magus-cli 7.5.0 → 7.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magus-cli",
-  "version": "7.5.0",
+  "version": "7.5.1",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -52,6 +52,7 @@
     "@opentui/react": "^0.1.75",
     "chalk": "^5.3.0",
     "fs-extra": "^11.2.0",
+    "jsonc-parser": "3.3.1",
     "react": "^19.0.0",
     "semver": "^7.6.3"
   },
@@ -64,8 +65,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "magus-cli-darwin-arm64": "7.5.0",
-    "magus-cli-darwin-x64": "7.5.0",
-    "magus-cli-linux-x64": "7.5.0"
+    "magus-cli-darwin-arm64": "7.5.1",
+    "magus-cli-darwin-x64": "7.5.1",
+    "magus-cli-linux-x64": "7.5.1"
   }
 }

package/src/__tests__/profile-absorb.test.ts

@@ -1091,6 +1091,78 @@ describe("the Claude CLI's install bookkeeping is never absorbed", () => {
 	});
 });
 
+describe("`magus update` owns only the plugins it installs", () => {
+	/** What `claude plugin install --scope project` does to the live file. */
+	async function enable(id: string): Promise<void> {
+		await editLive(settingsPath(), (s) => {
+			(s.enabledPlugins as Record<string, boolean>)[id] = true;
+		});
+	}
+	/** `magus update` installs the active profile's closure — team's plugins. */
+	const TEAM_CLOSURE = ["dev@magus", "terminal@magus"];
+
+	test("B5: a plugin the user enables for another profile's id during the run is kept", async () => {
+		await start(baseManifest());
+		const reported: string[] = [];
+
+		await withCliBookkeeping(
+			project,
+			async () => {
+				await enable("terminal@magus"); // the CLI's own record — team already has it
+				await enable("designer@magus"); // the user, in Claude Code, meanwhile
+			},
+			{ installable: TEAM_CLOSURE, report: (line) => reported.push(line) },
+		);
+
+		expect(reported).toEqual(['Added designer@magus to profile "team"']);
+		expect((await entry()).plugins).toEqual({
+			"dev@magus": "2.1.0",
+			"terminal@magus": "latest",
+			"designer@magus": "latest",
+		});
+		expect(
+			(await fs.readJson(settingsPath())).enabledPlugins["designer@magus"],
+		).toBe(true);
+		const marker = await readActiveMarker(project);
+		expect(marker?.cliBookkeeping).toBeUndefined();
+		expect(marker?.cliInstallable).toBeUndefined();
+	});
+
+	test("B5: a run killed part-way uses the same set — recorded in the marker", async () => {
+		await start(baseManifest());
+		const marker = await readActiveMarker(project);
+		if (!marker) throw new Error("no marker");
+		// What withCliBookkeeping writes before the loop; `finally` never ran.
+		await writeActiveMarker(
+			{ ...marker, cliBookkeeping: true, cliInstallable: TEAM_CLOSURE },
+			project,
+		);
+		await enable("designer@magus");
+
+		const result = await reconcileActiveProfile(project);
+
+		expect(result.lines).toEqual(['Added designer@magus to profile "team"']);
+		expect((await entry()).plugins).toHaveProperty("designer@magus", "latest");
+	});
+
+	test("B5 control: a plugin the run DID install for another profile is still discarded", async () => {
+		// `magus install` with no profile installs every profile's plugins, so
+		// designer@magus is in its installable set and its `true` is the CLI's.
+		await start(baseManifest());
+
+		await withCliBookkeeping(project, async () => enable("designer@magus"), {
+			installable: [...TEAM_CLOSURE, "designer@magus"],
+		});
+
+		expect((await entry()).plugins).toEqual(
+			baseManifest().profiles.team?.plugins as never,
+		);
+		expect(
+			(await fs.readJson(settingsPath())).enabledPlugins["designer@magus"],
+		).toBe(false);
+	});
+});
+
 describe("a false left over from an older render is not a disable", () => {
 	test("reviewer S3: a teammate drops a plugin from another profile while an edit is pending", async () => {
 		const manifest: ProfileManifest = {

package/src/__tests__/profile-dependencies.test.ts

@@ -0,0 +1,442 @@
+/**
+ * B6 — a profile enables what its plugins depend on.
+ *
+ * Claude Code will not load a plugin whose dependency is disabled. Every
+ * profile renders the plugins it does not want as `false` so switching is
+ * exclusive — and on magus-src that switched `claudish@magus` off under the
+ * `lean` profile, whose dev@magus depends on it: the loader logged
+ * `Dependency "claudish@magus" is disabled` and dev never loaded.
+ */
+
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import fs from "fs-extra";
+import { reportProfileState } from "../cli/doctor.js";
+import { readManifest, writeManifest } from "../services/manifest.js";
+import {
+	type PluginDependencyReader,
+	setPluginDependencyReader,
+} from "../services/plugin-dependencies.js";
+import {
+	type PluginManifestSources,
+	parsePluginDependencies,
+	readPluginManifest,
+	resolvePluginDependencies,
+} from "../services/plugin-requires.js";
+import { reconcileActiveProfile } from "../services/profile-absorb.js";
+import {
+	activateProfile,
+	activationNotes,
+} from "../services/profile-activate.js";
+import { renderProfile } from "../services/profile-render.js";
+import { resolveAllProfiles, resolveProfile } from "../services/resolver.js";
+import type { ProfileManifest } from "../types/index.js";
+import { NO_DEPENDENCIES } from "./support/preload.js";
+
+/** What dev@magus and multimodel@magus declare in the real marketplace. */
+const DECLARED: Record<string, string[] | null> = {
+	"dev@magus": ["claudish@magus", "mnemex@magus", "multimodel@magus"],
+	"multimodel@magus": ["claudish@magus"],
+};
+
+/** magus-src's shape: `lean` has dev without two of its dependencies. */
+function leanShaped(): ProfileManifest {
+	return {
+		version: 2,
+		profiles: {
+			maintainer: {
+				name: "Maintainer",
+				plugins: {
+					"dev@magus": "latest",
+					"claudish@magus": "latest",
+					"multimodel@magus": "latest",
+					"mnemex@magus": "latest",
+					"terminal@magus": "latest",
+				},
+			},
+			lean: {
+				name: "Lean",
+				plugins: { "dev@magus": "latest", "mnemex@magus": "latest" },
+			},
+		},
+	};
+}
+
+function reader(
+	declared: Record<string, string[] | null>,
+): PluginDependencyReader {
+	return async (id) => (id in declared ? (declared[id] ?? null) : []);
+}
+
+let project: string;
+let log: ReturnType<typeof spyOn>;
+const settingsPath = () => join(project, ".claude", "settings.json");
+const manifestPath = () => join(project, ".claude", "profiles.json");
+const enabled = async () =>
+	(await fs.readJson(settingsPath())).enabledPlugins as Record<string, boolean>;
+const printed = () => log.mock.calls.map((c) => String(c[0])).join("\n");
+
+beforeEach(async () => {
+	project = await mkdtemp(join(tmpdir(), "deps-"));
+	log = spyOn(console, "log").mockImplementation(() => {});
+	setPluginDependencyReader(reader(DECLARED));
+});
+afterEach(async () => {
+	setPluginDependencyReader(NO_DEPENDENCIES);
+	log.mockRestore();
+	await rm(project, { recursive: true, force: true });
+});
+
+async function start(manifest: ProfileManifest, profile: string) {
+	await writeManifest(manifest, project);
+	return activateProfile(manifest, profile, project, { onDisplace: () => {} });
+}
+
+describe("the render enables what the profile's plugins depend on", () => {
+	test("B6: lean enables claudish and multimodel for dev@magus, though maintainer lists them", async () => {
+		await start(leanShaped(), "lean");
+
+		expect(await enabled()).toEqual({
+			"dev@magus": true,
+			"mnemex@magus": true,
+			"claudish@magus": true,
+			"multimodel@magus": true,
+			"terminal@magus": false,
+		});
+	});
+
+	test("B6: dependencies are followed transitively, each in its dependent's marketplace", async () => {
+		// Real plugin.json files, read by the real parser.
+		const plugins = join(project, "plugins");
+		const write = (name: string, dependencies: unknown[]) =>
+			fs.outputJson(join(plugins, name, ".claude-plugin", "plugin.json"), {
+				name,
+				dependencies,
+			});
+		await write("app", [{ name: "lib", version: "^1.0" }]);
+		await write("lib", ["core"]);
+		await write("core", [{ name: "shared", marketplace: "other" }]);
+		setPluginDependencyReader(async (id) => {
+			const manifest = await readPluginManifest(
+				join(plugins, id.slice(0, id.lastIndexOf("@"))),
+			);
+			return manifest === null ? [] : parsePluginDependencies(manifest, id);
+		});
+		const manifest: ProfileManifest = {
+			version: 2,
+			profiles: { only: { name: "Only", plugins: { "app@mkt": "latest" } } },
+		};
+
+		const closure = await resolveProfile(manifest, "only");
+		expect(closure.plugins).toEqual({
+			"app@mkt": "latest",
+			"lib@mkt": "latest",
+			"core@mkt": "latest",
+			"shared@other": "latest",
+		});
+		expect(closure.dependencies?.derived).toEqual([
+			"core@mkt",
+			"lib@mkt",
+			"shared@other",
+		]);
+		await start(manifest, "only");
+		expect(await enabled()).toEqual({
+			"app@mkt": true,
+			"lib@mkt": true,
+			"core@mkt": true,
+			"shared@other": true,
+		});
+	});
+
+	test("B6: a dependency the profile itself turns off stays off, and the note names both plugins", async () => {
+		const manifest = leanShaped();
+		(manifest.profiles.lean?.plugins as Record<string, string | boolean>)[
+			"claudish@magus"
+		] = false;
+
+		const result = await start(manifest, "lean");
+
+		expect((await enabled())["claudish@magus"]).toBe(false);
+		expect((await enabled())["multimodel@magus"]).toBe(true);
+		const notes = activationNotes(result);
+		expect(notes).toContain(
+			'dev@magus will not load: it depends on claudish@magus, which profile "lean" turns off — remove "claudish@magus": false from the profile to let it load',
+		);
+		expect(notes).toContain(
+			'multimodel@magus will not load: it depends on claudish@magus, which profile "lean" turns off — remove "claudish@magus": false from the profile to let it load',
+		);
+		// doctor counts it: the plugin will not load.
+		const { unfixable } = await reportProfileState(project, false);
+		expect(unfixable).toBe(2);
+		expect(printed()).toContain("✗ dev@magus will not load");
+	});
+
+	test("B6: a plugin.json that cannot be read is reported, not guessed, and activation proceeds", async () => {
+		setPluginDependencyReader(reader({ ...DECLARED, "dev@magus": null }));
+
+		const result = await start(leanShaped(), "lean");
+
+		expect((await enabled())["dev@magus"]).toBe(true);
+		expect((await enabled())["claudish@magus"]).toBe(false);
+		expect(activationNotes(result)).toContain(
+			"Could not read the plugin.json of dev@magus on this machine, so nothing it depends on was enabled — run `magus install` to fetch it",
+		);
+		// doctor reports it, and does not count it as a failure.
+		const { unfixable } = await reportProfileState(project, false);
+		expect(unfixable).toBe(0);
+		expect(printed()).toContain(
+			"⚠ Could not read the plugin.json of dev@magus",
+		);
+	});
+
+	test("B6: `magus install` and `magus update` resolve the dependencies as part of the closure", async () => {
+		const lean = await resolveProfile(leanShaped(), "lean");
+		expect(lean.plugins).toEqual({
+			"dev@magus": "latest",
+			"mnemex@magus": "latest",
+			"claudish@magus": "latest",
+			"multimodel@magus": "latest",
+		});
+		const all = await resolveAllProfiles({
+			version: 2,
+			profiles: { lean: leanShaped().profiles.lean as never },
+		});
+		expect(Object.keys(all.plugins).sort()).toEqual([
+			"claudish@magus",
+			"dev@magus",
+			"mnemex@magus",
+			"multimodel@magus",
+		]);
+	});
+});
+
+describe("dependencies are derived, never recorded", () => {
+	test("B6: an edit elsewhere in settings.json records the edit and no dependency", async () => {
+		await start(leanShaped(), "lean");
+		const committed = await fs.readFile(manifestPath(), "utf8");
+		const live = await fs.readJson(settingsPath());
+		live.permissions = { allow: ["Bash(ls)"] };
+		await fs.writeJson(settingsPath(), live);
+
+		const result = await reconcileActiveProfile(project);
+
+		expect(result.lines).toEqual(['Updated settings of profile "lean"']);
+		const lean = (await readManifest(project)).profiles.lean;
+		expect(lean?.plugins).toEqual({
+			"dev@magus": "latest",
+			"mnemex@magus": "latest",
+		});
+		expect(lean?.settings).toEqual({ permissions: { allow: ["Bash(ls)"] } });
+		// The only change to the file is lean's new settings.
+		const after = await fs.readFile(manifestPath(), "utf8");
+		expect(after.split("claudish").length).toBe(
+			committed.split("claudish").length,
+		);
+		expect(after.split("multimodel").length).toBe(
+			committed.split("multimodel").length,
+		);
+	});
+
+	test("review LOW 1: Claude Code disabling a dependency another profile uses is the user's `false`, and it stays", async () => {
+		await start(leanShaped(), "lean");
+		expect((await enabled())["claudish@magus"]).toBe(true);
+		// Claude Code turns claudish off; maintainer uses claudish too.
+		const live = await fs.readJson(settingsPath());
+		live.enabledPlugins["claudish@magus"] = false;
+		await fs.writeJson(settingsPath(), live);
+
+		const result = await reconcileActiveProfile(project);
+
+		expect(result.lines).toContain('Disabled claudish@magus in profile "lean"');
+		expect((await readManifest(project)).profiles.lean?.plugins).toEqual({
+			"dev@magus": "latest",
+			"mnemex@magus": "latest",
+			"claudish@magus": false,
+		});
+		expect((await enabled())["claudish@magus"]).toBe(false);
+		// What will not load is reported from here on.
+		const { dependencies } = await renderProfile(
+			await readManifest(project),
+			"lean",
+		);
+		expect(dependencies?.blocked).toContainEqual({
+			plugin: "dev@magus",
+			dependency: "claudish@magus",
+		});
+		// A later regeneration (a teammate's change to maintainer) keeps it off.
+		const pulled = await readManifest(project);
+		(pulled.profiles.maintainer?.plugins as Record<string, string>)[
+			"designer@magus"
+		] = "latest";
+		await writeManifest(pulled, project);
+		const next = await reconcileActiveProfile(project);
+		expect(next.lines.join("\n")).toContain("regenerated");
+		expect((await enabled())["claudish@magus"]).toBe(false);
+		expect(
+			(await readManifest(project)).profiles.lean?.plugins?.["claudish@magus"],
+		).toBe(false);
+	});
+
+	test("B6: the `false` an older render wrote for a dependency is not taken as a disable", async () => {
+		// What 7.5.0 left: lean rendered with claudish and multimodel `false`,
+		// then an unrelated edit, so the file is absorbed.
+		setPluginDependencyReader(NO_DEPENDENCIES);
+		await start(leanShaped(), "lean");
+		expect((await enabled())["claudish@magus"]).toBe(false);
+		const live = await fs.readJson(settingsPath());
+		live.permissions = { allow: ["Bash(ls)"] };
+		await fs.writeJson(settingsPath(), live);
+		setPluginDependencyReader(reader(DECLARED));
+
+		const result = await reconcileActiveProfile(project);
+
+		expect(result.lines).toContain('Updated settings of profile "lean"');
+		expect((await readManifest(project)).profiles.lean?.plugins).toEqual({
+			"dev@magus": "latest",
+			"mnemex@magus": "latest",
+		});
+		expect((await enabled())["claudish@magus"]).toBe(true);
+		expect((await enabled())["multimodel@magus"]).toBe(true);
+	});
+
+	test("B6: a plugin.json that starts declaring a dependency regenerates the live config", async () => {
+		setPluginDependencyReader(NO_DEPENDENCIES);
+		await start(leanShaped(), "lean");
+		const before = (await renderProfile(leanShaped(), "lean")).definition;
+		setPluginDependencyReader(reader(DECLARED));
+		expect((await renderProfile(leanShaped(), "lean")).definition).not.toBe(
+			before,
+		);
+
+		const result = await reconcileActiveProfile(project);
+
+		expect(result.lines.join("\n")).toContain("regenerated");
+		expect((await enabled())["claudish@magus"]).toBe(true);
+		expect((await readManifest(project)).profiles.lean?.plugins).toEqual({
+			"dev@magus": "latest",
+			"mnemex@magus": "latest",
+		});
+	});
+});
+
+describe("reading dependencies from plugin.json", () => {
+	test("every form Claude Code accepts, resolved in the dependent's marketplace", () => {
+		expect(
+			parsePluginDependencies(
+				{
+					dependencies: [
+						{ name: "claudish", version: "^2.0" },
+						"mnemex",
+						"other@elsewhere",
+						{ name: "x", marketplace: "mp" },
+						{ version: "^1.0" },
+						42,
+					],
+				},
+				"dev@magus",
+			),
+		).toEqual(["claudish@magus", "mnemex@magus", "other@elsewhere", "x@mp"]);
+		expect(parsePluginDependencies({ name: "none" }, "dev@magus")).toEqual([]);
+	});
+
+	test("a plugin.json that does not parse reads as unreadable, not as no dependencies", async () => {
+		const dir = join(project, "broken");
+		await fs.outputFile(join(dir, ".claude-plugin", "plugin.json"), "{ nope");
+		await fs.outputJson(join(dir, "plugin.json"), { dependencies: ["x"] });
+		expect(await readPluginManifest(dir)).toBeNull();
+		expect(await readPluginManifest(join(project, "absent"))).toBeNull();
+	});
+});
+
+describe("the real reader: the installed copy Claude Code loads decides", () => {
+	/**
+	 * Fixture machine state, all under the test's temp dir: a plugins root with
+	 * a registry and an installed app@fixture 1.0.0, and a marketplace clone
+	 * whose app is 2.0.0. The preload's reader is bypassed — this runs
+	 * `resolvePluginDependencies` itself against these directories.
+	 */
+	async function machine(): Promise<{
+		here: string;
+		sources: PluginManifestSources;
+	}> {
+		const here = await fs.realpath(project);
+		const root = join(here, "plugins-root");
+		const installed = join(root, "cache", "fixture", "app", "1.0.0");
+		const clone = join(here, "marketplace-clone");
+		await fs.outputJson(join(installed, ".claude-plugin", "plugin.json"), {
+			name: "app",
+			version: "1.0.0",
+			dependencies: [{ name: "lib", version: "^1.0" }],
+		});
+		// The marketplace's newer app dropped the dependency.
+		await fs.outputJson(join(clone, "app", ".claude-plugin", "plugin.json"), {
+			name: "app",
+			version: "2.0.0",
+		});
+		await fs.outputJson(join(clone, "lib", ".claude-plugin", "plugin.json"), {
+			name: "lib",
+		});
+		await fs.outputJson(join(root, "installed_plugins.json"), {
+			version: 2,
+			plugins: {
+				"app@fixture": [
+					{
+						scope: "project",
+						projectPath: here,
+						installPath: installed,
+						version: "1.0.0",
+						installedAt: "2026-01-01T00:00:00.000Z",
+						lastUpdated: "2026-01-01T00:00:00.000Z",
+					},
+				],
+			},
+		});
+		return {
+			here,
+			sources: {
+				root,
+				clone: async (id) => join(clone, id.slice(0, id.lastIndexOf("@"))),
+			},
+		};
+	}
+
+	test("review LOW 2: a dependency the installed version declares stays enabled when the clone's newer version dropped it", async () => {
+		const { here, sources } = await machine();
+		expect(
+			await resolvePluginDependencies("app@fixture", here, sources),
+		).toEqual(["lib@fixture"]);
+		// Not installed: the clone answers.
+		expect(
+			await resolvePluginDependencies("lib@fixture", here, sources),
+		).toEqual([]);
+
+		setPluginDependencyReader((id, at) =>
+			resolvePluginDependencies(id, at, sources),
+		);
+		const manifest: ProfileManifest = {
+			version: 2,
+			profiles: {
+				only: { name: "Only", plugins: { "app@fixture": "latest" } },
+			},
+		};
+		await writeManifest(manifest, here);
+		await activateProfile(manifest, "only", here, { onDisplace: () => {} });
+
+		expect(await enabled()).toEqual({
+			"app@fixture": true,
+			"lib@fixture": true,
+		});
+	});
+
+	test('review LOW 2: nothing installed and no clone is unreadable, not "no dependencies"', async () => {
+		const { here, sources } = await machine();
+		expect(
+			await resolvePluginDependencies("ghost@fixture", here, {
+				...sources,
+				clone: async () => null,
+			}),
+		).toBeNull();
+	});
+});