magus-cli 7.11.5 → 7.11.7

package/src/services/marketplace-refresh.ts

@@ -17,9 +17,9 @@
  * A failed `git pull --ff-only` leaves the clone exactly as it was: stale, but intact.
  */
 
-import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import { runBounded } from "../utils/spawn-bounded.js";
 import {
 	getConfiguredMarketplaces,
 	getGlobalClaudeDir,
@@ -29,6 +29,9 @@ import {
 /** Per-git-invocation timeout. A hung pull must never block launching Claude. */
 const GIT_TIMEOUT_MS = 30_000;
 
+/** Hard cap per clone, whatever hangs: `git status` then `git pull`, each GIT_TIMEOUT_MS, plus slack. */
+const CLONE_DEADLINE_MS = 2 * GIT_TIMEOUT_MS + 5_000;
+
 export interface RefreshResult {
 	/** Clones fast-forwarded to a newer commit (or already current). */
 	refreshed: string[];
@@ -42,46 +45,36 @@ function cloneDir(name: string): string {
 	return path.join(getGlobalClaudeDir(), "plugins", "marketplaces", name);
 }
 
-/** Run git in `cwd`, resolving stdout on exit 0. Killed after `timeoutMs`. */
-function runGit(
+/**
+ * Run git in `cwd`, resolving stdout on exit 0. Killed after `timeoutMs`, or as
+ * soon as `signal` aborts (an already-aborted signal runs nothing). Throws on
+ * anything but exit 0.
+ */
+async function runGit(
 	cwd: string,
 	args: string[],
 	timeoutMs: number,
+	signal?: AbortSignal,
 ): Promise<string> {
-	return new Promise((resolve, reject) => {
-		const proc = spawn("git", args, {
-			cwd,
-			timeout: timeoutMs,
-			killSignal: "SIGKILL",
-		});
-		let stdout = "";
-		let stderr = "";
-		proc.stdout?.on("data", (b) => {
-			stdout += b.toString();
-		});
-		proc.stderr?.on("data", (b) => {
-			stderr += b.toString();
-		});
-		proc.on("error", reject);
-		proc.on("close", (code, signal) => {
-			if (code === 0) {
-				resolve(stdout);
-			} else {
-				reject(
-					new Error(
-						`git ${args.join(" ")} ${
-							signal ? `killed (${signal})` : `exited ${code}`
-						}: ${stderr.trim()}`,
-					),
-				);
-			}
-		});
-	});
+	const r = await runBounded("git", args, { cwd, timeoutMs, signal });
+	if (r.spawnError) throw r.spawnError;
+	if (r.code === 0 && !r.aborted) return r.stdout;
+	const how = r.aborted
+		? "aborted"
+		: r.signal
+			? `killed (${r.signal})`
+			: `exited ${r.code}`;
+	throw new Error(`git ${args.join(" ")} ${how}: ${r.stderr.trim()}`);
 }
 
 /** True if the clone has uncommitted changes we must not clobber. */
-async function isDirty(dir: string): Promise<boolean> {
-	const out = await runGit(dir, ["status", "--porcelain"], GIT_TIMEOUT_MS);
+async function isDirty(dir: string, signal?: AbortSignal): Promise<boolean> {
+	const out = await runGit(
+		dir,
+		["status", "--porcelain"],
+		GIT_TIMEOUT_MS,
+		signal,
+	);
 	return out.trim().length > 0;
 }
 
@@ -99,23 +92,50 @@ export type CloneRefresh = "absent" | "skipped" | "refreshed" | "failed";
  * deletes: the worst case is `failed` (stale clone left intact). Shared by the
  * batch refresh below and by claude-cli's "plugin not found" recovery, so both
  * paths get the same safe semantics instead of the old `marketplace update`.
+ *
+ * Bounded by `deadlineMs`: when it passes, the result is `failed` and the git
+ * command then in flight (`status` or `pull`) is SIGKILLed; no further git
+ * command starts. Only that direct child is killed: a `git fetch` or `ssh` it
+ * spawned may linger until it exits on its own, holding nothing we wait on.
+ * The clone directory is never deleted, but a pull killed while it updates the
+ * working tree can leave that update part-way and a `.git/index.lock` behind;
+ * later pulls then return `failed` until the lock is removed. The deadline sits
+ * well above a healthy pull, so that is the price of never hanging, not a
+ * normal outcome.
  */
 export async function fastForwardCloneIfPresent(
 	name: string,
+	deadlineMs: number = CLONE_DEADLINE_MS,
 ): Promise<CloneRefresh> {
 	const dir = cloneDir(name);
 	// No clone on disk (claude never installed it) or not a git repo.
 	if (!fs.existsSync(path.join(dir, ".git"))) return "absent";
+	const abort = new AbortController();
+	const work = (async (): Promise<CloneRefresh> => {
+		try {
+			// Never clobber a user's local edits to the clone.
+			if (await isDirty(dir, abort.signal)) return "skipped";
+			// --ff-only is the safety guarantee: it fetches and fast-forwards, and
+			// aborts without mutating the tree if it can't. It never deletes the dir,
+			// so a failure degrades to "stale clone", never "deleted marketplace".
+			await runGit(dir, ["pull", "--ff-only"], GIT_TIMEOUT_MS, abort.signal);
+			return "refreshed";
+		} catch {
+			return "failed";
+		}
+	})();
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const deadline = new Promise<CloneRefresh>((resolve) => {
+		timer = setTimeout(() => {
+			// Kill the in-flight git child rather than leave it running.
+			abort.abort();
+			resolve("failed");
+		}, deadlineMs);
+	});
 	try {
-		// Never clobber a user's local edits to the clone.
-		if (await isDirty(dir)) return "skipped";
-		// --ff-only is the safety guarantee: it fetches and fast-forwards, and
-		// aborts without mutating the tree if it can't. It never deletes the dir,
-		// so a failure degrades to "stale clone", never "deleted marketplace".
-		await runGit(dir, ["pull", "--ff-only"], GIT_TIMEOUT_MS);
-		return "refreshed";
-	} catch {
-		return "failed";
+		return await Promise.race([work, deadline]);
+	} finally {
+		clearTimeout(timer);
 	}
 }
 

package/src/services/mcp-registry.ts

@@ -2,6 +2,7 @@ import type {
 	McpRegistryResponse,
 	McpRegistryServer,
 	McpServer,
+	McpServerConfig,
 } from "../types/index.js";
 
 const DEFAULT_MCP_REGISTRY_API =
@@ -155,6 +156,155 @@ export async function fetchCuratedMcpServers(
 	return servers;
 }
 
+/**
+ * Whether the server is run by the owner of the domain its name claims.
+ * The name is `<reverse-dns namespace>/<slug>`; the server is official when the
+ * namespace labels are a label-boundary prefix of the URL host's reversed labels
+ * (`com.notion` for `mcp.notion.com`). Code-host namespaces (`io.github.*`) name
+ * an account, not an owner, and npm:/pypi:/unparsable sources have no host.
+ * It is official FOR A SEARCH: the brand (the namespace's second label, `notion`
+ * in `com.notion`) must equal, as a whole word, one of the search words.
+ */
+export function isOfficialMcpServer(
+	server: Pick<McpRegistryServer, "name" | "url">,
+	query: string,
+): boolean {
+	const words = query
+		.toLowerCase()
+		.split(/[^\p{L}\p{N}]+/u)
+		.filter(Boolean);
+	if (words.length === 0) return false;
+	const namespace = server.name.split("/")[0]?.toLowerCase() ?? "";
+	const labels = namespace.split(".");
+	if (labels.length < 2 || labels.some((label) => label === "")) return false;
+	if (labels[0] === "io" && labels[1] === "github") return false;
+	if (!words.includes(labels[1] as string)) return false;
+
+	let host: string;
+	try {
+		const url = new URL(server.url);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+		host = url.hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+
+	const hostLabels = host.split(".").reverse();
+	return (
+		labels.length <= hostLabels.length &&
+		labels.every((label, i) => label === hostLabels[i])
+	);
+}
+
+export type RegistryInstallKind = "http" | "pypi" | "npm";
+export type RegistryInstallPlan =
+	| { ok: true; kind: RegistryInstallKind; config: McpServerConfig }
+	| { ok: false; kind: string; reason: string };
+
+// Strict single tokens that cannot start with `-`: registry rows are
+// third-party data and the name becomes an argv element, so `npm:-y` or
+// `npm:--package=evil` must never turn into an option.
+const NPM_PACKAGE =
+	/^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*(?:@[a-z0-9][a-z0-9._+-]*)?$/i;
+const PYPI_PACKAGE =
+	/^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:@[a-z0-9][a-z0-9._+-]*)?$/i;
+
+function refuse(kind: string, reason: string): RegistryInstallPlan {
+	return { ok: false, kind, reason };
+}
+
+function unreadableAddress(): RegistryInstallPlan {
+	return refuse("unknown", "magus can't read this server's address.");
+}
+
+/**
+ * What installing a registry row writes, decided by the row's `url` alone
+ * (`package_registry` is ignored: an `https:` row stays hosted). Expected
+ * refusals are returned, never thrown. No shell: the entry is command + args.
+ */
+export function registryInstallPlan(
+	server: Pick<McpRegistryServer, "url">,
+): RegistryInstallPlan {
+	const raw = (server.url ?? "").trim();
+	const match = /^([a-z][a-z0-9+.-]*):(.*)$/is.exec(raw);
+	if (!match) return unreadableAddress();
+	const scheme = (match[1] as string).toLowerCase();
+	const rest = (match[2] as string).trim();
+	// `localhost:8080` is host:port, not a scheme.
+	if (/^\d+(?:[/?#]|$)/.test(rest)) return unreadableAddress();
+
+	if (scheme === "http" || scheme === "https") {
+		try {
+			if (new URL(raw).hostname) {
+				return {
+					ok: true,
+					kind: "http",
+					config: { type: "http", url: raw },
+				};
+			}
+		} catch {
+			// falls through to the refusal below
+		}
+		return unreadableAddress();
+	}
+
+	if (scheme === "pypi" || scheme === "npm") {
+		if (rest === "") {
+			return refuse(
+				scheme,
+				`This ${scheme} server has no package name, so there's nothing to run.`,
+			);
+		}
+		const pattern = scheme === "pypi" ? PYPI_PACKAGE : NPM_PACKAGE;
+		if (!pattern.test(rest)) {
+			return refuse(
+				scheme,
+				`The package name of this ${scheme} server looks wrong, so magus won't run it.`,
+			);
+		}
+		return {
+			ok: true,
+			kind: scheme,
+			config:
+				scheme === "pypi"
+					? { command: "uvx", args: [rest] }
+					: { command: "npx", args: ["-y", rest] },
+		};
+	}
+
+	return refuse(
+		scheme,
+		`magus can't install ${scheme} servers. It can install https, pypi and npm ones.`,
+	);
+}
+
+/** Official servers first; endpoint order is kept inside each group. */
+export function officialFirst<
+	T extends Pick<McpRegistryServer, "name" | "url">,
+>(servers: readonly T[], query: string): T[] {
+	const official = servers.filter((server) =>
+		isOfficialMcpServer(server, query),
+	);
+	const rest = servers.filter((server) => !isOfficialMcpServer(server, query));
+	return [...official, ...rest];
+}
+
+/**
+ * Last-to-start wins: take a token before each request and apply its response
+ * only while `isLatest(token)` still holds.
+ */
+export function createLatestOnlyGuard(): {
+	next(): number;
+	isLatest(token: number): boolean;
+} {
+	let latest = 0;
+	return {
+		next: () => ++latest,
+		isLatest: (token) => token === latest,
+	};
+}
+
 export function formatDate(dateStr?: string): string {
 	if (!dateStr) return "";
 	const date = new Date(dateStr);

package/src/ui/keymap.ts

@@ -294,6 +294,7 @@ const MCP_REGISTRY = [
 	bind("install", ["Enter"], "install", "Add the server to this project", 90),
 	search("Search the registry; the list reloads as you type"),
 	bind("local", ["l"], "local", "Back to this project's MCP servers", 50),
+	bind("remove", ["d"], "remove", "Remove the server from this project", 45),
 	bind("reload", ["R"], "reload", "Reload the results", 40),
 	CLEAR_FILTER,
 	MOVE,

package/src/ui/renderers/mcpRenderers.tsx

@@ -97,6 +97,8 @@ export interface McpRegistryListItem {
 	server: McpRegistryServer;
 	isInstalled: boolean;
 	needsRestart: boolean;
+	/** Run by the owner of the domain its name claims. */
+	isOfficial: boolean;
 }
 
 export function renderMcpRegistryRow(
@@ -104,10 +106,11 @@ export function renderMcpRegistryRow(
 	_index: number,
 	isSelected: boolean,
 ): React.ReactNode {
-	const { server, isInstalled, needsRestart } = item;
+	const { server, isInstalled, needsRestart, isOfficial } = item;
 	const version = server.version ? ` v${server.version}` : "";
 	const icon = isInstalled ? "● " : "";
 	const restart = needsRestart ? RESTART_MARK : "";
+	const official = isOfficial ? " official" : "";
 	if (isSelected) {
 		return (
 			<text bg={theme.selection.bg} fg={theme.selection.fg}>
@@ -115,6 +118,7 @@ export function renderMcpRegistryRow(
 				{icon}
 				{server.name}
 				{version}
+				{official}
 				{restart}{" "}
 			</text>
 		);
@@ -127,6 +131,7 @@ export function renderMcpRegistryRow(
 				<strong>{server.name}</strong>
 			</span>
 			<span fg={theme.colors.info}>{version}</span>
+			{official ? <span fg={theme.colors.success}>{official}</span> : null}
 			{restart ? <span fg={theme.colors.warning}>{restart}</span> : null}
 		</text>
 	);

package/src/ui/screens/McpRegistryScreen.tsx

@@ -15,9 +15,17 @@ import {
 	addMcpServer,
 	getEnabledMcpServers,
 	getInstalledMcpServers,
+	removeMcpServer,
 	setAllowMcp,
 } from "../../services/claude-settings.js";
-import { formatDate, searchMcpServers } from "../../services/mcp-registry.js";
+import {
+	createLatestOnlyGuard,
+	formatDate,
+	isOfficialMcpServer,
+	officialFirst,
+	registryInstallPlan,
+	searchMcpServers,
+} from "../../services/mcp-registry.js";
 import type { McpRegistryServer, McpServerConfig } from "../../types/index.js";
 import { ScrollableList } from "../components/ScrollableList.js";
 import {
@@ -131,24 +139,52 @@ export function McpRegistryScreen() {
 		void loadInstalled();
 	}, [loadInstalled]);
 
+	// Overlapping loads (first load, debounce, R) can resolve out of order: only
+	// the newest request's response may touch state. Unmounting takes a token too,
+	// so a response that lands afterwards is dropped.
+	const guardRef = useRef(createLatestOnlyGuard());
+	// The name under the cursor, so a replaced list keeps it on the same server.
+	const selectedNameRef = useRef<string | undefined>(undefined);
+	selectedNameRef.current = servers[mcpRegistry.selectedIndex]?.name;
+	// The query the list on screen was loaded with: the cursor follows a name
+	// only across a reload of the same query, never into a different result set.
+	const loadedQueryRef = useRef<string | undefined>(undefined);
+	// The same query as state, for rendering: badges follow the list on screen,
+	// not the text being typed.
+	const [loadedQuery, setLoadedQuery] = useState("");
+
 	// Load servers
-	const loadServers = useCallback(async (query: string) => {
-		setIsLoading(true);
-		setError(null);
-		try {
-			const response = await searchMcpServers({ query, limit: 50 });
-			if (!response || !Array.isArray(response.servers)) {
-				throw new Error("Invalid response from MCP Registry API");
+	const loadServers = useCallback(
+		async (query: string) => {
+			const guard = guardRef.current;
+			const token = guard.next();
+			setIsLoading(true);
+			setError(null);
+			try {
+				const response = await searchMcpServers({ query, limit: 50 });
+				if (!response || !Array.isArray(response.servers)) {
+					throw new Error("Invalid response from MCP Registry API");
+				}
+				if (!guard.isLatest(token)) return;
+				// Deduplicate to show only latest version of each server, official first
+				const next = officialFirst(deduplicateServers(response.servers), query);
+				const sameQuery = loadedQueryRef.current === query;
+				const keptAt = sameQuery
+					? next.findIndex((server) => server.name === selectedNameRef.current)
+					: -1;
+				loadedQueryRef.current = query;
+				setLoadedQuery(query);
+				setServers(next);
+				dispatch({ type: "MCPREGISTRY_SELECT", index: Math.max(0, keptAt) });
+			} catch (err) {
+				if (!guard.isLatest(token)) return;
+				setError(err instanceof Error ? err.message : "Failed to load servers");
+				setServers([]);
 			}
-			// Deduplicate to show only latest version of each server
-			const deduplicated = deduplicateServers(response.servers);
-			setServers(deduplicated);
-		} catch (err) {
-			setError(err instanceof Error ? err.message : "Failed to load servers");
-			setServers([]);
-		}
-		setIsLoading(false);
-	}, []);
+			if (guard.isLatest(token)) setIsLoading(false);
+		},
+		[dispatch],
+	);
 
 	// Debounced search
 	const debouncedSearch = useCallback(
@@ -168,7 +204,9 @@ export function McpRegistryScreen() {
 	const initialQueryRef = useRef(searchQuery);
 	useEffect(() => {
 		loadServers(initialQueryRef.current);
+		const guard = guardRef.current;
 		return () => {
+			guard.next();
 			if (searchTimeoutRef.current) {
 				clearTimeout(searchTimeoutRef.current);
 			}
@@ -179,6 +217,12 @@ export function McpRegistryScreen() {
 
 	/** A new query: the list reloads, debounced, and the cursor starts over. */
 	const setQuery = (query: string) => {
+		// The shown list is stale from this keystroke: drop any response still in
+		// flight and mark the list pending until the scheduled load settles, so
+		// install/remove cannot act on the old rows. The scheduled loadServers
+		// always runs (or the screen unmounts) and clears this in every outcome.
+		guardRef.current.next();
+		setIsLoading(true);
 		setSearchQuery(query);
 		dispatch({ type: "MCPREGISTRY_SEARCH", query });
 		dispatch({ type: "MCPREGISTRY_SELECT", index: 0 });
@@ -201,6 +245,9 @@ export function McpRegistryScreen() {
 		},
 		search: () => dispatch({ type: "SET_SEARCHING", isSearching: true }),
 		local: () => navigateToScreen("mcp"),
+		remove: () => {
+			void handleRemove();
+		},
 		reload: () => {
 			void loadServers(searchQuery);
 		},
@@ -219,14 +266,53 @@ export function McpRegistryScreen() {
 		},
 	});
 
+	const handleRemove = async () => {
+		if (isLoading) return;
+		const server = servers[mcpRegistry.selectedIndex];
+		if (!server || !installedNames.has(server.name)) return;
+
+		const confirmed = await modal.confirm(
+			`Remove ${server.name}?`,
+			"This will remove the MCP server configuration.",
+		);
+		if (!confirmed) return;
+
+		modal.loading(`Removing ${server.name}...`);
+		try {
+			await removeMcpServer(server.name, state.projectPath);
+			modal.hideModal();
+			dispatch({ type: "MCP_SERVER_CHANGED", name: server.name });
+			await loadInstalled();
+		} catch (error) {
+			modal.hideModal();
+			await showFailures(
+				stepFailureReport(
+					`Could not remove ${server.name}`,
+					server.name,
+					error,
+				),
+			);
+		}
+	};
+
 	const handleInstall = async () => {
+		// While loading, the visible panel is "Loading..." and `servers` is the
+		// previous, hidden list: installing from it would add a row nobody sees.
+		if (isLoading) return;
 		const server = servers[mcpRegistry.selectedIndex];
 		if (!server) return;
 
-		const config: McpServerConfig = {
-			type: "http",
-			url: server.url,
-		};
+		const plan = registryInstallPlan(server);
+		if (!plan.ok) {
+			// Nothing is written: the popup comes before the modal and the writes.
+			await showFailures({
+				headline: `${server.name} wasn't installed`,
+				rows: [{ subject: server.name, reason: plan.reason }],
+				fix: null,
+			});
+			return;
+		}
+		const config: McpServerConfig = plan.config;
 
 		modal.loading(`Installing ${server.name}...`);
 		try {
@@ -250,6 +336,7 @@ export function McpRegistryScreen() {
 		server,
 		isInstalled: installedNames.has(server.name),
 		needsRestart: state.mcp.changedThisSession.includes(server.name),
+		isOfficial: isOfficialMcpServer(server, loadedQuery),
 	}));
 
 	// Get selected server
@@ -279,6 +366,9 @@ export function McpRegistryScreen() {
 			? `v${selectedServer.version}`
 			: "unknown";
 
+		const plan = registryInstallPlan(selectedServer);
+		const packageRuns = plan.ok && plan.kind !== "http" ? plan.config : null;
+
 		return (
 			<box flexDirection="column">
 				<text fg={theme.colors.accent}>
@@ -288,6 +378,30 @@ export function McpRegistryScreen() {
 					<text fg={theme.colors.text}>{selectedServer.short_description}</text>
 				</box>
 				<box marginTop={1}>{renderMcpRegistryStatus(selectedItem)}</box>
+				{selectedItem.isOfficial ? (
+					<box flexDirection="row">
+						<text fg={theme.colors.muted}>{"Publisher "}</text>
+						<text fg={theme.colors.success}>{"official"}</text>
+					</box>
+				) : null}
+				{packageRuns ? (
+					<box flexDirection="column" marginTop={1}>
+						<box flexDirection="row">
+							<text fg={theme.colors.muted}>{"Runs  "}</text>
+							<text fg={theme.colors.text}>
+								{[packageRuns.command, ...(packageRuns.args ?? [])].join(" ")}
+							</text>
+						</box>
+						<text fg={theme.colors.warning}>
+							It may need API keys or settings to work. magus doesn't add any.
+						</text>
+						{selectedServer.source_code_url ? (
+							<text fg={theme.colors.muted}>
+								The source below says what to set.
+							</text>
+						) : null}
+					</box>
+				) : null}
 				<box flexDirection="row" marginTop={1}>
 					<text fg={theme.colors.text}>
 						<strong>Version: </strong>
@@ -316,11 +430,17 @@ export function McpRegistryScreen() {
 						</text>
 					</box>
 				)}
-				{selectedItem.isInstalled ? null : (
-					<box marginTop={1}>
-						<text fg={theme.colors.muted}>Press Enter to install</text>
-					</box>
-				)}
+				<box marginTop={1}>
+					{!selectedItem.isInstalled && !plan.ok ? (
+						<text fg={theme.colors.warning}>{plan.reason}</text>
+					) : (
+						<text fg={theme.colors.muted}>
+							{selectedItem.isInstalled
+								? "Press d to remove"
+								: "Press Enter to install"}
+						</text>
+					)}
+				</box>
 			</box>
 		);
 	};