magus-cli 7.5.0 → 7.5.2

package/src/services/resolver.ts

@@ -5,7 +5,8 @@
  * marketplaces, plugins, MCP servers, binary deps, skills, settings, and env a
  * machine must have to match the profile. Binary deps are the union of the
  * profile's own `cliTools` and every enabled plugin's declared `requires.bin`,
- * deduped by executable name with the project's pin winning.
+ * deduped by executable name with the project's pin winning. Plugins include
+ * every plugin an enabled one declares as a dependency, transitively.
  */
 
 import semver from "semver";
@@ -14,12 +15,17 @@ import { getMarketplaceByName } from "../data/marketplaces.js";
 import { PREDEFINED_PROFILES } from "../data/predefined-profiles.js";
 import type {
 	BinRequirement,
+	DependencyReport,
 	ProfileManifest,
 	ProfileManifestEntry,
 	ResolvedBin,
 	ResolvedClosure,
 } from "../types/index.js";
 import { readManifest } from "./manifest.js";
+import {
+	type PluginDependencyReader,
+	readPluginDependencies,
+} from "./plugin-dependencies.js";
 import { resolvePluginBinRequirements } from "./plugin-requires.js";
 import { activeProfile } from "./profile-live.js";
 
@@ -29,6 +35,61 @@ export interface ResolveOptions {
 	 * tests; defaults to reading plugin.json from the marketplace cache.
 	 */
 	binResolver?: (pluginId: string) => Promise<BinRequirement[]>;
+	/**
+	 * Resolve a plugin id to the plugin ids its plugin.json declares as
+	 * dependencies, or null when it cannot be read. Defaults to reading the
+	 * plugin.json on this machine (`readPluginDependencies`).
+	 */
+	dependencyResolver?: PluginDependencyReader;
+}
+
+/**
+ * Every plugin the `enabled` plugins depend on, transitively, as their own
+ * plugin.json files declare it.
+ *
+ * Claude Code refuses to load a plugin whose dependency is not enabled, so a
+ * dependency is part of what a profile enables — derived, never written into
+ * profiles.json. A dependency the profile itself turns off (`off`) is left
+ * off and reported as `blocked`; nothing it depends on is followed. A plugin
+ * whose plugin.json cannot be read is reported as `unreadable` rather than
+ * guessed at.
+ */
+export async function resolveDependencies(
+	enabled: readonly string[],
+	off: ReadonlySet<string>,
+	read: PluginDependencyReader,
+): Promise<DependencyReport> {
+	const derived: string[] = [];
+	const unreadable: string[] = [];
+	const blocked: DependencyReport["blocked"] = [];
+	const queue = [...enabled];
+	const seen = new Set(enabled);
+	for (let id = queue.shift(); id !== undefined; id = queue.shift()) {
+		const dependencies = await read(id);
+		if (dependencies === null) {
+			unreadable.push(id);
+			continue;
+		}
+		for (const dependency of dependencies) {
+			if (off.has(dependency)) {
+				blocked.push({ plugin: id, dependency });
+				continue;
+			}
+			if (seen.has(dependency)) continue;
+			seen.add(dependency);
+			derived.push(dependency);
+			queue.push(dependency);
+		}
+	}
+	return { derived: derived.sort(), unreadable: unreadable.sort(), blocked };
+}
+
+function hasDependencies(report: DependencyReport): boolean {
+	return (
+		report.derived.length > 0 ||
+		report.unreadable.length > 0 ||
+		report.blocked.length > 0
+	);
 }
 
 /** Normalize a manifest plugins map to pluginId -> version ("latest" for true). */
@@ -234,16 +295,25 @@ export async function resolveProfile(
 	const binResolver = opts.binResolver ?? resolvePluginBinRequirements;
 
 	const plugins = normalizePlugins(entry.plugins);
-	const bins = await resolveBins(entry, Object.keys(plugins), binResolver);
-
 	const disabledPlugins = Object.entries(entry.plugins ?? {})
 		.filter(([, ver]) => ver === false)
 		.map(([id]) => id);
 
+	// The plugins the enabled ones need in order to load at all.
+	const dependencies = await resolveDependencies(
+		Object.keys(plugins),
+		new Set(disabledPlugins),
+		opts.dependencyResolver ?? readPluginDependencies,
+	);
+	for (const id of dependencies.derived) plugins[id] = "latest";
+
+	const bins = await resolveBins(entry, Object.keys(plugins), binResolver);
+
 	return {
 		marketplaces: withDerivedMarketplaces(entry.marketplaces, plugins),
 		plugins,
 		...(disabledPlugins.length > 0 ? { disabledPlugins } : {}),
+		...(hasDependencies(dependencies) ? { dependencies } : {}),
 		mcpServers: { ...(entry.mcpServers ?? {}) },
 		bins,
 		skills: [...(entry.skills ?? [])],
@@ -333,6 +403,9 @@ function mergeClosures(
 		}
 	}
 
+	// Dependency reports: union, for `install` and `doctor` to report.
+	const dependencies = mergeDependencyReports(a.dependencies, b.dependencies);
+
 	// Skills: union by repo+path.
 	const skillKey = (s: { repo: string; path: string }) => `${s.repo}#${s.path}`;
 	const skillMap = new Map(b.skills.map((s) => [skillKey(s), s]));
@@ -353,6 +426,26 @@ function mergeClosures(
 			optional: [...new Set([...a.env.optional, ...b.env.optional])],
 		},
 		...(conflicts.length > 0 ? { conflicts: [...new Set(conflicts)] } : {}),
+		...(dependencies ? { dependencies } : {}),
+	};
+}
+
+function mergeDependencyReports(
+	a: DependencyReport | undefined,
+	b: DependencyReport | undefined,
+): DependencyReport | undefined {
+	if (!a) return b;
+	if (!b) return a;
+	const blocked = new Map(
+		[...a.blocked, ...b.blocked].map((x) => [
+			`${x.plugin}\u0000${x.dependency}`,
+			x,
+		]),
+	);
+	return {
+		derived: [...new Set([...a.derived, ...b.derived])].sort(),
+		unreadable: [...new Set([...a.unreadable, ...b.unreadable])].sort(),
+		blocked: [...blocked.values()],
 	};
 }
 

package/src/services/tracked-live-files.ts

@@ -0,0 +1,125 @@
+/**
+ * magus never writes a generated file that git tracks.
+ *
+ * In a project with profiles, `.claude/settings.json`, `.mcp.json` and
+ * `.claude/models.json` are generated per developer from `.claude/profiles.json`.
+ * A committed copy is the team's hand-kept file: writing it leaves git
+ * tracking a file that now differs per developer, so every write shows as a
+ * modified tracked file and one developer's plugin set gets committed for
+ * everyone. `.gitignore` cannot fix that — it does not untrack a file already
+ * committed. So every writer refuses, having written nothing, and says how to
+ * stop tracking it; the user decides.
+ *
+ * Activation checks every path it would write up front (`profile-activate.ts`).
+ * This module holds the refusal itself, and the check for the writers outside
+ * activation: the TUI's direct settings edits, `.mcp.json` edits, and the
+ * Claude CLI's project-scope installs, which write `.claude/settings.json`.
+ */
+
+import path from "node:path";
+import { GitQueryError, trackedByGit } from "./git-worktree.js";
+import { getManifestPath, readProfilesFile } from "./manifest.js";
+
+/** magus refused to write a live file, and changed nothing. */
+export class LiveFileRefusal extends Error {}
+
+/** A live file magus would write is tracked by git. */
+export class TrackedLiveFileError extends LiveFileRefusal {
+	constructor(readonly paths: readonly string[]) {
+		const one = paths.length === 1;
+		super(
+			[
+				`magus will not write ${one ? "a file" : "files"} git tracks in this project — ${
+					one ? "it is" : "they are"
+				} generated from .claude/profiles.json and ${one ? "differs" : "differ"} per developer:`,
+				...paths.map((p) => `  ${p}`),
+				`Stop tracking ${one ? "it" : "them"}, commit, then run the command again:`,
+				...paths.map((p) => `  ${untrackCommand(p)}`),
+				'  git commit -m "Stop tracking generated Claude Code config"',
+				"Nothing was changed.",
+			].join("\n"),
+		);
+		this.name = "TrackedLiveFileError";
+	}
+}
+
+/**
+ * The project is a git work tree, but git could not say what it tracks — it
+ * timed out, is missing, or refused the repository (`detected dubious
+ * ownership`). Answering "nothing is tracked" would let magus write a tracked
+ * file, so it refuses instead and passes on git's own words.
+ */
+export class GitCheckError extends LiveFileRefusal {
+	constructor(readonly detail: string) {
+		super(
+			[
+				"magus could not check which files git tracks in this project, so it wrote nothing. git said:",
+				...detail
+					.trim()
+					.split("\n")
+					.map((line) => `  ${line}`),
+				"Fix that, then run the command again. Nothing was changed.",
+			].join("\n"),
+		);
+		this.name = "GitCheckError";
+	}
+}
+
+/** How to untrack one generated path — `-r` for a skill folder. */
+export function untrackCommand(rel: string): string {
+	const isDir =
+		rel.split(path.sep).length > 2 &&
+		rel.startsWith(path.join(".claude", "skills") + path.sep);
+	return isDir ? `git rm --cached -r ${rel}` : `git rm --cached ${rel}`;
+}
+
+/**
+ * Which of `files` (exact entries) and `dirs` (any file under them) git
+ * tracks, relative to `projectPath`. Empty outside a git work tree; throws
+ * {@link GitCheckError} when inside one and git cannot answer.
+ */
+export async function trackedPaths(
+	projectPath: string,
+	files: readonly string[],
+	dirs: readonly string[] = [],
+): Promise<Set<string>> {
+	try {
+		return await trackedByGit(projectPath, files, dirs);
+	} catch (error) {
+		if (error instanceof GitQueryError) throw new GitCheckError(error.detail);
+		throw error;
+	}
+}
+
+/**
+ * Does magus generate this project's live files — does its profiles.json
+ * define a profile? A profiles.json that cannot be read counts as yes: the
+ * check that follows only ever stops a write.
+ */
+async function hasProfiles(projectPath: string): Promise<boolean> {
+	try {
+		const file = await readProfilesFile(getManifestPath(projectPath));
+		return Object.keys(file.profiles).length > 0;
+	} catch {
+		return true;
+	}
+}
+
+/**
+ * Throw {@link TrackedLiveFileError} — before anything is written — when
+ * `projectPath` has profiles and git tracks any of `files` (absolute, or
+ * relative to the project). A project without profiles owns its files by
+ * hand, and writing them is not magus's to refuse.
+ */
+export async function refuseTrackedLiveFiles(
+	projectPath: string,
+	files: readonly string[],
+): Promise<void> {
+	if (!(await hasProfiles(projectPath))) return;
+	const rel = files.map((f) =>
+		path.isAbsolute(f) ? path.relative(projectPath, f) : f,
+	);
+	const tracked = await trackedPaths(projectPath, rel);
+	const hit = rel.filter((r) => tracked.has(r));
+	if (hit.length > 0) throw new TrackedLiveFileError(hit);
+}

package/src/services/update-engine.ts

@@ -31,6 +31,7 @@
 
 import path from "node:path";
 import type {
+	InstalledPluginEntry,
 	ProfileSkillRef,
 	ResolvedBin,
 	SkillInfo,
@@ -42,9 +43,14 @@ import type { PluginScope } from "./claude-cli.js";
 import { installPlugin, repairPlugin, updatePlugin } from "./claude-cli.js";
 import {
 	type StaleLoadRepairResult,
+	loadedVersionHere,
+	readInstalledPluginsRegistry,
 	repairStaleLoad,
+	rowBelongsToRepository,
 } from "./claude-settings.js";
 import {
+	compareVersions,
+	isRepairablyBehind,
 	readInstalledVersionForScope,
 	saveInstalledPluginVersionForScope,
 } from "./plugin-manager.js";
@@ -181,6 +187,30 @@ export interface PluginApplyDeps {
 		target: string,
 		projectPath: string,
 	) => Promise<StaleLoadRepairResult>;
+	/**
+	 * The version Claude Code's loader resolves for a plugin in a project — the
+	 * question an install must ask afterwards (see {@link bringLoadForward}).
+	 * Optional so a test double that does not model the loader skips the check.
+	 */
+	loadedVersion?: (
+		pluginId: string,
+		projectPath: string,
+	) => Promise<string | null>;
+	/**
+	 * Every registry row for a plugin, read fresh — compared before and after
+	 * `update` to see WHICH row Claude Code moved (see
+	 * {@link followMisdirectedUpdate}). Optional so a test double that does not
+	 * model the registry skips the comparison.
+	 */
+	registryRows?: (pluginId: string) => Promise<readonly InstalledPluginEntry[]>;
+	/**
+	 * Is a row this project's repository's — the rows the stale-load repair may
+	 * rewrite. Defaults to that repair's own predicate (`rowBelongsToRepository`).
+	 */
+	inThisRepository?: (
+		row: InstalledPluginEntry,
+		projectPath: string,
+	) => boolean;
 }
 
 export const REAL_PLUGIN_DEPS: PluginApplyDeps = {
@@ -190,8 +220,168 @@ export const REAL_PLUGIN_DEPS: PluginApplyDeps = {
 	readInstalled: readInstalledVersionForScope,
 	saveInstalled: saveInstalledPluginVersionForScope,
 	repairStaleLoad,
+	loadedVersion: loadedVersionHere,
+	registryRows: async (pluginId) => {
+		const rows = (await readInstalledPluginsRegistry()).plugins?.[pluginId];
+		return Array.isArray(rows) ? rows : [];
+	},
 };
 
+/**
+ * An update Claude Code applied to another project's row instead of this one.
+ *
+ * Claude Code 2.1.281 changed `claude plugin update P --scope project`: it
+ * updates the FIRST registry row relevant to the repository — the row its
+ * loader would pick — not the row of the project it runs in. Measured
+ * 2026-09-24 on two APFS clones of one sandbox, same registry, cwd = the
+ * project:
+ *
+ *   2.1.280  updated from 8.0.0 to 8.1.3 for scope project (<sandbox>/magus-src)
+ *   2.1.281  updated from 8.0.0 to 8.1.3 for scope project (<sandbox>/magus-src/tools/claudeup)
+ *
+ * Both exit 0; under 2.1.281 this project's row stays at 8.0.0.
+ */
+export interface MisdirectedUpdate {
+	/** Where Claude Code wrote instead: each moved row's project path, or scope. */
+	elsewhere: string[];
+	/** The version it moved them to. */
+	version: string;
+	/** Why this project's row did not follow to `version`; null when it did. */
+	notFollowed: string | null;
+}
+
+/** One registry row's identity: scope, and the project it belongs to. */
+function rowKey(
+	row: Pick<InstalledPluginEntry, "scope" | "projectPath">,
+): string {
+	const where = row.projectPath ? path.resolve(row.projectPath) : "";
+	return `${row.scope}\u0000${where}`;
+}
+
+async function readRows(
+	deps: PluginApplyDeps,
+	pluginId: string,
+): Promise<readonly InstalledPluginEntry[] | null> {
+	if (!deps.registryRows) return null;
+	try {
+		return await deps.registryRows(pluginId);
+	} catch {
+		return null; // No readable registry: nothing to compare.
+	}
+}
+
+/**
+ * After `claude plugin update P --scope <scope>`: if this project's row did not
+ * move but another row OF THIS REPOSITORY did — Claude Code 2.1.281 updating
+ * the repository's first relevant row instead (see {@link MisdirectedUpdate})
+ * — move this project's row forward to that version, with the registry
+ * rewrite the stale-load repair performs. That repair refuses a version whose
+ * cache directory does not exist.
+ *
+ * Only rows the repair itself would rewrite count (`inThisRepository`): a row
+ * of another repository that happens to move while the CLI runs says nothing
+ * about this update. And when the update's `target` is known, the row must
+ * have reached exactly that version, or it is not followed.
+ *
+ * The row Claude Code moved is left as it is: it belongs to this repository,
+ * and bringing this repository's rows forward is what the repair does anyway.
+ * Null when there was nothing to follow — this project's row moved (2.1.280),
+ * or no row of this repository moved at all.
+ */
+async function followMisdirectedUpdate(
+	deps: PluginApplyDeps,
+	pluginId: string,
+	scope: PluginScope,
+	projectPath: string,
+	before: readonly InstalledPluginEntry[],
+	target: string | null,
+): Promise<MisdirectedUpdate | null> {
+	const now = await deps.readInstalled(pluginId, scope, projectPath);
+	const after = await readRows(deps, pluginId);
+	if (!now || !after) return null;
+	const inThisRepository = deps.inThisRepository ?? rowBelongsToRepository;
+	const was = new Map(before.map((row) => [rowKey(row), row.version]));
+	const moved = after.filter(
+		(row) =>
+			row.version &&
+			was.get(rowKey(row)) !== row.version &&
+			inThisRepository(row, projectPath),
+	);
+	const mine = rowKey({
+		scope,
+		projectPath: scope === "user" ? undefined : projectPath,
+	});
+	if (moved.length === 0 || moved.some((row) => rowKey(row) === mine)) {
+		return null;
+	}
+	const version = moved
+		.map((row) => row.version)
+		.reduce((a, b) => ((compareVersions(b, a) ?? 0) > 0 ? b : a));
+	if (!isRepairablyBehind(version, now)) return null;
+	const elsewhere = moved.map((row) => row.projectPath ?? `${row.scope} scope`);
+	if (target && version !== target) {
+		return {
+			elsewhere,
+			version,
+			notFollowed: `it went to v${version}, not the v${target} this update asked for`,
+		};
+	}
+	const repair = await deps.repairStaleLoad(pluginId, version, projectPath);
+	return {
+		elsewhere,
+		version,
+		notFollowed: repair.ok
+			? null
+			: (repair.error ?? "the registry was not rewritten"),
+	};
+}
+
+/** The words for a misdirected update, for an item's detail. */
+function describeMisdirected(m: MisdirectedUpdate): string {
+	const where = m.elsewhere.join(", ");
+	return m.notFollowed === null
+		? `Claude Code updated ${where} instead of this project — moved this project's record to v${m.version} too`
+		: `Claude Code updated ${where} instead of this project, and this project's record could not follow: ${m.notFollowed}`;
+}
+
+/**
+ * After a plugin landed at `target` for `projectPath`: make sure that is the
+ * version Claude Code actually loads there, and bring the loader forward when
+ * it is not.
+ *
+ * The loader takes the FIRST registry row relevant to the repository, and rows
+ * from this repository's other checkouts — deleted worktrees included — often
+ * precede this project's own row. `claude plugin install|update` writes only
+ * this project's row, so a successful update could leave the plugin showing
+ * "updated" and loading the old version at once (measured: an update wrote
+ * 2.0.5 to this project's row while eight earlier rows held 2.0.4, and
+ * `--debug-file` showed 2.0.4 loading). So the update runs the stale-load
+ * repair as its own last step — the same `repairStaleLoad` the `stale-load`
+ * state uses, moving this repository's older rows forward to `target`.
+ *
+ * Null when nothing needed doing (the loader already resolves `target`, or the
+ * dep that asks it is absent); otherwise the repair's result, which the caller
+ * reports — `ok: false` means the plugin still does not load `target`.
+ */
+export async function bringLoadForward(
+	pluginId: string,
+	target: string,
+	projectPath: string,
+	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
+): Promise<StaleLoadRepairResult | null> {
+	if (!deps.loadedVersion) return null;
+	const loaded = await deps.loadedVersion(pluginId, projectPath);
+	if (!isRepairablyBehind(target, loaded)) return null;
+	return deps.repairStaleLoad(pluginId, target, projectPath);
+}
+
+/** The words for a load brought forward, appended to an item's detail. */
+function describeLoadForward(outcome: StaleLoadRepairResult): string {
+	return `Claude Code now loads v${outcome.target} here (${outcome.rewritten} older record${
+		outcome.rewritten === 1 ? "" : "s"
+	} moved forward)`;
+}
+
 // -- selection ---------------------------------------------------------------
 
 /**
@@ -269,10 +459,26 @@ async function advanceInScope(
 	pluginId: string,
 	scope: PluginScope,
 	projectPath: string,
-): Promise<void> {
+	/** The version this update targets, when known — see followMisdirectedUpdate. */
+	target: string | null = null,
+): Promise<MisdirectedUpdate | null> {
 	const here = await deps.readInstalled(pluginId, scope, projectPath);
-	if (here) await deps.update(pluginId, scope);
-	else await deps.install(pluginId, scope);
+	if (!here) {
+		await deps.install(pluginId, scope);
+		return null;
+	}
+	const before = await readRows(deps, pluginId);
+	await deps.update(pluginId, scope);
+	return before
+		? followMisdirectedUpdate(
+				deps,
+				pluginId,
+				scope,
+				projectPath,
+				before,
+				target,
+			)
+		: null;
 }
 
 /**
@@ -399,6 +605,7 @@ export async function applyPlugins(
 		report.begin(item.pluginId);
 		const startedAt = Date.now();
 		const landed: Array<[PluginScope, string | null]> = [];
+		const misdirected: MisdirectedUpdate[] = [];
 
 		try {
 			for (const scope of scopes) {
@@ -417,7 +624,14 @@ export async function applyPlugins(
 				} else if (item.action === "install") {
 					await deps.install(item.pluginId, scope);
 				} else {
-					await advanceInScope(deps, item.pluginId, scope, projectPath);
+					const m = await advanceInScope(
+						deps,
+						item.pluginId,
+						scope,
+						projectPath,
+						item.target,
+					);
+					if (m) misdirected.push(m);
 				}
 
 				// Record what LANDED, not what we asked for.
@@ -448,19 +662,46 @@ export async function applyPlugins(
 				}
 			}
 			const noMove = pluginNoMove(item, landed);
-			if (noMove) {
+			// What landed here — the project row when there is one, since that is
+			// the row the loader must end up agreeing with.
+			const here =
+				landed.find(([scope]) => scope === "project")?.[1] ??
+				landed.find(([, actual]) => actual)?.[1] ??
+				null;
+			const forward = here
+				? await bringLoadForward(item.pluginId, here, projectPath, deps)
+				: null;
+			if (forward && !forward.ok) {
+				// Installed, but not what loads: that is not "updated". Reported as
+				// a failure with the repair's own reason, so nothing says current.
+				report.finish(
+					false,
+					item.pluginId,
+					`installed v${here}, but Claude Code still loads v${
+						forward.loaded ?? "an older version"
+					} here — ${forward.error ?? "the older records could not be moved forward"}`,
+					Date.now() - startedAt,
+				);
+				result.failed.push(item.pluginId);
+			} else if (noMove && !forward) {
+				const why = misdirected.map(describeMisdirected);
 				report.finish(
 					true,
 					item.pluginId,
-					`no change — ${noMove}`,
+					`no change — ${noMove}${why.length > 0 ? ` (${why.join("; ")})` : ""}`,
 					Date.now() - startedAt,
 				);
 				result.unchanged.push(item.pluginId);
 			} else {
+				const moved = `${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`;
+				const notes = [
+					...misdirected.map(describeMisdirected),
+					...(forward ? [describeLoadForward(forward)] : []),
+				];
 				report.finish(
 					true,
 					item.pluginId,
-					`${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`,
+					[moved, ...notes].join(" · "),
 					Date.now() - startedAt,
 				);
 				result.ok++;
@@ -499,6 +740,19 @@ async function applyOneInScope(
 	await run(pluginId, scope);
 	const actual = await deps.readInstalled(pluginId, scope, projectPath);
 	if (actual) await deps.saveInstalled(pluginId, actual, scope, projectPath);
+	// The same last step as the apply loop, at every scope: installed must mean
+	// loaded here. `repairStaleLoad` itself refuses — and says why — when the
+	// winning record is not one this repository's rows can move.
+	if (actual) {
+		const forward = await bringLoadForward(pluginId, actual, projectPath, deps);
+		if (forward && !forward.ok) {
+			throw new Error(
+				`installed v${actual}, but Claude Code still loads v${
+					forward.loaded ?? "an older version"
+				} here — ${forward.error ?? "the older records could not be moved forward"}`,
+			);
+		}
+	}
 	return actual;
 }
 
@@ -536,8 +790,12 @@ export async function updatePluginInScope(
 	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
 ): Promise<string | null> {
 	// Same guard as the apply loop, for the same reason — see advanceInScope.
+	// A misdirected update is followed there; the version read back afterwards
+	// is what this returns.
 	return applyOneInScope(
-		(id, sc) => advanceInScope(deps, id, sc, projectPath),
+		async (id, sc) => {
+			await advanceInScope(deps, id, sc, projectPath);
+		},
 		pluginId,
 		scope,
 		projectPath,

package/src/types/index.ts

@@ -471,4 +471,23 @@ export interface ResolvedClosure {
 	env: { required: string[]; optional: string[] };
 	/** Cross-profile version conflicts detected while unioning profiles. */
 	conflicts?: string[];
+	/**
+	 * What the enabled plugins' own plugin.json files require — present when
+	 * anything was derived or could not be read. The derived ids are already
+	 * in `plugins`.
+	 */
+	dependencies?: DependencyReport;
+}
+
+/**
+ * The dependencies a profile's enabled plugins declare, resolved transitively.
+ * Derived, never recorded: profiles.json names none of them.
+ */
+export interface DependencyReport {
+	/** Enabled only because an enabled plugin depends on them. Sorted. */
+	derived: string[];
+	/** Enabled plugins whose plugin.json could not be read here. Sorted. */
+	unreadable: string[];
+	/** A dependency the profile itself turns off: `plugin` will not load. */
+	blocked: Array<{ plugin: string; dependency: string }>;
 }

package/src/ui/screens/PluginsScreen.tsx

@@ -44,6 +44,7 @@ import {
 	fetchPluginContents,
 	fetchPluginSkillDetail,
 } from "../../services/skills-manager.js";
+import { LiveFileRefusal } from "../../services/tracked-live-files.js";
 // The one update implementation, shared with `magus update`. See the header
 // of update-engine.ts for what drifted while the TUI had its own loop.
 import {
@@ -982,7 +983,11 @@ export function PluginsScreen() {
 				fetchData();
 			} catch (error) {
 				modal.hideModal();
-				await modal.message("Error", `Failed: ${error}`, "error");
+				await modal.message(
+					"Error",
+					error instanceof LiveFileRefusal ? error.message : `Failed: ${error}`,
+					"error",
+				);
 			}
 		}
 	};
@@ -1202,7 +1207,11 @@ export function PluginsScreen() {
 			fetchData();
 		} catch (error) {
 			modal.hideModal();
-			await modal.message("Error", `Failed: ${error}`, "error");
+			await modal.message(
+				"Error",
+				error instanceof LiveFileRefusal ? error.message : `Failed: ${error}`,
+				"error",
+			);
 		}
 	};