feat: add install manifest/lock for MAP-managed provider surfaces (#313)

[azalio]

Summary

Closes #313.

Implements a scan-based install manifest written to .map/mapify.lock.json during mapify init for both Claude and Codex providers. Adds a mapify check-installed command that compares the current installed tree against the manifest.

What changed

New module: src/mapify_cli/install_manifest.py

• ManifestEntry dataclass: dest (relative POSIX path), content_hash, template_hash, management_mode (fenced/full/hooks-merge), committed, mapify_version, installed_at
• InstallManifest dataclass: mapify_version, provider, installed_at, entries
• build_manifest(project_path, provider, version) — scan-based: walks the provider's known install directories and collects all files carrying MAP-MANAGED metadata; no changes to existing install functions required
• write_manifest / read_manifest — persist and load .map/mapify.lock.json
• check_installed(project_path) → CheckResult(missing, orphaned, drifted, ok)

src/mapify_cli/__init__.py

• New manifest step in init command: writes the lock after all provider files are installed
• New mapify check-installed [project_path] command with exit codes 0 (ok), 1 (issues found), 2 (no manifest)

tests/test_install_manifest.py — 28 tests covering VC1–VC9:

• Claude install collects correct entries with correct management modes
• Codex install (including hooks.json → hooks-merge mode)
• Re-init idempotency (second write overwrites first)
• Missing, drifted (template_hash changed), and orphaned file detection
• read_manifest edge cases (missing/corrupt/wrong-type)
• Management mode inference (fenced vs full vs hooks-merge)
• Local-only exclusion (.claude/settings.local.json, symlinks)

Design decisions

• Scan-based, not instrumented: manifest is built by scanning installed directories for MAP-MANAGED metadata after install completes. No changes to the 10+ create_* functions.
• No absolute paths or secrets in the committed manifest.
• Local-only files excluded: settings.local.json (statusline, machine-specific) is not recorded.
• Symlinks excluded: AGENTS.md symlink to CLAUDE.md is not followed.
• hooks.json handled separately: Codex hooks.json uses a custom merge without MAP metadata; recorded with management_mode="hooks-merge".
• Existing per-file drift/backup behavior unchanged.

Test plan

• uv run pytest tests/test_install_manifest.py -v — 28/28 pass
• uv run make check — all 3284 tests pass, ruff + mypy + check-render clean
• uv run python -m pyright src/mapify_cli/install_manifest.py src/mapify_cli/__init__.py — 0 errors

---

Generated by Claude Code

Summary by CodeRabbit

• New Features

  • Added mapify check-installed to verify whether installed files match the recorded state, with clear exit codes for success, missing setup, and detected issues.
  • mapify init now saves an install manifest after setup so installed files can be tracked later.

• Bug Fixes

  • Improved handling of partial or changed installs, including missing, drifted, and extra files.
  • Safer manifest loading now avoids failing on missing or invalid manifest data.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 96ef6629-c1d4-4445-88fd-d4d1c5468de8

📥 Commits

Reviewing files that changed from the base of the PR and between 557de04 and 3ab0763.

📒 Files selected for processing (3)

• src/mapify_cli/__init__.py
• src/mapify_cli/install_manifest.py
• tests/test_install_manifest.py

---

📝 Walkthrough

Walkthrough

This PR adds a MAP-owned install manifest/lock system for provider-managed files. A new install_manifest module builds, writes, reads, and checks manifests recording per-file hashes and management modes. mapify init now generates this manifest, and a new mapify check-installed CLI command verifies installed files against it, reporting missing, drifted, or orphaned files.

Changes

Install Manifest Feature

Layer / File(s)	Summary
Manifest model, scanning, build, and check logic src/mapify_cli/install_manifest.py	Adds ManifestEntry, InstallManifest, CheckResult dataclasses, scan configuration, management-mode inference, per-file entry construction (with symlink/local-only exclusion and hooks-merge handling), directory/file scanning, build_manifest(), write_manifest()/read_manifest(), and check_installed() for missing/drifted/orphaned/ok comparison.
CLI integration: init manifest write and check-installed command src/mapify_cli/__init__.py	mapify init now builds and writes .map/mapify.lock.json after provider install, marking the step as skipped on failure. Adds mapify check-installed command that loads the manifest, runs the check, and exits 0/1/2 based on results.
Manifest test suite tests/test_install_manifest.py	Adds fixtures for Claude/Codex install layouts and tests covering manifest build, roundtrip persistence, idempotency, missing/drift/orphan detection, management-mode inference, local-only/symlink exclusion, and no-manifest edge cases.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant CLI as mapify_cli
  participant InstallManifest as install_manifest
  participant Disk

  User->>CLI: mapify init
  CLI->>InstallManifest: build_manifest(project_path, provider, version)
  InstallManifest->>Disk: scan provider files, hash content
  Disk-->>InstallManifest: file contents
  InstallManifest-->>CLI: InstallManifest entries
  CLI->>InstallManifest: write_manifest(project_path, manifest)
  InstallManifest->>Disk: write .map/mapify.lock.json

  User->>CLI: mapify check-installed
  CLI->>InstallManifest: read_manifest(project_path)
  InstallManifest->>Disk: read .map/mapify.lock.json
  Disk-->>InstallManifest: manifest data or None
  CLI->>InstallManifest: check_installed(project_path)
  InstallManifest->>Disk: scan and hash current files
  InstallManifest-->>CLI: CheckResult
  CLI-->>User: report + exit code

Loading

Poem

A rabbit hops with lock in paw,
Hashing files by MAP's own law,
Missing, drifted, orphaned found —
Check-installed makes the burrow sound.
🐇 Thump thump, the manifest's laid,
No drifted skill left unweighed!

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/compassionate-cerf-5tugql

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}