magus-cli 7.7.0 → 7.9.0

package/src/__tests__/fixtures/bins.ts

@@ -0,0 +1,55 @@
+/**
+ * Test builders for requirements, from the version-managed shape tests read
+ * best (`{ name, via, package, version }`), through the one bridge production
+ * uses (`managedOption`). Shared so no test hand-builds the `SelectedBin`
+ * shape its own way.
+ */
+
+import { type CliTool, cliTools, isOwnedEntry } from "../../data/cli-tools.js";
+import { ownedCliTool } from "../../services/cli-tool-commands.js";
+import { managedOption } from "../../services/toolchain.js";
+import type {
+	ManagedTool,
+	ResolvedBin,
+	SelectedBin,
+} from "../../types/index.js";
+
+/** A selected requirement whose one option (and choice) is `t`'s installer. */
+export function selected(t: ManagedTool, root?: string): SelectedBin {
+	const option = managedOption(t);
+	return {
+		name: t.name,
+		check: (t.check ?? `${t.name} --version`).trim().split(/\s+/),
+		install: [option],
+		chosen: option,
+		...(root ? { root } : {}),
+	};
+}
+
+/** {@link selected}, with provenance. */
+export function resolved(t: ManagedTool, sources: string[]): ResolvedBin {
+	return { ...selected(t), sources };
+}
+
+/**
+ * A plugin-owned catalogue tool's requirement as its plugin declares it today:
+ * a bun install of the package named after the tool.
+ */
+export async function ownedAsDeclared(
+	_pluginId: string,
+	name: string,
+): Promise<SelectedBin> {
+	return selected({ name, via: "bun", package: name });
+}
+
+/** The catalogue as CLI tools, owned entries resolved as {@link ownedAsDeclared}. */
+export function testCatalogue(): CliTool[] {
+	return cliTools.map((entry) =>
+		isOwnedEntry(entry)
+			? (ownedCliTool(
+					entry,
+					selected({ name: entry.name, via: "bun", package: entry.name }),
+				) as CliTool)
+			: entry,
+	);
+}

package/src/__tests__/format-update-outcome.test.ts

@@ -64,7 +64,6 @@ describe("REQ-12 formatUpdateOutcome: what the TUI shows after Update it now", (
 	test('REQ-12a a problem makes the outcome "failed" with the fixed title and the problem in the message, even when the state reads ok', () => {
 		const result: ProfileStartup = {
 			need: needIn("ok"),
-			notices: [],
 			problems: ["boom"],
 		};
 
@@ -79,7 +78,7 @@ describe("REQ-12 formatUpdateOutcome: what the TUI shows after Update it now", (
 
 	test('REQ-12b no problems and a need still to answer gives "ask" carrying the same need object', () => {
 		const need = needIn("inactive");
-		const result: ProfileStartup = { need, notices: [], problems: [] };
+		const result: ProfileStartup = { need, problems: [] };
 
 		const outcome = formatUpdateOutcome(result);
 
@@ -87,34 +86,12 @@ describe("REQ-12 formatUpdateOutcome: what the TUI shows after Update it now", (
 		expect((outcome as { need?: unknown }).need).toBe(need);
 	});
 
-	test('REQ-12c no problems, state ok and a notice gives "updated" with one notice line, not the gate\'s working log', () => {
-		const result: ProfileStartup = {
-			need: needIn("ok"),
-			notices: ["absorbed 1 edit"],
-			problems: [],
-		};
+	test('REQ-12c no problems and state ok gives "updated", and nothing to say about it', () => {
+		const result: ProfileStartup = { need: needIn("ok"), problems: [] };
 
 		const outcome = formatUpdateOutcome(result);
 
-		expect(outcome).toEqual({
-			kind: "updated",
-			notice: "Profile format updated",
-		});
-	});
-
-	test('REQ-12d no problems, state ok and no notices gives the same "updated" notice', () => {
-		const result: ProfileStartup = {
-			need: needIn("ok"),
-			notices: [],
-			problems: [],
-		};
-
-		const outcome = formatUpdateOutcome(result);
-
-		expect(outcome).toEqual({
-			kind: "updated",
-			notice: "Profile format updated",
-		});
+		expect(outcome).toEqual({ kind: "updated" });
 	});
 });
 
@@ -137,7 +114,6 @@ for (const stream of [process.stdin, process.stdout, process.stderr]) {
 
 const out = {
 	state: null,
-	notices: null,
 	problems: null,
 	outcome: null,
 	error: null,
@@ -148,14 +124,13 @@ try {
 			? await startup.prepareProfileStartup(project, { convert: true })
 			: await startup.prepareProfileStartup(project);
 	out.state = prepared.need.state;
-	out.notices = prepared.notices;
 	out.problems = Array.isArray(prepared.problems) ? prepared.problems : null;
 	const outcome = startup.formatUpdateOutcome(prepared);
 	out.outcome =
 		outcome.kind === "ask"
 			? { kind: "ask", needState: outcome.need.state }
 			: outcome.kind === "updated"
-				? { kind: "updated", notice: outcome.notice }
+				? { kind: "updated" }
 				: { kind: outcome.kind, title: outcome.title, message: outcome.message };
 } catch (e) {
 	out.error = e instanceof Error ? (e.stack ?? e.message) : String(e);
@@ -166,12 +141,11 @@ process.exit(0);
 
 interface StartupRun {
 	state: ProfileStartupState | null;
-	notices: string[] | null;
 	/** Null when the result carried no `problems` array at all. */
 	problems: string[] | null;
 	outcome:
 		| { kind: "ask"; needState: ProfileStartupState }
-		| { kind: "updated"; notice: string }
+		| { kind: "updated" }
 		| { kind: "failed"; title: string; message: string }
 		| null;
 	error: string | null;

package/src/__tests__/gitignore-profile.test.ts

@@ -31,10 +31,7 @@ import {
 	prepareProfileState,
 } from "../services/profile-state.js";
 import type { ProfileManifest } from "../types/index.js";
-import {
-	buildGitignoreModal,
-	startupFixNotices,
-} from "../ui/hooks/useGitignoreModal.js";
+import { buildGitignoreModal } from "../ui/hooks/useGitignoreModal.js";
 
 const MANIFEST: ProfileManifest = {
 	version: 2,
@@ -155,11 +152,6 @@ describe("the startup fix untracks generated files in place", () => {
 		expect(await fs.readFile(join(project, ".gitignore"), "utf8")).toContain(
 			".claude/settings.json",
 		);
-		// Untracking is unfinished until the user commits, so it is a warning.
-		expect(startupFixNotices(result)).toContainEqual({
-			text: "Stopped tracking .claude/settings.json — commit the staged removal",
-			tone: "warning",
-		});
 		// Asked again on the next open: nothing generated is tracked any more.
 		expect((await startupGitignoreNeed(project))?.generated ?? []).toEqual([]);
 	});

package/src/__tests__/install-plan.test.ts

@@ -8,6 +8,7 @@ import type {
 	InstalledPluginsRegistry,
 	ResolvedClosure,
 } from "../types/index.js";
+import { resolved } from "./fixtures/bins.js";
 
 function closure(overrides: Partial<ResolvedClosure> = {}): ResolvedClosure {
 	return {
@@ -91,7 +92,7 @@ describe("summarizeClosure", () => {
 			marketplaces: { magus: { source: "github", repo: "MadAppGang/magus" } },
 			plugins: { "dev@magus": "latest", "terminal@magus": "4.1.0" },
 			bins: [
-				{ name: "claudish", via: "bun", version: "1.2.0", sources: ["x"] },
+				resolved({ name: "claudish", via: "bun", version: "1.2.0" }, ["x"]),
 			],
 			env: { required: ["FIGMA_TOKEN"], optional: [] },
 		});
@@ -101,4 +102,17 @@ describe("summarizeClosure", () => {
 		expect(lines.some((l) => l.includes("claudish@1.2.0"))).toBe(true);
 		expect(lines.some((l) => l.startsWith("env"))).toBe(true);
 	});
+
+	test("a refused pin is shown with the tool, marked as not applied", () => {
+		const bin = {
+			...resolved({ name: "claudish", via: "brew", formula: "claudish" }, [
+				"profile:p.cliTools",
+			]),
+			refusedPins: ["6.1.0"],
+		};
+		const lines = summarizeClosure(closure({ bins: [bin] }));
+		expect(
+			lines.some((l) => l.includes("claudish@6.1.0 (pin not applied)")),
+		).toBe(true);
+	});
 });

package/src/__tests__/marketplace-refresh.test.ts

@@ -57,7 +57,13 @@ function writePluginJson(dir: string, version: string, pin: string) {
 	fs.mkdirSync(p, { recursive: true });
 	fs.writeFileSync(
 		path.join(p, "plugin.json"),
-		JSON.stringify({ version, setup: { go: [pin] } }),
+		JSON.stringify({
+			version,
+			requires: {
+				schema: 1,
+				bin: [{ name: "x", install: [{ via: "release", tag: pin }] }],
+			},
+		}),
 	);
 }
 function readPin(dir: string): { version: string; pin: string } {
@@ -67,7 +73,7 @@ function readPin(dir: string): { version: string; pin: string } {
 			"utf8",
 		),
 	);
-	return { version: j.version, pin: j.setup.go[0] };
+	return { version: j.version, pin: j.requires.bin[0].install[0].tag };
 }
 /** Clone origin into the marketplace dir for `name`, at origin's current HEAD. */
 function installClone(name: string): string {
@@ -111,7 +117,7 @@ afterEach(() => {
 });
 
 describe("refreshRegisteredMarketplaces — the fix (CLAIM #1)", () => {
-	it("fast-forwards a stale clone so a newly pinned setup.go becomes visible", async () => {
+	it("fast-forwards a stale clone so a newly pinned release tag becomes visible", async () => {
 		const dir = installClone("magus");
 		expect(readPin(dir).pin).toBe("x@latest"); // stale on-disk clone
 		publishV2(); // a release lands upstream

package/src/__tests__/models-screen-state.test.ts

@@ -51,10 +51,9 @@ const roundTrip: AppAction[] = [
 ];
 
 describe("models screen initial state", () => {
-	test("starts idle, unfiltered, and with no message", () => {
+	test("starts idle, unfiltered, and not writing", () => {
 		expect(initialState.models.data.status).toBe("idle");
 		expect(initialState.models.searchQuery).toBe("");
-		expect(initialState.models.status).toBeNull();
 		expect(initialState.models.isApplying).toBe(false);
 		// The mate slots are not drawn until something says they can be served. Starting
 		// true would put three rows on screen before anything had been asked.
@@ -166,39 +165,6 @@ describe("models data state", () => {
 	});
 });
 
-describe("models status line", () => {
-	test("survives the screen unmounting, because it lives in app state", () => {
-		// `Router` swaps the component type on a tab change, so a message held in
-		// the screen's own useState is destroyed by 0 → 1 → 0 — and the message is
-		// the only record of what the last apply did.
-		const messaged = run([
-			{
-				type: "MODELS_STATUS_SET",
-				status: { text: "Routed opus-lead", tone: "success" },
-			},
-		]);
-		expect(run(roundTrip, messaged).models.status?.text).toBe(
-			"Routed opus-lead",
-		);
-	});
-
-	test("is replaced by the next message, not appended to", () => {
-		const state = run([
-			{ type: "MODELS_STATUS_SET", status: { text: "one", tone: "success" } },
-			{ type: "MODELS_STATUS_SET", status: { text: "two", tone: "error" } },
-		]);
-		expect(state.models.status).toEqual({ text: "two", tone: "error" });
-	});
-
-	test("clearing removes it", () => {
-		const state = run([
-			{ type: "MODELS_STATUS_SET", status: { text: "one", tone: "success" } },
-			{ type: "MODELS_STATUS_CLEAR" },
-		]);
-		expect(state.models.status).toBeNull();
-	});
-});
-
 describe("apply-in-flight state", () => {
 	test("survives the screen unmounting", () => {
 		// An apply rewrites the profile, re-materializes it and registers a hook.
@@ -297,11 +263,10 @@ describe("ModelsScreen keybindings", () => {
 		expect(src.slice(apply, apply + 120)).toContain("handleApply()");
 	});
 
-	test("digits and Tab never reach the screen, so a message survives a tab round trip", () => {
-		// The status line is cleared only by this screen's own bindings. Every
-		// digit (0 included) and Tab navigate, and they belong to the global key
-		// layer: no Models binding may claim one, or the message would be wiped
-		// on the way OUT of the tab — the loss the state was moved to prevent.
+	test("digits and Tab never reach the screen", () => {
+		// Every digit (0 included) and Tab navigate, and they belong to the global
+		// key layer: a Models binding claiming one would make the tab unleavable
+		// by that key.
 		for (const digit of "1234567890") {
 			expect(
 				matchBinding(SCREEN_BINDINGS.models, press(digit)),
@@ -319,6 +284,19 @@ describe("ModelsScreen keybindings", () => {
 		expect(styles).not.toContain("/^[1-9]$/");
 	});
 
+	test("no status line: a failure goes to the failure popup, a success says nothing", async () => {
+		// The TUI shows no status lines, notices or success messages; the screen
+		// reloads and shows state. The header row carries state only.
+		const src = stripComments(await fs.readFile(SCREEN, "utf8"));
+		expect(src).not.toContain("notice=");
+		expect(src).not.toContain("MODELS_STATUS");
+		expect(src).not.toMatch(/\bApplied\b/);
+		// Negative control: the failure path is really wired, so the guard is
+		// not passing over a screen that reports nothing at all.
+		expect(src).toContain("useFailurePopup()");
+		expect(src).toContain("stepFailureReport(");
+	});
+
 	test("screen state is held in the reducer, never in useState", async () => {
 		// The rule the two "survives unmounting" tests above enforce at runtime,
 		// pinned at the source so a new piece of state cannot quietly opt out.

package/src/__tests__/no-shell-spawn.test.ts

@@ -0,0 +1,77 @@
+/**
+ * The plugin-dependency code paths never hand anything to a shell.
+ *
+ * Scoped, deliberately, to the files on the installer path: the one reader of
+ * `requires` (and the hook that runs it at session start), the executor, the
+ * runner, and the modules that feed them. Package names, check argv and script
+ * paths reach these from plugin manifests and profiles — data a marketplace or
+ * a teammate wrote — so here a shell is never acceptable. The test makes no
+ * claim about the rest of `src/`. A new file on the installer path joins
+ * {@link INSTALLER_PATH}.
+ */
+
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import fs from "fs-extra";
+
+const SRC_DIR = path.join(import.meta.dir, "..");
+
+/** Files on the installer path, relative to `src/`. */
+const INSTALLER_PATH = [
+	"shared/plugin/hooks/lib/requires-probe.ts",
+	"shared/plugin/hooks/deps-check.ts",
+	"services/deps-plan.ts",
+	"services/deps-report.ts",
+	"services/doctor-bins.ts",
+	"utils/run.ts",
+	"cli/deps-view.ts",
+	"ui/adapters/depsAdapter.ts",
+];
+
+/** Each way a string can reach a shell, as the line that would do it. */
+const SHELL_PATTERNS: Array<[string, RegExp]> = [
+	["a shell spawn option", /\bshell:\s*(true|["'`])/],
+	["exec / execSync (string commands)", /\bexec(Sync)?\s*\(/],
+	[
+		"a string handed to spawn",
+		/(?<!Bun\.)\bspawn(Sync)?\s*\(\s*["'`][^"'`]*\s/,
+	],
+	["a string handed to Bun.spawn", /\bBun\.spawn(Sync)?\s*\(\s*["'`]/],
+	["Bun's shell", /\$`|from\s+["']bun["'].*\$/],
+];
+
+const isComment = (line: string) => {
+	const t = line.trim();
+	return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
+};
+
+function shellUses(text: string): string[] {
+	const found: string[] = [];
+	text.split("\n").forEach((line, i) => {
+		if (isComment(line)) return;
+		for (const [what, re] of SHELL_PATTERNS) {
+			if (re.test(line)) found.push(`line ${i + 1}: ${what}`);
+		}
+	});
+	return found;
+}
+
+describe("the installer path never spawns a shell", () => {
+	for (const rel of INSTALLER_PATH) {
+		test(rel, async () => {
+			const text = await fs.readFile(path.join(SRC_DIR, rel), "utf8");
+			expect(shellUses(text)).toEqual([]);
+		});
+	}
+
+	test("the scan can fail", () => {
+		// Negative controls: each pattern fires on the line it exists for.
+		expect(shellUses("spawn(cmd, { shell: true });")).toHaveLength(1);
+		expect(shellUses(`spawn(cmd, { shell: "/bin/sh" });`)).toHaveLength(1);
+		expect(shellUses("execSync(`brew install ${f}`);")).toHaveLength(1);
+		expect(shellUses(`spawn("brew install tmux");`)).toHaveLength(1);
+		expect(shellUses(`Bun.spawn("brew install tmux");`)).toHaveLength(1);
+		// …and not on argv.
+		expect(shellUses(`spawn(exe, args, { stdio: "ignore" });`)).toEqual([]);
+	});
+});

package/src/__tests__/npm-package-name.test.ts

@@ -199,7 +199,7 @@ describe("the CLI Tools entry for magus", () => {
 	test("install targets the package", () => {
 		expect(cliToolInstall(magusEntry())).toEqual({
 			cmd: "bun",
-			args: ["install", "-g", PACKAGE],
+			args: ["add", "-g", PACKAGE],
 		});
 	});
 
@@ -251,10 +251,8 @@ describe("pins and probes resolve to the package", () => {
 	test("a pinned version installs `<package>@<version>` and checks the command", () => {
 		expect(cliToolToBin(COMMAND, PKG.version)).toMatchObject({
 			name: COMMAND,
-			via: "bun",
-			package: PACKAGE,
-			check: "magus --version",
-			version: PKG.version,
+			check: ["magus", "--version"],
+			chosen: { via: "bun", package: PACKAGE, version: PKG.version },
 		});
 	});
 
@@ -262,11 +260,10 @@ describe("pins and probes resolve to the package", () => {
 		const bin = cliToolToBin(COMMAND, "latest");
 		expect(bin).toMatchObject({
 			name: COMMAND,
-			via: "bun",
-			package: PACKAGE,
-			check: "magus --version",
+			check: ["magus", "--version"],
+			chosen: { via: "bun", package: PACKAGE },
 		});
-		expect(bin.version).toBeUndefined();
+		expect(bin.chosen && "version" in bin.chosen).toBe(false);
 	});
 
 	test("the catalogue spec (the dist-tags probe input) names the package", () => {