@jurislm/coolify-plugin 4.0.26 → 4.0.28

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coolify-plugin",
-  "version": "4.0.26",
+  "version": "4.0.28",
   "description": "Fallback Codex metadata for local stdio Coolify tools.",
   "author": {
     "name": "JurisLM",

package/.mcp.json

@@ -2,8 +2,8 @@
   "mcpServers": {
     "coolify": {
       "type": "stdio",
-      "command": "bunx",
-      "args": ["-y", "@jurislm/coolify-plugin@latest"],
+      "command": "bun",
+      "args": ["x", "@jurislm/coolify-plugin@latest"],
       "env_vars": ["COOLIFY_CLOUD_BASE_URL", "COOLIFY_CLOUD_ACCESS_TOKEN", "CURSOR_COOLIFY_BASE_URL", "CURSOR_COOLIFY_ACCESS_TOKEN", "COOLIFY_BASE_URL", "COOLIFY_ACCESS_TOKEN"]
     }
   }

package/.mcp.json.example

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
     "coolify": {
-      "command": "bunx",
-      "args": ["-y", "@jurislm/coolify-plugin@latest"],
+      "command": "bun",
+      "args": ["x", "@jurislm/coolify-plugin@latest"],
       "env": {
         "COOLIFY_BASE_URL": "https://coolify.example",
         "COOLIFY_ACCESS_TOKEN": "<set-in-host-environment>"

package/README.md

@@ -27,7 +27,7 @@ bun run check
 bun dist/index.js
 ```
 
-`mcp.json` and `.mcp.json` use the same published-package `bunx` stdio registration as the Woodpecker CI plugin. `.mcp.json.example` contains placeholder environment values only. NPM package release is allowed.
+`mcp.json`, `.mcp.json` and `plugins/cursor/mcp.json` launch the published package with `bun x` (not the separate `bunx` executable, which some package-manager shims break). When a connection variable is missing, empty, or an unsubstituted `${...}` placeholder, the server fills it from `~/.config/jurislm/plugin.env` (`KEY=value` or `export KEY=value` lines; override the path with `JURISLM_PLUGIN_ENV`); host values always take precedence and values are never logged. `.mcp.json.example` contains placeholder environment values only. NPM package release is allowed.
 
 For Codex repository marketplace installation, use the repository root and leave the sparse path empty. The supported marketplace manifest is `.agents/plugins/marketplace.json`; do not enter `plugins/codex`.
 The native Codex registration forwards `COOLIFY_CLOUD_BASE_URL`, `COOLIFY_CLOUD_ACCESS_TOKEN`, `CURSOR_COOLIFY_BASE_URL`, `CURSOR_COOLIFY_ACCESS_TOKEN`, `COOLIFY_BASE_URL` and `COOLIFY_ACCESS_TOKEN` from its owning environment. Portable `mcp.json` contains no host-specific fields or credential defaults.
@@ -51,7 +51,7 @@ args = ["-f", "-c", 'source "$HOME/.codex/bin/coolify-mcp.zsh"']
 startup_timeout_sec = 30
 ```
 
-The launcher checks startup-file syntax before explicitly sourcing `${ZDOTDIR:-$HOME}/.zshenv`, suppresses stdout and preserves stderr. Source status 0 or 1 is accepted because a final optional guard can return 1; higher statuses stop startup. It retains only the six supported connection variables, `HOME`, `PATH`, `TMPDIR` and `LANG`, fixes PATH to `$HOME/.bun/bin:/usr/bin:/bin` and executes the absolute `$HOME/.bun/bin/bunx` path. The `--require-config` option reuses `loadConfig` to require the selected complete URL/token pair before starting stdio; trim, placeholder handling and pair precedence remain the same. Ordinary portable initialization and tool discovery can still start without credentials.
+The launcher checks startup-file syntax before explicitly sourcing `${ZDOTDIR:-$HOME}/.zshenv`, suppresses stdout and preserves stderr. Source status 0 or 1 is accepted because a final optional guard can return 1; higher statuses stop startup. It retains only the six supported connection variables, `HOME`, `PATH`, `TMPDIR` and `LANG`, fixes PATH to `$HOME/.bun/bin:/usr/bin:/bin` and executes the absolute `$HOME/.bun/bin/bun x` path. The `--require-config` option reuses `loadConfig` to require the selected complete URL/token pair before starting stdio; trim, placeholder handling and pair precedence remain the same. Ordinary portable initialization and tool discovery can still start without credentials.
 
 Check `codex mcp get coolify`, restart Codex and open a fresh chat. Read `coolify_get_mcp_version` before connection checks and authenticated reads. Record the resolved package version, actual registration source, HTTP status and returned counts. Standalone stdio checks establish process behavior; fresh chat registration and provider reads require their own evidence.
 

package/dist/client.js

@@ -1,6 +1,92 @@
+import { isAlias, isScalar, parseDocument, stringify, visit } from "yaml";
 import { CoolifyApiError, redactErrorText } from "./errors.js";
 const sensitiveKey = /(^value$|real_?value|private_?key|api_?key|user_?key|webhook_?url|token|secret|password|authorization|cookie)/iu;
+const composeKey = /^(docker_compose(_pr)?(_raw)?|configuration)$/u;
+const composeSecretName = /(password|passwd|secret|token|private|credential|api_?key|access_?key|authorization|cookie)/iu;
+const composeSecretSegment = /(^|[_.-])(key|pass|pwd|auth)($|[_.-])/iu;
+const interpolation = /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/u;
+const urlCredential = /([a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]{0,256}):([^\s/?#]{1,256})@/giu;
+const queryParameter = /([?&])([^=&#?\s"']{1,64})=([^&#\s"']+)/gu;
+const querySecretSegments = new Set(["password", "passwd", "pass", "pwd", "secret", "token", "auth", "sig", "signature", "credential", "credentials", "apikey", "key"]);
+const querySecretName = /(password|passwd|secret|token|api_?key|access_?key)/iu;
+const flagValue = /^(true|false|yes|no|on|off|enabled|disabled|none)$/iu;
+const assignment = /^([\w.-]+)=([\s\S]*)$/u;
+const base64Text = /^[A-Za-z0-9+/]+={0,2}$/u;
+function isComposeSecret(name, value) {
+    if (!composeSecretName.test(name) && !composeSecretSegment.test(name))
+        return false;
+    const text = typeof value === "string" ? value : typeof value === "number" ? String(value) : "";
+    return text.trim() !== "" && !interpolation.test(text) && !flagValue.test(text.trim());
+}
+function redactUrlCredentials(text) {
+    return text
+        .replace(urlCredential, (match, prefix, password) => interpolation.test(password) ? match : `${prefix}:[REDACTED]@`)
+        .replace(queryParameter, (match, separator, name, value) => value !== "[REDACTED]" && isQuerySecret(name) ? `${separator}${name}=[REDACTED]` : match);
+}
+function isQuerySecret(name) {
+    return querySecretName.test(name) || name.toLowerCase().split(/[_.-]/u).some((segment) => querySecretSegments.has(segment));
+}
+const composeAliasLimit = 100;
+function redactComposeValue(value) {
+    if (Array.isArray(value))
+        return value.map(redactComposeValue);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, isComposeSecret(key, child) ? "[REDACTED]" : redactComposeValue(child)]));
+    }
+    if (typeof value !== "string")
+        return value;
+    const match = assignment.exec(value);
+    return match && isComposeSecret(match[1], match[2]) ? `${match[1]}=[REDACTED]` : redactUrlCredentials(value);
+}
+function redactComposeYaml(text) {
+    if (text.trim() === "" || text === "[REDACTED]")
+        return text;
+    const document = parseDocument(text, { schema: "failsafe", merge: true });
+    if (document.errors.length > 0)
+        return "[REDACTED]";
+    let parsed;
+    let rendered;
+    try {
+        const secrets = [];
+        visit(document, {
+            Pair(_key, pair) {
+                const key = isAlias(pair.key) ? pair.key.resolve(document) : pair.key;
+                const value = isAlias(pair.value) ? pair.value.resolve(document) : pair.value;
+                if (isScalar(key) && isScalar(value) && isComposeSecret(String(key.value), value.value))
+                    secrets.push(value);
+            },
+        });
+        for (const node of secrets)
+            node.value = "[REDACTED]";
+        parsed = document.toJS({ maxAliasCount: composeAliasLimit });
+        rendered = stringify(redactComposeValue(parsed), { lineWidth: 0 });
+    }
+    catch {
+        return "[REDACTED]";
+    }
+    return text.endsWith("\n") ? rendered : rendered.replace(/\n$/u, "");
+}
+function decodeBase64Text(text) {
+    if (text.length % 4 !== 0 || !base64Text.test(text))
+        return undefined;
+    const bytes = Buffer.from(text, "base64");
+    if (bytes.toString("base64") !== text)
+        return undefined;
+    try {
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        return /[\n:]/u.test(decoded) ? decoded : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function redactComposeText(text) {
+    const decoded = decodeBase64Text(text);
+    return decoded === undefined ? redactComposeYaml(text) : Buffer.from(redactComposeYaml(decoded), "utf8").toString("base64");
+}
 export function redactSensitive(value) {
+    if (typeof value === "string")
+        return redactUrlCredentials(value);
     if (Array.isArray(value))
         return value.map(redactSensitive);
     if (!value || typeof value !== "object")
@@ -8,7 +94,7 @@ export function redactSensitive(value) {
     const binary = value.encoding === "base64" && typeof value.contentType === "string" && typeof value.value === "string";
     return Object.fromEntries(Object.entries(value).map(([key, child]) => [
         key,
-        sensitiveKey.test(key) && !(binary && key === "value") ? "[REDACTED]" : redactSensitive(child),
+        sensitiveKey.test(key) && !(binary && key === "value") ? "[REDACTED]" : composeKey.test(key) && typeof child === "string" ? redactComposeText(child) : redactSensitive(child),
     ]));
 }
 function pathValue(value, name) {

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+export declare const CREDENTIAL_GROUPS: readonly [readonly ["COOLIFY_CLOUD_BASE_URL", "COOLIFY_CLOUD_ACCESS_TOKEN"], readonly ["CURSOR_COOLIFY_BASE_URL", "CURSOR_COOLIFY_ACCESS_TOKEN"], readonly ["COOLIFY_BASE_URL", "COOLIFY_ACCESS_TOKEN"]];
 export interface CoolifyConfig {
     baseUrl?: string;
     token?: string;

package/dist/config.js

@@ -1,3 +1,8 @@
+export const CREDENTIAL_GROUPS = [
+    ["COOLIFY_CLOUD_BASE_URL", "COOLIFY_CLOUD_ACCESS_TOKEN"],
+    ["CURSOR_COOLIFY_BASE_URL", "CURSOR_COOLIFY_ACCESS_TOKEN"],
+    ["COOLIFY_BASE_URL", "COOLIFY_ACCESS_TOKEN"],
+];
 export class ConfigError extends Error {
     constructor(message) {
         super(message);

package/dist/index.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env bun
-import { ConfigError, loadConfig } from "./config.js";
+import { CREDENTIAL_GROUPS, ConfigError, loadConfig } from "./config.js";
+import { withPluginEnv } from "./plugin-env.js";
 import { createServer } from "./server.js";
 import { createStdioTransport } from "./transports/stdio.js";
 try {
-    const config = loadConfig();
+    const config = loadConfig(withPluginEnv(process.env, CREDENTIAL_GROUPS));
     if (process.argv.includes("--require-config") && (!config.baseUrl || !config.token))
         throw new ConfigError("A complete URL/token pair is required for the selected Coolify configuration");
     await createServer(config).connect(createStdioTransport());

package/dist/plugin-env.d.ts

@@ -0,0 +1,6 @@
+export type Environment = Record<string, string | undefined>;
+export type CredentialGroups = readonly (readonly string[])[];
+export declare const PLUGIN_ENV_PATH_VARIABLE = "JURISLM_PLUGIN_ENV";
+export declare function parsePluginEnv(text: string): Record<string, string>;
+export declare function pluginEnvPath(env: Environment): string;
+export declare function withPluginEnv(env: Environment, groups: CredentialGroups, readText?: (path: string) => string, warn?: (message: string) => void): Environment;

package/dist/plugin-env.js

@@ -0,0 +1,66 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+export const PLUGIN_ENV_PATH_VARIABLE = "JURISLM_PLUGIN_ENV";
+const PLACEHOLDER = /^\$\{[^}]*\}$/u;
+const ASSIGNMENT = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/u;
+function isUnset(value) {
+    const trimmed = value?.trim();
+    return !trimmed || PLACEHOLDER.test(trimmed);
+}
+export function parsePluginEnv(text) {
+    const values = {};
+    for (const rawLine of text.split(/\r?\n/u)) {
+        const match = ASSIGNMENT.exec(rawLine.trim());
+        if (!match)
+            continue;
+        const [, name, rawValue] = match;
+        const quote = rawValue[0];
+        if (quote === '"' || quote === "'") {
+            const end = rawValue.indexOf(quote, 1);
+            if (end > 0)
+                values[name] = rawValue.slice(1, end);
+        }
+        else {
+            values[name] = rawValue.replace(/\s+#.*$/u, "").trim();
+        }
+    }
+    return values;
+}
+export function pluginEnvPath(env) {
+    const home = env.HOME?.trim() || homedir();
+    const override = env[PLUGIN_ENV_PATH_VARIABLE];
+    if (!override || isUnset(override))
+        return join(home, ".config", "jurislm", "plugin.env");
+    const path = override.trim();
+    return resolve(path === "~" || path.startsWith("~/") ? join(home, path.slice(1)) : path);
+}
+function readPluginEnv(path, readText, warn) {
+    try {
+        return parsePluginEnv(readText(path));
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT")
+            warn(`Could not read plugin env file ${path} (${code ?? "unknown error"})`);
+        return {};
+    }
+}
+export function withPluginEnv(env, groups, readText = (path) => readFileSync(path, "utf8"), warn = (message) => console.error(message)) {
+    if (groups.every((group) => group.every((name) => !isUnset(env[name]))))
+        return env;
+    const fileValues = groups.some((group) => group.every((name) => isUnset(env[name]))) ? readPluginEnv(pluginEnvPath(env), readText, warn) : {};
+    const resolved = { ...env };
+    for (const group of groups) {
+        const fillFromFile = group.every((name) => isUnset(env[name]));
+        for (const name of group) {
+            if (!isUnset(env[name]))
+                continue;
+            if (fillFromFile && !isUnset(fileValues[name]))
+                resolved[name] = fileValues[name];
+            else
+                delete resolved[name];
+        }
+    }
+    return resolved;
+}

package/launchers/coolify-desktop.zsh

@@ -20,4 +20,4 @@ for name in ${(k)parameters}; do
       ;;
   esac
 done
-exec "$HOME/.bun/bin/bunx" -y @jurislm/coolify-plugin@latest --require-config
+exec "$HOME/.bun/bin/bun" x @jurislm/coolify-plugin@latest --require-config

package/mcp.json

@@ -3,8 +3,8 @@
   "mcpServers": {
     "coolify": {
       "type": "stdio",
-      "command": "bunx",
-      "args": ["-y", "@jurislm/coolify-plugin@latest"]
+      "command": "bun",
+      "args": ["x", "@jurislm/coolify-plugin@latest"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jurislm/coolify-plugin",
-  "version": "4.0.26",
+  "version": "4.0.28",
   "description": "Portable local stdio MCP plugin for Coolify",
   "publishConfig": {
     "access": "public"
@@ -47,6 +47,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
+    "yaml": "2.9.1",
     "zod": "4.6.5"
   },
   "devDependencies": {
@@ -57,8 +58,7 @@
     "json-schema-to-zod": "2.8.1",
     "openapi-typescript": "7.13.0",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.70.1",
-    "yaml": "2.9.1"
+    "typescript-eslint": "8.70.1"
   },
   "packageManager": "bun@1.3.14"
 }

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "coolify-plugin",
-  "version": "4.0.26",
+  "version": "4.0.28",
   "description": "Portable Coolify MCP plugin with local stdio tools generated from the official OpenAPI contract.",
   "author": {
     "name": "JurisLM",