@khalilgharbaoui/opencode-claude-code-plugin 0.13.0 → 0.13.2

package/README.md

@@ -182,6 +182,7 @@ The account model IDs are internally suffixed, for example `claude-sonnet-4-6@wo
 | `skipPermissions` | boolean | `true` | Pass `--dangerously-skip-permissions` to `claude`. Ignored when `proxyTools` is set — the proxy handles permissions through opencode instead. |
 | `permissionMode` | `acceptEdits` \| `auto` \| `bypassPermissions` \| `default` \| `dontAsk` \| `plan` | – | Forwarded to `claude --permission-mode`. |
 | `proxyTools` | string[] | `["Bash", "Edit", "Write", "WebFetch", "Task"]` | Claude built-in tools to route through opencode's executor + permission UI. Opt-in extras: `"Question"`, `"Compress"`. See [Selective tool proxy](#selective-tool-proxy). |
+| `extraDisallowedTools` | string[] | – | Extra Claude built-ins to switch off with `--disallowedTools`, on top of what `proxyTools` implies. Claude's names, e.g. `["NotebookEdit"]`. See [Closing a tool with no proxy](#closing-a-tool-with-no-proxy). |
 | `proxyToolTimeoutMs` | `Record<string, number>` | – | Per-tool proxy call deadline in ms, keyed by proxy tool name (`bash`, `task`, …). Defaults: 10 min flat, `task` → 60 min. For `bash`, the call's own `input.timeout` is honoured on top (`max(resolved, input.timeout)`). See [Selective tool proxy](#selective-tool-proxy). |
 | `planModeQuestion` | boolean | `false` | Route `ExitPlanMode` approval through opencode's native `question` tool instead of a text "(yes/no)" prompt. Off because opencode's question form is currently broken upstream. See [Plan mode](#plan-mode). |
 | `controlRequestBehavior` | `allow` \| `deny` | `allow` | Default response when `skipPermissions: false` and Claude sends a `can_use_tool` control request. |
@@ -298,6 +299,28 @@ recovery step for harnesses that defer MCP tool schemas. Both apply per Claude
 process at spawn, and provider options are read once at opencode startup, so
 `proxyTools` changes need a full opencode restart.
 
+### Proxy endpoint security
+
+The proxy is a small HTTP MCP server on an ephemeral loopback port, and calling it runs Bash, Edit and Write through opencode's executor. Since 0.13.2 it requires a 256-bit bearer token, generated per server and handed to Claude in the `headers` block of the `0600` MCP config file the plugin writes. Requests are also rejected unless the `Host` header matches the bound `127.0.0.1:<port>` authority, no `Origin` header is present, and the content type is `application/json`.
+
+**Upgrade if you are on 0.13.1 or earlier.** Before this, any local process could post to that port and execute commands as you, and a web page you visited could do the same blind, without reading the response. Reported by @willmcginnis in [#28](https://github.com/khalilgharbaoui/opencode-claude-code-plugin/pull/28).
+
+Nothing to configure. If proxied tools ever stop working after a Claude Code upgrade, check the plugin log for `proxy-mcp rejected a request`, which names which guard failed.
+
+### Closing a tool with no proxy
+
+`proxyTools` only reaches built-ins the plugin can replace. A built-in with no opencode equivalent, `NotebookEdit` today and whatever Claude Code ships next, stays enabled and unmediated no matter what you put in that list. `extraDisallowedTools` names them directly:
+
+```json
+"options": {
+  "extraDisallowedTools": ["NotebookEdit"]
+}
+```
+
+These go straight to `claude --disallowedTools`, so use Claude's tool names rather than opencode's. There is no replacement: the capability goes away rather than being routed through opencode, which is the point, but the model then has to work without it.
+
+Unknown entries in `proxyTools` are logged as a warning at spawn rather than passing silently, so a typo shows up as "ignoring unknown proxyTools entries" in the plugin log instead of quietly leaving the matching built-in unmediated.
+
 ### Context compression
 
 `"Compress"` is off by default. Add it when you run a harness that expects the model to manage its own context (opencode-dcp injects exactly those instructions), and the plugin exposes `mcp__opencode_proxy__compress`:

package/dist/index.d.ts

@@ -31,8 +31,8 @@ type OpenCodeModel = {
             video: boolean;
             pdf: boolean;
         };
-        interleaved: boolean | {
-            field: "reasoning_content" | "reasoning_details";
+        interleaved: boolean | string | {
+            field: "reasoning" | "reasoning_content" | "reasoning_text" | string;
         };
     };
     cost: {
@@ -161,6 +161,7 @@ interface ClaudeCodeConfig {
     controlRequestToolBehaviors?: Record<string, ControlRequestBehavior>;
     controlRequestDenyMessage?: string;
     proxyTools?: string[];
+    extraDisallowedTools?: string[];
     proxyToolTimeoutMs?: Record<string, number>;
     /**
      * Route `ExitPlanMode` through opencode's native `question` tool so plan
@@ -283,6 +284,20 @@ interface ClaudeCodeProviderSettings {
       * entry, in which case the deny/markdown fallback applies.
       */
     proxyTools?: string[];
+    /**
+     * Extra Claude Code built-ins to switch off with `--disallowedTools`,
+     * on top of the ones implied by `proxyTools`.
+     *
+     * `proxyTools` can only disable built-ins the plugin knows how to
+     * replace, so a built-in with no proxy equivalent (`NotebookEdit`, and
+     * anything Claude Code adds after this release) has no off switch
+     * otherwise. Names are Claude's, not opencode's: `["NotebookEdit"]`.
+     *
+     * Disabling a tool with no replacement removes the capability rather
+     * than routing it through opencode — that is the point, but it does mean
+     * the model has to work without it.
+     */
+    extraDisallowedTools?: string[];
     /**
      * Per-tool proxy call timeouts in milliseconds, keyed by the proxy tool
      * name (`bash`, `edit`, `write`, `webfetch`, `task`, `question` —

package/dist/index.js

@@ -294,6 +294,9 @@ var CLAUDE_INTERNAL_TOOLS = /* @__PURE__ */ new Set([
   "TaskGet",
   "TaskStop"
 ]);
+function singleQuoteForShell(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 function emitTodoWrite(todos) {
   return {
     name: "todowrite",
@@ -348,7 +351,7 @@ function mapTool(name, input, opts) {
     return {
       name: "bash",
       input: {
-        command: `echo "TASK OUTPUT: ${String(output).replace(/"/g, '\\"')}"`,
+        command: `printf '%s\\n' ${singleQuoteForShell(`TASK OUTPUT: ${String(output)}`)}`,
         description: "Displaying task output"
       },
       executed: false
@@ -2538,10 +2541,50 @@ var DEFAULT_PROXY_TOOLS = [
 async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverrides, interceptors) {
   const calls = new EventEmitter3();
   const pending = /* @__PURE__ */ new Map();
+  const authToken = crypto2.randomBytes(32).toString("hex");
+  const expectedAuth = Buffer.from(`Bearer ${authToken}`);
+  let boundAuthority = "";
+  function authOk(req) {
+    const got = req.headers.authorization;
+    if (typeof got !== "string") return false;
+    const candidate = Buffer.from(got);
+    if (candidate.length !== expectedAuth.length) return false;
+    return crypto2.timingSafeEqual(candidate, expectedAuth);
+  }
+  function reject(req, res, statusCode, reason) {
+    log.notice("proxy-mcp rejected a request", {
+      statusCode,
+      reason,
+      method: req.method,
+      hasAuthorization: typeof req.headers.authorization === "string"
+    });
+    res.statusCode = statusCode;
+    res.setHeader("Connection", "close");
+    res.on("finish", () => {
+      req.socket?.destroy();
+    });
+    res.end();
+  }
   const server2 = createServer(async (req, res) => {
     if (req.method !== "POST" || !req.url?.startsWith("/mcp")) {
-      res.statusCode = 404;
-      res.end();
+      reject(req, res, 404, "not a POST to /mcp");
+      return;
+    }
+    if (req.headers.host !== boundAuthority) {
+      reject(req, res, 403, "host header is not the bound authority");
+      return;
+    }
+    if (req.headers.origin !== void 0) {
+      reject(req, res, 403, "origin header present");
+      return;
+    }
+    const contentType = String(req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+    if (contentType !== "application/json") {
+      reject(req, res, 415, "content-type is not application/json");
+      return;
+    }
+    if (!authOk(req)) {
+      reject(req, res, 401, "missing or invalid bearer token");
       return;
     }
     let requestId = null;
@@ -2633,13 +2676,13 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
         });
         let timer = null;
         const result = await new Promise(
-          (resolve4, reject) => {
+          (resolve4, reject2) => {
             const entry = {
               id: callId,
               toolName,
               input,
               resolve: resolve4,
-              reject
+              reject: reject2
             };
             pending.set(callId, entry);
             const deadlineMs = resolveProxyCallTimeoutMs(
@@ -2655,7 +2698,7 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
                 toolName,
                 deadlineMs
               });
-              reject(buildProxyTimeoutError(toolName, deadlineMs));
+              reject2(buildProxyTimeoutError(toolName, deadlineMs));
             }, deadlineMs);
             calls.emit("call", entry);
           }
@@ -2714,10 +2757,10 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
       }
     }
   });
-  await new Promise((resolve4, reject) => {
-    server2.once("error", reject);
+  await new Promise((resolve4, reject2) => {
+    server2.once("error", reject2);
     server2.listen(0, "127.0.0.1", () => {
-      server2.off("error", reject);
+      server2.off("error", reject2);
       resolve4();
     });
   });
@@ -2726,7 +2769,8 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
     server2.close();
     throw new Error("Failed to bind proxy MCP server");
   }
-  const url = `http://127.0.0.1:${addr.port}/mcp`;
+  boundAuthority = `127.0.0.1:${addr.port}`;
+  const url = `http://${boundAuthority}/mcp`;
   log.info("proxy-mcp server started", {
     url,
     tools: tools.map((t) => t.name)
@@ -2736,6 +2780,7 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
     url,
     serverName: SERVER_NAME,
     tools,
+    authToken,
     calls,
     configPath() {
       if (configFilePath) return configFilePath;
@@ -2745,6 +2790,10 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
             [SERVER_NAME]: {
               type: "http",
               url,
+              // Claude CLI replays these headers on every request to this
+              // server, which is what lets the handler above reject anyone
+              // who did not read this 0600 file.
+              headers: { Authorization: `Bearer ${authToken}` },
               timeout: resolveProxyClientCeilingMs(timeoutOverrides)
             }
           }
@@ -2810,6 +2859,20 @@ function disallowedToolFlags(tools) {
   }
   return out;
 }
+function resolveDisallowedTools(options) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (name) => {
+    const trimmed = name.trim();
+    if (!trimmed || seen.has(trimmed)) return;
+    seen.add(trimmed);
+    out.push(trimmed);
+  };
+  for (const name of disallowedToolFlags(options.proxyTools ?? [])) push(name);
+  for (const name of options.extraDisallowedTools ?? []) push(String(name));
+  if (options.disableWebSearch) push("WebSearch");
+  return out;
+}
 function readBody(req) {
   return new Promise((resolve4, reject) => {
     const chunks = [];
@@ -3353,9 +3416,22 @@ var ClaudeCodeLanguageModel = class {
       DEFAULT_PROXY_TOOLS.map((t) => [t.name.toLowerCase(), t])
     );
     const picked = [];
+    const unknown = [];
     for (const n of names) {
       const def = defsByName.get(String(n).toLowerCase());
       if (def) picked.push(def);
+      else unknown.push(String(n));
+    }
+    if (unknown.length > 0) {
+      const known = [...defsByName.keys()].join(", ");
+      if (picked.length === 0) {
+        log.warn(
+          "no proxyTools entry was recognised; nothing will be proxied this turn",
+          { unknown, known }
+        );
+      } else {
+        log.warn("ignoring unknown proxyTools entries", { unknown, known });
+      }
     }
     return picked.length > 0 ? picked : null;
   }
@@ -4453,10 +4529,11 @@ ${plan}
                 proxyServer = await self.ensureProxyServer(combinedProxyTools, sk);
               }
               const questionProxyActive = enrichedProxy?.some((t) => t.name === "question") ?? false;
-              const proxyDisallowed = enrichedProxy ? disallowedToolFlags(enrichedProxy) : [];
-              const extraDisallowed = [];
-              if (self.config.webSearch === "disabled") extraDisallowed.push("WebSearch");
-              const allDisallowed = [...proxyDisallowed, ...extraDisallowed];
+              const allDisallowed = resolveDisallowedTools({
+                proxyTools: enrichedProxy,
+                extraDisallowedTools: self.config.extraDisallowedTools,
+                disableWebSearch: self.config.webSearch === "disabled"
+              });
               const mcp = self.effectiveMcpConfig(
                 cwd,
                 proxyServer?.configPath(),
@@ -5707,11 +5784,11 @@ function defineModel(opts) {
     variants: opts.reasoning ? reasoningVariants : void 0
   };
 }
-var haikuCost = { input: 1e-6, output: 5e-6, cacheRead: 1e-7, cacheWrite: 125e-8 };
-var sonnetCost = { input: 3e-6, output: 15e-6, cacheRead: 3e-7, cacheWrite: 375e-8 };
-var sonnet5Cost = { input: 2e-6, output: 1e-5, cacheRead: 2e-7, cacheWrite: 25e-7 };
-var opusCost = { input: 5e-6, output: 25e-6, cacheRead: 5e-7, cacheWrite: 625e-8 };
-var fableCost = { input: 1e-5, output: 5e-5, cacheRead: 1e-6, cacheWrite: 125e-7 };
+var haikuCost = { input: 1, output: 5, cacheRead: 0.1, cacheWrite: 1.25 };
+var sonnetCost = { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3.75 };
+var sonnet5Cost = { input: 2, output: 10, cacheRead: 0.2, cacheWrite: 2.5 };
+var opusCost = { input: 5, output: 25, cacheRead: 0.5, cacheWrite: 6.25 };
+var fableCost = { input: 10, output: 50, cacheRead: 1, cacheWrite: 12.5 };
 function toConfigModel(model) {
   const inputMods = [];
   const outputMods = [];
@@ -6310,6 +6387,7 @@ function createClaudeCode(settings = {}) {
       controlRequestToolBehaviors: settings.controlRequestToolBehaviors,
       controlRequestDenyMessage: settings.controlRequestDenyMessage,
       proxyTools,
+      extraDisallowedTools: settings.extraDisallowedTools,
       proxyToolTimeoutMs: settings.proxyToolTimeoutMs,
       planModeQuestion: settings.planModeQuestion ?? false,
       webSearch: settings.webSearch,