@oh-my-tool/cli 0.2.0 → 0.3.1

package/src/runtime/providers/mcp/safe-errors.ts

@@ -0,0 +1,63 @@
+import type { McpServerConfig } from "../../../config/config";
+import { RuntimeError } from "../../errors";
+
+export function redactMcpText(message: string, secretValues: readonly string[]): string {
+  return secretValues.reduce(
+    (result, value) => value.length === 0 ? result : result.split(value).join("[REDACTED]"),
+    message,
+  );
+}
+
+function sdkDetails(cause: unknown, secretValues: readonly string[]): string {
+  if (!(cause instanceof Error)) return "unknown MCP error";
+  const error = cause as Error & { code?: unknown };
+  const code = typeof error.code === "string" ? ` (${error.code})` : "";
+  return `${code} ${redactMcpText(cause.message, secretValues)}`.trim();
+}
+
+export function configuredMcpValues(config: McpServerConfig): string[] {
+  const runtimeConfig = config as unknown as { env?: unknown; headers?: unknown };
+  return [runtimeConfig.env, runtimeConfig.headers].flatMap((values) => {
+    if (values === null || typeof values !== "object" || Array.isArray(values)) return [];
+    return Object.values(values).filter((value): value is string => typeof value === "string");
+  });
+}
+
+export function mcpConnectionError(
+  serverId: string,
+  cause: unknown,
+  secretValues: readonly string[] = [],
+): RuntimeError {
+  return new RuntimeError(
+    "MCP_CONNECTION_FAILED",
+    `MCP server '${serverId}' connection failed: ${sdkDetails(cause, secretValues)}`,
+    undefined,
+    { cause },
+  );
+}
+
+export function mcpRequestError(
+  serverId: string,
+  operation: "tools/list" | "tools/call",
+  cause: unknown,
+  secretValues: readonly string[] = [],
+): RuntimeError {
+  const code = operation === "tools/list" ? "MCP_LIST_TOOLS_FAILED" : "MCP_CALL_FAILED";
+  return new RuntimeError(
+    code,
+    `MCP server '${serverId}' ${operation} failed: ${sdkDetails(cause, secretValues)}`,
+    undefined,
+    { cause },
+  );
+}
+
+export function normalizeMcpError(
+  serverId: string,
+  cause: unknown,
+  secretValues: readonly string[] = [],
+): RuntimeError {
+  if (!(cause instanceof RuntimeError)) return mcpConnectionError(serverId, cause, secretValues);
+  const message = redactMcpText(cause.message, secretValues);
+  if (message === cause.message) return cause;
+  return new RuntimeError(cause.code, message, cause.details, { cause: cause.cause ?? cause });
+}

package/src/runtime/providers/mcp/session.ts

@@ -0,0 +1,117 @@
+import { Client, type CallToolResult, type Tool } from "@modelcontextprotocol/client";
+import type { McpEnabledServerConfig } from "../../../config/config";
+import { VERSION } from "../../../version";
+import type { SecretStore } from "@oh-my-tool/sdk";
+import { RuntimeError } from "../../errors";
+import {
+  createMcpTransport,
+  type McpTransport,
+  type OAuthAuthProviderFactory,
+  McpTransportSetupError,
+} from "./transport";
+import { createMcpOAuthProvider } from "./oauth-provider";
+import {
+  configuredMcpValues,
+  mcpConnectionError,
+  mcpRequestError,
+} from "./safe-errors";
+
+export interface McpSession {
+  listTools(cursor?: string): Promise<{ tools: readonly Tool[]; nextCursor?: string }>;
+  callTool(name: string, args: Record<string, unknown>): Promise<CallToolResult>;
+  close(): Promise<void>;
+}
+
+export type McpSessionFactory = (serverId: string, config: McpEnabledServerConfig, secrets: SecretStore) => Promise<McpSession>;
+
+export interface McpClient {
+  connect(transport: McpTransport): Promise<void>;
+  listTools(params: { cursor?: string }): Promise<{ tools: Tool[]; nextCursor?: string }>;
+  callTool(params: { name: string; arguments: Record<string, unknown> }): Promise<CallToolResult>;
+  close(): Promise<void>;
+}
+
+export interface McpSessionDependencies {
+  clientVersion: string;
+  createClient(info: { name: string; version: string }): McpClient;
+  createTransport: typeof createMcpTransport;
+  oauthAuthProviderFactory?: OAuthAuthProviderFactory;
+}
+
+const defaults: McpSessionDependencies = {
+  clientVersion: VERSION,
+  createClient: (info) => new Client(info),
+  createTransport: createMcpTransport,
+  oauthAuthProviderFactory: (serverId, config, secrets) => createMcpOAuthProvider(serverId, config, secrets),
+};
+
+function isMissingSecretError(cause: unknown): cause is RuntimeError {
+  return cause instanceof RuntimeError && cause.code === "MCP_SECRET_NOT_FOUND";
+}
+
+function isPreservedOAuthError(cause: unknown): cause is RuntimeError {
+  return cause instanceof RuntimeError && (
+    cause.code === "MCP_AUTH_REQUIRED" || cause.code === "MCP_OAUTH_CREDENTIALS_INVALID"
+  );
+}
+
+async function closeQuietly(transport: McpTransport): Promise<void> {
+  try {
+    await transport.close();
+  } catch {
+    // The original MCP setup or connection error is more useful than cleanup failure.
+  }
+}
+
+export async function createMcpSession(
+  serverId: string,
+  config: McpEnabledServerConfig,
+  secrets: SecretStore,
+  dependencies: McpSessionDependencies = defaults,
+): Promise<McpSession> {
+  let client: McpClient;
+  try {
+    client = dependencies.createClient({ name: "oh-my-tool", version: dependencies.clientVersion });
+  } catch (cause) {
+    throw mcpConnectionError(serverId, cause, configuredMcpValues(config));
+  }
+  let connection;
+  try {
+    connection = await dependencies.createTransport(serverId, config, secrets, dependencies.oauthAuthProviderFactory);
+  } catch (cause) {
+    if (isMissingSecretError(cause) || isPreservedOAuthError(cause)) throw cause;
+    const setupCause = cause instanceof McpTransportSetupError ? cause.cause : cause;
+    const secretValues = cause instanceof McpTransportSetupError ? cause.secretValues : [];
+    throw mcpConnectionError(serverId, setupCause, [...configuredMcpValues(config), ...secretValues]);
+  }
+  const secretValues = [...configuredMcpValues(config), ...connection.secretValues];
+  try {
+    await client.connect(connection.transport);
+  } catch (cause) {
+    await closeQuietly(connection.transport);
+    if (isPreservedOAuthError(cause)) throw cause;
+    throw mcpConnectionError(serverId, cause, secretValues);
+  }
+  let closed = false;
+  return {
+    async listTools(cursor) {
+      try {
+        return await client.listTools({ ...(cursor === undefined ? {} : { cursor }) });
+      } catch (cause) {
+        throw mcpRequestError(serverId, "tools/list", cause, secretValues);
+      }
+    },
+    async callTool(name, args) {
+      try {
+        return await client.callTool({ name, arguments: args });
+      } catch (cause) {
+        throw mcpRequestError(serverId, "tools/call", cause, secretValues);
+      }
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      await client.close();
+    },
+  };
+}

package/src/runtime/providers/mcp/transport.ts

@@ -0,0 +1,140 @@
+import {
+  StreamableHTTPClientTransport,
+  type AuthProvider,
+  type OAuthClientProvider,
+  type Transport,
+} from "@modelcontextprotocol/client";
+import {
+  StdioClientTransport,
+  getDefaultEnvironment,
+  type StdioServerParameters,
+} from "@modelcontextprotocol/client/stdio";
+import type { McpEnabledServerConfig, McpHttpServerConfig } from "../../../config/config";
+import { RuntimeError } from "../../errors";
+import type { SecretStore } from "@oh-my-tool/sdk";
+
+export type McpTransport = Transport & { readonly kind?: "stdio" | "streamable-http"; readonly options?: Record<string, unknown> };
+
+export type OAuthMcpServerConfig = McpHttpServerConfig & { readonly auth: Extract<McpHttpServerConfig["auth"], { type: "oauth" }> };
+
+export type OAuthAuthProviderFactory = (
+  serverId: string,
+  config: OAuthMcpServerConfig,
+  secrets: SecretStore,
+) => Promise<AuthProvider | OAuthClientProvider>;
+
+export interface McpTransportDependencies {
+  getDefaultEnvironment(): Record<string, string>;
+  createStdioTransport(options: StdioServerParameters): McpTransport;
+  createHttpTransport(url: URL, options: { authProvider?: AuthProvider | OAuthClientProvider; requestInit: { headers: Record<string, string> } }): McpTransport;
+}
+
+export interface McpTransportConnection {
+  transport: McpTransport;
+  secretValues: readonly string[];
+}
+
+export class McpTransportSetupError extends Error {
+  constructor(public readonly cause: unknown, public readonly secretValues: readonly string[]) {
+    super(cause instanceof Error ? cause.message : "MCP transport setup failed", { cause });
+    this.name = "McpTransportSetupError";
+  }
+}
+
+const defaults: McpTransportDependencies = {
+  getDefaultEnvironment,
+  createStdioTransport: (options) => new StdioClientTransport(options),
+  createHttpTransport: (url, options) => new StreamableHTTPClientTransport(url, options),
+};
+
+function hasAuthorizationHeader(headers: Readonly<Record<string, string>>): boolean {
+  return Object.keys(headers).some((name) => name.toLowerCase() === "authorization");
+}
+
+function authProviderSecretValues(provider: AuthProvider | OAuthClientProvider): string[] {
+  const values = (provider as { readonly secretValues?: unknown }).secretValues;
+  return Array.isArray(values) && values.every((value) => typeof value === "string") ? [...values] : [];
+}
+
+async function requiredSecret(serverId: string, name: string, secrets: SecretStore): Promise<string> {
+  const value = await secrets.get(name);
+  if (value === undefined) {
+    throw new RuntimeError("MCP_SECRET_NOT_FOUND", `MCP server '${serverId}' requires missing secret '${name}'`);
+  }
+  return value;
+}
+
+function isPreservedOAuthSetupError(cause: unknown): cause is RuntimeError {
+  return cause instanceof RuntimeError && (
+    cause.code === "MCP_SECRET_NOT_FOUND" ||
+    cause.code === "MCP_AUTH_REQUIRED" ||
+    cause.code === "MCP_OAUTH_CREDENTIALS_INVALID"
+  );
+}
+
+export async function createMcpTransport(
+  serverId: string,
+  config: McpEnabledServerConfig,
+  secrets: SecretStore,
+  oauthAuthProviderFactory?: OAuthAuthProviderFactory,
+  dependencies: McpTransportDependencies = defaults,
+): Promise<McpTransportConnection> {
+  const transportKind = (config as { transport: string }).transport;
+  if (transportKind !== "stdio" && transportKind !== "streamable-http") {
+    throw new RuntimeError("MCP_UNSUPPORTED_TRANSPORT", `MCP server '${serverId}' has unsupported transport '${transportKind}'`);
+  }
+  if (config.transport === "stdio") {
+    const resolvedSecretEnv = Object.fromEntries(await Promise.all(
+      Object.entries(config.secretEnv).map(async ([name, secret]) => [name, await requiredSecret(serverId, secret, secrets)]),
+    )) as Record<string, string>;
+    const secretValues = Object.values(resolvedSecretEnv);
+    try {
+      return {
+        transport: dependencies.createStdioTransport({
+          command: config.command,
+          args: [...config.args],
+          cwd: config.cwd,
+          env: { ...dependencies.getDefaultEnvironment(), ...config.env, ...resolvedSecretEnv },
+          stderr: "pipe",
+        }),
+        secretValues,
+      };
+    } catch (cause) {
+      throw new McpTransportSetupError(cause, secretValues);
+    }
+  }
+
+  if (config.auth.type !== "none" && (hasAuthorizationHeader(config.headers) || hasAuthorizationHeader(config.secretHeaders))) {
+    throw new RuntimeError("MCP_INVALID_CONFIG", `MCP server '${serverId}' must not configure Authorization when ${config.auth.type} auth is enabled`);
+  }
+
+  const resolvedSecretHeaders = Object.fromEntries(await Promise.all(
+    Object.entries(config.secretHeaders).map(async ([name, secret]) => [name, await requiredSecret(serverId, secret, secrets)]),
+  )) as Record<string, string>;
+  const secretValues = [...Object.values(resolvedSecretHeaders)];
+  try {
+    let authProvider: AuthProvider | OAuthClientProvider | undefined;
+    if (config.auth.type === "bearer") {
+      const auth = config.auth;
+      const token = await requiredSecret(serverId, auth.tokenSecret, secrets);
+      secretValues.push(token);
+      authProvider = { token: () => secrets.get(auth.tokenSecret) };
+    } else if (config.auth.type === "oauth") {
+      if (!oauthAuthProviderFactory) {
+        throw new RuntimeError("MCP_OAUTH_PROVIDER_UNAVAILABLE", `MCP server '${serverId}' requires an OAuth auth provider`);
+      }
+      authProvider = await oauthAuthProviderFactory(serverId, config as OAuthMcpServerConfig, secrets);
+      secretValues.push(...authProviderSecretValues(authProvider));
+    }
+    return {
+      transport: dependencies.createHttpTransport(new URL(config.url), {
+        ...(authProvider === undefined ? {} : { authProvider }),
+        requestInit: { headers: { ...config.headers, ...resolvedSecretHeaders } },
+      }),
+      secretValues: [...Object.values(config.headers), ...secretValues],
+    };
+  } catch (cause) {
+    if (isPreservedOAuthSetupError(cause)) throw cause;
+    throw new McpTransportSetupError(cause, secretValues);
+  }
+}

package/src/runtime/providers/native/provider.ts

@@ -32,7 +32,7 @@ export class NativeExtensionProvider implements ToolProvider {
           risk: tool.risk ?? "read",
           inputSchema: tool.inputSchema,
           provider: { id: this.id, kind: this.kind },
-          source: { id: extension.manifest.id, kind: "extension" },
+          source: { id: extension.manifest.id, kind: "extension", version: extension.manifest.version },
         });
       }
     }

package/src/runtime/result.ts

@@ -8,5 +8,5 @@ export interface ExecutionResult {
   toolId: string;
   output?: unknown;
   meta?: Record<string, unknown>;
-  error?: { code: string; message: string };
+  error?: { code: string; message: string; details?: unknown };
 }

package/src/runtime/runtime.ts

@@ -19,7 +19,9 @@ interface RuntimeState {
 }
 
 export class ToolRuntime {
-  constructor(private readonly state: RuntimeState) {}
+  private closePromise?: Promise<void>;
+
+  constructor(private readonly state: RuntimeState, private readonly registeredProviders: readonly ToolProvider[] = []) {}
 
   search(query: string): Promise<ToolSearchResult[]> {
     return Promise.resolve(this.state.tools.search(query));
@@ -44,28 +46,52 @@ export class ToolRuntime {
       createExecutionContext: this.state.createExecutionContext,
     }, (input ?? {}) as Record<string, unknown>);
   }
+
+  close(): Promise<void> {
+    if (this.closePromise) return this.closePromise;
+    this.closePromise = (async () => {
+      const errors: unknown[] = [];
+      for (const provider of [...this.registeredProviders].reverse()) {
+        if (!provider.close) continue;
+        try { await provider.close(); } catch (error) { errors.push(error); }
+      }
+      if (errors.length > 0) throw errors[0];
+    })();
+    return this.closePromise;
+  }
+}
+
+async function closeProviders(providers: readonly ToolProvider[]): Promise<void> {
+  await Promise.allSettled([...providers].reverse().map(async (provider) => {
+    if (provider.close) await provider.close();
+  }));
 }
 
 export async function createToolRuntime(options: ToolRuntimeOptions): Promise<ToolRuntime> {
   const providers = new ProviderRegistry();
   const tools = new ToolRegistry();
-  for (const provider of options.providers) {
-    providers.register(provider);
-    const descriptors = await provider.listTools();
-    for (const descriptor of descriptors) {
-      if (descriptor.provider.id !== provider.id || descriptor.provider.kind !== provider.kind) {
-        throw new RuntimeError(
-          "PROVIDER_DESCRIPTOR_MISMATCH",
-          `tool '${descriptor.id}' does not identify provider '${provider.id}/${provider.kind}'`,
-        );
+  try {
+    for (const provider of options.providers) {
+      providers.register(provider);
+      const descriptors = await provider.listTools();
+      for (const descriptor of descriptors) {
+        if (descriptor.provider.id !== provider.id || descriptor.provider.kind !== provider.kind) {
+          throw new RuntimeError(
+            "PROVIDER_DESCRIPTOR_MISMATCH",
+            `tool '${descriptor.id}' does not identify provider '${provider.id}/${provider.kind}'`,
+          );
+        }
       }
+      tools.register(descriptors);
     }
-    tools.register(descriptors);
+  } catch (error) {
+    await closeProviders(options.providers);
+    throw error;
   }
   return new ToolRuntime({
     providers,
     tools,
     policy: options.policy,
     createExecutionContext: options.createExecutionContext,
-  });
+  }, options.providers);
 }

package/src/runtime/schema.ts

@@ -33,13 +33,23 @@ function checkType(value: unknown, schema: Schema, path: string): void {
   }
 }
 
-export function validateInput(schema: Schema | undefined, input: Record<string, unknown>): Record<string, unknown> {
+export interface ValidateInputOptions {
+  readonly applyDefaults?: boolean;
+}
+
+export function validateInput(
+  schema: Schema | undefined,
+  input: Record<string, unknown>,
+  options: ValidateInputOptions = {},
+): Record<string, unknown> {
   if (!schema) return { ...input };
   const out: Record<string, unknown> = { ...input };
   const props = schema.properties ?? {};
-  for (const key of Object.keys(props)) {
-    const prop = props[key];
-    if (out[key] === undefined && prop.default !== undefined) out[key] = prop.default;
+  if (options.applyDefaults !== false) {
+    for (const key of Object.keys(props)) {
+      const prop = props[key];
+      if (out[key] === undefined && prop.default !== undefined) out[key] = prop.default;
+    }
   }
   for (const key of schema.required ?? []) {
     if (out[key] === undefined || out[key] === null) throw new OmtError("INVALID_INPUT", `missing required field '${key}'`);

package/src/search/search.ts

@@ -1,78 +1,78 @@
-import type { ExtensionManifest } from "@oh-my-tool/sdk";
-
-export interface SearchHit {
-  name: string;
-  description: string;
-  extension: string;
-  risk: string;
-  score: number;
-}
-
-interface Searchable {
-  name: string;
-  description: string;
-  keywords: string[];
-  risk: string;
-  extension: string;
-  extName: string;
-}
-
-const NAME_WEIGHT = 3;
-const KEYWORD_WEIGHT = 2;
-const DESC_WEIGHT = 1;
-
-function toSearchable(ext: ExtensionManifest) {
-  const out: Searchable[] = [];
-  for (const tool of ext.tools) {
-    out.push({
-      name: tool.name.toLowerCase(),
-      description: tool.description.toLowerCase(),
-      keywords: (tool.keywords ?? []).map((k) => k.toLowerCase()),
-      risk: tool.risk ?? "read",
-      extension: ext.id,
-      extName: ext.name.toLowerCase(),
-    });
-  }
-  return out;
-}
-
-function bestWeight(s: Searchable, token: string): number {
-  if (s.name.includes(token)) return NAME_WEIGHT;
-  if (s.extName.includes(token)) return NAME_WEIGHT;
-  if (s.keywords.some((k) => k.includes(token) || token.includes(k))) {
-    return KEYWORD_WEIGHT;
-  }
-  if (s.description.includes(token)) return DESC_WEIGHT;
-  return 0;
-}
-
-export function searchTools(query: string, manifests: ExtensionManifest[]): SearchHit[] {
-  const tokens = query
-    .toLowerCase()
-    .split(/\s+/)
-    .filter((t) => t.length > 0);
-
-  if (tokens.length === 0) return [];
-
-  const hits: SearchHit[] = [];
-  for (const ext of manifests) {
-    for (const s of toSearchable(ext)) {
-      let score = 0;
-      for (const token of tokens) {
-        score += bestWeight(s, token);
-      }
-      if (score > 0) {
-        hits.push({
-          name: s.name,
-          description: s.description,
-          extension: s.extension,
-          risk: s.risk,
-          score,
-        });
-      }
-    }
-  }
-
-  hits.sort((a, b) => b.score - a.score);
-  return hits;
-}
+import type { ExtensionManifest } from "@oh-my-tool/sdk";
+
+export interface SearchHit {
+  name: string;
+  description: string;
+  extension: string;
+  risk: string;
+  score: number;
+}
+
+interface Searchable {
+  name: string;
+  description: string;
+  keywords: string[];
+  risk: string;
+  extension: string;
+  extName: string;
+}
+
+const NAME_WEIGHT = 3;
+const KEYWORD_WEIGHT = 2;
+const DESC_WEIGHT = 1;
+
+function toSearchable(ext: ExtensionManifest) {
+  const out: Searchable[] = [];
+  for (const tool of ext.tools) {
+    out.push({
+      name: tool.name.toLowerCase(),
+      description: tool.description.toLowerCase(),
+      keywords: (tool.keywords ?? []).map((k) => k.toLowerCase()),
+      risk: tool.risk ?? "read",
+      extension: ext.id,
+      extName: ext.name.toLowerCase(),
+    });
+  }
+  return out;
+}
+
+function bestWeight(s: Searchable, token: string): number {
+  if (s.name.includes(token)) return NAME_WEIGHT;
+  if (s.extName.includes(token)) return NAME_WEIGHT;
+  if (s.keywords.some((k) => k.includes(token) || token.includes(k))) {
+    return KEYWORD_WEIGHT;
+  }
+  if (s.description.includes(token)) return DESC_WEIGHT;
+  return 0;
+}
+
+export function searchTools(query: string, manifests: ExtensionManifest[]): SearchHit[] {
+  const tokens = query
+    .toLowerCase()
+    .split(/\s+/)
+    .filter((t) => t.length > 0);
+
+  if (tokens.length === 0) return [];
+
+  const hits: SearchHit[] = [];
+  for (const ext of manifests) {
+    for (const s of toSearchable(ext)) {
+      let score = 0;
+      for (const token of tokens) {
+        score += bestWeight(s, token);
+      }
+      if (score > 0) {
+        hits.push({
+          name: s.name,
+          description: s.description,
+          extension: s.extension,
+          risk: s.risk,
+          score,
+        });
+      }
+    }
+  }
+
+  hits.sort((a, b) => b.score - a.score);
+  return hits;
+}