magus-cli 7.5.0 → 7.5.2

package/src/services/claude-settings.ts

@@ -37,6 +37,7 @@ import {
 	writableList,
 	writableMap,
 } from "./settings-file.js";
+import { refuseTrackedLiveFiles } from "./tracked-live-files.js";
 
 /**
  * What every reader below throws for a file that exists but does not parse.
@@ -148,6 +149,11 @@ export async function writeSettings(
 	settings: ClaudeSettings,
 	projectPath?: string,
 ): Promise<void> {
+	// In a project with profiles this file is generated: never written where
+	// git tracks it (see `tracked-live-files.ts`).
+	await refuseTrackedLiveFiles(projectPath ?? process.cwd(), [
+		getSettingsPath(projectPath),
+	]);
 	await refuseUnwritableFile(getSettingsPath(projectPath));
 	const claudeDir = await ensureClaudeDir(projectPath);
 	const settingsPath = path.join(claudeDir, SETTINGS_FILE);
@@ -191,6 +197,7 @@ export async function writeMcpConfig(
 	projectPath?: string,
 ): Promise<void> {
 	const mcpPath = getMcpConfigPath(projectPath);
+	await refuseTrackedLiveFiles(projectPath ?? process.cwd(), [mcpPath]);
 	await refuseUnwritableFile(mcpPath);
 	await fs.writeJson(mcpPath, config, { spaces: 2 });
 }
@@ -1984,6 +1991,24 @@ function belongsToThisRepository(
 	return repoRootForPath(entry.projectPath, cache) === cwdRoot;
 }
 
+/**
+ * Is `entry` a row of the repository `projectPath` is in — one
+ * {@link repairStaleLoad} may rewrite? The same predicate, for callers that
+ * judge one row at a time.
+ */
+export function rowBelongsToRepository(
+	entry: InstalledPluginEntry,
+	projectPath: string,
+): boolean {
+	const cache: RepoRootCache = new Map();
+	return belongsToThisRepository(
+		entry,
+		projectPath,
+		repoRootForPath(projectPath, cache),
+		cache,
+	);
+}
+
 /** A plugin whose loader-resolved version is behind a row this repair can rewrite. */
 export interface StaleLoad {
 	pluginId: string;
@@ -2143,6 +2168,26 @@ export async function repairAllStaleLoads(
 	return out;
 }
 
+/**
+ * The version Claude Code's loader resolves for `pluginId` in `projectPath`:
+ * the first relevant registry row whose installPath exists (`pickLoadedEntry`).
+ * Null when no row resolves, or the registry cannot be read.
+ */
+export async function loadedVersionHere(
+	pluginId: string,
+	projectPath: string,
+	root: string = pluginsDir(),
+): Promise<string | null> {
+	try {
+		const registry = await readInstalledPluginsRegistry(root);
+		const rows = registry.plugins?.[pluginId];
+		if (!Array.isArray(rows) || rows.length === 0) return null;
+		return pickLoadedEntry(rows, projectPath)?.version ?? null;
+	} catch {
+		return null;
+	}
+}
+
 /**
  * What one {@link repairStaleLoad} attempt did, and whether it worked.
  *

package/src/services/git-worktree.ts

@@ -24,36 +24,67 @@
  */
 
 import { spawn } from "node:child_process";
+import { lstat } from "node:fs/promises";
 import path from "node:path";
 
 function git(
 	cwd: string,
 	args: string[],
-): Promise<{ code: number; out: string }> {
+): Promise<{ code: number; out: string; err: string }> {
 	return new Promise((resolve) => {
 		const child = spawn("git", args, {
 			cwd,
-			stdio: ["ignore", "pipe", "ignore"],
+			stdio: ["ignore", "pipe", "pipe"],
 		});
 		let out = "";
+		let err = "";
 		child.stdout.on("data", (d) => {
 			out += String(d);
 		});
+		child.stderr.on("data", (d) => {
+			err += String(d);
+		});
+		const settle = (code: number, text: string, why: string) => {
+			clearTimeout(timer);
+			resolve({ code, out: text, err: why });
+		};
 		// Never let a wedged git block the UI.
 		const timer = setTimeout(() => {
 			child.kill();
-			resolve({ code: -1, out: "" });
+			settle(-1, "", `git ${args[0]} did not answer within 5 seconds`);
 		}, 5000);
 		timer.unref?.();
-		const settle = (code: number, text: string) => {
-			clearTimeout(timer);
-			resolve({ code, out: text });
-		};
-		child.on("error", () => settle(-1, ""));
-		child.on("close", (code) => settle(code ?? -1, out.trim()));
+		child.on("error", (error) =>
+			settle(-1, "", `could not run git: ${error.message}`),
+		);
+		child.on("close", (code) => settle(code ?? -1, out.trim(), err.trim()));
 	});
 }
 
+/**
+ * git was asked about a work tree and gave no answer: it timed out, is not
+ * installed, or refused the repository. `detail` is git's own message.
+ */
+export class GitQueryError extends Error {
+	constructor(readonly detail: string) {
+		super(detail);
+		this.name = "GitQueryError";
+	}
+}
+
+/** Is `dir`, or a directory above it, a git work tree (holds a `.git`)? */
+async function insideWorkTree(dir: string): Promise<boolean> {
+	for (let at = path.resolve(dir); ; at = path.dirname(at)) {
+		try {
+			await lstat(path.join(at, ".git"));
+			return true;
+		} catch {
+			// Not here; try the parent.
+		}
+		if (path.dirname(at) === at) return false;
+	}
+}
+
 /**
  * Session cache. Keyed by resolved project path — the repository layout cannot
  * change under a running magus in any way worth tracking, and the resolution
@@ -65,6 +96,58 @@ export function clearWorktreeCache(): void {
 	cache.clear();
 }
 
+/**
+ * The paths (relative to `projectPath`) that git tracks. A path in `files` is
+ * tracked when git has exactly that entry — a symlink is an entry too; a path
+ * in `dirs` when git tracks any file under it. Empty outside a work tree.
+ *
+ * Throws {@link GitQueryError} when there IS a `.git` at or above
+ * `projectPath` and git still fails — a timeout, git missing, or git refusing
+ * the repository (`detected dubious ownership`, exit 128). "Nothing is
+ * tracked" is not an answer git gave there, and a caller that believed it
+ * would write a tracked file.
+ *
+ * The distinction matters for `.claude/skills`: as a directory of committed
+ * custom skills it has tracked files under it, which says nothing about
+ * whether the path ITSELF (an older layout's symlink) was committed.
+ */
+export async function trackedByGit(
+	projectPath: string,
+	files: readonly string[],
+	dirs: readonly string[] = [],
+): Promise<Set<string>> {
+	const out = new Set<string>();
+	const relPaths = [...files, ...dirs];
+	if (relPaths.length === 0) return out;
+	// One call for every path: this runs on every magus command that touches
+	// profile state, and a spawn per path adds up. `ls-files` prints each
+	// tracked FILE matching the pathspecs, so a directory shows as its files.
+	const {
+		code,
+		out: listed,
+		err,
+	} = await git(projectPath, ["ls-files", "-z", "--", ...relPaths]);
+	if (code !== 0) {
+		if (!(await insideWorkTree(projectPath))) return out; // Nothing to track.
+		throw new GitQueryError(err || `git ls-files exited with code ${code}`);
+	}
+	const entries = new Set(listed.split("\0").filter(Boolean));
+	const norm = (rel: string) => rel.split(path.sep).join("/");
+	for (const rel of files) {
+		if (entries.has(norm(rel))) out.add(rel);
+	}
+	for (const rel of dirs) {
+		const prefix = `${norm(rel)}/`;
+		for (const entry of entries) {
+			if (entry.startsWith(prefix)) {
+				out.add(rel);
+				break;
+			}
+		}
+	}
+	return out;
+}
+
 /**
  * Is `relPath` (relative to `projectPath`) tracked by git? For a directory,
  * true when any file under it is tracked.

package/src/services/manifest.ts

@@ -9,6 +9,17 @@
 
 import path from "node:path";
 import fs from "fs-extra";
+import {
+	type FormattingOptions,
+	type JSONPath,
+	type Node as JsonNode,
+	applyEdits,
+	findNodeAtLocation,
+	format,
+	getNodeValue,
+	modify,
+	parseTree,
+} from "jsonc-parser";
 import type { ProfileManifest, ProfileManifestEntry } from "../types/index.js";
 import { validateModelsConfig } from "./models-core.js";
 import {
@@ -160,10 +171,216 @@ export async function writeManifest(
 	projectPath?: string,
 ): Promise<void> {
 	const filePath = getManifestPath(projectPath);
-	// Read for the throw alone; the contents are about to be replaced.
-	await readProfilesFile(filePath);
+	// The refusal, and the view every caller read: `readManifest`'s. Only what
+	// the caller changed in that view is written (see `writeJsonMinimal`).
+	// `version` is the file's own, so a v1 file is recorded as v2 on write.
+	const current = await readProfilesFile(filePath);
+	await writeJsonMinimal(filePath, manifest, {
+		...migrateToV2(current),
+		version: current.version,
+	});
+}
+
+/**
+ * Write `next` to a JSON file, changing only the values that differ from
+ * `view` — every other byte stays exactly as it was: formatting, key order,
+ * inline arrays, the trailing newline, and keys the caller never saw.
+ *
+ * `profiles.json` is committed and reviewed. Re-serialising the whole file on
+ * every write turned one absorbed plugin into a 63-line diff that expanded
+ * every inline array and dropped `"strictVersions": false` — a key the
+ * manifest type models only as `true`. So the write is an edit, not a dump.
+ *
+ * `view` is what the caller READ — the same projection of the file it then
+ * mutated (for `readManifest`, `migrateToV2` of the raw file, which omits
+ * `strictVersions: false` and unmodelled keys). Diffing `next` against that
+ * view, not against the raw file, is what makes a key the caller never saw
+ * "unchanged" rather than "deleted". The changed paths are then applied to the
+ * file's own text: objects key by key, anything else (arrays included) as a
+ * whole value, so a changed array is re-written and an unchanged one is not.
+ * Each edit keeps the style around it — see {@link editJsonText}.
+ *
+ * A file that does not exist yet (or is empty) is written as 2-space JSON.
+ */
+export async function writeJsonMinimal(
+	filePath: string,
+	next: unknown,
+	view: unknown,
+): Promise<void> {
+	let text = "";
+	try {
+		text = await fs.readFile(filePath, "utf8");
+	} catch {
+		// Absent: written fresh below.
+	}
 	await fs.ensureDir(path.dirname(filePath));
-	await fs.writeJson(filePath, manifest, { spaces: 2 });
+	if (text.trim() === "") {
+		await fs.writeFile(filePath, `${JSON.stringify(next, null, 2)}\n`);
+		return;
+	}
+	const edits: Array<{ path: JSONPath; value: unknown }> = [];
+	diffJson(view, next, [], edits);
+	if (edits.length === 0) return;
+	const options: FormattingOptions = {
+		insertSpaces: !/^\t/m.test(text),
+		tabSize: detectIndent(text),
+		eol: text.includes("\r\n") ? "\r\n" : "\n",
+	};
+	for (const edit of edits) {
+		text = editJsonText(text, edit.path, edit.value, options);
+	}
+	await fs.writeFile(filePath, text);
+}
+
+const MULTILINE = /[\r\n]/;
+
+/**
+ * Set (or, for `undefined`, remove) the value at `at` in JSON `text`, changing
+ * as few bytes as possible and keeping the style around the change:
+ *
+ *   - a container written on one line (`{ "a": "x" }`) stays on one line — it
+ *     is re-written inline, whole;
+ *   - a value written on one line is replaced on that line;
+ *   - anything else is jsonc-parser's edit, formatted only across the bytes it
+ *     inserted plus the join on either side.
+ *
+ * jsonc-parser's own formatting option is not used: it re-formats every line
+ * an insertion or removal touches, so adding a key after an inline array
+ * expands that array — a line the write did not change.
+ */
+function editJsonText(
+	text: string,
+	at: JSONPath,
+	value: unknown,
+	options: FormattingOptions,
+): string {
+	const root = parseTree(text);
+	const node = root ? findNodeAtLocation(root, at) : undefined;
+	const parent =
+		root && at.length > 0
+			? findNodeAtLocation(root, at.slice(0, -1))
+			: undefined;
+	const source = (n: JsonNode) => text.slice(n.offset, n.offset + n.length);
+	const replace = (n: JsonNode, content: string) =>
+		text.slice(0, n.offset) + content + text.slice(n.offset + n.length);
+	const key = at[at.length - 1];
+
+	if (
+		parent?.type === "object" &&
+		typeof key === "string" &&
+		(parent.children?.length ?? 0) > 0 &&
+		!MULTILINE.test(source(parent))
+	) {
+		const updated = { ...(getNodeValue(parent) as Record<string, unknown>) };
+		if (value === undefined) delete updated[key];
+		else updated[key] = value;
+		return replace(parent, inlineJson(updated));
+	}
+
+	if (
+		node &&
+		value !== undefined &&
+		!MULTILINE.test(source(node)) &&
+		(!isContainer(value) || isNonEmptyContainerNode(node))
+	) {
+		return replace(node, inlineJson(value));
+	}
+
+	const [edit] = modify(text, at, value, {});
+	if (!edit) return text;
+	const next = applyEdits(text, [edit]);
+	const from = Math.max(0, edit.offset - 1);
+	const to = Math.min(next.length, edit.offset + edit.content.length + 1);
+	return applyEdits(
+		next,
+		format(
+			next,
+			{ offset: from, length: to - from },
+			{
+				...options,
+				keepLines: false,
+			},
+		),
+	);
+}
+
+function isContainer(value: unknown): boolean {
+	return (
+		(Array.isArray(value) && value.length > 0) ||
+		(isPlainObject(value) && Object.keys(value).length > 0)
+	);
+}
+
+function isNonEmptyContainerNode(node: JsonNode): boolean {
+	return (
+		(node.type === "object" || node.type === "array") &&
+		(node.children?.length ?? 0) > 0
+	);
+}
+
+/** One-line JSON in the common inline style: `{ "a": 1 }`, `["x", "y"]`. */
+function inlineJson(value: unknown): string {
+	if (Array.isArray(value)) return `[${value.map(inlineJson).join(", ")}]`;
+	if (isPlainObject(value)) {
+		const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+		if (entries.length === 0) return "{}";
+		return `{ ${entries
+			.map(([k, v]) => `${JSON.stringify(k)}: ${inlineJson(v)}`)
+			.join(", ")} }`;
+	}
+	return JSON.stringify(value);
+}
+
+/** The indent width of the first indented line, or 2. */
+function detectIndent(text: string): number {
+	const match = /^( +)\S/m.exec(text);
+	return match ? (match[1] as string).length : 2;
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Same meaning, whatever the key order. */
+function sameJson(a: unknown, b: unknown): boolean {
+	const sort = (v: unknown): unknown => {
+		if (Array.isArray(v)) return v.map(sort);
+		if (isPlainObject(v)) {
+			const out: Record<string, unknown> = {};
+			for (const key of Object.keys(v).sort()) out[key] = sort(v[key]);
+			return out;
+		}
+		return v;
+	};
+	return JSON.stringify(sort(a)) === JSON.stringify(sort(b));
+}
+
+/**
+ * The edits that turn `before` into `after`: objects are walked key by key; a
+ * removed key is an edit to `undefined`; every other difference replaces the
+ * value at that path whole. Key order alone is not a difference.
+ */
+function diffJson(
+	before: unknown,
+	after: unknown,
+	at: JSONPath,
+	out: Array<{ path: JSONPath; value: unknown }>,
+): void {
+	if (sameJson(before, after)) return;
+	if (isPlainObject(before) && isPlainObject(after)) {
+		for (const key of Object.keys(before)) {
+			if (!(key in after) || after[key] === undefined) {
+				out.push({ path: [...at, key], value: undefined });
+			}
+		}
+		for (const [key, value] of Object.entries(after)) {
+			if (value === undefined) continue;
+			if (key in before) diffJson(before[key], value, [...at, key], out);
+			else out.push({ path: [...at, key], value });
+		}
+		return;
+	}
+	out.push({ path: at, value: after });
 }
 
 export interface ManifestValidationError {

package/src/services/plugin-dependencies.ts

@@ -0,0 +1,48 @@
+/**
+ * Which plugins a plugin depends on, as its own plugin.json declares them.
+ *
+ * A plugin's `dependencies` must be ENABLED for it to load — Claude Code's
+ * loader refuses it otherwise ("Dependency "claudish@magus" is disabled —
+ * enable it or remove the dependency"). A profile renders every other
+ * profile's plugins as `false`, so without reading these a profile that
+ * enables dev@magus but not claudish@magus switched dev off in effect.
+ *
+ * The reading itself lives beside the other plugin.json readers
+ * (`resolvePluginDependencies` in `plugin-requires.ts`). This module is only
+ * the entry point, kept free of imports: the render reaches it on every
+ * command, and a test preload replaces it so no test ever reads the plugin
+ * files installed on the machine running it.
+ */
+
+/**
+ * The plugin ids `pluginId` declares as dependencies, or null when no
+ * plugin.json for it can be read on this machine. `projectPath` picks the
+ * installed copy Claude Code loads there (default: the current directory).
+ */
+export type PluginDependencyReader = (
+	pluginId: string,
+	projectPath?: string,
+) => Promise<string[] | null>;
+
+let replacement: PluginDependencyReader | null = null;
+
+/**
+ * Replace where dependencies are read from, or restore the real reader with
+ * null. For tests: the real one reads `~/.claude/plugins`, which differs on
+ * every machine.
+ */
+export function setPluginDependencyReader(
+	reader: PluginDependencyReader | null,
+): void {
+	replacement = reader;
+}
+
+/** Read `pluginId`'s declared dependencies — see {@link PluginDependencyReader}. */
+export async function readPluginDependencies(
+	pluginId: string,
+	projectPath?: string,
+): Promise<string[] | null> {
+	if (replacement) return replacement(pluginId, projectPath);
+	const { resolvePluginDependencies } = await import("./plugin-requires.js");
+	return resolvePluginDependencies(pluginId, projectPath);
+}

package/src/services/plugin-requires.ts

@@ -17,7 +17,9 @@ import type {
 } from "../types/index.js";
 import { goBinaryName } from "../utils/go-module.js";
 import { parsePluginId } from "../utils/string-utils.js";
+import { readInstalledPluginsRegistry } from "./claude-settings.js";
 import { getLocalMarketplacesInfo } from "./plugin-manager.js";
+import { pickLoadedEntry } from "./plugin-resolution.js";
 
 const MARKETPLACES_DIR = (): string =>
 	path.join(os.homedir(), ".claude", "plugins", "marketplaces");
@@ -160,28 +162,149 @@ export function parsePluginRequires(pluginJson: unknown): PluginRequires {
 	return bin.length > 0 ? { bin } : {};
 }
 
+/**
+ * The plugin.json at a plugin directory, parsed — null when there is none or
+ * it does not parse.
+ *
+ * `.claude-plugin/plugin.json` FIRST — that is the only location Claude Code's
+ * runtime loader reads, and the only one its documentation describes. The root
+ * fallback stays for third-party plugins whose authors put it there; such a
+ * manifest is inert as far as Claude Code is concerned, but magus can still
+ * read metadata out of it rather than reporting nothing.
+ */
+export async function readPluginManifest(
+	pluginPath: string,
+): Promise<unknown | null> {
+	const candidates = [
+		path.join(pluginPath, ".claude-plugin", "plugin.json"),
+		path.join(pluginPath, "plugin.json"),
+	];
+	for (const manifestPath of candidates) {
+		try {
+			if (await fs.pathExists(manifestPath)) {
+				return await fs.readJson(manifestPath);
+			}
+		} catch {
+			return null; // Present but malformed: never fall through to another.
+		}
+	}
+	return null;
+}
+
 /** Read `requires` from a plugin.json at a known plugin directory. */
 export async function readPluginRequires(
 	pluginPath: string,
 ): Promise<PluginRequires> {
-	// `.claude-plugin/plugin.json` FIRST — that is the only location Claude Code's
-	// runtime loader reads, and the only one its documentation describes. The root
-	// fallback stays for third-party plugins whose authors put it there; such a manifest
-	// is inert as far as Claude Code is concerned, but magus can still read metadata
-	// out of it rather than reporting nothing.
-	const manifestPath = path.join(pluginPath, ".claude-plugin", "plugin.json");
-	try {
-		if (await fs.pathExists(manifestPath)) {
-			return parsePluginRequires(await fs.readJson(manifestPath));
+	// Unreadable/malformed — treat as no requirements.
+	return parsePluginRequires(await readPluginManifest(pluginPath));
+}
+
+/**
+ * The plugin ids a plugin.json's `dependencies` names, resolved the way
+ * Claude Code resolves them: an entry that names a marketplace
+ * (`"claudish@magus"`, or `{ "name": "claudish", "marketplace": "magus" }`)
+ * is taken as written; a bare name (`"claudish"`, `{ "name": "claudish" }`)
+ * is looked up in the DEPENDENT's marketplace — `claudish` declared by
+ * dev@magus is claudish@magus. Version constraints are not modelled here: a
+ * dependency is enabled, and installed at latest.
+ */
+export function parsePluginDependencies(
+	pluginJson: unknown,
+	dependentId: string,
+): string[] {
+	if (!pluginJson || typeof pluginJson !== "object") return [];
+	const raw = (pluginJson as Record<string, unknown>).dependencies;
+	if (!Array.isArray(raw)) return [];
+	const home = parsePluginId(dependentId)?.marketplace;
+	const out = new Set<string>();
+	for (const item of raw) {
+		let name = "";
+		let marketplace: string | undefined;
+		if (typeof item === "string") {
+			name = item.trim();
+		} else if (item && typeof item === "object") {
+			const o = item as Record<string, unknown>;
+			if (typeof o.name === "string") name = o.name.trim();
+			if (typeof o.marketplace === "string" && o.marketplace.trim()) {
+				marketplace = o.marketplace.trim();
+			}
+		}
+		if (!name) continue;
+		if (name.lastIndexOf("@") > 0) {
+			out.add(name);
+			continue;
 		}
-		const rootLevel = path.join(pluginPath, "plugin.json");
-		if (await fs.pathExists(rootLevel)) {
-			return parsePluginRequires(await fs.readJson(rootLevel));
+		const at = marketplace ?? home;
+		// A bare id cannot be named in enabledPlugins, so it is not one to render.
+		if (at) out.add(`${name}@${at}`);
+	}
+	return [...out];
+}
+
+/** Where {@link resolvePluginDependencies} looks; replaced in tests. */
+export interface PluginManifestSources {
+	/** The plugins directory holding the registry — see `pluginsDir`. */
+	root?: string;
+	/** The plugin's source in the local marketplace clone. */
+	clone?: (pluginId: string) => Promise<string | null>;
+}
+
+/**
+ * The directories that may hold `pluginId`'s plugin.json on this machine, in
+ * the order they are trusted:
+ *
+ *   1. the installed copy Claude Code LOADS in `projectPath` — the registry
+ *      row its loader resolves there (`pickLoadedEntry`). Claude Code checks
+ *      the dependencies of the version it loads, which may be older than the
+ *      marketplace's latest;
+ *   2. its source in the local marketplace clone (the reader `requires.bin`
+ *      uses), for a plugin not installed yet;
+ *   3. any other installed copy — where a plugin whose marketplace entry
+ *      points at another repository lives.
+ */
+async function pluginManifestDirs(
+	pluginId: string,
+	projectPath: string,
+	sources: PluginManifestSources,
+): Promise<string[]> {
+	const dirs: string[] = [];
+	const installed: string[] = [];
+	try {
+		const registry = await readInstalledPluginsRegistry(sources.root);
+		const rows = registry.plugins?.[pluginId];
+		if (Array.isArray(rows)) {
+			const loaded = pickLoadedEntry(rows, projectPath)?.installPath;
+			if (loaded) dirs.push(loaded);
+			for (const row of rows) {
+				if (typeof row.installPath === "string" && row.installPath) {
+					installed.push(row.installPath);
+				}
+			}
 		}
 	} catch {
-		// Unreadable/malformed — treat as no requirements.
+		// No readable registry: the clone alone decides.
+	}
+	const clone = await (sources.clone ?? resolvePluginPath)(pluginId);
+	if (clone) dirs.push(clone);
+	return [...new Set([...dirs, ...installed])];
+}
+
+/**
+ * The plugin ids `pluginId` declares as dependencies (see
+ * {@link parsePluginDependencies}) in the copy Claude Code loads in
+ * `projectPath`, or null when no plugin.json for it can be read on this
+ * machine — reported by the caller, never guessed.
+ */
+export async function resolvePluginDependencies(
+	pluginId: string,
+	projectPath: string = process.cwd(),
+	sources: PluginManifestSources = {},
+): Promise<string[] | null> {
+	for (const dir of await pluginManifestDirs(pluginId, projectPath, sources)) {
+		const manifest = await readPluginManifest(dir);
+		if (manifest !== null) return parsePluginDependencies(manifest, pluginId);
 	}
-	return {};
+	return null;
 }
 
 /**