magus-cli 7.4.1 → 7.5.1

package/src/cli/update.ts

@@ -48,9 +48,20 @@ import {
 	clearMarketplaceCache,
 	getAvailablePlugins,
 } from "../services/plugin-manager.js";
+import {
+	recordRefetchedSkills,
+	trackFetchedSkills,
+	updatableSkills,
+} from "../services/profile-activate.js";
+import { activeProfile } from "../services/profile-live.js";
+import { skillFolder } from "../services/profile-skills.js";
+import {
+	suggestedProfile,
+	switchHint,
+	withCliBookkeeping,
+} from "../services/profile-state.js";
 import { resolveProfile } from "../services/resolver.js";
 import { getInstalledSkillNames } from "../services/skills-manager.js";
-import { activeProfile } from "../services/symlink-manager.js";
 import { REAL_TOOL_PROBE_IO, probeTools } from "../services/tool-probe.js";
 // The apply half lives in services/ so the TUI runs the SAME code — see the
 // header of update-engine.ts for what drifted while it did not.
@@ -197,7 +208,7 @@ export async function runUpdateCommand(
 	//
 	// BOTH `--check` and `--dry-run` are read-only here. An earlier version let
 	// `--dry-run` activate, reasoning that a preview needs a real profile to
-	// report against — but activating writes symlinks and edits a TRACKED
+	// report against — but activating writes config files and edits a TRACKED
 	// `.gitignore`, and `--dry-run` promises to write nothing and exit 0. A
 	// preview that mutates the repo is not a preview.
 	//
@@ -207,7 +218,7 @@ export async function runUpdateCommand(
 	// preview result rather than an error.
 	//
 	// NAMING A PROFILE SKIPS THE GATE. `magus update lean` says which profile to
-	// update, and updating it needs the manifest, not the symlink — installs go
+	// update, and updating it needs the manifest, not the marker — installs go
 	// to project scope either way. Gating it would refuse a question the user
 	// already answered on the command line, and would break `magus update lean`
 	// and `--check lean` in CI, both of which worked before this gate existed.
@@ -254,7 +265,7 @@ export async function runUpdateCommand(
 	if (!resolvedId) {
 		console.error(
 			failLine(
-				`No active profile. Run \`magus profile switch <${profileIds.join("|")}>\`.`,
+				`No active profile. Run ${switchHint(profileIds, suggestedProfile(current))}.`,
 			),
 		);
 		return 1;
@@ -414,11 +425,18 @@ export async function runUpdateCommand(
 
 	// ---- plan ----------------------------------------------------------------
 
+	// Skills go into the live `.claude/skills/`, so only the ACTIVE profile's,
+	// and never over a custom skill folder.
+	const skillRefs = await updatableSkills(
+		projectPath,
+		targetId,
+		closure.skills,
+	);
 	const plan: UpdatePlan = {
 		profileId: targetId,
 		plugins: planPluginUpdates(closure.plugins, catalog),
 		bins: planBinUpdates(closure.bins, toolFacts),
-		skills: planSkillUpdates(closure.skills, installedSkills),
+		skills: planSkillUpdates(skillRefs, installedSkills),
 		binSpecs: new Map(closure.bins.map((b) => [b.name, b])),
 	};
 
@@ -575,9 +593,31 @@ export async function runUpdateCommand(
 	console.log("");
 	applyLive.start((tick) => applyFrame(state, tick, Date.now()));
 
-	const outcome = await applyPlan(plan, projectPath, { report: reporter });
+	// `claude plugin install --scope project` records each install in the live
+	// settings.json — for a profile that may not be the active one. The marker
+	// is flagged while that runs; in `finally` the re-fetched skill folders are
+	// recorded with their new contents, then the live config is reconciled:
+	// the user's own edits in the meantime are kept, the install's records are
+	// discarded, and an interrupted run leaves the flag for the next command.
+	const reconciledLines: string[] = [];
+	// Only the skills this run actually fetched get new hashes: one it did
+	// not fetch and someone edited meanwhile must still read as edited.
+	const skills = trackFetchedSkills(skillRefs, reporter);
+	const outcome = await withCliBookkeeping(
+		projectPath,
+		() => applyPlan(plan, projectPath, { report: skills.report }),
+		{
+			// Only the active profile's plugins are this run's to install, so
+			// only their records are the CLI's.
+			installable: Object.keys(closure.plugins),
+			beforeReconcile: () =>
+				recordRefetchedSkills(projectPath, skills.fetched()),
+			report: (line) => reconciledLines.push(line),
+		},
+	);
 
 	applyLive.stop();
+	for (const line of reconciledLines) console.log(noteLine(line));
 
 	const { failed } = outcome;
 

package/src/data/gitignore-defaults.ts

@@ -12,9 +12,9 @@ export const BUILTIN_DEFAULTS: GitignoreManifest = {
 		".claude/scheduled_tasks.lock",
 		".claude/cache/",
 		".claude/.statusline-worktree-*",
-		// Generated, per-developer profile build output (like node_modules).
-		".claude/_profiles/",
-		// Generated from profiles.json (a symlink into _profiles/ when a profile
+		// The per-developer active-profile marker.
+		".claude/profiles/",
+		// Generated from profiles.json (rendered from the active profile when one
 		// is active). The routing itself IS committed — in profiles.json, under
 		// the profile that declares it.
 		".claude/models.json",

package/src/services/active-closure.ts

@@ -6,7 +6,7 @@
  * pick the profile in different ways — the CLI inline, the TUI not at all (it
  * judged everything against "latest") — so an exact pin could never agree.
  * Both now choose through {@link selectProfileId} over the same manifest and
- * the same active-profile symlink.
+ * the same active-profile marker.
  *
  * Read-only. Unlike the CLI's `ensureManifest`, nothing here bootstraps a
  * manifest: a screen opening must never author a file a team commits.
@@ -20,14 +20,14 @@ import type {
 	ResolvedClosure,
 } from "../types/index.js";
 import { readManifest, validateManifest } from "./manifest.js";
+import { activeProfile } from "./profile-live.js";
 import { resolveProfile } from "./resolver.js";
-import { activeProfile } from "./symlink-manager.js";
 
 /**
  * The profile to use: the explicit one, else the active one, else the only one.
  *
  * Each candidate counts only if the manifest defines it. A stale active-profile
- * symlink naming a profile that was since removed would otherwise be chosen and
+ * marker naming a profile that was since removed would otherwise be chosen and
  * then fail to resolve, even when the manifest has exactly one profile and the
  * answer is unambiguous.
  */

package/src/services/claude-cli.ts

@@ -10,6 +10,7 @@
  */
 
 import { execFile } from "node:child_process";
+import path from "node:path";
 import { promisify } from "node:util";
 import { defaultMarketplaces } from "../data/marketplaces.js";
 import { which } from "../utils/command-utils.js";
@@ -19,6 +20,7 @@ import {
 	removeLocalInstalledPluginVersion,
 } from "./claude-settings.js";
 import { removeInstalledPluginVersion } from "./plugin-manager.js";
+import { refuseTrackedLiveFiles } from "./tracked-live-files.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -138,6 +140,23 @@ async function execPluginCommand(
 	}
 }
 
+/**
+ * Every `claude plugin … --scope project` command writes the project's
+ * `.claude/settings.json` (its enabledPlugins entry). In a project with
+ * profiles that file is generated; where git tracks it, refuse — before the
+ * CLI runs — rather than let the CLI write it (see `tracked-live-files.ts`).
+ * The CLI works on the current directory.
+ */
+async function refuseProjectSettingsWrite(
+	scope: PluginScope,
+	projectPath: string = process.cwd(),
+): Promise<void> {
+	if (scope !== "project") return;
+	await refuseTrackedLiveFiles(projectPath, [
+		path.join(".claude", "settings.json"),
+	]);
+}
+
 /**
  * Install a plugin using claude CLI
  * Handles enabling + version tracking + cache copy in one shot.
@@ -154,6 +173,7 @@ export async function installPlugin(
 	pluginId: string,
 	scope: PluginScope = "user",
 ): Promise<void> {
+	await refuseProjectSettingsWrite(scope);
 	// 60s, matching update and repair. Before the install/update split this path
 	// ran through `updatePlugin`'s 60s budget; leaving it on the 30s default
 	// would have quietly halved the time a fresh install — the SLOWEST of the
@@ -172,6 +192,7 @@ export async function uninstallPlugin(
 	scope: PluginScope = "user",
 	projectPath?: string,
 ): Promise<void> {
+	await refuseProjectSettingsWrite(scope, projectPath);
 	try {
 		await execClaude(["plugin", "uninstall", pluginId, "--scope", scope]);
 	} catch {
@@ -224,6 +245,7 @@ export async function enablePlugin(
 	pluginId: string,
 	scope: PluginScope = "user",
 ): Promise<void> {
+	await refuseProjectSettingsWrite(scope);
 	await execClaude(["plugin", "enable", pluginId, "--scope", scope]);
 }
 
@@ -234,6 +256,7 @@ export async function disablePlugin(
 	pluginId: string,
 	scope: PluginScope = "user",
 ): Promise<void> {
+	await refuseProjectSettingsWrite(scope);
 	await execClaude(["plugin", "disable", pluginId, "--scope", scope]);
 }
 
@@ -276,6 +299,7 @@ export async function updatePlugin(
 	pluginId: string,
 	scope: PluginScope = "user",
 ): Promise<void> {
+	await refuseProjectSettingsWrite(scope);
 	await execPluginCommand("update", pluginId, scope, 60000);
 }
 

package/src/services/claude-settings.ts

@@ -37,6 +37,7 @@ import {
 	writableList,
 	writableMap,
 } from "./settings-file.js";
+import { refuseTrackedLiveFiles } from "./tracked-live-files.js";
 
 /**
  * What every reader below throws for a file that exists but does not parse.
@@ -148,6 +149,11 @@ export async function writeSettings(
 	settings: ClaudeSettings,
 	projectPath?: string,
 ): Promise<void> {
+	// In a project with profiles this file is generated: never written where
+	// git tracks it (see `tracked-live-files.ts`).
+	await refuseTrackedLiveFiles(projectPath ?? process.cwd(), [
+		getSettingsPath(projectPath),
+	]);
 	await refuseUnwritableFile(getSettingsPath(projectPath));
 	const claudeDir = await ensureClaudeDir(projectPath);
 	const settingsPath = path.join(claudeDir, SETTINGS_FILE);
@@ -191,6 +197,7 @@ export async function writeMcpConfig(
 	projectPath?: string,
 ): Promise<void> {
 	const mcpPath = getMcpConfigPath(projectPath);
+	await refuseTrackedLiveFiles(projectPath ?? process.cwd(), [mcpPath]);
 	await refuseUnwritableFile(mcpPath);
 	await fs.writeJson(mcpPath, config, { spaces: 2 });
 }
@@ -2143,6 +2150,26 @@ export async function repairAllStaleLoads(
 	return out;
 }
 
+/**
+ * The version Claude Code's loader resolves for `pluginId` in `projectPath`:
+ * the first relevant registry row whose installPath exists (`pickLoadedEntry`).
+ * Null when no row resolves, or the registry cannot be read.
+ */
+export async function loadedVersionHere(
+	pluginId: string,
+	projectPath: string,
+	root: string = pluginsDir(),
+): Promise<string | null> {
+	try {
+		const registry = await readInstalledPluginsRegistry(root);
+		const rows = registry.plugins?.[pluginId];
+		if (!Array.isArray(rows) || rows.length === 0) return null;
+		return pickLoadedEntry(rows, projectPath)?.version ?? null;
+	} catch {
+		return null;
+	}
+}
+
 /**
  * What one {@link repairStaleLoad} attempt did, and whether it worked.
  *

package/src/services/conventions-manager.ts

@@ -258,6 +258,94 @@ export async function removeGitignoreEntries(
 	});
 }
 
+/** A `.gitignore` comment that heads a block magus wrote. */
+const MAGUS_BLOCK_HEADER_RE = /^#\s*magus:/;
+
+/**
+ * Edit magus's own block in a `.gitignore`, and nothing else in the file.
+ *
+ * A block is a `# magus: …` comment line and the entry lines under it, up to
+ * the next blank line or comment. Every magus release wrote its profile lines
+ * that way, so that block is the only part of the file magus may take lines
+ * OUT of: the same pattern elsewhere is a person's, and they put it there on
+ * purpose.
+ *
+ * - `add`: entries not already present anywhere in the file are appended to
+ *   the block headed exactly by `header`, which is created at the end of the
+ *   file when there is none.
+ * - `remove`: entries are removed from every `# magus:` block. Lines outside
+ *   the blocks are never touched.
+ *
+ * Under the file lock, written atomically, a no-op when nothing changes.
+ */
+export async function updateManagedGitignoreBlock(
+	gitignorePath: string,
+	header: string,
+	edits: { add?: readonly string[]; remove?: readonly string[] },
+): Promise<{ added: string[]; removed: string[]; modified: boolean }> {
+	const add = (edits.add ?? []).map((e) => e.trim()).filter(Boolean);
+	const remove = new Set(
+		(edits.remove ?? []).map((e) => e.trim()).filter((e) => !add.includes(e)),
+	);
+	if (add.length === 0 && remove.size === 0) {
+		return { added: [], removed: [], modified: false };
+	}
+
+	return withFileLock(gitignorePath, async () => {
+		const content = await readFileOrEmpty(gitignorePath);
+		const lines = content.length > 0 ? content.split("\n") : [];
+		if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+
+		// Pass 1: drop `remove` entries inside magus blocks only.
+		const removed: string[] = [];
+		const kept: string[] = [];
+		let inBlock = false;
+		for (const line of lines) {
+			const trimmed = line.trim();
+			if (MAGUS_BLOCK_HEADER_RE.test(trimmed)) {
+				inBlock = true;
+				kept.push(line);
+				continue;
+			}
+			if (trimmed === "" || trimmed.startsWith("#")) inBlock = false;
+			if (inBlock && remove.has(trimmed)) {
+				removed.push(trimmed);
+				continue;
+			}
+			kept.push(line);
+		}
+
+		// Pass 2: add what the file lacks, at the end of the named block.
+		const present = new Set(
+			kept.map((l) => l.trim()).filter((l) => l && !l.startsWith("#")),
+		);
+		const toAdd = add.filter((e) => !present.has(e));
+		let out = kept;
+		if (toAdd.length > 0) {
+			const at = kept.findIndex((l) => l.trim() === header.trim());
+			if (at === -1) {
+				out = [...kept];
+				if (out.length > 0 && out[out.length - 1]?.trim() !== "") out.push("");
+				out.push(header, ...toAdd);
+			} else {
+				let end = at + 1;
+				while (end < kept.length) {
+					const t = kept[end]?.trim() ?? "";
+					if (t === "" || t.startsWith("#")) break;
+					end++;
+				}
+				out = [...kept.slice(0, end), ...toAdd, ...kept.slice(end)];
+			}
+		}
+
+		if (toAdd.length === 0 && removed.length === 0) {
+			return { added: [], removed: [], modified: false };
+		}
+		await atomicWrite(gitignorePath, `${out.join("\n")}\n`);
+		return { added: toAdd, removed, modified: true };
+	});
+}
+
 /**
  * Check which expected entries are missing from a .gitignore file.
  *

package/src/services/git-worktree.ts

@@ -24,36 +24,67 @@
  */
 
 import { spawn } from "node:child_process";
+import { lstat } from "node:fs/promises";
 import path from "node:path";
 
 function git(
 	cwd: string,
 	args: string[],
-): Promise<{ code: number; out: string }> {
+): Promise<{ code: number; out: string; err: string }> {
 	return new Promise((resolve) => {
 		const child = spawn("git", args, {
 			cwd,
-			stdio: ["ignore", "pipe", "ignore"],
+			stdio: ["ignore", "pipe", "pipe"],
 		});
 		let out = "";
+		let err = "";
 		child.stdout.on("data", (d) => {
 			out += String(d);
 		});
+		child.stderr.on("data", (d) => {
+			err += String(d);
+		});
+		const settle = (code: number, text: string, why: string) => {
+			clearTimeout(timer);
+			resolve({ code, out: text, err: why });
+		};
 		// Never let a wedged git block the UI.
 		const timer = setTimeout(() => {
 			child.kill();
-			resolve({ code: -1, out: "" });
+			settle(-1, "", `git ${args[0]} did not answer within 5 seconds`);
 		}, 5000);
 		timer.unref?.();
-		const settle = (code: number, text: string) => {
-			clearTimeout(timer);
-			resolve({ code, out: text });
-		};
-		child.on("error", () => settle(-1, ""));
-		child.on("close", (code) => settle(code ?? -1, out.trim()));
+		child.on("error", (error) =>
+			settle(-1, "", `could not run git: ${error.message}`),
+		);
+		child.on("close", (code) => settle(code ?? -1, out.trim(), err.trim()));
 	});
 }
 
+/**
+ * git was asked about a work tree and gave no answer: it timed out, is not
+ * installed, or refused the repository. `detail` is git's own message.
+ */
+export class GitQueryError extends Error {
+	constructor(readonly detail: string) {
+		super(detail);
+		this.name = "GitQueryError";
+	}
+}
+
+/** Is `dir`, or a directory above it, a git work tree (holds a `.git`)? */
+async function insideWorkTree(dir: string): Promise<boolean> {
+	for (let at = path.resolve(dir); ; at = path.dirname(at)) {
+		try {
+			await lstat(path.join(at, ".git"));
+			return true;
+		} catch {
+			// Not here; try the parent.
+		}
+		if (path.dirname(at) === at) return false;
+	}
+}
+
 /**
  * Session cache. Keyed by resolved project path — the repository layout cannot
  * change under a running magus in any way worth tracking, and the resolution
@@ -65,6 +96,79 @@ export function clearWorktreeCache(): void {
 	cache.clear();
 }
 
+/**
+ * The paths (relative to `projectPath`) that git tracks. A path in `files` is
+ * tracked when git has exactly that entry — a symlink is an entry too; a path
+ * in `dirs` when git tracks any file under it. Empty outside a work tree.
+ *
+ * Throws {@link GitQueryError} when there IS a `.git` at or above
+ * `projectPath` and git still fails — a timeout, git missing, or git refusing
+ * the repository (`detected dubious ownership`, exit 128). "Nothing is
+ * tracked" is not an answer git gave there, and a caller that believed it
+ * would write a tracked file.
+ *
+ * The distinction matters for `.claude/skills`: as a directory of committed
+ * custom skills it has tracked files under it, which says nothing about
+ * whether the path ITSELF (an older layout's symlink) was committed.
+ */
+export async function trackedByGit(
+	projectPath: string,
+	files: readonly string[],
+	dirs: readonly string[] = [],
+): Promise<Set<string>> {
+	const out = new Set<string>();
+	const relPaths = [...files, ...dirs];
+	if (relPaths.length === 0) return out;
+	// One call for every path: this runs on every magus command that touches
+	// profile state, and a spawn per path adds up. `ls-files` prints each
+	// tracked FILE matching the pathspecs, so a directory shows as its files.
+	const {
+		code,
+		out: listed,
+		err,
+	} = await git(projectPath, ["ls-files", "-z", "--", ...relPaths]);
+	if (code !== 0) {
+		if (!(await insideWorkTree(projectPath))) return out; // Nothing to track.
+		throw new GitQueryError(err || `git ls-files exited with code ${code}`);
+	}
+	const entries = new Set(listed.split("\0").filter(Boolean));
+	const norm = (rel: string) => rel.split(path.sep).join("/");
+	for (const rel of files) {
+		if (entries.has(norm(rel))) out.add(rel);
+	}
+	for (const rel of dirs) {
+		const prefix = `${norm(rel)}/`;
+		for (const entry of entries) {
+			if (entry.startsWith(prefix)) {
+				out.add(rel);
+				break;
+			}
+		}
+	}
+	return out;
+}
+
+/**
+ * Is `relPath` (relative to `projectPath`) tracked by git? For a directory,
+ * true when any file under it is tracked.
+ *
+ * `git ls-files --error-unmatch` exits 0 only for a tracked path. Not a
+ * repository, git missing, or git not replying all answer false: a project
+ * outside git has nothing tracked to report.
+ */
+export async function isTrackedByGit(
+	projectPath: string,
+	relPath: string,
+): Promise<boolean> {
+	const { code } = await git(projectPath, [
+		"ls-files",
+		"--error-unmatch",
+		"--",
+		relPath,
+	]);
+	return code === 0;
+}
+
 /**
  * Directories whose registry rows this project may inherit, nearest first.
  *