magus-cli 0.0.0-placeholder → 7.0.0

package/src/utils/run.ts

@@ -0,0 +1,67 @@
+/**
+ * Running an installer, with the shell split out from the argv.
+ *
+ * Lives in `utils/` rather than `cli/prompt.ts` because the update engine needs
+ * it and a service must not import from the CLI layer — `cli/` and `ui/` are
+ * sibling front ends over `services/`, and an arrow from a service back up into
+ * one of them is how the two front ends ended up with different update logic in
+ * the first place.
+ *
+ * Both functions live in ONE file on purpose: {@link runShellScript}'s doc only
+ * makes sense next to {@link runCommand}, because most of what it has to say is
+ * "you almost certainly want the other one".
+ */
+
+import { spawn } from "node:child_process";
+import type { Command } from "./command-utils.js";
+
+/**
+ * Run a built command as argv, streaming its output; true on exit 0.
+ *
+ * **This is the one every installer uses.** No `shell` option, so:
+ *
+ *  - `cmd` is resolved on PATH as an executable. There is no profile to source
+ *    and therefore no way for a shell alias to appear to work — the reason the
+ *    shipped `pip install` bug could exist at all was that `/bin/sh` was asked
+ *    to resolve a word that only interactive zsh knew.
+ *  - Every argument stays exactly one argument. Package names reach here from
+ *    `.claude/profiles.json` and plugin `requires.bin` — hand-authored data
+ *    committed by teammates and fetched from marketplaces — and under a shell a
+ *    space or a `$(…)` in one of them would have been executed. Nothing
+ *    validates those names, and after this nothing has to.
+ *
+ * stdio is inherited: the installer owns the terminal while it runs, which is
+ * what makes brew's and bun's own progress output visible. A caller painting an
+ * animated region must pause it around this (see `ApplyReporter.detach`).
+ */
+export async function runCommand(c: Command): Promise<boolean> {
+	return new Promise((resolve) => {
+		const child = spawn(c.cmd, [...c.args], { stdio: "inherit" });
+		child.on("exit", (code) => resolve(code === 0));
+		child.on("error", () => resolve(false));
+	});
+}
+
+/**
+ * Run a shell SCRIPT through `/bin/sh`, streaming its output; true on exit 0.
+ *
+ * **Not for installer commands — use {@link runCommand}.** This exists for
+ * exactly one input: the values of `TOOLCHAIN_BOOTSTRAP`, which are the
+ * upstream-published one-liners for bun and Homebrew. Those genuinely are shell
+ * text — one contains a pipe, the other a command substitution — so they cannot
+ * be expressed as argv without wrapping them in a fake `/bin/sh -c` at the one
+ * place where a shell is actually correct.
+ *
+ * The distinction is who wrote the string. A bootstrap line is a constant in
+ * this repo, copied from bun.sh and brew.sh. An installer command is assembled
+ * from names that arrive with a profile. Passing the second kind here is the
+ * defect that motivated splitting the two, so
+ * `src/__tests__/shell-script-callers.test.ts` pins the caller set to one file.
+ */
+export async function runShellScript(script: string): Promise<boolean> {
+	return new Promise((resolve) => {
+		const child = spawn(script, { stdio: "inherit", shell: true });
+		child.on("exit", (code) => resolve(code === 0));
+		child.on("error", () => resolve(false));
+	});
+}

package/src/utils/string-utils.ts

@@ -0,0 +1,88 @@
+/**
+ * Shared string utilities for magus
+ */
+
+/**
+ * Format marketplace name for display
+ * e.g., "magus" -> "Magus"
+ */
+export function formatMarketplaceName(name: string): string {
+	return name
+		.split(/[-_]/)
+		.map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+		.join(" ");
+}
+
+/**
+ * Validate GitHub repository format (org/repo)
+ * Prevents SSRF via malicious repo strings
+ */
+export function isValidGitHubRepo(repo: string): boolean {
+	if (!repo || typeof repo !== "string") {
+		return false;
+	}
+
+	// Must match GitHub username/repo format
+	// Username: alphanumeric, hyphens (no consecutive, not start/end)
+	// Repo: alphanumeric, hyphens, underscores, dots
+	const GITHUB_REPO_PATTERN =
+		/^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]\/[a-zA-Z0-9_.-]+$/;
+
+	// Allow single-char usernames too
+	const GITHUB_REPO_PATTERN_SHORT = /^[a-zA-Z0-9]\/[a-zA-Z0-9_.-]+$/;
+
+	if (
+		!GITHUB_REPO_PATTERN.test(repo) &&
+		!GITHUB_REPO_PATTERN_SHORT.test(repo)
+	) {
+		return false;
+	}
+
+	// Blocklist suspicious patterns
+	const BLOCKLIST = [
+		/\.\./, // Path traversal
+		/@/, // URL authority injection
+		/:/, // Port specification
+		/\s/, // Whitespace
+		/%/, // URL encoding
+		/\\/, // Backslash
+	];
+
+	return !BLOCKLIST.some((pattern) => pattern.test(repo));
+}
+
+/**
+ * Parse plugin ID into components
+ * Format: pluginName@marketplaceName
+ */
+export interface ParsedPluginId {
+	pluginName: string;
+	marketplace: string;
+	raw: string;
+}
+
+export function parsePluginId(pluginId: string): ParsedPluginId | null {
+	if (!pluginId || typeof pluginId !== "string") {
+		return null;
+	}
+
+	const trimmed = pluginId.trim();
+	const atIndex = trimmed.lastIndexOf("@");
+
+	if (atIndex <= 0) {
+		return null;
+	}
+
+	const pluginName = trimmed.slice(0, atIndex).trim();
+	const marketplace = trimmed.slice(atIndex + 1).trim();
+
+	if (!pluginName || !marketplace) {
+		return null;
+	}
+
+	return {
+		pluginName,
+		marketplace,
+		raw: trimmed,
+	};
+}