magus-cli 7.12.2 → 7.14.0

package/src/services/github-cli.ts

@@ -0,0 +1,309 @@
+/**
+ * github-cli.ts — the `gh` calls `magus market` makes.
+ *
+ * Every call goes through {@link runBounded} with an argv, never a shell, and
+ * with prompting off (`GH_PROMPT_DISABLED`, `GIT_TERMINAL_PROMPT=0`), so a
+ * missing sign-in fails at once instead of waiting on a prompt nobody sees.
+ * No token is read, stored or passed: gh holds its own credentials.
+ *
+ * Every function answers a {@link GhResult}; a failure carries a class the
+ * caller maps to its own error code.
+ */
+
+import { which } from "../utils/command-utils.js";
+import { runBounded } from "../utils/spawn-bounded.js";
+
+export type GhFailure =
+	| "gh-missing"
+	| "gh-auth"
+	| "not-found"
+	| "no-network"
+	| "timeout"
+	| "other";
+
+export type GhResult<T> =
+	| { ok: true; value: T }
+	| { ok: false; failure: GhFailure; message: string };
+
+const GH_TIMEOUT_MS = 60_000;
+
+/** `gh auth status` exits 4 when no account is signed in. */
+const GH_EXIT_AUTH = 4;
+
+function ghEnv(): NodeJS.ProcessEnv {
+	return {
+		...process.env,
+		GH_PROMPT_DISABLED: "1",
+		GH_NO_UPDATE_NOTIFIER: "1",
+		GIT_TERMINAL_PROMPT: "0",
+		GCM_INTERACTIVE: "never",
+		NO_COLOR: "1",
+	};
+}
+
+/** Classify a failed gh run from its exit code and words. */
+export function classifyGhFailure(
+	code: number | null,
+	text: string,
+	timedOut: boolean,
+): GhFailure {
+	if (timedOut) return "timeout";
+	if (
+		code === GH_EXIT_AUTH ||
+		/not logged in|gh auth login|HTTP 401|Bad credentials|authentication required/i.test(
+			text,
+		)
+	) {
+		return "gh-auth";
+	}
+	if (/HTTP 404|Not Found|Could not resolve to a Repository/i.test(text)) {
+		return "not-found";
+	}
+	if (
+		/error connecting to|dial tcp|could not resolve host|no such host|network is unreachable|connection refused|i\/o timeout|TLS handshake timeout/i.test(
+			text,
+		)
+	) {
+		return "no-network";
+	}
+	return "other";
+}
+
+async function gh(args: string[]): Promise<GhResult<string>> {
+	const r = await runBounded("gh", args, {
+		env: ghEnv(),
+		timeoutMs: GH_TIMEOUT_MS,
+	});
+	if (r.spawnError) {
+		const missing = /ENOENT|not found/i.test(r.spawnError.message);
+		return {
+			ok: false,
+			failure: missing ? "gh-missing" : "other",
+			message: missing
+				? "gh is not installed"
+				: `gh could not be started: ${r.spawnError.message}`,
+		};
+	}
+	if (r.code === 0 && !r.timedOut) return { ok: true, value: r.stdout };
+	const text = `${r.stderr}\n${r.stdout}`;
+	return {
+		ok: false,
+		failure: classifyGhFailure(r.code, text, r.timedOut),
+		message:
+			r.stderr.trim() ||
+			r.stdout.trim() ||
+			(r.timedOut
+				? `gh ${args[0]} did not finish in time`
+				: `gh ${args[0]} failed`),
+	};
+}
+
+function map<T, U>(r: GhResult<T>, f: (v: T) => U): GhResult<U> {
+	return r.ok ? { ok: true, value: f(r.value) } : r;
+}
+
+/** True when a `gh` binary is on PATH. */
+export async function ghAvailable(): Promise<boolean> {
+	return (await which("gh")) !== null;
+}
+
+/** Whether gh has a signed-in account; `gh-auth` when it has none. */
+export async function authStatus(): Promise<GhResult<void>> {
+	if (!(await ghAvailable())) {
+		return { ok: false, failure: "gh-missing", message: "gh is not installed" };
+	}
+	return map(await gh(["auth", "status"]), () => undefined);
+}
+
+/** The signed-in account's login. */
+export async function viewerLogin(): Promise<GhResult<string>> {
+	return map(await gh(["api", "user", "--jq", ".login"]), (s) => s.trim());
+}
+
+/** The organisations the signed-in account belongs to. */
+export async function viewerOrgs(): Promise<GhResult<string[]>> {
+	return map(
+		await gh(["api", "--paginate", "user/orgs", "--jq", ".[].login"]),
+		(s) =>
+			s
+				.split("\n")
+				.map((l) => l.trim())
+				.filter(Boolean),
+	);
+}
+
+/** Validate `owner/repo` before it reaches an argv or an API path. */
+export function isRepoSlug(repo: string): boolean {
+	return (
+		/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}$/.test(repo) &&
+		!repo.endsWith("/.") &&
+		!repo.endsWith("/..")
+	);
+}
+
+function badSlug<T>(repo: string): GhResult<T> {
+	return {
+		ok: false,
+		failure: "other",
+		message: `not a GitHub owner/repo: ${repo}`,
+	};
+}
+
+/** Whether `owner/repo` exists and this account can see it. */
+export async function repoExists(repo: string): Promise<GhResult<boolean>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	const r = await gh(["api", `repos/${repo}`, "--jq", ".full_name"]);
+	if (r.ok) return { ok: true, value: true };
+	if (r.failure === "not-found") return { ok: true, value: false };
+	return r;
+}
+
+/** `gh repo create <owner/repo> --private|--public [--description <text>]`. */
+export async function repoCreate(
+	repo: string,
+	visibility: "private" | "public",
+	description?: string,
+): Promise<GhResult<void>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	const args = ["repo", "create", repo, `--${visibility}`];
+	if (description) args.push("--description", description);
+	return map(await gh(args), () => undefined);
+}
+
+/**
+ * Whether this account can push to `owner/repo` (`.permissions.push`).
+ * A repository it cannot see answers `not-found`, which callers report as
+ * `no-access`.
+ */
+export async function repoPermissions(
+	repo: string,
+): Promise<GhResult<boolean>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	return map(
+		await gh(["api", `repos/${repo}`, "--jq", ".permissions.push"]),
+		(s) => s.trim() === "true",
+	);
+}
+
+/** Whether `owner/repo` allows forks (`.allow_forking`). */
+export async function repoForkAllowed(
+	repo: string,
+): Promise<GhResult<boolean>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	return map(
+		await gh(["api", `repos/${repo}`, "--jq", ".allow_forking"]),
+		(s) => s.trim() === "true",
+	);
+}
+
+/**
+ * Fork `owner/repo` to the signed-in account, without cloning it, answering
+ * the fork's own `owner/repo`. GitHub returns the account's existing fork when
+ * there is one and renames a new fork whose name is taken, so the answer is
+ * read from GitHub, never derived from the source's name.
+ */
+export async function repoFork(repo: string): Promise<GhResult<string>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	const r = map(
+		await gh([
+			"api",
+			"--method",
+			"POST",
+			`repos/${repo}/forks`,
+			"--jq",
+			".full_name",
+		]),
+		(s) => s.trim(),
+	);
+	if (r.ok && !isRepoSlug(r.value)) {
+		return {
+			ok: false,
+			failure: "other",
+			message: `GitHub answered no fork name for ${repo}`,
+		};
+	}
+	return r;
+}
+
+/**
+ * The repository `owner/repo` is a fork of, as `owner/repo`, or null when it
+ * is not a fork.
+ */
+export async function forkParent(
+	repo: string,
+): Promise<GhResult<string | null>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	return map(
+		await gh([
+			"api",
+			`repos/${repo}`,
+			"--jq",
+			'if .fork then .parent.full_name else "" end',
+		]),
+		(s) => s.trim() || null,
+	);
+}
+
+/**
+ * One file of `owner/repo` at its default branch (or `ref`), raw. Null when
+ * the repository has no such file. For reading a marketplace manifest without
+ * a clone.
+ */
+export async function repoFileRaw(
+	repo: string,
+	filePath: string,
+	ref?: string,
+): Promise<GhResult<string | null>> {
+	if (!isRepoSlug(repo)) return badSlug(repo);
+	const query = ref ? `?ref=${encodeURIComponent(ref)}` : "";
+	const encoded = filePath.split("/").map(encodeURIComponent).join("/");
+	const r = await gh([
+		"api",
+		"-H",
+		"Accept: application/vnd.github.raw",
+		`repos/${repo}/contents/${encoded}${query}`,
+	]);
+	if (r.ok) return r;
+	if (r.failure === "not-found") return { ok: true, value: null };
+	return r;
+}
+
+export interface PrCreateOptions {
+	/** The repository the pull request is opened against, `owner/repo`. */
+	repo: string;
+	/** The branch with the change: `branch`, or `login:branch` from a fork. */
+	head: string;
+	/** The branch to merge into. */
+	base: string;
+	title: string;
+	/** A file holding the body, so no text passes through an argv unquoted. */
+	bodyFile: string;
+}
+
+/** `gh pr create`, answering the pull request's URL. */
+export async function prCreate(
+	opts: PrCreateOptions,
+): Promise<GhResult<string>> {
+	if (!isRepoSlug(opts.repo)) return badSlug(opts.repo);
+	const r = await gh([
+		"pr",
+		"create",
+		"--repo",
+		opts.repo,
+		"--head",
+		opts.head,
+		"--base",
+		opts.base,
+		"--title",
+		opts.title,
+		"--body-file",
+		opts.bodyFile,
+	]);
+	return map(r, (s) => {
+		const urls = s
+			.split("\n")
+			.map((l) => l.trim())
+			.filter((l) => /^https?:\/\//.test(l));
+		return urls[urls.length - 1] ?? s.trim();
+	});
+}

package/src/services/local-marketplace.ts

@@ -1,8 +1,17 @@
-import { execSync } from "node:child_process";
-import os from "node:os";
 import path from "node:path";
 import fs from "fs-extra";
 import type { PluginRelease } from "../types/index.js";
+import { requireClaudeConfigDir } from "../utils/config-dir.js";
+import { remoteUrl } from "./git-write.js";
+import { pluginDirFor } from "./market-layout.js";
+import { readMarker } from "./market-marker.js";
+import {
+	type TrustFile,
+	isGithubSource,
+	isTrustedIn,
+	normaliseSource,
+	readTrust,
+} from "./market-registry.js";
 import { normalizeReleases } from "./plugin-releases.js";
 
 export interface LocalMarketplacePlugin {
@@ -27,21 +36,35 @@ export interface LocalMarketplace {
 	name: string;
 	description: string;
 	plugins: LocalMarketplacePlugin[];
-	gitRepo?: string; // Extracted from git remote
+	/**
+	 * The GitHub `owner/repo` the clone comes from, or undefined for any other
+	 * remote. Everything that reads it assumes GitHub: it is printed as a
+	 * `github.com/` link and the plugin contents are fetched from GitHub.
+	 */
+	gitRepo?: string;
+	/**
+	 * Where the marketplace comes from, normalised: `owner/repo` for GitHub,
+	 * else the remote URL as configured, else the directory. Read by the trust
+	 * check only.
+	 */
+	remoteSource?: string;
+	/** `metadata.pluginRoot` from the manifest: where bare plugin sources live. */
+	pluginRoot?: string;
+	/**
+	 * A company marketplace on this machine: the manifest carries the marker
+	 * and the name and source are on this machine's trust list.
+	 */
+	company?: boolean;
+	/** `owner.name` from the manifest, trimmed; absent when empty or missing. */
+	ownerName?: string;
 }
 
-const CLAUDE_PLUGINS_DIR = path.join(
-	os.homedir(),
-	".claude",
-	"plugins",
-	"marketplaces",
-);
-const KNOWN_MARKETPLACES_FILE = path.join(
-	os.homedir(),
-	".claude",
-	"plugins",
-	"known_marketplaces.json",
-);
+/** Claude Code's marketplace clones, resolved per call. */
+const claudePluginsDir = (): string =>
+	path.join(requireClaudeConfigDir(), "plugins", "marketplaces");
+/** Claude Code's marketplace registry, resolved per call. */
+const knownMarketplacesFile = (): string =>
+	path.join(requireClaudeConfigDir(), "plugins", "known_marketplaces.json");
 
 /**
  * Where Claude Code keeps a marketplace's clone, whether or not it exists.
@@ -52,11 +75,11 @@ const KNOWN_MARKETPLACES_FILE = path.join(
  * screen combined.
  */
 export function getMarketplaceClonePath(marketplaceName: string): string {
-	return path.join(CLAUDE_PLUGINS_DIR, marketplaceName);
+	return path.join(claudePluginsDir(), marketplaceName);
 }
 
 interface KnownMarketplaceEntry {
-	source: { source: string; url?: string; repo?: string };
+	source: { source: string; url?: string; repo?: string; path?: string };
 	installLocation: string;
 	lastUpdated: string;
 }
@@ -75,8 +98,8 @@ type KnownMarketplaces = Record<string, KnownMarketplaceEntry>;
  */
 async function readKnownMarketplacesOrNull(): Promise<KnownMarketplaces | null> {
 	try {
-		if (!(await fs.pathExists(KNOWN_MARKETPLACES_FILE))) return null;
-		const parsed = await fs.readJson(KNOWN_MARKETPLACES_FILE);
+		if (!(await fs.pathExists(knownMarketplacesFile()))) return null;
+		const parsed = await fs.readJson(knownMarketplacesFile());
 		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
 			return null;
 		}
@@ -97,9 +120,8 @@ async function readKnownMarketplaces(): Promise<KnownMarketplaces> {
  * Directory names a parsed `known_marketplaces.json` registers, or null when it
  * says nothing usable.
  *
- * Pure, and exported, because `scanLocalMarketplaces` resolves its paths from
- * `os.homedir()` at module load and cannot be pointed at a temp directory. The
- * decision this encodes is the part worth testing; the IO around it is not.
+ * Pure, and exported, so it can be tested without a registry file on disk:
+ * the decision this encodes is the part worth testing; the IO around it is not.
  *
  * Keyed by BOTH the registry key and the basename of `installLocation`: the two
  * are normally equal and nothing enforces it, and dropping a real marketplace
@@ -134,29 +156,39 @@ async function registeredDirNames(): Promise<Set<string> | null> {
 }
 
 /**
- * Get git remote URL from a marketplace directory
+ * The clone's `origin` URL as configured, normalised — read before any
+ * `url.<base>.insteadOf` rewrite, so a clone of `owner/repo` reads as
+ * `owner/repo` whatever URL git actually fetches from. Undefined when the
+ * directory is not a git clone or has no `origin`.
  */
-function getGitRemote(marketplacePath: string): string | undefined {
-	try {
-		const gitDir = path.join(marketplacePath, ".git");
-		if (!fs.existsSync(gitDir)) return undefined;
-
-		const result = execSync("git remote get-url origin", {
-			cwd: marketplacePath,
-			encoding: "utf-8",
-			timeout: 5000,
-		}).trim();
-
-		// Convert SSH URL to HTTPS format: git@github.com:user/repo.git -> user/repo
-		if (result.startsWith("git@github.com:")) {
-			return result.replace("git@github.com:", "").replace(/\.git$/, "");
-		}
-		// HTTPS URL: https://github.com/user/repo -> user/repo
-		if (result.includes("github.com")) {
-			const match = result.match(/github\.com[/:]([^/]+\/[^/\s.]+)/);
-			if (match) return match[1].replace(/\.git$/, "");
-		}
+async function getGitRemote(
+	marketplacePath: string,
+): Promise<string | undefined> {
+	if (!(await fs.pathExists(path.join(marketplacePath, ".git")))) {
 		return undefined;
+	}
+	const url = await remoteUrl(marketplacePath);
+	if (!url.ok || !url.value) return undefined;
+	return normaliseSource(url.value);
+}
+
+/**
+ * The `version` in a plugin's own `.claude-plugin/plugin.json`, or undefined.
+ * The fallback for a marketplace entry that carries none: a plugin versioned
+ * only in its own manifest otherwise reads as 0.0.0.
+ */
+async function pluginJsonVersion(
+	pluginPath: string | null,
+): Promise<string | undefined> {
+	if (!pluginPath) return undefined;
+	try {
+		const manifest: unknown = await fs.readJson(
+			path.join(pluginPath, ".claude-plugin", "plugin.json"),
+		);
+		const version = (manifest as { version?: unknown } | null)?.version;
+		return typeof version === "string" && version.trim() !== ""
+			? version
+			: undefined;
 	} catch {
 		return undefined;
 	}
@@ -265,6 +297,8 @@ export async function scanMcpServers(pluginPath: string): Promise<string[]> {
 async function scanSingleMarketplace(
 	marketplacePath: string,
 	marketplaceName: string,
+	trusted: TrustFile,
+	directorySource?: string,
 ): Promise<LocalMarketplace | null> {
 	const manifestPath = path.join(
 		marketplacePath,
@@ -276,7 +310,24 @@ async function scanSingleMarketplace(
 
 	try {
 		const manifest = await fs.readJson(manifestPath);
-		const gitRepo = getGitRemote(marketplacePath);
+		// A `directory` registration is read in place, so its source is the
+		// directory the registry names, not whatever remote that folder has.
+		const remoteSource = directorySource
+			? normaliseSource(directorySource)
+			: await getGitRemote(marketplacePath);
+		const gitRepo =
+			!directorySource && remoteSource && isGithubSource(remoteSource)
+				? remoteSource
+				: undefined;
+		const pluginRoot: string | undefined =
+			typeof manifest.metadata?.pluginRoot === "string"
+				? manifest.metadata.pluginRoot
+				: undefined;
+
+		const ownerName: string | undefined =
+			typeof manifest.owner?.name === "string" && manifest.owner.name.trim()
+				? manifest.owner.name.trim()
+				: undefined;
 
 		const plugins: LocalMarketplacePlugin[] = [];
 
@@ -296,7 +347,7 @@ async function scanSingleMarketplace(
 				// manifest is Claude Code's, and a scan reads it, never rewrites it.
 				// Its component lists stay empty because there is nothing to count.
 				const pluginPath = sourceStr
-					? path.join(marketplacePath, sourceStr.replace("./", ""))
+					? pluginDirFor(marketplacePath, sourceStr, pluginRoot)
 					: null;
 				if (pluginPath && (await fs.pathExists(pluginPath))) {
 					try {
@@ -327,7 +378,8 @@ async function scanSingleMarketplace(
 
 				plugins.push({
 					name: plugin.name,
-					version: plugin.version || "0.0.0",
+					version:
+						plugin.version || (await pluginJsonVersion(pluginPath)) || "0.0.0",
 					description: plugin.description || "",
 					source: plugin.source,
 					category: plugin.category,
@@ -348,6 +400,12 @@ async function scanSingleMarketplace(
 			description: manifest.description || manifest.metadata?.description || "",
 			plugins,
 			gitRepo,
+			remoteSource,
+			pluginRoot,
+			company:
+				readMarker(manifest) &&
+				isTrustedIn(trusted, marketplaceName, remoteSource),
+			...(ownerName ? { ownerName } : {}),
 		};
 	} catch {
 		return null;
@@ -377,11 +435,12 @@ export async function scanLocalMarketplaces(): Promise<
 	// of a nonsense label — `kanban@magus … moved → magus.bak`. `claude plugin
 	// marketplace list` never showed it, because Claude Code reads the registry.
 	const registered = await registeredDirNames();
+	const trusted = await readTrust();
 
 	// 1. Scan marketplaces from the standard directory
-	if (await fs.pathExists(CLAUDE_PLUGINS_DIR)) {
+	if (await fs.pathExists(claudePluginsDir())) {
 		try {
-			const entries = await fs.readdir(CLAUDE_PLUGINS_DIR, {
+			const entries = await fs.readdir(claudePluginsDir(), {
 				withFileTypes: true,
 			});
 
@@ -389,10 +448,11 @@ export async function scanLocalMarketplaces(): Promise<
 				if (!entry.isDirectory()) continue;
 				if (registered && !registered.has(entry.name)) continue;
 
-				const marketplacePath = path.join(CLAUDE_PLUGINS_DIR, entry.name);
+				const marketplacePath = path.join(claudePluginsDir(), entry.name);
 				const marketplace = await scanSingleMarketplace(
 					marketplacePath,
 					entry.name,
+					trusted,
 				);
 				if (marketplace) {
 					marketplaces.set(entry.name, marketplace);
@@ -417,6 +477,8 @@ export async function scanLocalMarketplaces(): Promise<
 					const marketplace = await scanSingleMarketplace(
 						entry.installLocation,
 						name,
+						trusted,
+						entry.source.path ?? entry.installLocation,
 					);
 					if (marketplace) {
 						marketplaces.set(name, marketplace);
@@ -445,7 +507,7 @@ export async function getLocalMarketplace(
  * Check if a marketplace exists in local cache
  */
 export async function hasLocalMarketplace(name: string): Promise<boolean> {
-	const marketplacePath = path.join(CLAUDE_PLUGINS_DIR, name);
+	const marketplacePath = path.join(claudePluginsDir(), name);
 	const manifestPath = path.join(
 		marketplacePath,
 		".claude-plugin",