claudeup 4.32.1 → 4.34.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "4.32.1",
+  "version": "4.34.0",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "4.32.1",
-    "claudeup-darwin-x64": "4.32.1",
-    "claudeup-linux-x64": "4.32.1"
+    "claudeup-darwin-arm64": "4.34.0",
+    "claudeup-darwin-x64": "4.34.0",
+    "claudeup-linux-x64": "4.34.0"
   }
 }

package/src/__tests__/content-drift.test.ts

@@ -20,8 +20,17 @@ let configDir: string;
 let prevConfigDir: string | undefined;
 let repo: string;
 
+// commit.gpgsign=false isolates the developer's git config. With signing on
+// (1Password's SSH signer, for instance) every commit here calls that signer,
+// and because this helper ignores the exit status a failure is silent: no
+// commit is created, so drift is never detected and the assertions fail with a
+// bare `false` that points nowhere near the real cause. CI has no signing
+// config, so this only ever broke locally.
 const git = (args: string[]) =>
-	spawnSync("git", args, { cwd: repo, encoding: "utf-8" });
+	spawnSync("git", ["-c", "commit.gpgsign=false", ...args], {
+		cwd: repo,
+		encoding: "utf-8",
+	});
 
 const head = () => git(["rev-parse", "HEAD"]).stdout.trim();
 

package/src/__tests__/gitignore-detector.test.ts

@@ -9,7 +9,19 @@ import type { ResolvedManifest } from "../types/gitignore";
 function git(cwd: string, ...args: string[]): string {
   // core.excludesFile=/dev/null bypasses the developer's global gitignore
   // so the test environment doesn't leak into the result.
-  const r = spawnSync("git", ["-c", "core.excludesFile=/dev/null", ...args], {
+  //
+  // commit.gpgsign=false is the same isolation, one step further: a developer
+  // with signed commits makes every `git commit` here call their signer. With
+  // 1Password's SSH agent that means a prompt or an agent error, so these tests
+  // failed or timed out locally for reasons that have nothing to do with the
+  // code under test. CI has no signing config, so it only ever broke locally.
+  const r = spawnSync("git", [
+    "-c",
+    "core.excludesFile=/dev/null",
+    "-c",
+    "commit.gpgsign=false",
+    ...args,
+  ], {
     cwd,
     encoding: "utf8",
   });

package/src/__tests__/mcp-registry.test.ts

@@ -0,0 +1,158 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import {
+	fetchCuratedMcpServers,
+	searchMcpServers,
+} from "../services/mcp-registry.js";
+
+const realFetch = globalThis.fetch;
+const originalApiUrl = process.env.MCP_REGISTRY_API_URL;
+
+const server = {
+	name: "io.example/filesystem",
+	url: "npm:@example/filesystem",
+	short_description: "Filesystem tools",
+	version: "1.2.3",
+	source_code_url: "https://github.com/example/filesystem",
+	package_registry: "npm",
+	published_at: "2026-08-01T00:00:00.000Z",
+};
+
+afterEach(() => {
+	globalThis.fetch = realFetch;
+	if (originalApiUrl === undefined) {
+		Reflect.deleteProperty(process.env, "MCP_REGISTRY_API_URL");
+	} else {
+		process.env.MCP_REGISTRY_API_URL = originalApiUrl;
+	}
+});
+
+describe("searchMcpServers", () => {
+	it("calls the models-index endpoint with encoded normalized parameters", async () => {
+		process.env.MCP_REGISTRY_API_URL = "";
+		let requestedUrl = "";
+		globalThis.fetch = (async (input) => {
+			requestedUrl = String(input);
+			return Response.json({ servers: [server], next_cursor: "next page" });
+		}) as typeof fetch;
+
+		const result = await searchMcpServers({
+			query: "file system & tools",
+			limit: 7,
+			cursor: "page/2?x=1",
+		});
+
+		const url = new URL(requestedUrl);
+		expect(`${url.origin}${url.pathname}`).toBe(
+			"https://us-central1-claudish-6da10.cloudfunctions.net/mcpRegistry/search",
+		);
+		expect(Object.fromEntries(url.searchParams)).toEqual({
+			q: "file system & tools",
+			limit: "7",
+			cursor: "page/2?x=1",
+		});
+		expect(result).toEqual({ servers: [server], next_cursor: "next page" });
+	});
+
+	it("uses MCP_REGISTRY_API_URL and omits an empty query", async () => {
+		process.env.MCP_REGISTRY_API_URL = "https://registry.example.test/base/";
+		let requestedUrl = "";
+		globalThis.fetch = (async (input) => {
+			requestedUrl = String(input);
+			return Response.json({ servers: [] });
+		}) as typeof fetch;
+
+		await searchMcpServers({ query: "", limit: 4 });
+
+		expect(requestedUrl).toBe(
+			"https://registry.example.test/base/search?limit=4",
+		);
+	});
+
+	it("throws on an HTTP failure", async () => {
+		globalThis.fetch = (async () =>
+			new Response("unavailable", {
+				status: 503,
+				statusText: "Service Unavailable",
+			})) as typeof fetch;
+
+		expect(searchMcpServers({ query: "filesystem" })).rejects.toThrow(
+			"MCP Registry API error: 503 Service Unavailable",
+		);
+	});
+
+	it("throws when the normalized response or a server is malformed", async () => {
+		globalThis.fetch = (async () =>
+			Response.json({
+				servers: [{ name: "missing-url", short_description: "Broken" }],
+			})) as typeof fetch;
+
+		expect(searchMcpServers()).rejects.toThrow(
+			"MCP Registry API returned a malformed response",
+		);
+	});
+
+	it("throws when the response is not valid JSON", async () => {
+		globalThis.fetch = (async () =>
+			new Response("not json", {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			})) as typeof fetch;
+
+		expect(searchMcpServers()).rejects.toThrow(
+			"MCP Registry API returned a malformed response",
+		);
+	});
+
+	it("passes the caller abort signal to fetch", async () => {
+		const controller = new AbortController();
+		let receivedSignal: AbortSignal | null | undefined;
+		globalThis.fetch = (async (_input, init) => {
+			receivedSignal = init?.signal;
+			return Response.json({ servers: [] });
+		}) as typeof fetch;
+
+		await searchMcpServers({ signal: controller.signal });
+
+		expect(receivedSignal).toBe(controller.signal);
+	});
+});
+
+describe("fetchCuratedMcpServers", () => {
+	it("loads install-ready configurations from models-index", async () => {
+		process.env.MCP_REGISTRY_API_URL = "https://catalog.example.test/";
+		let requestedUrl = "";
+		globalThis.fetch = (async (input) => {
+			requestedUrl = String(input);
+			return Response.json({
+				schemaVersion: 1,
+				version: 2,
+				servers: [
+					{
+						name: "memory",
+						description: "Persistent memory",
+						command: "npx",
+						args: ["-y", "@modelcontextprotocol/server-memory@latest"],
+						category: "productivity",
+					},
+				],
+			});
+		}) as typeof fetch;
+
+		const result = await fetchCuratedMcpServers();
+		expect(requestedUrl).toBe("https://catalog.example.test/recommended");
+		expect(result).toHaveLength(1);
+		expect(result[0].name).toBe("memory");
+	});
+
+	it("rejects malformed install configurations", async () => {
+		globalThis.fetch = (async () =>
+			Response.json({
+				servers: [
+					{ name: "missing-command", description: "Broken", category: "ai" },
+				],
+			})) as typeof fetch;
+		expect(fetchCuratedMcpServers()).rejects.toThrow(
+			"MCP catalog API returned a malformed response",
+		);
+	});
+});

package/src/__tests__/skill-install-files.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import {
+  resolveSkillFilePath,
+  selectSkillFiles,
+} from "../services/skills-manager.js";
+
+/**
+ * Installing a skill used to write exactly one file, SKILL.md, and drop
+ * everything beside it. Measured against the real repos: audit-website lost
+ * `references/OUTPUT-FORMAT.md` while its SKILL.md still linked to it,
+ * systematic-debugging lost `find-polluter.sh` and 9 more, and
+ * remotion-best-practices lost 136 files. The installed skill looked fine and
+ * had dangling links.
+ *
+ * These cover the two pieces of that fix that are pure: choosing which files
+ * belong to a skill, and refusing to write outside its directory.
+ */
+
+const blob = (p: string) => ({ path: p, type: "blob" });
+const tree = (p: string) => ({ path: p, type: "tree" });
+
+describe("selectSkillFiles", () => {
+  test("returns paths relative to the skill directory", () => {
+    expect(
+      selectSkillFiles(
+        [
+          blob("skills/audit-website/SKILL.md"),
+          blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
+          blob("skills/audit-website/assets/icon-small.svg"),
+        ],
+        "skills/audit-website",
+      ),
+    ).toEqual(["SKILL.md", "references/OUTPUT-FORMAT.md", "assets/icon-small.svg"]);
+  });
+
+  test("REGRESSION: a sibling with a shared name prefix is excluded", () => {
+    // Without the trailing slash on the prefix, "skills/audit" also matches
+    // "skills/audit-website/..." and dumps a second skill's files into the
+    // first one's directory.
+    expect(
+      selectSkillFiles(
+        [
+          blob("skills/audit/SKILL.md"),
+          blob("skills/audit-website/SKILL.md"),
+          blob("skills/audit-website/references/OUTPUT-FORMAT.md"),
+        ],
+        "skills/audit",
+      ),
+    ).toEqual(["SKILL.md"]);
+  });
+
+  test("tree entries are skipped — only blobs are downloadable", () => {
+    expect(
+      selectSkillFiles(
+        [
+          tree("skills/x/references"),
+          blob("skills/x/SKILL.md"),
+          blob("skills/x/references/a.md"),
+        ],
+        "skills/x",
+      ),
+    ).toEqual(["SKILL.md", "references/a.md"]);
+  });
+
+  test("files outside the skill directory are excluded", () => {
+    expect(
+      selectSkillFiles(
+        [blob("README.md"), blob("other/SKILL.md"), blob("skills/x/SKILL.md")],
+        "skills/x",
+      ),
+    ).toEqual(["SKILL.md"]);
+  });
+
+  test("a trailing slash on the skill path does not break matching", () => {
+    expect(
+      selectSkillFiles([blob("skills/x/SKILL.md")], "skills/x/"),
+    ).toEqual(["SKILL.md"]);
+  });
+
+  test("a skill directory with no files yields nothing", () => {
+    expect(selectSkillFiles([blob("skills/other/SKILL.md")], "skills/x")).toEqual([]);
+  });
+});
+
+describe("resolveSkillFilePath", () => {
+  const dir = path.join(path.sep, "tmp", "skills", "demo");
+
+  test("resolves a plain relative path inside the install directory", () => {
+    expect(resolveSkillFilePath(dir, "SKILL.md")).toBe(
+      path.join(dir, "SKILL.md"),
+    );
+  });
+
+  test("resolves a nested path", () => {
+    expect(resolveSkillFilePath(dir, "references/OUTPUT-FORMAT.md")).toBe(
+      path.join(dir, "references", "OUTPUT-FORMAT.md"),
+    );
+  });
+
+  test("SECURITY: rejects paths escaping via ..", () => {
+    // These paths come from a remote repository and are untrusted input to a
+    // filesystem write.
+    expect(resolveSkillFilePath(dir, "../evil.md")).toBeNull();
+    expect(resolveSkillFilePath(dir, "../../.bashrc")).toBeNull();
+    expect(resolveSkillFilePath(dir, "refs/../../../evil.md")).toBeNull();
+  });
+
+  test("SECURITY: rejects absolute paths", () => {
+    expect(resolveSkillFilePath(dir, path.join(path.sep, "etc", "passwd"))).toBeNull();
+  });
+
+  test("rejects an empty path", () => {
+    expect(resolveSkillFilePath(dir, "")).toBeNull();
+  });
+
+  test("a .. that stays inside the directory is allowed", () => {
+    expect(resolveSkillFilePath(dir, "refs/../SKILL.md")).toBe(
+      path.join(dir, "SKILL.md"),
+    );
+  });
+
+  test("REGRESSION: a sibling directory sharing the name prefix is rejected", () => {
+    // path.startsWith without a separator would accept /tmp/skills/demo-evil
+    // as being inside /tmp/skills/demo.
+    expect(resolveSkillFilePath(dir, "../demo-evil/x.md")).toBeNull();
+  });
+});

package/src/__tests__/skills-catalog-client.test.ts

@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { fetchCuratedSkillsCatalog } from "../services/skillsmp-client.js";
+
+const realFetch = globalThis.fetch;
+
+afterEach(() => {
+	globalThis.fetch = realFetch;
+});
+
+describe("fetchCuratedSkillsCatalog", () => {
+	it("loads the versioned models-index catalog", async () => {
+		let requestedUrl = "";
+		globalThis.fetch = (async (input) => {
+			requestedUrl = String(input);
+			return Response.json({
+				schemaVersion: 1,
+				version: 1,
+				generatedAt: "2026-08-07T00:00:00.000Z",
+				skills: [
+					{
+						name: "Find Skills",
+						repo: "vercel-labs/skills",
+						skillPath: "skills/find-skills",
+						description: "Find skills",
+						category: "search",
+					},
+				],
+				skillSets: [],
+			});
+		}) as typeof fetch;
+
+		const catalog = await fetchCuratedSkillsCatalog();
+		expect(requestedUrl).toBe(
+			"https://us-central1-claudish-6da10.cloudfunctions.net/skills/recommended",
+		);
+		expect(catalog.skills[0].skillPath).toBe("skills/find-skills");
+	});
+
+	it("rejects HTTP and malformed responses", async () => {
+		globalThis.fetch = (async () =>
+			new Response("down", { status: 503 })) as typeof fetch;
+		expect(fetchCuratedSkillsCatalog()).rejects.toThrow("HTTP 503");
+
+		globalThis.fetch = (async () =>
+			Response.json({ skills: [] })) as typeof fetch;
+		expect(fetchCuratedSkillsCatalog()).rejects.toThrow("malformed response");
+	});
+});