magus-cli 7.12.2 → 7.14.0

package/src/services/profile-absorb.ts

@@ -53,9 +53,11 @@ import type {
 	McpServerConfig,
 	ProfileManifest,
 	ProfileManifestEntry,
+	ProfileMarketplaceRef,
 	ProfileSkillRef,
 } from "../types/index.js";
 import { readManifest, writeManifest } from "./manifest.js";
+import { registryLookup } from "./market-registry.js";
 import { validateModelsConfig } from "./models-core.js";
 import {
 	type ActivateOptions,
@@ -92,7 +94,7 @@ import {
 	skillFolder,
 	updateSkillIgnoreLines,
 } from "./profile-skills.js";
-import { resolveExtends, resolveProfile } from "./resolver.js";
+import { EMPTY_LOOKUP, resolveExtends, resolveProfile } from "./resolver.js";
 import { SettingsParseError } from "./settings-file.js";
 import { trackedSkillFolders } from "./tracked-live-files.js";
 
@@ -105,7 +107,8 @@ export type AbsorbChange =
 	| { kind: "settings-changed" }
 	| { kind: "mcp-changed" }
 	| { kind: "models-changed" }
-	| { kind: "skill-released"; skill: string; folder: string };
+	| { kind: "skill-released"; skill: string; folder: string }
+	| { kind: "marketplace-added"; name: string; repo: string };
 
 /** One line per change, naming the profile it went into. */
 export function describeChange(change: AbsorbChange, profile: string): string {
@@ -124,9 +127,47 @@ export function describeChange(change: AbsorbChange, profile: string): string {
 			return `Updated model routing of profile "${profile}"`;
 		case "skill-released":
 			return `Skill "${change.skill}" was edited — it is now a custom skill in .claude/skills/${change.folder}; commit it`;
+		case "marketplace-added":
+			return `Profile "${profile}" records where ${change.name} comes from (${change.repo})`;
 	}
 }
 
+/**
+ * Record in `next.marketplaces` where each enabled plugin's marketplace comes
+ * from, for every marketplace the entry does not name yet and `lookup` knows —
+ * this machine's registrations outside magus's defaults. Mutates `next`; each
+ * added name is pushed to `changes` when given. Without the record a teammate's
+ * `magus install` cannot register the marketplace, and the plugin fails to
+ * install there.
+ */
+function recordMarketplaces(
+	next: ProfileManifestEntry,
+	lookup: ReadonlyMap<string, ProfileMarketplaceRef>,
+	changes?: AbsorbChange[],
+): void {
+	if (lookup.size === 0) return;
+	const declared = { ...(next.marketplaces ?? {}) };
+	const inherited = resolveExtends(next).marketplaces ?? {};
+	let added = false;
+	for (const [id, pin] of Object.entries(next.plugins ?? {})) {
+		if (!isOn(pin)) continue;
+		const at = id.lastIndexOf("@");
+		if (at <= 0) continue;
+		const name = id.slice(at + 1);
+		if (declared[name] || inherited[name]) continue;
+		const ref = lookup.get(name);
+		if (!ref) continue;
+		declared[name] = { ...ref };
+		added = true;
+		changes?.push({
+			kind: "marketplace-added",
+			name,
+			repo: ref.repo ?? ref.path ?? "",
+		});
+	}
+	if (added) next.marketplaces = declared;
+}
+
 // ─── The inverse of rendering ────────────────────────────────────────────────
 
 /** The live config as absorption reads it. */
@@ -188,6 +229,7 @@ export function computeAbsorb(
 	live: LiveView,
 	otherPluginIds: ReadonlySet<string>,
 	derived: ReadonlySet<string> = new Set(),
+	lookup: ReadonlyMap<string, ProfileMarketplaceRef> = EMPTY_LOOKUP,
 ): { entry: ProfileManifestEntry; changes: AbsorbChange[] } {
 	const changes: AbsorbChange[] = [];
 	const next: ProfileManifestEntry = { ...entry };
@@ -240,6 +282,8 @@ export function computeAbsorb(
 		}
 	}
 	setOrDelete(next, "plugins", own);
+	// Where each plugin's marketplace comes from, when only this machine knows.
+	recordMarketplaces(next, lookup, changes);
 
 	// Settings: everything but enabledPlugins and machine-local keys, minus
 	// what `extends` supplies unchanged.
@@ -538,6 +582,20 @@ export function merge3(
 			),
 		),
 	);
+	// Where marketplaces come from, keyed by name: a name either side added is
+	// kept, and the same name with different refs on both sides is a conflict.
+	put(
+		"marketplaces",
+		nonEmpty(
+			merge3Entries(
+				base.marketplaces as Record<string, unknown> | undefined,
+				local.marketplaces as Record<string, unknown> | undefined,
+				remote.marketplaces as Record<string, unknown> | undefined,
+				"marketplaces",
+				conflicts,
+			),
+		),
+	);
 	// The routing config is validated as a unit, so it merges as one value.
 	let models = local.models;
 	if (!jsonEqual(local.models, remote.models)) {
@@ -746,6 +804,12 @@ function mergeAdditively(
 		};
 	}
 	if (everything.models) merged.models = everything.models;
+	// A marketplace `target` does not name is added; one it names keeps its ref.
+	const marketplaces = { ...(target.marketplaces ?? {}) };
+	for (const [name, ref] of Object.entries(everything.marketplaces ?? {})) {
+		if (!(name in marketplaces)) marketplaces[name] = ref;
+	}
+	if (Object.keys(marketplaces).length > 0) merged.marketplaces = marketplaces;
 	return merged;
 }
 
@@ -804,6 +868,15 @@ function diffEntries(
 	if (!jsonEqual(before.models ?? null, after.models ?? null)) {
 		changes.push({ kind: "models-changed" });
 	}
+	const bm = before.marketplaces ?? {};
+	for (const [name, ref] of Object.entries(after.marketplaces ?? {})) {
+		if (jsonEqual(bm[name], ref)) continue;
+		changes.push({
+			kind: "marketplace-added",
+			name,
+			repo: ref.repo ?? ref.path ?? "",
+		});
+	}
 	return changes;
 }
 
@@ -899,6 +972,7 @@ export async function absorbOrphanedProfile(
 		models: live.models,
 	};
 
+	const lookup = await registryLookup();
 	let merged: ProfileManifestEntry;
 	if (base) {
 		const local = computeAbsorb(
@@ -906,12 +980,19 @@ export async function absorbOrphanedProfile(
 			view,
 			union,
 			new Set(renderedBase?.dependencies?.derived ?? []),
+			lookup,
 		).entry;
 		const merge = merge3(base, local, targetEntry);
 		merged = merge.entry;
 		result.conflicts.push(...merge.conflicts);
 	} else {
-		const everything = computeAbsorb({ name: orphan }, view, union).entry;
+		const everything = computeAbsorb(
+			{ name: orphan },
+			view,
+			union,
+			undefined,
+			lookup,
+		).entry;
 		merged = mergeAdditively(targetEntry, everything);
 	}
 	// A plugin the target pins keeps its pin when the edit merely enabled it.
@@ -1053,6 +1134,7 @@ export async function absorbOlderLayout(
 		},
 		await olderRenderIds(projectPath, named, rendered.allPluginIds),
 		new Set(rendered.dependencies?.derived ?? []),
+		await registryLookup(),
 	);
 	const next = absorbed.entry;
 	const changes = diffEntries(entry, next);
@@ -1201,6 +1283,7 @@ export function absorbAdditively(
 	old: LiveView,
 	renderIds: ReadonlySet<string>,
 	derived: ReadonlySet<string> = new Set(),
+	lookup: ReadonlyMap<string, ProfileMarketplaceRef> = EMPTY_LOOKUP,
 ): { entry: ProfileManifestEntry; conflicts: string[]; keptMore: boolean } {
 	const conflicts: string[] = [];
 	const flags = { keptMore: false };
@@ -1234,6 +1317,7 @@ export function absorbAdditively(
 		if (isOn(declared) && enabled[id] === undefined) flags.keptMore = true;
 	}
 	setOrDelete(next, "plugins", own);
+	recordMarketplaces(next, lookup);
 
 	// Settings, recursively; `extends` keys compare against what they resolve to.
 	const { enabledPlugins: _drop, ...oldSettings } = withoutMachineKeys(
@@ -1463,6 +1547,7 @@ export async function reconcileActiveProfile(
 				marker.derived,
 			),
 			new Set(renderedBase.dependencies?.derived ?? []),
+			await registryLookup(),
 		);
 		local = absorbed.entry;
 		result.changes.push(...absorbed.changes);

package/src/services/profile-adopt.ts

@@ -17,6 +17,7 @@ import type {
 	McpServerConfig,
 	ProfileManifest,
 	ProfileManifestEntry,
+	ProfileMarketplaceRef,
 } from "../types/index.js";
 import {
 	getEnabledPlugins,
@@ -24,6 +25,7 @@ import {
 	readSettings,
 } from "./claude-settings.js";
 import { emptyManifest } from "./manifest.js";
+import { registryLookup } from "./market-registry.js";
 import { withDerivedMarketplaces } from "./resolver.js";
 
 /** The profile id used when adopting a project that has no manifest. */
@@ -62,6 +64,12 @@ export interface AdoptInput {
 	name?: string;
 	/** Injectable clock so the output is deterministic in tests. */
 	now?: string;
+	/**
+	 * This machine's registered marketplaces outside magus's defaults
+	 * ({@link registryLookup}), so a plugin from one of them records where its
+	 * marketplace comes from and a teammate can register it.
+	 */
+	lookup?: ReadonlyMap<string, ProfileMarketplaceRef>;
 }
 
 /**
@@ -127,7 +135,7 @@ export function buildAdoptedProfile(input: AdoptInput): ProfileManifestEntry {
 
 	const entry: ProfileManifestEntry = {
 		name: input.name ?? "Default",
-		marketplaces: withDerivedMarketplaces(undefined, plugins),
+		marketplaces: withDerivedMarketplaces(undefined, plugins, input.lookup),
 		plugins,
 		createdAt: input.now ?? new Date().toISOString(),
 	};
@@ -205,6 +213,7 @@ export async function adoptCurrentProject(
 		settings,
 		mcpServers: mcp.mcpServers ?? {},
 		name,
+		lookup: await registryLookup(),
 	});
 
 	// Copy rather than mutate the caller's manifest: this function does not

package/src/services/profiles.ts

@@ -1,8 +1,13 @@
 import os from "node:os";
 import path from "node:path";
 import fs from "fs-extra";
-import type { ProfileEntry, ProfileManifest } from "../types/index.js";
+import type {
+	ProfileEntry,
+	ProfileManifest,
+	ProfileMarketplaceRef,
+} from "../types/index.js";
 import { readProfilesFile, writeJsonMinimal } from "./manifest.js";
+import { registryLookup } from "./market-registry.js";
 import { activeProfile } from "./profile-live.js";
 
 const PROFILES_FILE = "profiles.json";
@@ -111,18 +116,27 @@ export async function listProfiles(
 /**
  * Save (create or overwrite) a profile.
  * Returns the generated profile ID.
+ *
+ * `marketplaces` is written with the entry, and every plugin from a
+ * marketplace it does not name is looked up in this machine's registrations
+ * ({@link registryLookup}): a profile saved at PROJECT scope is committed, and
+ * a teammate's `magus install` can only register a marketplace the profile
+ * says where to find. magus's default marketplaces need no record.
  */
 export async function saveProfile(
 	name: string,
 	plugins: Record<string, boolean>,
 	scope: "user" | "project",
 	projectPath?: string,
+	marketplaces?: Record<string, ProfileMarketplaceRef>,
 ): Promise<string> {
 	const data = await readProfiles(scope, projectPath);
 	const id = generateUniqueId(name, data.profiles);
 	const now = new Date().toISOString();
+	const recorded = await recordedMarketplaces(plugins, marketplaces);
 	data.profiles[id] = {
 		name,
+		...(Object.keys(recorded).length > 0 ? { marketplaces: recorded } : {}),
 		plugins,
 		createdAt: now,
 		updatedAt: now,
@@ -131,6 +145,27 @@ export async function saveProfile(
 	return id;
 }
 
+/**
+ * `given`, plus a ref from this machine's registrations for each plugin's
+ * marketplace that `given` does not name and magus does not know by default.
+ */
+async function recordedMarketplaces(
+	plugins: Record<string, unknown>,
+	given: Record<string, ProfileMarketplaceRef> | undefined,
+): Promise<Record<string, ProfileMarketplaceRef>> {
+	const lookup = await registryLookup();
+	const out: Record<string, ProfileMarketplaceRef> = { ...(given ?? {}) };
+	for (const id of Object.keys(plugins)) {
+		const at = id.lastIndexOf("@");
+		if (at <= 0) continue;
+		const name = id.slice(at + 1);
+		if (out[name]) continue;
+		const ref = lookup.get(name);
+		if (ref) out[name] = { ...ref };
+	}
+	return out;
+}
+
 /**
  * A profile's plugin map as Claude Code's `enabledPlugins` needs it.
  *
@@ -240,9 +275,37 @@ export async function importProfileFromJson(
 		entry.plugins as Record<string, boolean>,
 		targetScope,
 		projectPath,
+		pastedMarketplaces(entry.marketplaces),
 	);
 }
 
+/**
+ * The pasted entry's `marketplaces`, keeping only refs of a shape a profile
+ * can hold: a `github` ref with a repo, or a `directory` ref with a path.
+ */
+function pastedMarketplaces(
+	value: unknown,
+): Record<string, ProfileMarketplaceRef> | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		return undefined;
+	}
+	const out: Record<string, ProfileMarketplaceRef> = {};
+	for (const [name, ref] of Object.entries(value as Record<string, unknown>)) {
+		if (!ref || typeof ref !== "object") continue;
+		const r = ref as Partial<ProfileMarketplaceRef>;
+		if (r.source === "github" && typeof r.repo === "string" && r.repo) {
+			out[name] = { source: "github", repo: r.repo };
+		} else if (
+			r.source === "directory" &&
+			typeof r.path === "string" &&
+			r.path
+		) {
+			out[name] = { source: "directory", path: r.path };
+		}
+	}
+	return out;
+}
+
 // ─── Internal helpers ──────────────────────────────────────────────────────────
 
 function slugify(name: string): string {

package/src/services/resolver.ts

@@ -23,6 +23,7 @@ import type {
 	DependencyReport,
 	ProfileManifest,
 	ProfileManifestEntry,
+	ProfileMarketplaceRef,
 	ResolvedBin,
 	ResolvedClosure,
 	SelectedBin,
@@ -479,13 +480,16 @@ async function resolveBins(
  * never registered. `extends` made this the default failure, because it
  * inherits plugins from a predefined profile and no marketplaces at all.
  *
- * Only marketplaces magus already knows are derived, since a repo is needed
- * to register one. An unknown suffix is left alone for the manifest to declare.
+ * Only marketplaces with a known repo are derived, since a repo is needed to
+ * register one: magus's default marketplaces, and the names `lookup` answers
+ * (this machine's registrations, for a caller writing a profile a teammate
+ * will read). An unknown suffix is left alone for the manifest to declare.
  * An explicit entry always wins: deriving must never override a pin.
  */
 export function withDerivedMarketplaces(
 	declared: ProfileManifestEntry["marketplaces"],
-	plugins: Record<string, string>,
+	plugins: Record<string, unknown>,
+	lookup: ReadonlyMap<string, ProfileMarketplaceRef> = EMPTY_LOOKUP,
 ): NonNullable<ProfileManifestEntry["marketplaces"]> {
 	const out = { ...(declared ?? {}) };
 	for (const id of Object.keys(plugins)) {
@@ -494,12 +498,20 @@ export function withDerivedMarketplaces(
 		const name = id.slice(at + 1);
 		if (out[name]) continue;
 		const known = getMarketplaceByName(name);
-		if (!known?.source.repo) continue;
-		out[name] = { source: "github", repo: known.source.repo };
+		if (known?.source.repo) {
+			out[name] = { source: "github", repo: known.source.repo };
+			continue;
+		}
+		const registered = lookup.get(name);
+		if (registered) out[name] = { ...registered };
 	}
 	return out;
 }
 
+/** No registrations to consult: derive from magus's default marketplaces only. */
+export const EMPTY_LOOKUP: ReadonlyMap<string, ProfileMarketplaceRef> =
+	new Map();
+
 /**
  * The active profile's plugin pins, or null when there is nothing to read.
  *

package/src/services/settings-manager.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { SettingDefinition } from "../data/settings-catalog.js";
 import type { ClaudeSettings } from "../types/index.js";
+import { requireClaudeConfigDir } from "../utils/config-dir.js";
 import {
 	getGlobalSettingsPath,
 	getSettingsPath,
@@ -248,8 +249,7 @@ export async function discoverOutputStyles(
 		{ label: "Default", value: "" },
 	];
 
-	const homeDir = process.env.HOME || process.env.USERPROFILE || "";
-	const cacheDir = path.join(homeDir, ".claude", "plugins", "cache");
+	const cacheDir = path.join(requireClaudeConfigDir(), "plugins", "cache");
 
 	// Collect enabled plugins from both scopes
 	const enabledPlugins = new Set<string>();

package/src/services/skills-manager.ts

@@ -1,4 +1,3 @@
-import os from "node:os";
 import path from "node:path";
 import fs from "fs-extra";
 import {
@@ -11,6 +10,7 @@ import type {
 	SkillInfo,
 	SkillSource,
 } from "../types/index.js";
+import { requireClaudeConfigDir } from "../utils/config-dir.js";
 import {
 	getMarketplaceClonePath,
 	scanMcpServers,
@@ -33,7 +33,7 @@ const treeCache = new Map<string, TreeCacheEntry>();
 // ─── Path helpers ──────────────────────────────────────────────────────────────
 
 export function getUserSkillsDir(): string {
-	return path.join(os.homedir(), ".claude", "skills");
+	return path.join(requireClaudeConfigDir(), "skills");
 }
 
 export function getProjectSkillsDir(projectPath?: string): string {

package/src/services/update-plan.ts

@@ -118,6 +118,12 @@ export type PluginReason =
 	| "marketplace-unread"
 	/** unknown: the catalog fetch failed ("latest" pins only). */
 	| "catalog-unverified"
+	/**
+	 * unknown: its marketplace on this machine is not the one the profile
+	 * names, or could not be compared with it. The Plugins screen's rows only;
+	 * the plan leaves such a plugin out instead.
+	 */
+	| "marketplace-conflict"
 	/** current: listed, but its marketplace publishes no version to compare. */
 	| "no-published-version"
 	/** repair: files changed without a version bump. */
@@ -897,27 +903,37 @@ export function classifyPlugin(
  *                   (`pluginsAnyProfileLists`). One neither pinned nor
  *                   installed is planned only as a deprecated `remove`; see
  *                   {@link onlyOtherProfilesList}.
+ * @param leaveOut   plugins that get no item at all, whichever of the three
+ *                   sources would bring them in. `magus update` passes the
+ *                   plugins of every marketplace registered here from another
+ *                   repository than the profile names: what the catalog says
+ *                   about them describes the other repository, so planning an
+ *                   update, an install or a deprecated removal from it would
+ *                   act on the wrong source.
  */
 export function planPluginUpdates(
 	pinned: Readonly<Record<string, string>>,
 	catalog: ReadonlyMap<string, PluginInfo> | readonly PluginInfo[],
 	requiredBy: RequiredBy = {},
 	listedByProfiles: readonly string[] = [],
+	leaveOut: (pluginId: string) => boolean = () => false,
 ): PluginUpdateItem[] {
 	const index = indexCatalog(catalog);
 	const plugins =
 		catalog instanceof Map
 			? [...catalog.values()]
 			: (catalog as readonly PluginInfo[]);
-	const pins = new Map(Object.entries(pinned));
+	const pins = new Map(
+		Object.entries(pinned).filter(([pluginId]) => !leaveOut(pluginId)),
+	);
 	for (const info of plugins) {
-		if (pins.has(info.id)) continue;
+		if (pins.has(info.id) || leaveOut(info.id)) continue;
 		const pin = pinForRow(info, pinned);
 		if (pin !== null) pins.set(info.id, pin);
 	}
 	const othersOnly = new Set<string>();
 	for (const pluginId of listedByProfiles) {
-		if (pins.has(pluginId)) continue;
+		if (pins.has(pluginId) || leaveOut(pluginId)) continue;
 		othersOnly.add(pluginId);
 		pins.set(pluginId, "latest");
 	}
@@ -982,19 +998,62 @@ export function pinForRow(
  * SAME plan `magus update` runs, not a second classification. Computed once
  * per data/pins change, and the one map feeds the row, the detail panel, the
  * header and the scope picker, so none of them can disagree.
+ *
+ * `leftOut` answers, for a plugin whose marketplace on this machine is not the
+ * one the profile names, why it is left out; null for every other plugin. The
+ * plan leaves those plugins out exactly as `magus update`'s does, and each
+ * one's row gets a `marketplace-conflict` status carrying that answer, which
+ * is no work for any apply.
  */
 export function classifyPluginRows(
 	plugins: readonly PluginInfo[],
 	pins: Readonly<Record<string, string>>,
 	requiredBy: RequiredBy = {},
 	listedByProfiles: readonly string[] = [],
+	leftOut: (pluginId: string) => string | null = () => null,
 ): Map<string, PluginUpdateItem> {
-	return new Map(
-		planPluginUpdates(pins, plugins, requiredBy, listedByProfiles).map((i) => [
-			i.pluginId,
-			i,
-		]),
+	const rows = new Map(
+		planPluginUpdates(
+			pins,
+			plugins,
+			requiredBy,
+			listedByProfiles,
+			(pluginId) => leftOut(pluginId) !== null,
+		).map((i) => [i.pluginId, i]),
 	);
+	for (const info of plugins) {
+		const note = leftOut(info.id);
+		if (note === null) continue;
+		rows.set(info.id, leftOutItem(info, pins[info.id] ?? "latest", note));
+	}
+	return rows;
+}
+
+/**
+ * The status of a row the plan leaves out: no target, no scopes, nothing to
+ * apply. Its marketplace's catalog is the other repository's, so no version it
+ * offers is shown as available.
+ */
+function leftOutItem(
+	info: PluginInfo,
+	pinned: string,
+	note: string,
+): PluginUpdateItem {
+	return {
+		pluginId: info.id,
+		pinned,
+		installed: highestInstalledVersion(info),
+		loaded: info.loadedVersion ?? null,
+		available: null,
+		beforeVersions: Object.fromEntries(installedScopeVersions(info)) as Partial<
+			Record<PluginScope, string>
+		>,
+		target: null,
+		action: "unknown",
+		reason: "marketplace-conflict",
+		scopes: [],
+		note,
+	};
 }
 
 export interface PluginStateCounts {