magus-cli 7.2.0 → 7.3.1

package/src/cli/update-view.ts

@@ -81,6 +81,7 @@ type ActionKey =
 	| "upgrade"
 	| "repair"
 	| "refresh"
+	| "stale-load"
 	| "unknown";
 
 const ACTIONS: Record<ActionKey, ActionStyle> = {
@@ -93,6 +94,11 @@ const ACTIONS: Record<ActionKey, ActionStyle> = {
 	upgrade: { glyph: "↑", label: "UPGRADE", color: brand.success },
 	repair: { glyph: "⟳", label: "REPAIR", color: brand.info },
 	refresh: { glyph: "⟳", label: "REFRESH", color: brand.info },
+	// The installed version is right and an older one loads, so this session runs
+	// a version nobody installed. Danger, and the word is BROKEN: "STALE" read as
+	// a mild version of `repair`, and this is not that. Six characters, one under
+	// UNKNOWN, so CHIP_WIDTH is unchanged and no other section pays for it.
+	"stale-load": { glyph: "✗", label: "BROKEN", color: brand.danger },
 	// Warning, not danger: "cannot tell" is not a failure, and red UNKNOWN read
 	// as "broken". The summary line and the TUI already use warning for it.
 	unknown: { glyph: "?", label: "UNKNOWN", color: brand.warning },
@@ -249,8 +255,12 @@ function pluginDetail(item: PluginUpdateItem): string {
 	// The note stays on the item. The TUI has no heading to lean on and renders
 	// it as that row's only explanation — this is a rendering decision about a
 	// table that carries the fact twice, not a change to what is known.
+	// `older-version-loads` is excluded for the same reason: its note says
+	// "loads v0.3.0, installed v0.5.0" and the two columns beside it already do.
 	const note =
-		item.note && item.reason !== "not-offered"
+		item.note &&
+		item.reason !== "not-offered" &&
+		item.reason !== "older-version-loads"
 			? `  ${dim(`(${item.note})`)}`
 			: "";
 	switch (item.action) {
@@ -268,6 +278,16 @@ function pluginDetail(item: PluginUpdateItem): string {
 		case "repair":
 		case "unknown":
 			return `${item.installed ?? "—"}${note}`;
+		case "stale-load":
+			// Both versions, in the order the reader needs them: what runs, then
+			// what is installed. This is a report, not a one-line picker row — the
+			// TUI's row deliberately shows neither, because there the verdict and
+			// the key are all that fit. The note says the same thing in words; the
+			// columns are what makes a table of these scannable.
+			return `${fg(
+				groupStyle("Broken").text,
+				item.loaded ?? "?",
+			)} ${dim("≠")} ${item.installed ?? "—"}${note}`;
 		case "current":
 			return `${item.installed ?? "—"}${note}`;
 	}
@@ -347,6 +367,10 @@ function binDetail(item: BinUpdateItem, plan: UpdatePlan): string {
 function pluginGroup(item: PluginUpdateItem): string {
 	if (item.action === "update" || item.action === "repair") return "Update";
 	if (item.action === "install") return "Fix required";
+	// Never "Current". The installed version matching is exactly what makes this
+	// state deceptive, and a row that reads as up to date under a CURRENT
+	// heading is the defect this state was added to end.
+	if (item.action === "stale-load") return "Broken";
 	if (item.action === "unknown") {
 		return item.reason === "not-offered" ? "Deprecated" : "Unverified";
 	}
@@ -354,6 +378,7 @@ function pluginGroup(item: PluginUpdateItem): string {
 }
 
 const GROUP_ORDER = [
+	"Broken",
 	"Update",
 	"Deprecated",
 	"Fix required",
@@ -373,6 +398,11 @@ const GROUP_KIND: Record<string, ReportBadgeKind> = {
 	Update: "update",
 	Deprecated: "deprecated",
 	"Fix required": "fix",
+	// Red earth, borrowed from `deprecated`. The kinds are measured contrast
+	// pairs, not meanings — "Hue, not meaning; the badge says the word", as
+	// theme-mode.ts puts it — so an unmeasured fourth palette would be the only
+	// thing here nobody had checked against both pages.
+	Broken: "deprecated",
 };
 
 interface GroupStyle {

package/src/cli/upgrade.ts

@@ -6,19 +6,49 @@
  * and advancing the tool itself moved here.
  *
  * Detects magus installs across bun + npm global, warns on duplicates
- * (active vs shadowed), then re-installs `magus@latest` with whichever
- * package manager owns the active binary. Resolves with the child's exit code.
+ * (active vs shadowed), then re-installs the npm package (`MAGUS_NPM_PACKAGE`)
+ * at latest with whichever package manager owns the active binary. Resolves
+ * with the child's exit code.
+ *
+ * The npm package is not the command. The binary on disk and `which magus`
+ * stay `magus`; only what is handed to the package manager uses the package
+ * name, because bare `magus` on npm is an unrelated package.
  */
 
 import { spawn } from "node:child_process";
 import { constants } from "node:os";
+import { MAGUS_NPM_PACKAGE } from "../data/npm-package.js";
+import type { Command } from "../utils/command-utils.js";
+
+/** The package managers `magus upgrade` detects and upgrades through. */
+export type SelfUpgradeManager = "bun" | "npm";
+
+/**
+ * The self-upgrade command for a package manager. Pure: no I/O, no PATH probe.
+ */
+export function selfUpgradeCommand(manager: SelfUpgradeManager): Command {
+	return {
+		cmd: manager,
+		args: ["install", "-g", `${MAGUS_NPM_PACKAGE}@latest`],
+	};
+}
+
+/**
+ * The command that removes a duplicate global install, for the hint printed
+ * when magus is installed through both package managers. No leading
+ * indentation — the caller indents.
+ */
+export function duplicateInstallRemoval(manager: SelfUpgradeManager): string {
+	return `${manager} uninstall -g ${MAGUS_NPM_PACKAGE}`;
+}
 
 export async function runUpgradeCommand(): Promise<number> {
 	const { execSync } = await import("node:child_process");
 	const { existsSync } = await import("node:fs");
 
 	// Detect all installations of magus across package managers
-	const installations: Array<{ manager: "bun" | "npm"; path: string }> = [];
+	const installations: Array<{ manager: SelfUpgradeManager; path: string }> =
+		[];
 
 	// Check bun global
 	try {
@@ -60,7 +90,7 @@ export async function runUpgradeCommand(): Promise<number> {
 		}
 		console.log("\nTo fix, keep one and remove the other:");
 		for (const inst of installations) {
-			console.log(`  ${inst.manager} uninstall -g magus`);
+			console.log(`  ${duplicateInstallRemoval(inst.manager)}`);
 		}
 		console.log();
 	}
@@ -76,13 +106,11 @@ export async function runUpgradeCommand(): Promise<number> {
 		// If which fails, default to npm
 	}
 
-	const pkgManager = usesBun ? "bun" : "npm";
-	console.log(`Updating magus using ${pkgManager}...`);
-
-	const installArgs = ["install", "-g", "magus@latest"];
+	const { cmd, args } = selfUpgradeCommand(usesBun ? "bun" : "npm");
+	console.log(`Updating magus using ${cmd}...`);
 
 	return new Promise<number>((resolve) => {
-		const proc = spawn(pkgManager, installArgs, {
+		const proc = spawn(cmd, args, {
 			stdio: "inherit",
 			shell: false, // Avoid shell for security (fixes DEP0190 warning)
 		});

package/src/data/cli-tools.ts

@@ -1,4 +1,5 @@
 import type { BinInstaller } from "../types/index.js";
+import { MAGUS_NPM_PACKAGE } from "./npm-package.js";
 
 /**
  * A CLI tool magus can install, check and update.
@@ -38,7 +39,9 @@ export const cliTools: CliTool[] = [
 		website: "https://github.com/MadAppGang/magus/tree/main/tools/magus",
 		category: "ai-coding",
 		packageManager: "bun",
-		packageName: "magus",
+		// The npm package (`magus-cli`), not the command above: bare `magus` on
+		// npm is an unrelated package.
+		packageName: MAGUS_NPM_PACKAGE,
 	},
 	{
 		name: "mnemex",

package/src/data/npm-package.ts

@@ -0,0 +1,15 @@
+import pkg from "../../package.json";
+
+/**
+ * The npm package magus is published as. It is NOT the command.
+ *
+ * The command users type is `magus` (package.json `bin`). The npm package is
+ * `magus-cli`, because the bare `magus` name on npm belongs to an unrelated
+ * 2015 package, and npm never transfers names. Anything that talks to npm —
+ * the registry check, the self-upgrade, the CLI Tools row — must use this, and
+ * `git grep MAGUS_NPM_PACKAGE` lists every such call site.
+ *
+ * Static import so it resolves inside a `bun build --compile` binary — a
+ * dynamic require("../../package.json") returns nothing usable there.
+ */
+export const MAGUS_NPM_PACKAGE: string = (pkg as { name: string }).name;

package/src/services/active-closure.ts

@@ -115,3 +115,26 @@ export async function loadActiveClosure(
 		return null;
 	}
 }
+
+/**
+ * The active profile's plugin pins — `pluginId -> exact version | "latest"` — and
+ * `{}` when no profile resolves.
+ *
+ * The one shape every surface that judges a plugin needs: `classifyPlugin`'s
+ * `pin`, the Plugins screen's `pins`, and the ceiling `findStaleLoads` caps its
+ * repair target at. Reading it through one helper is what keeps the startup popup
+ * and the Plugins header from capping differently — a pinned plugin read as
+ * BROKEN in one and current in the other is exactly the drift the classifier was
+ * centralised to end.
+ *
+ * `{}` means "latest for everything", which is what `pinForRow` assumes for an
+ * installed plugin no profile declares. `resolveBins: false` because no caller of
+ * this needs a plugin's binary requirements, and the default resolver reads every
+ * declared plugin's `plugin.json` to build them.
+ */
+export async function activePluginPins(
+	projectPath: string,
+): Promise<Readonly<Record<string, string>>> {
+	const active = await loadActiveClosure(projectPath, { resolveBins: false });
+	return active?.closure.plugins ?? {};
+}