magus-cli 7.11.5 → 7.11.6

package/src/__tests__/mcp-registry-screen-debounce.test.tsx

@@ -0,0 +1,195 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { testRender } from "@opentui/react/test-utils";
+import { act, useEffect } from "react";
+import { KeyRouter } from "../ui/input/KeyRouter.js";
+import McpRegistryScreen from "../ui/screens/McpRegistryScreen.js";
+import { AppProvider, useNavigation } from "../ui/state/AppContext.js";
+import { DimensionsProvider } from "../ui/state/DimensionsContext.js";
+
+// REGRESSION: MTL-337 debounce window and cursor jump — round 2 of /dev:fix session dev-fix-20261101-153739-a08a5829
+//
+// The real McpRegistryScreen is mounted under the real providers, with a fake
+// `fetch` for the registry endpoint and a throwaway project path. Keys go
+// through the test renderer's mock keyboard; the outcome is read from what the
+// screen wrote to .mcp.json.
+
+// Real-looking hosts for the servers whose host decides "official"; every
+// other name gets an example.org host.
+const HOSTS: Record<string, string> = {
+	"com.notion/mcp": "https://mcp.notion.com/mcp",
+	"ai.smithery/smithery-notion": "https://server.smithery.ai/notion/mcp",
+	"com.linear/mcp": "https://mcp.linear.com/mcp",
+};
+
+const server = (name: string) => ({
+	name,
+	url: HOSTS[name] ?? `https://${name.replace(/[^a-z]/g, "")}.example.org/mcp`,
+	short_description: `${name} description`,
+});
+
+type Deferred = { query: string; resolve: (names: string[]) => void };
+
+let cleanup: Array<() => Promise<void> | void> = [];
+const realFetch = globalThis.fetch;
+
+afterEach(async () => {
+	globalThis.fetch = realFetch;
+	for (const fn of cleanup.reverse()) await fn();
+	cleanup = [];
+});
+
+function GoToRegistry() {
+	const { navigateToScreen } = useNavigation();
+	// biome-ignore lint/correctness/useExhaustiveDependencies: navigate once on mount
+	useEffect(() => navigateToScreen("mcp-registry"), []);
+	return null;
+}
+
+async function mount(initialNames: string[]) {
+	const project = mkdtempSync(join(tmpdir(), "mcp-registry-screen-"));
+	cleanup.push(() => rmSync(project, { recursive: true, force: true }));
+
+	const pending: Deferred[] = [];
+	globalThis.fetch = (async (input: unknown) => {
+		const url = new URL(String(input));
+		const query = url.searchParams.get("q") ?? "";
+		const names = await new Promise<string[]>((resolve) => {
+			if (query === "") resolve(initialNames);
+			else pending.push({ query, resolve });
+		});
+		return new Response(JSON.stringify({ servers: names.map(server) }), {
+			status: 200,
+			headers: { "content-type": "application/json" },
+		});
+	}) as typeof fetch;
+
+	const { renderer, mockInput, renderOnce, captureCharFrame } =
+		await testRender(
+			<AppProvider initialProjectPath={project}>
+				<DimensionsProvider>
+					<KeyRouter>
+						<GoToRegistry />
+						<McpRegistryScreen />
+					</KeyRouter>
+				</DimensionsProvider>
+			</AppProvider>,
+			{ width: 110, height: 30 },
+		);
+	cleanup.push(async () => {
+		await act(async () => renderer.destroy());
+	});
+
+	const settle = async (ms = 30) => {
+		for (let i = 0; i < 3; i++) {
+			await new Promise((r) => setTimeout(r, ms));
+			await renderOnce();
+		}
+	};
+	const send = async (fn: () => void | Promise<void>, ms?: number) =>
+		act(async () => {
+			await fn();
+			await settle(ms);
+		});
+	await act(() => settle());
+
+	const mcpJson = () => {
+		const path = join(project, ".mcp.json");
+		return existsSync(path) ? readFileSync(path, "utf8") : "";
+	};
+	return { mockInput, send, settle, pending, mcpJson, frame: captureCharFrame };
+}
+
+describe("registry screen: the list is not actionable while a query change is pending", () => {
+	test("typing a query then Enter, Enter inside the debounce installs nothing from the old list", async () => {
+		const m = await mount(["com.old/alpha", "com.old/beta"]);
+
+		// "/" opens the search box, the text is typed, the first Enter leaves it,
+		// the second Enter installs the row under the cursor. All of it happens
+		// well inside the 300 ms debounce, before loadServers has started.
+		await m.send(() => m.mockInput.typeText("/notion"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+
+		expect(m.pending).toHaveLength(0); // debounce has not fired yet
+		expect(m.mcpJson()).not.toContain("com.old/");
+	});
+
+	test("after the new query's response lands, Enter installs the new list's first row", async () => {
+		const m = await mount(["com.old/alpha", "com.old/beta"]);
+		await m.send(() => m.mockInput.typeText("/notion"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.settle(400); // debounce fires, request is now pending
+		expect(m.pending).toHaveLength(1);
+		await m.send(() => m.pending[0]?.resolve(["com.notion/mcp"]));
+		await m.send(() => m.mockInput.pressEnter(), 100);
+
+		expect(m.mcpJson()).toContain("com.notion/mcp");
+	});
+});
+
+describe("registry screen: the cursor follows the name only when the query is unchanged", () => {
+	test("a new query puts the cursor on row 0 of the new results, even when the old row-0 server is in them", async () => {
+		const m = await mount(["com.old/alpha", "com.old/beta"]);
+		await m.send(() => m.mockInput.typeText("/x"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.settle(400);
+		expect(m.pending).toHaveLength(1);
+		// The old row-0 server comes back, but second.
+		await m.send(() =>
+			m.pending[0]?.resolve(["com.new/first", "com.old/alpha"]),
+		);
+		await m.send(() => m.mockInput.pressEnter(), 100);
+
+		expect(m.mcpJson()).toContain("com.new/first");
+		expect(m.mcpJson()).not.toContain("com.old/alpha");
+	});
+});
+
+describe("registry screen: the official badge follows the search", () => {
+	const rowLines = (frame: string, needle: string) =>
+		frame.split("\n").filter((line) => line.includes(needle));
+
+	test("the unfiltered list shows no official badge on any row", async () => {
+		const m = await mount([
+			"com.linear/mcp",
+			"ai.smithery/smithery-notion",
+			"com.notion/mcp",
+		]);
+		await m.send(() => m.settle(400)); // the initial load runs behind the debounce
+		expect(m.frame()).toContain("notion/mcp"); // the rows did render
+		expect(m.frame()).not.toContain("official");
+	});
+
+	test("after searching notion only the real notion server is badged, and it is first", async () => {
+		const m = await mount([
+			"com.linear/mcp",
+			"ai.smithery/smithery-notion",
+			"com.notion/mcp",
+		]);
+		await m.send(() => m.mockInput.typeText("/notion"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.settle(400);
+		expect(m.pending).toHaveLength(1);
+		// The endpoint answers with the third-party server before the real one.
+		await m.send(() =>
+			m.pending[0]?.resolve(["ai.smithery/smithery-notion", "com.notion/mcp"]),
+		);
+
+		await m.send(() => m.settle(100));
+		const frame = m.frame();
+		const lines = frame.split("\n");
+		const notionRow = lines.findIndex((l) => l.includes("com.notion/mcp"));
+		const smitheryRow = lines.findIndex((l) =>
+			l.includes("ai.smithery/smithery-notion"),
+		);
+		expect(notionRow).toBeGreaterThanOrEqual(0);
+		expect(notionRow).toBeLessThan(smitheryRow); // official first
+		expect(lines[notionRow]).toContain("official");
+		expect(rowLines(frame, "smithery-notion").join("\n")).not.toContain(
+			"official",
+		);
+	});
+});

package/src/__tests__/mcp-registry-screen.test.ts

@@ -0,0 +1,209 @@
+import { describe, expect, test } from "bun:test";
+import { parseKeypress } from "@opentui/core";
+import {
+	createLatestOnlyGuard,
+	isOfficialMcpServer,
+	officialFirst,
+} from "../services/mcp-registry.js";
+import type { KeyPress } from "../ui/input/key-dispatch.js";
+import { SCREEN_BINDINGS, matchBinding } from "../ui/keymap.js";
+
+// REGRESSION: MTL-337 registry screen installs the wrong server / no remove / no official first — Fixed in /dev:fix session dev-fix-20261101-153739-a08a5829
+
+const srv = (name: string, url: string) => ({
+	name,
+	url,
+	short_description: "",
+});
+
+const press = (raw: string): KeyPress => {
+	const k = parseKeypress(raw);
+	return {
+		name: k?.name ?? "",
+		sequence: k?.sequence ?? "",
+		ctrl: k?.ctrl === true,
+		meta: k?.meta === true,
+		shift: k?.shift === true,
+	};
+};
+
+describe("isOfficialMcpServer", () => {
+	const notion = srv("com.notion/mcp", "https://mcp.notion.com/mcp");
+
+	test("an empty or whitespace query makes nothing official", () => {
+		expect(isOfficialMcpServer(notion, "")).toBe(false);
+		expect(isOfficialMcpServer(notion, "   ")).toBe(false);
+	});
+
+	test("com.notion/mcp served from mcp.notion.com is official for the query notion", () => {
+		expect(isOfficialMcpServer(notion, "notion")).toBe(true);
+	});
+
+	test("a third-party host is not official for the brand it mentions", () => {
+		expect(
+			isOfficialMcpServer(
+				srv("ai.smithery/smithery-notion", "https://server.smithery.ai/notion"),
+				"notion",
+			),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(
+				srv("com.foreverworks/notion", "https://mcp.foreverworks.com/notion"),
+				"notion",
+			),
+		).toBe(false);
+	});
+
+	test("a server is official for its own brand, but not for another brand's query", () => {
+		const smithery = srv(
+			"ai.smithery/smithery-notion",
+			"https://server.smithery.ai/notion",
+		);
+		expect(isOfficialMcpServer(smithery, "smithery")).toBe(true);
+		expect(isOfficialMcpServer(notion, "smithery")).toBe(false);
+	});
+
+	test("the query is case-insensitive and split into words", () => {
+		expect(isOfficialMcpServer(notion, "Notion MCP")).toBe(true);
+		expect(isOfficialMcpServer(notion, "mcp-NOTION")).toBe(true);
+	});
+
+	test("a word must equal the brand, a substring does not count", () => {
+		expect(isOfficialMcpServer(notion, "notional")).toBe(false);
+		expect(isOfficialMcpServer(notion, "not")).toBe(false);
+	});
+
+	test("com.mcparmory/notion packaged on pypi is not official", () => {
+		expect(
+			isOfficialMcpServer(
+				srv("com.mcparmory/notion", "pypi:mcparmory-notion"),
+				"mcparmory notion",
+			),
+		).toBe(false);
+	});
+
+	test("an io.github.<owner> namespace is never official, even when the host matches", () => {
+		expect(
+			isOfficialMcpServer(
+				srv("io.github.someone/notion", "https://github.io/someone/notion"),
+				"github someone notion",
+			),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(
+				srv("io.github.notion/mcp", "https://mcp.github.io/mcp"),
+				"github notion",
+			),
+		).toBe(false);
+	});
+
+	test("npm: and pypi: sources are not official", () => {
+		expect(
+			isOfficialMcpServer(srv("com.notion/mcp", "npm:@notion/mcp"), "notion"),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(srv("com.notion/mcp", "pypi:notion-mcp"), "notion"),
+		).toBe(false);
+	});
+
+	test("an unparsable URL is not official", () => {
+		expect(
+			isOfficialMcpServer(srv("com.notion/mcp", "not a url"), "notion"),
+		).toBe(false);
+		expect(isOfficialMcpServer(srv("com.notion/mcp", ""), "notion")).toBe(
+			false,
+		);
+	});
+
+	test("a namespace that is only a string prefix of the host does not match on a label boundary", () => {
+		expect(
+			isOfficialMcpServer(srv("com.not/x", "https://notion.com/mcp"), "not"),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(srv("com.not/x", "https://notion.com/mcp"), "notion"),
+		).toBe(false);
+	});
+});
+
+describe("officialFirst", () => {
+	const a = srv("io.github.a/one", "https://a.example.org/mcp");
+	const o1 = srv("com.notion/mcp", "https://mcp.notion.com/mcp");
+	const b = srv("com.mcparmory/notion", "pypi:mcparmory-notion");
+	const o2 = srv("com.notion/second", "https://api.notion.com/second");
+	const other = srv("com.linear/mcp", "https://mcp.linear.com/mcp");
+
+	test("official servers move to the front, endpoint order kept inside each group", () => {
+		expect(officialFirst([a, o1, b, other, o2], "notion")).toEqual([
+			o1,
+			o2,
+			a,
+			b,
+			other,
+		]);
+	});
+
+	test("with an empty query the order is unchanged", () => {
+		expect(officialFirst([a, o1, b, o2], "")).toEqual([a, o1, b, o2]);
+	});
+
+	test("does not mutate its input", () => {
+		const input = [a, o1, b];
+		const snapshot = [...input];
+		const out = officialFirst(input, "notion");
+		expect(input).toEqual(snapshot);
+		expect(out).not.toBe(input);
+	});
+
+	test("an empty list stays empty", () => {
+		expect(officialFirst([], "notion")).toEqual([]);
+	});
+});
+
+describe("MCP registry keymap", () => {
+	test("d is bound to a remove action on the mcp-registry screen", () => {
+		expect(matchBinding(SCREEN_BINDINGS["mcp-registry"], press("d"))?.id).toBe(
+			"remove",
+		);
+	});
+});
+
+describe("stale registry responses", () => {
+	// The screen (McpRegistryScreen.tsx) is a React/OpenTUI component whose
+	// loadServers closes over component state; the repo has no harness that
+	// drives it with fake fetches. The guard is therefore tested as the small
+	// pure helper the screen will call: take a token before each request, apply
+	// the response only when isLatest(token) still holds.
+	test("only the newest request's response is applied when responses arrive out of order", async () => {
+		const guard = createLatestOnlyGuard();
+		const deferred = <T>() => {
+			let resolve!: (v: T) => void;
+			const promise = new Promise<T>((r) => {
+				resolve = r;
+			});
+			return { promise, resolve };
+		};
+		const first = deferred<string[]>();
+		const second = deferred<string[]>();
+		let applied: string[] | null = null;
+		const appliedFrom: string[] = [];
+
+		const load = async (label: string, p: Promise<string[]>) => {
+			const token = guard.next();
+			const result = await p;
+			if (guard.isLatest(token)) {
+				applied = result;
+				appliedFrom.push(label);
+			}
+		};
+
+		const a = load("old", first.promise);
+		const b = load("new", second.promise);
+		second.resolve(["new-server"]); // newest answers first
+		await b;
+		first.resolve(["old-server"]); // stale answer lands last
+		await a;
+
+		expect(applied).toEqual(["new-server"]);
+		expect(appliedFrom).toEqual(["new"]);
+	});
+});

package/src/services/mcp-registry.ts

@@ -2,6 +2,7 @@ import type {
 	McpRegistryResponse,
 	McpRegistryServer,
 	McpServer,
+	McpServerConfig,
 } from "../types/index.js";
 
 const DEFAULT_MCP_REGISTRY_API =
@@ -155,6 +156,155 @@ export async function fetchCuratedMcpServers(
 	return servers;
 }
 
+/**
+ * Whether the server is run by the owner of the domain its name claims.
+ * The name is `<reverse-dns namespace>/<slug>`; the server is official when the
+ * namespace labels are a label-boundary prefix of the URL host's reversed labels
+ * (`com.notion` for `mcp.notion.com`). Code-host namespaces (`io.github.*`) name
+ * an account, not an owner, and npm:/pypi:/unparsable sources have no host.
+ * It is official FOR A SEARCH: the brand (the namespace's second label, `notion`
+ * in `com.notion`) must equal, as a whole word, one of the search words.
+ */
+export function isOfficialMcpServer(
+	server: Pick<McpRegistryServer, "name" | "url">,
+	query: string,
+): boolean {
+	const words = query
+		.toLowerCase()
+		.split(/[^\p{L}\p{N}]+/u)
+		.filter(Boolean);
+	if (words.length === 0) return false;
+	const namespace = server.name.split("/")[0]?.toLowerCase() ?? "";
+	const labels = namespace.split(".");
+	if (labels.length < 2 || labels.some((label) => label === "")) return false;
+	if (labels[0] === "io" && labels[1] === "github") return false;
+	if (!words.includes(labels[1] as string)) return false;
+
+	let host: string;
+	try {
+		const url = new URL(server.url);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+		host = url.hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+
+	const hostLabels = host.split(".").reverse();
+	return (
+		labels.length <= hostLabels.length &&
+		labels.every((label, i) => label === hostLabels[i])
+	);
+}
+
+export type RegistryInstallKind = "http" | "pypi" | "npm";
+export type RegistryInstallPlan =
+	| { ok: true; kind: RegistryInstallKind; config: McpServerConfig }
+	| { ok: false; kind: string; reason: string };
+
+// Strict single tokens that cannot start with `-`: registry rows are
+// third-party data and the name becomes an argv element, so `npm:-y` or
+// `npm:--package=evil` must never turn into an option.
+const NPM_PACKAGE =
+	/^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*(?:@[a-z0-9][a-z0-9._+-]*)?$/i;
+const PYPI_PACKAGE =
+	/^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:@[a-z0-9][a-z0-9._+-]*)?$/i;
+
+function refuse(kind: string, reason: string): RegistryInstallPlan {
+	return { ok: false, kind, reason };
+}
+
+function unreadableAddress(): RegistryInstallPlan {
+	return refuse("unknown", "magus can't read this server's address.");
+}
+
+/**
+ * What installing a registry row writes, decided by the row's `url` alone
+ * (`package_registry` is ignored: an `https:` row stays hosted). Expected
+ * refusals are returned, never thrown. No shell: the entry is command + args.
+ */
+export function registryInstallPlan(
+	server: Pick<McpRegistryServer, "url">,
+): RegistryInstallPlan {
+	const raw = (server.url ?? "").trim();
+	const match = /^([a-z][a-z0-9+.-]*):(.*)$/is.exec(raw);
+	if (!match) return unreadableAddress();
+	const scheme = (match[1] as string).toLowerCase();
+	const rest = (match[2] as string).trim();
+	// `localhost:8080` is host:port, not a scheme.
+	if (/^\d+(?:[/?#]|$)/.test(rest)) return unreadableAddress();
+
+	if (scheme === "http" || scheme === "https") {
+		try {
+			if (new URL(raw).hostname) {
+				return {
+					ok: true,
+					kind: "http",
+					config: { type: "http", url: raw },
+				};
+			}
+		} catch {
+			// falls through to the refusal below
+		}
+		return unreadableAddress();
+	}
+
+	if (scheme === "pypi" || scheme === "npm") {
+		if (rest === "") {
+			return refuse(
+				scheme,
+				`This ${scheme} server has no package name, so there's nothing to run.`,
+			);
+		}
+		const pattern = scheme === "pypi" ? PYPI_PACKAGE : NPM_PACKAGE;
+		if (!pattern.test(rest)) {
+			return refuse(
+				scheme,
+				`The package name of this ${scheme} server looks wrong, so magus won't run it.`,
+			);
+		}
+		return {
+			ok: true,
+			kind: scheme,
+			config:
+				scheme === "pypi"
+					? { command: "uvx", args: [rest] }
+					: { command: "npx", args: ["-y", rest] },
+		};
+	}
+
+	return refuse(
+		scheme,
+		`magus can't install ${scheme} servers. It can install https, pypi and npm ones.`,
+	);
+}
+
+/** Official servers first; endpoint order is kept inside each group. */
+export function officialFirst<
+	T extends Pick<McpRegistryServer, "name" | "url">,
+>(servers: readonly T[], query: string): T[] {
+	const official = servers.filter((server) =>
+		isOfficialMcpServer(server, query),
+	);
+	const rest = servers.filter((server) => !isOfficialMcpServer(server, query));
+	return [...official, ...rest];
+}
+
+/**
+ * Last-to-start wins: take a token before each request and apply its response
+ * only while `isLatest(token)` still holds.
+ */
+export function createLatestOnlyGuard(): {
+	next(): number;
+	isLatest(token: number): boolean;
+} {
+	let latest = 0;
+	return {
+		next: () => ++latest,
+		isLatest: (token) => token === latest,
+	};
+}
+
 export function formatDate(dateStr?: string): string {
 	if (!dateStr) return "";
 	const date = new Date(dateStr);

package/src/ui/keymap.ts

@@ -294,6 +294,7 @@ const MCP_REGISTRY = [
 	bind("install", ["Enter"], "install", "Add the server to this project", 90),
 	search("Search the registry; the list reloads as you type"),
 	bind("local", ["l"], "local", "Back to this project's MCP servers", 50),
+	bind("remove", ["d"], "remove", "Remove the server from this project", 45),
 	bind("reload", ["R"], "reload", "Reload the results", 40),
 	CLEAR_FILTER,
 	MOVE,

package/src/ui/renderers/mcpRenderers.tsx

@@ -97,6 +97,8 @@ export interface McpRegistryListItem {
 	server: McpRegistryServer;
 	isInstalled: boolean;
 	needsRestart: boolean;
+	/** Run by the owner of the domain its name claims. */
+	isOfficial: boolean;
 }
 
 export function renderMcpRegistryRow(
@@ -104,10 +106,11 @@ export function renderMcpRegistryRow(
 	_index: number,
 	isSelected: boolean,
 ): React.ReactNode {
-	const { server, isInstalled, needsRestart } = item;
+	const { server, isInstalled, needsRestart, isOfficial } = item;
 	const version = server.version ? ` v${server.version}` : "";
 	const icon = isInstalled ? "● " : "";
 	const restart = needsRestart ? RESTART_MARK : "";
+	const official = isOfficial ? " official" : "";
 	if (isSelected) {
 		return (
 			<text bg={theme.selection.bg} fg={theme.selection.fg}>
@@ -115,6 +118,7 @@ export function renderMcpRegistryRow(
 				{icon}
 				{server.name}
 				{version}
+				{official}
 				{restart}{" "}
 			</text>
 		);
@@ -127,6 +131,7 @@ export function renderMcpRegistryRow(
 				<strong>{server.name}</strong>
 			</span>
 			<span fg={theme.colors.info}>{version}</span>
+			{official ? <span fg={theme.colors.success}>{official}</span> : null}
 			{restart ? <span fg={theme.colors.warning}>{restart}</span> : null}
 		</text>
 	);