magus-cli 7.4.0 → 7.5.0

package/src/services/git-worktree.ts

@@ -65,6 +65,27 @@ export function clearWorktreeCache(): void {
 	cache.clear();
 }
 
+/**
+ * Is `relPath` (relative to `projectPath`) tracked by git? For a directory,
+ * true when any file under it is tracked.
+ *
+ * `git ls-files --error-unmatch` exits 0 only for a tracked path. Not a
+ * repository, git missing, or git not replying all answer false: a project
+ * outside git has nothing tracked to report.
+ */
+export async function isTrackedByGit(
+	projectPath: string,
+	relPath: string,
+): Promise<boolean> {
+	const { code } = await git(projectPath, [
+		"ls-files",
+		"--error-unmatch",
+		"--",
+		relPath,
+	]);
+	return code === 0;
+}
+
 /**
  * Directories whose registry rows this project may inherit, nearest first.
  *

package/src/services/gitignore-service.ts

@@ -3,6 +3,11 @@
  * the Gitignore screen needs in one call, and exposes a small set of
  * action helpers (apply safe fixes, apply one destructive fix, apply a
  * built-in template).
+ *
+ * `.claude/gitignore.json` is read through `settings-file.ts`, the same refusal
+ * every settings file gets: applying a template REWRITES that file, so a copy
+ * we could not parse must never be the one it is rewritten from — see
+ * {@link readProjectManifest}.
  */
 
 import { existsSync } from "node:fs";
@@ -22,6 +27,7 @@ import {
 	applySafeFixes as coreApplySafeFixes,
 } from "./gitignore-fixer.js";
 import { resolveGitignore } from "./gitignore-resolver.js";
+import { readSettingsFile, writableList } from "./settings-file.js";
 
 export interface GitignoreState {
 	resolved: ResolvedManifest;
@@ -97,7 +103,9 @@ export async function applyTemplate(
 	if (!tpl) throw new Error(`Unknown template: ${templateName}`);
 
 	const projectManifestPath = join(cwd, ".claude", "gitignore.json");
-	const existing = await readManifestOrEmpty(projectManifestPath);
+	// Before anything is merged: a manifest we cannot read is refused here, so
+	// the file is never rewritten from a misreading of it.
+	const existing = await readProjectManifest(projectManifestPath);
 
 	const existingIgnore = new Set(existing.ignore);
 	const existingTrack = new Set(existing.track);
@@ -143,25 +151,34 @@ export async function applyTemplate(
 	};
 }
 
-async function readManifestOrEmpty(path: string): Promise<GitignoreManifest> {
-	if (!existsSync(path)) return { ignore: [], track: [] };
-	try {
-		const raw = await readFile(path, "utf8");
-		const parsed = JSON.parse(raw);
-		if (!isManifest(parsed)) return { ignore: [], track: [] };
-		return parsed;
-	} catch {
-		return { ignore: [], track: [] };
-	}
-}
-
-function isManifest(x: unknown): x is GitignoreManifest {
-	if (!x || typeof x !== "object") return false;
-	const m = x as Record<string, unknown>;
-	return (
-		Array.isArray(m.ignore) &&
-		m.ignore.every((p) => typeof p === "string") &&
-		Array.isArray(m.track) &&
-		m.track.every((p) => typeof p === "string")
-	);
+/**
+ * The project manifest, as something safe to merge into and write back.
+ *
+ * Missing or empty is an empty manifest — nothing is lost by starting from one.
+ * A file that EXISTS and cannot be used is a `SettingsParseError` naming it, so
+ * the merge never runs and the file stays byte-for-byte as it was:
+ *
+ *   - it does not parse, or its top level is not a JSON object
+ *     ({@link readSettingsFile});
+ *   - `ignore`, `track` or `extends` is present but is not an array
+ *     ({@link writableList}).
+ *
+ * Reading any of those as "no entries" is what made `t` (apply template)
+ * destructive: a trailing comma left by a hand edit read as an empty manifest,
+ * the template merged into nothing, and the write replaced the user's own rules
+ * with the template's. A dropped `secrets/` line is how a secret reaches a
+ * commit, so this refuses rather than guesses.
+ *
+ * Entries INSIDE those arrays are carried through as they are, not filtered:
+ * the merge only appends, so anything already in the file comes back out of it
+ * unchanged. Dropping an entry we do not recognise would be the same data loss
+ * by a smaller door.
+ */
+async function readProjectManifest(path: string): Promise<GitignoreManifest> {
+	const raw = await readSettingsFile(path);
+	return {
+		ignore: writableList(raw, "ignore", path) ?? [],
+		track: writableList(raw, "track", path) ?? [],
+		extends: writableList(raw, "extends", path),
+	} as GitignoreManifest;
 }

package/src/services/manifest.ts

@@ -311,11 +311,10 @@ export async function updateProfileEntry(
  * Merge `patch` into `profiles.<profile>.settings`, optionally removing the
  * keys named in `unset`.
  *
- * Why this exists: `.claude/settings.json` is a symlink into the active
- * profile's materialized directory, so a live write lands in the right place —
- * but `materializeProfile` REWRITES that file from the manifest on every
- * `magus install`, so the live write alone silently regresses. The manifest
- * is the durable half of every settings write magus makes.
+ * Why this exists: `.claude/settings.json` is rendered from the active
+ * profile's entry, so a setting magus writes belongs in the entry — the next
+ * render reads it from there. The manifest is the durable half of every
+ * settings write magus makes.
  */
 export async function mergeManifestSettings(
 	projectPath: string,

package/src/services/models-manager.ts

@@ -11,15 +11,13 @@
  *
  * The routing is a PROFILE property, committed in `.claude/profiles.json` under
  * `profiles.<name>.models`. `.claude/models.json` is the generated view of it —
- * a symlink into `_profiles/<active>/models.json` when a profile is active, a
- * plain file when the project has no profiles. The hook reads the generated
- * file (it walks up from the session's cwd looking for exactly that name); a
- * teammate gets the routing by pulling profiles.json and running `magus
- * install`.
+ * a real file rendered from the active profile when there is one, a plain
+ * hand-kept file when the project has no profiles. The hook reads the
+ * generated file (it walks up from the session's cwd looking for exactly that
+ * name); a teammate gets the routing by pulling profiles.json.
  *
- * Writing only the generated file would be silently temporary: `magus
- * install` rewrites `_profiles/<name>/` from the manifest, so the routing would
- * disappear on the next install with nothing to explain why.
+ * Writing only the generated file would be silently temporary: every
+ * activation renders it again from the manifest.
  *
  * ## Why the full model id is resolved live
  *
@@ -61,17 +59,17 @@ import {
 	computeModelsStatus,
 	validateModelsConfig,
 } from "./models-core.js";
-import { materializeProfile } from "./profile-materializer.js";
-import { resolveAllProfiles, resolveProfile } from "./resolver.js";
+import { regenerateLiveFiles } from "./profile-activate.js";
+import { activeProfile } from "./profile-live.js";
+import { prepareProfileWrite } from "./profile-state.js";
 import { readSettingsFile, updateSettingsFile } from "./settings-file.js";
-import { activeProfile, syncProfileLink } from "./symlink-manager.js";
 
 /** `<projectPath>/.claude/models.json` — what the hook looks for. */
 export function configPath(projectPath: string): string {
 	return path.join(projectPath, ".claude", "models.json");
 }
 
-/** `<projectPath>/.claude/settings.json` — a symlink when a profile is active. */
+/** `<projectPath>/.claude/settings.json` — rendered from the profile when one is active. */
 function settingsPathFor(projectPath: string): string {
 	return path.join(projectPath, ".claude", "settings.json");
 }
@@ -368,8 +366,9 @@ export interface ApplyModelPresetResult {
  *
  * Validation comes first: an invalid config makes every subagent spawn fail, so
  * it must never reach disk. After that the order of the numbered steps below is
- * load-bearing — the manifest is written before materialization because
- * materialization regenerates `_profiles/<n>/` FROM the manifest, and the hook
+ * load-bearing — Claude Code's edits are absorbed before the manifest is
+ * written, the manifest is written before the live files because they are
+ * rendered FROM it, and the hook
  * is registered last because a hook pointing at a config that failed to write is
  * worse than no hook at all.
  */
@@ -405,10 +404,14 @@ export async function applyModelPreset(
 	if (Object.keys(manifest.profiles).length === 0 && args.ensureManifest) {
 		manifest = (await args.ensureManifest(projectPath)) ?? manifest;
 	}
+	// 2. The gate: anything Claude Code wrote to the live files goes into the
+	// profile first, so the regeneration below replaces nothing unrecorded —
+	// and a live file that does not parse stops everything, unwritten.
+	await prepareProfileWrite(projectPath);
 	const profile = await activeProfile(projectPath);
 
-	// 2. Record BOTH halves in the manifest: the routing, and the settings it
-	// implies. Without the settings half the next `magus install` rewrites
+	// 3. Record BOTH halves in the manifest: the routing, and the settings it
+	// implies. Without the settings half the next activation renders
 	// settings.json from the manifest and silently reverts the main thread's
 	// model — the routing would keep working and the orchestrator would not.
 	const recordedInManifest = await updateProfileEntry(
@@ -420,38 +423,23 @@ export async function applyModelPreset(
 		},
 	);
 
-	// 3. Regenerate the profile dir from the manifest, then point
-	// .claude/models.json at it. Only the models link is touched: repointing all
-	// four here would replace a project's real .mcp.json with a symlink as a side
-	// effect of choosing a model.
+	// 4. The live files. With a profile active, settings.json and models.json
+	// are rendered from the manifest just written. Without one, models.json is
+	// a plain file and settings.json is edited in place.
 	if (recordedInManifest && profile) {
-		// Re-read: `manifest` above predates the write, so resolving from it would
-		// materialize the OLD entry — which, having no `models`, would delete the
-		// file this call exists to create.
-		const written = await readManifest(projectPath);
-		await materializeProfile(
-			profile,
-			await resolveProfile(written, profile, { binResolver: noBins }),
-			projectPath,
-			await unionPluginIds(projectPath),
-		);
-		await syncProfileLink(profile, "models", projectPath);
+		await regenerateLiveFiles(projectPath);
 	} else {
-		// No profile: models.json is a plain committed-alongside file.
 		await fs.outputFile(
 			configPath(projectPath),
 			`${JSON.stringify(config, null, 2)}\n`,
 		);
+		await updateSettingsFile(settingsPath, (settings) => {
+			for (const [key, value] of Object.entries(patch.set)) {
+				settings[key] = value;
+			}
+		});
 	}
 
-	// 4. The live settings file (a symlink into the profile when one is active,
-	// so this lands in the same place materialization just wrote).
-	await updateSettingsFile(settingsPath, (settings) => {
-		for (const [key, value] of Object.entries(patch.set)) {
-			settings[key] = value;
-		}
-	});
-
 	// 5. Without this, nothing routes.
 	const hook = await registerAgentModelHook();
 
@@ -480,6 +468,8 @@ export async function clearModels(projectPath: string): Promise<void> {
 			)
 		: [];
 
+	// The gate first; a live file that does not parse stops everything.
+	await prepareProfileWrite(projectPath);
 	const profile = await activeProfile(projectPath);
 	const removed = await updateProfileEntry(projectPath, profile, (entry) => {
 		// biome-ignore lint/performance/noDelete: absence is the state, not undefined
@@ -493,21 +483,14 @@ export async function clearModels(projectPath: string): Promise<void> {
 		}
 	});
 
+	// With a profile active, rendering from an entry with no `models` REMOVES
+	// .claude/models.json — that is the whole mechanism by which `off` is off.
 	if (removed && profile) {
-		// Re-materializing with no `models` in the closure DELETES
-		// _profiles/<n>/models.json, and the relink then removes the now-dangling
-		// .claude/models.json. That is the whole mechanism by which `off` is off.
-		const manifest = await readManifest(projectPath);
-		await materializeProfile(
-			profile,
-			await resolveProfile(manifest, profile, { binResolver: noBins }),
-			projectPath,
-			await unionPluginIds(projectPath),
-		);
-		await syncProfileLink(profile, "models", projectPath);
+		await regenerateLiveFiles(projectPath);
+		return;
 	}
-	await fs.remove(configPath(projectPath));
 
+	await fs.remove(configPath(projectPath));
 	const settingsPath = settingsPathFor(projectPath);
 	if (await fs.pathExists(settingsPath)) {
 		await updateSettingsFile(settingsPath, (settings) => {
@@ -543,26 +526,6 @@ function unclaimModelSettings(
 	}
 }
 
-/**
- * Materialization needs no binary requirements — it writes settings, mcp,
- * models and skills, and reads none of `closure.bins`. Skipping the resolver's
- * per-plugin `plugin.json` reads keeps `models use` off the marketplace cache
- * entirely.
- */
-const noBins = async () => [];
-
-/**
- * The manifest-wide union of plugin ids, which `materializeProfile` needs to
- * keep writing the explicit `false` entries that make `profile switch`
- * exclusive. Re-materializing without it would silently make switching additive
- * again — a routing change must not have that side effect.
- */
-async function unionPluginIds(projectPath: string): Promise<string[]> {
-	const manifest = await readManifest(projectPath);
-	const union = await resolveAllProfiles(manifest, { binResolver: noBins });
-	return Object.keys(union.plugins);
-}
-
 // ─── Status ───────────────────────────────────────────────────────────────────
 
 /** What `magus models status` and `magus doctor` report. */
@@ -596,7 +559,7 @@ async function readSettingsFileSafely(
 	}
 }
 
-/** Re-apply the config already on disk. Used by `doctor --fix` to clear drift. */
+/** Re-apply the config already on disk. Used by `doctor --fix` to repair settings the config implies. */
 export async function reapplyModels(
 	projectPath: string,
 ): Promise<ApplyModelPresetResult | null> {