magus-cli 7.9.1 → 7.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magus-cli",
-  "version": "7.9.1",
+  "version": "7.10.1",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -65,8 +65,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "magus-cli-darwin-arm64": "7.9.1",
-    "magus-cli-darwin-x64": "7.9.1",
-    "magus-cli-linux-x64": "7.9.1"
+    "magus-cli-darwin-arm64": "7.10.1",
+    "magus-cli-darwin-x64": "7.10.1",
+    "magus-cli-linux-x64": "7.10.1"
   }
 }

package/src/__tests__/blind/c15-probe-ownership.test.ts

@@ -361,11 +361,11 @@ describe("C15 (c) — a crush binary that npm does not own", () => {
 		expect(facts.managed).not.toBe(true);
 	});
 
-	test("R9.7 classifyTool keeps the not-managed veto for it (unknown / not-managed)", async () => {
+	test("R9.7 classifyTool keeps the not-managed veto for it (external / not-managed)", async () => {
 		const { facts } = await probe(CRUSH, elsewhere());
 		const status = classifyTool(CRUSH, facts);
 		expect({ state: status.state, reason: status.reason }).toEqual({
-			state: "unknown",
+			state: "external",
 			reason: "not-managed",
 		});
 	});
@@ -526,7 +526,7 @@ describe("C15 (e) — a claude binary outside the native layout and outside node
 		expect(facts.managed).not.toBe(true);
 		const status = classifyTool(CLAUDE, facts);
 		expect({ state: status.state, reason: status.reason }).toEqual({
-			state: "unknown",
+			state: "external",
 			reason: "not-managed",
 		});
 	});

package/src/__tests__/blind/plugin-deps/doctor.test.ts

@@ -174,6 +174,7 @@ describe("magus doctor black-box contract", () => {
 				"plugins_needing_update",
 				"schema",
 				"unfixable",
+				"worktreesWithoutProfile",
 			]);
 			expect(new Set(report.plugins)).toEqual(
 				new Set(["user-tool@test", "project-tool@test", "local-tool@test"]),

package/src/__tests__/cli-tools-adapter.test.ts

@@ -197,7 +197,7 @@ describe("buildToolRow — which installer a catalogue row is judged through", (
 		expect(row.installCommand).toEqual(cliToolInstall(codex));
 	});
 
-	test("detected pnpm → the catalogue's via, and a not-managed row naming the real path", () => {
+	test("detected pnpm → the catalogue's via, and a not-managed row in the user's terms", () => {
 		const opencode = catalogue("opencode");
 		const install = { primary: "pnpm" as const, all: ["pnpm" as const] };
 		const spec = specForCatalogTool(opencode, null, install);
@@ -210,8 +210,13 @@ describe("buildToolRow — which installer a catalogue row is judged through", (
 			owner: "npm (root /Users/j/.local/lib/node_modules)",
 		});
 		const row = buildToolRow(opencode, spec, f, install);
+		expect(row.status?.state).toBe("external");
 		expect(row.status?.reason).toBe("not-managed");
-		expect(row.status?.note).toContain("/Users/j/.local/share/pnpm/");
+		// No path and no installer directory: the user acts on neither.
+		expect(row.status?.note).toBe(
+			"installed outside npm, so magus leaves it as is",
+		);
+		expect(row.status?.note).not.toContain("/");
 		// Enter still follows how it IS installed (pnpm).
 		expect(row.updateCommand?.cmd).toBe("pnpm");
 	});
@@ -249,16 +254,28 @@ describe("cliToolStatusText — the row's words", () => {
 			primary: "npm",
 			all: ["npm"],
 		});
-		const f = facts("crush", { managed: false, owner: "npm (root /l)" });
+		const f = facts("crush", { managed: null });
 		const row = buildToolRow(tool, spec, f);
 		const text = cliToolStatusText(row);
 		expect(text.tone).toBe("warning");
-		expect(text.suffix).toBe(" ? not managed by npm");
-		// The note (with its path) is for the detail pane's "Why", not the row.
+		expect(text.suffix).toBe(" ? owner not known");
+		// The note is for the detail pane's "Why", not the row.
 		expect(row.status?.note).toBe(classifyTool(spec, f).note);
 		expect(text.suffix).not.toContain("/");
 	});
 
+	test("external renders muted, naming the installer it is outside of", () => {
+		const tool = catalogue("crush");
+		const spec = specForCatalogTool(tool, null, {
+			primary: "npm",
+			all: ["npm"],
+		});
+		const row = buildToolRow(tool, spec, facts("crush", { managed: false }));
+		const text = cliToolStatusText(row);
+		expect(text.tone).toBe("muted");
+		expect(text.suffix).toBe(" · outside npm");
+	});
+
 	test("upgrade names the target once, with one v", () => {
 		const tool = catalogue("mnemex");
 		const spec = specForCatalogTool(tool, null, {
@@ -287,12 +304,14 @@ describe("countToolRows — header counts from states", () => {
 		const rows = [
 			buildToolRow(tool, spec, facts("mnemex", { behind: false })),
 			buildToolRow(tool, spec, facts("mnemex", { behind: true })),
+			buildToolRow(tool, spec, facts("mnemex", { managed: null })),
+			// Another installer's: installed, and not "unverified".
 			buildToolRow(tool, spec, facts("mnemex", { managed: false })),
 			buildToolRow(tool, spec, facts("mnemex", { present: false })),
 			buildToolRow(tool, spec, undefined),
 		];
 		expect(countToolRows(rows)).toEqual({
-			installed: 3,
+			installed: 4,
 			updates: 1,
 			unverified: 1,
 		});

package/src/__tests__/plugin-mcp-source-shapes.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Marketplace plugin `source` comes in two shapes: a string path
+ * ("./plugins/foo") or an object (git-subdir / github / url). Only a string
+ * source has an on-disk MCP config under the marketplace clone.
+ *
+ * Regression guarded: the Plugins screen does
+ *   src = await getPluginSourcePath(mp, name); if (!src) skip;
+ *   await getPluginEnvRequirements(mp, src)
+ * and an object source used to throw `pluginSource.replace is not a function`.
+ *
+ * The module resolves the home directory at import time, and Bun's
+ * os.homedir() ignores a HOME changed at runtime, so every scenario runs in a
+ * child bun process with HOME pointed at a temp directory.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const MODULE_PATH = path.resolve(
+	import.meta.dir,
+	"../services/plugin-mcp-config.ts",
+);
+const MP = "testmp";
+
+const CHILD_SCRIPT = `
+import { getPluginSourcePath, getPluginEnvRequirements } from ${JSON.stringify(MODULE_PATH)};
+
+const input = JSON.parse(process.env.MCP_SHAPES_INPUT ?? "{}");
+const out = {};
+
+try {
+	const sp = await getPluginSourcePath(input.mp, input.plugin);
+	out.sourcePathType = typeof sp;
+	out.sourcePath = sp === undefined ? null : sp;
+	out.sourcePathOk = true;
+} catch (e) {
+	out.sourcePathOk = false;
+	out.sourcePathError = String(e && e.message ? e.message : e);
+}
+
+// The exact Plugins-screen sequence.
+try {
+	const src = await getPluginSourcePath(input.mp, input.plugin);
+	if (!src) {
+		out.sequence = { ok: true, skipped: true };
+	} else {
+		const reqs = await getPluginEnvRequirements(input.mp, src);
+		out.sequence = { ok: true, skipped: false, names: reqs.map((r) => r.name) };
+	}
+} catch (e) {
+	out.sequence = { ok: false, error: String(e && e.message ? e.message : e) };
+}
+
+if (typeof input.direct === "string") {
+	try {
+		const reqs = await getPluginEnvRequirements(input.mp, input.direct);
+		out.direct = {
+			ok: true,
+			reqs: reqs.map((r) => ({ name: r.name, serverName: r.serverName })),
+		};
+	} catch (e) {
+		out.direct = { ok: false, error: String(e && e.message ? e.message : e) };
+	}
+}
+
+process.stdout.write("__RESULT__" + JSON.stringify(out) + "\\n");
+`;
+
+interface ChildResult {
+	sourcePathOk: boolean;
+	sourcePathError?: string;
+	sourcePathType?: string;
+	sourcePath?: unknown;
+	sequence: {
+		ok: boolean;
+		skipped?: boolean;
+		names?: string[];
+		error?: string;
+	};
+	direct?: {
+		ok: boolean;
+		reqs?: Array<{ name: string; serverName: string }>;
+		error?: string;
+	};
+}
+
+let tmpHome: string;
+let scriptPath: string;
+
+async function writeMarketplace(
+	plugins: Array<{ name: string; source: unknown }>,
+): Promise<void> {
+	const dir = path.join(
+		tmpHome,
+		".claude",
+		"plugins",
+		"marketplaces",
+		MP,
+		".claude-plugin",
+	);
+	await fs.mkdir(dir, { recursive: true });
+	await fs.writeFile(
+		path.join(dir, "marketplace.json"),
+		JSON.stringify({ name: MP, plugins }, null, 2),
+	);
+}
+
+async function writeMcpConfig(
+	relSource: string,
+	config: Record<string, unknown>,
+): Promise<void> {
+	const dir = path.join(
+		tmpHome,
+		".claude",
+		"plugins",
+		"marketplaces",
+		MP,
+		relSource.replace(/^\.\//, ""),
+		"mcp-servers",
+	);
+	await fs.mkdir(dir, { recursive: true });
+	await fs.writeFile(
+		path.join(dir, "mcp-config.json"),
+		JSON.stringify(config, null, 2),
+	);
+}
+
+function runChild(input: {
+	mp: string;
+	plugin: string;
+	direct?: string;
+}): ChildResult {
+	const res = spawnSync("bun", ["--no-env-file", scriptPath], {
+		cwd: tmpHome,
+		env: {
+			...process.env,
+			HOME: tmpHome,
+			MCP_SHAPES_INPUT: JSON.stringify(input),
+		},
+		encoding: "utf-8",
+		timeout: 30_000,
+	});
+	const stdout = res.stdout ?? "";
+	const line = stdout.split("\n").find((l) => l.startsWith("__RESULT__"));
+	if (!line) {
+		throw new Error(
+			`child produced no result (status ${res.status})\nstdout:\n${stdout}\nstderr:\n${res.stderr ?? ""}`,
+		);
+	}
+	return JSON.parse(line.slice("__RESULT__".length)) as ChildResult;
+}
+
+beforeEach(async () => {
+	tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "mcp-source-shapes-"));
+	scriptPath = path.join(tmpHome, "child.ts");
+	await fs.writeFile(scriptPath, CHILD_SCRIPT);
+});
+
+afterEach(async () => {
+	await fs.rm(tmpHome, { recursive: true, force: true });
+});
+
+describe("string source", () => {
+	test("getPluginSourcePath returns the string and env requirements resolve from its mcp-config", async () => {
+		await writeMarketplace([{ name: "foo", source: "./plugins/foo" }]);
+		await writeMcpConfig("./plugins/foo", {
+			"foo-server": {
+				command: "node",
+				args: ["server.js"],
+				env: { FOO_TOKEN: "${FOO_TOKEN}" },
+			},
+		});
+
+		const r = runChild({ mp: MP, plugin: "foo", direct: "./plugins/foo" });
+
+		expect(r.sourcePathOk).toBe(true);
+		expect(r.sourcePathType).toBe("string");
+		expect(r.sourcePath).toBe("./plugins/foo");
+
+		expect(r.direct?.ok).toBe(true);
+		const names = (r.direct?.reqs ?? []).map((q) => q.name);
+		expect(names).toContain("FOO_TOKEN");
+		const foo = r.direct?.reqs?.find((q) => q.name === "FOO_TOKEN");
+		expect(foo?.serverName).toBe("foo-server");
+
+		// The Plugins-screen sequence reaches the same requirement.
+		expect(r.sequence.ok).toBe(true);
+		expect(r.sequence.skipped).toBe(false);
+		expect(r.sequence.names).toContain("FOO_TOKEN");
+	});
+});
+
+describe("object source", () => {
+	const shapes: Array<[string, Record<string, unknown>]> = [
+		[
+			"git-subdir",
+			{
+				source: "git-subdir",
+				url: "https://github.com/expo/skills.git",
+				path: "plugins/expo",
+				ref: "main",
+			},
+		],
+		["github", { source: "github", repo: "owner/name" }],
+		["url", { source: "url", url: "https://example.com/x.git" }],
+	];
+
+	for (const [label, source] of shapes) {
+		test(`${label}: getPluginSourcePath returns undefined, not the object`, async () => {
+			await writeMarketplace([
+				{ name: "foo", source: "./plugins/foo" },
+				{ name: "remote", source },
+			]);
+			await writeMcpConfig("./plugins/foo", {
+				"foo-server": { env: { FOO_TOKEN: "${FOO_TOKEN}" } },
+			});
+
+			const r = runChild({ mp: MP, plugin: "remote" });
+
+			expect(r.sourcePathError).toBeUndefined();
+			expect(r.sourcePathOk).toBe(true);
+			expect(r.sourcePathType).toBe("undefined");
+			expect(r.sourcePathType).not.toBe("object");
+		});
+
+		test(`${label}: the Plugins-screen sequence resolves without throwing`, async () => {
+			await writeMarketplace([{ name: "remote", source }]);
+
+			const r = runChild({ mp: MP, plugin: "remote" });
+
+			expect(r.sequence.error).toBeUndefined();
+			expect(r.sequence.ok).toBe(true);
+		});
+	}
+});
+
+describe("unknown plugin", () => {
+	test("getPluginSourcePath returns undefined for a name not in the marketplace", async () => {
+		await writeMarketplace([{ name: "foo", source: "./plugins/foo" }]);
+
+		const r = runChild({ mp: MP, plugin: "does-not-exist" });
+
+		expect(r.sourcePathOk).toBe(true);
+		expect(r.sourcePathType).toBe("undefined");
+		expect(r.sequence.ok).toBe(true);
+		expect(r.sequence.skipped).toBe(true);
+	});
+});

package/src/__tests__/tool-probe.test.ts

@@ -226,7 +226,7 @@ describe("classifyTool — every rule of §4.3, in order", () => {
 		);
 	});
 
-	test("6. not managed → unknown, naming both paths", () => {
+	test("6. not managed → external, in the user's terms", () => {
 		const s = classifyTool(
 			spec({ name: "crush" }),
 			facts({
@@ -237,16 +237,24 @@ describe("classifyTool — every rule of §4.3, in order", () => {
 				owner: "npm (root /Users/j/.local/lib/node_modules)",
 			}),
 		);
-		expect(s).toMatchObject({ state: "unknown", reason: "not-managed" });
-		expect(s.note).toContain("/Users/j/.nvm/versions/node/v24.14.0");
-		expect(s.note).toContain("npm (root /Users/j/.local/lib/node_modules)");
-		expect(s.note).toContain("second copy");
+		expect(s).toMatchObject({ state: "external", reason: "not-managed" });
+		expect(s.note).toBe("installed outside npm, so magus leaves it as is");
+		expect(s.note).not.toContain("/");
 	});
 
-	test("6. managed === null (owner undeterminable) is also a veto", () => {
+	test("6. managed === null (owner undeterminable) is also a veto, as unknown", () => {
 		expect(
-			classifyTool(spec(), facts({ managed: null, behind: true })).reason,
-		).toBe("not-managed");
+			classifyTool(spec(), facts({ managed: null, behind: true })),
+		).toMatchObject({ state: "unknown", reason: "not-managed" });
+	});
+
+	test("6. brew is named as the user knows it", () => {
+		expect(
+			classifyTool(
+				spec({ via: "brew" }),
+				facts({ managed: false, behind: true }),
+			).note,
+		).toBe("installed outside Homebrew, so magus leaves it as is");
 	});
 
 	test("7. held back → unknown, with the hold as the note", () => {
@@ -364,7 +372,7 @@ describe("classifyTool — every rule of §4.3, in order", () => {
 		];
 		for (const [s, f] of cases) {
 			const status = classifyTool(spec(s), facts(f));
-			expect(["unknown", "upgrade"]).toContain(status.state);
+			expect(["unknown", "upgrade", "external"]).toContain(status.state);
 			expect(status.note?.length ?? 0).toBeGreaterThan(0);
 		}
 	});
@@ -866,11 +874,11 @@ describe("probeTool — ownership decides managed", () => {
 		const [f] = await probeTools([hostile], io);
 		expect(io.calls).toEqual(["npm root -g"]);
 		expect(f?.installed).toBeNull();
-		// Cannot tell ⇒ unknown, so it is reported and never applied. The file
-		// is outside npm's tree, so the reason is ownership (R9.9), not the
-		// unread version that follows from it.
+		// Another installer's file ⇒ external, so it is reported and never
+		// applied. The reason is ownership (R9.9), not the unread version that
+		// follows from it.
 		expect(classifyTool(hostile, f!)).toMatchObject({
-			state: "unknown",
+			state: "external",
 			reason: "not-managed",
 		});
 

package/src/__tests__/update-plan.test.ts

@@ -502,7 +502,7 @@ describe("planIsBehind — the --check gate", () => {
 		const p = plan({
 			bins: planBinUpdates(
 				[{ name: "crush", via: "npm", sources: [] }],
-				[toolFacts("crush", { managed: false })],
+				[toolFacts("crush", { managed: null })],
 			),
 		});
 		expect(p.bins[0]!.action).toBe("unknown");
@@ -510,6 +510,19 @@ describe("planIsBehind — the --check gate", () => {
 		expect(planIsBehind(p)).toBe(false);
 	});
 
+	test("an EXTERNAL tool (another installer's) is no work, and not unknown", () => {
+		const p = plan({
+			bins: planBinUpdates(
+				[{ name: "crush", via: "npm", sources: [] }],
+				[toolFacts("crush", { managed: false, behind: true })],
+			),
+		});
+		expect(p.bins[0]!.action).toBe("external");
+		expect(planHasWork(p)).toBe(false);
+		expect(planIsBehind(p)).toBe(false);
+		expect(summarizePlan(p)).toMatchObject({ unknownTools: 0, kept: 1 });
+	});
+
 	test("a MISSING binary does fail the gate", () => {
 		const p = plan({
 			bins: planBinUpdates(
@@ -946,11 +959,13 @@ describe("planHasWork / summarizePlan", () => {
 					{ name: "crush", via: "npm", sources: [] },
 					{ name: "claude", via: "npm", sources: [] },
 					{ name: "tmux", via: "brew", sources: [] },
+					{ name: "zsh", via: "brew", sources: [] },
 				],
 				[
-					toolFacts("crush", { managed: false }),
-					toolFacts("claude", { managed: false }),
+					toolFacts("crush", { managed: null }),
+					toolFacts("claude", { managed: null }),
 					toolFacts("tmux", { behind: false }),
+					toolFacts("zsh", { managed: false }),
 				],
 			),
 		});
@@ -959,6 +974,7 @@ describe("planHasWork / summarizePlan", () => {
 			unknownTools: 2,
 			unknown: 3,
 			current: 1,
+			kept: 1,
 		});
 	});
 });