magus-cli 7.5.2 → 7.5.4

package/src/services/claude-settings.ts

@@ -37,7 +37,6 @@ import {
 	writableList,
 	writableMap,
 } from "./settings-file.js";
-import { refuseTrackedLiveFiles } from "./tracked-live-files.js";
 
 /**
  * What every reader below throws for a file that exists but does not parse.
@@ -149,11 +148,6 @@ export async function writeSettings(
 	settings: ClaudeSettings,
 	projectPath?: string,
 ): Promise<void> {
-	// In a project with profiles this file is generated: never written where
-	// git tracks it (see `tracked-live-files.ts`).
-	await refuseTrackedLiveFiles(projectPath ?? process.cwd(), [
-		getSettingsPath(projectPath),
-	]);
 	await refuseUnwritableFile(getSettingsPath(projectPath));
 	const claudeDir = await ensureClaudeDir(projectPath);
 	const settingsPath = path.join(claudeDir, SETTINGS_FILE);
@@ -197,7 +191,6 @@ export async function writeMcpConfig(
 	projectPath?: string,
 ): Promise<void> {
 	const mcpPath = getMcpConfigPath(projectPath);
-	await refuseTrackedLiveFiles(projectPath ?? process.cwd(), [mcpPath]);
 	await refuseUnwritableFile(mcpPath);
 	await fs.writeJson(mcpPath, config, { spaces: 2 });
 }
@@ -413,6 +406,34 @@ export function pickRegistryEntry(
 	return entries.find((e) => e.scope === "user");
 }
 
+/**
+ * The row a `claude plugin … --scope <scope>` run from `projectPath` owns: the
+ * user row for user scope; for project or local scope, the row of exactly that
+ * scope pinned to exactly this path.
+ *
+ * NOT {@link pickRegistryEntry}, which answers "what version applies here" and
+ * so falls back to inherited rows and then to the user row. That fallback asked
+ * the apply engine's "does this project hold a row?" guard made a plugin
+ * installed only at user scope, and turned on in project settings, look like it
+ * held a project row — so `claude plugin update --scope project` ran from a
+ * folder with none, and Claude Code updated some other project's row instead.
+ */
+export function ownRegistryEntry(
+	entries: InstalledPluginEntry[] | undefined,
+	scope: "user" | "project" | "local",
+	projectPath: string,
+): InstalledPluginEntry | undefined {
+	if (!Array.isArray(entries)) return undefined;
+	if (scope === "user") return entries.find((e) => e.scope === "user");
+	const target = path.resolve(projectPath);
+	return entries.find(
+		(e) =>
+			e.scope === scope &&
+			e.projectPath !== undefined &&
+			path.resolve(e.projectPath) === target,
+	);
+}
+
 async function overlayRegistryVersions(
 	base: Record<string, string>,
 	scope: "user" | "project" | "local",

package/src/services/gitignore-check.ts

@@ -1,63 +1,51 @@
 /**
- * Read-only gitignore check for the gitignore manager.
+ * The TUI's startup gitignore question.
  *
- * Called from the TUI on startup and from `doctor`. Resolves the manifest, runs
- * detection, and returns a concise warning when violations exist. Does NOT
- * auto-apply fixes — the user must open the Git State tab and confirm. This
- * mirrors the plugin-version-mismatch flow, where the check only *reports* and
- * the TUI provides the interactive fix dialog.
+ * Asked on every open (and again after a first adoption). Resolves the
+ * manifest — including, in a project with profiles, the files magus generates
+ * from `.claude/profiles.json` — runs detection, and reports. Nothing here
+ * applies a fix: the startup question applies the in-place fix only when the
+ * user picks it (`applyStartupFixes`), and every other destructive fix is
+ * confirmed per item in the Git State tab.
  */
 
 import type { Violation } from "../types/gitignore.js";
-import { detectViolations } from "./gitignore-detector.js";
-import { formatViolationSummary } from "./gitignore-fixer.js";
-import { resolveGitignore } from "./gitignore-resolver.js";
+import { loadGitignoreState } from "./gitignore-service.js";
 
-export interface GitignoreCheckResult {
+/** What the TUI's startup gitignore question needs to show. */
+export interface StartupGitignoreNeed {
 	violationCount: number;
-	warnings: string[];
-}
-
-export async function checkGitignore(
-	cwd: string,
-): Promise<GitignoreCheckResult> {
-	const warnings: string[] = [];
-	try {
-		const resolved = await resolveGitignore(cwd, {
-			logger: (m) => warnings.push(m),
-		});
-		const violations = await detectViolations(cwd, resolved);
-		return {
-			violationCount: violations.length,
-			warnings,
-		};
-	} catch (err) {
-		warnings.push(
-			`[gitignore] check failed: ${err instanceof Error ? err.message : String(err)}`,
-		);
-		return { violationCount: 0, warnings };
-	}
+	/** Missing `.gitignore` entries — the additive fix. */
+	safeCount: number;
+	/**
+	 * Files magus generates from `.claude/profiles.json` that git tracks — the
+	 * ones the startup fix untracks in place.
+	 */
+	generated: string[];
 }
 
 /**
- * One-line summary suitable for stderr. Returns null when there's
- * nothing to warn about.
+ * The startup gitignore question, or null when there is nothing to ask.
+ *
+ * Asked fresh on every call — the TUI calls it on every open, and again after
+ * a first adoption — and nothing remembers an earlier answer: a tracked
+ * generated file is asked about until it is fixed.
  */
-export function formatGitignoreWarning(
-	result: GitignoreCheckResult,
-): string | null {
-	if (result.violationCount === 0) return null;
-	return `⚠ ${result.violationCount} git state issue(s) detected. Run: magus → Git State tab to review and fix`;
+export async function startupGitignoreNeed(
+	cwd: string,
+): Promise<StartupGitignoreNeed | null> {
+	const { violations } = await loadGitignoreState(cwd);
+	if (violations.length === 0) return null;
+	return {
+		violationCount: violations.length,
+		safeCount: violations.filter((v) => v.severity === "safe").length,
+		generated: generatedTracked(violations).map((v) => v.path),
+	};
 }
 
-/**
- * Verbose multi-line summary, used by the Git State tab when the user wants
- * to know what's wrong before deciding what to do.
- */
-export async function describeViolations(
-	cwd: string,
-	violations: Violation[],
-): Promise<string> {
-	void cwd;
-	return formatViolationSummary(violations);
+/** The violations the startup fix handles in place: tracked generated files. */
+export function generatedTracked(violations: Violation[]): Violation[] {
+	return violations.filter(
+		(v) => v.kind === "tracked-but-should-ignore" && v.source === "profile",
+	);
 }

package/src/services/gitignore-resolver.ts

@@ -5,6 +5,10 @@
  *   1. Built-in defaults (shipped with magus)
  *   2. Global manifest at ~/.claude/gitignore.json (team-level, manually shared)
  *   3. Project manifest at <cwd>/.claude/gitignore.json
+ *   4. Profile: in a project with profiles, the files magus generates from
+ *      `.claude/profiles.json` (passed in as `opts.profile`). Highest, because
+ *      those files are rewritten per developer — tracking one cannot be right
+ *      whatever another manifest says.
  *
  * `extends` references are resolved against BUILTIN_TEMPLATES. Within a single
  * tier, the same pattern cannot appear in both `ignore` and `track` — that
@@ -33,9 +37,11 @@ export interface ResolveOptions {
 	homeDir?: string;
 	/** Optional logger for non-fatal warnings (malformed JSON, missing template). */
 	logger?: (msg: string) => void;
+	/** The profile tier — see `profileGitignoreManifest`. */
+	profile?: GitignoreManifest | null;
 }
 
-const TIER_ORDER: Tier[] = ["builtin", "global", "project"];
+const TIER_ORDER: Tier[] = ["builtin", "global", "project", "profile"];
 
 export async function resolveGitignore(
 	projectCwd: string,
@@ -59,6 +65,9 @@ export async function resolveGitignore(
 	const projectManifest = await readManifest(projectPath, log);
 	if (projectManifest) tierManifests.set("project", projectManifest);
 
+	// 4. The files the profile model generates
+	if (opts.profile) tierManifests.set("profile", opts.profile);
+
 	// Apply `extends` for each tier (templates count as part of their tier)
 	for (const tier of TIER_ORDER) {
 		const m = tierManifests.get(tier);

package/src/services/gitignore-service.ts

@@ -28,6 +28,7 @@ import {
 } from "./gitignore-fixer.js";
 import { resolveGitignore } from "./gitignore-resolver.js";
 import { readSettingsFile, writableList } from "./settings-file.js";
+import { profileGitignoreManifest } from "./tracked-live-files.js";
 
 export interface GitignoreState {
 	resolved: ResolvedManifest;
@@ -40,11 +41,77 @@ export async function loadGitignoreState(cwd: string): Promise<GitignoreState> {
 	const warnings: string[] = [];
 	const resolved = await resolveGitignore(cwd, {
 		logger: (m) => warnings.push(m),
+		profile: await profileGitignoreManifest(cwd),
 	});
 	const violations = await detectViolations(cwd, resolved);
 	return { resolved, violations, warnings };
 }
 
+export interface StartupFixResult {
+	/** Generated files removed from the index — staged, not committed. */
+	untracked: string[];
+	/** `.gitignore` entries added. */
+	appended: string[];
+	/** Files that could not be untracked, with git's reason. */
+	failed: Array<{ path: string; reason: string }>;
+}
+
+/**
+ * The startup question's fix, applied in place: every file magus generates
+ * from `.claude/profiles.json` that git tracks is removed from the index
+ * (`git rm --cached`, the existing tracked-but-should-ignore fix, which also
+ * makes sure `.gitignore` ignores it), and the additive `.gitignore` fixes
+ * are applied too. Every other violation is left for the Git State tab.
+ */
+export async function applyStartupFixes(
+	cwd: string,
+): Promise<StartupFixResult> {
+	const { resolved, violations } = await loadGitignoreState(cwd);
+	const generatedRules = resolved.rules
+		.filter((r) => r.source === "profile" && r.action === "ignore")
+		.map((r) => r.pattern);
+	const result: StartupFixResult = { untracked: [], appended: [], failed: [] };
+	for (const v of violations) {
+		if (v.kind !== "tracked-but-should-ignore" || v.source !== "profile") {
+			continue;
+		}
+		const rule =
+			generatedRules.find(
+				(p) => p === v.path || (p.endsWith("/") && v.path.startsWith(p)),
+			) ?? v.path;
+		try {
+			await coreApplyDestructiveFix(cwd, v, rule);
+			result.untracked.push(v.path);
+		} catch (error) {
+			result.failed.push({
+				path: v.path,
+				reason: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
+	result.appended = (await coreApplySafeFixes(cwd, violations)).appended;
+	return result;
+}
+
+/** What {@link applyStartupFixes} did, for the message the TUI shows. */
+export function describeStartupFix(result: StartupFixResult): string {
+	const lines: string[] = [];
+	if (result.untracked.length > 0) {
+		lines.push(
+			"Stopped tracking (the removal is staged — commit it):",
+			...result.untracked.map((p) => `  ${p}`),
+			'  git commit -m "Stop tracking generated Claude Code config"',
+		);
+	}
+	if (result.appended.length > 0) {
+		lines.push("Added to .gitignore:", ...result.appended.map((p) => `  ${p}`));
+	}
+	for (const f of result.failed) {
+		lines.push(`Could not untrack ${f.path}: ${f.reason}`);
+	}
+	return lines.length > 0 ? lines.join("\n") : "Nothing needed changing.";
+}
+
 export async function applyAllSafeFixes(
 	cwd: string,
 	violations: Violation[],

package/src/services/manifest.ts

@@ -7,6 +7,7 @@
  * structural subset of a v2 manifest entry, so migration is a version bump.
  */
 
+import os from "node:os";
 import path from "node:path";
 import fs from "fs-extra";
 import {
@@ -41,6 +42,36 @@ export function getManifestPath(projectPath?: string): string {
 	return path.join(base, MANIFEST_FILE);
 }
 
+/**
+ * The nearest ANCESTOR directory holding a `.claude/profiles.json`, searched no
+ * higher than the repository root — so magus can say so when it runs in a
+ * subdirectory.
+ *
+ * magus manages the directory it runs in because that is the project Claude Code
+ * reads: launched in `tools/magus`, it watches `tools/magus/.claude/settings.json`
+ * and never the root's (MEASURED with `--debug-file`, Claude Code 2.1.281). A
+ * root profiles.json is therefore not this directory's — but someone who meant
+ * the root has to hear that it exists before creating a second one here.
+ *
+ * A directory holding `.git` (file or folder) is a repository root, a worktree's
+ * included: nothing above it is searched, or a worktree under
+ * `<repo>/.claude/worktrees/` would find the main checkout's file. The home
+ * directory is never checked — its `.claude/` is Claude Code's user config.
+ */
+export async function findEnclosingManifest(
+	projectPath: string,
+): Promise<string | null> {
+	const home = os.homedir();
+	let dir = path.resolve(projectPath);
+	for (;;) {
+		if (await fs.pathExists(path.join(dir, ".git"))) return null;
+		const parent = path.dirname(dir);
+		if (parent === dir || parent === home) return null;
+		dir = parent;
+		if (await fs.pathExists(path.join(dir, MANIFEST_FILE))) return dir;
+	}
+}
+
 /** An empty, valid v2 manifest. */
 export function emptyManifest(): ProfileManifest {
 	return { version: 2, profiles: {} };

package/src/services/mate-availability.ts

@@ -28,15 +28,17 @@
  * silently. `getAvailablePlugins` resolves all three scopes and hands back both facts per
  * scope, which is all this module takes from it.
  *
- * The test on those facts is `servesAMate`, below, and it is deliberately NOT
- * `plugin-manager`'s `isInstalledInScope` — that one answers a narrower question. See the
- * comment on the predicate for why the two must not share a helper.
+ * The test on those facts is `servesAMate`, below, and it is built from `plugin-manager`'s
+ * own helpers rather than reading either fact itself, so a mate row and the plugin list
+ * cannot disagree about what "installed" means.
  */
 
 import {
 	type PluginInfo,
 	type ScopeStatus,
 	getAvailablePlugins,
+	isInstalledInScope,
+	scopeFilesMissing,
 } from "./plugin-manager.js";
 
 /** The plugin that puts claudish's model tools in reach. */
@@ -71,11 +73,23 @@ export function matesForced(env: NodeJS.ProcessEnv = process.env): boolean {
 }
 
 /**
- * True when `multimodel@magus` is installed in ANY scope.
+ * Can this scope actually serve a mate? Installed there, with its files present.
+ *
+ * Installed alone is not enough. Files missing is installed with no version: Claude Code
+ * wants to load the plugin and has nothing to load, so claudish is not reachable through it,
+ * and a row drawn on the strength of it promises routing that cannot happen — the one thing
+ * these rows must never claim.
+ */
+function servesAMate(scope: ScopeStatus | undefined): boolean {
+	return isInstalledInScope(scope) && !scopeFilesMissing(scope);
+}
+
+/**
+ * True when `multimodel@magus` is installed, with its files, in ANY scope.
  *
  * Any scope, because a mate is served by whatever Claude Code has loaded when the agent is
  * spawned, and that is the union of the three — a user-scope install serves a project that
- * enables nothing of its own.
+ * installs nothing of its own.
  *
  * FAILS CLOSED. This reaches the marketplace resolution path, which does network work and can
  * time out; a failure means "we do not know", and the honest rendering of not knowing is the
@@ -83,31 +97,11 @@ export function matesForced(env: NodeJS.ProcessEnv = process.env): boolean {
  * rows on screen on the strength of an error.
  *
  * `listPlugins` is injected the same way `buildSettingsPatch` takes its `resolveFullId`: the
- * DECISION here — which scopes count, what an enabled-but-not-installed plugin means, what a
- * thrown error means — is the part worth testing, and it cannot be tested through a function
- * that reaches the network and a real machine's registry. The default is the real one, so no
- * caller has to know the seam exists.
+ * DECISION here — which scopes count, what files missing means, what a thrown error means —
+ * is the part worth testing, and it cannot be tested through a function that reaches the
+ * network and a real machine's registry. The default is the real one, so no caller has to
+ * know the seam exists.
  */
-/**
- * Can this scope actually serve a mate? Both facts, not either one.
- *
- * Deliberately NOT `isInstalledInScope`, which asks a narrower question: that one means the
- * files are on disk, and says so — it dropped `enabled` from its test on purpose, so the
- * plugin list would stop offering to install what was already there.
- *
- * Presence on disk is not what this module needs. A plugin the user has switched off is not
- * loaded, so claudish is not reachable through it, so the routing a mate row advertises
- * cannot happen — which is the one thing these rows must never claim. The other half matters
- * for the mirror-image state: a settings flag with no registry version is the broken
- * enabled-but-not-installed case, and a row drawn on the strength of it promises a plugin
- * that never loaded.
- *
- * So both, and locally, rather than reaching for a shared helper whose meaning is owned by a
- * different question.
- */
-function servesAMate(scope: ScopeStatus | undefined): boolean {
-	return !!scope?.enabled && !!scope.version;
-}
 
 export async function areMatesAvailable(
 	projectPath?: string,