magus-cli 7.7.0 → 7.8.0

package/src/services/claude-cli.ts

@@ -10,6 +10,8 @@
  */
 
 import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
 import { promisify } from "node:util";
 import { defaultMarketplaces } from "../data/marketplaces.js";
 import { which } from "../utils/command-utils.js";
@@ -28,13 +30,12 @@ export type PluginScope = "user" | "project" | "local";
  * Get the path to the claude CLI binary
  * @throws Error if claude CLI is not found in PATH
  */
+const CLAUDE_NOT_FOUND =
+	"claude CLI not found in PATH. Install with: npm install -g @anthropic-ai/claude-code";
+
 async function getClaudePath(): Promise<string> {
 	const claudePath = await which("claude");
-	if (!claudePath) {
-		throw new Error(
-			"claude CLI not found in PATH. Install with: npm install -g @anthropic-ai/claude-code",
-		);
-	}
+	if (!claudePath) throw new Error(CLAUDE_NOT_FOUND);
 	return claudePath;
 }
 
@@ -42,29 +43,84 @@ async function getClaudePath(): Promise<string> {
  * Execute a claude CLI command and return stdout
  * @param args - Arguments to pass to claude
  * @param timeoutMs - Timeout in milliseconds (default: 30s)
+ * @param cwd - Working directory; Claude Code resolves project and local
+ *   scope from it. Defaults to this process's.
  * @returns stdout from the command
  */
-async function execClaude(args: string[], timeoutMs = 30000): Promise<string> {
+async function execClaude(
+	args: string[],
+	timeoutMs = 30000,
+	cwd?: string,
+): Promise<string> {
 	const claudePath = await getClaudePath();
 	try {
 		const { stdout } = await execFileAsync(claudePath, args, {
 			timeout: timeoutMs,
+			...(cwd ? { cwd } : {}),
 		});
 		return stdout.trim();
 	} catch (error: unknown) {
-		const execError = error as {
-			stderr?: string;
-			stdout?: string;
-			message?: string;
-			code?: number;
-		};
-		const msg =
-			execError.stderr?.trim() ||
-			execError.stdout?.trim() ||
-			execError.message ||
-			"claude command failed";
-		throw new Error(msg);
+		throw new Error(claudeFailureMessage(error, args, timeoutMs, cwd));
+	}
+}
+
+/**
+ * What a failed `claude` command says, in the words a user reads.
+ *
+ * Claude Code's own output first — stderr, then stdout — since that is the
+ * reason. Only when it printed nothing does Node's error message stand in, and
+ * that one opens with `Command failed: /absolute/path/to/claude plugin …`:
+ * the path and the argument list are the mechanism, not the reason, so that
+ * line is dropped and what follows it kept. A run that was killed for taking
+ * too long says so.
+ *
+ * A spawn that fails with ENOENT is not always a missing `claude`: Node and
+ * Bun both report a working directory that does not exist the same way,
+ * naming the binary. So when the run was given a `cwd` that is gone, that is
+ * what is said — by the folder's name, never its absolute path — rather than
+ * telling someone with Claude Code installed to install it.
+ */
+export function claudeFailureMessage(
+	error: unknown,
+	args: readonly string[],
+	timeoutMs: number,
+	cwd?: string,
+): string {
+	const execError = error as {
+		code?: string | number;
+		stderr?: string;
+		stdout?: string;
+		message?: string;
+		killed?: boolean;
+		signal?: string | null;
+	};
+	const output = execError.stderr?.trim() || execError.stdout?.trim();
+	if (output) return output;
+	if (execError.killed) {
+		return `claude ${args.slice(0, 2).join(" ")} did not finish within ${Math.round(timeoutMs / 1000)}s`;
+	}
+	const message = execError.message ?? "";
+	// The binary vanished between the PATH lookup and the spawn (Node says
+	// `spawn <path> ENOENT`, Bun `Executable not found in $PATH`). Same fact as
+	// the lookup failing, so the same words — and never the absolute path.
+	if (
+		execError.code === "ENOENT" ||
+		/\bENOENT\b|Executable not found in \$PATH/.test(message)
+	) {
+		if (cwd && !existsSync(cwd)) {
+			return `the folder ${path.basename(cwd) || cwd} no longer exists`;
+		}
+		return CLAUDE_NOT_FOUND;
+	}
+	if (execError.code === "EACCES" || /\bEACCES\b/.test(message)) {
+		return "claude could not be started: permission denied";
 	}
+	const rest = message
+		.replace(/^Command failed: [^\n]*\n?/, "")
+		// Any leftover mention of the binary by absolute path is mechanism.
+		.replace(/(?:\/[^\s/:]+)+\/claude\b/g, "claude")
+		.trim();
+	return rest || `claude ${args.slice(0, 2).join(" ")} failed`;
 }
 
 /**
@@ -186,6 +242,32 @@ export async function uninstallPlugin(
 	}
 }
 
+/**
+ * Uninstall through `claude plugin uninstall` and NOTHING else: its error is
+ * thrown, never absorbed.
+ *
+ * {@link uninstallPlugin} falls back to editing the settings files directly
+ * when the command fails. That fallback is a direct writer of Claude Code's
+ * files, and it turns every failure into an apparent success — so a caller
+ * that reads the result back, as removing a deprecated plugin does, could
+ * never see why the plugin was still there. This one lets the command's own
+ * words reach the caller.
+ *
+ * Runs in `projectPath` when given, because Claude Code resolves project and
+ * local scope from its working directory.
+ */
+export async function uninstallPluginViaCli(
+	pluginId: string,
+	scope: PluginScope,
+	projectPath?: string,
+): Promise<void> {
+	await execClaude(
+		["plugin", "uninstall", pluginId, "--scope", scope],
+		30000,
+		projectPath,
+	);
+}
+
 /**
  * Repair a plugin whose files drifted from the marketplace under an unchanged
  * version — uninstall, then install again at the same scope.
@@ -270,7 +352,12 @@ export async function disablePlugin(
  * {@link installPlugin}, and content drift under an unchanged version still
  * needs {@link repairPlugin} — `update` has no version bump to act on there.
  *
- * Retries with marketplace update on "not found" errors (same as installPlugin).
+ * On a "not found in marketplace" error it recovers once and retries, exactly
+ * as {@link installPlugin} does (see `recoverMissingMarketplace`): a registered
+ * marketplace has its source repaired and its clone fast-forwarded with
+ * `git pull --ff-only` — never `claude plugin marketplace update`, which
+ * deletes the clone before re-cloning — and a missing clone or an unregistered
+ * default marketplace is added with `claude plugin marketplace add`.
  */
 export async function updatePlugin(
 	pluginId: string,

package/src/services/claude-settings.ts

@@ -573,6 +573,58 @@ export async function removeLocalInstalledPluginVersion(
 	);
 }
 
+/**
+ * Take `pluginId` out of `installedPluginVersions` at `scope`, and touch
+ * nothing else.
+ *
+ * `installedPluginVersions` is magus's own field — Claude Code never writes it
+ * — so a plugin Claude Code uninstalled still has a claim there until magus
+ * clears it, and a stale claim is how an uninstalled plugin kept reading as
+ * installed. Unlike the `remove*InstalledPluginVersion` fallbacks above, this
+ * leaves `enabledPlugins` and the registry alone: those are Claude Code's, and
+ * the uninstall that just ran is what changed them. A file with no claim for
+ * the plugin is not rewritten.
+ */
+export async function forgetInstalledPluginVersion(
+	pluginId: string,
+	scope: "user" | "project" | "local",
+	projectPath?: string,
+): Promise<void> {
+	if (scope === "user") {
+		const settings = await readGlobalSettings();
+		const versions = writableMap(
+			settings,
+			"installedPluginVersions",
+			getGlobalSettingsPath(),
+		);
+		if (!versions || !Object.hasOwn(versions, pluginId)) return;
+		delete versions[pluginId];
+		await writeGlobalSettings(settings);
+		return;
+	}
+	if (scope === "local") {
+		const settings = await readLocalSettings(projectPath);
+		const versions = writableMap(
+			settings,
+			"installedPluginVersions",
+			getLocalSettingsPath(projectPath),
+		);
+		if (!versions || !Object.hasOwn(versions, pluginId)) return;
+		delete versions[pluginId];
+		await writeLocalSettings(settings, projectPath);
+		return;
+	}
+	const settings = await readSettings(projectPath);
+	const versions = writableMap(
+		settings,
+		"installedPluginVersions",
+		getSettingsPath(projectPath),
+	);
+	if (!versions || !Object.hasOwn(versions, pluginId)) return;
+	delete versions[pluginId];
+	await writeSettings(settings, projectPath);
+}
+
 // Status line management
 // Claude Code expects statusLine as an object: { type: "template", template: "..." }
 // or { type: "command", command: "..." }. Writing a bare string causes a validation error
@@ -1992,9 +2044,8 @@ export async function removeFromInstalledPluginsRegistry(
  *    the reach it states, so those rows are never written here. When such a row is
  *    the one that WINS, the repair refuses outright and names the scope — silently
  *    rewriting nothing would be the worse answer of the two.
- *  - A null repository root matches null in the loader (two rootless directories
- *    are relevant to each other there, and this port now says so). It must not
- *    match here: "the same repository" cannot be true of two directories that are
+ *  - A null repository root matches nothing, here and (since Claude Code
+ *    2.1.284) in the loader too: "the same repository" cannot be true of two directories that are
  *    in no repository at all, and treating it as true would have a repair run
  *    from a scratch directory rewrite another scratch directory's rows. Only the
  *    exact same directory qualifies without a root.
@@ -2209,6 +2260,15 @@ export async function loadedVersionHere(
 	}
 }
 
+/**
+ * {@link repairStaleLoad}'s refusal when `target` has no downloaded copy to
+ * point Claude Code at. Exported so a caller that already names the version —
+ * "installed v1.3.0, but …" — can say it without repeating it.
+ */
+export function notDownloadedReason(target: string): string {
+	return `v${target} is not downloaded — run magus install`;
+}
+
 /**
  * What one {@link repairStaleLoad} attempt did, and whether it worked.
  *
@@ -2326,9 +2386,7 @@ export async function repairStaleLoad(
 		root,
 	);
 	if (!(await fs.pathExists(cacheDir))) {
-		return fail(
-			`no cache directory for v${target} — ${cacheDir} does not exist`,
-		);
+		return fail(notDownloadedReason(target));
 	}
 
 	const file = installedPluginsFile(root);
@@ -2336,22 +2394,22 @@ export async function repairStaleLoad(
 	// precondition the write is checked against, so they have to describe one
 	// moment — see `writeInstalledPluginsRegistry`.
 	const before = await readRegistryBytes(file);
-	if (before === null) return fail(`${file} does not exist`);
+	if (before === null) return fail("no plugin is installed on this machine");
 	let registry: InstalledPluginsRegistry;
 	try {
 		registry = requireRegistry(file, before);
-	} catch (error) {
+	} catch {
 		// The same check every other reader makes; a repair reports it as a result
 		// rather than throwing, because it is one item in a plan of many.
+		// Why it does not parse is `magus doctor`'s to show; here it is only the
+		// reason nothing was changed.
 		return fail(
-			`${file} is not a readable registry — refusing to write over it: ${
-				error instanceof Error ? error.message : String(error)
-			}`,
+			"Claude Code's list of installed plugins cannot be read, so nothing was changed — run magus doctor",
 		);
 	}
 	const rows = registry.plugins[pluginId];
 	if (!Array.isArray(rows) || rows.length === 0) {
-		return fail(`${pluginId} has no rows in ${file}`);
+		return fail("it is not installed on this machine");
 	}
 
 	// One cache for the whole pass: the same project paths repeat across rows,
@@ -2374,13 +2432,9 @@ export async function repairStaleLoad(
 		// `LoaderScope` in plugin-resolution.ts.
 		const scope: string = winner.scope;
 		return fail(
-			`the row Claude Code loads here is the machine-wide ${scope}-scope record at v${
-				winner.version
-			}, which every project on this machine resolves through. This repair only rewrites THIS repository's records, so it will not move it. ${
-				scope === "managed"
-					? "A managed record is administrator policy — raise it with whoever set that policy."
-					: `Update that scope directly instead: claude plugin install ${pluginId} --scope user`
-			}`,
+			scope === "managed"
+				? "Claude Code loads the install your administrator manages here — ask them to update it"
+				: "Claude Code loads the USER install of it here — update it at USER scope",
 		);
 	}
 
@@ -2398,11 +2452,9 @@ export async function repairStaleLoad(
 		try {
 			backup = await registryBackupPath(file, pluginId);
 			await fs.copy(file, backup);
-		} catch (error) {
+		} catch {
 			return fail(
-				`could not back up ${file}: ${
-					error instanceof Error ? error.message : String(error)
-				}`,
+				"could not save a backup before changing anything, so nothing was changed",
 			);
 		}
 
@@ -2428,10 +2480,8 @@ export async function repairStaleLoad(
 			if (backup) await fs.remove(backup).catch(() => {});
 			return fail(
 				error instanceof RegistryChangedError
-					? error.message
-					: `could not write ${file}: ${
-							error instanceof Error ? error.message : String(error)
-						}`,
+					? "another Claude Code session changed its plugins at the same moment, so nothing was changed — run it again"
+					: "the change could not be saved, so nothing was changed",
 			);
 		}
 		await pruneRegistryBackups(file);
@@ -2444,12 +2494,8 @@ export async function repairStaleLoad(
 	let after: InstalledPluginsRegistry;
 	try {
 		after = await readInstalledPluginsRegistry(root);
-	} catch (error) {
-		return fail(
-			`could not re-read ${file} to confirm the repair: ${
-				error instanceof Error ? error.message : String(error)
-			}`,
-		);
+	} catch {
+		return fail("the change was saved, but could not be checked afterwards");
 	}
 	const loaded =
 		pickLoadedEntry(after.plugins[pluginId], projectPath)?.version ?? null;
@@ -2470,8 +2516,10 @@ export async function repairStaleLoad(
 		backup,
 		loaded,
 		ok: false,
-		error: `the loader still resolves ${
-			loaded ? `v${loaded}` : "nothing"
-		} here, not v${target}`,
+		// The user's words, not the mechanism's: this reaches both front ends
+		// verbatim as the reason an item failed, grouped by that reason.
+		error: loaded
+			? `Claude Code still loads v${loaded} in this folder`
+			: "Claude Code loads no version of it in this folder",
 	};
 }

package/src/services/plugin-env-needs.ts

@@ -0,0 +1,69 @@
+/**
+ * Which variables a plugin's MCP server needs and does not have yet.
+ *
+ * DERIVED FROM CURRENT CONFIG, every time: the plugin's own MCP config names
+ * the `${VAR}` references, and a variable counts as set when this project's
+ * MCP variables hold it or magus's environment carries it. Nothing records
+ * that the user declined to set them — so the Plugins screen's "needs N
+ * settings" state disappears on its own the moment they are set, however
+ * they were set.
+ *
+ * One function for both the install flow (which asks for exactly these) and
+ * the detail panel (which states them), so the two cannot disagree.
+ */
+
+import { getMcpEnvVars } from "./claude-settings.js";
+import {
+	type PluginEnvRequirement,
+	getPluginEnvRequirements,
+	getPluginSourcePath,
+} from "./plugin-mcp-config.js";
+
+/** The reads, injectable so a test needs no marketplace clone on disk. */
+export interface PluginEnvNeedsDeps {
+	sourcePath: (
+		marketplace: string,
+		pluginName: string,
+	) => Promise<string | undefined>;
+	requirements: (
+		marketplace: string,
+		pluginSource: string,
+	) => Promise<PluginEnvRequirement[]>;
+	configured: (projectPath?: string) => Promise<Record<string, string>>;
+}
+
+const REAL_DEPS: PluginEnvNeedsDeps = {
+	sourcePath: getPluginSourcePath,
+	requirements: getPluginEnvRequirements,
+	configured: getMcpEnvVars,
+};
+
+/**
+ * The variables `pluginName`'s MCP servers reference that are set nowhere —
+ * empty when it has no MCP server, needs nothing, or has everything.
+ *
+ * Throws when the project's variables cannot be read (a settings file that
+ * does not parse): "needs nothing" would be a guess.
+ */
+export async function missingPluginEnvVars(
+	marketplace: string,
+	pluginName: string,
+	projectPath?: string,
+	env: Readonly<Record<string, string | undefined>> = process.env,
+	deps: PluginEnvNeedsDeps = REAL_DEPS,
+): Promise<PluginEnvRequirement[]> {
+	const source = await deps.sourcePath(marketplace, pluginName);
+	if (!source) return [];
+	const requirements = await deps.requirements(marketplace, source);
+	if (requirements.length === 0) return [];
+	const configured = await deps.configured(projectPath);
+	return requirements.filter((req) => !configured[req.name] && !env[req.name]);
+}
+
+/**
+ * The detail panel's words for a plugin whose MCP server lacks variables:
+ * what is missing, then the one key that sets them.
+ */
+export function mcpSettingsNeededText(count: number): string {
+	return `its MCP server needs ${count} ${count === 1 ? "setting" : "settings"} — press e to set ${count === 1 ? "it" : "them"}`;
+}

package/src/services/plugin-manager.ts

@@ -162,17 +162,6 @@ export interface PluginInfo {
 	 * a reinstall delivers the current content. See content-drift.ts.
 	 */
 	contentStale?: boolean;
-	/**
-	 * Set when this plugin's installed version changed since magus last
-	 * rendered it — including updates made by Claude Code or a direct CLI call
-	 * rather than by magus itself. Drives the "updated" badge.
-	 */
-	recentlyUpdatedFrom?: string;
-	/**
-	 * Set when magus is seeing this plugin installed for the first time.
-	 * Never set on the very first run, when there is no baseline to compare to.
-	 */
-	recentlyInstalled?: boolean;
 	/**
 	 * Which catalog supplied `version` — i.e. the number this plugin's installed
 	 * version was compared against.
@@ -389,6 +378,28 @@ export function resolveScopeAction(
 	return behind ? "update" : "uninstall";
 }
 
+/**
+ * The plugin ids the Plugins list may show as installed-but-unlisted rows.
+ *
+ * Installed means a key in this project's `enabledPlugins`, or registry rows.
+ * A version in `installedPluginVersions` with neither behind it is not an
+ * install: Claude Code never writes that field, so such a claim is a leftover
+ * of magus's own, and building a row from it showed a plugin nothing had
+ * installed — the settings key treated as authority, which it never is.
+ */
+export function orphanCandidateIds(
+	enabledPlugins: Readonly<Record<string, boolean>>,
+	installedVersions: Readonly<Record<string, string>>,
+	registryPlugins: InstalledPluginsRegistry["plugins"] | undefined,
+): Set<string> {
+	return new Set([
+		...Object.keys(enabledPlugins),
+		...Object.keys(installedVersions).filter(
+			(id) => (registryPlugins?.[id]?.length ?? 0) > 0,
+		),
+	]);
+}
+
 export async function getAvailablePlugins(
 	projectPath?: string,
 ): Promise<PluginInfo[]> {
@@ -402,8 +413,9 @@ export async function getAvailablePlugins(
 	// ported in services/plugin-resolution.ts. Resolved once for the whole
 	// registry and carried alongside `installedVersion` on every row below; where
 	// the two disagree, the classifier calls it `stale-load`.
+	const registry = await readInstalledPluginsRegistry();
 	const loadedVersions = resolveLoadedVersions(
-		await readInstalledPluginsRegistry(),
+		registry,
 		projectPath ?? process.cwd(),
 	);
 	const loadedVersionOf = (pluginId: string): string | null =>
@@ -568,13 +580,13 @@ export async function getAvailablePlugins(
 		}
 	}
 
-	// Add orphaned plugins (in this project's settings or registry, but not in any cache)
-	const allPluginIds = new Set([
-		...Object.keys(enabledPlugins),
-		...Object.keys(installedVersions),
-	]);
-
-	for (const pluginId of allPluginIds) {
+	// Add orphaned plugins (in this project's settings or registry, but not in
+	// any cache) — see `orphanCandidateIds` for what counts as installed.
+	for (const pluginId of orphanCandidateIds(
+		enabledPlugins,
+		installedVersions,
+		registry.plugins,
+	)) {
 		if (seenPluginIds.has(pluginId)) continue;
 
 		const parsed = parsePluginId(pluginId);

package/src/services/plugin-resolution.ts

@@ -4,7 +4,12 @@
  * Ported from Claude Code 2.1.274, decompiled: the relevance filter `SF`
  * (byte 178070986) and the selection function `Bls` (byte 178140984). The port
  * was validated against the real loader over 123/123 plugin resolutions across
- * 12 repositories and worktrees. RE-VALIDATE IT WHEN CLAUDE CODE UPDATES —
+ * 12 repositories and worktrees. Re-derived from 2.1.284 (`Aw` at byte
+ * 188165906, `t5t` at 188274660): the picker is unchanged, and the relevance
+ * filter now rejects a row with no `projectPath` and matches nothing by root when
+ * the current folder is in no repository (see {@link isRelevantInstallation}).
+ * Checked against `--debug-file` in a rootless folder (7/7) and in a repository
+ * (11/11). RE-VALIDATE IT WHEN CLAUDE CODE UPDATES —
  * this file describes someone else's algorithm, so a new release can move it
  * without anything here failing.
  *
@@ -21,26 +26,14 @@
  * This module holds NO magus policy. It answers the second question only, so
  * that a disagreement between the two is visible rather than averaged away.
  *
- * KNOWN DIVERGENCES from the decompiled original, both of which only ever REMOVE
- * candidates — so each can make this module name an entry the loader does not
- * use, and neither can make it miss one the loader does use:
- *
- *  1. The binary additionally rejects an entry whose `installPath` fails a
- *     path-safety check (`suspect(installPath)`). Not ported — every
- *     `installPath` is treated as non-suspect here.
- *  2. The binary's relevance filter reads `entry.projectPath === originalCwd ||
- *     repoRoot(entry.projectPath) === repoRoot(originalCwd)` with no guard on
- *     `projectPath` being absent at all. A project-scope row carrying no
- *     `projectPath` is rejected outright here (`isRelevantInstallation`), because
- *     what `repoRoot(undefined)` answers inside the binary was not measured and
- *     guessing it would put a row into the selection on a guess. Claude Code
- *     writes `projectPath` for every project-scope install, so the case is
- *     theoretical rather than observed.
- *
- * A THIRD divergence was removed rather than documented: two rootless paths used
- * to compare unequal here, so in a directory belonging to no repository every
- * rootless row was irrelevant to magus while the loader still counted it. See
- * {@link isRelevantInstallation}.
+ * ONE KNOWN DIVERGENCE from the decompiled original: the binary additionally
+ * rejects an entry whose `installPath` fails a path-safety check
+ * (`suspect(installPath)`). Not ported — every `installPath` is treated as
+ * non-suspect here. That check only ever removes candidates, so skipping it can
+ * make this module name an entry the loader does not use, never miss one the
+ * loader does use. A row's `projectPath` is compared as the raw string the
+ * binary compares — normalising it once added candidates the loader rejects —
+ * so path handling is not a second divergence.
  */
 
 import fs from "node:fs";
@@ -193,28 +186,27 @@ export function isRelevantInstallation(
 	if (isMachineWideScope(entry.scope)) return true;
 	if (!entry.projectPath) return false;
 
-	// The binary compares the two paths as raw strings. They are normalised here
-	// first, which can only turn a spelling difference of the same directory
-	// ("/p/a/" vs "/p/a") into a match — and that same pair already matches on
-	// the repository-root comparison below, which normalises on the way through.
-	if (path.resolve(entry.projectPath) === path.resolve(cwd)) return true;
-
-	// NULL MATCHES NULL, because the original's `repoRoot(entry.projectPath) ===
-	// repoRoot(originalCwd)` does: two directories in no repository at all compare
-	// equal there, so every rootless row competes when Claude Code runs from a
-	// scratch directory, a home directory, or any plain non-git folder.
+	// Raw strings, exactly as the binary compares them. Normalising first looked
+	// harmless — "/p/a/" and "/p/a" are the same directory — but it is not a
+	// no-op: in a folder outside any repository the root comparison below
+	// matches nothing, so normalisation was the ONLY thing that could make that
+	// pair relevant, and it added a candidate the loader rejects.
 	//
-	// This used to `return false` on a null `cwdRoot`, on the reasoning that two
-	// unrelated rootless directories are not the same project. That reasoning is
-	// magus policy, and this module holds none: with it, magus could name a
-	// `loadedVersion` the loader would not pick, and a repair would skip the very
-	// rows the loader treats as relevant — the same class of wrong answer the port
-	// exists to eliminate.
-	//
-	// The policy did not disappear, it moved to where it belongs: `repairStaleLoad`
-	// rewrites a row only when it belongs to THIS repository, which requires either
-	// the exact same directory or a non-null shared root. So a rootless row from an
-	// unrelated directory is reported as relevant (true) and never written (correct).
+	// Only `cwd` is resolved, because it stands in for the binary's own working
+	// directory, which is always absolute and has no trailing slash; a caller
+	// handing over "./x" or "/p/a/" means that directory. The row's path is
+	// compared exactly as written, as the binary compares it.
+	if (entry.projectPath === path.resolve(cwd)) return true;
+
+	// A directory in no repository matches NOTHING by root. Claude Code 2.1.284
+	// guards the comparison (`Aw` at byte 188165906:
+	// `let r=Zx(n);return r!==null&&Zx(e.projectPath)===r`), so in a rootless
+	// folder only its own rows and the machine-wide ones count. 2.1.274 had no
+	// guard and two nulls compared equal, which this port used to copy — and so
+	// named, in every rootless folder, versions from strangers' rows that the
+	// loader never looks at. Measured on 2.1.284 with `--debug-file` in a rootless
+	// folder: 7 of 7 plugins matched this rule, 2 of 7 matched the old one.
+	if (cwdRoot === null) return false;
 	return repoRootForPath(entry.projectPath, cache) === cwdRoot;
 }
 

package/src/services/profile-activate.ts

@@ -209,8 +209,7 @@ export function releasedCommittedSkillNote(folder: string): string {
 
 /**
  * Lines describing what activation did beyond the switch itself, phrased for
- * the terminal. The TUI words its own, shorter set (`activationNotices` in
- * ui/hooks/useProfileStartupModal.ts).
+ * the terminal.
  *
  * `tracked: false` leaves the tracked-path notices out, for the CLI, which
  * prints them itself as a warning with the fix beneath it