magus-cli 7.5.0 → 7.5.1

package/src/__tests__/profile-state.test.ts

@@ -9,14 +9,23 @@ import { lstat, mkdtemp, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import fs from "fs-extra";
-import { profileGate } from "../cli/bootstrap.js";
+import { ensureManifest, profileGate } from "../cli/bootstrap.js";
 import { reportProfileState, runDoctorCommand } from "../cli/doctor.js";
 import { runModelsCommand } from "../cli/models.js";
+import { route } from "../cli/router.js";
+import { installPlugin, uninstallPlugin } from "../services/claude-cli.js";
+import {
+	readSettings,
+	writeMcpConfig,
+	writeSettings,
+} from "../services/claude-settings.js";
+import { trackedByGit } from "../services/git-worktree.js";
 import { readManifest, writeManifest } from "../services/manifest.js";
 import type { ModelsConfig } from "../services/models-core.js";
+import { reconcileActiveProfile } from "../services/profile-absorb.js";
 import {
 	activateProfile,
-	activationNotes,
+	regenerateLiveFiles,
 	trackedGeneratedFiles,
 } from "../services/profile-activate.js";
 import {
@@ -29,11 +38,16 @@ import {
 } from "../services/profile-live.js";
 import { renderProfile } from "../services/profile-render.js";
 import {
+	applyProfileChoice,
 	checkActiveProfile,
 	prepareProfileState,
 	switchToProfile,
 } from "../services/profile-state.js";
 import { applyUserProfile } from "../services/profiles.js";
+import {
+	GitCheckError,
+	TrackedLiveFileError,
+} from "../services/tracked-live-files.js";
 import type { ProfileManifest } from "../types/index.js";
 
 const MANIFEST: ProfileManifest = {
@@ -673,25 +687,268 @@ function git(cwd: string, ...args: string[]) {
 }
 
 describe("generated files git still tracks", () => {
-	test("activation reports a committed settings.json with the git rm --cached fix", async () => {
+	/** A repo that committed profiles.json AND settings.json, like magus-src. */
+	async function commitTrackedSettings(): Promise<void> {
 		expect(git(project, "init", "-q").status).toBe(0);
-		await fs.outputJson(settingsPath(), { committed: true });
-		git(project, "add", ".claude/settings.json");
+		await fs.outputJson(settingsPath(), {
+			enabledPlugins: { "dev@magus": true },
+			installedPluginVersions: { "dev@magus": "8.0.0" },
+		});
+		git(project, "add", ".claude/settings.json", ".claude/profiles.json");
 		expect(git(project, "commit", "-q", "-m", "init").status).toBe(0);
+	}
+
+	/** Everything B1 says must not change when magus refuses. */
+	async function untouched(): Promise<void> {
+		expect(git(project, "status", "--porcelain").stdout).toBe("");
+		expect(await fs.pathExists(join(project, ".claude", "profiles"))).toBe(
+			false,
+		);
+		expect(await fs.pathExists(backupRoot(project))).toBe(false);
+		expect(await fs.pathExists(join(project, ".gitignore"))).toBe(false);
+	}
+
+	test("B1: activating over a tracked settings.json writes nothing and names the fix", async () => {
+		await commitTrackedSettings();
+
+		const error = await activateProfile(MANIFEST, "team", project, {
+			onDisplace: () => {},
+		}).then(
+			() => null,
+			(e: unknown) => e,
+		);
+
+		expect(error).toBeInstanceOf(TrackedLiveFileError);
+		const message = (error as Error).message;
+		expect(message).toContain(".claude/settings.json");
+		expect(message).toContain("git rm --cached .claude/settings.json");
+		expect(message).toContain("Nothing was changed.");
+		await untouched();
+	});
+
+	test("B1: the gate, the switch path and a startup choice all refuse, writing nothing", async () => {
+		await commitTrackedSettings();
+
+		const prep = await prepareProfileState(project);
+		expect(prep.refusal).toBeInstanceOf(TrackedLiveFileError);
+		expect(prep.problems[0]).toContain("git rm --cached .claude/settings.json");
+		expect(await profileGate(project)).toBe(false);
 
-		const result = await activateProfile(MANIFEST, "team", project, {
+		const switched = await switchToProfile(project, "other", {
 			onDisplace: () => {},
 		});
+		expect(switched.activation).toBeNull();
+		expect(switched.problems[0]).toContain(".claude/settings.json");
+
+		for (const choice of [
+			{ kind: "activate", id: "team" },
+			{ kind: "adopt", id: "default-2" },
+		] as const) {
+			await expect(
+				applyProfileChoice(choice, MANIFEST, project, { onDisplace: () => {} }),
+			).rejects.toBeInstanceOf(TrackedLiveFileError);
+		}
+		await untouched();
+	});
+
+	test("B1: the CLI router exits 1 for `magus profile switch`, and writes nothing", async () => {
+		await commitTrackedSettings();
+		const cwd = process.cwd();
+		process.chdir(project);
+		let outcome: Awaited<ReturnType<typeof route>>;
+		try {
+			outcome = await route(["profile", "switch", "other"], "0.0.0-test");
+		} finally {
+			process.chdir(cwd);
+		}
+		expect(outcome.exitCode).toBe(1);
+		expect(printed()).toContain("git rm --cached .claude/settings.json");
+		await untouched();
+	});
 
-		expect(result.tracked).toEqual([".claude/settings.json"]);
-		expect(activationNotes(result)).toContain(
-			".claude/settings.json is generated but tracked by git — run `git rm --cached .claude/settings.json`, then commit",
+	test("B1: once settings.json is tracked, a pulled change regenerates nothing", async () => {
+		expect(git(project, "init", "-q").status).toBe(0);
+		await activateProfile(MANIFEST, "team", project, { onDisplace: () => {} });
+		// Somebody commits the generated file after all.
+		git(project, "add", "-f", ".claude/settings.json");
+		git(project, "add", ".claude/profiles.json");
+		expect(git(project, "commit", "-q", "-m", "oops").status).toBe(0);
+		const before = await fs.readFile(settingsPath(), "utf8");
+		// A teammate's pull changes the profile.
+		const pulled = structuredClone(MANIFEST);
+		(pulled.profiles.team as { plugins: Record<string, string> }).plugins[
+			"mnemex@magus"
+		] = "latest";
+		await writeManifest(pulled, project);
+		const manifestBefore = await fs.readFile(
+			join(project, ".claude", "profiles.json"),
+			"utf8",
+		);
+
+		const prep = await prepareProfileState(project);
+		expect(prep.problems[0]).toContain("git rm --cached .claude/settings.json");
+		expect((await reconcileActiveProfile(project)).problems[0]).toContain(
+			".claude/settings.json",
 		);
-		// Report only: nothing was untracked.
+		await expect(regenerateLiveFiles(project)).rejects.toBeInstanceOf(
+			TrackedLiveFileError,
+		);
+		expect(await fs.readFile(settingsPath(), "utf8")).toBe(before);
+		expect(
+			await fs.readFile(join(project, ".claude", "profiles.json"), "utf8"),
+		).toBe(manifestBefore);
+	});
+
+	test("B1: after `git rm --cached` and a commit, activation proceeds and keeps the committed profiles.json", async () => {
+		await commitTrackedSettings();
+		git(project, "rm", "-q", "--cached", ".claude/settings.json");
+		expect(git(project, "commit", "-q", "-m", "untrack").status).toBe(0);
+		const manifestBytes = await fs.readFile(
+			join(project, ".claude", "profiles.json"),
+			"utf8",
+		);
+
+		await activateProfile(MANIFEST, "team", project, { onDisplace: () => {} });
+
+		expect((await lstat(settingsPath())).isFile()).toBe(true);
+		expect((await readActiveMarker(project))?.profile).toBe("team");
 		expect(
-			git(project, "ls-files", "--error-unmatch", ".claude/settings.json")
-				.status,
-		).toBe(0);
+			await fs.readFile(join(project, ".claude", "profiles.json"), "utf8"),
+		).toBe(manifestBytes);
+	});
+
+	test("B1: adopting a repo with no profiles.json and a tracked settings.json writes nothing", async () => {
+		await fs.remove(join(project, ".claude", "profiles.json"));
+		expect(git(project, "init", "-q").status).toBe(0);
+		await fs.outputJson(settingsPath(), {
+			enabledPlugins: { "dev@magus": true },
+		});
+		git(project, "add", ".claude/settings.json");
+		expect(git(project, "commit", "-q", "-m", "init").status).toBe(0);
+		const home = await mkdtemp(join(tmpdir(), "state-adopt-home-"));
+		const savedHome = process.env.HOME;
+		process.env.HOME = home;
+		try {
+			await expect(
+				ensureManifest(project, { allowAdopt: true }),
+			).rejects.toBeInstanceOf(TrackedLiveFileError);
+		} finally {
+			process.env.HOME = savedHome;
+			await rm(home, { recursive: true, force: true });
+		}
+		expect(await fs.pathExists(join(project, ".claude", "profiles.json"))).toBe(
+			false,
+		);
+		await untouched();
+	});
+
+	test("B1: doctor counts a tracked live file as a problem", async () => {
+		await commitTrackedSettings();
+		const counts = await reportProfileState(project, false);
+		expect(counts.unfixable).toBeGreaterThan(0);
+		expect(printed()).toContain("git rm --cached .claude/settings.json");
+		await untouched();
+	});
+
+	test("review M1: writeSettings and writeMcpConfig refuse a tracked live file and leave it as it is", async () => {
+		await commitTrackedSettings();
+		await fs.outputJson(join(project, ".mcp.json"), { mcpServers: {} });
+		git(project, "add", ".mcp.json");
+		expect(git(project, "commit", "-q", "-m", "mcp").status).toBe(0);
+		const before = await fs.readFile(settingsPath(), "utf8");
+
+		// What the TUI Profiles tab's "apply predefined" does.
+		const settings = await readSettings(project);
+		(settings.enabledPlugins as Record<string, boolean>)["frontend@magus"] =
+			true;
+		await expect(writeSettings(settings, project)).rejects.toBeInstanceOf(
+			TrackedLiveFileError,
+		);
+		await expect(
+			writeMcpConfig({ mcpServers: { x: { command: "x" } } }, project),
+		).rejects.toBeInstanceOf(TrackedLiveFileError);
+
+		expect(await fs.readFile(settingsPath(), "utf8")).toBe(before);
+		await untouched();
+	});
+
+	test("review M1: a project-scope Claude CLI install or uninstall is refused before the CLI runs", async () => {
+		await commitTrackedSettings();
+		const cwd = process.cwd();
+		const pathBefore = process.env.PATH;
+		// git stays reachable; `claude` does not — were the refusal missing, the
+		// CLI could not run here and touch this machine's plugins anyway.
+		const gitDir = spawnSync("sh", ["-c", "command -v git"], {
+			encoding: "utf8",
+		}).stdout.trim();
+		process.env.PATH = gitDir.slice(0, gitDir.lastIndexOf("/"));
+		process.chdir(project);
+		try {
+			await expect(
+				installPlugin("dev@magus", "project"),
+			).rejects.toBeInstanceOf(TrackedLiveFileError);
+			await expect(
+				uninstallPlugin("dev@magus", "project", project),
+			).rejects.toBeInstanceOf(TrackedLiveFileError);
+		} finally {
+			process.chdir(cwd);
+			process.env.PATH = pathBefore;
+		}
+		await untouched();
+	});
+
+	test("review M1: a project without profiles writes its own settings.json as before", async () => {
+		await commitTrackedSettings();
+		await writeManifest({ version: 2, profiles: {} }, project);
+		const settings = await readSettings(project);
+		(settings.enabledPlugins as Record<string, boolean>)["frontend@magus"] =
+			true;
+		await writeSettings(settings, project);
+		expect(
+			(await fs.readJson(settingsPath())).enabledPlugins["frontend@magus"],
+		).toBe(true);
+	});
+
+	test("review 3a: inside a work tree git cannot read, activation refuses with git's own message", async () => {
+		// A .git pointing at a repository that is not there: git exits 128.
+		await fs.outputFile(
+			join(project, ".git"),
+			`gitdir: ${join(project, "no-such-repository")}\n`,
+		);
+
+		const error = await activateProfile(MANIFEST, "team", project, {
+			onDisplace: () => {},
+		}).then(
+			() => null,
+			(e: unknown) => e,
+		);
+
+		expect(error).toBeInstanceOf(GitCheckError);
+		expect((error as Error).message).toContain("not a git repository");
+		expect((error as Error).message).toContain("Nothing was changed.");
+		expect(await fs.pathExists(settingsPath())).toBe(false);
+		expect(await fs.pathExists(join(project, ".claude", "profiles"))).toBe(
+			false,
+		);
+		const prep = await prepareProfileState(project);
+		expect(prep.refusal).toBeInstanceOf(GitCheckError);
+	});
+
+	test("review 3a: git missing is a refusal inside a work tree, and no check outside one", async () => {
+		expect(git(project, "init", "-q").status).toBe(0);
+		const outside = await mkdtemp(join(tmpdir(), "no-git-"));
+		const pathBefore = process.env.PATH;
+		// Not empty: an empty PATH falls back to the system default, where git is.
+		process.env.PATH = join(outside, "no-bin");
+		try {
+			await expect(
+				trackedByGit(project, [".claude/settings.json"]),
+			).rejects.toThrow("could not run git");
+			expect([...(await trackedByGit(outside, [".mcp.json"]))]).toEqual([]);
+		} finally {
+			process.env.PATH = pathBefore;
+			await rm(outside, { recursive: true, force: true });
+		}
 	});
 
 	test("committed custom skills are not reported", async () => {
@@ -712,6 +969,64 @@ describe("generated files git still tracks", () => {
 	});
 });
 
+describe("machine-local settings survive every render", () => {
+	/** What `magus update` records: eleven plugins, as on the reporting machine. */
+	const VERSIONS = Object.fromEntries(
+		Array.from({ length: 11 }, (_, i) => [`p${i}@magus`, `1.${i}.0`]),
+	);
+
+	test("B3: first adoption carries installedPluginVersions out of the settings.json it moves aside", async () => {
+		await fs.outputJson(settingsPath(), {
+			enabledPlugins: { "hand@written": true },
+			installedPluginVersions: VERSIONS,
+		});
+		const moved: string[] = [];
+
+		await activateProfile(MANIFEST, "team", project, {
+			onDisplace: (artifact) => moved.push(artifact.savedTo),
+		});
+
+		expect(moved).toHaveLength(1);
+		const live = await fs.readJson(settingsPath());
+		expect(live.installedPluginVersions).toEqual(VERSIONS);
+		expect(live.enabledPlugins["dev@magus"]).toBe(true);
+		expect(live.enabledPlugins["hand@written"]).toBeUndefined();
+		// The backup still holds the whole original.
+		expect(
+			(await fs.readJson(moved[0] as string)).installedPluginVersions,
+		).toEqual(VERSIONS);
+	});
+
+	test("B3: a switch, then a regeneration from a pulled change, keep what an update recorded", async () => {
+		await activateProfile(MANIFEST, "team", project, { onDisplace: () => {} });
+		const live = await fs.readJson(settingsPath());
+		live.installedPluginVersions = VERSIONS;
+		await fs.writeJson(settingsPath(), live);
+
+		const switched = await switchToProfile(project, "other");
+		expect(switched.problems).toEqual([]);
+		expect((await fs.readJson(settingsPath())).installedPluginVersions).toEqual(
+			VERSIONS,
+		);
+		// Machine state, not a contract: nothing of it reached profiles.json.
+		expect(JSON.stringify(await readManifest(project))).not.toContain(
+			"installedPluginVersions",
+		);
+
+		// A teammate's commit adds a plugin to the active profile.
+		const manifest = await readManifest(project);
+		(manifest.profiles.other?.plugins as Record<string, string>)[
+			"designer@magus"
+		] = "latest";
+		await writeManifest(manifest, project);
+		expect(await regenerateLiveFiles(project)).toBe(true);
+
+		const after = await fs.readJson(settingsPath());
+		expect(after.enabledPlugins["designer@magus"]).toBe(true);
+		expect(after.installedPluginVersions).toEqual(VERSIONS);
+	});
+});
+
 describe("the gate is idempotent", () => {
 	test("a second pass with nothing changed prints nothing", async () => {
 		await activateProfile(MANIFEST, "team", project, { onDisplace: () => {} });

package/src/__tests__/stale-load-repair.test.ts

@@ -13,6 +13,7 @@ import path from "node:path";
 import fs from "fs-extra";
 import {
 	findStaleLoads,
+	loadedVersionHere,
 	repairAllStaleLoads,
 	repairStaleLoad,
 	writeInstalledPluginsRegistry,
@@ -24,6 +25,11 @@ import {
 	repoRootForPath,
 	resolveLoadedVersions,
 } from "../services/plugin-resolution.js";
+import {
+	type PluginApplyDeps,
+	applyPlugins,
+	bringLoadForward,
+} from "../services/update-engine.js";
 import {
 	classifyPluginRows,
 	countPluginStates,
@@ -1075,3 +1081,102 @@ describe("repairAllStaleLoads", () => {
 		expect(await backups()).toEqual([]);
 	});
 });
+
+describe("B4: an update brings the loader forward in the same run", () => {
+	/**
+	 * `claude plugin update --scope project`, as far as the registry sees it:
+	 * this project's row moves to `version`, every other row stays.
+	 */
+	async function cliUpdateHere(version: string): Promise<void> {
+		const registry = await readRegistry();
+		registry.plugins[PLUGIN] = registry.plugins[PLUGIN].map((e) =>
+			e.projectPath === here
+				? { ...e, version, installPath: cacheFor(version) }
+				: e,
+		);
+		await fs.outputJson(registryFile, registry, { spaces: 2 });
+	}
+
+	/** The real repair and loader question, against this case's plugins root. */
+	function realDeps(): PluginApplyDeps {
+		return {
+			install: async () => {},
+			update: async () => cliUpdateHere("0.5.0"),
+			repair: async () => {},
+			readInstalled: async () => {
+				const rows = (await readRegistry()).plugins[PLUGIN];
+				return rows.find((e) => e.projectPath === here)?.version ?? null;
+			},
+			saveInstalled: async () => {},
+			repairStaleLoad: (id, target, projectPath) =>
+				repairStaleLoad(id, target, projectPath, root),
+			loadedVersion: (id, projectPath) =>
+				loadedVersionHere(id, projectPath, root),
+		};
+	}
+
+	test("B4: the deleted worktree's older row stops winning, and the update says so", async () => {
+		await writeRegistry([
+			row({ version: "0.3.0", projectPath: gone }),
+			row({ version: "0.4.0", projectPath: here }),
+		]);
+		const details: string[] = [];
+
+		const result = await applyPlugins(
+			[
+				{
+					pluginId: PLUGIN,
+					pinned: "latest",
+					installed: "0.4.0",
+					available: "0.5.0",
+					target: "0.5.0",
+					action: "update",
+					reason: "behind",
+					scopes: ["project"],
+					beforeVersions: { project: "0.4.0" },
+				},
+			],
+			here,
+			realDeps(),
+			{
+				begin: () => {},
+				finish: (_ok, _name, detail) => details.push(detail),
+				detach: (work) => work(),
+			},
+		);
+
+		expect(result.ok).toBe(1);
+		expect(result.failed).toEqual([]);
+		expect(details).toEqual([
+			"project → 0.5.0 · Claude Code now loads v0.5.0 here (1 older record moved forward)",
+		]);
+		expect(await loadedVersionHere(PLUGIN, here, root)).toBe("0.5.0");
+		// Moved forward, nothing removed.
+		expect(
+			(await readRegistry()).plugins[PLUGIN].map((e) => [
+				e.projectPath,
+				e.version,
+			]),
+		).toEqual([
+			[gone, "0.5.0"],
+			[here, "0.5.0"],
+		]);
+	});
+
+	test("B4: without the repair step the same update leaves the old version loading (negative control)", async () => {
+		await writeRegistry([
+			row({ version: "0.3.0", projectPath: gone }),
+			row({ version: "0.4.0", projectPath: here }),
+		]);
+		await cliUpdateHere("0.5.0");
+		expect(await loadedVersionHere(PLUGIN, here, root)).toBe("0.3.0");
+	});
+
+	test("B4: a loader already on the target is left alone — no write, no backup", async () => {
+		await writeRegistry([row({ version: "0.5.0", projectPath: here })]);
+		expect(
+			await bringLoadForward(PLUGIN, "0.5.0", here, realDeps()),
+		).toBeNull();
+		expect(await backups()).toEqual([]);
+	});
+});

package/src/__tests__/support/preload.ts

@@ -0,0 +1,14 @@
+/**
+ * Loaded before every test file (bunfig.toml `[test] preload`).
+ *
+ * Rendering a profile reads each plugin's plugin.json to find its
+ * dependencies, from `~/.claude/plugins` — different on every machine, and
+ * absent on CI. Every test starts from "no plugin declares a dependency"; a
+ * test about dependencies installs its own reader and restores this one.
+ */
+
+import { setPluginDependencyReader } from "../../services/plugin-dependencies.js";
+
+export const NO_DEPENDENCIES = async (): Promise<string[]> => [];
+
+setPluginDependencyReader(NO_DEPENDENCIES);

package/src/__tests__/update-apply.test.ts

@@ -780,3 +780,148 @@ describe("applyPlugins — read-back against beforeVersions", () => {
 		expect(reasons.lines(["other@magus"])).toBe("other@magus");
 	});
 });
+
+// ── B4: installed must mean LOADED ──────────────────────────────────────────
+//
+// Claude Code's loader takes the FIRST registry row relevant to the repository,
+// and rows from this repository's other checkouts (deleted worktrees included)
+// often precede this project's own. `claude plugin update` writes only this
+// project's row, so an update could show "updated" and load the old version at
+// once. The same operation now runs the stale-load repair as its last step.
+
+describe("B4: an install or update ends with the loader on the new version", () => {
+	/** `loaded` is what the loader resolves until the repair has run. */
+	function loaderDeps(loaded: string | null, repairOk = true) {
+		const stub = stubDeps("2.0.0", (pluginId, target) =>
+			repairOk
+				? {
+						pluginId,
+						target,
+						rewritten: 3,
+						backup: "/tmp/installed_plugins.json.backup.1",
+						loaded: target,
+						ok: true,
+					}
+				: {
+						pluginId,
+						target,
+						rewritten: 0,
+						backup: null,
+						loaded,
+						ok: false,
+						error: `the loader still resolves v${loaded} here, not v${target}`,
+					},
+		);
+		stub.deps.loadedVersion = mock(async () => loaded);
+		return stub;
+	}
+
+	test("B4: an update the loader does not pick up moves the older records forward and says so", async () => {
+		const { deps, rowsRepaired } = loaderDeps("1.0.0");
+		const { reporter, rows } = recordingReporter();
+
+		const result = await applyPlugins([item({})], PROJECT, deps, reporter);
+
+		expect(rowsRepaired).toEqual([
+			{ id: "dev@magus", target: "2.0.0", projectPath: PROJECT },
+		]);
+		expect(result.ok).toBe(1);
+		expect(result.failed).toEqual([]);
+		expect(rows).toEqual([
+			{
+				ok: true,
+				name: "dev@magus",
+				detail:
+					"project → 2.0.0 · Claude Code now loads v2.0.0 here (3 older records moved forward)",
+			},
+		]);
+	});
+
+	test("B4: a loader already on the landed version runs no repair", async () => {
+		const { deps, rowsRepaired } = loaderDeps("2.0.0");
+		const { reporter, rows } = recordingReporter();
+
+		const result = await applyPlugins([item({})], PROJECT, deps, reporter);
+
+		expect(rowsRepaired).toEqual([]);
+		expect(result.ok).toBe(1);
+		expect(rows[0]?.detail).toBe("project → 2.0.0");
+	});
+
+	test("B4: a repair that cannot move the loader makes the update a failure, never 'updated'", async () => {
+		const { deps } = loaderDeps("1.0.0", false);
+		const { reporter, rows } = recordingReporter();
+
+		const result = await applyPlugins([item({})], PROJECT, deps, reporter);
+
+		expect(result.ok).toBe(0);
+		expect(result.failed).toEqual(["dev@magus"]);
+		expect(rows).toEqual([
+			{
+				ok: false,
+				name: "dev@magus",
+				detail:
+					"installed v2.0.0, but Claude Code still loads v1.0.0 here — the loader still resolves v1.0.0 here, not v2.0.0",
+			},
+		]);
+	});
+
+	test("B4: an install whose version did not move still brings the loader forward, and is not 'no change'", async () => {
+		// The project row already held 2.0.0; the older row ahead of it is what
+		// loaded. Reporting "no change" would leave the plugin loading 1.0.0.
+		const { deps, rowsRepaired } = loaderDeps("1.0.0");
+
+		const result = await applyPlugins(
+			[item({ beforeVersions: { project: "2.0.0" } })],
+			PROJECT,
+			deps,
+		);
+
+		expect(rowsRepaired).toHaveLength(1);
+		expect(result.unchanged).toEqual([]);
+		expect(result.ok).toBe(1);
+	});
+
+	test("B4: the TUI's per-scope install and update helpers repair at project scope", async () => {
+		const a = loaderDeps("1.0.0");
+		expect(
+			await updatePluginInScope("dev@magus", "project", PROJECT, a.deps),
+		).toBe("2.0.0");
+		expect(a.rowsRepaired).toEqual([
+			{ id: "dev@magus", target: "2.0.0", projectPath: PROJECT },
+		]);
+
+		const b = loaderDeps("1.0.0");
+		await installPluginInScope("dev@magus", "project", PROJECT, b.deps);
+		expect(b.rowsRepaired).toHaveLength(1);
+	});
+
+	test("B4: a per-scope helper whose repair fails throws, so the TUI reports a failure", async () => {
+		const { deps } = loaderDeps("1.0.0", false);
+		await expect(
+			updatePluginInScope("dev@magus", "project", PROJECT, deps),
+		).rejects.toThrow(
+			"installed v2.0.0, but Claude Code still loads v1.0.0 here",
+		);
+	});
+
+	test("B4: the per-scope helpers bring the loader forward at user and local scope too", async () => {
+		for (const scope of ["user", "local"] as const) {
+			const up = loaderDeps("1.0.0");
+			await updatePluginInScope("dev@magus", scope, PROJECT, up.deps);
+			expect(up.rowsRepaired).toEqual([
+				{ id: "dev@magus", target: "2.0.0", projectPath: PROJECT },
+			]);
+			const fresh = loaderDeps("1.0.0");
+			await installPluginInScope("dev@magus", scope, PROJECT, fresh.deps);
+			expect(fresh.rowsRepaired).toHaveLength(1);
+		}
+	});
+
+	test("B4: a machine-wide winner the repair refuses fails the user-scope update, naming why", async () => {
+		const { deps } = loaderDeps("1.0.0", false);
+		await expect(
+			updatePluginInScope("dev@magus", "user", PROJECT, deps),
+		).rejects.toThrow("the loader still resolves v1.0.0 here, not v2.0.0");
+	});
+});

package/src/cli/bootstrap.ts

@@ -18,6 +18,7 @@ import {
 	type ActivationResult,
 	activateProfile,
 	activationNotes,
+	assertNoTrackedWriteTargets,
 	reportDisplaced,
 } from "../services/profile-activate.js";
 import {
@@ -83,6 +84,9 @@ async function writeAndActivate(
 	// their hand-written files went.
 	const rel = (p: string) => path.relative(projectPath, p);
 
+	// Before the manifest is written: adopting activates, and activating a
+	// project whose settings.json git tracks would take that file over.
+	await assertNoTrackedWriteTargets(projectPath);
 	await writeManifest(result.manifest, projectPath);
 	console.log(`✓ Wrote ${rel(getManifestPath(projectPath))}`);