@hiai-gg/hiai-opencode 0.1.7 → 0.1.8

package/src/features/mcp-oauth/dcr.ts

@@ -1,98 +0,0 @@
-export type ClientRegistrationRequest = {
-  redirect_uris: string[]
-  client_name: string
-  grant_types: ["authorization_code", "refresh_token"]
-  response_types: ["code"]
-  token_endpoint_auth_method: "none" | "client_secret_post"
-}
-
-export type ClientCredentials = {
-  clientId: string
-  clientSecret?: string
-}
-
-export type ClientRegistrationStorage = {
-  getClientRegistration: (serverIdentifier: string) => ClientCredentials | null
-  setClientRegistration: (
-    serverIdentifier: string,
-    credentials: ClientCredentials
-  ) => void
-}
-
-export type DynamicClientRegistrationOptions = {
-  registrationEndpoint?: string | null
-  serverIdentifier?: string
-  clientName: string
-  redirectUris: string[]
-  tokenEndpointAuthMethod: "none" | "client_secret_post"
-  clientId?: string | null
-  storage: ClientRegistrationStorage
-  fetch?: DcrFetch
-}
-
-export type DcrFetch = (
-  input: string,
-  init?: { method?: string; headers?: Record<string, string>; body?: string }
-) => Promise<{ ok: boolean; json: () => Promise<unknown> }>
-
-export async function getOrRegisterClient(
-  options: DynamicClientRegistrationOptions
-): Promise<ClientCredentials | null> {
-  const serverIdentifier =
-    options.serverIdentifier ?? options.registrationEndpoint ?? "default"
-  const existing = options.storage.getClientRegistration(serverIdentifier)
-  if (existing) return existing
-
-  if (!options.registrationEndpoint) {
-    return options.clientId ? { clientId: options.clientId } : null
-  }
-
-  const fetchImpl = options.fetch ?? globalThis.fetch
-  const request: ClientRegistrationRequest = {
-    redirect_uris: options.redirectUris,
-    client_name: options.clientName,
-    grant_types: ["authorization_code", "refresh_token"],
-    response_types: ["code"],
-    token_endpoint_auth_method: options.tokenEndpointAuthMethod,
-  }
-
-  try {
-    const response = await fetchImpl(options.registrationEndpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(request),
-    })
-
-    if (!response.ok) {
-      return options.clientId ? { clientId: options.clientId } : null
-    }
-
-    const data: unknown = await response.json()
-    const parsed = parseRegistrationResponse(data)
-    if (!parsed) {
-      return options.clientId ? { clientId: options.clientId } : null
-    }
-
-    options.storage.setClientRegistration(serverIdentifier, parsed)
-    return parsed
-  } catch {
-    return options.clientId ? { clientId: options.clientId } : null
-  }
-}
-
-function parseRegistrationResponse(data: unknown): ClientCredentials | null {
-  if (!isRecord(data)) return null
-  const clientId = data.client_id
-  if (typeof clientId !== "string" || clientId.length === 0) return null
-
-  const clientSecret = data.client_secret
-  if (typeof clientSecret === "string" && clientSecret.length > 0) {
-    return { clientId, clientSecret }
-  }
-
-  return { clientId }
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null
-}

package/src/features/mcp-oauth/discovery.ts

@@ -1,134 +0,0 @@
-export interface OAuthServerMetadata {
-  authorizationEndpoint: string
-  tokenEndpoint: string
-  registrationEndpoint?: string
-  resource: string
-}
-
-const discoveryCache = new Map<string, OAuthServerMetadata>()
-const pendingDiscovery = new Map<string, Promise<OAuthServerMetadata>>()
-
-function parseHttpsUrl(value: string, label: string): URL {
-  const parsed = new URL(value)
-  if (parsed.protocol !== "https:") {
-    throw new Error(`${label} must use https`)
-  }
-  return parsed
-}
-
-function readStringField(source: Record<string, unknown>, field: string): string {
-  const value = source[field]
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error(`OAuth metadata missing ${field}`)
-  }
-  return value
-}
-
-async function fetchMetadata(url: string): Promise<{ ok: true; json: Record<string, unknown> } | { ok: false; status: number }> {
-  const response = await fetch(url, { headers: { accept: "application/json" } })
-  if (!response.ok) {
-    return { ok: false, status: response.status }
-  }
-  const json = (await response.json().catch(() => null)) as Record<string, unknown> | null
-  if (!json || typeof json !== "object") {
-    throw new Error("OAuth metadata response is not valid JSON")
-  }
-  return { ok: true, json }
-}
-
-function parseMetadataFields(json: Record<string, unknown>, resource: string): OAuthServerMetadata {
-  const authorizationEndpoint = parseHttpsUrl(
-    readStringField(json, "authorization_endpoint"),
-    "authorization_endpoint"
-  ).toString()
-  const tokenEndpoint = parseHttpsUrl(
-    readStringField(json, "token_endpoint"),
-    "token_endpoint"
-  ).toString()
-  const registrationEndpointValue = json.registration_endpoint
-  const registrationEndpoint =
-    typeof registrationEndpointValue === "string" && registrationEndpointValue.length > 0
-      ? parseHttpsUrl(registrationEndpointValue, "registration_endpoint").toString()
-      : undefined
-
-  return {
-    authorizationEndpoint,
-    tokenEndpoint,
-    registrationEndpoint,
-    resource,
-  }
-}
-
-async function fetchAuthorizationServerMetadata(issuer: string, resource: string): Promise<OAuthServerMetadata> {
-  const issuerUrl = parseHttpsUrl(issuer, "Authorization server URL")
-  const issuerPath = issuerUrl.pathname.replace(/\/+$/, "")
-  const metadataUrl = new URL(`/.well-known/oauth-authorization-server${issuerPath}`, issuerUrl).toString()
-  const metadata = await fetchMetadata(metadataUrl)
-
-  if (!metadata.ok) {
-    if (metadata.status === 404 && issuerPath !== "") {
-      const rootMetadataUrl = new URL("/.well-known/oauth-authorization-server", issuerUrl).toString()
-      const rootMetadata = await fetchMetadata(rootMetadataUrl)
-      if (rootMetadata.ok) {
-        return parseMetadataFields(rootMetadata.json, resource)
-      }
-    }
-    if (metadata.status === 404) {
-      throw new Error("OAuth authorization server metadata not found")
-    }
-    throw new Error(`OAuth authorization server metadata fetch failed (${metadata.status})`)
-  }
-
-  return parseMetadataFields(metadata.json, resource)
-}
-
-function parseAuthorizationServers(metadata: Record<string, unknown>): string[] {
-  const servers = metadata.authorization_servers
-  if (!Array.isArray(servers)) return []
-  return servers.filter((server): server is string => typeof server === "string" && server.length > 0)
-}
-
-export async function discoverOAuthServerMetadata(resource: string): Promise<OAuthServerMetadata> {
-  const resourceUrl = parseHttpsUrl(resource, "Resource server URL")
-  const resourceKey = resourceUrl.toString()
-
-  const cached = discoveryCache.get(resourceKey)
-  if (cached) return cached
-
-  const pending = pendingDiscovery.get(resourceKey)
-  if (pending) return pending
-
-  const discoveryPromise = (async () => {
-    const prmUrl = new URL("/.well-known/oauth-protected-resource", resourceUrl).toString()
-    const prmResponse = await fetchMetadata(prmUrl)
-
-    if (prmResponse.ok) {
-      const authServers = parseAuthorizationServers(prmResponse.json)
-      if (authServers.length === 0) {
-        throw new Error("OAuth protected resource metadata missing authorization_servers")
-      }
-      return fetchAuthorizationServerMetadata(authServers[0], resource)
-    }
-
-    if (prmResponse.status !== 404) {
-      throw new Error(`OAuth protected resource metadata fetch failed (${prmResponse.status})`)
-    }
-
-    return fetchAuthorizationServerMetadata(resourceKey, resource)
-  })()
-
-  pendingDiscovery.set(resourceKey, discoveryPromise)
-
-  try {
-    const result = await discoveryPromise
-    discoveryCache.set(resourceKey, result)
-    return result
-  } finally {
-    pendingDiscovery.delete(resourceKey)
-  }
-}
-
-export function resetDiscoveryCache(): void {
-  discoveryCache.clear()
-  pendingDiscovery.clear()
-}

package/src/features/mcp-oauth/oauth-authorization-flow.ts

@@ -1,150 +0,0 @@
-import { spawn } from "node:child_process"
-import { createHash, randomBytes } from "node:crypto"
-import { createServer } from "node:http"
-
-export type OAuthCallbackResult = {
-  code: string
-  state: string
-}
-
-export function generateCodeVerifier(): string {
-  return randomBytes(32).toString("base64url")
-}
-
-export function generateCodeChallenge(verifier: string): string {
-  return createHash("sha256").update(verifier).digest("base64url")
-}
-
-export function buildAuthorizationUrl(
-  authorizationEndpoint: string,
-  options: {
-    clientId: string
-    redirectUri: string
-    codeChallenge: string
-    state: string
-    scopes?: string[]
-    resource?: string
-  }
-): string {
-  const url = new URL(authorizationEndpoint)
-  url.searchParams.set("response_type", "code")
-  url.searchParams.set("client_id", options.clientId)
-  url.searchParams.set("redirect_uri", options.redirectUri)
-  url.searchParams.set("code_challenge", options.codeChallenge)
-  url.searchParams.set("code_challenge_method", "S256")
-  url.searchParams.set("state", options.state)
-  if (options.scopes && options.scopes.length > 0) {
-    url.searchParams.set("scope", options.scopes.join(" "))
-  }
-  if (options.resource) {
-    url.searchParams.set("resource", options.resource)
-  }
-  return url.toString()
-}
-
-const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000
-
-export function startCallbackServer(port: number): Promise<OAuthCallbackResult> {
-  return new Promise((resolve, reject) => {
-    let timeoutId: ReturnType<typeof setTimeout>
-
-    const server = createServer((request, response) => {
-      clearTimeout(timeoutId)
-
-      const requestUrl = new URL(request.url ?? "/", `http://localhost:${port}`)
-      const code = requestUrl.searchParams.get("code")
-      const state = requestUrl.searchParams.get("state")
-      const error = requestUrl.searchParams.get("error")
-
-      if (error) {
-        const errorDescription = requestUrl.searchParams.get("error_description") ?? error
-        response.writeHead(400, { "content-type": "text/html" })
-        response.end("<html><body><h1>Authorization failed</h1></body></html>")
-        server.close()
-        reject(new Error(`OAuth authorization error: ${errorDescription}`))
-        return
-      }
-
-      if (!code || !state) {
-        response.writeHead(400, { "content-type": "text/html" })
-        response.end("<html><body><h1>Missing code or state</h1></body></html>")
-        server.close()
-        reject(new Error("OAuth callback missing code or state parameter"))
-        return
-      }
-
-      response.writeHead(200, { "content-type": "text/html" })
-      response.end("<html><body><h1>Authorization successful. You can close this tab.</h1></body></html>")
-      server.close()
-      resolve({ code, state })
-    })
-
-    timeoutId = setTimeout(() => {
-      server.close()
-      reject(new Error("OAuth callback timed out after 5 minutes"))
-    }, CALLBACK_TIMEOUT_MS)
-
-    server.listen(port, "127.0.0.1")
-    server.on("error", (err) => {
-      clearTimeout(timeoutId)
-      reject(err)
-    })
-  })
-}
-
-function openBrowser(url: string): void {
-  const platform = process.platform
-  let command: string
-  let args: string[]
-
-  if (platform === "darwin") {
-    command = "open"
-    args = [url]
-  } else if (platform === "win32") {
-    command = "explorer"
-    args = [url]
-  } else {
-    command = "xdg-open"
-    args = [url]
-  }
-
-  try {
-    const child = spawn(command, args, { stdio: "ignore", detached: true })
-    child.on("error", () => {})
-    child.unref()
-  } catch {
-    // Browser open failed - user must navigate manually
-  }
-}
-
-export async function runAuthorizationCodeRedirect(options: {
-  authorizationEndpoint: string
-  callbackPort: number
-  clientId: string
-  redirectUri: string
-  scopes?: string[]
-  resource?: string
-}): Promise<{ code: string; verifier: string }> {
-  const verifier = generateCodeVerifier()
-  const challenge = generateCodeChallenge(verifier)
-  const state = randomBytes(16).toString("hex")
-
-  const authorizationUrl = buildAuthorizationUrl(options.authorizationEndpoint, {
-    clientId: options.clientId,
-    redirectUri: options.redirectUri,
-    codeChallenge: challenge,
-    state,
-    scopes: options.scopes,
-    resource: options.resource,
-  })
-
-  const callbackPromise = startCallbackServer(options.callbackPort)
-  openBrowser(authorizationUrl)
-
-  const result = await callbackPromise
-  if (result.state !== state) {
-    throw new Error("OAuth state mismatch")
-  }
-
-  return { code: result.code, verifier }
-}

package/src/features/mcp-oauth/provider.ts

@@ -1,215 +0,0 @@
-import type { OAuthTokenData } from "./storage"
-import { loadToken, saveToken } from "./storage"
-import { PLUGIN_NAME } from "../../shared/plugin-identity"
-import { discoverOAuthServerMetadata } from "./discovery"
-import type { OAuthServerMetadata } from "./discovery"
-import { getOrRegisterClient } from "./dcr"
-import type { ClientCredentials, ClientRegistrationStorage } from "./dcr"
-import { findAvailablePort } from "./callback-server"
-import {
-  buildAuthorizationUrl,
-  generateCodeChallenge,
-  generateCodeVerifier,
-  runAuthorizationCodeRedirect,
-  startCallbackServer,
-} from "./oauth-authorization-flow"
-
-export type McpOAuthProviderOptions = {
-  serverUrl: string
-  clientId?: string
-  scopes?: string[]
-}
-
-async function parseTokenResponse(tokenResponse: Response): Promise<Record<string, unknown>> {
-  if (!tokenResponse.ok) {
-    let errorDetail = `${tokenResponse.status}`
-    try {
-      const body = (await tokenResponse.json()) as Record<string, unknown>
-      if (body.error) {
-        errorDetail = `${tokenResponse.status} ${body.error}`
-        if (body.error_description) {
-          errorDetail += `: ${body.error_description}`
-        }
-      }
-    } catch {
-      // Response body not JSON
-    }
-    throw new Error(`Token exchange failed: ${errorDetail}`)
-  }
-
-  return (await tokenResponse.json()) as Record<string, unknown>
-}
-
-function buildOAuthTokenData(
-  tokenData: Record<string, unknown>,
-  clientInfo: ClientCredentials,
-  fallbackRefreshToken?: string,
-): OAuthTokenData {
-  const accessToken = tokenData.access_token
-  if (typeof accessToken !== "string") {
-    throw new Error("Token response missing access_token")
-  }
-
-  return {
-    accessToken,
-    refreshToken: typeof tokenData.refresh_token === "string" ? tokenData.refresh_token : fallbackRefreshToken,
-    expiresAt:
-      typeof tokenData.expires_in === "number" ? Math.floor(Date.now() / 1000) + tokenData.expires_in : undefined,
-    clientInfo: {
-      clientId: clientInfo.clientId,
-      ...(clientInfo.clientSecret ? { clientSecret: clientInfo.clientSecret } : {}),
-    },
-  }
-}
-
-export class McpOAuthProvider {
-  private readonly serverUrl: string
-  private readonly configClientId: string | undefined
-  private readonly scopes: string[]
-  private storedCodeVerifier: string | null = null
-  private storedClientInfo: ClientCredentials | null = null
-  private callbackPort: number | null = null
-
-  constructor(options: McpOAuthProviderOptions) {
-    this.serverUrl = options.serverUrl
-    this.configClientId = options.clientId
-    this.scopes = options.scopes ?? []
-  }
-
-  tokens(): OAuthTokenData | null {
-    return loadToken(this.serverUrl, this.serverUrl)
-  }
-
-  saveTokens(tokenData: OAuthTokenData): boolean {
-    return saveToken(this.serverUrl, this.serverUrl, tokenData)
-  }
-
-  clientInformation(): ClientCredentials | null {
-    if (this.storedClientInfo) return this.storedClientInfo
-    const tokenData = this.tokens()
-    if (tokenData?.clientInfo) {
-      this.storedClientInfo = tokenData.clientInfo
-      return this.storedClientInfo
-    }
-    return null
-  }
-
-  redirectUrl(): string {
-    return `http://127.0.0.1:${this.callbackPort ?? 19877}/callback`
-  }
-
-  saveCodeVerifier(verifier: string): void {
-    this.storedCodeVerifier = verifier
-  }
-
-  codeVerifier(): string | null {
-    return this.storedCodeVerifier
-  }
-
-  async redirectToAuthorization(metadata: OAuthServerMetadata): Promise<{ code: string }> {
-    const clientInfo = this.clientInformation()
-    if (!clientInfo) {
-      throw new Error("No client information available. Run login() or register a client first.")
-    }
-
-    if (this.callbackPort === null) {
-      this.callbackPort = await findAvailablePort()
-    }
-
-    const result = await runAuthorizationCodeRedirect({
-      authorizationEndpoint: metadata.authorizationEndpoint,
-      callbackPort: this.callbackPort,
-      clientId: clientInfo.clientId,
-      redirectUri: this.redirectUrl(),
-      scopes: this.scopes,
-      resource: metadata.resource,
-    })
-
-    this.saveCodeVerifier(result.verifier)
-    return { code: result.code }
-  }
-
-  async login(): Promise<OAuthTokenData> {
-    const metadata = await discoverOAuthServerMetadata(this.serverUrl)
-
-    const clientRegistrationStorage: ClientRegistrationStorage = {
-      getClientRegistration: () => this.storedClientInfo,
-      setClientRegistration: (_serverIdentifier: string, credentials: ClientCredentials) => {
-        this.storedClientInfo = credentials
-      },
-    }
-
-    const clientInfo = await getOrRegisterClient({
-      registrationEndpoint: metadata.registrationEndpoint,
-      serverIdentifier: this.serverUrl,
-      clientName: PLUGIN_NAME,
-      redirectUris: [this.redirectUrl()],
-      tokenEndpointAuthMethod: "none",
-      clientId: this.configClientId,
-      storage: clientRegistrationStorage,
-    })
-
-    if (!clientInfo) {
-      throw new Error("Failed to obtain client credentials. Provide a clientId or ensure the server supports DCR.")
-    }
-
-    this.storedClientInfo = clientInfo
-
-    const { code } = await this.redirectToAuthorization(metadata)
-    const verifier = this.codeVerifier()
-    if (!verifier) {
-      throw new Error("Code verifier not found")
-    }
-
-    const tokenResponse = await fetch(metadata.tokenEndpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this.redirectUrl(),
-        client_id: clientInfo.clientId,
-        code_verifier: verifier,
-        ...(metadata.resource ? { resource: metadata.resource } : {}),
-      }).toString(),
-    })
-
-    const tokenData = await parseTokenResponse(tokenResponse)
-    const oauthTokenData = buildOAuthTokenData(tokenData, clientInfo)
-
-    this.saveTokens(oauthTokenData)
-    return oauthTokenData
-  }
-
-  async refresh(refreshToken: string): Promise<OAuthTokenData> {
-    const metadata = await discoverOAuthServerMetadata(this.serverUrl)
-    const clientInfo = this.clientInformation()
-    const clientId = clientInfo?.clientId ?? this.configClientId
-    if (!clientId) {
-      throw new Error("No client information available. Run login() or register a client first.")
-    }
-
-    const tokenResponse = await fetch(metadata.tokenEndpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-        client_id: clientId,
-        ...(clientInfo?.clientSecret ? { client_secret: clientInfo.clientSecret } : {}),
-        ...(metadata.resource ? { resource: metadata.resource } : {}),
-      }).toString(),
-    })
-
-    const tokenData = await parseTokenResponse(tokenResponse)
-    const oauthTokenData = buildOAuthTokenData(tokenData, {
-      clientId,
-      ...(clientInfo?.clientSecret ? { clientSecret: clientInfo.clientSecret } : {}),
-    }, refreshToken)
-
-    this.saveTokens(oauthTokenData)
-    return oauthTokenData
-  }
-}
-
-export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, startCallbackServer }

package/src/features/mcp-oauth/refresh-mutex.ts

@@ -1,58 +0,0 @@
-import type { OAuthTokenData } from "./storage"
-
-/**
- * Per-server OAuth refresh mutex to prevent concurrent refresh race conditions.
- *
- * When multiple operations need to refresh a token for the same server,
- * this ensures only one refresh request is made and all waiters receive
- * the same result.
- */
-
-const ongoingRefreshes = new Map<string, Promise<OAuthTokenData>>()
-
-/**
- * Execute a token refresh with per-server mutual exclusion.
- *
- * If a refresh is already in progress for the given server, this will
- * return the same promise to all concurrent callers. Once the refresh
- * completes (success or failure), the lock is released.
- *
- * @param serverUrl - The OAuth server URL (used as mutex key)
- * @param refreshFn - The actual refresh operation to execute
- * @returns Promise that resolves to the new token data
- */
-export async function withRefreshMutex(
-  serverUrl: string,
-  refreshFn: () => Promise<OAuthTokenData>,
-): Promise<OAuthTokenData> {
-  const existing = ongoingRefreshes.get(serverUrl)
-  if (existing) {
-    return existing
-  }
-
-  const refreshPromise = refreshFn().finally(() => {
-    ongoingRefreshes.delete(serverUrl)
-  })
-
-  ongoingRefreshes.set(serverUrl, refreshPromise)
-  return refreshPromise
-}
-
-/**
- * Check if a refresh is currently in progress for a server.
- *
- * @param serverUrl - The OAuth server URL
- * @returns true if a refresh operation is active
- */
-export function isRefreshInProgress(serverUrl: string): boolean {
-  return ongoingRefreshes.has(serverUrl)
-}
-
-/**
- * Get the number of servers currently undergoing token refresh.
- *
- * @returns Number of active refresh operations
- */
-export function getActiveRefreshCount(): number {
-  return ongoingRefreshes.size
-}

package/src/features/mcp-oauth/resource-indicator.ts

@@ -1,16 +0,0 @@
-export function getResourceIndicator(url: string): string {
-  const parsed = new URL(url)
-  parsed.search = ""
-  parsed.hash = ""
-
-  let normalized = parsed.toString()
-  if (normalized.endsWith("/")) {
-    normalized = normalized.slice(0, -1)
-  }
-
-  return normalized
-}
-
-export function addResourceToParams(params: URLSearchParams, resource: string): void {
-  params.set("resource", resource)
-}

package/src/features/mcp-oauth/schema.ts

@@ -1,8 +0,0 @@
-import { z } from "zod"
-
-export const McpOauthSchema = z.object({
-  clientId: z.string().optional(),
-  scopes: z.array(z.string()).optional(),
-})
-
-export type McpOauth = z.infer<typeof McpOauthSchema>