magus-cli 7.12.2 → 7.14.0

package/src/__tests__/market-safety.test.ts

@@ -0,0 +1,357 @@
+import { afterEach, expect, test } from "bun:test";
+import {
+	existsSync,
+	mkdirSync,
+	readFileSync,
+	rmSync,
+	symlinkSync,
+} from "node:fs";
+import { join } from "node:path";
+import {
+	EDITED,
+	ID,
+	MarketFixture,
+	SKILL,
+	SKILL_REL,
+	expectPublished,
+	sourceModule,
+	write,
+	writeJson,
+} from "./market-fixture.js";
+
+let f: MarketFixture | undefined;
+afterEach(() => {
+	f?.close();
+	f = undefined;
+});
+
+test("TEST-27 REQ-21 source inventory exclusions list every reason and never publish secret bytes", () => {
+	f = new MarketFixture();
+	const repo = f.seed({
+		extras: { ".gitignore": "plugins/review-kit/skills/review/dest.tmp\n" },
+	});
+	f.register(repo);
+	const folder = f.folder();
+	write(join(folder, "SKILL.md"), EDITED);
+	write(join(folder, ".env"), "PRIVATE_TOKEN=never-publish\n");
+	write(
+		join(folder, "node_modules", "pkg", "secret.txt"),
+		"never publish dependency\n",
+	);
+	write(join(folder, "ignored.txt"), "never publish ignored content\n");
+	write(join(folder, "dest.tmp"), "never publish destination ignored\n");
+	write(join(folder, "references", "guide.md"), "Publish this guide\n");
+	write(join(f.project, ".gitignore"), ".claude/skills/review/ignored.txt\n");
+	const outside = join(f.root, "outside.txt");
+	write(outside, "outside secret\n");
+	symlinkSync(outside, join(folder, "link.txt"));
+	const before = f.snapshot();
+
+	const sets = f.value<{
+		published: Array<{ path: string }>;
+		notPublished: Array<{ path: string; reason: string }>;
+	}>(
+		`const m=await import(${JSON.stringify(sourceModule("services/market-publish.js"))}); console.log(JSON.stringify(await m.readSourceSets(${JSON.stringify(folder)},${JSON.stringify(f.clone(repo))},'plugins/review-kit/skills/review')));`,
+	);
+
+	expect(sets.published.map((file) => file.path).sort()).toEqual([
+		"SKILL.md",
+		"references/guide.md",
+	]);
+	expect(
+		sets.notPublished.sort((a, b) => a.path.localeCompare(b.path)),
+	).toEqual(
+		[
+			{ path: ".env", reason: "dotfile" },
+			{ path: "dest.tmp", reason: "ignored-by-marketplace" },
+			{ path: "ignored.txt", reason: "ignored-here" },
+			{ path: "link.txt", reason: "symlink" },
+			{ path: "node_modules/pkg/secret.txt", reason: "node_modules" },
+		].sort((a, b) => a.path.localeCompare(b.path)),
+	);
+	expect(f.snapshot()).toEqual(before);
+	expect(readFileSync(outside, "utf8")).toBe("outside secret\n");
+}, 30_000);
+
+test("TEST-27 REQ-21 an ignored skill root bypasses source ignore rules, not shape or destination exclusions", () => {
+	f = new MarketFixture();
+	const repo = f.seed({ extras: { ".gitignore": "*.tmp\n" } });
+	f.register(repo);
+	write(join(f.project, ".gitignore"), ".claude/skills/review/\n*.secret\n");
+	write(join(f.folder(), "SKILL.md"), EDITED);
+	write(
+		join(f.folder(), "notes.secret"),
+		"Included because the root is ignored\n",
+	);
+	write(join(f.folder(), ".env"), "Still excluded\n");
+	write(join(f.folder(), "dest.tmp"), "Still excluded by marketplace\n");
+
+	const sets = f.value<{
+		untrackedFolder: boolean;
+		published: Array<{ path: string }>;
+		notPublished: Array<{ path: string; reason: string }>;
+	}>(
+		`const m=await import(${JSON.stringify(sourceModule("services/market-publish.js"))}); console.log(JSON.stringify(await m.readSourceSets(${JSON.stringify(f.folder())},${JSON.stringify(f.clone(repo))},'plugins/review-kit/skills/review')));`,
+	);
+
+	expect(sets.untrackedFolder).toBe(true);
+	expect(sets.published.map((file) => file.path).sort()).toEqual([
+		"SKILL.md",
+		"notes.secret",
+	]);
+	expect(sets.notPublished).toContainEqual({ path: ".env", reason: "dotfile" });
+	expect(sets.notPublished).toContainEqual({
+		path: "dest.tmp",
+		reason: "ignored-by-marketplace",
+	});
+}, 30_000);
+
+test("TEST-27 REQ-30 excluded plugin files compare same, survive publish, and an exact full copy is removable", () => {
+	f = new MarketFixture();
+	const repo = f.seed({
+		extras: {
+			"plugins/review-kit/skills/review/.gitkeep": "",
+			"plugins/review-kit/skills/review/ignored.txt":
+				"Plugin content ignored by the source project\n",
+		},
+	});
+	f.register(repo);
+	f.install();
+	write(join(f.project, ".gitignore"), ".claude/skills/review/ignored.txt\n");
+	f.edit();
+
+	const status = f.market(["status", "review"]);
+
+	expect(
+		status.result.skills?.find((row) => row.skill === "review")?.state,
+	).toBe("same");
+	write(join(f.folder(), "SKILL.md"), EDITED);
+	const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+	expect(r.code).toBe(0);
+	expect(
+		r.result.files?.map(({ path, change }) => ({
+			path: path === SKILL_REL ? "SKILL.md" : path,
+			change,
+		})),
+	).toEqual([{ path: "SKILL.md", change: "modified" }]);
+	expect(f.remotePaths(repo)).toContain(
+		"plugins/review-kit/skills/review/.gitkeep",
+	);
+	expect(
+		f.remoteFile(repo, "plugins/review-kit/skills/review/ignored.txt"),
+	).toContain("Plugin content");
+	expect(r.result.localCopy?.action).toBe("removed");
+	expect(existsSync(f.folder())).toBe(false);
+	f.assertOwned();
+}, 60_000);
+
+test.each([
+	{ file: ".env", reason: "dotfile" },
+	{ file: "dest.tmp", reason: "ignored-by-marketplace" },
+	{ file: "ignored.txt", reason: "ignored-here" },
+])(
+	"TEST-27 REQ-15 unpublished $file is kept after a successful push",
+	async ({ file, reason }) => {
+		f = new MarketFixture();
+		const repo = f.seed({ extras: { ".gitignore": "*.tmp\n" } });
+		f.register(repo);
+		f.install();
+		f.edit();
+		write(join(f.folder(), "SKILL.md"), EDITED);
+		write(join(f.folder(), file), "Not published; must survive\n");
+		if (reason === "ignored-here")
+			write(
+				join(f.project, ".gitignore"),
+				".claude/skills/review/ignored.txt\n",
+			);
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(0);
+		expectPublished(f, repo);
+		expect(r.result.notPublished).toContainEqual({ path: file, reason });
+		expect(r.result.localCopy?.action).toBe("kept");
+		expect(readFileSync(join(f.folder(), file), "utf8")).toBe(
+			"Not published; must survive\n",
+		);
+		expect(f.remotePaths(repo)).not.toContain(
+			`plugins/review-kit/skills/review/${file}`,
+		);
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each([
+	"not-installed",
+	"keep-local",
+	"profile-managed",
+	"custom-profile-folder",
+	"local-off",
+	"global-project-only",
+] as const)(
+	"TEST-30 REQ-15 removes only a reachable exact active copy: %s",
+	(kind) => {
+		f = new MarketFixture();
+		const repo = f.seed();
+		f.register(repo);
+		if (kind !== "not-installed")
+			f.install(ID, kind === "global-project-only" ? "project" : "user");
+		const global = kind === "global-project-only";
+		f.edit(global ? ["--to", "global"] : []);
+		const folder = f.folder(global ? "global" : "project");
+		write(join(folder, "SKILL.md"), EDITED);
+		if (kind === "profile-managed" || kind === "custom-profile-folder") {
+			f.profile();
+			f.active(kind === "profile-managed" ? { review: "a".repeat(64) } : {});
+		}
+		if (kind === "local-off")
+			writeJson(join(f.project, ".claude", "settings.local.json"), {
+				enabledPlugins: { [ID]: false },
+			});
+		f.rememberOwned();
+
+		const r = f.market([
+			"publish",
+			"review",
+			"--plugin",
+			ID,
+			"--yes",
+			...(global ? ["--from", "global"] : []),
+			...(kind === "keep-local" ? ["--keep-local"] : []),
+		]);
+
+		expect(r.code).toBe(0);
+		const removed = kind === "custom-profile-folder";
+		expect(r.result.localCopy?.action).toBe(removed ? "removed" : "kept");
+		expect(existsSync(folder)).toBe(!removed);
+		expectPublished(f, repo);
+		if (!removed) expect(typeof r.result.localCopy?.reason).toBe("string");
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each([
+	{ user: true, project: true, local: false, expected: "local" },
+	{ user: true, project: false, local: true, expected: null },
+	{ user: true, project: false, local: undefined, expected: "project" },
+	{ user: false, project: undefined, local: undefined, expected: "user" },
+	{ user: undefined, project: undefined, local: undefined, expected: null },
+])(
+	"TEST-30 REQ-15 activation precedence is LOCAL over PROJECT over USER: %j",
+	(values) => {
+		f = new MarketFixture();
+		for (const [scope, file] of [
+			["user", join(f.config, "settings.json")],
+			["project", join(f.project, ".claude", "settings.json")],
+			["local", join(f.project, ".claude", "settings.local.json")],
+		] as const)
+			if (values[scope] !== undefined)
+				writeJson(file, { enabledPlugins: { [ID]: values[scope] } });
+
+		const off = f.value(
+			`const m=await import(${JSON.stringify(sourceModule("services/market-publish.js"))}); console.log(JSON.stringify(await m.turnedOffHere(${JSON.stringify(ID)},${JSON.stringify(f.project)})));`,
+		);
+
+		expect(off).toBe(values.expected);
+	},
+);
+
+test.each(["new-file", "changed-file", "turned-off"] as const)(
+	"TEST-49 REQ-15 source or activation changed at CLI completion remains kept: %s",
+	async (kind) => {
+		f = new MarketFixture();
+		const repo = await f.prepared();
+		const file = join(
+			f.folder(),
+			kind === "new-file" ? "late.txt" : "SKILL.md",
+		);
+		f.setModes(
+			kind === "turned-off"
+				? { lateOff: "local" }
+				: { lateFile: { path: file, content: "Late content must survive\n" } },
+		);
+
+		const r = f.market(["publish", "review", "--plugin", ID, "--yes"]);
+
+		expect(r.code).toBe(0);
+		expectPublished(f, repo);
+		expect(r.result.localCopy?.action).toBe("kept");
+		expect(existsSync(f.folder())).toBe(true);
+		if (kind !== "turned-off")
+			expect(readFileSync(file, "utf8")).toBe("Late content must survive\n");
+		expect(typeof r.result.localCopy?.reason).toBe("string");
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test.each(["plugin", "skill", "manifest"] as const)(
+	"TEST-44 REQ-21 refuses a symlink at the %s write boundary",
+	(boundary) => {
+		f = new MarketFixture();
+		const repo = f.seed();
+		const outside = join(f.root, "outside");
+		mkdirSync(outside);
+		write(join(outside, "sentinel.txt"), "Do not alter\n");
+		let args: string[];
+		if (boundary === "manifest") {
+			const manifestText = readFileSync(
+				join(repo.author, ".claude-plugin", "marketplace.json"),
+				"utf8",
+			);
+			rmSync(join(repo.author, ".claude-plugin"), { recursive: true });
+			write(join(outside, "marketplace.json"), manifestText);
+			symlinkSync(outside, join(repo.author, ".claude-plugin"));
+			args = ["plugin", "create", "unsafe@acme", "--yes"];
+		} else {
+			const rel =
+				boundary === "plugin"
+					? "plugins/review-kit"
+					: "plugins/review-kit/skills/review";
+			rmSync(join(repo.author, rel), { recursive: true });
+			if (boundary === "plugin")
+				writeJson(join(outside, ".claude-plugin", "plugin.json"), {
+					name: "review-kit",
+					version: "0.3.1",
+				});
+			else write(join(outside, "SKILL.md"), SKILL);
+			symlinkSync(outside, join(repo.author, rel));
+			args =
+				boundary === "plugin"
+					? ["plugin", "delete", ID, "--yes"]
+					: ["skill", "remove", "review", "--plugin", ID, "--yes"];
+		}
+		f.push(repo);
+		f.register(repo);
+		const head = f.head(repo);
+		const sentinel = readFileSync(join(outside, "sentinel.txt"), "utf8");
+
+		const r = f.market(args);
+
+		// Refuse at ownership lookup (usage) or at the link write guard.
+		if (boundary === "skill") expect([1, 2]).toContain(r.code);
+		else expect(r.code).toBe(1);
+		expect(f.head(repo)).toBe(head);
+		expect(readFileSync(join(outside, "sentinel.txt"), "utf8")).toBe(sentinel);
+		f.assertOwned();
+	},
+	60_000,
+);
+
+test("TEST-44 REQ-21 skill edit refuses a linked destination parent", () => {
+	f = new MarketFixture();
+	const repo = f.seed();
+	f.register(repo);
+	const outside = join(f.root, "outside");
+	mkdirSync(outside);
+	mkdirSync(join(f.project, ".claude"), { recursive: true });
+	symlinkSync(outside, join(f.project, ".claude", "skills"));
+
+	const r = f.market(["skill", "edit", "review", "--plugin", ID, "--yes"]);
+
+	expect(r.code).toBe(1);
+	expect(existsSync(join(outside, "review"))).toBe(false);
+	f.assertOwned();
+}, 30_000);

package/src/__tests__/market-teammates.test.ts

@@ -0,0 +1,304 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, mkdirSync, readFileSync, symlinkSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import {
+	ID,
+	MANIFEST,
+	MarketFixture,
+	PLUGIN_MANIFEST,
+	type Repo,
+	readJson,
+	sourceModule,
+	writeJson,
+} from "./market-fixture.js";
+
+const machines: MarketFixture[] = [];
+function machine(): MarketFixture {
+	const f = new MarketFixture();
+	machines.push(f);
+	return f;
+}
+afterEach(() => {
+	for (const f of machines.splice(0).reverse()) f.close();
+});
+function shareRemote(from: Repo, to: MarketFixture): void {
+	const link = join(to.root, "remotes", `${from.slug}.git`);
+	mkdirSync(dirname(link), { recursive: true });
+	symlinkSync(from.bare, link);
+}
+function registration(f: MarketFixture, marketplaces: Record<string, unknown>) {
+	return f.value<{
+		added: unknown[];
+		trusted: string[];
+		conflicts: Array<{ name: string; message: string; fix?: string }>;
+		failed: unknown[];
+	}>(
+		`const m=await import(${JSON.stringify(sourceModule("services/marketplace-sync.js"))}); console.log(JSON.stringify(await m.registerClosureMarketplaces(${JSON.stringify(marketplaces)},${JSON.stringify(f.project)})));`,
+	);
+}
+function conflicts(f: MarketFixture, marketplaces: Record<string, unknown>) {
+	return f.value<Array<{ name: string; message: string; fix?: string }>>(
+		`const m=await import(${JSON.stringify(sourceModule("services/marketplace-sync.js"))}); console.log(JSON.stringify(await m.findMarketplaceConflicts(${JSON.stringify(marketplaces)},${JSON.stringify(f.project)})));`,
+	);
+}
+function addPlugin(f: MarketFixture, repo: Repo, name: string) {
+	const manifest = readJson(join(repo.author, MANIFEST));
+	manifest.plugins.push({
+		name,
+		source: `./plugins/${name}`,
+		version: "0.1.0",
+		description: `${name} tools`,
+	});
+	writeJson(join(repo.author, MANIFEST), manifest);
+	writeJson(
+		join(repo.author, "plugins", name, ".claude-plugin", "plugin.json"),
+		{ name, version: "0.1.0", description: `${name} tools` },
+	);
+}
+
+test("TEST-36 REQ-33 mismatched company source is a read-only conflict with no destructive remove fix", () => {
+	const f = machine();
+	const repo = f.seed({ slug: "different/market" });
+	f.register(repo);
+	const refs = { acme: { source: "github", repo: "expected/market" } };
+	const before = f.snapshot();
+
+	const readOnly = conflicts(f, refs);
+	const applied = registration(f, refs);
+
+	expect(readOnly.map((row) => row.name)).toEqual(["acme"]);
+	expect(applied.conflicts.map((row) => row.name)).toEqual(["acme"]);
+	expect(applied.added).toEqual([]);
+	expect(applied.trusted).toEqual([]);
+	for (const row of [...readOnly, ...applied.conflicts]) {
+		expect(row.message).toMatch(/nothing was changed/i);
+		expect(row.fix ?? "").not.toContain("market remove");
+		expect(row.fix ?? "").toMatch(/check/i);
+	}
+	expect(f.snapshot()).toEqual(before);
+	expect(f.journal()).toEqual([]);
+	f.assertOwned();
+}, 30_000);
+
+test.each(["fork", "path", "directory"] as const)(
+	"TEST-37 REQ-33 default magus registration from a %s is not a company conflict",
+	(source) => {
+		const f = machine();
+		const repo = f.seed({
+			name: "magus",
+			slug: "developer/magus-fork",
+			marker: false,
+		});
+		f.register(repo, { trust: false });
+		if (source === "path")
+			f.registration(repo, { source: "git", url: repo.author });
+		if (source === "directory")
+			f.registration(repo, { source: "directory", path: repo.author });
+		const refs = { magus: { source: "github", repo: "MadAppGang/magus" } };
+		const before = f.snapshot();
+
+		expect(conflicts(f, refs)).toEqual([]);
+		const r = registration(f, refs);
+		expect(r.conflicts).toEqual([]);
+		expect(r.added).toEqual([]);
+		expect(f.snapshot()).toEqual(before);
+		f.assertOwned();
+	},
+	30_000,
+);
+
+test.each(["case", "relative-directory"] as const)(
+	"TEST-37 REQ-33 equivalent %s source trusts the company without changing its registration",
+	(spelling) => {
+		const f = machine();
+		const repo = f.seed();
+		f.register(repo, { trust: false });
+		let refs: Record<string, unknown>;
+		if (spelling === "case") {
+			f.registration(repo, { source: "github", repo: "Acme/Market" });
+			refs = { acme: { source: "github", repo: "acme/market" } };
+		} else {
+			f.registration(repo, { source: "directory", path: repo.author });
+			refs = {
+				acme: { source: "directory", path: relative(f.project, repo.author) },
+			};
+		}
+
+		expect(conflicts(f, refs)).toEqual([]);
+		const r = registration(f, refs);
+		expect(r.conflicts).toEqual([]);
+		expect(r.trusted).toEqual(["acme"]);
+		expect(registration(f, refs).trusted).toEqual([]);
+		f.assertOwned();
+	},
+	30_000,
+);
+
+test.each([
+	{ args: ["update", "team", "--dry-run"], readonly: true, stop: false },
+	{ args: ["update", "team", "--check"], readonly: true, stop: false },
+	{ args: ["update", "team"], readonly: false, stop: false },
+	{ args: ["install", "team", "--yes"], readonly: false, stop: true },
+])(
+	"TEST-36 REQ-26 wrong-source work stays out in $args",
+	({ args, readonly, stop }) => {
+		const f = machine();
+		const repo = f.seed({ slug: "different/market" });
+		f.register(repo);
+		f.install();
+		const manifest = readJson(join(repo.author, MANIFEST));
+		manifest.plugins[0].version = "0.3.2";
+		writeJson(join(repo.author, MANIFEST), manifest);
+		writeJson(join(repo.author, PLUGIN_MANIFEST), {
+			name: "review-kit",
+			version: "0.3.2",
+		});
+		f.push(repo);
+		f.git(f.clone(repo), "pull", "--ff-only");
+		f.profile(
+			{ [ID]: "latest" },
+			{ acme: { source: "github", repo: "expected/market" } },
+		);
+		if (!stop) f.active();
+		const profile = readFileSync(
+			join(f.project, ".claude", "profiles.json"),
+			"utf8",
+		);
+		const registry = readFileSync(
+			join(f.config, "plugins", "installed_plugins.json"),
+			"utf8",
+		);
+		const userSettings = readFileSync(join(f.config, "settings.json"), "utf8");
+		const before = f.snapshot();
+
+		const r = f.cli(args);
+
+		if (stop) expect(r.code).toBe(1);
+		expect(r.out + r.err).toContain("acme");
+		expect(r.out + r.err).toMatch(
+			/left out|conflict|different|not the|does not match/i,
+		);
+		expect(r.out + r.err).not.toContain("magus market remove");
+		expect(
+			readFileSync(join(f.config, "plugins", "installed_plugins.json"), "utf8"),
+		).toBe(registry);
+		expect(readFileSync(join(f.config, "settings.json"), "utf8")).toBe(
+			userSettings,
+		);
+		expect(
+			readFileSync(join(f.project, ".claude", "profiles.json"), "utf8"),
+		).toBe(profile);
+		expect(f.version()).toBe("0.3.1");
+		if (stop)
+			expect(
+				existsSync(join(f.project, ".claude", "profiles", "active.json")),
+			).toBe(false);
+		if (readonly) expect(f.snapshot()).toEqual(before);
+	},
+	60_000,
+);
+
+test.each(["install", "update"] as const)(
+	"TEST-40 REQ-6 REQ-7 Save Profile on the author onboards a fresh teammate via %s",
+	(verb) => {
+		const author = machine();
+		const repo = author.seed({ dependencies: ["base-kit"] });
+		addPlugin(author, repo, "base-kit");
+		author.push(repo);
+		author.register(repo);
+		author.install(ID, "project");
+		const saved = author.value<Record<string, any>>(
+			`const p=await import(${JSON.stringify(sourceModule("services/profiles.js"))}); const fs=await import('node:fs'); await p.saveProfile('Team',{${JSON.stringify(ID)}:true},'project',${JSON.stringify(author.project)}); console.log(JSON.stringify(JSON.parse(fs.readFileSync(${JSON.stringify(join(author.project, ".claude", "profiles.json"))},'utf8'))));`,
+		);
+		expect(saved.profiles.team.marketplaces.acme).toEqual({
+			source: "github",
+			repo: repo.slug,
+		});
+		expect(saved.profiles.team.marketplaces.magus).toBeUndefined();
+		const mate = machine();
+		shareRemote(repo, mate);
+		writeJson(join(mate.project, ".claude", "profiles.json"), saved);
+
+		const r = mate.cli(
+			verb === "install" ? [verb, "team", "--yes"] : [verb, "team"],
+		);
+
+		expect(r.code).toBe(0);
+		expect(mate.version(ID, "project")).toBe("0.3.1");
+		expect(mate.version("base-kit@acme", "project")).toBe("0.1.0");
+		expect(mate.version(ID, "user")).toBeNull();
+		expect(
+			readJson(join(mate.config, "magus-market", "trusted.json")).marketplaces
+				.acme,
+		).toEqual({ source: repo.slug, via: "profile" });
+		const notices = (r.out + r.err).match(/company marketplace|trust/gi) ?? [];
+		expect(notices.length).toBeGreaterThan(0);
+	},
+	60_000,
+);
+
+test.each(["github", "git"] as const)(
+	"TEST-41 REQ-7 company %s source refreshes inside the hour despite autoUpdate false and adds new dependency",
+	(source) => {
+		const author = machine();
+		const repo = author.seed({ dependencies: ["base-kit"] });
+		addPlugin(author, repo, "base-kit");
+		author.push(repo);
+		const mate = machine();
+		shareRemote(repo, mate);
+		mate.setModes({ autoUpdate: false });
+		mate.profile();
+		const first = mate.cli(["update", "team"]);
+		expect(first.code).toBe(0);
+		expect(mate.version(ID, "project")).toBe("0.3.1");
+		if (source === "git")
+			mate.registration(repo, { source: "git", url: repo.url });
+		const knownFile = join(mate.config, "plugins", "known_marketplaces.json");
+		const known = readJson(knownFile);
+		known.acme.autoUpdate = false;
+		writeJson(knownFile, known);
+		addPlugin(author, repo, "extra-kit");
+		const manifest = readJson(join(repo.author, MANIFEST));
+		manifest.plugins.find(
+			(entry: { name: string }) => entry.name === "review-kit",
+		).version = "0.3.2";
+		writeJson(join(repo.author, MANIFEST), manifest);
+		writeJson(join(repo.author, PLUGIN_MANIFEST), {
+			name: "review-kit",
+			version: "0.3.2",
+			dependencies: ["base-kit", "extra-kit"],
+		});
+		author.push(repo);
+
+		const second = mate.cli(["update", "team"]);
+
+		expect(second.code).toBe(0);
+		expect(mate.version(ID, "project")).toBe("0.3.2");
+		expect(mate.version("extra-kit@acme", "project")).toBe("0.1.0");
+		expect(mate.version("base-kit@acme", "project")).toBe("0.1.0");
+	},
+	60_000,
+);
+
+test("TEST-42 REQ-26 an unreadable company marketplace does not prevent unrelated teammate plugins", () => {
+	const owner = machine();
+	const bad = owner.seed();
+	const good = owner.seed({ name: "safe", slug: "safe/market" });
+	const mate = machine();
+	shareRemote(bad, mate);
+	shareRemote(good, mate);
+	mate.setModes({ denyReadSlug: bad.slug });
+	mate.profile(
+		{ [ID]: "latest", "review-kit@safe": "latest" },
+		{
+			acme: { source: "github", repo: bad.slug },
+			safe: { source: "github", repo: good.slug },
+		},
+	);
+
+	const r = mate.cli(["update", "team"]);
+
+	expect(r.out + r.err).toContain("ask its owner");
+	expect(mate.version("review-kit@safe", "project")).toBe("0.3.1");
+	expect(mate.version(ID, "project")).toBeNull();
+}, 60_000);