magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
2 min read

read-navigation

A deny rule by default: it refuses a whole read of a Go, Buzz or Markdown file past the workspace's line limit, and names what to run instead.

What it catches

A whole read of a Go, Buzz or Markdown file past the workspace's line limit.

Why

The deny carries the file's declarations or headings with their lines, and the command that prints one of them, so the refused read costs nothing. The map is parsed from the file itself, so a stale index still gets one: where the index vouches for every name, magus refs <name> --definition --source prints one checked against it and the graph lists the map; where it does not, and for Buzz, which nothing indexes for refs, sed -n <first>,<last>p <file> prints one by its lines. A Go declaration spans its doc comment to its closing brace, each member of a grouped var, const or type is its own entry, and a method is named Type.Method. A Buzz entry is a top-level fun, test, object or enum, from its doc comment to the line before the next statement. Every file a cat or nl prints is judged, so cat a.go b.go is refused for whichever mapped file is over the threshold. A host's read tool is restated as the same line (cat <file>, or sed -n over its offset and limit, a limit over 300 counting as whole) and judged the same way. The size worth flagging is the rule's lines setting, which a workspace sets: the binary ships no number for it. Silent on a short file, TypeScript (no parser here), SKILL.md, AGENTS.md and a host's own instruction file (written to be read whole), a generated output, a path outside the workspace, a file that does not parse, and a read feeding a pipe or redirect. It refuses each caller once per file: the same caller asking for the same file again has the map in hand and chose the whole read, so that read passes.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"read-navigation": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [read-navigation]: ...

A workspace that sets this rule to advise sees advise [read-navigation]: ... instead.

magus describe rule read-navigation prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

guardrulesread-navigationdeny
Last updated (c6a327d5)
Earlier changes on this page (5)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. Workspace in full.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. Magusfile in full.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). Op in full.

Buzz

The language magusfiles are written in (the .buzz engine). Buzz in full.

CI

An ordinary target you compose yourself with ctx.needs; magus does not hardcode its stages. It is the anchor magus affected ci keys off, and ci strips the rw charm. CI in full.

Span

OpenTelemetry's name for one unit of work under a trace: a target execution, whose sub-operations are child spans. An output reference points at a span's captured output. Span in full.

Agent

A model working through an agent host such as Claude Code, Codex, Cursor or OpenCode. magus treats an agent as one more caller of its CLI, MCP tools and console, held to the same checks as a person. Agent in full.

Tool

An action a model can call through its host: a name, a description, a typed input and a result. magus serves its tools over MCP, each a read of the workspace model or a run of the CLI it already has. Tool in full.

Skill

A packaged set of instructions an agent host loads when a task matches its description: a directory holding a SKILL.md. magus ships its magus-* skills in the binary and writes them with magus agent install. Skill in full.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate. Run in full.

Conventions

Placeholders

Angle brackets mark a value you replace with your own; never type the brackets:

magus run <target>
magus completion <shell>    # e.g. bash, zsh, fish

<target>, <path>, <shell>, <name> and the like are stand-ins, not literal text.