@cabane/companion 0.6.134 → 0.6.135

package/dist/cli.js

@@ -2024,12 +2024,14 @@ var init_turn_request = __esm({
       z8.object({
         type: z8.literal("http"),
         url: z8.string(),
-        headers: z8.record(z8.string(), z8.string()).optional()
+        headers: z8.record(z8.string(), z8.string()).optional(),
+        headersFromEnv: z8.record(z8.string(), z8.string()).optional()
       }),
       z8.object({
         type: z8.literal("sse"),
         url: z8.string(),
-        headers: z8.record(z8.string(), z8.string()).optional()
+        headers: z8.record(z8.string(), z8.string()).optional(),
+        headersFromEnv: z8.record(z8.string(), z8.string()).optional()
       })
     ]);
     resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
@@ -2070,6 +2072,11 @@ var init_turn_request = __esm({
         cwd: z8.string().optional(),
         env: z8.record(z8.string(), z8.string()).optional(),
         mcpServers: resolvedMcpServersSchema.optional(),
+        // CT1698: the values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` →
+        // complete header value). The adapter merges them into the harness
+        // process's environment and nowhere else; the host never merges them into
+        // its own. Absent when no server references one.
+        secretEnv: z8.record(z8.string(), z8.string()).optional(),
         // CT289: machine-local claude-code adapter knobs the operator sets on a
         // companion they run themselves — the auto-memory escape hatch. `autoMemory:
         // true` opts back into Claude Code's auto-memory (governed by the operator's
@@ -2565,6 +2572,29 @@ var init_addendum = __esm({
   }
 });
 
+// packages/agent-runtime/src/mcp-secret-env.ts
+function headersAsEnvReferences(server) {
+  const refs = Object.entries(server.headersFromEnv ?? {}).map(
+    ([header, envName]) => [header, `\${${envName}}`]
+  );
+  if (!server.headers && refs.length === 0) return void 0;
+  return { ...server.headers, ...Object.fromEntries(refs) };
+}
+function headersResolvedFrom(server, secretEnv) {
+  const resolved = {};
+  for (const [header, envName] of Object.entries(server.headersFromEnv ?? {})) {
+    const value = secretEnv?.[envName];
+    if (value !== void 0) resolved[header] = value;
+  }
+  if (!server.headers && Object.keys(resolved).length === 0) return void 0;
+  return { ...server.headers, ...resolved };
+}
+var init_mcp_secret_env = __esm({
+  "packages/agent-runtime/src/mcp-secret-env.ts"() {
+    "use strict";
+  }
+});
+
 // packages/agent-runtime/src/claude-code/policy.ts
 import { z as z10 } from "zod";
 function disallowedToolsFor(policy) {
@@ -2713,8 +2743,18 @@ async function preToolUseHook(input) {
 function buildClaudeCodeOptions(req, augment) {
   const { policy, config } = req;
   const cwd = req.local.cwd;
+  const userServers = {};
+  for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
+    if ("url" in server) {
+      const { headersFromEnv: _refs, headers: _headers, ...rest } = server;
+      const headers = headersAsEnvReferences(server);
+      userServers[name] = { ...rest, ...headers ? { headers } : {} };
+    } else {
+      userServers[name] = server;
+    }
+  }
   const mcpServers = {
-    ...req.local.mcpServers ?? {},
+    ...userServers,
     ...req.extra.mcpServers
   };
   if (!(CABANE_MCP_SERVER in mcpServers)) {
@@ -2796,9 +2836,13 @@ function buildClaudeCodeOptions(req, augment) {
     // SDK's own doc on `Options.env`), which is why `process.env` is spread here
     // and why this key is now always present — previously it appeared only when
     // `req.local.env` was set, and an absent `env` inherits `process.env`.
+    //
+    // CT1698: `secretEnv` joins here, and only here — the values the MCP
+    // headers above reference. It is this child's environment, not the host's.
     env: {
       ...process.env,
       ...req.local.env,
+      ...req.local.secretEnv,
       CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"
     },
     ...resume ? { resume } : {}
@@ -2832,6 +2876,7 @@ var CABANE_MCP_SERVER, ACTIVE_CONVERSATION_HEADER;
 var init_options = __esm({
   "packages/agent-runtime/src/claude-code/options.ts"() {
     "use strict";
+    init_mcp_secret_env();
     init_policy();
     init_model();
     init_session();
@@ -4121,7 +4166,10 @@ function buildRunSpec(req, resumeSessionId) {
     // Fresh session → mint + send a client id; resumed → let opencode mint it.
     sendClientMessageId: resumeSessionId == null,
     ...dialect.agent ? { agent: dialect.agent } : {},
-    mcp: buildMcp(req)
+    mcp: buildMcp(req),
+    credentialServers: Object.entries(req.local.mcpServers ?? {}).filter(
+      ([, server]) => "url" in server && Object.keys(server.headersFromEnv ?? {}).length > 0
+    ).map(([name]) => name)
   };
 }
 function buildParts(req) {
@@ -4140,10 +4188,11 @@ function buildMcp(req) {
   const mcp = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const headers = headersResolvedFrom(server, req.local.secretEnv);
       mcp[name] = {
         type: "remote",
         url: server.url,
-        ...server.headers ? { headers: server.headers } : {},
+        ...headers ? { headers } : {},
         enabled: true
       };
     } else if ("command" in server) {
@@ -4202,6 +4251,7 @@ var CABANE_MCP_SERVER2, TURN_CONTROL_MCP_SERVER, ACTIVE_CONVERSATION_HEADER2;
 var init_run_spec = __esm({
   "packages/agent-runtime/src/opencode/run-spec.ts"() {
     "use strict";
+    init_mcp_secret_env();
     init_policy2();
     init_model2();
     CABANE_MCP_SERVER2 = "cabane";
@@ -4338,23 +4388,47 @@ async function* releaseAfter(events, release) {
   }
 }
 async function installMcp(doFetch, base, spec, signal) {
+  const [live, configured] = await Promise.all([
+    getJson(doFetch, `${base}/mcp`, signal),
+    getJson(doFetch, `${base}/config`, signal)
+  ]);
+  const operatorOwned = new Set(Object.keys(asRecord2(asRecord2(configured).mcp)));
+  const stale = Object.keys(asRecord2(live)).filter(
+    (name) => !(name in spec.mcp) && !operatorOwned.has(name)
+  );
+  await Promise.all(stale.map((name) => postMcp(doFetch, base, name, SCRUBBED_MCP_CONFIG, signal)));
+  const shadowing = (spec.credentialServers ?? []).filter((name) => operatorOwned.has(name));
+  if (shadowing.length > 0) {
+    throw new Error(
+      `opencode: ${shadowing.map((n) => `"${n}"`).join(", ")} would replace an MCP server this opencode instance configures itself; rename that server in the opencode config to use this connection here`
+    );
+  }
   await Promise.all(
-    Object.entries(spec.mcp).map(async ([name, config]) => {
-      const res = await doFetch(`${base}/mcp`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ name, config }),
-        signal
-      });
-      if (!res.ok) {
-        const detail = await res.text().catch(() => "");
-        throw new Error(
-          `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
-        );
-      }
-    })
+    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, base, name, config, signal))
   );
 }
+async function postMcp(doFetch, base, name, config, signal) {
+  const res = await doFetch(`${base}/mcp`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name, config }),
+    signal
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
+    );
+  }
+}
+async function getJson(doFetch, url, signal) {
+  const res = await doFetch(url, { signal });
+  if (!res.ok) throw new Error(`opencode: ${url} unavailable (HTTP ${res.status})`);
+  return res.json();
+}
+function asRecord2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
 async function* parseSseStream(body, sessionId, signal) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
@@ -4404,11 +4478,16 @@ function newOpencodeMessageId() {
 function trimSlash(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
-var serverTurnTails;
+var serverTurnTails, SCRUBBED_MCP_CONFIG;
 var init_transport = __esm({
   "packages/agent-runtime/src/opencode/transport.ts"() {
     "use strict";
     serverTurnTails = /* @__PURE__ */ new Map();
+    SCRUBBED_MCP_CONFIG = {
+      type: "remote",
+      url: "http://127.0.0.1:9/cabane-removed",
+      enabled: false
+    };
   }
 });
 
@@ -4972,7 +5051,7 @@ var init_addendum3 = __esm({
 });
 
 // packages/agent-runtime/src/codex/events.ts
-function asRecord2(v) {
+function asRecord3(v) {
   return v && typeof v === "object" ? v : null;
 }
 function str(v) {
@@ -4982,7 +5061,7 @@ function readThreadId(ev) {
   return str(ev.thread_id);
 }
 function readItem(ev) {
-  return asRecord2(ev.item);
+  return asRecord3(ev.item);
 }
 function readItemText(item) {
   return str(item.text);
@@ -5053,7 +5132,7 @@ function readItemType(item) {
 function readErrorMessage(ev) {
   const direct = str(ev.message);
   if (direct) return direct;
-  const err = asRecord2(ev.error);
+  const err = asRecord3(ev.error);
   if (err) {
     const m = str(err.message);
     if (m) return m;
@@ -5061,7 +5140,7 @@ function readErrorMessage(ev) {
   return "unknown";
 }
 function readUsage(ev) {
-  const usage = asRecord2(ev.usage);
+  const usage = asRecord3(ev.usage);
   if (!usage) return void 0;
   const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
   return {
@@ -5085,7 +5164,7 @@ function toStatus(v) {
   return v === "completed" || v === "failed" ? v : "in_progress";
 }
 function readMcpResult(result) {
-  const rec2 = asRecord2(result);
+  const rec2 = asRecord3(result);
   if (!rec2) return result;
   if (hasOnlyNonTextContentBlocks(rec2.content)) return rec2.content;
   if (rec2.structured_content !== void 0 && rec2.structured_content !== null) {
@@ -5101,7 +5180,7 @@ function hasOnlyNonTextContentBlocks(content) {
   if (!Array.isArray(content) || content.length === 0) return false;
   let sawTypedBlock = false;
   for (const raw of content) {
-    const block = asRecord2(raw);
+    const block = asRecord3(raw);
     const type = block && str(block.type);
     if (!type) continue;
     sawTypedBlock = true;
@@ -5119,7 +5198,7 @@ function hasMcpReceipt(result) {
   return true;
 }
 function readMcpError(error) {
-  const rec2 = asRecord2(error);
+  const rec2 = asRecord3(error);
   return rec2 && str(rec2.message) || "error";
 }
 var init_events2 = __esm({
@@ -5427,7 +5506,8 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromp
     input: buildInput(req, promptRidesInput),
     promptRidesInput,
     promptFingerprint,
-    config: buildConfig(req, baseInstructionsFile)
+    config: buildConfig(req, baseInstructionsFile),
+    secretEnv: req.local.secretEnv && Object.keys(req.local.secretEnv).length > 0 ? req.local.secretEnv : null
   };
 }
 function buildInput(req, promptRidesInput) {
@@ -5443,9 +5523,11 @@ function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const fromEnv = server.headersFromEnv ?? {};
       mcp_servers[name] = {
         url: server.url,
         ...server.headers ? { http_headers: server.headers } : {},
+        ...Object.keys(fromEnv).length > 0 ? { env_http_headers: fromEnv } : {},
         default_tools_approval_mode: "approve"
       };
     } else if ("command" in server) {
@@ -5611,6 +5693,13 @@ function buildSdkThreadOptions(spec) {
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
+function codexProcessEnv(secretEnv) {
+  const inherited = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== void 0) inherited[key] = value;
+  }
+  return { ...inherited, ...secretEnv };
+}
 function createSdkCodexTransport(opts = {}) {
   return {
     async run(spec, signal) {
@@ -5627,7 +5716,8 @@ function createSdkCodexTransport(opts = {}) {
         // also what makes the PUBLISHED companion correct, where the vendored
         // patch never reached — and why that patch is gone. See
         // `config-overrides.ts`.
-        configOverrides: buildConfigOverrides(spec.config)
+        configOverrides: buildConfigOverrides(spec.config),
+        ...spec.secretEnv ? { env: codexProcessEnv(spec.secretEnv) } : {}
       };
       const codex = new Codex(codexOptions);
       const threadOptions = buildSdkThreadOptions(spec);
@@ -7324,8 +7414,14 @@ function requiredSecretNames(mcpServers) {
   }
   return [...names].sort();
 }
-function resolveMcpSecrets(mcpServers, store) {
+function resolveMcpSecrets(mcpServers, store, serverSecretEnv = {}) {
   const missing = /* @__PURE__ */ new Set();
+  const secretEnv = { ...serverSecretEnv };
+  let counter = 0;
+  for (const name of Object.keys(serverSecretEnv)) {
+    const n = SECRET_ENV_NAME.exec(name);
+    if (n) counter = Math.max(counter, Number(n[1]));
+  }
   const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
     const resolved = store.get(name);
     if (resolved === void 0) {
@@ -7343,10 +7439,25 @@ function resolveMcpSecrets(mcpServers, store) {
   for (const [name, server] of Object.entries(mcpServers)) {
     const next = { ...server };
     if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    if ("url" in next && next.headers) {
+      const headers = {};
+      const fromEnv = { ...next.headersFromEnv };
+      for (const [header, value] of Object.entries(next.headers)) {
+        if (!value.match(PLACEHOLDER_RE)) {
+          headers[header] = value;
+          continue;
+        }
+        const envName = `CABANE_MCP_${++counter}`;
+        secretEnv[envName] = interpolate(value);
+        fromEnv[header] = envName;
+      }
+      next.headers = headers;
+      if (Object.keys(headers).length === 0) delete next.headers;
+      if (Object.keys(fromEnv).length > 0) next.headersFromEnv = fromEnv;
+    }
     servers[name] = next;
   }
-  return { servers, missing: [...missing].sort() };
+  return { servers, secretEnv, missing: [...missing].sort() };
 }
 function missingSecretReason(missing) {
   const prefix = "missing_secret: ";
@@ -7358,7 +7469,7 @@ function missingSecretReason(missing) {
   }
   return `${prefix}+${missing.length}`;
 }
-var PLACEHOLDER_RE, secretStoreSchema, ERROR_REASON_MAX;
+var PLACEHOLDER_RE, secretStoreSchema, SECRET_ENV_NAME, ERROR_REASON_MAX;
 var init_secrets = __esm({
   "src/secrets.ts"() {
     "use strict";
@@ -7366,6 +7477,7 @@ var init_secrets = __esm({
     init_errors();
     PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
     secretStoreSchema = z14.record(z14.string(), z14.string());
+    SECRET_ENV_NAME = /^CABANE_MCP_(\d+)$/;
     ERROR_REASON_MAX = 200;
   }
 });
@@ -7393,12 +7505,20 @@ var init_run_config = __esm({
     mcpHttpServerSchema = z15.object({
       type: z15.literal("http"),
       url: z15.string().url(),
-      headers: z15.record(z15.string(), z15.string()).optional()
+      headers: z15.record(z15.string(), z15.string()).optional(),
+      // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+      // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+      // header whose `${VAR}` it resolved.
+      headersFromEnv: z15.record(z15.string(), z15.string()).optional()
     });
     mcpSseServerSchema = z15.object({
       type: z15.literal("sse"),
       url: z15.string().url(),
-      headers: z15.record(z15.string(), z15.string()).optional()
+      headers: z15.record(z15.string(), z15.string()).optional(),
+      // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+      // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+      // header whose `${VAR}` it resolved.
+      headersFromEnv: z15.record(z15.string(), z15.string()).optional()
     });
     mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
     thinkingConfigSchema = z15.discriminatedUnion("type", [
@@ -8280,6 +8400,7 @@ function buildCompanionTurnRequest(params) {
       // User MCP servers (already `${PLACEHOLDER}`-resolved). Structurally the
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
+      ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
       // CT289: the auto-memory escape hatch, when the operator set it.
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
@@ -8925,6 +9046,9 @@ var init_turn_execution = __esm({
       resumedSpoke = false;
       turnContext;
       resolvedMcpServers;
+      // CT1698: the harness's secret environment for this turn. Only ever handed
+      // to the adapter; never logged, never merged into `process.env`.
+      secretEnv = {};
       effectiveCwd;
       hookEnv;
       turnEnv;
@@ -9212,11 +9336,17 @@ var init_turn_execution = __esm({
         const secretStore = this.opts.secretStore ?? (fromLauncher ? await fromLauncher(requiredSecretNames(this.turnContext.mcpServers)) : null) ?? loadSecretStoreTolerant(
           (m) => turnLog.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
         );
-        const { servers: resolvedMcpServers, missing } = resolveMcpSecrets(
+        const {
+          servers: resolvedMcpServers,
+          secretEnv,
+          missing
+        } = resolveMcpSecrets(
           // CT262: the user MCP DEFINITIONS (placeholder form) come from the turn
-          // context now, not a separate `getAgentSelf` run-config fetch.
+          // context now, not a separate `getAgentSelf` run-config fetch. CT1698: and
+          // the room connections' entries, whose values arrive in `secretEnv`.
           this.turnContext.mcpServers ?? {},
-          secretStore
+          secretStore,
+          this.turnContext.secretEnv
         );
         if (missing.length > 0) {
           turnLog.debug({ missing }, "dispatcher: turn needs secrets not declared on this companion");
@@ -9224,6 +9354,7 @@ var init_turn_execution = __esm({
           throw this.concluded(reason, reason);
         }
         this.resolvedMcpServers = resolvedMcpServers;
+        this.secretEnv = secretEnv;
       }
       async prepareEnvironment() {
         const { payload, workspaceId, turnId, turnLog } = this;
@@ -9456,6 +9587,7 @@ var init_turn_execution = __esm({
           // CT1103: the prepare-hook env plus the authoritative host-access token.
           env: this.turnEnv,
           mcpServers: this.resolvedMcpServers,
+          secretEnv: this.secretEnv,
           turnControlServer,
           // CT238: this turn's conversation, forwarded as the active-conversation
           // header so a cross-thread post/spawn stamps its origin.

package/dist/runtime.js

@@ -3493,12 +3493,14 @@ var resolvedMcpServerSchema = z8.union([
   z8.object({
     type: z8.literal("http"),
     url: z8.string(),
-    headers: z8.record(z8.string(), z8.string()).optional()
+    headers: z8.record(z8.string(), z8.string()).optional(),
+    headersFromEnv: z8.record(z8.string(), z8.string()).optional()
   }),
   z8.object({
     type: z8.literal("sse"),
     url: z8.string(),
-    headers: z8.record(z8.string(), z8.string()).optional()
+    headers: z8.record(z8.string(), z8.string()).optional(),
+    headersFromEnv: z8.record(z8.string(), z8.string()).optional()
   })
 ]);
 var resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
@@ -3539,6 +3541,11 @@ var turnRequestSchema = z8.object({
     cwd: z8.string().optional(),
     env: z8.record(z8.string(), z8.string()).optional(),
     mcpServers: resolvedMcpServersSchema.optional(),
+    // CT1698: the values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` →
+    // complete header value). The adapter merges them into the harness
+    // process's environment and nowhere else; the host never merges them into
+    // its own. Absent when no server references one.
+    secretEnv: z8.record(z8.string(), z8.string()).optional(),
     // CT289: machine-local claude-code adapter knobs the operator sets on a
     // companion they run themselves — the auto-memory escape hatch. `autoMemory:
     // true` opts back into Claude Code's auto-memory (governed by the operator's
@@ -3989,6 +3996,24 @@ var CLAUDE_CODE_ADDENDUM = [
   "read/edit) keep their ordinary names and act on the local machine only."
 ].join(" ");
 
+// packages/agent-runtime/src/mcp-secret-env.ts
+function headersAsEnvReferences(server) {
+  const refs = Object.entries(server.headersFromEnv ?? {}).map(
+    ([header, envName]) => [header, `\${${envName}}`]
+  );
+  if (!server.headers && refs.length === 0) return void 0;
+  return { ...server.headers, ...Object.fromEntries(refs) };
+}
+function headersResolvedFrom(server, secretEnv) {
+  const resolved = {};
+  for (const [header, envName] of Object.entries(server.headersFromEnv ?? {})) {
+    const value = secretEnv?.[envName];
+    if (value !== void 0) resolved[header] = value;
+  }
+  if (!server.headers && Object.keys(resolved).length === 0) return void 0;
+  return { ...server.headers, ...resolved };
+}
+
 // packages/agent-runtime/src/claude-code/policy.ts
 import { z as z10 } from "zod";
 var HOST_FS_TOOLS = [
@@ -4122,8 +4147,18 @@ async function preToolUseHook(input) {
 function buildClaudeCodeOptions(req, augment) {
   const { policy, config } = req;
   const cwd = req.local.cwd;
+  const userServers = {};
+  for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
+    if ("url" in server) {
+      const { headersFromEnv: _refs, headers: _headers, ...rest } = server;
+      const headers = headersAsEnvReferences(server);
+      userServers[name] = { ...rest, ...headers ? { headers } : {} };
+    } else {
+      userServers[name] = server;
+    }
+  }
   const mcpServers = {
-    ...req.local.mcpServers ?? {},
+    ...userServers,
     ...req.extra.mcpServers
   };
   if (!(CABANE_MCP_SERVER in mcpServers)) {
@@ -4205,9 +4240,13 @@ function buildClaudeCodeOptions(req, augment) {
     // SDK's own doc on `Options.env`), which is why `process.env` is spread here
     // and why this key is now always present — previously it appeared only when
     // `req.local.env` was set, and an absent `env` inherits `process.env`.
+    //
+    // CT1698: `secretEnv` joins here, and only here — the values the MCP
+    // headers above reference. It is this child's environment, not the host's.
     env: {
       ...process.env,
       ...req.local.env,
+      ...req.local.secretEnv,
       CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"
     },
     ...resume ? { resume } : {}
@@ -5442,7 +5481,10 @@ function buildRunSpec(req, resumeSessionId) {
     // Fresh session → mint + send a client id; resumed → let opencode mint it.
     sendClientMessageId: resumeSessionId == null,
     ...dialect.agent ? { agent: dialect.agent } : {},
-    mcp: buildMcp(req)
+    mcp: buildMcp(req),
+    credentialServers: Object.entries(req.local.mcpServers ?? {}).filter(
+      ([, server]) => "url" in server && Object.keys(server.headersFromEnv ?? {}).length > 0
+    ).map(([name]) => name)
   };
 }
 function buildParts(req) {
@@ -5461,10 +5503,11 @@ function buildMcp(req) {
   const mcp = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const headers = headersResolvedFrom(server, req.local.secretEnv);
       mcp[name] = {
         type: "remote",
         url: server.url,
-        ...server.headers ? { headers: server.headers } : {},
+        ...headers ? { headers } : {},
         enabled: true
       };
     } else if ("command" in server) {
@@ -5643,24 +5686,53 @@ async function* releaseAfter(events, release) {
     release();
   }
 }
+var SCRUBBED_MCP_CONFIG = {
+  type: "remote",
+  url: "http://127.0.0.1:9/cabane-removed",
+  enabled: false
+};
 async function installMcp(doFetch, base, spec, signal) {
+  const [live, configured] = await Promise.all([
+    getJson(doFetch, `${base}/mcp`, signal),
+    getJson(doFetch, `${base}/config`, signal)
+  ]);
+  const operatorOwned = new Set(Object.keys(asRecord2(asRecord2(configured).mcp)));
+  const stale = Object.keys(asRecord2(live)).filter(
+    (name) => !(name in spec.mcp) && !operatorOwned.has(name)
+  );
+  await Promise.all(stale.map((name) => postMcp(doFetch, base, name, SCRUBBED_MCP_CONFIG, signal)));
+  const shadowing = (spec.credentialServers ?? []).filter((name) => operatorOwned.has(name));
+  if (shadowing.length > 0) {
+    throw new Error(
+      `opencode: ${shadowing.map((n) => `"${n}"`).join(", ")} would replace an MCP server this opencode instance configures itself; rename that server in the opencode config to use this connection here`
+    );
+  }
   await Promise.all(
-    Object.entries(spec.mcp).map(async ([name, config]) => {
-      const res = await doFetch(`${base}/mcp`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ name, config }),
-        signal
-      });
-      if (!res.ok) {
-        const detail = await res.text().catch(() => "");
-        throw new Error(
-          `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
-        );
-      }
-    })
+    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, base, name, config, signal))
   );
 }
+async function postMcp(doFetch, base, name, config, signal) {
+  const res = await doFetch(`${base}/mcp`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name, config }),
+    signal
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
+    );
+  }
+}
+async function getJson(doFetch, url, signal) {
+  const res = await doFetch(url, { signal });
+  if (!res.ok) throw new Error(`opencode: ${url} unavailable (HTTP ${res.status})`);
+  return res.json();
+}
+function asRecord2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
 async function* parseSseStream(body, sessionId, signal) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
@@ -6236,7 +6308,7 @@ var CODEX_ADDENDUM = [
 ].join(" ");
 
 // packages/agent-runtime/src/codex/events.ts
-function asRecord2(v) {
+function asRecord3(v) {
   return v && typeof v === "object" ? v : null;
 }
 function str(v) {
@@ -6246,7 +6318,7 @@ function readThreadId(ev) {
   return str(ev.thread_id);
 }
 function readItem(ev) {
-  return asRecord2(ev.item);
+  return asRecord3(ev.item);
 }
 function readItemText(item) {
   return str(item.text);
@@ -6317,7 +6389,7 @@ function readItemType(item) {
 function readErrorMessage(ev) {
   const direct = str(ev.message);
   if (direct) return direct;
-  const err = asRecord2(ev.error);
+  const err = asRecord3(ev.error);
   if (err) {
     const m = str(err.message);
     if (m) return m;
@@ -6325,7 +6397,7 @@ function readErrorMessage(ev) {
   return "unknown";
 }
 function readUsage(ev) {
-  const usage = asRecord2(ev.usage);
+  const usage = asRecord3(ev.usage);
   if (!usage) return void 0;
   const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
   return {
@@ -6349,7 +6421,7 @@ function toStatus(v) {
   return v === "completed" || v === "failed" ? v : "in_progress";
 }
 function readMcpResult(result) {
-  const rec = asRecord2(result);
+  const rec = asRecord3(result);
   if (!rec) return result;
   if (hasOnlyNonTextContentBlocks(rec.content)) return rec.content;
   if (rec.structured_content !== void 0 && rec.structured_content !== null) {
@@ -6365,7 +6437,7 @@ function hasOnlyNonTextContentBlocks(content) {
   if (!Array.isArray(content) || content.length === 0) return false;
   let sawTypedBlock = false;
   for (const raw of content) {
-    const block = asRecord2(raw);
+    const block = asRecord3(raw);
     const type = block && str(block.type);
     if (!type) continue;
     sawTypedBlock = true;
@@ -6383,7 +6455,7 @@ function hasMcpReceipt(result) {
   return true;
 }
 function readMcpError(error) {
-  const rec = asRecord2(error);
+  const rec = asRecord3(error);
   return rec && str(rec.message) || "error";
 }
 
@@ -6671,7 +6743,8 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromp
     input: buildInput(req, promptRidesInput),
     promptRidesInput,
     promptFingerprint,
-    config: buildConfig(req, baseInstructionsFile)
+    config: buildConfig(req, baseInstructionsFile),
+    secretEnv: req.local.secretEnv && Object.keys(req.local.secretEnv).length > 0 ? req.local.secretEnv : null
   };
 }
 function buildInput(req, promptRidesInput) {
@@ -6687,9 +6760,11 @@ function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const fromEnv = server.headersFromEnv ?? {};
       mcp_servers[name] = {
         url: server.url,
         ...server.headers ? { http_headers: server.headers } : {},
+        ...Object.keys(fromEnv).length > 0 ? { env_http_headers: fromEnv } : {},
         default_tools_approval_mode: "approve"
       };
     } else if ("command" in server) {
@@ -6831,6 +6906,13 @@ function buildSdkThreadOptions(spec) {
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
+function codexProcessEnv(secretEnv) {
+  const inherited = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== void 0) inherited[key] = value;
+  }
+  return { ...inherited, ...secretEnv };
+}
 function createSdkCodexTransport(opts = {}) {
   return {
     async run(spec, signal) {
@@ -6847,7 +6929,8 @@ function createSdkCodexTransport(opts = {}) {
         // also what makes the PUBLISHED companion correct, where the vendored
         // patch never reached — and why that patch is gone. See
         // `config-overrides.ts`.
-        configOverrides: buildConfigOverrides(spec.config)
+        configOverrides: buildConfigOverrides(spec.config),
+        ...spec.secretEnv ? { env: codexProcessEnv(spec.secretEnv) } : {}
       };
       const codex = new Codex(codexOptions);
       const threadOptions = buildSdkThreadOptions(spec);
@@ -8464,8 +8547,15 @@ function requiredSecretNames(mcpServers) {
   }
   return [...names].sort();
 }
-function resolveMcpSecrets(mcpServers, store) {
+var SECRET_ENV_NAME = /^CABANE_MCP_(\d+)$/;
+function resolveMcpSecrets(mcpServers, store, serverSecretEnv = {}) {
   const missing = /* @__PURE__ */ new Set();
+  const secretEnv = { ...serverSecretEnv };
+  let counter = 0;
+  for (const name of Object.keys(serverSecretEnv)) {
+    const n = SECRET_ENV_NAME.exec(name);
+    if (n) counter = Math.max(counter, Number(n[1]));
+  }
   const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
     const resolved = store.get(name);
     if (resolved === void 0) {
@@ -8483,10 +8573,25 @@ function resolveMcpSecrets(mcpServers, store) {
   for (const [name, server] of Object.entries(mcpServers)) {
     const next = { ...server };
     if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    if ("url" in next && next.headers) {
+      const headers = {};
+      const fromEnv = { ...next.headersFromEnv };
+      for (const [header, value] of Object.entries(next.headers)) {
+        if (!value.match(PLACEHOLDER_RE)) {
+          headers[header] = value;
+          continue;
+        }
+        const envName = `CABANE_MCP_${++counter}`;
+        secretEnv[envName] = interpolate(value);
+        fromEnv[header] = envName;
+      }
+      next.headers = headers;
+      if (Object.keys(headers).length === 0) delete next.headers;
+      if (Object.keys(fromEnv).length > 0) next.headersFromEnv = fromEnv;
+    }
     servers[name] = next;
   }
-  return { servers, missing: [...missing].sort() };
+  return { servers, secretEnv, missing: [...missing].sort() };
 }
 var ERROR_REASON_MAX = 200;
 function missingSecretReason(missing) {
@@ -8514,12 +8619,20 @@ var mcpStdioServerSchema = z15.object({
 var mcpHttpServerSchema = z15.object({
   type: z15.literal("http"),
   url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
+  headers: z15.record(z15.string(), z15.string()).optional(),
+  // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+  // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+  // header whose `${VAR}` it resolved.
+  headersFromEnv: z15.record(z15.string(), z15.string()).optional()
 });
 var mcpSseServerSchema = z15.object({
   type: z15.literal("sse"),
   url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
+  headers: z15.record(z15.string(), z15.string()).optional(),
+  // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+  // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+  // header whose `${VAR}` it resolved.
+  headersFromEnv: z15.record(z15.string(), z15.string()).optional()
 });
 var mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
 var thinkingConfigSchema = z15.discriminatedUnion("type", [
@@ -9355,6 +9468,7 @@ function buildCompanionTurnRequest(params) {
       // User MCP servers (already `${PLACEHOLDER}`-resolved). Structurally the
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
+      ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
       // CT289: the auto-memory escape hatch, when the operator set it.
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
@@ -9911,6 +10025,9 @@ var TurnExecution = class {
   resumedSpoke = false;
   turnContext;
   resolvedMcpServers;
+  // CT1698: the harness's secret environment for this turn. Only ever handed
+  // to the adapter; never logged, never merged into `process.env`.
+  secretEnv = {};
   effectiveCwd;
   hookEnv;
   turnEnv;
@@ -10198,11 +10315,17 @@ var TurnExecution = class {
     const secretStore = this.opts.secretStore ?? (fromLauncher ? await fromLauncher(requiredSecretNames(this.turnContext.mcpServers)) : null) ?? loadSecretStoreTolerant(
       (m) => turnLog.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
     );
-    const { servers: resolvedMcpServers, missing } = resolveMcpSecrets(
+    const {
+      servers: resolvedMcpServers,
+      secretEnv,
+      missing
+    } = resolveMcpSecrets(
       // CT262: the user MCP DEFINITIONS (placeholder form) come from the turn
-      // context now, not a separate `getAgentSelf` run-config fetch.
+      // context now, not a separate `getAgentSelf` run-config fetch. CT1698: and
+      // the room connections' entries, whose values arrive in `secretEnv`.
       this.turnContext.mcpServers ?? {},
-      secretStore
+      secretStore,
+      this.turnContext.secretEnv
     );
     if (missing.length > 0) {
       turnLog.debug({ missing }, "dispatcher: turn needs secrets not declared on this companion");
@@ -10210,6 +10333,7 @@ var TurnExecution = class {
       throw this.concluded(reason, reason);
     }
     this.resolvedMcpServers = resolvedMcpServers;
+    this.secretEnv = secretEnv;
   }
   async prepareEnvironment() {
     const { payload, workspaceId, turnId, turnLog } = this;
@@ -10442,6 +10566,7 @@ var TurnExecution = class {
       // CT1103: the prepare-hook env plus the authoritative host-access token.
       env: this.turnEnv,
       mcpServers: this.resolvedMcpServers,
+      secretEnv: this.secretEnv,
       turnControlServer,
       // CT238: this turn's conversation, forwarded as the active-conversation
       // header so a cross-thread post/spawn stamps its origin.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.134",
+  "version": "0.6.135",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",