@hiai-gg/hiai-opencode 0.1.1 → 0.1.2

package/src/features/hook-message-injector/types.ts

@@ -1,49 +1,49 @@
-export type ToolPermission = boolean | "allow" | "deny" | "ask"
-
-export interface MessageMeta {
-  id: string
-  sessionID: string
-  role: "user" | "assistant"
-  time: {
-    created: number
-    completed?: number
-  }
-  agent?: string
-  model?: {
-    providerID: string
-    modelID: string
-    variant?: string
-  }
-  path?: {
-    cwd: string
-    root: string
-  }
-  tools?: Record<string, ToolPermission>
-}
-
-export interface OriginalMessageContext {
-  agent?: string
-  model?: {
-    providerID?: string
-    modelID?: string
-    variant?: string
-  }
-  path?: {
-    cwd?: string
-    root?: string
-  }
-  tools?: Record<string, ToolPermission>
-}
-
-export interface TextPart {
-  id: string
-  type: "text"
-  text: string
-  synthetic: boolean
-  time: {
-    start: number
-    end: number
-  }
-  messageID: string
-  sessionID: string
-}
+export type ToolPermission = boolean | "allow" | "deny" | "ask"
+
+export interface MessageMeta {
+  id: string
+  sessionID: string
+  role: "user" | "assistant"
+  time: {
+    created: number
+    completed?: number
+  }
+  agent?: string
+  model?: {
+    providerID: string
+    modelID: string
+    variant?: string
+  }
+  path?: {
+    cwd: string
+    root: string
+  }
+  tools?: Record<string, ToolPermission>
+}
+
+export interface OriginalMessageContext {
+  agent?: string
+  model?: {
+    providerID?: string
+    modelID?: string
+    variant?: string
+  }
+  path?: {
+    cwd?: string
+    root?: string
+  }
+  tools?: Record<string, ToolPermission>
+}
+
+export interface TextPart {
+  id: string
+  type: "text"
+  text: string
+  synthetic: boolean
+  time: {
+    start: number
+    end: number
+  }
+  messageID: string
+  sessionID: string
+}

package/src/features/mcp-oauth/AGENTS.md

@@ -1,54 +1,54 @@
-# src/features/mcp-oauth/ — OAuth 2.0 + PKCE + DCR for MCP Servers
-
-**Generated:** 2026-04-11
-
-## OVERVIEW
-
-18 files. Full OAuth 2.0 authorization flow for MCP servers requiring authentication. Implements PKCE (RFC 7636), Dynamic Client Registration (DCR, RFC 7591), and resource indicators (RFC 8707). Used by `bunx oh-my-opencode mcp-oauth login`.
-
-## AUTHORIZATION FLOW
-
-```
-1. discovery.ts → fetch /.well-known/oauth-authorization-server
-2. dcr.ts → Dynamic Client Registration (if server supports it)
-3. oauth-authorization-flow.ts → generate PKCE verifier/challenge
-4. callback-server.ts → local HTTP server on random port for redirect
-5. Open browser → authorization URL
-6. callback-server.ts → receive code + state
-7. provider.ts → exchange code for token (with PKCE verifier)
-8. storage.ts → persist token to ~/.config/opencode/mcp-oauth/
-9. step-up.ts → handle step-up auth if initial token insufficient
-```
-
-## KEY FILES
-
-| File | Purpose |
-|------|---------|
-| `oauth-authorization-flow.ts` | PKCE helpers: `generateCodeVerifier()`, `generateCodeChallenge()`, `buildAuthorizationUrl()` |
-| `callback-server.ts` | Local HTTP redirect server — listens for OAuth callback |
-| `provider.ts` | `OAuthProvider` — token exchange, refresh, revoke |
-| `discovery.ts` | Fetch + parse OAuth server metadata from well-known endpoint |
-| `dcr.ts` | Dynamic Client Registration — register this app with OAuth server |
-| `resource-indicator.ts` | RFC 8707 resource indicator handling |
-| `step-up.ts` | Handle step-up authentication challenges |
-| `storage.ts` | Persist tokens to `~/.config/opencode/mcp-oauth/{server-hash}.json` |
-| `schema.ts` | Zod schemas for OAuth server metadata, token response, DCR |
-
-## PKCE IMPLEMENTATION
-
-- Code verifier: 32 random bytes → base64url (no padding)
-- Code challenge: SHA-256(verifier) → base64url
-- Method: `S256`
-
-## TOKEN STORAGE
-
-Location: `~/.config/opencode/mcp-oauth/` — one JSON file per MCP server (keyed by server URL hash).
-Fields: `access_token`, `refresh_token`, `expires_at`, `client_id`.
-
-## CLI COMMANDS
-
-```bash
-bunx oh-my-opencode mcp-oauth login <server-url>   # Full PKCE flow
-bunx oh-my-opencode mcp-oauth logout <server-url>  # Revoke + delete token
-bunx oh-my-opencode mcp-oauth status               # List stored tokens
-```
+# src/features/mcp-oauth/ — OAuth 2.0 + PKCE + DCR for MCP Servers
+
+**Generated:** 2026-04-11
+
+## OVERVIEW
+
+18 files. Full OAuth 2.0 authorization flow for MCP servers requiring authentication. Implements PKCE (RFC 7636), Dynamic Client Registration (DCR, RFC 7591), and resource indicators (RFC 8707). Used by `bunx oh-my-opencode mcp-oauth login`.
+
+## AUTHORIZATION FLOW
+
+```
+1. discovery.ts → fetch /.well-known/oauth-authorization-server
+2. dcr.ts → Dynamic Client Registration (if server supports it)
+3. oauth-authorization-flow.ts → generate PKCE verifier/challenge
+4. callback-server.ts → local HTTP server on random port for redirect
+5. Open browser → authorization URL
+6. callback-server.ts → receive code + state
+7. provider.ts → exchange code for token (with PKCE verifier)
+8. storage.ts → persist token to ~/.config/opencode/mcp-oauth/
+9. step-up.ts → handle step-up auth if initial token insufficient
+```
+
+## KEY FILES
+
+| File | Purpose |
+|------|---------|
+| `oauth-authorization-flow.ts` | PKCE helpers: `generateCodeVerifier()`, `generateCodeChallenge()`, `buildAuthorizationUrl()` |
+| `callback-server.ts` | Local HTTP redirect server — listens for OAuth callback |
+| `provider.ts` | `OAuthProvider` — token exchange, refresh, revoke |
+| `discovery.ts` | Fetch + parse OAuth server metadata from well-known endpoint |
+| `dcr.ts` | Dynamic Client Registration — register this app with OAuth server |
+| `resource-indicator.ts` | RFC 8707 resource indicator handling |
+| `step-up.ts` | Handle step-up authentication challenges |
+| `storage.ts` | Persist tokens to `~/.config/opencode/mcp-oauth/{server-hash}.json` |
+| `schema.ts` | Zod schemas for OAuth server metadata, token response, DCR |
+
+## PKCE IMPLEMENTATION
+
+- Code verifier: 32 random bytes → base64url (no padding)
+- Code challenge: SHA-256(verifier) → base64url
+- Method: `S256`
+
+## TOKEN STORAGE
+
+Location: `~/.config/opencode/mcp-oauth/` — one JSON file per MCP server (keyed by server URL hash).
+Fields: `access_token`, `refresh_token`, `expires_at`, `client_id`.
+
+## CLI COMMANDS
+
+```bash
+bunx oh-my-opencode mcp-oauth login <server-url>   # Full PKCE flow
+bunx oh-my-opencode mcp-oauth logout <server-url>  # Revoke + delete token
+bunx oh-my-opencode mcp-oauth status               # List stored tokens
+```

package/src/features/mcp-oauth/callback-server.ts

@@ -1,106 +1,106 @@
-import { findAvailablePort as findAvailablePortShared } from "../../shared/port-utils"
-
-const DEFAULT_PORT = 19877
-const TIMEOUT_MS = 5 * 60 * 1000
-
-export type OAuthCallbackResult = {
-  code: string
-  state: string
-}
-
-export type CallbackServer = {
-  port: number
-  waitForCallback: () => Promise<OAuthCallbackResult>
-  close: () => void
-}
-
-const SUCCESS_HTML = `<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>OAuth Authorized</title>
-  <style>
-    body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #0a0a0a; color: #fafafa; }
-    .container { text-align: center; }
-    h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
-    p { color: #888; }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>Authorization successful</h1>
-    <p>You can close this window and return to your terminal.</p>
-  </div>
-</body>
-</html>`
-
-export async function findAvailablePort(startPort: number = DEFAULT_PORT): Promise<number> {
-  return findAvailablePortShared(startPort)
-}
-
-export async function startCallbackServer(startPort: number = DEFAULT_PORT): Promise<CallbackServer> {
-  const requestedPort = await findAvailablePort(startPort).catch(() => 0)
-
-  let resolveCallback: ((result: OAuthCallbackResult) => void) | null = null
-  let rejectCallback: ((error: Error) => void) | null = null
-
-  const callbackPromise = new Promise<OAuthCallbackResult>((resolve, reject) => {
-    resolveCallback = resolve
-    rejectCallback = reject
-  })
-
-  const timeoutId = setTimeout(() => {
-    rejectCallback?.(new Error("OAuth callback timed out after 5 minutes"))
-    server.stop(true)
-  }, TIMEOUT_MS)
-
-  const server = Bun.serve({
-    port: requestedPort,
-    hostname: "127.0.0.1",
-    fetch(request: Request): Response {
-      const url = new URL(request.url)
-
-      if (url.pathname !== "/oauth/callback") {
-        return new Response("Not Found", { status: 404 })
-      }
-
-      const oauthError = url.searchParams.get("error")
-      if (oauthError) {
-        const description = url.searchParams.get("error_description") ?? oauthError
-        clearTimeout(timeoutId)
-        rejectCallback?.(new Error(`OAuth authorization failed: ${description}`))
-        setTimeout(() => server.stop(true), 100)
-        return new Response(`Authorization failed: ${description}`, { status: 400 })
-      }
-
-      const code = url.searchParams.get("code")
-      const state = url.searchParams.get("state")
-
-      if (!code || !state) {
-        clearTimeout(timeoutId)
-        rejectCallback?.(new Error("OAuth callback missing code or state parameter"))
-        setTimeout(() => server.stop(true), 100)
-        return new Response("Missing code or state parameter", { status: 400 })
-      }
-
-      resolveCallback?.({ code, state })
-      clearTimeout(timeoutId)
-
-      setTimeout(() => server.stop(true), 100)
-
-      return new Response(SUCCESS_HTML, {
-        headers: { "content-type": "text/html; charset=utf-8" },
-      })
-    },
-  })
-  const activePort = server.port ?? requestedPort
-
-  return {
-    port: activePort,
-    waitForCallback: () => callbackPromise,
-    close: () => {
-      clearTimeout(timeoutId)
-      server.stop(true)
-    },
-  }
-}
+import { findAvailablePort as findAvailablePortShared } from "../../shared/port-utils"
+
+const DEFAULT_PORT = 19877
+const TIMEOUT_MS = 5 * 60 * 1000
+
+export type OAuthCallbackResult = {
+  code: string
+  state: string
+}
+
+export type CallbackServer = {
+  port: number
+  waitForCallback: () => Promise<OAuthCallbackResult>
+  close: () => void
+}
+
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>OAuth Authorized</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #0a0a0a; color: #fafafa; }
+    .container { text-align: center; }
+    h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
+    p { color: #888; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization successful</h1>
+    <p>You can close this window and return to your terminal.</p>
+  </div>
+</body>
+</html>`
+
+export async function findAvailablePort(startPort: number = DEFAULT_PORT): Promise<number> {
+  return findAvailablePortShared(startPort)
+}
+
+export async function startCallbackServer(startPort: number = DEFAULT_PORT): Promise<CallbackServer> {
+  const requestedPort = await findAvailablePort(startPort).catch(() => 0)
+
+  let resolveCallback: ((result: OAuthCallbackResult) => void) | null = null
+  let rejectCallback: ((error: Error) => void) | null = null
+
+  const callbackPromise = new Promise<OAuthCallbackResult>((resolve, reject) => {
+    resolveCallback = resolve
+    rejectCallback = reject
+  })
+
+  const timeoutId = setTimeout(() => {
+    rejectCallback?.(new Error("OAuth callback timed out after 5 minutes"))
+    server.stop(true)
+  }, TIMEOUT_MS)
+
+  const server = Bun.serve({
+    port: requestedPort,
+    hostname: "127.0.0.1",
+    fetch(request: Request): Response {
+      const url = new URL(request.url)
+
+      if (url.pathname !== "/oauth/callback") {
+        return new Response("Not Found", { status: 404 })
+      }
+
+      const oauthError = url.searchParams.get("error")
+      if (oauthError) {
+        const description = url.searchParams.get("error_description") ?? oauthError
+        clearTimeout(timeoutId)
+        rejectCallback?.(new Error(`OAuth authorization failed: ${description}`))
+        setTimeout(() => server.stop(true), 100)
+        return new Response(`Authorization failed: ${description}`, { status: 400 })
+      }
+
+      const code = url.searchParams.get("code")
+      const state = url.searchParams.get("state")
+
+      if (!code || !state) {
+        clearTimeout(timeoutId)
+        rejectCallback?.(new Error("OAuth callback missing code or state parameter"))
+        setTimeout(() => server.stop(true), 100)
+        return new Response("Missing code or state parameter", { status: 400 })
+      }
+
+      resolveCallback?.({ code, state })
+      clearTimeout(timeoutId)
+
+      setTimeout(() => server.stop(true), 100)
+
+      return new Response(SUCCESS_HTML, {
+        headers: { "content-type": "text/html; charset=utf-8" },
+      })
+    },
+  })
+  const activePort = server.port ?? requestedPort
+
+  return {
+    port: activePort,
+    waitForCallback: () => callbackPromise,
+    close: () => {
+      clearTimeout(timeoutId)
+      server.stop(true)
+    },
+  }
+}

package/src/features/mcp-oauth/dcr.ts

@@ -1,98 +1,98 @@
-export type ClientRegistrationRequest = {
-  redirect_uris: string[]
-  client_name: string
-  grant_types: ["authorization_code", "refresh_token"]
-  response_types: ["code"]
-  token_endpoint_auth_method: "none" | "client_secret_post"
-}
-
-export type ClientCredentials = {
-  clientId: string
-  clientSecret?: string
-}
-
-export type ClientRegistrationStorage = {
-  getClientRegistration: (serverIdentifier: string) => ClientCredentials | null
-  setClientRegistration: (
-    serverIdentifier: string,
-    credentials: ClientCredentials
-  ) => void
-}
-
-export type DynamicClientRegistrationOptions = {
-  registrationEndpoint?: string | null
-  serverIdentifier?: string
-  clientName: string
-  redirectUris: string[]
-  tokenEndpointAuthMethod: "none" | "client_secret_post"
-  clientId?: string | null
-  storage: ClientRegistrationStorage
-  fetch?: DcrFetch
-}
-
-export type DcrFetch = (
-  input: string,
-  init?: { method?: string; headers?: Record<string, string>; body?: string }
-) => Promise<{ ok: boolean; json: () => Promise<unknown> }>
-
-export async function getOrRegisterClient(
-  options: DynamicClientRegistrationOptions
-): Promise<ClientCredentials | null> {
-  const serverIdentifier =
-    options.serverIdentifier ?? options.registrationEndpoint ?? "default"
-  const existing = options.storage.getClientRegistration(serverIdentifier)
-  if (existing) return existing
-
-  if (!options.registrationEndpoint) {
-    return options.clientId ? { clientId: options.clientId } : null
-  }
-
-  const fetchImpl = options.fetch ?? globalThis.fetch
-  const request: ClientRegistrationRequest = {
-    redirect_uris: options.redirectUris,
-    client_name: options.clientName,
-    grant_types: ["authorization_code", "refresh_token"],
-    response_types: ["code"],
-    token_endpoint_auth_method: options.tokenEndpointAuthMethod,
-  }
-
-  try {
-    const response = await fetchImpl(options.registrationEndpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(request),
-    })
-
-    if (!response.ok) {
-      return options.clientId ? { clientId: options.clientId } : null
-    }
-
-    const data: unknown = await response.json()
-    const parsed = parseRegistrationResponse(data)
-    if (!parsed) {
-      return options.clientId ? { clientId: options.clientId } : null
-    }
-
-    options.storage.setClientRegistration(serverIdentifier, parsed)
-    return parsed
-  } catch {
-    return options.clientId ? { clientId: options.clientId } : null
-  }
-}
-
-function parseRegistrationResponse(data: unknown): ClientCredentials | null {
-  if (!isRecord(data)) return null
-  const clientId = data.client_id
-  if (typeof clientId !== "string" || clientId.length === 0) return null
-
-  const clientSecret = data.client_secret
-  if (typeof clientSecret === "string" && clientSecret.length > 0) {
-    return { clientId, clientSecret }
-  }
-
-  return { clientId }
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null
-}
+export type ClientRegistrationRequest = {
+  redirect_uris: string[]
+  client_name: string
+  grant_types: ["authorization_code", "refresh_token"]
+  response_types: ["code"]
+  token_endpoint_auth_method: "none" | "client_secret_post"
+}
+
+export type ClientCredentials = {
+  clientId: string
+  clientSecret?: string
+}
+
+export type ClientRegistrationStorage = {
+  getClientRegistration: (serverIdentifier: string) => ClientCredentials | null
+  setClientRegistration: (
+    serverIdentifier: string,
+    credentials: ClientCredentials
+  ) => void
+}
+
+export type DynamicClientRegistrationOptions = {
+  registrationEndpoint?: string | null
+  serverIdentifier?: string
+  clientName: string
+  redirectUris: string[]
+  tokenEndpointAuthMethod: "none" | "client_secret_post"
+  clientId?: string | null
+  storage: ClientRegistrationStorage
+  fetch?: DcrFetch
+}
+
+export type DcrFetch = (
+  input: string,
+  init?: { method?: string; headers?: Record<string, string>; body?: string }
+) => Promise<{ ok: boolean; json: () => Promise<unknown> }>
+
+export async function getOrRegisterClient(
+  options: DynamicClientRegistrationOptions
+): Promise<ClientCredentials | null> {
+  const serverIdentifier =
+    options.serverIdentifier ?? options.registrationEndpoint ?? "default"
+  const existing = options.storage.getClientRegistration(serverIdentifier)
+  if (existing) return existing
+
+  if (!options.registrationEndpoint) {
+    return options.clientId ? { clientId: options.clientId } : null
+  }
+
+  const fetchImpl = options.fetch ?? globalThis.fetch
+  const request: ClientRegistrationRequest = {
+    redirect_uris: options.redirectUris,
+    client_name: options.clientName,
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: options.tokenEndpointAuthMethod,
+  }
+
+  try {
+    const response = await fetchImpl(options.registrationEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(request),
+    })
+
+    if (!response.ok) {
+      return options.clientId ? { clientId: options.clientId } : null
+    }
+
+    const data: unknown = await response.json()
+    const parsed = parseRegistrationResponse(data)
+    if (!parsed) {
+      return options.clientId ? { clientId: options.clientId } : null
+    }
+
+    options.storage.setClientRegistration(serverIdentifier, parsed)
+    return parsed
+  } catch {
+    return options.clientId ? { clientId: options.clientId } : null
+  }
+}
+
+function parseRegistrationResponse(data: unknown): ClientCredentials | null {
+  if (!isRecord(data)) return null
+  const clientId = data.client_id
+  if (typeof clientId !== "string" || clientId.length === 0) return null
+
+  const clientSecret = data.client_secret
+  if (typeof clientSecret === "string" && clientSecret.length > 0) {
+    return { clientId, clientSecret }
+  }
+
+  return { clientId }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}