magus-cli 0.0.0-placeholder → 7.0.0

package/src/services/alias-store.ts

@@ -0,0 +1,172 @@
+/**
+ * In-memory types and defaults for the managed `claude` alias.
+ *
+ * Persistence has moved:
+ *   - Alias name lives in Claude Code's `settings.json` under `magus.aliasName`
+ *     (read/written via `alias-settings.ts`).
+ *   - Flag values are read from the user's shell rc file on screen mount
+ *     (via `parseAliasFromRc` in `alias-shell-writer.ts`). Edits stay in
+ *     memory until the user presses `w` to write the rc file.
+ *
+ * This module is filesystem-free so it can be imported by tests and pure
+ * logic without dragging in `claude-settings.ts`'s module-level `os.homedir()`
+ * constants.
+ */
+
+import { ALIAS_FLAGS, type AliasFlag } from "../data/alias-flags.js";
+
+/**
+ * Per-flag value shapes. Discriminator is `kind`, mirroring `AliasFlag.kind`.
+ */
+export type FlagValue =
+	| { kind: "boolean"; enabled: boolean }
+	| { kind: "tri-state"; state: "unset" | "on" | "off" }
+	| { kind: "select"; enabled: boolean; value: string }
+	| { kind: "text"; enabled: boolean; value: string }
+	| { kind: "optional-text"; enabled: boolean; value: string }
+	| { kind: "text-list"; enabled: boolean; values: string[] }
+	| {
+			kind: "multi-with-custom";
+			enabled: boolean;
+			picked: string[];
+			custom: string[];
+	  };
+
+/**
+ * In-memory alias configuration. No `version` field since this isn't
+ * persisted as-is anymore — the alias name is stored in `settings.json`
+ * and flag values come from the rc file.
+ */
+export interface AliasConfig {
+	/**
+	 * Name of the shell alias. Default `"c"` so users can keep typing the
+	 * vanilla `claude` command alongside the wrapped one.
+	 */
+	aliasName: string;
+	/** Per-flag state, keyed by `AliasFlag.id`. */
+	flags: Record<string, FlagValue>;
+}
+
+/** Default alias name. POSIX/fish-safe, short, and not in conflict with `claude`. */
+export const DEFAULT_ALIAS_NAME = "c";
+
+/**
+ * Validate a candidate alias name. Returns null when valid, or a human
+ * reason when invalid.
+ *
+ * We refuse anything that isn't `[A-Za-z_][A-Za-z0-9_-]*` — that's the
+ * intersection of POSIX `name` rules and fish's `alias NAME …` accepting
+ * set, and avoids the need to quote the name on either side of the `=`.
+ */
+export function validateAliasName(name: string): string | null {
+	if (name.length === 0) return "Alias name cannot be empty.";
+	if (name.length > 32) return "Alias name is unreasonably long (>32 chars).";
+	if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(name)) {
+		return "Alias name must start with a letter or underscore and contain only letters, digits, _ or -.";
+	}
+	return null;
+}
+
+/**
+ * Build the default in-memory config. Used when no managed block exists in
+ * the rc file (every flag disabled, default alias name).
+ */
+export function defaultAliasConfig(): AliasConfig {
+	const flags: Record<string, FlagValue> = {};
+	for (const flag of ALIAS_FLAGS) {
+		flags[flag.id] = defaultValueFor(flag);
+	}
+	return { aliasName: DEFAULT_ALIAS_NAME, flags };
+}
+
+// ─── Channels ⊇ dev-load (derive-on-display) ───────────────────────────
+//
+// `--channels` is the approved-channel allowlist; `--dangerously-load-
+// development-channels` sideloads channels for local dev. A dev-loaded
+// channel must also run, so at the COMMAND LINE the channels list is the
+// union of both. We do NOT store that union — provenance would be lost
+// (you couldn't tell an own channel from a derived one). Instead:
+//   - `channels.values` holds the user's OWN approved channels only.
+//   - The dev-load flag is the single source of truth for derived channels.
+//   - The editor shows them as a separate read-only section (display).
+//   - The writer unions `own ∪ dev-load(if enabled)` at RENDER time.
+// This keeps the two lists distinct everywhere except the emitted alias.
+
+/** Id of the channels allowlist flag. */
+export const CHANNELS_FLAG_ID = "channels";
+/** Id of the dev-load flag whose values are derived into channels. */
+export const DEVLOAD_FLAG_ID = "dangerously-load-development-channels";
+
+/** Read the value list off a flag value, or `[]` for non-list kinds. */
+export function listValues(v: FlagValue | undefined): string[] {
+	return v && v.kind === "text-list" ? v.values : [];
+}
+
+/**
+ * Channels that `--channels` derives from the dev-load flag for DISPLAY and
+ * for the render-time union: the dev-load flag's values, but only when that
+ * flag is enabled (a disabled dev-load contributes nothing to the alias).
+ */
+export function derivedChannelValues(
+	flags: Record<string, FlagValue>,
+): string[] {
+	const devload = flags[DEVLOAD_FLAG_ID];
+	if (!devload || devload.kind !== "text-list" || !devload.enabled) return [];
+	return devload.values;
+}
+
+/**
+ * Return a new flags map with `value` removed from the dev-load flag (the
+ * SOURCE of derived channels). Used when the user deletes a "Dev-loaded
+ * channels" row inside the --channels editor: the deletion must land on the
+ * source flag, never on `channels.values`. Disables dev-load when emptied so
+ * it stops emitting. Pure — leaves `channels.values` untouched.
+ */
+export function withoutDerivedChannel(
+	flags: Record<string, FlagValue>,
+	value: string,
+): Record<string, FlagValue> {
+	const cur = flags[DEVLOAD_FLAG_ID];
+	if (!cur || cur.kind !== "text-list") return flags;
+	const values = cur.values.filter((v) => v !== value);
+	return {
+		...flags,
+		[DEVLOAD_FLAG_ID]: {
+			kind: "text-list",
+			enabled: values.length > 0 && cur.enabled,
+			values,
+		},
+	};
+}
+
+export function defaultValueFor(flag: AliasFlag): FlagValue {
+	switch (flag.kind) {
+		case "boolean":
+			return { kind: "boolean", enabled: false };
+		case "tri-state":
+			return { kind: "tri-state", state: "unset" };
+		case "select":
+			return {
+				kind: "select",
+				enabled: false,
+				value: flag.options?.[0]?.value ?? "",
+			};
+		case "text":
+			return { kind: "text", enabled: false, value: "" };
+		case "optional-text":
+			return { kind: "optional-text", enabled: false, value: "" };
+		case "text-list":
+			return {
+				kind: "text-list",
+				enabled: false,
+				values: [...(flag.defaultValues ?? [])],
+			};
+		case "multi-with-custom":
+			return {
+				kind: "multi-with-custom",
+				enabled: false,
+				picked: [],
+				custom: [...(flag.defaultValues ?? [])],
+			};
+	}
+}

package/src/services/binary-signing.ts

@@ -0,0 +1,78 @@
+/**
+ * Code-sign a compiled magus binary, and refuse to ship one that does not
+ * verify.
+ *
+ * `bun build --compile` produces a Mach-O carrying an ad-hoc, linker-signed
+ * signature (`flags=0x20002(adhoc,linker-signed)`) and then appends the
+ * JavaScript bundle to the end of the file. The signature therefore describes
+ * a shorter file than the one that ships. `codesign -v` has reported
+ * "invalid signature (code or signature have been modified)" on every
+ * published magus binary back to 4.22.0.
+ *
+ * macOS 27 refuses to exec such a binary: SIGKILL at startup, no output. The
+ * build never signed anything, so nothing caught it — `codesign` appeared
+ * nowhere in this package.
+ *
+ * Signing is ad-hoc (`--sign -`) rather than Developer ID on purpose: files
+ * installed by npm are not quarantined, so Gatekeeper never evaluates them.
+ * The kernel's signature check is the only gate that was failing, and an
+ * ad-hoc signature satisfies it — with no Apple account, no CI secrets and no
+ * notarization wait.
+ */
+
+import { spawnSync } from "node:child_process";
+
+/** Result of one external command. Injected so the logic is testable. */
+export type Run = (
+	cmd: string,
+	args: string[],
+) => { status: number | null; stderr: string };
+
+const realRun: Run = (cmd, args) => {
+	const result = spawnSync(cmd, args, { encoding: "utf8" });
+	// Fail closed and say why. A missing `codesign` must stop the build, not
+	// quietly skip signing — and the raw ENOENT names neither the binary being
+	// signed nor the reason signing is mandatory.
+	if (result.error) {
+		throw new Error(
+			`Could not run \`${cmd}\` while signing ${args[args.length - 1]}: ${result.error.message}\nSigning is mandatory for darwin binaries — macOS kills an unsigned one at exec.`,
+		);
+	}
+	return { status: result.status, stderr: result.stderr ?? "" };
+};
+
+/**
+ * Only darwin. `codesign` does not exist elsewhere, and no other platform
+ * validates a signature at exec.
+ */
+export const needsSigning = (target: { os: string }): boolean =>
+	target.os === "darwin";
+
+/**
+ * Sign the binary, then verify it. A failing verify THROWS.
+ *
+ * This is a gate, not an advisory. The whole defect being fixed is a release
+ * that shipped a binary whose signature did not match it; a warning here would
+ * reproduce that exactly, one log line louder.
+ */
+export function signAndVerify(
+	target: { os: string },
+	binPath: string,
+	run: Run = realRun,
+): void {
+	if (!needsSigning(target)) return;
+
+	const signed = run("codesign", ["--force", "--sign", "-", binPath]);
+	if (signed.status !== 0) {
+		throw new Error(
+			`codesign --sign failed for ${binPath} (exit ${signed.status})\n${signed.stderr}`,
+		);
+	}
+
+	const verified = run("codesign", ["--verify", "--strict", binPath]);
+	if (verified.status !== 0) {
+		throw new Error(
+			`codesign --verify --strict rejected ${binPath} (exit ${verified.status}).\nRefusing to ship a binary macOS will kill at exec.\n${verified.stderr}`,
+		);
+	}
+}

package/src/services/catalog-cache-store.ts

@@ -0,0 +1,316 @@
+/**
+ * catalog-cache-store.ts — the catalog cache and the rate-limit cooldown, on disk.
+ *
+ * Why on disk
+ * -----------
+ * Every cache in this area used to be a module-level `Map`, which for a TUI means
+ * "cleared on every launch". Measured 2026-08-17, two consecutive processes:
+ *
+ *   [process-1] 6 HTTP requests in 13.32s
+ *   [process-2] 6 HTTP requests in 13.01s
+ *
+ * So each launch re-fetched all six catalogs, and the second process had no idea
+ * the first had just been rate-limited — it spent six more requests rediscovering
+ * that. On some endpoints a rejected request extends the penalty, so an in-memory
+ * cooldown is not merely useless across launches, it is counterproductive.
+ *
+ * Persisting the cooldown is the more important half. A stale catalog costs the
+ * user a version number that is an hour old; re-firing six doomed requests on
+ * every launch costs them the ability to check at all.
+ *
+ * Trade-off, stated
+ * -----------------
+ * A cached catalog means a release published inside the TTL is not visible yet.
+ * That is why the TTL is short, why `r` forces a real refetch, and why the age is
+ * available for display. A cache the user cannot see through or override would be
+ * the same trap as a frozen clone.
+ */
+
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { claudeConfigDirOrNull } from "../utils/config-dir.js";
+import { withFileLock } from "../utils/file-locking.js";
+import type { MarketplacePlugin } from "./marketplace-catalog.js";
+
+/**
+ * How long a cached catalog is served before we ask again.
+ *
+ * This is the ONLY refresh rhythm magus has, and it is why the TUI and
+ * `magus update` can disagree about the same plugin for up to an hour:
+ * `update` fast-forwards the clones and clears this cache before planning,
+ * while the TUI serves whatever is here. That is not a bug in either path, but
+ * anything that reports "no update" off a cached catalog has to say the answer
+ * is up to an hour old.
+ */
+export const CATALOG_TTL_MS = 60 * 60 * 1000;
+
+interface StoredCatalog {
+	fetchedAt: number;
+	/** Which transport answered — carried so the UI can still say "unverified". */
+	source: string;
+	plugins: MarketplacePlugin[];
+}
+
+interface StoredCooldown {
+	until: number;
+	exact: boolean;
+	strikes: number;
+}
+
+/**
+ * What the last upstream check learned about one community-styles repository.
+ *
+ * Lives here rather than in a fourth cache file so it inherits this store's file
+ * lock, atomic write and CLAUDE_CONFIG_DIR test isolation — and, more to the
+ * point, so it sits beside the rate-limit cooldowns it is budgeted against.
+ *
+ * `dirHeadSha` is the pivot of the two-phase check: one API call per REPO
+ * answers "did anything in its styles directory move", and only a repo that
+ * moved is drilled into with free raw fetches. Per-style API calls would spend
+ * the machine's whole hourly budget on first use.
+ */
+export interface StoredCommunityCheck {
+	/** Wall-clock ms of the last successful phase A. Drives the 24h TTL. */
+	checkedAt: number;
+	/** Latest commit touching the repo's styles directory, as of that check. */
+	dirHeadSha: string;
+	/** Per coordinate id: the bytes we hold, and any update sitting in .pending/. */
+	styles: Record<
+		string,
+		{
+			sha256: string;
+			pendingSha256?: string;
+			/** Changed-line count of that pending update, so it survives a restart. */
+			pendingLines?: number;
+		}
+	>;
+}
+
+interface StoreShape {
+	version: 1;
+	catalogs: Record<string, StoredCatalog>;
+	cooldowns: Record<string, StoredCooldown>;
+	communityStyles: Record<string, StoredCommunityCheck>;
+}
+
+const EMPTY: StoreShape = {
+	version: 1,
+	catalogs: {},
+	cooldowns: {},
+	communityStyles: {},
+};
+
+/**
+ * Resolved per call, honouring CLAUDE_CONFIG_DIR — same reasoning as
+ * content-drift.ts and marketplace-catalog-git.ts.
+ *
+ * Null when a test has not chosen a config dir, which makes this whole store inert
+ * rather than letting an unisolated test read the operator's live cooldown and
+ * decide its own outcome from it. See utils/config-dir.ts.
+ */
+function storePath(): string | null {
+	const configDir = claudeConfigDirOrNull();
+	if (!configDir) return null;
+	return path.join(configDir, "magus-catalog-cache.json");
+}
+
+/**
+ * Read-through memo for this process. The disk file is the cross-launch cache;
+ * this just avoids re-reading and re-parsing it on every lookup within one run.
+ */
+let memo: { path: string; data: StoreShape } | null = null;
+
+async function load(): Promise<StoreShape> {
+	const file = storePath();
+	if (!file)
+		return { version: 1, catalogs: {}, cooldowns: {}, communityStyles: {} };
+	if (memo?.path === file) return memo.data;
+	try {
+		const parsed = JSON.parse(await fs.readFile(file, "utf-8")) as StoreShape;
+		// A cache from a future/unknown layout is discarded rather than migrated:
+		// it is regenerable by definition, so guessing at it buys nothing.
+		const data = parsed?.version === 1 ? parsed : { ...EMPTY };
+		data.catalogs ??= {};
+		data.cooldowns ??= {};
+		// Absent in every file written before community styles existed, so this
+		// default is the migration — an upgrade must not read as a corrupt cache.
+		data.communityStyles ??= {};
+		memo = { path: file, data };
+		return data;
+	} catch {
+		// Absent or corrupt. A cache must never be a failure mode — start empty.
+		const data: StoreShape = {
+			...EMPTY,
+			catalogs: {},
+			cooldowns: {},
+			communityStyles: {},
+		};
+		memo = { path: file, data };
+		return data;
+	}
+}
+
+/**
+ * Apply a mutation and persist it.
+ *
+ * Locked and re-read inside the lock, because two magus processes can be open
+ * at once and a blind read-modify-write would drop the other's cooldown — exactly
+ * the record we most need to keep.
+ */
+async function mutate(fn: (data: StoreShape) => void): Promise<void> {
+	const file = storePath();
+	if (!file) return;
+	try {
+		await fs.mkdir(path.dirname(file), { recursive: true });
+		await withFileLock(file, async () => {
+			let onDisk: StoreShape;
+			try {
+				const parsed = JSON.parse(
+					await fs.readFile(file, "utf-8"),
+				) as StoreShape;
+				// Every section is named explicitly: a key omitted here is silently
+				// dropped on the next write of any OTHER section.
+				onDisk =
+					parsed?.version === 1
+						? {
+								version: 1,
+								catalogs: parsed.catalogs ?? {},
+								cooldowns: parsed.cooldowns ?? {},
+								communityStyles: parsed.communityStyles ?? {},
+							}
+						: { version: 1, catalogs: {}, cooldowns: {}, communityStyles: {} };
+			} catch {
+				onDisk = {
+					version: 1,
+					catalogs: {},
+					cooldowns: {},
+					communityStyles: {},
+				};
+			}
+			fn(onDisk);
+			// Temp + rename, so a crash mid-write cannot leave a half-written file
+			// that the next launch has to treat as corrupt.
+			const tmp = `${file}.${process.pid}.tmp`;
+			await fs.writeFile(tmp, JSON.stringify(onDisk), "utf-8");
+			await fs.rename(tmp, file);
+			memo = { path: file, data: onDisk };
+		});
+	} catch {
+		// Never let a cache write break the run. Worst case we re-fetch next time.
+	}
+}
+
+// ─── Catalogs ────────────────────────────────────────────────────────────────
+
+export interface CachedCatalog {
+	plugins: MarketplacePlugin[];
+	source: string;
+	/** Milliseconds since it was fetched — for display, and for the TTL test. */
+	ageMs: number;
+}
+
+/** A cached catalog for this marketplace, if one is present and still fresh. */
+export async function readCachedCatalog(
+	marketplace: string,
+	now: number = Date.now(),
+): Promise<CachedCatalog | null> {
+	const data = await load();
+	const entry = data.catalogs[marketplace];
+	if (!entry) return null;
+	const ageMs = now - entry.fetchedAt;
+	if (ageMs < 0 || ageMs > CATALOG_TTL_MS) return null;
+	return { plugins: entry.plugins, source: entry.source, ageMs };
+}
+
+export async function writeCachedCatalog(
+	marketplace: string,
+	plugins: MarketplacePlugin[],
+	source: string,
+	now: number = Date.now(),
+): Promise<void> {
+	// An empty catalog is never worth caching: it is indistinguishable from a
+	// failure we did not classify, and serving it would resurrect the original bug.
+	if (plugins.length === 0) return;
+	await mutate((data) => {
+		data.catalogs[marketplace] = { fetchedAt: now, source, plugins };
+	});
+}
+
+/** Drop every cached catalog. Backs the explicit refresh (`r`). */
+export async function clearCachedCatalogs(): Promise<void> {
+	await mutate((data) => {
+		data.catalogs = {};
+	});
+}
+
+// ─── Cooldowns ───────────────────────────────────────────────────────────────
+
+export async function readStoredCooldowns(
+	now: number = Date.now(),
+): Promise<Record<string, StoredCooldown>> {
+	const data = await load();
+	const live: Record<string, StoredCooldown> = {};
+	for (const [host, cooldown] of Object.entries(data.cooldowns)) {
+		// Expired entries are dropped on read rather than persisted forever. The
+		// strike count goes with them: a cooldown that lapsed a day ago should not
+		// make today's first failure back off for ten minutes.
+		if (cooldown.until > now) live[host] = cooldown;
+	}
+	return live;
+}
+
+export async function writeStoredCooldown(
+	host: string,
+	cooldown: StoredCooldown,
+): Promise<void> {
+	await mutate((data) => {
+		data.cooldowns[host] = cooldown;
+	});
+}
+
+export async function clearStoredCooldown(host: string): Promise<void> {
+	await mutate((data) => {
+		delete data.cooldowns[host];
+	});
+}
+
+// ─── Community style checks ──────────────────────────────────────────────────
+
+/**
+ * Every recorded upstream check, keyed by community source id.
+ *
+ * Deliberately NOT expired on read, unlike cooldowns. An expired cooldown means
+ * "you may call again"; an expired CHECK still carries the shas we compare
+ * against, and only its `checkedAt` has gone stale. Dropping it would throw away
+ * the one thing that makes the next check cheap, and would make a 25-hour-old
+ * result indistinguishable from never having looked. Freshness is judged by the
+ * reader, which is what lets an expired check present as `unknown` rather than
+ * as up to date.
+ */
+export async function readCommunityChecks(): Promise<
+	Record<string, StoredCommunityCheck>
+> {
+	return { ...(await load()).communityStyles };
+}
+
+export async function writeCommunityCheck(
+	sourceId: string,
+	check: StoredCommunityCheck,
+): Promise<void> {
+	await mutate((data) => {
+		data.communityStyles ??= {};
+		data.communityStyles[sourceId] = check;
+	});
+}
+
+/** Drop every recorded check. Backs an explicit refresh. */
+export async function clearCommunityChecks(): Promise<void> {
+	await mutate((data) => {
+		data.communityStyles = {};
+	});
+}
+
+/** Test seam: forget this process's memo so the next read hits disk. */
+export function resetCatalogCacheMemo(): void {
+	memo = null;
+}