@hiai-gg/hiai-opencode 0.1.0 → 0.1.1

package/src/features/skill-mcp-manager/connection.ts

@@ -1,146 +1,146 @@
-import type { ClaudeCodeMcpServer } from "../claude-code-mcp-loader/types"
-import { expandEnvVarsInObject } from "../claude-code-mcp-loader/env-expander"
-import { forceReconnect } from "./cleanup"
-import { getConnectionType } from "./connection-type"
-import { createHttpClient } from "./http-client"
-import { createStdioClient } from "./stdio-client"
-import type { McpClient, SkillMcpClientConnectionParams, SkillMcpClientInfo, SkillMcpManagerState } from "./types"
-
-function removeClientIfCurrent(state: SkillMcpManagerState, clientKey: string, client: McpClient): void {
-  const managed = state.clients.get(clientKey)
-  if (managed?.client === client) {
-    state.clients.delete(clientKey)
-  }
-}
-
-const PROJECT_SCOPES = new Set(["project", "opencode-project", "local"])
-
-export async function getOrCreateClient(params: {
-  state: SkillMcpManagerState
-  clientKey: string
-  info: SkillMcpClientInfo
-  config: ClaudeCodeMcpServer
-}): Promise<McpClient> {
-  const { state, clientKey, info, config } = params
-
-  if (state.disposed) {
-    throw new Error(`MCP manager for "${info.sessionID}" has been shut down, cannot create new connections.`)
-  }
-
-  const existing = state.clients.get(clientKey)
-  if (existing) {
-    existing.lastUsedAt = Date.now()
-    return existing.client
-  }
-
-  // Prevent race condition: if a connection is already in progress, wait for it
-  const pending = state.pendingConnections.get(clientKey)
-  if (pending) {
-    return pending
-  }
-
-  const isTrusted = !PROJECT_SCOPES.has(info.scope ?? "")
-  const expandedConfig = expandEnvVarsInObject(config, { trusted: isTrusted })
-  let currentConnectionPromise!: Promise<McpClient>
-  state.inFlightConnections.set(info.sessionID, (state.inFlightConnections.get(info.sessionID) ?? 0) + 1)
-  currentConnectionPromise = (async () => {
-    const disconnectGenAtStart = state.disconnectedSessions.get(info.sessionID) ?? 0
-    const shutdownGenAtStart = state.shutdownGeneration
-
-    const client = await createClient({ state, clientKey, info, config: expandedConfig })
-
-    const isStale = state.pendingConnections.has(clientKey) && state.pendingConnections.get(clientKey) !== currentConnectionPromise
-    if (isStale) {
-      removeClientIfCurrent(state, clientKey, client)
-      try { await client.close() } catch {}
-      throw new Error(`Connection for "${info.sessionID}" was superseded by a newer connection attempt.`)
-    }
-
-    if (state.shutdownGeneration !== shutdownGenAtStart) {
-      removeClientIfCurrent(state, clientKey, client)
-      try { await client.close() } catch {}
-      throw new Error(`Shutdown occurred during MCP connection for "${info.sessionID}"`)
-    }
-
-    const currentDisconnectGen = state.disconnectedSessions.get(info.sessionID) ?? 0
-    if (currentDisconnectGen > disconnectGenAtStart) {
-      await forceReconnect(state, clientKey)
-      throw new Error(`Session "${info.sessionID}" disconnected during MCP connection setup.`)
-    }
-
-    return client
-  })()
-
-  state.pendingConnections.set(clientKey, currentConnectionPromise)
-
-  try {
-    const client = await currentConnectionPromise
-    return client
-  } finally {
-    if (state.pendingConnections.get(clientKey) === currentConnectionPromise) {
-      state.pendingConnections.delete(clientKey)
-    }
-    const remaining = (state.inFlightConnections.get(info.sessionID) ?? 1) - 1
-    if (remaining <= 0) {
-      state.inFlightConnections.delete(info.sessionID)
-      state.disconnectedSessions.delete(info.sessionID)
-    } else {
-      state.inFlightConnections.set(info.sessionID, remaining)
-    }
-  }
-}
-
-export async function getOrCreateClientWithRetryImpl(params: {
-  state: SkillMcpManagerState
-  clientKey: string
-  info: SkillMcpClientInfo
-  config: ClaudeCodeMcpServer
-}): Promise<McpClient> {
-  const { state, clientKey } = params
-
-  try {
-    return await getOrCreateClient(params)
-  } catch (error) {
-    const didReconnect = await forceReconnect(state, clientKey)
-    if (!didReconnect) {
-      throw error
-    }
-    return await getOrCreateClient(params)
-  }
-}
-
-async function createClient(params: {
-  state: SkillMcpManagerState
-  clientKey: string
-  info: SkillMcpClientInfo
-  config: ClaudeCodeMcpServer
-}): Promise<McpClient> {
-  const { info, config } = params
-  const connectionType = getConnectionType(config)
-
-  if (!connectionType) {
-    throw new Error(
-      `MCP server "${info.serverName}" has no valid connection configuration.\n\n` +
-      `The MCP configuration in skill "${info.skillName}" must specify either:\n` +
-      `  - A URL for HTTP connection (remote MCP server)\n` +
-      `  - A command for stdio connection (local MCP process)\n\n` +
-      `Examples:\n` +
-      `  HTTP:\n` +
-      `    mcp:\n` +
-      `      ${info.serverName}:\n` +
-      `        url: https://mcp.example.com/mcp\n` +
-      `        headers:\n` +
-      "          Authorization: Bearer ${API_KEY}\n\n" +
-      `  Stdio:\n` +
-      `    mcp:\n` +
-      `      ${info.serverName}:\n` +
-      `        command: npx\n` +
-      `        args: [-y, @some/mcp-server]`
-    )
-  }
-
-  if (connectionType === "http") {
-    return await createHttpClient(params satisfies SkillMcpClientConnectionParams)
-  }
-  return await createStdioClient(params satisfies SkillMcpClientConnectionParams)
-}
+import type { ClaudeCodeMcpServer } from "../claude-code-mcp-loader/types"
+import { expandEnvVarsInObject } from "../claude-code-mcp-loader/env-expander"
+import { forceReconnect } from "./cleanup"
+import { getConnectionType } from "./connection-type"
+import { createHttpClient } from "./http-client"
+import { createStdioClient } from "./stdio-client"
+import type { McpClient, SkillMcpClientConnectionParams, SkillMcpClientInfo, SkillMcpManagerState } from "./types"
+
+function removeClientIfCurrent(state: SkillMcpManagerState, clientKey: string, client: McpClient): void {
+  const managed = state.clients.get(clientKey)
+  if (managed?.client === client) {
+    state.clients.delete(clientKey)
+  }
+}
+
+const PROJECT_SCOPES = new Set(["project", "opencode-project", "local"])
+
+export async function getOrCreateClient(params: {
+  state: SkillMcpManagerState
+  clientKey: string
+  info: SkillMcpClientInfo
+  config: ClaudeCodeMcpServer
+}): Promise<McpClient> {
+  const { state, clientKey, info, config } = params
+
+  if (state.disposed) {
+    throw new Error(`MCP manager for "${info.sessionID}" has been shut down, cannot create new connections.`)
+  }
+
+  const existing = state.clients.get(clientKey)
+  if (existing) {
+    existing.lastUsedAt = Date.now()
+    return existing.client
+  }
+
+  // Prevent race condition: if a connection is already in progress, wait for it
+  const pending = state.pendingConnections.get(clientKey)
+  if (pending) {
+    return pending
+  }
+
+  const isTrusted = !PROJECT_SCOPES.has(info.scope ?? "")
+  const expandedConfig = expandEnvVarsInObject(config, { trusted: isTrusted })
+  let currentConnectionPromise!: Promise<McpClient>
+  state.inFlightConnections.set(info.sessionID, (state.inFlightConnections.get(info.sessionID) ?? 0) + 1)
+  currentConnectionPromise = (async () => {
+    const disconnectGenAtStart = state.disconnectedSessions.get(info.sessionID) ?? 0
+    const shutdownGenAtStart = state.shutdownGeneration
+
+    const client = await createClient({ state, clientKey, info, config: expandedConfig })
+
+    const isStale = state.pendingConnections.has(clientKey) && state.pendingConnections.get(clientKey) !== currentConnectionPromise
+    if (isStale) {
+      removeClientIfCurrent(state, clientKey, client)
+      try { await client.close() } catch {}
+      throw new Error(`Connection for "${info.sessionID}" was superseded by a newer connection attempt.`)
+    }
+
+    if (state.shutdownGeneration !== shutdownGenAtStart) {
+      removeClientIfCurrent(state, clientKey, client)
+      try { await client.close() } catch {}
+      throw new Error(`Shutdown occurred during MCP connection for "${info.sessionID}"`)
+    }
+
+    const currentDisconnectGen = state.disconnectedSessions.get(info.sessionID) ?? 0
+    if (currentDisconnectGen > disconnectGenAtStart) {
+      await forceReconnect(state, clientKey)
+      throw new Error(`Session "${info.sessionID}" disconnected during MCP connection setup.`)
+    }
+
+    return client
+  })()
+
+  state.pendingConnections.set(clientKey, currentConnectionPromise)
+
+  try {
+    const client = await currentConnectionPromise
+    return client
+  } finally {
+    if (state.pendingConnections.get(clientKey) === currentConnectionPromise) {
+      state.pendingConnections.delete(clientKey)
+    }
+    const remaining = (state.inFlightConnections.get(info.sessionID) ?? 1) - 1
+    if (remaining <= 0) {
+      state.inFlightConnections.delete(info.sessionID)
+      state.disconnectedSessions.delete(info.sessionID)
+    } else {
+      state.inFlightConnections.set(info.sessionID, remaining)
+    }
+  }
+}
+
+export async function getOrCreateClientWithRetryImpl(params: {
+  state: SkillMcpManagerState
+  clientKey: string
+  info: SkillMcpClientInfo
+  config: ClaudeCodeMcpServer
+}): Promise<McpClient> {
+  const { state, clientKey } = params
+
+  try {
+    return await getOrCreateClient(params)
+  } catch (error) {
+    const didReconnect = await forceReconnect(state, clientKey)
+    if (!didReconnect) {
+      throw error
+    }
+    return await getOrCreateClient(params)
+  }
+}
+
+async function createClient(params: {
+  state: SkillMcpManagerState
+  clientKey: string
+  info: SkillMcpClientInfo
+  config: ClaudeCodeMcpServer
+}): Promise<McpClient> {
+  const { info, config } = params
+  const connectionType = getConnectionType(config)
+
+  if (!connectionType) {
+    throw new Error(
+      `MCP server "${info.serverName}" has no valid connection configuration.\n\n` +
+      `The MCP configuration in skill "${info.skillName}" must specify either:\n` +
+      `  - A URL for HTTP connection (remote MCP server)\n` +
+      `  - A command for stdio connection (local MCP process)\n\n` +
+      `Examples:\n` +
+      `  HTTP:\n` +
+      `    mcp:\n` +
+      `      ${info.serverName}:\n` +
+      `        url: https://mcp.example.com/mcp\n` +
+      `        headers:\n` +
+      "          Authorization: Bearer ${API_KEY}\n\n" +
+      `  Stdio:\n` +
+      `    mcp:\n` +
+      `      ${info.serverName}:\n` +
+      `        command: npx\n` +
+      `        args: [-y, @some/mcp-server]`
+    )
+  }
+
+  if (connectionType === "http") {
+    return await createHttpClient(params satisfies SkillMcpClientConnectionParams)
+  }
+  return await createStdioClient(params satisfies SkillMcpClientConnectionParams)
+}

package/src/features/skill-mcp-manager/env-cleaner.ts

@@ -1,59 +1,59 @@
-// Filters npm/pnpm/yarn config env vars that break MCP servers in pnpm projects (#456)
-// Also filters secret-containing env vars to prevent exposure to malicious stdio MCP servers (#B-02)
-export const EXCLUDED_ENV_PATTERNS: RegExp[] = [
-  // npm/pnpm/yarn config patterns (original)
-  /^NPM_CONFIG_/i,
-  /^npm_config_/,
-  /^YARN_/,
-  /^PNPM_/,
-  /^NO_UPDATE_NOTIFIER$/,
-
-  // Specific high-risk secret env vars (explicit blocks)
-  /^ANTHROPIC_API_KEY$/i,
-  /^AWS_ACCESS_KEY_ID$/i,
-  /^AWS_SECRET_ACCESS_KEY$/i,
-  /^GOOGLE_APPLICATION_CREDENTIALS$/i,
-  /^GOOGLE_CLOUD_PROJECT$/i,
-  /^GITHUB_TOKEN$/i,
-  /^DATABASE_URL$/i,
-  /^OPENAI_API_KEY$/i,
-  /^AZURE_/i,
-  /^GCP_/i,
-  /^FIREBASE_/i,
-  /^HEROKU_/i,
-  /^DOCKER_AUTH/i,
-  /^KUBECONFIG$/i,
-  /^VAULT_/i,
-
-  // Suffix-based patterns for common secret naming conventions
-  /_KEY$/i,
-  /_SECRET$/i,
-  /_TOKEN$/i,
-  /_PASSWORD$/i,
-  /_CREDENTIAL$/i,
-  /_CREDENTIALS$/i,
-  /_API_KEY$/i,
-]
-
-export function createCleanMcpEnvironment(
-  customEnv: Record<string, string> = {}
-): Record<string, string> {
-  const mergedEnv: Record<string, string> = {}
-
-  for (const [key, value] of Object.entries(process.env)) {
-    if (value === undefined) continue
-    mergedEnv[key] = value
-  }
-
-  Object.assign(mergedEnv, customEnv)
-
-  const cleanEnv: Record<string, string> = {}
-  for (const [key, value] of Object.entries(mergedEnv)) {
-    const shouldExclude = EXCLUDED_ENV_PATTERNS.some((pattern) => pattern.test(key))
-    if (!shouldExclude) {
-      cleanEnv[key] = value
-    }
-  }
-
-  return cleanEnv
-}
+// Filters npm/pnpm/yarn config env vars that break MCP servers in pnpm projects (#456)
+// Also filters secret-containing env vars to prevent exposure to malicious stdio MCP servers (#B-02)
+export const EXCLUDED_ENV_PATTERNS: RegExp[] = [
+  // npm/pnpm/yarn config patterns (original)
+  /^NPM_CONFIG_/i,
+  /^npm_config_/,
+  /^YARN_/,
+  /^PNPM_/,
+  /^NO_UPDATE_NOTIFIER$/,
+
+  // Specific high-risk secret env vars (explicit blocks)
+  /^ANTHROPIC_API_KEY$/i,
+  /^AWS_ACCESS_KEY_ID$/i,
+  /^AWS_SECRET_ACCESS_KEY$/i,
+  /^GOOGLE_APPLICATION_CREDENTIALS$/i,
+  /^GOOGLE_CLOUD_PROJECT$/i,
+  /^GITHUB_TOKEN$/i,
+  /^DATABASE_URL$/i,
+  /^OPENAI_API_KEY$/i,
+  /^AZURE_/i,
+  /^GCP_/i,
+  /^FIREBASE_/i,
+  /^HEROKU_/i,
+  /^DOCKER_AUTH/i,
+  /^KUBECONFIG$/i,
+  /^VAULT_/i,
+
+  // Suffix-based patterns for common secret naming conventions
+  /_KEY$/i,
+  /_SECRET$/i,
+  /_TOKEN$/i,
+  /_PASSWORD$/i,
+  /_CREDENTIAL$/i,
+  /_CREDENTIALS$/i,
+  /_API_KEY$/i,
+]
+
+export function createCleanMcpEnvironment(
+  customEnv: Record<string, string> = {}
+): Record<string, string> {
+  const mergedEnv: Record<string, string> = {}
+
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value === undefined) continue
+    mergedEnv[key] = value
+  }
+
+  Object.assign(mergedEnv, customEnv)
+
+  const cleanEnv: Record<string, string> = {}
+  for (const [key, value] of Object.entries(mergedEnv)) {
+    const shouldExclude = EXCLUDED_ENV_PATTERNS.some((pattern) => pattern.test(key))
+    if (!shouldExclude) {
+      cleanEnv[key] = value
+    }
+  }
+
+  return cleanEnv
+}

package/src/features/skill-mcp-manager/error-redaction.ts

@@ -1,47 +1,47 @@
-// Redacts sensitive tokens from error messages to prevent credential exposure
-// Follows same patterns as env-cleaner.ts for consistency
-
-const SENSITIVE_PATTERNS: RegExp[] = [
-  // API keys and tokens in common formats
-  /[a-zA-Z0-9_-]*(?:api[_-]?key|apikey)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:auth[_-]?token|authtoken)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:access[_-]?token|accesstoken)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:secret)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:password)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{8,})/gi,
-
-  // Bearer tokens
-  /bearer\s+([a-zA-Z0-9_-]{20,})/gi,
-
-  // Common token prefixes
-  /sk-[a-zA-Z0-9]{20,}/g, // OpenAI-style secret keys
-  /gh[pousr]_[a-zA-Z0-9]{20,}/gi, // GitHub tokens
-  /glpat-[a-zA-Z0-9_-]{20,}/gi, // GitLab tokens
-  /[A-Za-z0-9_]{20,}-[A-Za-z0-9_]{10,}-[A-Za-z0-9_]{10,}/g, // Common JWT-like patterns
-]
-
-const REDACTION_MARKER = "[REDACTED]"
-
-/**
- * Redacts sensitive tokens from a string.
- * Used for error messages that may contain command-line arguments or environment info.
- */
-export function redactSensitiveData(input: string): string {
-  let result = input
-
-  for (const pattern of SENSITIVE_PATTERNS) {
-    result = result.replace(pattern, REDACTION_MARKER)
-  }
-
-  return result
-}
-
-/**
- * Redacts sensitive data from an Error object, returning a new Error.
- * Preserves the stack trace but redacts the message.
- */
-export function redactErrorSensitiveData(error: Error): Error {
-  const redactedMessage = redactSensitiveData(error.message)
-  const redactedError = new Error(redactedMessage)
-  redactedError.stack = error.stack ? redactSensitiveData(error.stack) : undefined
-  return redactedError
-}
+// Redacts sensitive tokens from error messages to prevent credential exposure
+// Follows same patterns as env-cleaner.ts for consistency
+
+const SENSITIVE_PATTERNS: RegExp[] = [
+  // API keys and tokens in common formats
+  /[a-zA-Z0-9_-]*(?:api[_-]?key|apikey)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
+  /[a-zA-Z0-9_-]*(?:auth[_-]?token|authtoken)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
+  /[a-zA-Z0-9_-]*(?:access[_-]?token|accesstoken)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
+  /[a-zA-Z0-9_-]*(?:secret)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
+  /[a-zA-Z0-9_-]*(?:password)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{8,})/gi,
+
+  // Bearer tokens
+  /bearer\s+([a-zA-Z0-9_-]{20,})/gi,
+
+  // Common token prefixes
+  /sk-[a-zA-Z0-9]{20,}/g, // OpenAI-style secret keys
+  /gh[pousr]_[a-zA-Z0-9]{20,}/gi, // GitHub tokens
+  /glpat-[a-zA-Z0-9_-]{20,}/gi, // GitLab tokens
+  /[A-Za-z0-9_]{20,}-[A-Za-z0-9_]{10,}-[A-Za-z0-9_]{10,}/g, // Common JWT-like patterns
+]
+
+const REDACTION_MARKER = "[REDACTED]"
+
+/**
+ * Redacts sensitive tokens from a string.
+ * Used for error messages that may contain command-line arguments or environment info.
+ */
+export function redactSensitiveData(input: string): string {
+  let result = input
+
+  for (const pattern of SENSITIVE_PATTERNS) {
+    result = result.replace(pattern, REDACTION_MARKER)
+  }
+
+  return result
+}
+
+/**
+ * Redacts sensitive data from an Error object, returning a new Error.
+ * Preserves the stack trace but redacts the message.
+ */
+export function redactErrorSensitiveData(error: Error): Error {
+  const redactedMessage = redactSensitiveData(error.message)
+  const redactedError = new Error(redactedMessage)
+  redactedError.stack = error.stack ? redactSensitiveData(error.stack) : undefined
+  return redactedError
+}