEST-13 REQ-28 REQ-29 rotating a token invalidates restored old content", () => {
+	f = new MarketFixture(true);
+	mkdirSync(f.folder(), { recursive: true });
+	const result = f.value<{
+		a: { token: string };
+		b: { token: string };
+		current: { token: string };
+	}>(
+		useBases(
+			`const a = b.recordBase(folder, ${JSON.stringify(base)}); const newer = b.recordBase(folder, ${JSON.stringify({ ...base, commit: "b".repeat(40) })}); console.log(JSON.stringify({a, b:newer, current:b.readBase(folder)}));`,
+		),
+	);
+	expect(typeof result.a.token).toBe("string");
+	expect(result.b.token).not.toBe(result.a.token);
+	expect(result.current.token).toBe(result.b.token);
+	write(join(f.folder(), ".magus-origin"), `${result.a.token}\n`);
+	const before = f.snapshot();
+
+	expect(
+		f.value(useBases("console.log(JSON.stringify(b.readBase(folder)));")),
+	).toBeNull();
+	expect(f.snapshot()).toEqual(before);
+	expect(
+		f.value(
+			useBases(
+				"console.log(JSON.stringify([b.forgetBase(folder), b.forgetBase(folder)]));",
+			),
+		),
+	).toEqual([true, false]);
+});
+
+test("TEST-13 REQ-29 selective forgetting leaves other copies and markets intact", () => {
+	f = new MarketFixture();
+	for (const name of ["review", "other", "elsewhere"])
+		mkdirSync(f.folder("project", name), { recursive: true });
+	const script = useBases(
+		`b.recordBase(folder, ${JSON.stringify(base)});b.recordBase(${JSON.stringify(f.folder("project", "other"))}, ${JSON.stringify({ ...base, skill: "other" })});b.recordBase(${JSON.stringify(f.folder("project", "elsewhere"))}, ${JSON.stringify({ ...base, marketplace: "beta" })});console.log(JSON.stringify({ one:b.forgetBasesFor('acme', {plugin:'review-kit',skill:'review'}), remaining:b.readBase(${JSON.stringify(f.folder("project", "other"))}), all:b.forgetBasesFor('acme'), beta:b.readBase(${JSON.stringify(f.folder("project", "elsewhere"))}) }));`,
+	);
+	const result = f.value<{
+		one: number;
+		all: number;
+		remaining: unknown;
+		beta: unknown;
+	}>(script);
+	expect(result.one).toBe(1);
+	expect(result.remaining).not.toBeNull();
+	expect(result.all).toBe(1);
+	expect(result.beta).not.toBeNull();
+});
+
+test("TEST-13 REQ-29 folder keys canonicalise the parent, not a recreated skill", () => {
+	f = new MarketFixture();
+	const parent = join(f.root, "real-parent");
+	mkdirSync(parent);
+	const alias = join(f.root, "alias-parent");
+	symlinkSync(parent, alias);
+	const got = f.value(
+		`const b = await import(${JSON.stringify(sourceModule("services/market-bases.js"))}); console.log(JSON.stringify(b.folderKey(${JSON.stringify(join(alias, "review"))})));`,
+	);
+	expect(got).toBe(join(parent, "review"));
+});

package/src/__tests__/market-config.test.ts

@@ -0,0 +1,84 @@
+import { afterEach, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+	EDITED,
+	ID,
+	MarketFixture,
+	SKILL_REL,
+	sourceModule,
+	write,
+	writeJson,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-35 REQ-28 USER installation, global skills and read-back follow CLAUDE_CONFIG_DIR outside HOME", () => {
+	f = new MarketFixture(true);
+	const repo = f.seed();
+	f.register(repo);
+	f.install();
+	f.edit(["--to", "global"]);
+	write(join(f.folder("global"), "SKILL.md"), EDITED);
+	const decoy = join(f.home, ".claude");
+	writeJson(join(decoy, "settings.json"), {
+		enabledPlugins: { [ID]: false },
+		installedPluginVersions: { [ID]: "99.0.0" },
+	});
+	write(
+		join(decoy, "skills", "review", "SKILL.md"),
+		"Wrong HOME skill; never publish this\n",
+	);
+	const beforeSettings = readFileSync(join(decoy, "settings.json"), "utf8");
+	f.rememberOwned();
+
+	const r = f.market([
+		"publish",
+		"review",
+		"--plugin",
+		ID,
+		"--from",
+		"global",
+		"--yes",
+	]);
+
+	expect(r.code).toBe(0);
+	expect(r.result.installs?.find((row) => row.scope === "user")?.to).toBe(
+		"0.3.2",
+	);
+	expect(f.version()).toBe("0.3.2");
+	expect(f.remoteFile(repo, SKILL_REL)).toBe(EDITED.trimEnd());
+	expect(
+		readFileSync(join(decoy, "skills", "review", "SKILL.md"), "utf8"),
+	).toBe("Wrong HOME skill; never publish this\n");
+	expect(readFileSync(join(decoy, "settings.json"), "utf8")).toBe(
+		beforeSettings,
+	);
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-35 REQ-28 a registry row without that scope's activation is not an install", () => {
+	f = new MarketFixture(true);
+	const repo = f.seed();
+	f.register(repo);
+	f.install();
+	writeJson(join(f.config, "settings.json"), {
+		enabledPlugins: { [ID]: false },
+	});
+	writeJson(join(f.home, ".claude", "settings.json"), {
+		enabledPlugins: { [ID]: true },
+	});
+	f.rememberOwned();
+	const before = f.snapshot();
+
+	const installed = f.value(
+		`const m=await import(${JSON.stringify(sourceModule("services/market-publish.js"))}); console.log(JSON.stringify({version:await m.installedVersionAt(${JSON.stringify(ID)},'user',${JSON.stringify(f.project)}), scopes:await m.installedScopes(${JSON.stringify(ID)},${JSON.stringify(f.project)})}));`,
+	);
+
+	expect(installed).toEqual({ version: null, scopes: [] });
+	expect(f.snapshot()).toEqual(before);
+}, 30_000);

package/src/__tests__/market-conflicts.test.ts

@@ -0,0 +1,175 @@
+import { afterEach, expect, test } from "bun:test";
+import { join } from "node:path";
+import {
+	fromConflicted,
+	leftOutWhy,
+} from "../services/marketplace-conflicts.js";
+import type { PluginInfo } from "../services/plugin-manager.js";
+import {
+	classifyPluginRows,
+	planPluginUpdates,
+} from "../services/update-plan.js";
+import {
+	ID,
+	MarketFixture,
+	PLUGIN_MANIFEST,
+	readJson,
+	sourceModule,
+	writeJson,
+} from "./market-fixture.js";
+
+function info(id: string, extra: Partial<PluginInfo> = {}): PluginInfo {
+	return {
+		id,
+		name: id.split("@")[0]!,
+		version: "0.3.2",
+		description: "",
+		marketplace: id.split("@")[1]!,
+		marketplaceDisplay: "",
+		...extra,
+	} as PluginInfo;
+}
+test("TEST-38 REQ-34 a conflict predicate matches the marketplace suffix exactly", () => {
+	const names = new Set(["acme"]);
+	expect(fromConflicted("kit@acme", names)).toBe(true);
+	expect(fromConflicted("acme@safe", names)).toBe(false);
+	expect(fromConflicted("kit@not-acme", names)).toBe(false);
+});
+
+test.each(["profile", "installed", "other-profile"] as const)(
+	"TEST-38 REQ-34 leaves out a conflicted plugin from the %s candidate source",
+	(source) => {
+		const bad = info(
+			ID,
+			source === "other-profile"
+				? { isOrphaned: true }
+				: source === "installed"
+					? { projectScope: { installed: true, version: "0.3.1" } }
+					: {},
+		);
+		const safe = info("safe-kit@safe", {
+			projectScope: { installed: true, version: "0.3.1" },
+		});
+		const catalog = [bad, safe, info("listed-kit@acme")];
+		const pins = source === "profile" ? { [ID]: "latest" } : {};
+		const otherProfiles = source === "other-profile" ? [ID] : [];
+		expect(
+			planPluginUpdates(pins, catalog, {}, otherProfiles).some(
+				(item) => item.pluginId === ID,
+			),
+		).toBe(true);
+
+		const plan = planPluginUpdates(pins, catalog, {}, otherProfiles, (id) =>
+			fromConflicted(id, new Set(["acme"])),
+		);
+		expect(plan.map((item) => item.pluginId)).toEqual(["safe-kit@safe"]);
+		expect(plan[0]?.action).toBe("update");
+	},
+);
+
+test("TEST-38 REQ-34 a still-loaded conflicted requirer protects its deprecated dependency from removal", () => {
+	const bad = info(ID, { projectScope: { installed: true, version: "0.3.1" } });
+	const dependency = info("lib@safe", {
+		isOrphaned: true,
+		projectScope: { installed: true, version: "0.1.0" },
+	});
+	const catalog = [bad, dependency, info("other@safe")];
+
+	const plan = planPluginUpdates({}, catalog, { "lib@safe": [ID] }, [], (id) =>
+		fromConflicted(id, new Set(["acme"])),
+	);
+
+	expect(plan.some((item) => item.pluginId === ID)).toBe(false);
+	expect(plan.find((item) => item.pluginId === "lib@safe")?.action).toBe(
+		"unknown",
+	);
+	expect(plan.find((item) => item.pluginId === "lib@safe")?.reason).toBe(
+		"still-required",
+	);
+});
+
+test.each(["conflicted", "unchecked"] as const)(
+	"TEST-38 REQ-34 %s display rows say why without creating executable work",
+	(kind) => {
+		const check = {
+			conflicted: new Set(kind === "conflicted" ? ["acme"] : []),
+			unchecked: new Set(kind === "unchecked" ? ["acme"] : []),
+		};
+		const why = leftOutWhy(ID, check);
+		expect(why).not.toBeNull();
+		expect(leftOutWhy("safe-kit@safe", check)).toBeNull();
+
+		const rows = classifyPluginRows(
+			[info(ID)],
+			{ [ID]: "latest" },
+			{},
+			[],
+			(id) => leftOutWhy(id, check),
+		);
+		const row = rows.get(ID);
+		expect(row?.action).toBe("unknown");
+		expect(row?.reason).toBe("marketplace-conflict");
+		expect(row?.target).toBeNull();
+		expect(row?.scopes).toEqual([]);
+		expect(row?.note).toBe(why!);
+		if (kind === "unchecked") expect(why).toMatch(/could not check/i);
+	},
+);
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-39 REQ-34 an active closure excludes conflicted plugin dependencies and its tool requirements", () => {
+	f = new MarketFixture();
+	const repo = f.seed({
+		slug: "different/market",
+		extras: {
+			[PLUGIN_MANIFEST]: JSON.stringify({
+				name: "review-kit",
+				version: "0.3.1",
+				dependencies: ["wrong-dependency"],
+				requires: {
+					schema: 2,
+					bin: [
+						{
+							name: "unsafe-company-tool",
+							check: ["unsafe-company-tool", "--version"],
+							install: [{ via: "brew", formula: "unsafe-company-tool" }],
+						},
+					],
+				},
+			}),
+		},
+	});
+	f.register(repo);
+	f.profile(
+		{ [ID]: "latest" },
+		{ acme: { source: "github", repo: "expected/market" } },
+	);
+	const profileFile = join(f.project, ".claude", "profiles.json");
+	const manifest = readJson(profileFile);
+	manifest.profiles.team.cliTools = { claudish: "latest" };
+	writeJson(profileFile, manifest);
+	f.active();
+	const before = f.snapshot();
+
+	const closure = f.value<{
+		closure: { plugins: Record<string, string>; bins: Array<{ name: string }> };
+		conflicted: string[];
+	}>(
+		`const a=await import(${JSON.stringify(sourceModule("services/active-closure.js"))}); const x=await a.loadActiveClosure(${JSON.stringify(f.project)}); console.log(JSON.stringify(x && {closure:x.closure,conflicted:[...x.marketplaces.conflicted]}));`,
+	);
+
+	expect(closure.conflicted).toEqual(["acme"]);
+	expect(closure.closure.plugins["wrong-dependency@acme"]).toBeUndefined();
+	expect(
+		closure.closure.bins.some((bin) => bin.name === "unsafe-company-tool"),
+	).toBe(false);
+	expect(closure.closure.bins.some((bin) => bin.name === "claudish")).toBe(
+		true,
+	);
+	expect(f.snapshot()).toEqual(before);
+}, 30_000);

package/src/__tests__/market-consent.test.ts

@@ -0,0 +1,185 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import {
+	EDITED,
+	ID,
+	MarketFixture,
+	SKILL_REL,
+	expectPublished,
+	write,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-34 REQ-25 an explicit skill-edit target does not consult an unreachable other company", () => {
+	f = new MarketFixture();
+	const a = f.seed();
+	const b = f.seed({ name: "beta", slug: "beta/market" });
+	f.register(a);
+	f.register(b);
+	rmSync(b.bare, { recursive: true, force: true });
+
+	const r = f.market(["skill", "edit", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(0);
+	expect(r.result.localCopy?.action).toBe("created");
+	expect(existsSync(join(f.folder(), "SKILL.md"))).toBe(true);
+	f.assertOwned();
+}, 60_000);
+
+test.each(["remote", "source", "install", "options", "notPublished"] as const)(
+	"TEST-33 REQ-24 changing %s after consent returns a fresh plan without publishing",
+	async (changed) => {
+		f = new MarketFixture();
+		const repo = await f.prepared();
+		const plan = f.market(["publish", "review", "--plugin", ID]);
+		expect(plan.code).toBe(3);
+		expect(typeof plan.result.planId).toBe("string");
+		if (changed === "remote") {
+			write(join(repo.author, "README.md"), "new remote head\n");
+			f.push(repo);
+		}
+		if (changed === "source")
+			write(join(f.folder(), "SKILL.md"), `${EDITED}\nA later edit.\n`);
+		if (changed === "install") f.install(ID, "project");
+		if (changed === "notPublished")
+			write(join(f.folder(), ".env"), "DO_NOT_PUBLISH=secret\n");
+		const head = f.head(repo);
+		const args = [
+			"publish",
+			"review",
+			"--plugin",
+			ID,
+			`--yes=${plan.result.planId}`,
+		];
+		if (changed === "options") args.push("--keep-local");
+
+		const applied = f.market(args);
+
+		expect(applied.code).toBe(3);
+		expect(applied.result.error?.code).toBe("plan-changed");
+		expect(applied.result.outcome).toBe("needs-consent");
+		expect(typeof applied.result.planId).toBe("string");
+		expect(applied.result.planId).not.toBe(plan.result.planId);
+		expect(applied.result.plan?.length).toBeGreaterThan(0);
+		expect(f.head(repo)).toBe(head);
+		expect(existsSync(f.folder())).toBe(true);
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test("TEST-34 REQ-25 an explicit target ignores an unreachable other marketplace", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	const other = f.seed({ name: "beta", slug: "beta/market" });
+	f.register(other);
+	rmSync(other.bare, { recursive: true, force: true });
+	const head = f.head(repo);
+
+	const inferred = f.market(["publish", "review"]);
+
+	expect(inferred.code).toBe(3);
+	expect(inferred.result.error?.code).toBe("stale");
+	expect(JSON.stringify(inferred.result)).toContain("beta");
+	expect(JSON.stringify(inferred.result)).toContain("--plugin");
+	expect(f.head(repo)).toBe(head);
+
+	const explicit = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+	expect(explicit.code).toBe(0);
+	expectPublished(f, repo);
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-34 REQ-25 fresh duplicate skill ownership is ambiguous until a plugin is named", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	const other = f.seed({ name: "beta", slug: "beta/market" });
+	f.register(repo);
+	f.register(other);
+	write(join(f.folder(), "SKILL.md"), EDITED);
+	const head = f.head(repo);
+
+	const r = f.market(["publish", "review"]);
+
+	expect(r.code).toBe(2);
+	expect(r.result.error?.code).toBe("ambiguous");
+	expect(f.head(repo)).toBe(head);
+	f.assertOwned();
+}, 30_000);
+
+test("TEST-45 REQ-24 non-fast-forward races return the fresh plan instead of silently retrying", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	const oldSkill = f.remoteFile(repo, SKILL_REL);
+	const plan = f.market(["publish", "review", "--plugin", ID]);
+	expect(plan.code).toBe(3);
+	f.setModes({ advanceOnValidate: { author: repo.author } });
+
+	const r = f.market([
+		"publish",
+		"review",
+		"--plugin",
+		ID,
+		`--yes=${plan.result.planId}`,
+	]);
+
+	expect(r.code).toBe(3);
+	expect(r.result.error?.code).toBe("plan-changed");
+	expect(r.result.planId).not.toBe(plan.result.planId);
+	expect(r.result.plan?.length).toBeGreaterThan(0);
+	expect(f.remoteFile(repo, "remote-race.txt")).toBe("remote advance");
+	expect(f.remoteFile(repo, SKILL_REL)).toBe(oldSkill);
+	expect(existsSync(f.folder())).toBe(true);
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-45 REQ-32 disposable leftover content cannot enter a later operation's commit", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.register(repo);
+	f.ok(["fetch", "acme"]);
+	write(
+		join(f.working(repo), "plugins", "unapproved", "SKILL.md"),
+		"must not escape\n",
+	);
+	write(join(f.working(repo), ".unapproved-secret"), "not approved\n");
+
+	const r = f.market([
+		"plugin",
+		"create",
+		"approved@acme",
+		"--description",
+		"Approved tools",
+		"--yes",
+	]);
+
+	expect(r.code).toBe(0);
+	const changed = f
+		.git(
+			f.root,
+			"--git-dir",
+			repo.bare,
+			"diff-tree",
+			"--no-commit-id",
+			"--name-only",
+			"-r",
+			"HEAD",
+		)
+		.split("\n")
+		.sort();
+	expect(changed).toEqual([
+		".claude-plugin/marketplace.json",
+		"plugins/approved/.claude-plugin/plugin.json",
+	]);
+	expect(f.remotePaths(repo).some((path) => path.includes("unapproved"))).toBe(
+		false,
+	);
+	expect(existsSync(join(f.working(repo), ".unapproved-secret"))).toBe(false);
+	f.assertOwned();
+}, 60_000);