magus v0.4.3 is out. See what's new
¶ View generated markdown
3 min read

magus-spell

Build, publish, pull and list spells as OCI artifacts, and pin them in magus.lock

Synopsis

magus spell <build|push|pull|ls|lock> [args] [flags]

Description

A spell as an artifact: what one workspace publishes so another imports it by registry path, pinned by digest in magus.lock and versioned apart from the magus binary. Authoring a spell is magus init spell.

Subcommands (the first argument):

build Pack <dir> exactly as push would and print the manifest digest the push would produce, without touching the network. --out writes the layer tar too. push Pack <dir> as one uncompressed tar layer and push it to <ref>, a <registry>/<repository>:<tag>, then under each --tag with no second upload. Prints <registry>/<repository>@sha256:<digest>. magus/spell/<name> in place of <dir> pushes a spell magus ships, packed from the binary: the digest pull stamps on a copy. pull Fetch <ref> by tag or digest, verify the manifest and layer digests, and print the pinned reference and the directory holding the files: [<dir>] when given, otherwise the user cache. A bare registry path, as a magusfile imports it, pulls the digest magus.lock pins. magus/spell/<name> <dir> copies a spell magus ships instead, from the binary with no network: the files its published artifact holds, spell.buzz opening on a "// magus:origin <reference>" line, and prints the magus.yaml override to add. ls List <registry>/<repository>'s tags, following pagination. magus/spell lists every spell magus ships instead, each pinned to the digest a release publishes, with no network. lock Check that magus.lock pins every remote spell magus.yaml declares, for its declared tag, and verify each pinned digest; no tag is resolved. --update resolves each tag and rewrites magus.lock, and is what the update charm on the lock-owning target runs. The workspace is not loaded, so credentials resolve through the environment.

Only files the VCS tracks are packed, each with a fixed mode, owner and time, and the manifest carries org.opencontainers.image.{title,source,revision,created}, created being the revision's commit time (SOURCE_DATE_EPOCH overrides), so one commit builds to one digest on every machine. <dir> must hold a tracked spell.buzz; a tracked symlink is refused.

Credentials: the spells.registries entry in magus.yaml for the reference's host names a username and a secret reference, resolved through the workspace's secret provider. --username overrides it and reads the password from stdin. With neither, requests are anonymous. A new GHCR package is private until its owner makes it public in the package settings; magus never changes it.

spell build options

--out string
Also write the packed layer (an uncompressed tar) to this file
--source string
The org.opencontainers.image.source URL; default: the VCS remote as https

spell push options

--source string
The org.opencontainers.image.source URL; default: the VCS remote as https
--tag string
Another tag to write the same manifest under; repeatable
--username string
The registry username; the password is then read from stdin, overriding spells.registries

spell pull options

--username string
The registry username; the password is then read from stdin, overriding spells.registries

spell ls options

--username string
The registry username; the password is then read from stdin, overriding spells.registries

spell lock options

--update
Ask the registry what each declared tag names now, and rewrite magus.lock

Subcommands

build
Pack a spell directory and print the manifest digest a push would produce
push
Push a spell directory's tracked files, or a spell magus ships, as an OCI artifact and print its pinned reference
pull
Fetch and verify a published spell into the cache or a directory, or copy out one magus ships
ls
List a spell repository's tags, or the spells magus ships
lock
Check magus.lock against magus.yaml, or rewrite it with --update

Examples

Print the digest a push of this commit would produce

magus spell build spells/harness/cursor

Publish under a version and a floating tag

magus spell push spells/harness/cursor ghcr.io/owner/repo/spells/cursor:v1.2.0 --tag latest

Pull a published spell into a directory

magus spell pull ghcr.io/owner/repo/spells/cursor:v1.2.0 ./vendor/cursor

List a spell repository's tags

magus spell ls ghcr.io/owner/repo/spells/cursor

List every spell magus ships with the digest a release publishes

magus spell ls magus/spell

Pin every declared remote spell's tag in magus.lock

magus spell lock --update

See Also

magus(1), magus-ls(1), magus-describe(1), magus-where(1), magus-run(1), magus-affected(1), magus-x(1), magus-clean(1), magus-shell(1), magus-query(1), magus-refs(1), magus-explain(1), magus-path(1), magus-graph(1), magus-diff(1), magus-vcs(1), magus-session(1), magus-job(1), magus-notes(1), magus-queue(1), magus-watch(1), magus-events(1), magus-server(1), magus-broker(1), magus-mcp(1), magus-status(1), magus-buzz(1), magus-agent(1), magus-init(1), magus-doctor(1), magus-config(1), magus-completion(1), magus-man(1), magus-self(1), magus-version(1)

ManpagePages in this section. SpellsA spell is a library of tool-native ops (go-build, cargo-clippy, eslint) plus cache metadata that your magusfile composes into runnable targets. ChangelogEvery change to magus, newest first, in Keep a Changelog format, starting with the unreleased entries. Generated from changes/unreleased/ and releases/*.yaml. ScopeThe claim magus is built on: that a correct incremental build already requires a precise model of your repo, and everything else is a read of it. Includes the test for what belongs, the boundaries, and where the claim is strained.
generatedinternal/commands/registry.goclimagus spellspellpublishpullociregistrydigestremote spellscredentialsmagus.locklockupdate
Last updated (29d8b3de)
Earlier changes on this page (7)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. Workspace in full.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. Magusfile in full.

Target

A named operation (build, test, ...) you invoke with magus run <target>; it may compose a spell's tool-native operations and depend on other targets. Target in full.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). Op in full.

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. Spell in full.

Manifest

The file that declares what a package is: its name, dependencies, entry points and tool config (go.mod, package.json, pyproject.toml, Cargo.toml). How the workspace builds, tests and lints the package belongs in the magusfile, not in the manifest's scripts. Manifest in full.

Charm

An execution modifier attached with : (lint:rw) that changes how a target runs, not which one; the built-in rw flips a check-only target to mutate in place, and ci always strips it. Charm in full.

Buzz

The language magusfiles are written in (the .buzz engine). Buzz in full.

Cache

The content-addressed store magus consults before running a target, so unchanged work is skipped. Cache in full.

Affected

The set of projects touched by a change; magus affected <target> runs a target only over them. Affected in full.

Broker

The per-user background process that holds this host's capacity: the machine budget every run claims slots from, and the shared services runs keep warm. A run starts it on demand; broker: off in magus.yaml runs without one. Broker in full.

CI

An ordinary target you compose yourself with ctx.needs; magus does not hardcode its stages. It is the anchor magus affected ci keys off, and ci strips the rw charm. CI in full.

MAGUS.md

The committed routing index at a workspace root, regenerated from the knowledge graph: it lists every node and points at the exact query for a given question, so it is the entry point an agent reads first. MAGUS.md in full.

Agent

A model working through an agent host such as Claude Code, Codex, Cursor or OpenCode. magus treats an agent as one more caller of its CLI, MCP tools and console, held to the same checks as a person. Agent in full.

Harness

The deterministic scaffolding around the work on a change, for a person or an agent: compiler errors, formatters, linters, checks, gates, leases and hooks, placed at points a person chose. Around an agent's loop, magus supplies one and keeps it outside. Harness in full.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it. Session in full.

Job

The unit of delegated work, and one row of the job store: what an orchestrating agent handed out, with its goal, the checkpoint it was cut against, the paths it may write or must not touch, and the one check it runs. A job's holder is either a session, for work an orchestrator handed out, or the daemon, for its own maintenance. The store records; the agent guard is what reads those facts back when grading a write. Job in full.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate. Run in full.

Lease

The grant a holder takes on a job: the write and read paths that job declared, enforced in the checkout that took it with magus job exec. A job is the piece of work; a lease is permission over it. Lease in full.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.