rovecode 0.3.2 → 0.4.0-beta.2

package/src/mcp/config.ts

@@ -1,252 +0,0 @@
-/** MCP server configuration loading (port #3).
- *  Merges `.rovecode/mcp.json` (ours) with `.mcp.json` (harvested, claude-code
- *  format `{ mcpServers: { name: {command,args,env,url,type} } }`); ours wins
- *  on a name clash. With a `home`, the USER file `<home>/mcp.json` is the lowest
- *  layer under both (that is where `rovecode mcp add` writes by default).
- *  `${NAME}` in args, env, headers or url is filled from the environment — so a
- *  project file can name a secret without holding it; an unset name skips the
- *  entry with a warning rather than launching a server with an empty key.
- *  Malformed files/entries are skipped with a warning — this loader never throws. */
-
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { fileDigest } from "../core/trust.ts";
-
-/** sha256 (hex) of a file's bytes — the trust key for a project file; since 2026-09-07 core/trust.ts's memoised one */
-export { fileDigest };
-
-/** the one line an untrusted project file gets — names the file, the count, the review and the approval command */
-export function untrustedNote(file: string, count: number): string {
-  return `${file}: not trusted on this machine — its ${count} MCP server${count === 1 ? "" : "s"} stay off (they would run commands from this repo). Review: rovecode mcp show · approve: rovecode mcp trust (or rovecode trust for every gated file)`;
-}
-
-/** the PROJECT file — what the status hint and `mcp login` name (mcpConfigFiles(cwd).project) */
-export function mcpConfigPath(cwd: string): string {
-  return mcpConfigFiles(cwd).project;
-}
-
-/** where each scope's file lives; the market's `add`/`remove` write exactly these */
-export function mcpConfigFiles(cwd: string, home?: string): { user?: string; harvest: string; project: string } {
-  return { ...(home !== undefined ? { user: join(home, "mcp.json") } : {}), harvest: join(cwd, ".mcp.json"), project: join(cwd, ".rovecode", "mcp.json") };
-}
-
-const VAR_REF = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-/** an unfilled market placeholder: `<directory the server may touch>`. Angle brackets around prose, which
- *  is not something a real argument, URL or header value looks like. */
-const PLACEHOLDER_REF = /<[^<>]*[a-z][^<>]*>/g;
-/** `${NAME}` → env value; every missing name lands in `missing` (the caller decides that it is fatal) */
-export function expandVars(text: string, env: Record<string, string | undefined>, missing: string[]): string {
-  return text.replace(VAR_REF, (_m, name: string) => { const v = env[name]; if (v === undefined) { missing.push(name); return ""; } return v; });
-}
-
-export interface McpServerConfig {
-  name: string;
-  /** `sse` is the legacy HTTP+SSE wire (port #57): a first-class url transport, and the wire an `http`
-   *  entry falls back to ONCE when its initialize POST answers 404/405 (client.ts) */
-  transport: "stdio" | "http" | "sse";
-  command?: string;
-  args?: string[];
-  env?: Record<string, string>;
-  url?: string;
-  /** extra HTTP headers (auth tokens etc.) for http transports */
-  headers?: Record<string, string>;
-  /** port #76 (mcp/oauth.ts): a configured client id beats dynamic registration; scope rides the authorize request */
-  oauth?: { clientId?: string; scope?: string };
-  enabled?: boolean;
-}
-
-/** Shared narrow helper (also used by the manager in client.ts). */
-export function isRecord(v: unknown): v is Record<string, unknown> {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-
-/** Shared error-to-string helper (also used by the manager in client.ts). */
-export function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
-
-/** Normalize one server entry (claude-code `.mcp.json` style or ours). Returns
- *  undefined (and records a warning) when the entry cannot produce a usable config. */
-export function normalizeEntry(name: string, raw: unknown, file: string, warnings: string[], envSource: Record<string, string | undefined> = process.env, opts: { allowPlaceholders?: boolean } = {}): McpServerConfig | undefined {
-  if (!isRecord(raw)) {
-    warnings.push(`${file}: server "${name}" is not an object; skipped`);
-    return undefined;
-  }
-  const missing: string[] = [];
-  const fill = (s: string): string => expandVars(s, envSource, missing);
-  const command = typeof raw.command === "string" && raw.command.length > 0 ? raw.command : undefined;
-  const url = typeof raw.url === "string" && raw.url.length > 0 ? fill(raw.url) : undefined;
-  const declared = typeof raw.transport === "string" ? raw.transport : typeof raw.type === "string" ? raw.type : undefined;
-
-  let transport: McpServerConfig["transport"] | undefined;
-  if (declared === "stdio") transport = "stdio";
-  else if (declared === "http" || declared === "streamable-http" || declared === "streamable_http") transport = "http";
-  else if (declared === "sse") transport = "sse"; // port #57: legacy HTTP+SSE, spoken by client.ts
-  else if (declared !== undefined) {
-    warnings.push(`${file}: server "${name}" has unknown transport "${declared}"; skipped`);
-    return undefined;
-  } else transport = url !== undefined ? "http" : command !== undefined ? "stdio" : undefined;
-
-  if (transport === undefined) {
-    warnings.push(`${file}: server "${name}" has neither command nor url; skipped`);
-    return undefined;
-  }
-  if (transport === "stdio" && command === undefined) {
-    warnings.push(`${file}: stdio server "${name}" is missing command; skipped`);
-    return undefined;
-  }
-  if (transport === "http" || transport === "sse") {
-    if (url === undefined) {
-      warnings.push(`${file}: ${transport} server "${name}" is missing url; skipped`);
-      return undefined;
-    }
-    try {
-      new URL(url);
-    } catch {
-      warnings.push(`${file}: ${transport} server "${name}" has invalid url "${url}"; skipped`);
-      return undefined;
-    }
-  }
-
-  let args: string[] | undefined;
-  if (raw.args !== undefined) {
-    if (Array.isArray(raw.args) && raw.args.every((x): x is string => typeof x === "string")) {
-      args = raw.args.map(fill);
-    } else {
-      warnings.push(`${file}: server "${name}" has non-string args; skipped`);
-      return undefined;
-    }
-  }
-  let env: Record<string, string> | undefined;
-  if (isRecord(raw.env)) {
-    env = {};
-    for (const [k, v] of Object.entries(raw.env)) if (typeof v === "string") env[k] = fill(v);
-  }
-  let headers: Record<string, string> | undefined;
-  if (isRecord(raw.headers)) {
-    headers = {};
-    for (const [k, v] of Object.entries(raw.headers)) if (typeof v === "string") headers[k] = fill(v);
-  }
-  let oauth: McpServerConfig["oauth"];
-  if (isRecord(raw.oauth)) {
-    oauth = {};
-    if (typeof raw.oauth.clientId === "string" && raw.oauth.clientId.length > 0) oauth.clientId = raw.oauth.clientId;
-    if (typeof raw.oauth.scope === "string" && raw.oauth.scope.length > 0) oauth.scope = raw.oauth.scope;
-    if (Object.keys(oauth).length === 0) oauth = undefined;
-  }
-  if (missing.length > 0) {
-    // an empty key would launch a server that fails on its first call; naming the variable is the fix
-    warnings.push(`${file}: server "${name}" needs ${[...new Set(missing)].map((m) => `\${${m}}`).join(", ")} set in the environment; skipped`);
-    return undefined;
-  }
-  // The other half of the same rule, for the values a market install could not fill: a required argument
-  // that only the human knows (which directory the filesystem server may touch) is written into the file
-  // as `<directory the server may touch>`, and a server still carrying one is not launched. Launching it
-  // means npx starts, the server rejects its own arguments, and the failure surfaces as a connect error
-  // several layers from the thing that is actually wrong — an editable line in a file rovecode named.
-  const holes = placeholderHoles({ args, env, headers, url });
-  if (holes.length > 0 && opts.allowPlaceholders !== true) {
-    warnings.push(`${file}: server "${name}" still has ${holes.join(", ")} to fill in; skipped (edit that line and it will connect)`);
-    return undefined;
-  }
-
-  const out: McpServerConfig = { name, transport };
-  if (command !== undefined) out.command = command;
-  if (args !== undefined) out.args = args;
-  if (env !== undefined) out.env = env;
-  if (url !== undefined) out.url = url;
-  if (headers !== undefined) out.headers = headers;
-  if (oauth !== undefined) out.oauth = oauth;
-  if (typeof raw.enabled === "boolean") out.enabled = raw.enabled;
-  return out;
-}
-
-/** Parse one config file. Accepts the claude-code map form
- *  `{ mcpServers: { name: {...} } }` and, additionally (ours), a
- *  `{ servers: McpServerConfig[] }` array form. */
-/** The `<…>` placeholders an entry still carries, in file order, each once. Empty = launchable as far as
- *  arguments go. Shared by the loader (which refuses to launch while any remain) and the listing surfaces
- *  (which must SHOW such an entry, marked, rather than pretend it was never written). */
-export function placeholderHoles(s: { args?: string[]; env?: Record<string, string>; headers?: Record<string, string>; url?: string }): string[] {
-  return [...new Set([...(s.args ?? []), ...Object.values(s.env ?? {}), ...Object.values(s.headers ?? {}), ...(s.url !== undefined ? [s.url] : [])]
-    .flatMap((v) => [...v.matchAll(PLACEHOLDER_REF)].map((m) => m[0])))];
-}
-
-/** `opts.allowPlaceholders`: keep entries that still carry a `<…>` hole (a LISTING wants to show them, marked);
- *  the loader leaves it off and such an entry is skipped with a warning naming the hole. */
-export function parseConfigFile(path: string, warnings: string[], envSource: Record<string, string | undefined> = process.env, opts: { allowPlaceholders?: boolean } = {}): McpServerConfig[] {
-  if (!existsSync(path)) return [];
-  let text: string;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch (err) {
-    warnings.push(`${path}: unreadable (${message(err)}); file skipped`);
-    return [];
-  }
-  let json: unknown;
-  try {
-    json = JSON.parse(text);
-  } catch (err) {
-    warnings.push(`${path}: invalid JSON (${message(err)}); file skipped`);
-    return [];
-  }
-  if (!isRecord(json)) {
-    warnings.push(`${path}: root is not an object; file skipped`);
-    return [];
-  }
-  const out: McpServerConfig[] = [];
-  if (json.mcpServers !== undefined) {
-    if (isRecord(json.mcpServers)) {
-      for (const [name, raw] of Object.entries(json.mcpServers)) {
-        const cfg = normalizeEntry(name, raw, path, warnings, envSource, opts);
-        if (cfg) out.push(cfg);
-      }
-    } else warnings.push(`${path}: "mcpServers" is not an object; ignored`);
-  }
-  if (json.servers !== undefined) {
-    if (Array.isArray(json.servers)) {
-      for (const raw of json.servers) {
-        const name = isRecord(raw) && typeof raw.name === "string" && raw.name.length > 0 ? raw.name : undefined;
-        if (name === undefined) {
-          warnings.push(`${path}: servers[] entry without a name; skipped`);
-          continue;
-        }
-        const cfg = normalizeEntry(name, raw, path, warnings, envSource, opts);
-        if (cfg) out.push(cfg);
-      }
-    } else warnings.push(`${path}: "servers" is not an array; ignored`);
-  }
-  return out;
-}
-
-export interface LoadMcpOptions {
-  /** the user home; without it the user file is not read (existing callers and tests) */
-  home?: string;
-  /** what `${NAME}` is filled from (default process.env) */
-  env?: Record<string, string | undefined>;
-  /** the trust gate for PROJECT files (mcp/trust.ts trustedPredicate). Without it project files load as
-   *  they always did; with it an unapproved file contributes nothing and leaves one warning. The user
-   *  file is never gated — it is yours. */
-  trusted?: (file: string, digest: string) => boolean;
-}
-
-/** Merge the user file (`<home>/mcp.json`, only when a home is given) under `.mcp.json` (harvest)
- *  under `.rovecode/mcp.json` (ours). The most local wins on a name clash. Pass a `warnings` array
- *  to collect human-readable skip reasons. */
-export function loadMcpConfig(cwd: string, warnings: string[] = [], opts: LoadMcpOptions = {}): McpServerConfig[] {
-  const files = mcpConfigFiles(cwd, opts.home);
-  const byName = new Map<string, McpServerConfig>();
-  const anySet = new Proxy({}, { get: () => "set" }) as Record<string, string>; // counting entries, not launching them
-  for (const [scope, path] of [["user", files.user], ["harvest", files.harvest], ["project", files.project]] as const) {
-    if (path === undefined) continue;
-    if (scope !== "user" && opts.trusted !== undefined) {
-      const digest = fileDigest(path);
-      if (digest !== undefined && !opts.trusted(path, digest)) {
-        warnings.push(untrustedNote(path, parseConfigFile(path, [], anySet).length));
-        continue; // absence, not "loaded but marked"
-      }
-    }
-    for (const c of parseConfigFile(path, warnings, opts.env)) byName.set(c.name, c); // later layers win
-  }
-  return [...byName.values()];
-}

package/src/mcp/local-package.ts

@@ -1,211 +0,0 @@
-/** Install-once for MCP servers the market would otherwise launch with `npx -y <package>`.
- *
- *  Why this exists, in numbers (Windows 11, node 24, npm 11, the memory and filesystem servers, medians of
- *  3–5 runs through McpManager, measured 2026-09-06): a warm `npx -y` takes 1.8–2.1 s from spawn to the
- *  initialize handshake; the same package installed once and launched with `node <its bin>` takes
- *  0.35–0.47 s. The difference is npx itself — `npx --version` alone is 0.6 s, and every warm launch still
- *  asks registry.npmjs.org to revalidate the package (0.3–1.3 s, and no network means a timeout path). A
- *  cold cache is 7 s and a 47 MB download, repeated whenever upstream publishes, because `-y <package>`
- *  means "latest". The one-time install is ~6 s and ~30 MB for two servers sharing one SDK copy.
- *
- *  What it is NOT: silent, or the only path. The human is asked, in the plan they approve, and "no" leaves
- *  the npx line exactly as it is today. Installing code is a bigger act than writing a config line, and
- *  the plan says so in those words. The record in installed.json carries the package name, the version
- *  that landed and npm's integrity hash from the lockfile — an install that is recorded is auditable; an
- *  `npx -y` that runs whatever "latest" is at every start is not.
- *
- *  Where: one shared prefix, `~/.rovecode/mcp/`, with its own package.json so npm never mistakes a parent
- *  folder for the project. N servers share one node_modules and one SDK copy. The launch line is `node`
- *  plus the ABSOLUTE path of the package's bin — never the .cmd shim (it means cmd.exe and its quoting),
- *  and the path survives a space because it is one argv entry, not a shell string. */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import type { McpServerConfig } from "./config.ts";
-import type { MarketInstall } from "./market.ts";
-
-export type Spawn = (cmd: string[], cwd: string) => Promise<{ code: number; stderr: string }>;
-
-/** the package an `npx …` launch line runs, taken apart */
-export interface NpxPackage {
-  /** the package name, `@scope/name` or `name` */
-  name: string;
-  /** what npx was given: name, or `name@version` when the catalog pinned one */
-  spec: string;
-  /** the pinned version, when the spec carried one */
-  version?: string;
-  /** the arguments the SERVER receives — everything after the package spec */
-  rest: string[];
-}
-
-const NPX_FLAGS_NO_VALUE = new Set(["-y", "--yes", "-q", "--quiet", "--no-install", "--prefer-offline", "--prefer-online"]);
-/** `@scope/name`, `name`, optionally `@version` — a registry package and nothing else (no git URL, no tarball, no path) */
-const PACKAGE_SPEC = /^(@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)(?:@([^@\s/]+))?$/;
-
-/** The package a stdio `npx` launch runs, or undefined when the line is not a plain `npx [flags] <package>
- *  [args]` — an `npx -p x cmd`, a git URL or a tarball is left to npx, since we cannot say what we would be
- *  installing. Undefined means "no offer", never an error: the npx line still works. */
-export function npxPackage(install: MarketInstall): NpxPackage | undefined {
-  if (install.kind !== "stdio" || install.runtime !== "npx" || install.command !== "npx") return undefined;
-  let i = 0;
-  while (i < install.args.length && install.args[i]!.startsWith("-")) {
-    if (!NPX_FLAGS_NO_VALUE.has(install.args[i]!)) return undefined; // a flag with a value (-p, --package, -c): not our shape
-    i += 1;
-  }
-  const spec = install.args[i];
-  if (spec === undefined) return undefined;
-  const m = PACKAGE_SPEC.exec(spec);
-  if (!m) return undefined;
-  const out: NpxPackage = { name: m[1]!, spec, rest: install.args.slice(i + 1) };
-  if (m[2] !== undefined) out.version = m[2];
-  return out;
-}
-
-/** the shared prefix every install-once server lives in */
-export function localPrefix(home: string): string { return join(home, "mcp"); }
-
-/** what landed on disk, read back after npm finished — the record's source of truth */
-export interface LocalPackage {
-  name: string;
-  version: string;
-  /** ABSOLUTE path of the package's bin script — what `node` runs */
-  bin: string;
-  /** npm's integrity hash for the tarball, from package-lock.json */
-  integrity?: string;
-  /** the tarball URL npm resolved, from package-lock.json */
-  resolved?: string;
-  /** what could not be recorded and why — an empty list is the normal case. Written into installed.json
-   *  as it is, so a record with a hole says where the hole is instead of leaving a field silently absent. */
-  missing: string[];
-}
-
-export interface InstallLocalDeps {
-  /** how `npm install` runs — tests inject one that writes a fake node_modules and never touches the network */
-  spawn?: Spawn;
-}
-
-const defaultSpawn: Spawn = async (cmd, cwd) => {
-  const p = Bun.spawn(cmd, { cwd, stdout: "ignore", stderr: "pipe", stdin: "ignore" });
-  return { code: await p.exited, stderr: await new Response(p.stderr).text() };
-};
-
-/** the exact argv `installLocalPackage` runs — exported so the plan can show it verbatim */
-export function npmInstallArgv(pkg: NpxPackage, prefix: string): string[] {
-  return ["npm", "install", "--prefix", prefix, "--save", "--no-fund", "--no-audit", "--loglevel=error", pkg.spec];
-}
-
-/** Run `npm install` for one package into the shared prefix, then read back what landed. Never throws for
- *  an npm failure — the caller shows the error and nothing has been written to mcp.json yet. */
-export async function installLocalPackage(pkg: NpxPackage, prefix: string, deps: InstallLocalDeps = {}): Promise<{ ok: true; pkg: LocalPackage } | { ok: false; error: string }> {
-  const spawn = deps.spawn ?? defaultSpawn;
-  try {
-    mkdirSync(prefix, { recursive: true });
-    // a package.json of its own, so npm treats the prefix as the project: without one it can walk up and
-    // install into whatever package.json it finds above ~/.rovecode
-    const manifest = join(prefix, "package.json");
-    if (!existsSync(manifest)) {
-      writeFileSync(manifest, JSON.stringify({ name: "rovecode-mcp-servers", private: true, description: "MCP servers installed once by rovecode's market — launched with node, not npx (docs/mcp-market.md)" }, null, 2) + "\n");
-    }
-    const r = await spawn(npmInstallArgv(pkg, prefix), prefix);
-    if (r.code !== 0) return { ok: false, error: `npm install ${pkg.spec} failed (exit ${r.code})${r.stderr.trim() ? `: ${r.stderr.trim().split("\n").slice(-3).join(" · ")}` : ""}` };
-  } catch (e) {
-    return { ok: false, error: `npm install ${pkg.spec} could not run: ${e instanceof Error ? e.message : String(e)}` };
-  }
-  return readLocalPackage(pkg.name, prefix);
-}
-
-/** What is on disk for one package under the prefix: version and bin from its package.json, integrity from
- *  the lockfile. `ok: false` when the package or its bin is not there — then there is nothing to launch. */
-export function readLocalPackage(name: string, prefix: string): { ok: true; pkg: LocalPackage } | { ok: false; error: string } {
-  const dir = join(prefix, "node_modules", ...name.split("/"));
-  const manifestPath = join(dir, "package.json");
-  if (!existsSync(manifestPath)) return { ok: false, error: `npm reported success but ${manifestPath} is not there` };
-  let manifest: Record<string, unknown>;
-  try { manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>; }
-  catch (e) { return { ok: false, error: `${manifestPath}: ${e instanceof Error ? e.message : String(e)}` }; }
-  const version = typeof manifest.version === "string" ? manifest.version : undefined;
-  if (version === undefined) return { ok: false, error: `${manifestPath} states no version` };
-  const binRel = binOf(name, manifest.bin);
-  if (binRel === undefined) return { ok: false, error: `${name} declares no bin — there is nothing for node to run; npx would have failed the same way` };
-  const bin = resolve(dir, binRel);
-  if (!existsSync(bin)) return { ok: false, error: `${name}'s bin ${bin} is not on disk` };
-  const missing: string[] = [];
-  const lock = lockEntry(prefix, name, missing);
-  const pkg: LocalPackage = { name, version, bin, missing };
-  if (lock?.integrity !== undefined) pkg.integrity = lock.integrity;
-  if (lock?.resolved !== undefined) pkg.resolved = lock.resolved;
-  return { ok: true, pkg };
-}
-
-/** the bin a package declares: a string, or a map — the entry named like the package, else the only one */
-function binOf(name: string, bin: unknown): string | undefined {
-  if (typeof bin === "string") return bin;
-  if (typeof bin !== "object" || bin === null) return undefined;
-  const entries = Object.entries(bin as Record<string, unknown>).filter((e): e is [string, string] => typeof e[1] === "string");
-  if (entries.length === 0) return undefined;
-  const short = name.split("/").pop()!;
-  return (entries.find(([k]) => k === short) ?? entries[0]!)[1];
-}
-
-/** package-lock.json (lockfileVersion 2/3) → the entry for `node_modules/<name>`. Every way it can fall
- *  short is written into `missing` in words, because a silent undefined here becomes a record that looks
- *  complete and is not. */
-function lockEntry(prefix: string, name: string, missing: string[]): { integrity?: string; resolved?: string } | undefined {
-  const lockPath = join(prefix, "package-lock.json");
-  if (!existsSync(lockPath)) { missing.push(`integrity: ${lockPath} was not written by npm`); return undefined; }
-  let lock: unknown;
-  try { lock = JSON.parse(readFileSync(lockPath, "utf8")); }
-  catch { missing.push(`integrity: ${lockPath} is not valid JSON`); return undefined; }
-  const packages = typeof lock === "object" && lock !== null ? (lock as { packages?: unknown }).packages : undefined;
-  if (typeof packages !== "object" || packages === null) { missing.push(`integrity: ${lockPath} has no "packages" map (lockfileVersion 1?)`); return undefined; }
-  const entry = (packages as Record<string, unknown>)[`node_modules/${name}`];
-  if (typeof entry !== "object" || entry === null) { missing.push(`integrity: ${lockPath} has no entry for node_modules/${name}`); return undefined; }
-  const e = entry as { integrity?: unknown; resolved?: unknown };
-  const out: { integrity?: string; resolved?: string } = {};
-  if (typeof e.integrity === "string") out.integrity = e.integrity; else missing.push(`integrity: the lockfile entry for ${name} carries no integrity field`);
-  if (typeof e.resolved === "string") out.resolved = e.resolved;
-  return out;
-}
-
-/** the mcp.json launch line for an installed package: `node` + the bin's absolute path + the server's own
- *  arguments. One argv entry per item — a path with a space in it is still one argument, because nothing
- *  here goes through a shell (mcp/client.ts spawns with shell: false). */
-export function localLaunch(pkg: LocalPackage, rest: string[]): { command: "node"; args: string[] } {
-  return { command: "node", args: [pkg.bin, ...rest] };
-}
-
-/** the launch line as the plan can show it BEFORE the install: the bin's exact filename is read from the
- *  package after npm has put it there, so the preview names the folder and marks the file as pending */
-export function plannedLaunchLabel(pkg: NpxPackage, prefix: string): string {
-  return ["node", `${join(prefix, "node_modules", ...pkg.name.split("/"))}${process.platform === "win32" ? "\\" : "/"}<its bin, read after the install>`, ...pkg.rest].join(" ");
-}
-
-/** the plan rows that say what installing once means — every word the human should read before the yes */
-export function localPlanLines(pkg: NpxPackage, prefix: string): string[] {
-  return [
-    `  installs   ${npmInstallArgv(pkg, prefix).join(" ")}`,
-    `             rovecode runs a package manager for you here. npm downloads ${pkg.spec} and everything it depends`,
-    `             on and puts their CODE on this machine, under ${prefix} — typically 20–30 MB and a few seconds, once.`,
-    `             In return the server starts in ~0.4 s instead of ~2 s and needs no network to start.`,
-    `             Requires npm (it comes with Node.js, as npx does).`,
-    `  records    package name, version and npm's integrity hash in installed.json — what ran is on record`,
-    `             (an npx line runs whatever "latest" is at every start, and records nothing)`,
-  ];
-}
-
-/** a configured server that still launches through npx — the rows `mcp list` may offer the install-once line for */
-export function launchesViaNpx(server: McpServerConfig): boolean {
-  return server.transport === "stdio" && server.command === "npx" && server.enabled !== false;
-}
-
-/** the one-line offer `mcp list` prints under the rows when some of them start through npx. Says what
- *  changes, what it costs and that nothing happens until the human runs the command — no config is
- *  rewritten by a listing. */
-export function npxOfferLine(names: string[]): string | undefined {
-  if (names.length === 0) return undefined;
-  const n = names.length;
-  // `<catalog name>`, not the server name the row shows: `mcp add` takes the name you installed it by (a
-  // registry server is `io.github.acme/widgets`, its row is `widgets`), and a renamed one needs its `--as` back
-  return `${n} server${n === 1 ? "" : "s"} start${n === 1 ? "s" : ""} through npx, which re-resolves the package at every start (~2 s each): ${names.join(", ")}. `
-    + `To start in ~0.4 s, reinstall with \`rovecode mcp add <catalog name> --local --force\` (the name you installed it by; add \`--as <server name>\` if you renamed it; installs the package once, ~25 MB). Nothing changes until you do.`;
-}

package/src/mcp/market-catalog.ts

@@ -1,84 +0,0 @@
-/** The curated half of the MCP market: servers we have looked at, from publishers we can name, with
- *  the exact launch line spelled out. Offline by design — `rovecode mcp search` answers from this list
- *  before it asks the registry, and /mcp with an empty query shows only this list. Rules for an entry:
- *  the publisher is the org that owns the package or the host; secrets travel by environment variable
- *  (or a header for a remote), never as an argument; anything OAuth-only is left out because our http
- *  transport carries a header, not a browser flow. Keep it short — this is a shelf, not a mirror. */
-
-import type { MarketEntry } from "./market.ts";
-
-const npx = (pkg: string, ...rest: string[]): string[] => ["-y", pkg, ...rest];
-
-export const CURATED: readonly MarketEntry[] = [
-  { key: "filesystem", title: "Filesystem", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "Read, write, search and move files under the directories you name.",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("@modelcontextprotocol/server-filesystem"), env: [], pending: ["<directory the server may touch>"] }] },
-  { key: "memory", title: "Memory", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "A knowledge graph the model can remember across sessions with (entities, relations, observations).",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("@modelcontextprotocol/server-memory"), env: [], pending: [] }] },
-  { key: "sequential-thinking", title: "Sequential Thinking", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "A scratchpad tool for step-by-step reasoning with revisions and branches.",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("@modelcontextprotocol/server-sequential-thinking"), env: [], pending: [] }] },
-  { key: "everything", title: "Everything (test server)", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "Exercises every MCP feature — prompts, resources, sampling, progress. For testing a client, not for work.",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("@modelcontextprotocol/server-everything"), env: [], pending: [] }] },
-  { key: "fetch", title: "Fetch", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "Fetch a URL and hand the page back as markdown (Python; needs uv).",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "uvx", command: "uvx", args: ["mcp-server-fetch"], env: [], pending: [] }] },
-  { key: "git", title: "Git", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "Read and search git repositories: log, diff, show, status (Python; needs uv).",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "uvx", command: "uvx", args: ["mcp-server-git"], env: [], pending: [] }] },
-  { key: "time", title: "Time", source: "curated", publisher: "modelcontextprotocol (Anthropic)",
-    description: "Current time and timezone conversion (Python; needs uv).",
-    repository: "https://github.com/modelcontextprotocol/servers",
-    installs: [{ kind: "stdio", runtime: "uvx", command: "uvx", args: ["mcp-server-time"], env: [], pending: [] }] },
-  { key: "github", title: "GitHub", source: "curated", publisher: "GitHub",
-    description: "Issues, pull requests, code search and Actions on GitHub — remote with a personal access token, or the official image via docker.",
-    repository: "https://github.com/github/github-mcp-server",
-    installs: [
-      { kind: "http", url: "https://api.githubcopilot.com/mcp/", headers: [{ name: "Authorization", template: "Bearer {GITHUB_PAT}", required: true, secret: true, description: "a GitHub personal access token" }] },
-      { kind: "stdio", runtime: "docker", command: "docker", args: ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"],
-        env: [{ name: "GITHUB_PERSONAL_ACCESS_TOKEN", required: true, secret: true, description: "a GitHub personal access token" }], pending: [] },
-    ] },
-  { key: "playwright", title: "Playwright", source: "curated", publisher: "Microsoft",
-    description: "Drive a real browser through accessibility snapshots: navigate, click, type, screenshot.",
-    repository: "https://github.com/microsoft/playwright-mcp",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("@playwright/mcp@latest"), env: [], pending: [] }] },
-  { key: "context7", title: "Context7", source: "curated", publisher: "Upstash",
-    description: "Up-to-date library documentation and code examples for the versions you actually use.",
-    repository: "https://github.com/upstash/context7",
-    installs: [
-      { kind: "http", url: "https://mcp.context7.com/mcp", headers: [{ name: "CONTEXT7_API_KEY", required: false, secret: true, description: "optional API key for higher limits" }] },
-      { kind: "stdio", runtime: "npx", command: "npx", args: npx("@upstash/context7-mcp"), env: [{ name: "CONTEXT7_API_KEY", required: false, secret: true, description: "optional API key for higher limits" }], pending: [] },
-    ] },
-  { key: "brave-search", title: "Brave Search", source: "curated", publisher: "Brave",
-    description: "Web, news, image and local search through the Brave Search API.",
-    repository: "https://github.com/brave/brave-search-mcp-server",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("@brave/brave-search-mcp-server"), env: [{ name: "BRAVE_API_KEY", required: true, secret: true, description: "Brave Search API key" }], pending: [] }] },
-  { key: "firecrawl", title: "Firecrawl", source: "curated", publisher: "Firecrawl (Mendable)",
-    description: "Scrape, crawl and extract structured data from websites.",
-    repository: "https://github.com/mendableai/firecrawl-mcp-server",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("firecrawl-mcp"), env: [{ name: "FIRECRAWL_API_KEY", required: true, secret: true, description: "Firecrawl API key" }], pending: [] }] },
-  { key: "tavily", title: "Tavily", source: "curated", publisher: "Tavily",
-    description: "Search and extract built for agents: web search, page extraction, site crawl.",
-    repository: "https://github.com/tavily-ai/tavily-mcp",
-    installs: [{ kind: "stdio", runtime: "npx", command: "npx", args: npx("tavily-mcp"), env: [{ name: "TAVILY_API_KEY", required: true, secret: true, description: "Tavily API key" }], pending: [] }] },
-  { key: "exa", title: "Exa", source: "curated", publisher: "Exa",
-    description: "Neural web search and page contents for AI; the remote works without a key at a low rate.",
-    repository: "https://github.com/exa-labs/exa-mcp-server",
-    installs: [{ kind: "http", url: "https://mcp.exa.ai/mcp", headers: [] }] },
-  { key: "deepwiki", title: "DeepWiki", source: "curated", publisher: "Cognition (Devin)",
-    description: "Ask questions about any public GitHub repository, answered from its generated wiki. No key.",
-    homepage: "https://docs.devin.ai/work-with-devin/deepwiki-mcp",
-    installs: [{ kind: "http", url: "https://mcp.deepwiki.com/mcp", headers: [] }] },
-  { key: "cloudflare-docs", title: "Cloudflare Docs", source: "curated", publisher: "Cloudflare",
-    description: "Search Cloudflare's developer documentation. No key.",
-    repository: "https://github.com/cloudflare/mcp-server-cloudflare",
-    installs: [{ kind: "http", url: "https://docs.mcp.cloudflare.com/mcp", headers: [] }] },
-];