magus-cli 7.9.0 → 7.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magus-cli",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -65,8 +65,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "magus-cli-darwin-arm64": "7.9.0",
-    "magus-cli-darwin-x64": "7.9.0",
-    "magus-cli-linux-x64": "7.9.0"
+    "magus-cli-darwin-arm64": "7.10.0",
+    "magus-cli-darwin-x64": "7.10.0",
+    "magus-cli-linux-x64": "7.10.0"
   }
 }

package/src/__tests__/blind/plugin-deps/doctor.test.ts

@@ -174,6 +174,7 @@ describe("magus doctor black-box contract", () => {
 				"plugins_needing_update",
 				"schema",
 				"unfixable",
+				"worktreesWithoutProfile",
 			]);
 			expect(new Set(report.plugins)).toEqual(
 				new Set(["user-tool@test", "project-tool@test", "local-tool@test"]),

package/src/__tests__/blind/review-followups/bun-install-path.test.ts

@@ -0,0 +1,57 @@
+import { expect, test } from "bun:test";
+import { join } from "node:path";
+
+import {
+	hookCommand,
+	makeHookPlugin,
+	makeShellPath,
+	makeWorld,
+	pinnedEnv,
+	removeWorld,
+	runChild,
+	sessionInput,
+	writeExecutable,
+} from "../plugin-deps/helpers";
+
+test("a Bun under BUN_INSTALL is reported as installed but absent from Claude Code's PATH", async () => {
+	const world = await makeWorld();
+	try {
+		const plugin = await makeHookPlugin(world, "bun-install", {
+			bin: [],
+			schema: 1,
+		});
+		const shellPath = await makeShellPath(world);
+		const bunInstall = join(world.root, "bun-install");
+		const bunBin = join(bunInstall, "bin");
+		await writeExecutable(join(bunBin, "bun"), "exit 0");
+
+		const result = await runChild(
+			join(shellPath, "sh"),
+			["-c", hookCommand("bun-install")],
+			{
+				cwd: world.project,
+				env: pinnedEnv(world, [shellPath], {
+					BUN_INSTALL: bunInstall,
+					CLAUDE_PLUGIN_ROOT: plugin,
+					SHELL: join(shellPath, "sh"),
+				}),
+				input: sessionInput("bun-install-session"),
+				timeoutMs: 9_500,
+			},
+		);
+		const message = JSON.parse(result.stdout).systemMessage as string;
+
+		expect({
+			describesInstalledBun:
+				message.includes("Bun is installed") && message.includes(bunBin),
+			explainsOffPath: message.includes(
+				"not on the PATH Claude Code started with",
+			),
+		}).toEqual({
+			describesInstalledBun: true,
+			explainsOffPath: true,
+		});
+	} finally {
+		await removeWorld(world);
+	}
+});

package/src/__tests__/blind/review-followups/d1-empty-lock.test.ts

@@ -0,0 +1,94 @@
+import { expect, test } from "bun:test";
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import {
+	type ApplyIO,
+	type ApplyOptions,
+	DepsLockBusy,
+	type DepsPlan,
+	applyDepsPlan,
+} from "../../../services/deps-plan.js";
+import type { RunResult } from "../../../utils/run.js";
+import { makeWorld, removeWorld } from "../plugin-deps/helpers.js";
+
+function successfulRun(): Promise<RunResult> {
+	return Promise.resolve({
+		durationMs: 0,
+		exitCode: 0,
+		outputTail: "",
+		signal: null,
+		timedOut: false,
+	});
+}
+
+function plan(): DepsPlan {
+	return {
+		pathAdvice: [],
+		steps: [
+			{
+				installs: [
+					{
+						pluginRoot: "",
+						requirement: {
+							check: ["widget", "--version"],
+							install: [],
+							name: "widget",
+						},
+					},
+				],
+				needs: [],
+				requiredBy: ["testdata@test"],
+				step: {
+					argv: ["installer", "widget"],
+					escalation: "none",
+					kind: "argv",
+					name: "widget",
+				},
+			},
+		],
+		unfixable: [],
+	};
+}
+
+function options(
+	world: Awaited<ReturnType<typeof makeWorld>>,
+	lockPath: string,
+): ApplyOptions {
+	const io: Partial<ApplyIO> = {
+		alive: () => false,
+		run: successfulRun,
+		uid: () => 1000,
+		verify: async ({ requirement }) => ({
+			name: requirement.name,
+			status: "present",
+		}),
+	};
+	return {
+		confirm: async () => true,
+		env: {
+			arch: "amd64",
+			home: world.home,
+			os: "linux",
+			path: world.bin,
+			userShell: join(world.bin, "zsh"),
+		},
+		io,
+		lockPath,
+		yes: true,
+	};
+}
+
+test("an empty lock file means another apply is starting", async () => {
+	const world = await makeWorld();
+	try {
+		const lockPath = join(world.cache, "doctor-fix.lock");
+		await writeFile(lockPath, "");
+
+		await expect(
+			applyDepsPlan(plan(), options(world, lockPath)),
+		).rejects.toBeInstanceOf(DepsLockBusy);
+	} finally {
+		await removeWorld(world);
+	}
+});

package/src/__tests__/blind/review-followups/d2-disappearing-lock.test.ts

@@ -0,0 +1,90 @@
+import { expect, test } from "bun:test";
+import { rmSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import {
+	type ApplyOptions,
+	type DepsPlan,
+	applyDepsPlan,
+} from "../../../services/deps-plan.js";
+import type { RunResult } from "../../../utils/run.js";
+import { makeWorld, removeWorld } from "../plugin-deps/helpers.js";
+
+const plan: DepsPlan = {
+	pathAdvice: [],
+	steps: [
+		{
+			installs: [
+				{
+					pluginRoot: "",
+					requirement: {
+						check: ["widget", "--version"],
+						install: [],
+						name: "widget",
+					},
+				},
+			],
+			needs: [],
+			requiredBy: ["testdata@test"],
+			step: {
+				argv: ["installer", "widget"],
+				escalation: "none",
+				kind: "argv",
+				name: "widget",
+			},
+		},
+	],
+	unfixable: [],
+};
+
+function successfulRun(): Promise<RunResult> {
+	return Promise.resolve({
+		durationMs: 0,
+		exitCode: 0,
+		outputTail: "",
+		signal: null,
+		timedOut: false,
+	});
+}
+
+test("a lock that disappears during inspection is retried", async () => {
+	const world = await makeWorld();
+	try {
+		const lockPath = join(world.cache, "doctor-fix.lock");
+		await writeFile(lockPath, "4242");
+		let removed = false;
+		const options: ApplyOptions = {
+			confirm: async () => true,
+			env: {
+				arch: "amd64",
+				home: world.home,
+				os: "linux",
+				path: world.bin,
+				userShell: join(world.bin, "zsh"),
+			},
+			io: {
+				alive: () => {
+					if (!removed) {
+						removed = true;
+						rmSync(lockPath);
+					}
+					return false;
+				},
+				run: successfulRun,
+				uid: () => 1000,
+				verify: async ({ requirement }) => ({
+					name: requirement.name,
+					status: "present",
+				}),
+			},
+			lockPath,
+			yes: true,
+		};
+
+		const outcomes = await applyDepsPlan(plan, options);
+		expect(outcomes).toMatchObject([{ name: "widget", status: "installed" }]);
+	} finally {
+		await removeWorld(world);
+	}
+});

package/src/__tests__/blind/review-followups/d3-release-temp-cleanup.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "bun:test";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, utimes, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import {
+	type ApplyOptions,
+	type DepsPlan,
+	applyDepsPlan,
+} from "../../../services/deps-plan.js";
+import { makeWorld, removeWorld } from "../plugin-deps/helpers.js";
+
+test("an apply removes abandoned release directories from the user bin directory", async () => {
+	const world = await makeWorld();
+	try {
+		const destination = join(world.home, ".local", "bin");
+		const abandoned = join(destination, ".magus-tmp-abandoned");
+		await mkdir(abandoned, { recursive: true });
+		await writeFile(join(abandoned, "partial-download"), "interrupted");
+		const old = new Date("2020-01-01T00:00:00.000Z");
+		await utimes(join(abandoned, "partial-download"), old, old);
+		await utimes(abandoned, old, old);
+
+		const body = new TextEncoder().encode("widget binary\n");
+		const digest = createHash("sha256").update(body).digest("hex");
+		const plan: DepsPlan = {
+			pathAdvice: [],
+			steps: [
+				{
+					installs: [
+						{
+							pluginRoot: "",
+							requirement: {
+								check: ["widget", "--version"],
+								install: [],
+								name: "widget",
+							},
+						},
+					],
+					needs: [],
+					requiredBy: ["testdata@test"],
+					step: {
+						binary: "widget",
+						dest: "~/.local/bin",
+						format: "binary",
+						kind: "release",
+						name: "widget",
+						sha256: digest,
+						url: "https://example.test/widget",
+					},
+				},
+			],
+			unfixable: [],
+		};
+		const options: ApplyOptions = {
+			confirm: async () => true,
+			env: {
+				arch: "amd64",
+				home: world.home,
+				os: "linux",
+				path: world.bin,
+				userShell: join(world.bin, "zsh"),
+			},
+			io: {
+				alive: () => false,
+				download: async () => body,
+				uid: () => 1000,
+				verify: async ({ requirement }) => ({
+					name: requirement.name,
+					status: "present",
+				}),
+			},
+			lockPath: join(world.cache, "doctor-fix.lock"),
+			yes: true,
+		};
+
+		await applyDepsPlan(plan, options);
+		expect(existsSync(abandoned)).toBe(false);
+	} finally {
+		await removeWorld(world);
+	}
+});

package/src/__tests__/blind/review-followups/d4-tool-stdout.test.ts

@@ -0,0 +1,152 @@
+import { expect, test } from "bun:test";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+
+import {
+	type ApplyIO,
+	type ApplyOptions,
+	type DepsPlan,
+	applyDepsPlan,
+} from "../../../services/deps-plan.js";
+import {
+	makeWorld,
+	removeWorld,
+	writeExecutable,
+} from "../plugin-deps/helpers.js";
+
+function options(
+	world: Awaited<ReturnType<typeof makeWorld>>,
+	lockName: string,
+	verify: ApplyIO["verify"],
+): ApplyOptions {
+	return {
+		confirm: async () => true,
+		env: {
+			arch: "amd64",
+			home: world.home,
+			os: "linux",
+			path: world.bin,
+			userShell: join(world.bin, "zsh"),
+		},
+		io: {
+			alive: () => false,
+			uid: () => 1000,
+			verify,
+		},
+		lockPath: join(world.cache, lockName),
+		yes: true,
+	};
+}
+
+test("tool answers use stdout without treating stderr warnings as paths", async () => {
+	const world = await makeWorld();
+	try {
+		await writeExecutable(
+			join(world.bin, "uv"),
+			[
+				'if [ "$1" = "python" ] && [ "$2" = "find" ]; then',
+				'  printf "%s\\n" "${0%/*}/python-env"',
+				"  i=0",
+				'  while [ "$i" -lt 100000 ]; do i=$((i + 1)); done',
+				'  printf "uv warning: cache metadata is stale\\n" >&2',
+				"fi",
+				"exit 0",
+			].join("\n"),
+		);
+		await writeExecutable(join(world.bin, "python-env"), "exit 0");
+		const uvPlan: DepsPlan = {
+			pathAdvice: [],
+			steps: [
+				{
+					installs: [
+						{
+							pluginRoot: world.root,
+							requirement: {
+								check: ["chromium", "--version"],
+								install: [],
+								name: "chromium",
+							},
+						},
+					],
+					needs: [],
+					requiredBy: ["browser-use@test"],
+					step: {
+						args: ["install", "chromium"],
+						escalation: "none",
+						kind: "uv-module",
+						module: "playwright",
+						name: "chromium",
+						script: join(world.root, "scripts", "browser.py"),
+					},
+				},
+			],
+			unfixable: [],
+		};
+		const [uvOutcome] = await applyDepsPlan(
+			uvPlan,
+			options(world, "uv.lock", async ({ requirement }) => ({
+				name: requirement.name,
+				status: "present",
+			})),
+		);
+
+		const globalBin = join(world.bin, "bun-global");
+		await mkdir(globalBin, { recursive: true });
+		await writeExecutable(join(globalBin, "widget"), "exit 0");
+		await writeExecutable(
+			join(world.bin, "bun"),
+			[
+				'if [ "$1" = "pm" ] && [ "$2" = "bin" ]; then',
+				'  printf "%s\\n" "${0%/*}/bun-global"',
+				"  i=0",
+				'  while [ "$i" -lt 100000 ]; do i=$((i + 1)); done',
+				'  printf "bun warning: registry metadata is stale\\n" >&2',
+				"fi",
+				"exit 0",
+			].join("\n"),
+		);
+		const bunPlan: DepsPlan = {
+			pathAdvice: [],
+			steps: [
+				{
+					installs: [
+						{
+							pluginRoot: "",
+							requirement: {
+								check: ["widget", "--version"],
+								install: [],
+								name: "widget",
+							},
+						},
+					],
+					needs: [],
+					requiredBy: ["testdata@test"],
+					step: {
+						argv: ["bun", "add", "-g", "widget"],
+						escalation: "none",
+						kind: "argv",
+						name: "widget",
+					},
+				},
+			],
+			unfixable: [],
+		};
+		const [bunOutcome] = await applyDepsPlan(
+			bunPlan,
+			options(world, "bun.lock", async ({ requirement }) => ({
+				name: requirement.name,
+				status: "missing",
+			})),
+		);
+
+		expect({
+			bunGlobalBin: bunOutcome?.dir,
+			uvInterpreter: uvOutcome?.status,
+		}).toEqual({
+			bunGlobalBin: globalBin,
+			uvInterpreter: "installed",
+		});
+	} finally {
+		await removeWorld(world);
+	}
+});

package/src/__tests__/blind/review-followups/installer-redirect.test.ts

@@ -0,0 +1,74 @@
+import { expect, test } from "bun:test";
+
+import { REAL_APPLY_IO } from "../../../services/deps-plan.js";
+
+const HTTPS_URL = "https://example.test/install.sh";
+const HTTP_URL = "http://mirror.example.test/install.sh";
+
+function responseAt(
+	url: string,
+	body: BodyInit | null,
+	init: ResponseInit,
+	redirected = false,
+): Response {
+	const response = new Response(body, init);
+	Object.defineProperty(response, "url", { value: url });
+	if (redirected) {
+		Object.defineProperty(response, "redirected", { value: true });
+	}
+	return response;
+}
+
+test("an installer script redirected to plain HTTP is rejected", async () => {
+	const realFetch = globalThis.fetch;
+	const requestedUrls: string[] = [];
+	const stubFetch: typeof fetch = async (input, init) => {
+		const url =
+			typeof input === "string"
+				? input
+				: input instanceof URL
+					? input.href
+					: input.url;
+		const redirect =
+			init?.redirect ?? (input instanceof Request ? input.redirect : "follow");
+		requestedUrls.push(url);
+
+		if (url === HTTPS_URL) {
+			if (redirect === "manual") {
+				return responseAt(HTTPS_URL, null, {
+					headers: { Location: HTTP_URL },
+					status: 302,
+				});
+			}
+			return stubFetch(HTTP_URL, { ...init, redirect: "follow" }).then(
+				(response) => {
+					Object.defineProperty(response, "redirected", { value: true });
+					return response;
+				},
+			);
+		}
+		if (url === HTTP_URL) {
+			return responseAt(HTTP_URL, "#!/bin/sh\n", { status: 200 });
+		}
+		throw new Error(`unexpected URL: ${url}`);
+	};
+
+	globalThis.fetch = stubFetch;
+	let rejection: unknown;
+	try {
+		await REAL_APPLY_IO.download(HTTPS_URL);
+	} catch (error) {
+		rejection = error;
+	} finally {
+		globalThis.fetch = realFetch;
+	}
+
+	expect({
+		errorNamesHttp:
+			rejection instanceof Error && rejection.message.includes(HTTP_URL),
+		requestedUrls,
+	}).toEqual({
+		errorNamesHttp: true,
+		requestedUrls: [HTTPS_URL],
+	});
+});

package/src/__tests__/blind/review-followups/ledger-permissions.test.ts

@@ -0,0 +1,78 @@
+import { expect, test } from "bun:test";
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+
+import {
+	type World,
+	hookCommand,
+	linkExecutable,
+	makeHookPlugin,
+	makeShellPath,
+	makeWorld,
+	pinnedEnv,
+	removeWorld,
+	runChild,
+	sessionInput,
+} from "../plugin-deps/helpers";
+
+async function runHookWithPinnedUmask(
+	world: World,
+	shellPath: string,
+	pluginRoot: string,
+	label: string,
+	pathDirs: string[],
+	sessionId: string,
+): Promise<void> {
+	await runChild(
+		join(shellPath, "sh"),
+		["-c", `umask 022; ${hookCommand(label)}`],
+		{
+			cwd: world.project,
+			env: pinnedEnv(world, pathDirs, {
+				BUN_INSTALL: join(world.home, ".bun"),
+				CLAUDE_PLUGIN_ROOT: pluginRoot,
+				SHELL: join(shellPath, "sh"),
+			}),
+			input: sessionInput(sessionId),
+			timeoutMs: 9_500,
+		},
+	);
+}
+
+test("the TypeScript hook and shell fallback create ledger directories private to the user", async () => {
+	const world = await makeWorld();
+	try {
+		const plugin = await makeHookPlugin(world, "private-ledger", {
+			schema: 1,
+			bin: [],
+		});
+		const shellPath = await makeShellPath(world);
+		await linkExecutable(world.bin, "bun", process.execPath);
+		await runHookWithPinnedUmask(
+			world,
+			shellPath,
+			plugin,
+			"typescript",
+			[world.bin, shellPath],
+			"typescript-ledger",
+		);
+		await runHookWithPinnedUmask(
+			world,
+			shellPath,
+			plugin,
+			"fallback",
+			[shellPath],
+			"fallback-ledger",
+		);
+
+		const modes = await Promise.all(
+			["typescript-ledger", "fallback-ledger"].map(
+				async (sessionId) =>
+					(await stat(join(world.tmp, `magus-deps-${sessionId}`))).mode & 0o777,
+			),
+		);
+		expect(modes).toEqual([0o700, 0o700]);
+	} finally {
+		await removeWorld(world);
+	}
+});