claudeup 4.32.1 → 4.34.0

package/src/services/mcp-registry.ts

@@ -1,31 +1,107 @@
-import type { McpRegistryServer, McpRegistryResponse } from "../types/index.js";
+import type {
+	McpRegistryResponse,
+	McpRegistryServer,
+	McpServer,
+} from "../types/index.js";
 
-// Official Model Context Protocol Registry
-// API Docs: https://registry.modelcontextprotocol.io
-const MCP_REGISTRY_API = "https://registry.modelcontextprotocol.io/v0";
+const DEFAULT_MCP_REGISTRY_API =
+	"https://us-central1-claudish-6da10.cloudfunctions.net/mcpRegistry";
 
 export interface SearchOptions {
 	query?: string;
 	limit?: number;
 	cursor?: string;
+	signal?: AbortSignal;
+}
+
+function getMcpRegistryApiUrl(): string {
+	return (process.env.MCP_REGISTRY_API_URL || DEFAULT_MCP_REGISTRY_API).replace(
+		/\/+$/,
+		"",
+	);
+}
+
+function isOptionalString(value: unknown): value is string | undefined {
+	return value === undefined || typeof value === "string";
+}
+
+function isMcpRegistryServer(value: unknown): value is McpRegistryServer {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+
+	const server = value as Record<string, unknown>;
+	return (
+		typeof server.name === "string" &&
+		server.name.length > 0 &&
+		typeof server.url === "string" &&
+		server.url.length > 0 &&
+		typeof server.short_description === "string" &&
+		isOptionalString(server.version) &&
+		isOptionalString(server.source_code_url) &&
+		isOptionalString(server.package_registry) &&
+		isOptionalString(server.published_at)
+	);
+}
+
+function isMcpServer(value: unknown): value is McpServer {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const server = value as Record<string, unknown>;
+	const isHttp = server.type === "http";
+	return (
+		typeof server.name === "string" &&
+		server.name.length > 0 &&
+		typeof server.description === "string" &&
+		typeof server.category === "string" &&
+		(isHttp
+			? typeof server.url === "string" && server.url.length > 0
+			: typeof server.command === "string" && server.command.length > 0) &&
+		(server.args === undefined ||
+			(Array.isArray(server.args) &&
+				server.args.every((arg) => typeof arg === "string"))) &&
+		(server.env === undefined ||
+			(typeof server.env === "object" && !Array.isArray(server.env))) &&
+		(server.configFields === undefined || Array.isArray(server.configFields))
+	);
+}
+
+function parseMcpRegistryResponse(value: unknown): McpRegistryResponse {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("MCP Registry API returned a malformed response");
+	}
+
+	const response = value as Record<string, unknown>;
+	if (
+		!Array.isArray(response.servers) ||
+		!response.servers.every(isMcpRegistryServer) ||
+		!isOptionalString(response.next_cursor)
+	) {
+		throw new Error("MCP Registry API returned a malformed response");
+	}
+
+	return {
+		servers: response.servers,
+		...(response.next_cursor === undefined
+			? {}
+			: { next_cursor: response.next_cursor }),
+	};
 }
 
 export async function searchMcpServers(
 	options: SearchOptions = {},
 ): Promise<McpRegistryResponse> {
-	const { query = "", limit = 20, cursor } = options;
+	const { query = "", limit = 20, cursor, signal } = options;
 
 	const params = new URLSearchParams();
-	if (query) params.set("query", query);
+	if (query) params.set("q", query);
 	params.set("limit", String(limit));
 	if (cursor) params.set("cursor", cursor);
 
-	const url = `${MCP_REGISTRY_API}/servers?${params.toString()}`;
+	const url = `${getMcpRegistryApiUrl()}/search?${params.toString()}`;
 
 	const response = await fetch(url, {
 		headers: {
 			Accept: "application/json",
 		},
+		signal,
 	});
 
 	if (!response.ok) {
@@ -34,61 +110,51 @@ export async function searchMcpServers(
 		);
 	}
 
-	const data: any = await response.json();
-
-	// The official registry returns data in a nested format:
-	// { servers: [{ server: {...}, _meta: {...} }] }
-	// Convert it to match our expected McpRegistryResponse format
-	const servers: McpRegistryServer[] = (data.servers || [])
-		.map((item: any) => {
-			const server = item.server || item; // Handle both nested and flat structures
-			const meta = item._meta?.["io.modelcontextprotocol.registry/official"];
-
-			// Get URL from remotes (HTTP) or construct from packages
-			let url = "";
-			if (server.remotes?.length > 0) {
-				url = server.remotes[0].url;
-			} else if (server.packages?.length > 0) {
-				// For package-based servers, use the package identifier as reference
-				const pkg = server.packages[0];
-				url = `${pkg.registryType}:${pkg.identifier}`;
-			}
-
-			return {
-				name: server.name,
-				url,
-				short_description: server.description || "No description",
-				version: server.version,
-				source_code_url: server.repository?.url,
-				package_registry: server.packages?.[0]?.registryType,
-				published_at: meta?.publishedAt,
-			};
-		})
-		// Filter out servers without name or URL
-		.filter((s: McpRegistryServer) => s.name && s.url)
-		// Sort by publish date (newest first)
-		.sort((a: McpRegistryServer, b: McpRegistryServer) => {
-			if (!a.published_at) return 1;
-			if (!b.published_at) return -1;
-			return (
-				new Date(b.published_at).getTime() - new Date(a.published_at).getTime()
-			);
-		});
+	let data: unknown;
+	try {
+		data = await response.json();
+	} catch {
+		throw new Error("MCP Registry API returned a malformed response");
+	}
 
-	return {
-		servers,
-		next_cursor: data.metadata?.nextCursor || data.next_cursor,
-	};
+	return parseMcpRegistryResponse(data);
 }
 
 export async function getPopularServers(
 	limit = 20,
 ): Promise<McpRegistryServer[]> {
 	const response = await searchMcpServers({ limit });
-	// Already sorted by publish date in searchMcpServers
 	return response.servers;
 }
 
+/** Fetch the install-ready catalog. This is separate from dynamic Registry search. */
+export async function fetchCuratedMcpServers(
+	signal?: AbortSignal,
+): Promise<McpServer[]> {
+	const response = await fetch(`${getMcpRegistryApiUrl()}/recommended`, {
+		headers: { Accept: "application/json" },
+		signal,
+	});
+	if (!response.ok) {
+		throw new Error(`MCP catalog API error: ${response.status}`);
+	}
+
+	let data: unknown;
+	try {
+		data = await response.json();
+	} catch {
+		throw new Error("MCP catalog API returned a malformed response");
+	}
+	if (!data || typeof data !== "object" || Array.isArray(data)) {
+		throw new Error("MCP catalog API returned a malformed response");
+	}
+	const servers = (data as Record<string, unknown>).servers;
+	if (!Array.isArray(servers) || !servers.every(isMcpServer)) {
+		throw new Error("MCP catalog API returned a malformed response");
+	}
+	return servers;
+}
+
 export function formatDate(dateStr?: string): string {
 	if (!dateStr) return "";
 	const date = new Date(dateStr);

package/src/services/skills-manager.ts

@@ -7,7 +7,7 @@ import type {
 	SkillFrontmatter,
 	GitTreeResponse,
 } from "../types/index.js";
-import { RECOMMENDED_SKILLS, classifyStarReliability } from "../data/skill-repos.js";
+import { classifyStarReliability, type RecommendedSkill } from "../data/skill-repos.js";
 
 const SKILLS_API_BASE =
 	"https://us-central1-claudish-6da10.cloudfunctions.net/skills";
@@ -286,6 +286,7 @@ export async function fetchPopularSkills(limit = 30): Promise<SkillInfo[]> {
 export async function fetchAvailableSkills(
 	_repos: SkillSource[],
 	projectPath?: string,
+	recommended: RecommendedSkill[] = [],
 ): Promise<SkillInfo[]> {
 	const userInstalled = await getInstalledSkillNames("user");
 	const projectInstalled = await getInstalledSkillNames("project", projectPath);
@@ -306,8 +307,8 @@ export async function fetchAvailableSkills(
 		return { ...skill, installed, installedScope };
 	};
 
-	// 1. Recommended skills from RECOMMENDED_SKILLS constant (no API call)
-	const recommendedSkills: SkillInfo[] = RECOMMENDED_SKILLS.map((rec) => {
+	// 1. Recommended skills from the versioned models-index catalog.
+	const recommendedSkills: SkillInfo[] = recommended.map((rec) => {
 		const source: SkillSource = {
 			label: rec.repo,
 			repo: rec.repo,
@@ -334,52 +335,7 @@ export async function fetchAvailableSkills(
 	const popular = await fetchPopularSkills(30);
 	const popularSkills = popular.map((s) => markInstalled({ ...s, isRecommended: false }));
 
-	// 3. Enrich recommended skills with GitHub repo stars (cached to disk)
-	const starsCachePath = path.join(os.homedir(), ".claude", "skill-stars-cache.json");
-	let starsCache: Record<string, { stars: number; fetchedAt: string }> = {};
-	try { starsCache = await fs.readJson(starsCachePath); } catch { /* no cache yet */ }
-
-	const uniqueRepos = [...new Set(recommendedSkills.map((s) => s.source.repo))];
-	const repoStars = new Map<string, number>();
-	const cacheMaxAge = 24 * 60 * 60 * 1000; // 24 hours
-	let cacheUpdated = false;
-
-	for (const repo of uniqueRepos) {
-		const cached = starsCache[repo];
-		if (cached && Date.now() - new Date(cached.fetchedAt).getTime() < cacheMaxAge) {
-			repoStars.set(repo, cached.stars);
-			continue;
-		}
-		// Try fetching from GitHub (may be rate limited)
-		try {
-			const res = await fetch(`https://api.github.com/repos/${repo}`, {
-				headers: { Accept: "application/vnd.github+json" },
-				signal: AbortSignal.timeout(5000),
-			});
-			if (res.ok) {
-				const data = (await res.json()) as { stargazers_count?: number };
-				if (data.stargazers_count) {
-					repoStars.set(repo, data.stargazers_count);
-					starsCache[repo] = { stars: data.stargazers_count, fetchedAt: new Date().toISOString() };
-					cacheUpdated = true;
-				}
-			} else if (cached) {
-				// Rate limited but have stale cache — use it
-				repoStars.set(repo, cached.stars);
-			}
-		} catch {
-			if (cached) repoStars.set(repo, cached.stars);
-		}
-	}
-	if (cacheUpdated) {
-		try { await fs.writeJson(starsCachePath, starsCache); } catch { /* ignore */ }
-	}
-
-	for (const rec of recommendedSkills) {
-		rec.stars = repoStars.get(rec.source.repo) || rec.stars || undefined;
-	}
-
-	// 4. Combine: recommended first, then popular (dedup by name)
+	// 3. Combine: recommended first, then popular (dedup by name)
 	const seen = new Set<string>(recommendedSkills.map((s) => s.name));
 	const deduped = popularSkills.filter((s) => !seen.has(s.name));
 
@@ -388,11 +344,69 @@ export async function fetchAvailableSkills(
 
 // ─── Install / Uninstall ──────────────────────────────────────────────────────
 
+/** Hard ceilings so one pathological repo cannot fill a user's disk. */
+const MAX_SKILL_FILES = 200;
+const MAX_SKILL_BYTES = 20 * 1024 * 1024;
+
+/**
+ * Pick the files that belong to one skill out of a whole-repo tree listing.
+ *
+ * Returns paths relative to the skill directory, so `skills/x/refs/a.md`
+ * under `skills/x` becomes `refs/a.md`.
+ *
+ * The trailing slash on the prefix is load-bearing: without it `skills/audit`
+ * also matches `skills/audit-website/...`, and the user gets a second skill's
+ * files dumped into the first one's directory.
+ */
+export function selectSkillFiles(
+	treePaths: { path: string; type: string }[],
+	repoPath: string,
+): string[] {
+	const prefix = `${repoPath.replace(/\/+$/, "")}/`;
+	return treePaths
+		.filter((e) => e.type === "blob" && e.path.startsWith(prefix))
+		.map((e) => e.path.slice(prefix.length))
+		.filter((rel) => rel.length > 0);
+}
+
+/**
+ * Resolve one relative path inside the install directory, or return null.
+ *
+ * These paths come from a remote repository, so they are untrusted input to a
+ * filesystem write. Anything that escapes the install directory — `..`
+ * segments, an absolute path — is dropped rather than written outside the
+ * skill folder.
+ */
+export function resolveSkillFilePath(
+	installDir: string,
+	relativePath: string,
+): string | null {
+	if (!relativePath || path.isAbsolute(relativePath)) return null;
+	const resolvedDir = path.resolve(installDir);
+	const target = path.resolve(resolvedDir, relativePath);
+	if (target !== resolvedDir && !target.startsWith(resolvedDir + path.sep)) {
+		return null;
+	}
+	return target;
+}
+
+/** What an install actually delivered — surfaced so the UI can be honest. */
+export interface InstallResult {
+	/** Number of files written, always ≥ 1 (SKILL.md). */
+	fileCount: number;
+	/**
+	 * Set when only SKILL.md could be written for a skill that has more files,
+	 * e.g. the GitHub tree call was rate-limited. The skill is installed but
+	 * incomplete, and the caller should say so.
+	 */
+	degraded?: string;
+}
+
 export async function installSkill(
 	skill: SkillInfo,
 	scope: "user" | "project",
 	projectPath?: string,
-): Promise<void> {
+): Promise<InstallResult> {
 	// Try multiple URL patterns — repos structure SKILL.md differently
 	const repo = skill.source.repo;
 	const repoPath = skill.repoPath.replace(/\/SKILL\.md$/, "");
@@ -436,6 +450,74 @@ export async function installSkill(
 
 	await fs.ensureDir(installDir);
 	await fs.writeFile(path.join(installDir, "SKILL.md"), content, "utf8");
+
+	// SKILL.md alone is usually not a working skill. Skills ship scripts,
+	// references and assets beside it and link to them by relative path, so
+	// writing only SKILL.md leaves dangling links — measured: audit-website
+	// references `references/OUTPUT-FORMAT.md`, systematic-debugging ships
+	// `find-polluter.sh` and 9 more. Fetch the rest of the directory.
+	let extras: string[] = [];
+	try {
+		const tree = await fetchGitTree(repo);
+		extras = selectSkillFiles(tree.tree, repoPath).filter(
+			(rel) => rel !== "SKILL.md",
+		);
+	} catch (error) {
+		// The tree call is the rate-limited one. A skill with only SKILL.md is
+		// still correct, so report the shortfall instead of failing the install.
+		return {
+			fileCount: 1,
+			degraded:
+				error instanceof Error && /rate limit/i.test(error.message)
+					? "GitHub rate limit — supporting files not fetched. Set GITHUB_TOKEN and reinstall."
+					: "supporting files could not be listed; SKILL.md only",
+		};
+	}
+
+	if (extras.length === 0) return { fileCount: 1 };
+
+	const truncated = extras.length > MAX_SKILL_FILES;
+	const selected = truncated ? extras.slice(0, MAX_SKILL_FILES) : extras;
+
+	let written = 1;
+	let bytes = content.length;
+	let budgetHit = false;
+
+	for (const rel of selected) {
+		if (bytes >= MAX_SKILL_BYTES) {
+			budgetHit = true;
+			break;
+		}
+		const target = resolveSkillFilePath(installDir, rel);
+		if (!target) continue; // escapes the install dir — never write it
+		try {
+			const res = await fetch(
+				`https://raw.githubusercontent.com/${repo}/HEAD/${repoPath}/${rel}`,
+				{ signal: AbortSignal.timeout(15000) },
+			);
+			if (!res.ok) continue;
+			// Buffer, not text: skills ship binary assets (.png, .svg) and
+			// decoding those as UTF-8 corrupts them.
+			const buf = Buffer.from(await res.arrayBuffer());
+			await fs.ensureDir(path.dirname(target));
+			await fs.writeFile(target, buf);
+			written++;
+			bytes += buf.length;
+		} catch {
+			// One unreachable asset should not abandon a half-written skill.
+		}
+	}
+
+	let degraded: string | undefined;
+	if (budgetHit) {
+		degraded = `stopped at ${MAX_SKILL_BYTES / 1024 / 1024}MB — skill is larger than the install budget`;
+	} else if (truncated) {
+		degraded = `only the first ${MAX_SKILL_FILES} of ${extras.length + 1} files were installed`;
+	} else if (written < selected.length + 1) {
+		degraded = `${selected.length + 1 - written} of ${selected.length + 1} files could not be fetched`;
+	}
+
+	return { fileCount: written, degraded };
 }
 
 export async function uninstallSkill(
@@ -455,11 +537,20 @@ export async function uninstallSkill(
 
 	const skillMdPath = path.join(installDir, "SKILL.md");
 
+	// Remove the whole skill directory, not just SKILL.md. Installs now write
+	// supporting files (scripts, references, assets); deleting SKILL.md alone
+	// left those orphaned, and the follow-up `rmdir` then failed silently on the
+	// non-empty directory — so the skill vanished from the UI while its files
+	// stayed on disk forever.
+	//
+	// Gated on SKILL.md existing so this only ever deletes a directory that is
+	// actually an installed skill.
 	if (await fs.pathExists(skillMdPath)) {
-		await fs.remove(skillMdPath);
+		await fs.remove(installDir);
+		return;
 	}
 
-	// Try to remove directory if empty
+	// No SKILL.md: at most an empty leftover directory. Remove it only if empty.
 	try {
 		await fs.rmdir(installDir);
 	} catch {

package/src/services/skillsmp-client.ts

@@ -11,7 +11,8 @@
 // Deployed `skills` Gen2 Cloud Function (project claudish-6da10, us-central1).
 // Firebase keeps this cloudfunctions.net alias stable for the function.
 const SKILLS_API_BASE =
-	process.env.SKILLS_API_URL || "https://us-central1-claudish-6da10.cloudfunctions.net/skills";
+	process.env.SKILLS_API_URL ||
+	"https://us-central1-claudish-6da10.cloudfunctions.net/skills";
 
 export interface SkillSearchResult {
 	name: string;
@@ -31,6 +32,54 @@ export interface RepoSkillResult {
 	description?: string;
 }
 
+export interface CuratedSkillSetResult {
+	name: string;
+	repo: string;
+	description: string;
+	icon: string;
+	stars?: number;
+	skillCount?: number;
+}
+
+export interface CuratedSkillResult extends SkillSearchResult {
+	description: string;
+	category: string;
+}
+
+export interface CuratedSkillsCatalogResult {
+	schemaVersion: number;
+	version: number;
+	generatedAt: string;
+	skills: CuratedSkillResult[];
+	skillSets: CuratedSkillSetResult[];
+}
+
+function isCuratedSkill(value: unknown): value is CuratedSkillResult {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const skill = value as Record<string, unknown>;
+	return (
+		typeof skill.name === "string" &&
+		typeof skill.repo === "string" &&
+		typeof skill.skillPath === "string" &&
+		typeof skill.description === "string" &&
+		typeof skill.category === "string" &&
+		(skill.stars === undefined || typeof skill.stars === "number")
+	);
+}
+
+function isCuratedSkillSet(value: unknown): value is CuratedSkillSetResult {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const set = value as Record<string, unknown>;
+	return (
+		typeof set.name === "string" &&
+		typeof set.repo === "string" &&
+		typeof set.description === "string" &&
+		typeof set.icon === "string" &&
+		(set.stars === undefined || typeof set.stars === "number") &&
+		(set.skillCount === undefined || typeof set.skillCount === "number")
+	);
+}
+
 /**
  * Thrown when the skills API is unreachable or returns a non-OK status.
  * Lets callers distinguish "search service is down" from "no skills matched",
@@ -106,14 +155,39 @@ export async function fetchRepoSkills(
  * Get recommended skills list (curated, server-side)
  */
 export async function fetchRecommendedSkills(): Promise<SkillSearchResult[]> {
+	return (await fetchCuratedSkillsCatalog()).skills;
+}
+
+/** Load the versioned install-ready catalog and skill-set definitions. */
+export async function fetchCuratedSkillsCatalog(): Promise<CuratedSkillsCatalogResult> {
+	let res: Response;
 	try {
-		const res = await fetch(`${SKILLS_API_BASE}/recommended`, {
-			signal: AbortSignal.timeout(5000),
+		res = await fetch(`${SKILLS_API_BASE}/recommended`, {
+			signal: AbortSignal.timeout(10000),
 		});
-		if (!res.ok) return [];
-		const data = (await res.json()) as { skills: SkillSearchResult[] };
-		return data.skills || [];
-	} catch {
-		return [];
+	} catch (cause) {
+		throw new SkillsApiError(
+			`Curated skills request failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+		);
+	}
+	if (!res.ok) {
+		throw new SkillsApiError(
+			`Curated skills returned HTTP ${res.status}`,
+			res.status,
+		);
+	}
+
+	const data = (await res.json()) as Partial<CuratedSkillsCatalogResult>;
+	if (
+		typeof data.schemaVersion !== "number" ||
+		typeof data.version !== "number" ||
+		typeof data.generatedAt !== "string" ||
+		!Array.isArray(data.skills) ||
+		!data.skills.every(isCuratedSkill) ||
+		!Array.isArray(data.skillSets) ||
+		!data.skillSets.every(isCuratedSkillSet)
+	) {
+		throw new SkillsApiError("Curated skills returned a malformed response");
 	}
+	return data as CuratedSkillsCatalogResult;
 }

package/src/ui/screens/McpScreen.tsx

@@ -9,6 +9,7 @@ import {
 	getCategoryDisplayName,
 	categoryOrder,
 } from "../../data/mcp-servers.js";
+import { fetchCuratedMcpServers } from "../../services/mcp-registry.js";
 import {
 	addMcpServer,
 	removeMcpServer,
@@ -33,7 +34,10 @@ export function McpScreen() {
 	const fetchData = useCallback(async () => {
 		dispatch({ type: "MCP_DATA_LOADING" });
 		try {
-			const serversByCategory = getMcpServersByCategory();
+			const curatedServers = await fetchCuratedMcpServers(
+				AbortSignal.timeout(10_000),
+			);
+			const serversByCategory = getMcpServersByCategory(curatedServers);
 			const installedServers = await getInstalledMcpServers(state.projectPath);
 			const enabledServers = await getEnabledMcpServers(state.projectPath);
 
@@ -70,7 +74,7 @@ export function McpScreen() {
 	const allListItems = useMemo((): McpListItem[] => {
 		if (mcp.servers.status !== "success") return [];
 
-		const serversByCategory = getMcpServersByCategory();
+		const serversByCategory = getMcpServersByCategory(mcp.servers.data);
 		const items: McpListItem[] = [];
 
 		for (const category of categoryOrder) {
@@ -86,7 +90,7 @@ export function McpScreen() {
 		}
 
 		return items;
-	}, [mcp.servers.status, mcp.installedServers]);
+	}, [mcp.servers, mcp.installedServers]);
 
 	useKeyboard((event) => {
 		if (state.isSearching || state.modal) return;
@@ -142,10 +146,14 @@ export function McpScreen() {
 		let config: McpServerConfig;
 
 		if (server.type === "http") {
-			config = { type: "http", url: server.url! };
+			if (!server.url) throw new Error(`${server.name} is missing its HTTP URL`);
+			config = { type: "http", url: server.url };
 		} else {
+			if (!server.command) {
+				throw new Error(`${server.name} is missing its launch command`);
+			}
 			config = {
-				command: server.command!,
+				command: server.command,
 				args: server.args ? [...server.args] : undefined,
 				env: server.env ? { ...server.env } : undefined,
 			};