@khalilgharbaoui/opencode-claude-code-plugin 0.49.0 → 0.50.0

package/dist/index.d.ts

@@ -404,6 +404,7 @@ interface ClaudeCodeConfig {
     mcpConfig?: string | string[];
     strictMcpConfig?: boolean;
     bridgeOpencodeMcp?: boolean;
+    bridgeMcpOauthTokens?: boolean;
     controlRequestBehavior?: ControlRequestBehavior;
     controlRequestToolBehaviors?: Record<string, ControlRequestBehavior>;
     controlRequestDenyMessage?: string;
@@ -586,6 +587,25 @@ interface ClaudeCodeProviderSettings {
      * the same MCP servers opencode is configured with.
      */
     bridgeOpencodeMcp?: boolean;
+    /**
+     * Give a bridged remote MCP server the OAuth bearer token opencode already
+     * holds for it, so the Claude CLI can use a server you authenticated
+     * through opencode's own OAuth flow instead of reporting it `needs-auth`
+     * for the whole session.
+     *
+     * **Off by default, and deliberately.** You authenticated that server to
+     * opencode; this copies the token into the private config file the plugin
+     * writes for a second program, which then lets a model drive calls with it.
+     * That is your decision rather than a default. Nothing is read from
+     * opencode's credential store unless this is `true`.
+     *
+     * opencode 1 only: opencode 2 keeps MCP credentials in its database behind
+     * a typed plugin domain rather than in the `mcp-auth.json` file this reads,
+     * so the option finds nothing there. A server with no usable token is
+     * bridged exactly as it is today, never dropped, and an `Authorization`
+     * header you set yourself always wins.
+     */
+    bridgeMcpOauthTokens?: boolean;
     /**
      * Behavior for Claude CLI `control_request` permission checks
      * (`subtype: can_use_tool`) when `skipPermissions` is false.
@@ -1388,6 +1408,17 @@ declare class ClaudeCodeLanguageModel implements LanguageModelV3 {
 }
 
 type McpHostApi = "v1" | "v2";
+/**
+ * How a bridge call reaches opencode's MCP OAuth store.
+ *
+ * `oauthTokens` is the `bridgeMcpOauthTokens` provider option and is false
+ * unless the operator set it. `stateDir` exists so a spec can point the read
+ * at a scratch directory; production callers never pass it.
+ */
+interface McpBridgeAuthOptions {
+    oauthTokens?: boolean;
+    stateDir?: string;
+}
 interface BridgedMcp {
     /** Path to the temp file containing the translated `--mcp-config`. */
     path: string;
@@ -1429,8 +1460,12 @@ type RuntimeMcpStatus = Record<string, string>;
  * translate each server to Claude CLI format, write a scratch file, and
  * return its path + a stable hash. Returns null when no enabled MCP servers
  * remain after the merge + overlay.
+ *
+ * @param stateDir  Override the opencode state directory (`~/.local/share/opencode`
+ *                  by default) where `mcp-auth.json` is read from. Exposed for
+ *                  testing; production callers should omit it.
  */
-declare function bridgeOpencodeMcp(cwd: string, runtimeStatus?: RuntimeMcpStatus, excludeServers?: ReadonlySet<string>, hostApi?: McpHostApi): BridgedMcp | null;
+declare function bridgeOpencodeMcp(cwd: string, runtimeStatus?: RuntimeMcpStatus, excludeServers?: ReadonlySet<string>, hostApi?: McpHostApi, auth?: McpBridgeAuthOptions): BridgedMcp | null;
 
 type AgentRecord = {
     mode?: string;