@khalilgharbaoui/opencode-claude-code-plugin 0.22.0 → 0.23.0

package/README.md

@@ -334,6 +334,8 @@ Every variable the plugin itself reads, in one place. Config is read once at ope
 | `OPENCODE_CONFIG` / `OPENCODE_CONFIG_DIR` | config discovery | Where the plugin looks for your opencode config when bridging MCP and skills. See [Discovery order](#discovery-order-highest-to-lowest-priority). |
 | `OPENCODE_VERSION` | startup diagnostics | Reported as the opencode version when set, sparing the plugin a `--version` spawn. Diagnostics only. |
 | `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` | spawn environment | Not set by the plugin: these are yours, and Claude Code authenticates with them in preference to your subscription login when present. `ignoreAnthropicApiKey: true` strips them from the spawn. See [Billing](#billing). |
+| `DISABLE_AUTOUPDATER` | spawn environment | Set to `1` on every `claude` the plugin spawns, **only if you have not set it yourself**. The plugin detects your CLI version once and caches it, and gates `--thinking-display summarized`, `--plugin-dir` and fast mode on the answer, so a CLI that updates itself mid-session would leave those gates describing a binary that is no longer running. Export `DISABLE_AUTOUPDATER=0` to keep the autoupdater; your value is never overwritten, and updating the CLI between opencode restarts works normally either way. |
+| `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` | spawn environment | Set to `1` on every spawned `claude` under the same never-overwrite rule. It suppresses the CLI's non-essential network calls and is a second, independent way Claude Code declines to auto-update. Export it yourself (including as an empty string, which the CLI reads as off) to take control. |
 
 The plugin also honours the usual path conventions rather than defining its own: `XDG_CONFIG_HOME` and `XDG_CACHE_HOME` (falling back to `~/.config` and `~/.cache`), `HOME` / `USERPROFILE`, and Claude Code's `CLAUDE_CONFIG_DIR` when the interactive transport needs to find the session transcript. Account providers set `CLAUDE_CONFIG_DIR` themselves for the process they spawn.
 

package/dist/index.js

@@ -381,6 +381,17 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var cache = /* @__PURE__ */ new Map();
+var CLI_HYGIENE_ENV_VARS = [
+  "DISABLE_AUTOUPDATER",
+  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"
+];
+function cliHygieneEnv(inherited = process.env) {
+  const filled = {};
+  for (const name of CLI_HYGIENE_ENV_VARS) {
+    if (inherited[name] === void 0) filled[name] = "1";
+  }
+  return filled;
+}
 function detectCliVersion(cliPath) {
   const cached = cache.get(cliPath);
   if (cached) return cached;
@@ -2056,7 +2067,11 @@ function cliEffortLevel(effort) {
 function claudeSpawnEnv(opts) {
   const env = {
     ...process.env,
-    TERM: "xterm-256color"
+    TERM: "xterm-256color",
+    // Pin the child to the binary whose version we detected, and keep it off
+    // non-essential network calls. Fills gaps only, so an explicit shell value
+    // survives: see `cliHygieneEnv` for why the version has to hold still.
+    ...cliHygieneEnv()
   };
   if (opts?.effort) {
     env.CLAUDE_CODE_EFFORT_LEVEL = cliEffortLevel(opts.effort);
@@ -3396,9 +3411,10 @@ function finishBridge(input) {
     };
   }
   const body = JSON.stringify({ mcpServers: servers }, null, 2);
+  const bodyDigest = crypto2.createHash("sha256").update(body).digest("hex").slice(0, 12);
   const outPath = path3.join(
     pluginTmpDir(),
-    `mcp-${hash}.json`
+    `mcp-${bodyDigest}.json`
   );
   try {
     if (!fileExists(outPath)) {
@@ -4936,6 +4952,19 @@ function resolveClaude(cmd = "claude") {
 function encodeCwd(cwd) {
   return path7.resolve(cwd).replace(/[^a-zA-Z0-9]/g, "-");
 }
+function interactiveSpawnEnv(opts) {
+  return {
+    ...process.env,
+    CLAUDE_CONFIG_DIR: opts.configDir,
+    TERM: "xterm-256color",
+    // Pin the binary so a mid-session autoupdate cannot invalidate the
+    // detected version the flag gates read, and skip non-essential traffic.
+    // Fills gaps only, so a var the user exported survives untouched.
+    ...cliHygieneEnv(),
+    ...opts.ignoreAnthropicApiKey ? { ANTHROPIC_API_KEY: void 0, ANTHROPIC_AUTH_TOKEN: void 0 } : {},
+    ...opts.effort ? { CLAUDE_CODE_EFFORT_LEVEL: opts.effort } : {}
+  };
+}
 var TERMINAL_STOP = /* @__PURE__ */ new Set(["end_turn", "stop_sequence", "max_tokens"]);
 var delay = (ms) => new Promise((r) => setTimeout(r, ms));
 function resolveConfigDir(configDir) {
@@ -5022,13 +5051,13 @@ var ClaudeSession = class {
     this.lastDataAt = Date.now();
     this.proc = Bun.spawn([claude, ...args], {
       cwd: this.cwd,
-      env: {
-        ...process.env,
-        CLAUDE_CONFIG_DIR: this.o.configDir,
-        TERM: "xterm-256color",
-        ...this.o.ignoreAnthropicApiKey ? { ANTHROPIC_API_KEY: void 0, ANTHROPIC_AUTH_TOKEN: void 0 } : {},
-        ...this.o.effort ? { CLAUDE_CODE_EFFORT_LEVEL: this.o.effort } : {}
-      },
+      env: interactiveSpawnEnv({
+        // The resolved field, not `this.o.configDir`: same value (the
+        // constructor copies it in) but typed as always present.
+        configDir: this.configDir,
+        ignoreAnthropicApiKey: this.o.ignoreAnthropicApiKey,
+        effort: this.o.effort
+      }),
       terminal: {
         cols: this.o.cols,
         rows: this.o.rows,