magus-cli 7.12.2 → 7.14.0

package/src/__tests__/market-readonly.test.ts

@@ -0,0 +1,162 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import {
+	EDITED,
+	ID,
+	MarketFixture,
+	SKILL,
+	SKILL_REL,
+	sourceModule,
+	write,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-32 REQ-31 a selected fetch array refreshes only that working clone", () => {
+	f = new MarketFixture();
+	const a = f.seed();
+	const b = f.seed({ name: "beta", slug: "beta/market" });
+	f.register(a);
+	f.register(b);
+	f.ok(["fetch"]);
+	const oldB = f.git(f.working(b), "rev-parse", "HEAD");
+	const oldClaudeA = f.git(f.clone(a), "rev-parse", "HEAD");
+	write(join(a.author, "README.md"), "New acme commit\n");
+	write(join(b.author, "README.md"), "New beta commit\n");
+	const newA = f.push(a);
+	f.push(b);
+	const before = f.snapshot();
+	const outsideA = (snapshot: Record<string, string>) =>
+		Object.fromEntries(
+			Object.entries(snapshot).filter(
+				([file]) => !file.includes("magus-market/acme/"),
+			),
+		);
+
+	const r = f.value<{ outcome: string }>(
+		`const m=await import(${JSON.stringify(sourceModule("services/market-ops.js"))}); console.log(JSON.stringify(await m.marketFetch(['acme'])));`,
+	);
+
+	expect(r.outcome).toBe("ok");
+	expect(f.git(f.working(a), "rev-parse", "HEAD")).toBe(newA);
+	expect(f.git(f.working(b), "rev-parse", "HEAD")).toBe(oldB);
+	expect(f.git(f.clone(a), "rev-parse", "HEAD")).toBe(oldClaudeA);
+	expect(outsideA(f.snapshot())).toEqual(outsideA(before));
+	f.assertOwned();
+}, 60_000);
+
+for (const working of [false, true]) {
+	test.each([
+		{ args: ["list"], code: 0 },
+		{ args: ["status"], code: 0 },
+		{ args: ["status", "review"], code: 0 },
+		{ args: ["publish", "review", "--plugin", ID, "--dry-run"], code: 0 },
+		{ args: ["publish", "review", "--plugin", ID], code: 3 },
+	])(
+		`TEST-31 REQ-20 read-only $args keeps every state byte; working clone=${working}`,
+		async ({ args, code }) => {
+			f = new MarketFixture();
+			const repo = await f.prepared();
+			if (!working) rmSync(f.working(repo), { recursive: true, force: true });
+			f.rememberOwned();
+			const before = f.snapshot();
+			const head = f.head(repo);
+
+			const r = f.market(args);
+
+			expect(r.code).toBe(code);
+			expect(f.snapshot()).toEqual(before);
+			expect(f.head(repo)).toBe(head);
+			expect(f.journal().flatMap((event) => event.writes)).toEqual([]);
+			f.assertOwned();
+		},
+		60_000,
+	);
+}
+
+test("TEST-32 REQ-20 stale state decides nothing, offers fetch, and dry-run has no consent id", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.register(repo);
+	write(join(f.folder(), "SKILL.md"), SKILL);
+	write(join(repo.author, SKILL_REL), EDITED);
+	f.push(repo);
+	const before = f.snapshot();
+
+	const refused = f.market(["publish", "review", "--plugin", ID]);
+
+	expect(refused.code).toBe(3);
+	expect(refused.result.outcome).toBe("stale");
+	expect(refused.result.error?.code).toBe("stale");
+	expect(refused.result.planId).toBeUndefined();
+	expect(JSON.stringify(refused.result)).toContain("magus market fetch");
+	expect(f.snapshot()).toEqual(before);
+
+	const provisional = f.market([
+		"publish",
+		"review",
+		"--plugin",
+		ID,
+		"--dry-run",
+	]);
+	expect(provisional.code).toBe(0);
+	expect(provisional.result.stale).toBe(true);
+	expect(provisional.result.planId).toBeUndefined();
+	expect(f.snapshot()).toEqual(before);
+	const status = f.market(["status", "review"]);
+	expect(
+		status.result.skills?.find((row) => row.skill === "review")?.state,
+	).toBe("not-checked");
+	expect(f.snapshot()).toEqual(before);
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-32 REQ-31 fetch writes only magus's clone then fresh consent can apply", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	rmSync(f.working(repo), { recursive: true, force: true });
+	write(join(repo.author, "README.md"), "A newer remote commit\n");
+	const head = f.push(repo);
+	const clone = f.git(f.clone(repo), "rev-parse", "HEAD");
+	const fetched = f.market(["fetch", "acme"]);
+
+	expect(fetched.code).toBe(0);
+	expect(f.git(f.working(repo), "rev-parse", "HEAD")).toBe(head);
+	expect(f.git(f.clone(repo), "rev-parse", "HEAD")).toBe(clone);
+	expect(existsSync(join(f.folder(), "SKILL.md"))).toBe(true);
+	f.assertOwned();
+	const plan = f.market(["publish", "review", "--plugin", ID]);
+	expect(plan.code).toBe(3);
+	expect(plan.result.outcome).toBe("needs-consent");
+	expect(typeof plan.result.planId).toBe("string");
+	const applied = f.market([
+		"publish",
+		"review",
+		"--plugin",
+		ID,
+		`--yes=${plan.result.planId}`,
+	]);
+	expect(applied.code).toBe(0);
+	expect(f.version()).toBe("0.3.2");
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-31 REQ-20 unconsented connect marker consent leaves local state and remote unchanged", () => {
+	f = new MarketFixture();
+	const repo = f.seed({ marker: false });
+	const before = f.snapshot();
+	const head = f.head(repo);
+
+	const r = f.market(["connect", repo.url]);
+
+	expect(r.code).toBe(3);
+	expect(typeof r.result.planId).toBe("string");
+	expect(r.result.plan?.join("\n")).toMatch(/company|mark/i);
+	expect(f.snapshot()).toEqual(before);
+	expect(f.head(repo)).toBe(head);
+}, 30_000);

package/src/__tests__/market-repositories.test.ts

@@ -0,0 +1,263 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+	MANIFEST,
+	MarketFixture,
+	PLUGIN,
+	readJson,
+	sourceModule,
+	writeJson,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-19 REQ-2 registration failure after create reports the existing repository and connect remedy", () => {
+	f = new MarketFixture();
+	f.setModes({ addFail: true });
+
+	const r = f.market([
+		"create",
+		"acme/new-market",
+		"--private",
+		"--name",
+		"acme",
+		"--yes",
+	]);
+
+	expect(r.code).toBe(1);
+	expect(existsSync(join(f.root, "remotes", "acme", "new-market.git"))).toBe(
+		true,
+	);
+	expect(r.result.message.toLowerCase()).not.toContain("nothing changed");
+	expect(JSON.stringify(r.result)).toContain("connect");
+	expect(JSON.stringify(r.result)).toContain("acme/new-market");
+	f.assertOwned();
+}, 60_000);
+
+test.each(["--private", "--public"])(
+	"TEST-19 REQ-2 creates %s marketplace then reads back USER registration",
+	(visibility) => {
+		f = new MarketFixture();
+
+		const r = f.market([
+			"create",
+			"acme/new-market",
+			visibility,
+			"--name",
+			"acme",
+			"--description",
+			"Company tools",
+			"--yes",
+		]);
+
+		expect(r.code).toBe(0);
+		expect(r.result.outcome).toBe("ok");
+		const bare = join(f.root, "remotes", "acme", "new-market.git");
+		const manifest = JSON.parse(
+			f.git(f.root, "--git-dir", bare, "show", `HEAD:${MANIFEST}`),
+		);
+		expect(manifest).toEqual({
+			name: "acme",
+			owner: { name: "acme" },
+			metadata: {
+				description: "Company tools",
+				magus: { schema: 1, company: true },
+			},
+			plugins: [],
+		});
+		expect(
+			readJson(join(f.config, "plugins", "known_marketplaces.json")).acme,
+		).toBeDefined();
+		expect(
+			readJson(join(f.config, "magus-market", "trusted.json")).marketplaces.acme
+				.source,
+		).toBe("acme/new-market");
+		expect(
+			f.market(["list"]).result.marketplaces?.map((row) => ({
+				name: row.name,
+				scope: row.scope,
+			})),
+		).toEqual([{ name: "acme", scope: "user" }]);
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test("TEST-19 REQ-2 an existing repository gets a connect remedy instead of another create", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	const head = f.head(repo);
+
+	const r = f.market(["create", repo.slug, "--private", "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(r.result.error?.code).toBe("name-taken");
+	expect(JSON.stringify(r.result)).toContain("connect");
+	expect(f.head(repo)).toBe(head);
+	f.assertOwned();
+}, 30_000);
+
+test.each([
+	{
+		marker: true,
+		noManifest: false,
+		empty: false,
+		commits: 0,
+		label: "marked",
+	},
+	{
+		marker: false,
+		noManifest: false,
+		empty: false,
+		commits: 1,
+		label: "unmarked",
+	},
+	{ marker: true, noManifest: true, empty: true, commits: 1, label: "empty" },
+	{
+		marker: true,
+		noManifest: true,
+		empty: false,
+		commits: 1,
+		label: "populated without manifest",
+	},
+])(
+	"TEST-20 REQ-3 connects $label while retaining pre-existing history",
+	(options) => {
+		f = new MarketFixture();
+		const repo = f.seed(options);
+		const old = options.empty ? null : f.head(repo);
+		const originalReadme = options.empty
+			? null
+			: f.remoteFile(repo, "README.md");
+		const args = ["connect", repo.url, "--yes"];
+		if (options.noManifest) args.push("--name", "acme");
+
+		const r = f.market(args);
+
+		expect(r.code).toBe(0);
+		expect(r.result.outcome).toBe("ok");
+		expect(f.remoteJson(repo, MANIFEST).metadata.magus).toEqual({
+			schema: 1,
+			company: true,
+		});
+		if (old) {
+			expect(
+				f.git(
+					f.root,
+					"--git-dir",
+					repo.bare,
+					"rev-list",
+					"--count",
+					`${old}..HEAD`,
+				),
+			).toBe(String(options.commits));
+			expect(f.remoteFile(repo, "README.md")).toBe(originalReadme!);
+		}
+		if (old && options.noManifest) {
+			expect(
+				f.git(
+					f.root,
+					"--git-dir",
+					repo.bare,
+					"diff-tree",
+					"--no-commit-id",
+					"--name-only",
+					"-r",
+					"HEAD",
+				),
+			).toBe(MANIFEST);
+		}
+		expect(
+			readJson(join(f.config, "plugins", "known_marketplaces.json")).acme,
+		).toBeDefined();
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test("TEST-20 REQ-23 --name cannot rename an existing marketplace", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	const before = f.snapshot();
+	const head = f.head(repo);
+
+	const r = f.market(["connect", repo.url, "--name", "different", "--yes"]);
+
+	expect(r.code).toBe(2);
+	expect(f.head(repo)).toBe(head);
+	expect(f.snapshot()).toEqual(before);
+}, 30_000);
+
+test("TEST-20 REQ-20 GitHub connect without gh cleans up its temporary read clone", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.missingGh();
+	const before = f.snapshot();
+
+	const r = f.market(["connect", repo.url]);
+
+	expect(r.code).toBe(3);
+	expect(r.result.outcome).toBe("needs-consent");
+	expect(typeof r.result.planId).toBe("string");
+	expect(f.snapshot()).toEqual(before);
+}, 30_000);
+
+test("TEST-20 REQ-3 reconnect refreshes an already registered but not yet marked clone", () => {
+	f = new MarketFixture();
+	const repo = f.seed({ marker: false });
+	f.register(repo, { trust: false });
+	const manifest = readJson(join(repo.author, MANIFEST));
+	manifest.metadata.magus = { schema: 1, company: true };
+	writeJson(join(repo.author, MANIFEST), manifest);
+	f.push(repo);
+
+	const r = f.market(["connect", repo.url, "--yes"]);
+
+	expect(r.code).toBe(0);
+	expect(
+		f.market(["list"]).result.marketplaces?.map((row) => row.name),
+	).toEqual(["acme"]);
+	f.assertOwned();
+}, 60_000);
+
+test("TEST-43 REQ-16 remove discloses uninstall/profile re-add and never deletes the remote", async () => {
+	f = new MarketFixture();
+	const repo = await f.prepared();
+	f.profile();
+	const head = f.head(repo);
+	const folder = f.folder();
+	const before = f.snapshot();
+
+	const plan = f.market(["remove", "acme"]);
+
+	expect(plan.code).toBe(3);
+	const wording = [plan.result.message, ...(plan.result.plan ?? [])].join("\n");
+	expect(wording).toMatch(/uninstall/i);
+	expect(wording).toContain(PLUGIN);
+	expect(wording).toContain("magus update");
+	expect(wording).toMatch(/adds? it back|again/i);
+	expect(f.snapshot()).toEqual(before);
+
+	const applied = f.market(["remove", "acme", `--yes=${plan.result.planId}`]);
+
+	expect(applied.code).toBe(0);
+	expect(f.head(repo)).toBe(head);
+	expect(existsSync(repo.bare)).toBe(true);
+	expect(readFileSync(join(folder, "SKILL.md"), "utf8")).toContain(
+		"Review error handling",
+	);
+	expect(
+		readJson(join(f.config, "magus-market", "trusted.json")).marketplaces.acme,
+	).toBeUndefined();
+	expect(existsSync(f.working(repo))).toBe(false);
+	const base = f.value(
+		`const b=await import(${JSON.stringify(sourceModule("services/market-bases.js"))}); console.log(JSON.stringify(b.readBase(${JSON.stringify(folder)})));`,
+	);
+	expect(base).toBeNull();
+	f.assertOwned();
+}, 60_000);

package/src/__tests__/market-results.test.ts

@@ -0,0 +1,198 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import {
+	computePlanId,
+	errorResult,
+	exitCodeFor,
+} from "../services/market-ops.js";
+import { MarketError, type MarketResult } from "../services/market-types.js";
+import { MarketFixture, sourceModule } from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+function result(
+	outcome: MarketResult["outcome"],
+	error?: MarketResult["error"],
+): MarketResult {
+	return {
+		command: "market publish",
+		outcome,
+		message: "State of this change",
+		steps: [],
+		...(error ? { error } : {}),
+	};
+}
+test.each([
+	["ok", 0],
+	["unchanged", 0],
+	["plugin-newer", 0],
+	["pull-request", 0],
+	["failed", 1],
+	["partial", 1],
+	["needs-consent", 3],
+	["stale", 3],
+] as const)("TEST-15 REQ-27 outcome %s exits %i", (outcome, code) =>
+	expect(exitCodeFor(result(outcome))).toBe(code),
+);
+test.each([
+	["gh-auth", 4],
+	["no-network", 1],
+	["no-access", 1],
+	["fork-not-allowed", 1],
+	["timeout", 1],
+	["signing-timeout", 1],
+	["install-failed", 1],
+	["plan-changed", 3],
+] as const)("TEST-15 REQ-27 error %s exits %i", (code, exit) => {
+	const r = errorResult(
+		"market publish",
+		new MarketError(code, "Provider failure"),
+	);
+	expect(r.error?.code).toBe(code);
+	expect(exitCodeFor(r)).toBe(exit);
+	expect(exitCodeFor(r, true)).toBe(2);
+});
+test("TEST-15 REQ-27 an unexpected exception keeps its words under other", () => {
+	const r = errorResult(
+		"market publish",
+		new Error("unexpected provider words"),
+	);
+	expect(r.outcome).toBe("failed");
+	expect(r.error).toEqual({
+		code: "other",
+		message: expect.stringContaining("unexpected provider words"),
+	});
+});
+
+test("TEST-48 REQ-32 a live lock excludes another writer and release permits a new one", () => {
+	f = new MarketFixture();
+	const answer = f.value<{
+		refused: string | null;
+		acquiredAfterRelease: boolean;
+	}>(
+		`const c=await import(${JSON.stringify(sourceModule("services/market-clone.js"))});const release=await c.acquireMarketLock('acme'); let refused=null; try { const unexpected=await c.acquireMarketLock('acme'); unexpected(); } catch(e) { refused=e.code; } finally { release(); }const again=await c.acquireMarketLock('acme'); again(); console.log(JSON.stringify({refused,acquiredAfterRelease:true}));`,
+	);
+	expect(answer).toEqual({ refused: "locked", acquiredAfterRelease: true });
+});
+
+test("TEST-48 REQ-24 a public plan revalidation changes consent before any external step", () => {
+	f = new MarketFixture();
+	const destination = join(f.project, "must-not-exist.txt");
+	const r = f.value<MarketResult>(
+		`const fs=await import('node:fs'); const o=await import(${JSON.stringify(sourceModule("services/market-ops.js"))});const fresh={command:'market test',lines:['Fresh action'],planId:'fresh',summary:{},steps:[{id:'write',label:'write',outside:true,run:async()=>{fs.writeFileSync(${JSON.stringify(destination)},'wrong');}}],sync:null,lock:null,doneMessage:'Done'};fresh.replan=async()=>({kind:'plan',plan:fresh}); const old={...fresh,planId:'old'}; console.log(JSON.stringify(await o.applyMarketPlan(old,{approved:'old',cwd:${JSON.stringify(f.project)}})));`,
+	);
+	expect(r.outcome).toBe("needs-consent");
+	expect(r.error?.code).toBe("plan-changed");
+	expect(r.planId).toBe("fresh");
+	expect(r.plan).toEqual(["Fresh action"]);
+	expect(existsSync(destination)).toBe(false);
+});
+
+const facts = {
+	operation: "publish",
+	options: { from: "project", force: false, keepLocal: false },
+	commit: "a".repeat(40),
+	hash: "content-a",
+	notPublished: [],
+	target: "push-or-pr",
+	version: { from: "0.3.1", to: "0.3.2" },
+	installs: [{ scope: "user", from: "0.3.1" }],
+	localCopy: { action: "removed" },
+};
+test("TEST-16 REQ-24 identical material facts have a stable consent id", () => {
+	expect(computePlanId(facts)).toBe(
+		computePlanId(JSON.parse(JSON.stringify(facts))),
+	);
+});
+test.each([
+	{ operation: "skill add" },
+	{ options: { from: "global", force: false, keepLocal: false } },
+	{ options: { from: "project", force: true, keepLocal: false } },
+	{ options: { from: "project", force: false, keepLocal: true } },
+	{ commit: "b".repeat(40) },
+	{ hash: "content-b" },
+	{ notPublished: [{ path: ".env", reason: "dotfile" }] },
+	{ target: "fork-pr" },
+	{ version: { from: "0.3.2", to: "0.3.3" } },
+	{
+		installs: [
+			{ scope: "user", from: "0.3.1" },
+			{ scope: "project", from: "0.3.1" },
+		],
+	},
+	{ localCopy: { action: "kept", reason: "turned off here" } },
+])("TEST-16 REQ-24 changed material fact revokes consent: %j", (patch) => {
+	expect(computePlanId({ ...facts, ...patch })).not.toBe(computePlanId(facts));
+});
+
+test("TEST-48 REQ-32 apply stops at a failed public plan step and reports completed writes", () => {
+	f = new MarketFixture();
+	const first = join(f.project, "first.txt");
+	const last = join(f.project, "must-not-exist.txt");
+	const script = `const fs = await import('node:fs'); const o = await import(${JSON.stringify(sourceModule("services/market-ops.js"))});const t = await import(${JSON.stringify(sourceModule("services/market-types.js"))});const p = {command:'market test', lines:['first write','fail','last write'],planId:'approved',summary:{},sync:null,lock:null,doneMessage:'Done', steps:[{id:'first',label:'first',outside:true,run:async()=>{fs.writeFileSync(${JSON.stringify(first)},'first');}},{id:'fail',label:'fail',outside:false,run:async()=>{throw new t.MarketError('other','Provider stopped');}},{id:'last',label:'last',outside:true,run:async()=>{fs.writeFileSync(${JSON.stringify(last)},'last');}}]}; p.replan=async()=>({kind:'plan',plan:p}); console.log(JSON.stringify(await o.applyMarketPlan(p,{approved:'approved',cwd:${JSON.stringify(f.project)}})));`;
+
+	const r = f.value<MarketResult>(script);
+
+	expect(r.outcome).toBe("failed");
+	expect(
+		r.steps.filter((step) => step.status === "done").map((step) => step.id),
+	).toEqual(["first"]);
+	expect(r.steps.find((step) => step.id === "fail")?.status).toBe("failed");
+	expect(r.message.toLowerCase()).not.toContain("nothing changed");
+	expect(existsSync(first)).toBe(true);
+	expect(existsSync(last)).toBe(false);
+});
+
+test.each(
+	[
+		["market", "nonsense"],
+		["market", "publish"],
+		["market", "plugin", "unknown"],
+		["market", "create", "acme/new"],
+		["market", "create", "acme/new", "--private", "--public"],
+		["market", "publish", "review", "--from", "elsewhere"],
+		["market", "publish", "review", "--unknown"],
+	].map((argv) => ({ argv })),
+)(
+	"TEST-47 REQ-27 rejects invalid argv %j before any writes",
+	({ argv }) => {
+		f = new MarketFixture();
+		const before = f.snapshot();
+
+		const r = f.cli([...argv, "--json"]);
+
+		expect(r.code).toBe(2);
+		expect(f.snapshot()).toEqual(before);
+		f.assertOwned();
+	},
+	30_000,
+);
+
+test("TEST-47 REQ-18 human output uses a header, scope and reload guidance", async () => {
+	f = new MarketFixture();
+	await f.prepared();
+
+	const r = f.cli([
+		"market",
+		"publish",
+		"review",
+		"--plugin",
+		"review-kit@acme",
+		"--yes",
+	]);
+
+	expect(r.code).toBe(0);
+	expect(r.out).toContain("◆");
+	expect(r.out).toContain("USER");
+	expect(r.out).toContain("0.3.2");
+	expect(r.out).toContain("/reload-plugins");
+	expect(r.out).toMatch(/new sessions/i);
+	expect(r.out).not.toMatch(
+		/installed_plugins\.json|known_marketplaces\.json|enabledPlugins|legacy/i,
+	);
+	f.assertOwned();
+}, 60_000);

package/src/__tests__/market-router.test.ts

@@ -0,0 +1,65 @@
+import { afterEach, expect, test } from "bun:test";
+import { MarketFixture, sourceModule } from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-17 REQ-1 routing edit selects a different app than bare magus", () => {
+	f = new MarketFixture();
+	const before = f.snapshot();
+	const routes = f.value<
+		Array<{ launchTui: boolean; app?: string; handled: boolean }>
+	>(
+		`const {route}=await import(${JSON.stringify(sourceModule("cli/router.js"))}); console.log(JSON.stringify([await route(['edit'],'1.2.3'),await route([],'1.2.3')]));`,
+	);
+	expect(routes[0]).toEqual({ handled: false, launchTui: true, app: "market" });
+	expect(routes[1]?.handled).toBe(false);
+	expect(routes[1]?.launchTui).toBe(true);
+	expect(routes[1]?.app ?? "main").toBe("main");
+	expect(f.snapshot()).toEqual(before);
+});
+test("TEST-17 REQ-1 headless bare edit is a usage error without renderer writes", () => {
+	f = new MarketFixture();
+	const before = f.snapshot();
+
+	const r = f.cli(["edit"]);
+
+	expect(r.code).toBe(2);
+	expect(r.out + r.err).toMatch(/terminal|TTY|interactive/i);
+	expect(f.snapshot()).toEqual(before);
+});
+
+test.each(
+	[
+		["market", "--help"],
+		["--help"],
+		["update", "--help"],
+		["install", "--help"],
+		["upgrade", "--help"],
+		["upgrade", "-v"],
+	].map((args) => ({ args })),
+)(
+	"TEST-18 REQ-27 help/version bypass profile gates and preserve state: %j",
+	({ args }) => {
+		f = new MarketFixture();
+		const before = f.snapshot();
+
+		const r = f.cli(args);
+
+		expect(r.code).toBe(0);
+		expect(r.out + r.err).toMatch(/magus/i);
+		if (args[0] === "market") {
+			expect(r.out).toContain("publish");
+			expect(r.out).toContain("connect");
+		} else if (args.includes("--help")) {
+			expect(r.out).toContain("upgrade");
+			expect(r.out).toContain("install");
+		}
+		expect(f.snapshot()).toEqual(before);
+		expect(f.journal().flatMap((event) => event.writes)).toEqual([]);
+	},
+	30_000,
+);