@khalilgharbaoui/opencode-claude-code-plugin 0.13.1 → 0.13.2

package/README.md

@@ -299,6 +299,14 @@ recovery step for harnesses that defer MCP tool schemas. Both apply per Claude
 process at spawn, and provider options are read once at opencode startup, so
 `proxyTools` changes need a full opencode restart.
 
+### Proxy endpoint security
+
+The proxy is a small HTTP MCP server on an ephemeral loopback port, and calling it runs Bash, Edit and Write through opencode's executor. Since 0.13.2 it requires a 256-bit bearer token, generated per server and handed to Claude in the `headers` block of the `0600` MCP config file the plugin writes. Requests are also rejected unless the `Host` header matches the bound `127.0.0.1:<port>` authority, no `Origin` header is present, and the content type is `application/json`.
+
+**Upgrade if you are on 0.13.1 or earlier.** Before this, any local process could post to that port and execute commands as you, and a web page you visited could do the same blind, without reading the response. Reported by @willmcginnis in [#28](https://github.com/khalilgharbaoui/opencode-claude-code-plugin/pull/28).
+
+Nothing to configure. If proxied tools ever stop working after a Claude Code upgrade, check the plugin log for `proxy-mcp rejected a request`, which names which guard failed.
+
 ### Closing a tool with no proxy
 
 `proxyTools` only reaches built-ins the plugin can replace. A built-in with no opencode equivalent, `NotebookEdit` today and whatever Claude Code ships next, stays enabled and unmediated no matter what you put in that list. `extraDisallowedTools` names them directly:

package/dist/index.d.ts

@@ -31,8 +31,8 @@ type OpenCodeModel = {
             video: boolean;
             pdf: boolean;
         };
-        interleaved: boolean | {
-            field: "reasoning_content" | "reasoning_details";
+        interleaved: boolean | string | {
+            field: "reasoning" | "reasoning_content" | "reasoning_text" | string;
         };
     };
     cost: {

package/dist/index.js

@@ -2541,10 +2541,50 @@ var DEFAULT_PROXY_TOOLS = [
 async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverrides, interceptors) {
   const calls = new EventEmitter3();
   const pending = /* @__PURE__ */ new Map();
+  const authToken = crypto2.randomBytes(32).toString("hex");
+  const expectedAuth = Buffer.from(`Bearer ${authToken}`);
+  let boundAuthority = "";
+  function authOk(req) {
+    const got = req.headers.authorization;
+    if (typeof got !== "string") return false;
+    const candidate = Buffer.from(got);
+    if (candidate.length !== expectedAuth.length) return false;
+    return crypto2.timingSafeEqual(candidate, expectedAuth);
+  }
+  function reject(req, res, statusCode, reason) {
+    log.notice("proxy-mcp rejected a request", {
+      statusCode,
+      reason,
+      method: req.method,
+      hasAuthorization: typeof req.headers.authorization === "string"
+    });
+    res.statusCode = statusCode;
+    res.setHeader("Connection", "close");
+    res.on("finish", () => {
+      req.socket?.destroy();
+    });
+    res.end();
+  }
   const server2 = createServer(async (req, res) => {
     if (req.method !== "POST" || !req.url?.startsWith("/mcp")) {
-      res.statusCode = 404;
-      res.end();
+      reject(req, res, 404, "not a POST to /mcp");
+      return;
+    }
+    if (req.headers.host !== boundAuthority) {
+      reject(req, res, 403, "host header is not the bound authority");
+      return;
+    }
+    if (req.headers.origin !== void 0) {
+      reject(req, res, 403, "origin header present");
+      return;
+    }
+    const contentType = String(req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+    if (contentType !== "application/json") {
+      reject(req, res, 415, "content-type is not application/json");
+      return;
+    }
+    if (!authOk(req)) {
+      reject(req, res, 401, "missing or invalid bearer token");
       return;
     }
     let requestId = null;
@@ -2636,13 +2676,13 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
         });
         let timer = null;
         const result = await new Promise(
-          (resolve4, reject) => {
+          (resolve4, reject2) => {
             const entry = {
               id: callId,
               toolName,
               input,
               resolve: resolve4,
-              reject
+              reject: reject2
             };
             pending.set(callId, entry);
             const deadlineMs = resolveProxyCallTimeoutMs(
@@ -2658,7 +2698,7 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
                 toolName,
                 deadlineMs
               });
-              reject(buildProxyTimeoutError(toolName, deadlineMs));
+              reject2(buildProxyTimeoutError(toolName, deadlineMs));
             }, deadlineMs);
             calls.emit("call", entry);
           }
@@ -2717,10 +2757,10 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
       }
     }
   });
-  await new Promise((resolve4, reject) => {
-    server2.once("error", reject);
+  await new Promise((resolve4, reject2) => {
+    server2.once("error", reject2);
     server2.listen(0, "127.0.0.1", () => {
-      server2.off("error", reject);
+      server2.off("error", reject2);
       resolve4();
     });
   });
@@ -2729,7 +2769,8 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
     server2.close();
     throw new Error("Failed to bind proxy MCP server");
   }
-  const url = `http://127.0.0.1:${addr.port}/mcp`;
+  boundAuthority = `127.0.0.1:${addr.port}`;
+  const url = `http://${boundAuthority}/mcp`;
   log.info("proxy-mcp server started", {
     url,
     tools: tools.map((t) => t.name)
@@ -2739,6 +2780,7 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
     url,
     serverName: SERVER_NAME,
     tools,
+    authToken,
     calls,
     configPath() {
       if (configFilePath) return configFilePath;
@@ -2748,6 +2790,10 @@ async function createProxyMcpServer(tools = DEFAULT_PROXY_TOOLS, timeoutOverride
             [SERVER_NAME]: {
               type: "http",
               url,
+              // Claude CLI replays these headers on every request to this
+              // server, which is what lets the handler above reject anyone
+              // who did not read this 0600 file.
+              headers: { Authorization: `Bearer ${authToken}` },
               timeout: resolveProxyClientCeilingMs(timeoutOverrides)
             }
           }