magus v0.4.3 is out. See what's new
¶ View generated markdown
3 min read

magus-spell

Build, publish, pull and list spells as OCI artifacts, and pin them in magus.lock

Synopsis

magus spell <build|push|pull|ls|lock> [args] [flags]

Description

A spell as an artifact: what one workspace publishes so another imports it by registry path, pinned by digest in magus.lock and versioned apart from the magus binary. Authoring a spell is magus init spell.

Subcommands (the first argument):

build Pack <dir> exactly as push would and print the manifest digest the push would produce, without touching the network. --out writes the layer tar too. push Pack <dir> as one uncompressed tar layer and push it to <ref>, a <registry>/<repository>:<tag>, then under each --tag with no second upload. Prints <registry>/<repository>@sha256:<digest>. pull Fetch <ref> by tag or digest, verify the manifest and layer digests, and print the pinned reference and the directory holding the files: [<dir>] when given, otherwise the user cache. A bare registry path, as a magusfile imports it, pulls the digest magus.lock pins. ls List <registry>/<repository>'s tags, following pagination. lock Check that magus.lock pins every remote spell magus.yaml declares, for its declared tag, and verify each pinned digest; no tag is resolved. --update resolves each tag and rewrites magus.lock, and is what the update charm on the lock-owning target runs. The workspace is not loaded, so credentials resolve through the environment.

Only files the VCS tracks are packed, each with a fixed mode, owner and time, and the manifest carries org.opencontainers.image.{title,source,revision,created}, created being the revision's commit time (SOURCE_DATE_EPOCH overrides), so one commit builds to one digest on every machine. <dir> must hold a tracked spell.buzz; a tracked symlink is refused.

Credentials: the spells.registries entry in magus.yaml for the reference's host names a username and a secret reference, resolved through the workspace's secret provider. --username overrides it and reads the password from stdin. With neither, requests are anonymous. A new GHCR package is private until someone makes it public.

spell build options

--out string
Also write the packed layer (an uncompressed tar) to this file
--source string
The org.opencontainers.image.source URL; default: the VCS remote as https

spell push options

--source string
The org.opencontainers.image.source URL; default: the VCS remote as https
--tag string
Another tag to write the same manifest under; repeatable
--username string
The registry username; the password is then read from stdin, overriding spells.registries

spell pull options

--username string
The registry username; the password is then read from stdin, overriding spells.registries

spell ls options

--username string
The registry username; the password is then read from stdin, overriding spells.registries

spell lock options

--update
Ask the registry what each declared tag names now, and rewrite magus.lock

Subcommands

build
Pack a spell directory and print the manifest digest a push would produce
push
Push a spell directory's tracked files as an OCI artifact and print its pinned reference
pull
Fetch and verify a published spell into the cache or a directory
ls
List a spell repository's tags
lock
Check magus.lock against magus.yaml, or rewrite it with --update

Examples

Print the digest a push of this commit would produce

magus spell build spells/harness/cursor

Publish under a version and a floating tag

magus spell push spells/harness/cursor ghcr.io/owner/repo/spells/cursor:v1.2.0 --tag latest

Pull a published spell into a directory

magus spell pull ghcr.io/owner/repo/spells/cursor:v1.2.0 ./vendor/cursor

List a spell repository's tags

magus spell ls ghcr.io/owner/repo/spells/cursor

Pin every declared remote spell's tag in magus.lock

magus spell lock --update

See Also

magus(1), magus-ls(1), magus-describe(1), magus-run(1), magus-x(1), magus-where(1), magus-affected(1), magus-graph(1), magus-query(1), magus-explain(1), magus-path(1), magus-refs(1), magus-watch(1), magus-events(1), magus-status(1), magus-clean(1), magus-shell(1), magus-vcs(1), magus-queue(1), magus-doctor(1), magus-config(1), magus-session(1), magus-memory(1), magus-job(1), magus-notes(1), magus-diff(1), magus-server(1), magus-broker(1), magus-mcp(1), magus-buzz(1), magus-completion(1), magus-man(1), magus-init(1), magus-agent(1), magus-self(1), magus-version(1)

ManpagePages in this section. magus describeDefine a magus concept (spell, charm, target, project, workspace, module, mcp-tool, tool, file, graph) and list every entity of that kind, or detail one when a name is given. magus affectedRun a target for every project affected by a VCS diff, with forensic modes for explain, graph, CI shard plan, and regression bisect. magus doctorRun diagnostic checks on the workspace covering project discovery, magusfile syntax, graph cycles, symlinks, env vars, and VCS reachability.
generatedinternal/cli/registry.goclimagus spellspellpublishpullociregistrydigestremote spellscredentialsmagus.locklockupdate
Last updated (00e25f0e)
Earlier changes on this page (3)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Target

A named operation (build, test, ...) you invoke with magus run <target>; it may compose a spell's tool-native operations and depend on other targets. See targets.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. See spells.

Charm

An execution modifier attached with : (lint:rw) that changes how a target runs, not which one; the built-in rw flips a check-only target to mutate in place, and ci always strips it. See charms.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

Cache

The content-addressed store magus consults before running a target, so unchanged work is skipped. See cache.

Affected

The set of projects touched by a change; magus affected <target> runs a target only over them. See affected.

Broker

The per-user background process that holds this host's capacity: the machine budget every run claims slots from, and the shared services runs keep warm. A run starts it on demand; broker: off in magus.yaml runs without one. See server.

Server

The background process a person starts with magus server start. It serves MCP, the console, background jobs and the warm knowledge graph, and adopts nested magus calls into one pool. See server.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs - magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

MAGUS.md

The committed routing index at a workspace root, regenerated from the knowledge graph: it lists every node and points at the exact query for a given question, so it is the entry point an agent reads first. See knowledge.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Job

The unit of delegated work, and one row of the job store: what an orchestrating agent handed out, with its goal, the checkpoint it was cut against, the paths it may write or must not touch, and the one check it runs. A job's holder is either a session, for work an orchestrator handed out, or the server, for its own maintenance. The store records; the agent guard is what reads those facts back when grading a write. See doctrine.

A job is not a run. magus run build web is a run, and no job exists for it. A job causes runs: its check executes as one, and a server job records the invocation of its last one. Jobs are listed with magus ls jobs and in the console's Jobs view; runs are listed in the Runs view.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.