magus-cli 7.11.5 → 7.11.7

package/src/__tests__/mcp-registry-screen-debounce.test.tsx

@@ -0,0 +1,195 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { testRender } from "@opentui/react/test-utils";
+import { act, useEffect } from "react";
+import { KeyRouter } from "../ui/input/KeyRouter.js";
+import McpRegistryScreen from "../ui/screens/McpRegistryScreen.js";
+import { AppProvider, useNavigation } from "../ui/state/AppContext.js";
+import { DimensionsProvider } from "../ui/state/DimensionsContext.js";
+
+// REGRESSION: MTL-337 debounce window and cursor jump — round 2 of /dev:fix session dev-fix-20261101-153739-a08a5829
+//
+// The real McpRegistryScreen is mounted under the real providers, with a fake
+// `fetch` for the registry endpoint and a throwaway project path. Keys go
+// through the test renderer's mock keyboard; the outcome is read from what the
+// screen wrote to .mcp.json.
+
+// Real-looking hosts for the servers whose host decides "official"; every
+// other name gets an example.org host.
+const HOSTS: Record<string, string> = {
+	"com.notion/mcp": "https://mcp.notion.com/mcp",
+	"ai.smithery/smithery-notion": "https://server.smithery.ai/notion/mcp",
+	"com.linear/mcp": "https://mcp.linear.com/mcp",
+};
+
+const server = (name: string) => ({
+	name,
+	url: HOSTS[name] ?? `https://${name.replace(/[^a-z]/g, "")}.example.org/mcp`,
+	short_description: `${name} description`,
+});
+
+type Deferred = { query: string; resolve: (names: string[]) => void };
+
+let cleanup: Array<() => Promise<void> | void> = [];
+const realFetch = globalThis.fetch;
+
+afterEach(async () => {
+	globalThis.fetch = realFetch;
+	for (const fn of cleanup.reverse()) await fn();
+	cleanup = [];
+});
+
+function GoToRegistry() {
+	const { navigateToScreen } = useNavigation();
+	// biome-ignore lint/correctness/useExhaustiveDependencies: navigate once on mount
+	useEffect(() => navigateToScreen("mcp-registry"), []);
+	return null;
+}
+
+async function mount(initialNames: string[]) {
+	const project = mkdtempSync(join(tmpdir(), "mcp-registry-screen-"));
+	cleanup.push(() => rmSync(project, { recursive: true, force: true }));
+
+	const pending: Deferred[] = [];
+	globalThis.fetch = (async (input: unknown) => {
+		const url = new URL(String(input));
+		const query = url.searchParams.get("q") ?? "";
+		const names = await new Promise<string[]>((resolve) => {
+			if (query === "") resolve(initialNames);
+			else pending.push({ query, resolve });
+		});
+		return new Response(JSON.stringify({ servers: names.map(server) }), {
+			status: 200,
+			headers: { "content-type": "application/json" },
+		});
+	}) as typeof fetch;
+
+	const { renderer, mockInput, renderOnce, captureCharFrame } =
+		await testRender(
+			<AppProvider initialProjectPath={project}>
+				<DimensionsProvider>
+					<KeyRouter>
+						<GoToRegistry />
+						<McpRegistryScreen />
+					</KeyRouter>
+				</DimensionsProvider>
+			</AppProvider>,
+			{ width: 110, height: 30 },
+		);
+	cleanup.push(async () => {
+		await act(async () => renderer.destroy());
+	});
+
+	const settle = async (ms = 30) => {
+		for (let i = 0; i < 3; i++) {
+			await new Promise((r) => setTimeout(r, ms));
+			await renderOnce();
+		}
+	};
+	const send = async (fn: () => void | Promise<void>, ms?: number) =>
+		act(async () => {
+			await fn();
+			await settle(ms);
+		});
+	await act(() => settle());
+
+	const mcpJson = () => {
+		const path = join(project, ".mcp.json");
+		return existsSync(path) ? readFileSync(path, "utf8") : "";
+	};
+	return { mockInput, send, settle, pending, mcpJson, frame: captureCharFrame };
+}
+
+describe("registry screen: the list is not actionable while a query change is pending", () => {
+	test("typing a query then Enter, Enter inside the debounce installs nothing from the old list", async () => {
+		const m = await mount(["com.old/alpha", "com.old/beta"]);
+
+		// "/" opens the search box, the text is typed, the first Enter leaves it,
+		// the second Enter installs the row under the cursor. All of it happens
+		// well inside the 300 ms debounce, before loadServers has started.
+		await m.send(() => m.mockInput.typeText("/notion"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+
+		expect(m.pending).toHaveLength(0); // debounce has not fired yet
+		expect(m.mcpJson()).not.toContain("com.old/");
+	});
+
+	test("after the new query's response lands, Enter installs the new list's first row", async () => {
+		const m = await mount(["com.old/alpha", "com.old/beta"]);
+		await m.send(() => m.mockInput.typeText("/notion"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.settle(400); // debounce fires, request is now pending
+		expect(m.pending).toHaveLength(1);
+		await m.send(() => m.pending[0]?.resolve(["com.notion/mcp"]));
+		await m.send(() => m.mockInput.pressEnter(), 100);
+
+		expect(m.mcpJson()).toContain("com.notion/mcp");
+	});
+});
+
+describe("registry screen: the cursor follows the name only when the query is unchanged", () => {
+	test("a new query puts the cursor on row 0 of the new results, even when the old row-0 server is in them", async () => {
+		const m = await mount(["com.old/alpha", "com.old/beta"]);
+		await m.send(() => m.mockInput.typeText("/x"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.settle(400);
+		expect(m.pending).toHaveLength(1);
+		// The old row-0 server comes back, but second.
+		await m.send(() =>
+			m.pending[0]?.resolve(["com.new/first", "com.old/alpha"]),
+		);
+		await m.send(() => m.mockInput.pressEnter(), 100);
+
+		expect(m.mcpJson()).toContain("com.new/first");
+		expect(m.mcpJson()).not.toContain("com.old/alpha");
+	});
+});
+
+describe("registry screen: the official badge follows the search", () => {
+	const rowLines = (frame: string, needle: string) =>
+		frame.split("\n").filter((line) => line.includes(needle));
+
+	test("the unfiltered list shows no official badge on any row", async () => {
+		const m = await mount([
+			"com.linear/mcp",
+			"ai.smithery/smithery-notion",
+			"com.notion/mcp",
+		]);
+		await m.send(() => m.settle(400)); // the initial load runs behind the debounce
+		expect(m.frame()).toContain("notion/mcp"); // the rows did render
+		expect(m.frame()).not.toContain("official");
+	});
+
+	test("after searching notion only the real notion server is badged, and it is first", async () => {
+		const m = await mount([
+			"com.linear/mcp",
+			"ai.smithery/smithery-notion",
+			"com.notion/mcp",
+		]);
+		await m.send(() => m.mockInput.typeText("/notion"), 5);
+		await m.send(() => m.mockInput.pressEnter(), 5);
+		await m.settle(400);
+		expect(m.pending).toHaveLength(1);
+		// The endpoint answers with the third-party server before the real one.
+		await m.send(() =>
+			m.pending[0]?.resolve(["ai.smithery/smithery-notion", "com.notion/mcp"]),
+		);
+
+		await m.send(() => m.settle(100));
+		const frame = m.frame();
+		const lines = frame.split("\n");
+		const notionRow = lines.findIndex((l) => l.includes("com.notion/mcp"));
+		const smitheryRow = lines.findIndex((l) =>
+			l.includes("ai.smithery/smithery-notion"),
+		);
+		expect(notionRow).toBeGreaterThanOrEqual(0);
+		expect(notionRow).toBeLessThan(smitheryRow); // official first
+		expect(lines[notionRow]).toContain("official");
+		expect(rowLines(frame, "smithery-notion").join("\n")).not.toContain(
+			"official",
+		);
+	});
+});

package/src/__tests__/mcp-registry-screen.test.ts

@@ -0,0 +1,209 @@
+import { describe, expect, test } from "bun:test";
+import { parseKeypress } from "@opentui/core";
+import {
+	createLatestOnlyGuard,
+	isOfficialMcpServer,
+	officialFirst,
+} from "../services/mcp-registry.js";
+import type { KeyPress } from "../ui/input/key-dispatch.js";
+import { SCREEN_BINDINGS, matchBinding } from "../ui/keymap.js";
+
+// REGRESSION: MTL-337 registry screen installs the wrong server / no remove / no official first — Fixed in /dev:fix session dev-fix-20261101-153739-a08a5829
+
+const srv = (name: string, url: string) => ({
+	name,
+	url,
+	short_description: "",
+});
+
+const press = (raw: string): KeyPress => {
+	const k = parseKeypress(raw);
+	return {
+		name: k?.name ?? "",
+		sequence: k?.sequence ?? "",
+		ctrl: k?.ctrl === true,
+		meta: k?.meta === true,
+		shift: k?.shift === true,
+	};
+};
+
+describe("isOfficialMcpServer", () => {
+	const notion = srv("com.notion/mcp", "https://mcp.notion.com/mcp");
+
+	test("an empty or whitespace query makes nothing official", () => {
+		expect(isOfficialMcpServer(notion, "")).toBe(false);
+		expect(isOfficialMcpServer(notion, "   ")).toBe(false);
+	});
+
+	test("com.notion/mcp served from mcp.notion.com is official for the query notion", () => {
+		expect(isOfficialMcpServer(notion, "notion")).toBe(true);
+	});
+
+	test("a third-party host is not official for the brand it mentions", () => {
+		expect(
+			isOfficialMcpServer(
+				srv("ai.smithery/smithery-notion", "https://server.smithery.ai/notion"),
+				"notion",
+			),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(
+				srv("com.foreverworks/notion", "https://mcp.foreverworks.com/notion"),
+				"notion",
+			),
+		).toBe(false);
+	});
+
+	test("a server is official for its own brand, but not for another brand's query", () => {
+		const smithery = srv(
+			"ai.smithery/smithery-notion",
+			"https://server.smithery.ai/notion",
+		);
+		expect(isOfficialMcpServer(smithery, "smithery")).toBe(true);
+		expect(isOfficialMcpServer(notion, "smithery")).toBe(false);
+	});
+
+	test("the query is case-insensitive and split into words", () => {
+		expect(isOfficialMcpServer(notion, "Notion MCP")).toBe(true);
+		expect(isOfficialMcpServer(notion, "mcp-NOTION")).toBe(true);
+	});
+
+	test("a word must equal the brand, a substring does not count", () => {
+		expect(isOfficialMcpServer(notion, "notional")).toBe(false);
+		expect(isOfficialMcpServer(notion, "not")).toBe(false);
+	});
+
+	test("com.mcparmory/notion packaged on pypi is not official", () => {
+		expect(
+			isOfficialMcpServer(
+				srv("com.mcparmory/notion", "pypi:mcparmory-notion"),
+				"mcparmory notion",
+			),
+		).toBe(false);
+	});
+
+	test("an io.github.<owner> namespace is never official, even when the host matches", () => {
+		expect(
+			isOfficialMcpServer(
+				srv("io.github.someone/notion", "https://github.io/someone/notion"),
+				"github someone notion",
+			),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(
+				srv("io.github.notion/mcp", "https://mcp.github.io/mcp"),
+				"github notion",
+			),
+		).toBe(false);
+	});
+
+	test("npm: and pypi: sources are not official", () => {
+		expect(
+			isOfficialMcpServer(srv("com.notion/mcp", "npm:@notion/mcp"), "notion"),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(srv("com.notion/mcp", "pypi:notion-mcp"), "notion"),
+		).toBe(false);
+	});
+
+	test("an unparsable URL is not official", () => {
+		expect(
+			isOfficialMcpServer(srv("com.notion/mcp", "not a url"), "notion"),
+		).toBe(false);
+		expect(isOfficialMcpServer(srv("com.notion/mcp", ""), "notion")).toBe(
+			false,
+		);
+	});
+
+	test("a namespace that is only a string prefix of the host does not match on a label boundary", () => {
+		expect(
+			isOfficialMcpServer(srv("com.not/x", "https://notion.com/mcp"), "not"),
+		).toBe(false);
+		expect(
+			isOfficialMcpServer(srv("com.not/x", "https://notion.com/mcp"), "notion"),
+		).toBe(false);
+	});
+});
+
+describe("officialFirst", () => {
+	const a = srv("io.github.a/one", "https://a.example.org/mcp");
+	const o1 = srv("com.notion/mcp", "https://mcp.notion.com/mcp");
+	const b = srv("com.mcparmory/notion", "pypi:mcparmory-notion");
+	const o2 = srv("com.notion/second", "https://api.notion.com/second");
+	const other = srv("com.linear/mcp", "https://mcp.linear.com/mcp");
+
+	test("official servers move to the front, endpoint order kept inside each group", () => {
+		expect(officialFirst([a, o1, b, other, o2], "notion")).toEqual([
+			o1,
+			o2,
+			a,
+			b,
+			other,
+		]);
+	});
+
+	test("with an empty query the order is unchanged", () => {
+		expect(officialFirst([a, o1, b, o2], "")).toEqual([a, o1, b, o2]);
+	});
+
+	test("does not mutate its input", () => {
+		const input = [a, o1, b];
+		const snapshot = [...input];
+		const out = officialFirst(input, "notion");
+		expect(input).toEqual(snapshot);
+		expect(out).not.toBe(input);
+	});
+
+	test("an empty list stays empty", () => {
+		expect(officialFirst([], "notion")).toEqual([]);
+	});
+});
+
+describe("MCP registry keymap", () => {
+	test("d is bound to a remove action on the mcp-registry screen", () => {
+		expect(matchBinding(SCREEN_BINDINGS["mcp-registry"], press("d"))?.id).toBe(
+			"remove",
+		);
+	});
+});
+
+describe("stale registry responses", () => {
+	// The screen (McpRegistryScreen.tsx) is a React/OpenTUI component whose
+	// loadServers closes over component state; the repo has no harness that
+	// drives it with fake fetches. The guard is therefore tested as the small
+	// pure helper the screen will call: take a token before each request, apply
+	// the response only when isLatest(token) still holds.
+	test("only the newest request's response is applied when responses arrive out of order", async () => {
+		const guard = createLatestOnlyGuard();
+		const deferred = <T>() => {
+			let resolve!: (v: T) => void;
+			const promise = new Promise<T>((r) => {
+				resolve = r;
+			});
+			return { promise, resolve };
+		};
+		const first = deferred<string[]>();
+		const second = deferred<string[]>();
+		let applied: string[] | null = null;
+		const appliedFrom: string[] = [];
+
+		const load = async (label: string, p: Promise<string[]>) => {
+			const token = guard.next();
+			const result = await p;
+			if (guard.isLatest(token)) {
+				applied = result;
+				appliedFrom.push(label);
+			}
+		};
+
+		const a = load("old", first.promise);
+		const b = load("new", second.promise);
+		second.resolve(["new-server"]); // newest answers first
+		await b;
+		first.resolve(["old-server"]); // stale answer lands last
+		await a;
+
+		expect(applied).toEqual(["new-server"]);
+		expect(appliedFrom).toEqual(["new"]);
+	});
+});

package/src/__tests__/spawn-bounded.test.ts

@@ -0,0 +1,211 @@
+/**
+ * runBounded settles on its deadline even when a descendant of the child keeps
+ * the stdout/stderr pipes open — the shape of `git pull` -> `git fetch` -> `ssh`.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { runBounded } from "../utils/spawn-bounded.js";
+
+let tmp: string;
+let pidFile: string;
+
+beforeEach(() => {
+	tmp = fs.mkdtempSync(path.join(os.tmpdir(), "spawn-bounded-"));
+	pidFile = path.join(tmp, "grandchild.pid");
+});
+
+afterEach(() => {
+	// Kill the leftover grandchild by pid, never by pattern.
+	if (fs.existsSync(pidFile)) {
+		const pid = Number(fs.readFileSync(pidFile, "utf8").trim());
+		if (pid > 0) {
+			try {
+				process.kill(pid, "SIGKILL");
+			} catch {
+				// already gone
+			}
+		}
+	}
+	fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+function writeScript(name: string, body: string): string {
+	const file = path.join(tmp, name);
+	fs.writeFileSync(file, `#!/bin/sh\n${body}`, { mode: 0o755 });
+	return file;
+}
+
+/**
+ * `sh -c` argv: background a `sleep 30` that inherits stdout, then exit 0.
+ * Run through /bin/sh rather than a freshly written script: macOS's first exec
+ * of a new file can take ~300 ms, which would push the exit past a 200 ms
+ * deadline and turn a normal exit into a timeout.
+ */
+function exitLeavingHolder(): string[] {
+	return ["-c", `sleep 30 & echo $! > '${pidFile}'; exit 0`];
+}
+
+describe("runBounded", () => {
+	it("settles at the deadline while a grandchild still holds the pipes", async () => {
+		const script = writeScript(
+			"holder.sh",
+			`sleep 30 &\necho $! > '${pidFile}'\nwait\n`,
+		);
+
+		const started = Date.now();
+		const r = await runBounded(script, [], { timeoutMs: 300 });
+		const elapsed = Date.now() - started;
+
+		expect(r.timedOut).toBe(true);
+		expect(r.signal).toBe("SIGKILL");
+		expect(r.code).not.toBe(0);
+		expect(elapsed).toBeLessThan(2_000);
+	}, 5_000);
+
+	it("settles at the deadline with stdout-only pipes, too", async () => {
+		const script = writeScript(
+			"holder.sh",
+			`sleep 30 &\necho $! > '${pidFile}'\nwait\n`,
+		);
+
+		const started = Date.now();
+		const r = await runBounded(script, [], {
+			timeoutMs: 300,
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+
+		expect(r.timedOut).toBe(true);
+		expect(r.signal).toBe("SIGKILL");
+		expect(Date.now() - started).toBeLessThan(2_000);
+	}, 5_000);
+
+	it("returns the full stdout of a child that exits normally", async () => {
+		const lines = Array.from({ length: 2000 }, (_, i) => `line ${i}`);
+		const script = writeScript(
+			"talker.sh",
+			`i=0\nwhile [ $i -lt 2000 ]; do echo "line $i"; i=$((i+1)); done\necho oops >&2\n`,
+		);
+
+		const r = await runBounded(script, [], { timeoutMs: 5_000 });
+
+		expect(r.code).toBe(0);
+		expect(r.signal).toBeNull();
+		expect(r.timedOut).toBe(false);
+		expect(r.spawnError).toBeUndefined();
+		expect(r.stdout).toBe(`${lines.join("\n")}\n`);
+		expect(r.stderr.trim()).toBe("oops");
+	}, 5_000);
+
+	it("reports a non-zero exit code without timing out", async () => {
+		const script = writeScript("fail.sh", "exit 3\n");
+
+		const r = await runBounded(script, [], { timeoutMs: 5_000 });
+
+		expect(r.code).toBe(3);
+		expect(r.timedOut).toBe(false);
+	}, 5_000);
+
+	it("after a normal exit with a background descendant holding stdout, settles after the close grace", async () => {
+		const started = Date.now();
+		const r = await runBounded("/bin/sh", exitLeavingHolder(), {
+			timeoutMs: 20_000,
+		});
+		const elapsed = Date.now() - started;
+
+		expect(r.timedOut).toBe(false);
+		expect(r.code).toBe(0);
+		// CLOSE_GRACE_MS is 1_500: not before it, and not much after it.
+		expect(elapsed).toBeGreaterThanOrEqual(1_400);
+		expect(elapsed).toBeLessThan(2_500);
+	}, 5_000);
+
+	it("never extends a normal exit's close grace past the deadline", async () => {
+		const started = Date.now();
+		const r = await runBounded("/bin/sh", exitLeavingHolder(), {
+			timeoutMs: 200,
+		});
+		const elapsed = Date.now() - started;
+
+		// The child exited by itself, so this is not a timeout.
+		expect(r.timedOut).toBe(false);
+		expect(r.code).toBe(0);
+		// Deadline 200 ms; the 1_500 ms grace must not outlive it.
+		expect(elapsed).toBeLessThan(700);
+	}, 5_000);
+
+	it("an abort mid-run kills the child and settles at once", async () => {
+		const script = writeScript(
+			"sleeper.sh",
+			`echo $$ > '${pidFile}'\nexec sleep 30\n`,
+		);
+		const controller = new AbortController();
+
+		const started = Date.now();
+		const pending = runBounded(script, [], {
+			timeoutMs: 20_000,
+			signal: controller.signal,
+		});
+		// Abort once the child is really running (it has written its pid).
+		while (!fs.existsSync(pidFile) || !fs.readFileSync(pidFile, "utf8")) {
+			await Bun.sleep(10);
+		}
+		const pid = Number(fs.readFileSync(pidFile, "utf8").trim());
+		const abortedAt = Date.now();
+		controller.abort();
+		const r = await pending;
+		const settledAfterAbort = Date.now() - abortedAt;
+
+		expect(r.aborted).toBe(true);
+		expect(r.code).not.toBe(0);
+		expect(settledAfterAbort).toBeLessThan(300);
+		expect(Date.now() - started).toBeLessThan(2_000);
+
+		// The child is dead. Poll briefly: a SIGKILLed child is a zombie until the
+		// runtime reaps it, and signal 0 still succeeds on a zombie.
+		const dead = async (): Promise<boolean> => {
+			for (let i = 0; i < 50; i++) {
+				try {
+					process.kill(pid, 0);
+				} catch {
+					return true;
+				}
+				await Bun.sleep(20);
+			}
+			return false;
+		};
+		expect(await dead()).toBe(true);
+	}, 5_000);
+
+	it("an already-aborted signal settles at once and spawns nothing", async () => {
+		const marker = path.join(tmp, "ran");
+		const script = writeScript("marker.sh", `touch '${marker}'\n`);
+		const controller = new AbortController();
+		controller.abort();
+
+		const started = Date.now();
+		const r = await runBounded(script, [], {
+			timeoutMs: 5_000,
+			signal: controller.signal,
+		});
+		const elapsed = Date.now() - started;
+
+		expect(r.aborted).toBe(true);
+		expect(r.code).toBeNull();
+		expect(elapsed).toBeLessThan(100);
+		// Give a spawned child every chance to run before checking it did not.
+		await Bun.sleep(300);
+		expect(fs.existsSync(marker)).toBe(false);
+	}, 5_000);
+
+	it("settles with spawnError, never throws, for a command that does not exist", async () => {
+		const r = await runBounded(path.join(tmp, "no-such-command"), [], {
+			timeoutMs: 5_000,
+		});
+
+		expect(r.spawnError).toBeInstanceOf(Error);
+		expect(r.timedOut).toBe(false);
+	}, 5_000);
+});

package/src/services/marketplace-catalog-git.ts

@@ -27,10 +27,10 @@
  * working precisely when the HTTP catalog cannot.
  */
 
-import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { claudeConfigDirOrNull } from "../utils/config-dir.js";
+import { runBounded } from "../utils/spawn-bounded.js";
 import {
 	type MarketplacePlugin,
 	normalizeCatalogJson,
@@ -55,36 +55,27 @@ function cloneDir(name: string): string | null {
 	return path.join(configDir, "plugins", "marketplaces", name);
 }
 
-function git(
+async function git(
 	cwd: string,
 	args: string[],
 	timeoutMs: number,
 ): Promise<{ ok: boolean; out: string }> {
-	return new Promise((resolve) => {
-		const child = spawn("git", args, {
-			cwd,
-			stdio: ["ignore", "pipe", "ignore"],
-			timeout: timeoutMs,
-			killSignal: "SIGKILL",
-			env: {
-				...process.env,
-				// Never let git stop for credentials: this runs inside a TUI with no
-				// way to answer a prompt, and a private marketplace we cannot read
-				// should degrade to "unknown", not hang the screen forever.
-				GIT_TERMINAL_PROMPT: "0",
-				GIT_ASKPASS: "echo",
-				SSH_ASKPASS: "echo",
-			},
-		});
-		let out = "";
-		child.stdout.on("data", (d: Buffer | string) => {
-			out += String(d);
-		});
-		child.on("error", () => resolve({ ok: false, out: "" }));
-		child.on("close", (code: number | null) =>
-			resolve({ ok: code === 0, out }),
-		);
+	const r = await runBounded("git", args, {
+		cwd,
+		stdio: ["ignore", "pipe", "ignore"],
+		timeoutMs,
+		env: {
+			...process.env,
+			// Never let git stop for credentials: this runs inside a TUI with no
+			// way to answer a prompt, and a private marketplace we cannot read
+			// should degrade to "unknown", not hang the screen forever.
+			GIT_TERMINAL_PROMPT: "0",
+			GIT_ASKPASS: "echo",
+			SSH_ASKPASS: "echo",
+		},
 	});
+	if (r.spawnError) return { ok: false, out: "" };
+	return { ok: r.code === 0, out: r.stdout };
 }
 
 /**