magus-cli 7.3.1 → 7.4.1

package/src/services/cli-tool-commands.ts

@@ -37,8 +37,10 @@ import {
  * to follow what is actually on the machine, or it installs a second copy
  * beside the first and the screen then reports a conflict it created itself.
  *
- * `pnpm`, `yarn` and `unknown` have no `BinInstaller` counterpart, which is why
- * the two unions stay separate rather than one being widened into the other.
+ * `pnpm`, `yarn`, `native` and `unknown` have no `BinInstaller` counterpart,
+ * which is why the two unions stay separate rather than one being widened into
+ * the other. `native` is a tool's own installer — today Claude Code's, which
+ * keeps its releases under `~/.local/share/claude/versions/` and updates itself.
  */
 export type InstallMethod =
 	| "npm"
@@ -47,6 +49,7 @@ export type InstallMethod =
 	| "yarn"
 	| "brew"
 	| "pip"
+	| "native"
 	| "unknown";
 
 /**
@@ -75,6 +78,10 @@ export function cliToolInstall(tool: CliTool): Command {
  * the detector could not attribute the binary on PATH to any package manager,
  * and guessing there would install a second copy alongside the one already
  * there. Callers fall back to installing.
+ *
+ * `native` is null too: a tool's own updater is not derivable from the method
+ * name. The probe builds it (`ToolFacts.upgradeCommand`, e.g. `claude update`)
+ * and the row takes it from there, ahead of this function.
  */
 export function cliToolUpdate(
 	tool: CliTool,
@@ -82,12 +89,13 @@ export function cliToolUpdate(
 	brewFormula?: string,
 ): Command | null {
 	switch (method) {
-		// The three the resolver does not model. `pnpm`/`yarn` are not
+		// The ones the resolver does not model. `pnpm`/`yarn` are not
 		// BinInstallers because magus never chooses them — it only finds them.
 		case "pnpm":
 			return { cmd: "pnpm", args: ["install", "-g", tool.packageName] };
 		case "yarn":
 			return { cmd: "yarn", args: ["global", "add", tool.packageName] };
+		case "native":
 		case "unknown":
 			return null;
 		default:
@@ -107,8 +115,9 @@ export function cliToolUpdate(
 /**
  * Remove a tool, following the method it was actually installed with.
  *
- * Null means "no command to offer": `unknown` for the reason above, and `go`
- * because a `go install` binary has no uninstaller to call.
+ * Null means "no command to offer": `unknown` for the reason above, `native`
+ * because a self-installed tool ships no uninstall command, and `go` because a
+ * `go install` binary has no uninstaller to call.
  */
 export function cliToolUninstall(
 	tool: CliTool,
@@ -120,6 +129,7 @@ export function cliToolUninstall(
 			return { cmd: "pnpm", args: ["remove", "-g", tool.packageName] };
 		case "yarn":
 			return { cmd: "yarn", args: ["global", "remove", tool.packageName] };
+		case "native":
 		case "unknown":
 			return null;
 		default:
@@ -131,3 +141,33 @@ export function cliToolUninstall(
 			});
 	}
 }
+
+/**
+ * Why magus cannot remove an install made this way — or null when it can.
+ *
+ * Derived from {@link cliToolUninstall}, never from a second list of methods:
+ * "is there a command" and "why is there no command" have to answer about the
+ * same thing, or the conflict fix offers a removal it then skips. That is the
+ * defect this exists for — the fix used to list every install as removable,
+ * `continue` past the ones with no command, and report success.
+ *
+ * The text is a clause, to be read after "the <method> install stays:".
+ */
+export function uninstallBlocker(
+	tool: CliTool,
+	method: InstallMethod,
+	brewFormula?: string,
+): string | null {
+	if (cliToolUninstall(tool, method, brewFormula) !== null) return null;
+	switch (method) {
+		case "native":
+			// Claude Code's native installer. It updates itself and ships no
+			// uninstall command; inventing one would mean deleting another
+			// program's files by hand.
+			return "its own installer ships no uninstall command";
+		case "unknown":
+			return "magus could not tell which installer put it there";
+		default:
+			return `magus has no uninstall command for a ${method} install`;
+	}
+}

package/src/services/cli-tool-version.ts

@@ -0,0 +1,101 @@
+import { readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+/**
+ * The version of the npm/bun package a binary on PATH belongs to.
+ *
+ * A global install leaves `<prefix>/bin/<tool>` as a symlink into
+ * `<prefix>/lib/node_modules/<package>/…` (npm) or
+ * `~/.bun/install/global/node_modules/<package>/…` (bun). The package's own
+ * `package.json` is therefore the authority on what is installed, and reading
+ * it needs neither an installer record nor running the tool.
+ *
+ * The walk starts from the binary's REAL location — the symlink is resolved
+ * first, chain and all — because the directory the symlink sits in can belong
+ * to some unrelated project whose `package.json` would answer wrongly. The
+ * nearest `package.json` carrying both `name` and `version` wins; the partial
+ * ones a build leaves in `dist/` (`{"type":"module"}`) are skipped.
+ *
+ * Never throws: a missing binary, a dangling link, an unreadable or unparseable
+ * manifest, and "no package at all" are all `null`.
+ */
+export function readPackageVersionForBin(binPath: string): string | null {
+	let real: string;
+	try {
+		real = realpathSync(binPath);
+	} catch {
+		return null;
+	}
+
+	let dir = path.dirname(real);
+	for (;;) {
+		const version = qualifyingVersion(path.join(dir, "package.json"));
+		if (version !== undefined) return version;
+		const parent = path.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+
+/** A bare release number, as a versioned install directory names its files. */
+const RELEASE = /^v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+
+/**
+ * The version a VERSIONED INSTALL names its binary by, or `null`.
+ *
+ * Some installers keep every release side by side and point PATH at one:
+ * Claude Code's native installer links `~/.local/bin/claude` to
+ * `~/.local/share/claude/versions/2.1.276`. There is no package.json there to
+ * read, but the file's own name IS the version — accepted only when the real
+ * path's parent directory is literally `versions` and the name is a bare
+ * release number, so an ordinary binary called `1.0.0` is not misread.
+ *
+ * Reads no file and runs nothing; never throws.
+ */
+export function readVersionDirForBin(binPath: string): string | null {
+	let real: string;
+	try {
+		real = realpathSync(binPath);
+	} catch {
+		return null;
+	}
+	return versionFromVersionedPath(real);
+}
+
+/**
+ * The same reading as {@link readVersionDirForBin}, from a path that is ALREADY
+ * real — pure string work, no filesystem. The probe resolves paths through its
+ * own IO seam and must not reach past it to the real disk.
+ */
+export function versionFromVersionedPath(realPath: string): string | null {
+	const name = path.basename(realPath);
+	if (path.basename(path.dirname(realPath)) !== "versions") return null;
+	return RELEASE.test(name) ? name.replace(/^v/, "") : null;
+}
+
+/**
+ * The manifest's version when it names both a package and a version.
+ *
+ * `undefined` means "not a package root, keep walking"; `null` means "this is
+ * the package root, and it cannot be read" — the walk stops there rather than
+ * letting an enclosing workspace answer for a package it does not own.
+ */
+function qualifyingVersion(file: string): string | null | undefined {
+	let text: string;
+	try {
+		text = readFileSync(file, "utf8");
+	} catch {
+		return undefined;
+	}
+	let manifest: unknown;
+	try {
+		manifest = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (manifest === null || typeof manifest !== "object") return undefined;
+	const { name, version } = manifest as Record<string, unknown>;
+	if (typeof name !== "string" || name === "") return undefined;
+	if (typeof version !== "string" || version === "") return undefined;
+	return version;
+}

package/src/services/gitignore-service.ts

@@ -3,6 +3,11 @@
  * the Gitignore screen needs in one call, and exposes a small set of
  * action helpers (apply safe fixes, apply one destructive fix, apply a
  * built-in template).
+ *
+ * `.claude/gitignore.json` is read through `settings-file.ts`, the same refusal
+ * every settings file gets: applying a template REWRITES that file, so a copy
+ * we could not parse must never be the one it is rewritten from — see
+ * {@link readProjectManifest}.
  */
 
 import { existsSync } from "node:fs";
@@ -22,6 +27,7 @@ import {
 	applySafeFixes as coreApplySafeFixes,
 } from "./gitignore-fixer.js";
 import { resolveGitignore } from "./gitignore-resolver.js";
+import { readSettingsFile, writableList } from "./settings-file.js";
 
 export interface GitignoreState {
 	resolved: ResolvedManifest;
@@ -97,7 +103,9 @@ export async function applyTemplate(
 	if (!tpl) throw new Error(`Unknown template: ${templateName}`);
 
 	const projectManifestPath = join(cwd, ".claude", "gitignore.json");
-	const existing = await readManifestOrEmpty(projectManifestPath);
+	// Before anything is merged: a manifest we cannot read is refused here, so
+	// the file is never rewritten from a misreading of it.
+	const existing = await readProjectManifest(projectManifestPath);
 
 	const existingIgnore = new Set(existing.ignore);
 	const existingTrack = new Set(existing.track);
@@ -143,25 +151,34 @@ export async function applyTemplate(
 	};
 }
 
-async function readManifestOrEmpty(path: string): Promise<GitignoreManifest> {
-	if (!existsSync(path)) return { ignore: [], track: [] };
-	try {
-		const raw = await readFile(path, "utf8");
-		const parsed = JSON.parse(raw);
-		if (!isManifest(parsed)) return { ignore: [], track: [] };
-		return parsed;
-	} catch {
-		return { ignore: [], track: [] };
-	}
-}
-
-function isManifest(x: unknown): x is GitignoreManifest {
-	if (!x || typeof x !== "object") return false;
-	const m = x as Record<string, unknown>;
-	return (
-		Array.isArray(m.ignore) &&
-		m.ignore.every((p) => typeof p === "string") &&
-		Array.isArray(m.track) &&
-		m.track.every((p) => typeof p === "string")
-	);
+/**
+ * The project manifest, as something safe to merge into and write back.
+ *
+ * Missing or empty is an empty manifest — nothing is lost by starting from one.
+ * A file that EXISTS and cannot be used is a `SettingsParseError` naming it, so
+ * the merge never runs and the file stays byte-for-byte as it was:
+ *
+ *   - it does not parse, or its top level is not a JSON object
+ *     ({@link readSettingsFile});
+ *   - `ignore`, `track` or `extends` is present but is not an array
+ *     ({@link writableList}).
+ *
+ * Reading any of those as "no entries" is what made `t` (apply template)
+ * destructive: a trailing comma left by a hand edit read as an empty manifest,
+ * the template merged into nothing, and the write replaced the user's own rules
+ * with the template's. A dropped `secrets/` line is how a secret reaches a
+ * commit, so this refuses rather than guesses.
+ *
+ * Entries INSIDE those arrays are carried through as they are, not filtered:
+ * the merge only appends, so anything already in the file comes back out of it
+ * unchanged. Dropping an entry we do not recognise would be the same data loss
+ * by a smaller door.
+ */
+async function readProjectManifest(path: string): Promise<GitignoreManifest> {
+	const raw = await readSettingsFile(path);
+	return {
+		ignore: writableList(raw, "ignore", path) ?? [],
+		track: writableList(raw, "track", path) ?? [],
+		extends: writableList(raw, "extends", path),
+	} as GitignoreManifest;
 }

package/src/services/hook-registration.ts

@@ -18,16 +18,21 @@
  *     absolute path recorded today is a dead path after the next upgrade, and
  *     the failure is invisible (a hook that cannot start is a hook that
  *     silently does not route).
- *  3. **User scope, through `updateSettingsFile`.** NOT
- *     `readGlobalSettings`/`writeGlobalSettings`: those swallow a parse error
- *     and return `{}`, so a settings file a human is mid-edit in would be
- *     overwritten with one hook and nothing else. `updateSettingsFile` refuses
- *     a file it cannot parse.
+ *  3. **User scope, through `updateSettingsFile`.** It refuses a file it
+ *     cannot parse, so a settings file a human is mid-edit in is never
+ *     overwritten with one hook and nothing else. The path is the resolved
+ *     Claude config dir (`CLAUDE_CONFIG_DIR`), which
+ *     `readGlobalSettings`/`writeGlobalSettings` (always `~/.claude`) ignore.
  */
 
 import path from "node:path";
 import { claudeConfigDirOrNull } from "../utils/config-dir.js";
-import { readSettingsFile, updateSettingsFile } from "./settings-file.js";
+import {
+	readSettingsFile,
+	updateSettingsFile,
+	writableList,
+	writableMap,
+} from "./settings-file.js";
 
 /** The command Claude Code runs. Bare — see rule 2 above. */
 export const AGENT_MODEL_HOOK_COMMAND = "magus hook agent-model";
@@ -196,6 +201,18 @@ export async function registerAgentModelHook(
 	if (isHookRegistered(await readSettingsFile(settingsPath))) return "already";
 
 	await updateSettingsFile(settingsPath, (settings) => {
+		// The user's own hooks live in `hooks.PreToolUse`. A malformed one is
+		// refused here, never replaced: `ensureHookRegistered` alone swaps a
+		// non-object `hooks` or a non-array `PreToolUse` for an empty one, and this
+		// write would then drop everything that was in it.
+		const hooks = writableMap(settings, "hooks", settingsPath);
+		if (hooks) {
+			writableList(
+				hooks as Record<string, unknown>,
+				"PreToolUse",
+				settingsPath,
+			);
+		}
 		return ensureHookRegistered(settings).settings;
 	});
 	return "registered";

package/src/services/manifest.ts

@@ -11,13 +11,23 @@ import path from "node:path";
 import fs from "fs-extra";
 import type { ProfileManifest, ProfileManifestEntry } from "../types/index.js";
 import { validateModelsConfig } from "./models-core.js";
+import {
+	SettingsShapeError,
+	describeJsonKind,
+	isJsonObject,
+	readSettingsFile,
+} from "./settings-file.js";
 
-const PROFILES_FILE = "profiles.json";
+/**
+ * The manifest's path relative to the project root, for messages that name the
+ * file without an absolute path — which wraps, and a wrapped path reads as two.
+ */
+export const MANIFEST_FILE = path.join(".claude", "profiles.json");
 
 /** Project-scoped manifest path: <projectPath|cwd>/.claude/profiles.json */
 export function getManifestPath(projectPath?: string): string {
 	const base = projectPath ?? process.cwd();
-	return path.join(base, ".claude", PROFILES_FILE);
+	return path.join(base, MANIFEST_FILE);
 }
 
 /** An empty, valid v2 manifest. */
@@ -26,65 +36,132 @@ export function emptyManifest(): ProfileManifest {
 }
 
 /**
- * Normalize any parsed profiles.json (v1 or v2) into a v2 manifest.
- * Unknown/missing shapes degrade to an empty manifest rather than throwing —
- * validation is the caller's job via {@link validateManifest}.
+ * A profiles file's contents once its shape has been checked: a JSON object
+ * whose `profiles` maps each id to an object. Only {@link readProfilesFile}
+ * produces one, so holding one means the check ran.
+ */
+export type ProfilesFile = Record<string, unknown> & {
+	profiles: Record<string, Record<string, unknown>>;
+};
+
+const NOT_A_PROFILES_FILE = "is not a valid profiles file";
+
+/**
+ * Read a profiles file — the project's `.claude/profiles.json` or the user's
+ * `~/.claude/profiles.json` — and check its shape.
+ *
+ * THE one shape check. `readManifest`, `readProfiles` and both writers all come
+ * through here, so the two views of the same file cannot disagree about
+ * whether it holds profiles. They used to: for `"profiles": 5` one read "none"
+ * and the other passed the 5 through.
+ *
+ * Missing, empty, `{}` and `{"version": 2}` read as no profiles. Everything
+ * else that is not a map of profile objects THROWS `SettingsShapeError` naming
+ * the file (a `SettingsParseError`, so every existing catch reports it):
+ *
+ *   - `profiles` present but not an object (`5`, `[]`, `null`);
+ *   - any entry under `profiles` that is not an object;
+ *   - `profiles` absent while the file holds any key besides `version`.
+ *
+ * The last is the one that bites. `{"version": 2, "profile": {…}}` — one
+ * letter off — read as "no profiles", which is the state in which magus offers
+ * to save what is turned on as the first profile, and saving writes this file.
+ * The real profile would have been replaced by a generated one.
  */
-export function migrateToV2(raw: unknown): ProfileManifest {
-	if (!raw || typeof raw !== "object") return emptyManifest();
-	const obj = raw as Record<string, unknown>;
+export async function readProfilesFile(
+	filePath: string,
+): Promise<ProfilesFile> {
+	const raw = await readSettingsFile(filePath);
+	const refuse = (detail: string): never => {
+		throw new SettingsShapeError(filePath, NOT_A_PROFILES_FILE, detail);
+	};
 
-	const profilesRaw =
-		obj.profiles && typeof obj.profiles === "object"
-			? (obj.profiles as Record<string, unknown>)
-			: {};
+	if (!("profiles" in raw)) {
+		const others = Object.keys(raw).filter((key) => key !== "version");
+		if (others.length > 0) {
+			refuse(
+				`it has no "profiles" key, but has ${others.map((key) => `"${key}"`).join(", ")}`,
+			);
+		}
+		return { ...raw, profiles: {} };
+	}
 
-	const profiles: Record<string, ProfileManifestEntry> = {};
-	for (const [id, entry] of Object.entries(profilesRaw)) {
-		if (entry && typeof entry === "object") {
-			// v1 and v2 entries are both accepted as-is; v1's plugins map
-			// (Record<string, boolean>) is valid under v2's widened type.
-			profiles[id] = entry as ProfileManifestEntry;
+	const { profiles } = raw;
+	if (!isJsonObject(profiles)) {
+		return refuse(`"profiles" is ${describeJsonKind(profiles)}, not an object`);
+	}
+	for (const [id, entry] of Object.entries(profiles)) {
+		if (!isJsonObject(entry)) {
+			refuse(`profile "${id}" is ${describeJsonKind(entry)}, not an object`);
 		}
 	}
+	return raw as ProfilesFile;
+}
 
-	const manifest: ProfileManifest = { version: 2, profiles };
+/**
+ * Normalize a checked profiles file (v1 or v2) into a v2 manifest.
+ *
+ * Takes a {@link ProfilesFile}, never raw JSON: deciding that a wrong shape is
+ * "empty" is how a damaged file got overwritten, so there is no garbage branch
+ * here to decide it. The shape check refuses first.
+ */
+export function migrateToV2(file: ProfilesFile): ProfileManifest {
+	// v1 and v2 entries are both accepted as-is; v1's plugins map
+	// (Record<string, boolean>) is valid under v2's widened type. What an entry
+	// holds is `validateManifest`'s to report, not this function's to drop.
+	const manifest: ProfileManifest = {
+		version: 2,
+		profiles: file.profiles as unknown as Record<string, ProfileManifestEntry>,
+	};
 	// Only carry strictVersions when enabled, so a committed manifest that
 	// doesn't opt in stays minimal (no spurious `"strictVersions": false`).
-	if (obj.strictVersions === true) manifest.strictVersions = true;
+	if (file.strictVersions === true) manifest.strictVersions = true;
 	// Carried through even when it names no existing profile: dropping it here
 	// would silently "fix" a typo that `validateManifest` is meant to report,
 	// and the commands that read it all check the id resolves first.
-	if (typeof obj.default === "string" && obj.default !== "") {
-		manifest.default = obj.default;
+	if (typeof file.default === "string" && file.default !== "") {
+		manifest.default = file.default;
 	}
 	return manifest;
 }
 
 /**
- * Read and migrate the project manifest. Returns an empty v2 manifest if the
- * file is absent or unreadable.
+ * Read and migrate the project manifest.
+ *
+ * A missing (or empty) file is an empty v2 manifest: a repo with no profiles.
+ * A file that exists and does not parse, or has the wrong shape, THROWS
+ * `SettingsParseError` carrying its path — see {@link readProfilesFile}.
+ *
+ * It used to answer an empty manifest for both, and "no profiles" is not a
+ * harmless answer here. It is exactly the state in which magus offers to save
+ * what is turned on as a first profile, and saving WRITES this file — so a
+ * manifest someone was mid-edit in came back as one generated profile and
+ * nothing else. Throwing stops every caller before its write.
  */
 export async function readManifest(
 	projectPath?: string,
 ): Promise<ProfileManifest> {
-	const filePath = getManifestPath(projectPath);
-	try {
-		if (await fs.pathExists(filePath)) {
-			return migrateToV2(await fs.readJson(filePath));
-		}
-	} catch {
-		// Corrupt/unreadable — fall through to empty.
-	}
-	return emptyManifest();
+	return migrateToV2(await readProfilesFile(getManifestPath(projectPath)));
 }
 
-/** Write the manifest back to disk (used by `profile sync`, tests). */
+/**
+ * Write the manifest to disk.
+ *
+ * Refuses with `SettingsParseError`, leaving the file untouched, whenever the
+ * file already there would be refused by {@link readManifest} — unparseable or
+ * the wrong shape. Every caller read the manifest first, but not necessarily
+ * just before: the TUI's startup gate reads it at launch and writes when the
+ * user answers, which can be minutes later — long enough for someone to be
+ * mid-edit. Checking here makes the refusal hold for every writer, not only
+ * for the ones that happened to re-read.
+ */
 export async function writeManifest(
 	manifest: ProfileManifest,
 	projectPath?: string,
 ): Promise<void> {
 	const filePath = getManifestPath(projectPath);
+	// Read for the throw alone; the contents are about to be replaced.
+	await readProfilesFile(filePath);
 	await fs.ensureDir(path.dirname(filePath));
 	await fs.writeJson(filePath, manifest, { spaces: 2 });
 }
@@ -207,10 +284,10 @@ export function validateManifest(
  * manifest file, or no entry for that profile) — all three are normal states,
  * and `mutate` is not called.
  *
- * THROWS when the manifest exists and cannot be read as JSON. `readManifest`
- * degrades a corrupt file to an empty manifest, which here would mean silently
- * recording nothing and reporting success — the caller has just written a live
- * setting the next `magus install` will revert, and would never learn.
+ * THROWS `SettingsParseError` when the manifest exists and does not parse.
+ * Treating that as "no entry" would mean silently recording nothing and
+ * reporting success — the caller has just written a live setting the next
+ * `magus install` will revert, and would never learn.
  */
 export async function updateProfileEntry(
 	projectPath: string,
@@ -218,21 +295,9 @@ export async function updateProfileEntry(
 	mutate: (entry: ProfileManifestEntry) => void,
 ): Promise<boolean> {
 	if (!profile) return false;
-	const filePath = getManifestPath(projectPath);
-	if (!(await fs.pathExists(filePath))) return false;
-
-	// Read directly rather than through readManifest: its `catch` is exactly
-	// what turns a corrupt file into a silent no-op.
-	let raw: unknown;
-	try {
-		raw = await fs.readJson(filePath);
-	} catch (error) {
-		throw new Error(
-			`${filePath} is not valid JSON, refusing to write to it: ${String(error)}`,
-		);
-	}
+	if (!(await fs.pathExists(getManifestPath(projectPath)))) return false;
 
-	const manifest = migrateToV2(raw);
+	const manifest = await readManifest(projectPath);
 	const entry = manifest.profiles[profile];
 	if (!entry) return false;
 

package/src/services/plugin-manager.ts

@@ -16,6 +16,7 @@ import {
 	getLocalEnabledPlugins,
 	getLocalInstalledPluginVersions,
 	getProjectInstalledPluginVersions,
+	getSettingsPath,
 	pickRegistryEntry,
 	readInstalledPluginsRegistry,
 	readSettings,
@@ -46,6 +47,7 @@ import {
 	resolveMarketplacePlugins,
 } from "./marketplace-fetcher.js";
 import { resolveLoadedVersions } from "./plugin-resolution.js";
+import { writableMap } from "./settings-file.js";
 export {
 	fetchMarketplacePlugins,
 	getMarketplaceFetchFailures,
@@ -733,7 +735,12 @@ export async function saveInstalledPluginVersion(
 	projectPath?: string,
 ): Promise<void> {
 	const settings = await readSettings(projectPath);
-	settings.installedPluginVersions = settings.installedPluginVersions || {};
+	settings.installedPluginVersions =
+		writableMap(
+			settings,
+			"installedPluginVersions",
+			getSettingsPath(projectPath),
+		) ?? {};
 	settings.installedPluginVersions[pluginId] = version;
 	await writeSettings(settings, projectPath);
 
@@ -799,11 +806,18 @@ export async function removeInstalledPluginVersion(
 	projectPath?: string,
 ): Promise<void> {
 	const settings = await readSettings(projectPath);
-	if (settings.installedPluginVersions) {
-		delete settings.installedPluginVersions[pluginId];
+	const settingsPath = getSettingsPath(projectPath);
+	const versions = writableMap(
+		settings,
+		"installedPluginVersions",
+		settingsPath,
+	);
+	const enabled = writableMap(settings, "enabledPlugins", settingsPath);
+	if (versions) {
+		delete versions[pluginId];
 	}
-	if (settings.enabledPlugins) {
-		delete settings.enabledPlugins[pluginId];
+	if (enabled) {
+		delete enabled[pluginId];
 	}
 	await writeSettings(settings, projectPath);
 

package/src/services/profile-adopt.ts

@@ -165,11 +165,16 @@ export type AdoptSource = "project" | "user";
 export async function collectEnabledPlugins(
 	projectPath: string,
 ): Promise<{ plugins: Record<string, boolean>; source: AdoptSource }> {
-	const project = await getEnabledPlugins(projectPath).catch(() => ({}));
+	// No catch on either read. A project settings file that does not parse is
+	// not "no project plugins": falling through to user scope there would adopt
+	// one developer's global set as the team's contract, the exact thing the
+	// project-first order exists to prevent. The SettingsParseError names the
+	// file, and adoption stops.
+	const project = await getEnabledPlugins(projectPath);
 	if (Object.values(project).some(Boolean)) {
 		return { plugins: project, source: "project" };
 	}
-	const user = await getGlobalEnabledPlugins().catch(() => ({}));
+	const user = await getGlobalEnabledPlugins();
 	return { plugins: user, source: "user" };
 }