magus-cli 7.5.1 → 7.5.3

package/src/services/tracked-live-files.ts

@@ -1,76 +1,54 @@
 /**
- * magus never writes a generated file that git tracks.
+ * Generated files that git tracks: reported, never refused.
  *
- * In a project with profiles, `.claude/settings.json`, `.mcp.json` and
- * `.claude/models.json` are generated per developer from `.claude/profiles.json`.
- * A committed copy is the team's hand-kept file: writing it leaves git
- * tracking a file that now differs per developer, so every write shows as a
- * modified tracked file and one developer's plugin set gets committed for
- * everyone. `.gitignore` cannot fix that — it does not untrack a file already
- * committed. So every writer refuses, having written nothing, and says how to
- * stop tracking it; the user decides.
+ * In a project with profiles, `.claude/settings.json`, `.mcp.json`,
+ * `.claude/models.json` and the magus-installed skill folders are generated
+ * per developer from `.claude/profiles.json`, and are expected to be
+ * gitignored. A repository that committed one before adopting profiles keeps
+ * tracking it — `.gitignore` does not untrack a committed file.
  *
- * Activation checks every path it would write up front (`profile-activate.ts`).
- * This module holds the refusal itself, and the check for the writers outside
- * activation: the TUI's direct settings edits, `.mcp.json` edits, and the
- * Claude CLI's project-scope installs, which write `.claude/settings.json`.
+ * magus writes those files anyway: every command that writes them proceeds
+ * exactly as for an untracked file. What changes is what it says. The CLI
+ * prints one warning per tracked file with the fix (`git rm --cached <path>`,
+ * then commit) and never runs git itself; `magus doctor` reports it as a note;
+ * the TUI asks on every open and, when told to, untracks them in place
+ * (`gitignore-check.ts`, `profileGitignoreManifest`).
  */
 
 import path from "node:path";
+import type { GitignoreManifest } from "../types/gitignore.js";
 import { GitQueryError, trackedByGit } from "./git-worktree.js";
 import { getManifestPath, readProfilesFile } from "./manifest.js";
-
-/** magus refused to write a live file, and changed nothing. */
-export class LiveFileRefusal extends Error {}
-
-/** A live file magus would write is tracked by git. */
-export class TrackedLiveFileError extends LiveFileRefusal {
-	constructor(readonly paths: readonly string[]) {
-		const one = paths.length === 1;
-		super(
-			[
-				`magus will not write ${one ? "a file" : "files"} git tracks in this project — ${
-					one ? "it is" : "they are"
-				} generated from .claude/profiles.json and ${one ? "differs" : "differ"} per developer:`,
-				...paths.map((p) => `  ${p}`),
-				`Stop tracking ${one ? "it" : "them"}, commit, then run the command again:`,
-				...paths.map((p) => `  ${untrackCommand(p)}`),
-				'  git commit -m "Stop tracking generated Claude Code config"',
-				"Nothing was changed.",
-			].join("\n"),
-		);
-		this.name = "TrackedLiveFileError";
-	}
-}
+import {
+	LIVE_FILE_KEYS,
+	livePath,
+	readActiveMarker,
+	skillsRoot,
+} from "./profile-live.js";
 
 /**
  * The project is a git work tree, but git could not say what it tracks — it
  * timed out, is missing, or refused the repository (`detected dubious
- * ownership`). Answering "nothing is tracked" would let magus write a tracked
- * file, so it refuses instead and passes on git's own words.
+ * ownership`). Reported with git's own words wherever the check is made; it
+ * never stops a write.
  */
-export class GitCheckError extends LiveFileRefusal {
+export class GitCheckError extends Error {
 	constructor(readonly detail: string) {
 		super(
-			[
-				"magus could not check which files git tracks in this project, so it wrote nothing. git said:",
-				...detail
-					.trim()
-					.split("\n")
-					.map((line) => `  ${line}`),
-				"Fix that, then run the command again. Nothing was changed.",
-			].join("\n"),
+			`magus could not check which files git tracks in this project. git said: ${detail.trim()}`,
 		);
 		this.name = "GitCheckError";
 	}
 }
 
-/** How to untrack one generated path — `-r` for a skill folder. */
+/** How to untrack one generated path. */
 export function untrackCommand(rel: string): string {
-	const isDir =
-		rel.split(path.sep).length > 2 &&
-		rel.startsWith(path.join(".claude", "skills") + path.sep);
-	return isDir ? `git rm --cached -r ${rel}` : `git rm --cached ${rel}`;
+	return `git rm --cached ${rel}`;
+}
+
+/** The warning the CLI prints for one tracked generated path. */
+export function trackedWarning(rel: string): string {
+	return `${rel} is generated from .claude/profiles.json but tracked by git — run \`${untrackCommand(rel)}\`, then commit`;
 }
 
 /**
@@ -92,34 +70,70 @@ export async function trackedPaths(
 }
 
 /**
- * Does magus generate this project's live files — does its profiles.json
- * define a profile? A profiles.json that cannot be read counts as yes: the
- * check that follows only ever stops a write.
+ * Of `folders` under `.claude/skills/`, the ones git tracks — the team's own
+ * copies. A skill folder git tracks is the team's, never magus's: magus does
+ * not install over it, manage it, flag it or untrack it. Empty when git cannot
+ * say, so a failed git call never turns a team skill into one magus removes —
+ * it only leaves a folder magus recorded as its own until git answers.
  */
-async function hasProfiles(projectPath: string): Promise<boolean> {
+export async function trackedSkillFolders(
+	projectPath: string,
+	folders: readonly string[],
+): Promise<Set<string>> {
+	if (folders.length === 0) return new Set();
+	const root = path.relative(projectPath, skillsRoot(projectPath));
+	let tracked: Set<string>;
 	try {
-		const file = await readProfilesFile(getManifestPath(projectPath));
-		return Object.keys(file.profiles).length > 0;
-	} catch {
-		return true;
+		tracked = await trackedPaths(
+			projectPath,
+			[],
+			folders.map((folder) => path.join(root, folder)),
+		);
+	} catch (error) {
+		if (error instanceof GitCheckError) return new Set();
+		throw error;
 	}
+	return new Set(folders.filter((f) => tracked.has(path.join(root, f))));
 }
 
 /**
- * Throw {@link TrackedLiveFileError} — before anything is written — when
- * `projectPath` has profiles and git tracks any of `files` (absolute, or
- * relative to the project). A project without profiles owns its files by
- * hand, and writing them is not magus's to refuse.
+ * The gitignore rules the profile model implies, for the gitignore manager's
+ * `profile` tier — or null in a project without profiles.
+ *
+ * In a project with profiles — profiles.json defines at least one — the three
+ * live files and the magus-installed skill folders are generated per
+ * developer, so they must be ignored. The built-in defaults say to TRACK
+ * `.claude/settings.json` and `.mcp.json`, which is right for a project that
+ * writes them by hand; this tier overrides that for a profiled one, so a
+ * committed copy is reported as "tracked but should be ignored". A left-over
+ * marker in a repo that dropped profiles.json does not make it profiled.
+ *
+ * A skill folder git tracks is left out even when the marker records it:
+ * markers written by 7.5.0's conversion recorded committed skills as
+ * magus-installed, and the team's copy must never be flagged or untracked.
  */
-export async function refuseTrackedLiveFiles(
+export async function profileGitignoreManifest(
 	projectPath: string,
-	files: readonly string[],
-): Promise<void> {
-	if (!(await hasProfiles(projectPath))) return;
-	const rel = files.map((f) =>
-		path.isAbsolute(f) ? path.relative(projectPath, f) : f,
-	);
-	const tracked = await trackedPaths(projectPath, rel);
-	const hit = rel.filter((r) => tracked.has(r));
-	if (hit.length > 0) throw new TrackedLiveFileError(hit);
+): Promise<GitignoreManifest | null> {
+	try {
+		const file = await readProfilesFile(getManifestPath(projectPath));
+		if (Object.keys(file.profiles).length === 0) return null;
+	} catch {
+		return null; // An unreadable profiles.json is reported by every profile command.
+	}
+	const marker = await readActiveMarker(projectPath);
+	const managed = Object.keys(marker?.skills ?? {});
+	const committed = await trackedSkillFolders(projectPath, managed);
+	const posix = (abs: string) =>
+		path.relative(projectPath, abs).split(path.sep).join("/");
+	const skills = posix(skillsRoot(projectPath));
+	return {
+		ignore: [
+			...LIVE_FILE_KEYS.map((key) => posix(livePath(key, projectPath))),
+			...managed
+				.filter((folder) => !committed.has(folder))
+				.map((folder) => `${skills}/${folder}/`),
+		],
+		track: [],
+	};
 }

package/src/services/update-engine.ts

@@ -31,6 +31,7 @@
 
 import path from "node:path";
 import type {
+	InstalledPluginEntry,
 	ProfileSkillRef,
 	ResolvedBin,
 	SkillInfo,
@@ -43,9 +44,12 @@ import { installPlugin, repairPlugin, updatePlugin } from "./claude-cli.js";
 import {
 	type StaleLoadRepairResult,
 	loadedVersionHere,
+	readInstalledPluginsRegistry,
 	repairStaleLoad,
+	rowBelongsToRepository,
 } from "./claude-settings.js";
 import {
+	compareVersions,
 	isRepairablyBehind,
 	readInstalledVersionForScope,
 	saveInstalledPluginVersionForScope,
@@ -192,6 +196,21 @@ export interface PluginApplyDeps {
 		pluginId: string,
 		projectPath: string,
 	) => Promise<string | null>;
+	/**
+	 * Every registry row for a plugin, read fresh — compared before and after
+	 * `update` to see WHICH row Claude Code moved (see
+	 * {@link followMisdirectedUpdate}). Optional so a test double that does not
+	 * model the registry skips the comparison.
+	 */
+	registryRows?: (pluginId: string) => Promise<readonly InstalledPluginEntry[]>;
+	/**
+	 * Is a row this project's repository's — the rows the stale-load repair may
+	 * rewrite. Defaults to that repair's own predicate (`rowBelongsToRepository`).
+	 */
+	inThisRepository?: (
+		row: InstalledPluginEntry,
+		projectPath: string,
+	) => boolean;
 }
 
 export const REAL_PLUGIN_DEPS: PluginApplyDeps = {
@@ -202,8 +221,129 @@ export const REAL_PLUGIN_DEPS: PluginApplyDeps = {
 	saveInstalled: saveInstalledPluginVersionForScope,
 	repairStaleLoad,
 	loadedVersion: loadedVersionHere,
+	registryRows: async (pluginId) => {
+		const rows = (await readInstalledPluginsRegistry()).plugins?.[pluginId];
+		return Array.isArray(rows) ? rows : [];
+	},
 };
 
+/**
+ * An update Claude Code applied to another project's row instead of this one.
+ *
+ * Claude Code 2.1.281 changed `claude plugin update P --scope project`: it
+ * updates the FIRST registry row relevant to the repository — the row its
+ * loader would pick — not the row of the project it runs in. Measured
+ * 2026-09-24 on two APFS clones of one sandbox, same registry, cwd = the
+ * project:
+ *
+ *   2.1.280  updated from 8.0.0 to 8.1.3 for scope project (<sandbox>/magus-src)
+ *   2.1.281  updated from 8.0.0 to 8.1.3 for scope project (<sandbox>/magus-src/tools/claudeup)
+ *
+ * Both exit 0; under 2.1.281 this project's row stays at 8.0.0.
+ */
+export interface MisdirectedUpdate {
+	/** Where Claude Code wrote instead: each moved row's project path, or scope. */
+	elsewhere: string[];
+	/** The version it moved them to. */
+	version: string;
+	/** Why this project's row did not follow to `version`; null when it did. */
+	notFollowed: string | null;
+}
+
+/** One registry row's identity: scope, and the project it belongs to. */
+function rowKey(
+	row: Pick<InstalledPluginEntry, "scope" | "projectPath">,
+): string {
+	const where = row.projectPath ? path.resolve(row.projectPath) : "";
+	return `${row.scope}\u0000${where}`;
+}
+
+async function readRows(
+	deps: PluginApplyDeps,
+	pluginId: string,
+): Promise<readonly InstalledPluginEntry[] | null> {
+	if (!deps.registryRows) return null;
+	try {
+		return await deps.registryRows(pluginId);
+	} catch {
+		return null; // No readable registry: nothing to compare.
+	}
+}
+
+/**
+ * After `claude plugin update P --scope <scope>`: if this project's row did not
+ * move but another row OF THIS REPOSITORY did — Claude Code 2.1.281 updating
+ * the repository's first relevant row instead (see {@link MisdirectedUpdate})
+ * — move this project's row forward to that version, with the registry
+ * rewrite the stale-load repair performs. That repair refuses a version whose
+ * cache directory does not exist.
+ *
+ * Only rows the repair itself would rewrite count (`inThisRepository`): a row
+ * of another repository that happens to move while the CLI runs says nothing
+ * about this update. And when the update's `target` is known, the row must
+ * have reached exactly that version, or it is not followed.
+ *
+ * The row Claude Code moved is left as it is: it belongs to this repository,
+ * and bringing this repository's rows forward is what the repair does anyway.
+ * Null when there was nothing to follow — this project's row moved (2.1.280),
+ * or no row of this repository moved at all.
+ */
+async function followMisdirectedUpdate(
+	deps: PluginApplyDeps,
+	pluginId: string,
+	scope: PluginScope,
+	projectPath: string,
+	before: readonly InstalledPluginEntry[],
+	target: string | null,
+): Promise<MisdirectedUpdate | null> {
+	const now = await deps.readInstalled(pluginId, scope, projectPath);
+	const after = await readRows(deps, pluginId);
+	if (!now || !after) return null;
+	const inThisRepository = deps.inThisRepository ?? rowBelongsToRepository;
+	const was = new Map(before.map((row) => [rowKey(row), row.version]));
+	const moved = after.filter(
+		(row) =>
+			row.version &&
+			was.get(rowKey(row)) !== row.version &&
+			inThisRepository(row, projectPath),
+	);
+	const mine = rowKey({
+		scope,
+		projectPath: scope === "user" ? undefined : projectPath,
+	});
+	if (moved.length === 0 || moved.some((row) => rowKey(row) === mine)) {
+		return null;
+	}
+	const version = moved
+		.map((row) => row.version)
+		.reduce((a, b) => ((compareVersions(b, a) ?? 0) > 0 ? b : a));
+	if (!isRepairablyBehind(version, now)) return null;
+	const elsewhere = moved.map((row) => row.projectPath ?? `${row.scope} scope`);
+	if (target && version !== target) {
+		return {
+			elsewhere,
+			version,
+			notFollowed: `it went to v${version}, not the v${target} this update asked for`,
+		};
+	}
+	const repair = await deps.repairStaleLoad(pluginId, version, projectPath);
+	return {
+		elsewhere,
+		version,
+		notFollowed: repair.ok
+			? null
+			: (repair.error ?? "the registry was not rewritten"),
+	};
+}
+
+/** The words for a misdirected update, for an item's detail. */
+function describeMisdirected(m: MisdirectedUpdate): string {
+	const where = m.elsewhere.join(", ");
+	return m.notFollowed === null
+		? `Claude Code updated ${where} instead of this project — moved this project's record to v${m.version} too`
+		: `Claude Code updated ${where} instead of this project, and this project's record could not follow: ${m.notFollowed}`;
+}
+
 /**
  * After a plugin landed at `target` for `projectPath`: make sure that is the
  * version Claude Code actually loads there, and bring the loader forward when
@@ -319,10 +459,26 @@ async function advanceInScope(
 	pluginId: string,
 	scope: PluginScope,
 	projectPath: string,
-): Promise<void> {
+	/** The version this update targets, when known — see followMisdirectedUpdate. */
+	target: string | null = null,
+): Promise<MisdirectedUpdate | null> {
 	const here = await deps.readInstalled(pluginId, scope, projectPath);
-	if (here) await deps.update(pluginId, scope);
-	else await deps.install(pluginId, scope);
+	if (!here) {
+		await deps.install(pluginId, scope);
+		return null;
+	}
+	const before = await readRows(deps, pluginId);
+	await deps.update(pluginId, scope);
+	return before
+		? followMisdirectedUpdate(
+				deps,
+				pluginId,
+				scope,
+				projectPath,
+				before,
+				target,
+			)
+		: null;
 }
 
 /**
@@ -449,6 +605,7 @@ export async function applyPlugins(
 		report.begin(item.pluginId);
 		const startedAt = Date.now();
 		const landed: Array<[PluginScope, string | null]> = [];
+		const misdirected: MisdirectedUpdate[] = [];
 
 		try {
 			for (const scope of scopes) {
@@ -467,7 +624,14 @@ export async function applyPlugins(
 				} else if (item.action === "install") {
 					await deps.install(item.pluginId, scope);
 				} else {
-					await advanceInScope(deps, item.pluginId, scope, projectPath);
+					const m = await advanceInScope(
+						deps,
+						item.pluginId,
+						scope,
+						projectPath,
+						item.target,
+					);
+					if (m) misdirected.push(m);
 				}
 
 				// Record what LANDED, not what we asked for.
@@ -520,19 +684,24 @@ export async function applyPlugins(
 				);
 				result.failed.push(item.pluginId);
 			} else if (noMove && !forward) {
+				const why = misdirected.map(describeMisdirected);
 				report.finish(
 					true,
 					item.pluginId,
-					`no change — ${noMove}`,
+					`no change — ${noMove}${why.length > 0 ? ` (${why.join("; ")})` : ""}`,
 					Date.now() - startedAt,
 				);
 				result.unchanged.push(item.pluginId);
 			} else {
 				const moved = `${scopes.join(", ")}${item.target ? ` → ${item.target}` : ""}`;
+				const notes = [
+					...misdirected.map(describeMisdirected),
+					...(forward ? [describeLoadForward(forward)] : []),
+				];
 				report.finish(
 					true,
 					item.pluginId,
-					forward ? `${moved} · ${describeLoadForward(forward)}` : moved,
+					[moved, ...notes].join(" · "),
 					Date.now() - startedAt,
 				);
 				result.ok++;
@@ -621,8 +790,12 @@ export async function updatePluginInScope(
 	deps: PluginApplyDeps = REAL_PLUGIN_DEPS,
 ): Promise<string | null> {
 	// Same guard as the apply loop, for the same reason — see advanceInScope.
+	// A misdirected update is followed there; the version read back afterwards
+	// is what this returns.
 	return applyOneInScope(
-		(id, sc) => advanceInScope(deps, id, sc, projectPath),
+		async (id, sc) => {
+			await advanceInScope(deps, id, sc, projectPath);
+		},
 		pluginId,
 		scope,
 		projectPath,

package/src/ui/App.tsx

@@ -7,10 +7,13 @@ import {
 	recoverMarketplaceSettings,
 	repairAllStaleLoads,
 } from "../services/claude-settings.js";
-import { checkGitignore } from "../services/gitignore-check.js";
 import {
-	applyAllSafeFixes,
-	loadGitignoreState,
+	type StartupGitignoreNeed,
+	startupGitignoreNeed,
+} from "../services/gitignore-check.js";
+import {
+	applyStartupFixes,
+	describeStartupFix,
 } from "../services/gitignore-service.js";
 import { repairAllMarketplaces } from "../services/local-marketplace.js";
 import { autoAddMissingMarketplaces } from "../services/marketplace-sync.js";
@@ -261,10 +264,8 @@ function AppContent({ onExit }: AppContentProps) {
 	const [updateInfo, setUpdateInfo] = useState<VersionCheckResult | null>(null);
 	const [recoveryReport, setRecoveryReport] = useState<string | null>(null);
 	const [profileNotices, setProfileNotices] = useState<string[]>([]);
-	const [gitignoreData, setGitignoreData] = useState<{
-		violationCount: number;
-		safeCount: number;
-	} | null>(null);
+	const [gitignoreData, setGitignoreData] =
+		useState<StartupGitignoreNeed | null>(null);
 	const [profileNeed, setProfileNeed] = useState<ProfileStartupNeed | null>(
 		null,
 	);
@@ -273,9 +274,22 @@ function AppContent({ onExit }: AppContentProps) {
 		null,
 	);
 	const staleLoadModal = useStaleLoadModal();
+	// The gitignore question, asked fresh: on every open, and again once the
+	// profile modal has activated a profile — a first adoption is what turns a
+	// committed settings.json into a generated file git should not track.
+	// Nothing remembers an earlier answer.
+	const checkGitignoreNow = React.useCallback(() => {
+		startupGitignoreNeed(process.cwd())
+			.then((need) => {
+				if (need) setGitignoreData(need);
+			})
+			.catch(() => {
+				// non-fatal: the Git State tab still shows the same rows
+			});
+	}, []);
 	// The profile modal cannot be dismissed, so it needs the app's own exit: its
 	// only non-action is to leave.
-	const profileModal = useProfileStartupModal(onExit);
+	const profileModal = useProfileStartupModal(onExit, checkGitignoreNow);
 
 	// Check for updates on startup, then re-check periodically (force-bypassing
 	// the session cache) so the banner reflects a release that lands while
@@ -318,10 +332,11 @@ function AppContent({ onExit }: AppContentProps) {
 		gitignoreModal.show({
 			violationCount: gitignoreData.violationCount,
 			safeCount: gitignoreData.safeCount,
-			onFixSafe: async () => {
-				const s = await loadGitignoreState(state.projectPath);
-				await applyAllSafeFixes(state.projectPath, s.violations);
-			},
+			generated: gitignoreData.generated,
+			// In place, then back to the app: tracked generated files are
+			// untracked, missing entries added; other items stay for the tab.
+			onFixSafe: async () =>
+				describeStartupFix(await applyStartupFixes(state.projectPath)),
 		});
 		setGitignoreData(null);
 	}, [gitignoreData, gitignoreModal, state.modal, state.projectPath]);
@@ -389,6 +404,13 @@ function AppContent({ onExit }: AppContentProps) {
 		setProfileNeed(null);
 	}, [profileNeed, profileModal, state.modal]);
 
+	// The gitignore question on every open. Its own effect, NOT part of the
+	// marketplace block below, which returns early on `--no-refresh`: that flag
+	// is about network calls and must not silence this question.
+	useEffect(() => {
+		checkGitignoreNow();
+	}, [checkGitignoreNow]);
+
 	// Is this project actually running a profile? Detection only — nothing is
 	// written until the user picks something in the modal. The Profiles tab could
 	// list two profiles while the project ran neither, and nothing anywhere said
@@ -470,27 +492,6 @@ function AppContent({ onExit }: AppContentProps) {
 			})
 			.catch(() => {}); // non-fatal
 
-		// Check for gitignore manifest violations and surface a popup if any.
-		// Loads twice (once for count, once when user picks "fix safe") because
-		// the second load happens after edits — keeps detection cheap on startup.
-		(async () => {
-			try {
-				const result = await checkGitignore(process.cwd());
-				if (result.violationCount > 0) {
-					const s = await loadGitignoreState(process.cwd());
-					const safeCount = s.violations.filter(
-						(v) => v.severity === "safe",
-					).length;
-					setGitignoreData({
-						violationCount: result.violationCount,
-						safeCount,
-					});
-				}
-			} catch {
-				// non-fatal
-			}
-		})();
-
 		repairAllMarketplaces()
 			.then(async () => {
 				dispatch({ type: "HIDE_PROGRESS" });