@oh-my-tool/cli 0.3.0 → 0.3.2

package/package.json

@@ -1,9 +1,16 @@
 {
   "name": "@oh-my-tool/cli",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "type": "module",
   "description": "Oh My Tool CLI - local and enterprise tools for agents",
-  "keywords": ["ai", "agent", "cli", "tools", "extensions", "bun"],
+  "keywords": [
+    "ai",
+    "agent",
+    "cli",
+    "tools",
+    "extensions",
+    "bun"
+  ],
   "homepage": "https://github.com/oh-my-tool/oh-my-tool#readme",
   "repository": {
     "type": "git",
@@ -22,7 +29,7 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/client": "2.0.0",
-    "@oh-my-tool/sdk": "0.3.0",
+    "@oh-my-tool/sdk": "0.3.2",
     "open": "11.0.0"
   },
   "engines": {

package/src/cli/commands/connections.ts

@@ -0,0 +1,94 @@
+import { loadConfig } from "../../config/config";
+import { createPaths } from "../../paths";
+import { prepareHome } from "../../migration";
+import { withRuntime } from "../context";
+
+export interface ConnectionSummary {
+  extension: string;
+  name: string;
+  environment: string;
+  host: string;
+  port: number;
+  database: string;
+  username: string;
+  tls: boolean;
+  secretConfigured: boolean;
+}
+
+export interface ConnectionListResult {
+  connections: ConnectionSummary[];
+  count: number;
+}
+
+export interface ConnectionCheck {
+  extension: string;
+  name: string;
+  status: "ok" | "error" | "unsupported";
+  code?: string;
+  durationMs?: number;
+}
+
+export interface ConnectionCheckResult {
+  checks: ConnectionCheck[];
+  count: number;
+}
+
+export interface ConfigCheckResult {
+  valid: true;
+  connectionCount: number;
+  extensionCount: number;
+}
+
+async function configuredConnections(): Promise<ConnectionListResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  const connections = Object.entries(config.extensions)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .flatMap(([extension, value]) => Object.entries(value.connections)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([name, connection]) => ({
+        extension,
+        name,
+        environment: connection.environment,
+        host: connection.host,
+        port: connection.port,
+        database: connection.database,
+        username: connection.username,
+        tls: connection.tls,
+        secretConfigured: connection.secret.length > 0,
+      })));
+  return { connections, count: connections.length };
+}
+
+export async function runConnectionList(): Promise<ConnectionListResult> {
+  return configuredConnections();
+}
+
+export async function runConfigCheck(): Promise<ConfigCheckResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  return {
+    valid: true,
+    connectionCount: Object.values(config.extensions).reduce((count, extension) => count + Object.keys(extension.connections).length, 0),
+    extensionCount: Object.keys(config.extensions).length,
+  };
+}
+
+export async function runConnectionCheck(): Promise<ConnectionCheckResult> {
+  const list = await configuredConnections();
+  return withRuntime(async (runtime) => {
+    const checks: ConnectionCheck[] = [];
+    for (const connection of list.connections) {
+      const started = Date.now();
+      const result = await runtime.run(`${connection.extension}.ping`, { connection: connection.name });
+      checks.push(result.ok
+        ? { extension: connection.extension, name: connection.name, status: "ok", durationMs: Date.now() - started }
+        : result.error?.code === "TOOL_NOT_FOUND"
+          ? { extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED" }
+          : { extension: connection.extension, name: connection.name, status: "error", code: result.error?.code ?? "CHECK_FAILED", durationMs: Date.now() - started });
+    }
+    return { checks, count: checks.length };
+  }, { includeMcp: false });
+}

package/src/cli/commands/describe.ts

@@ -18,7 +18,7 @@ export async function runDescribe(toolName: string): Promise<DescribedTool> {
       risk: descriptor.risk,
       inputSchema: descriptor.inputSchema,
       extension: descriptor.source.id,
-      extensionVersion: "unknown",
+      extensionVersion: descriptor.source.version ?? "unknown",
     };
   });
 }

package/src/cli/commands/extension.ts

@@ -1,5 +1,5 @@
 import { discoverExtensions } from "../../extension/discovery";
-import { installLocalExtension, type InstalledRef } from "../../extension/install";
+import { installExtension, type InstalledRef } from "../../extension/install";
 import { homeDir } from "../context";
 
 export interface InstalledInfo {
@@ -19,6 +19,6 @@ export async function runExtensionList(): Promise<InstalledInfo[]> {
 }
 
 export async function runExtensionInstall(spec: string): Promise<InstalledRef> {
-  return installLocalExtension(homeDir(), spec);
+  return installExtension(homeDir(), spec);
 }
 

package/src/cli/commands/index.ts

@@ -5,4 +5,5 @@ export * from "./extension";
 export * from "./secret";
 export * from "./integrate";
 export * from "./mcp";
+export * from "./connections";
 

package/src/cli/commands/run.ts

@@ -19,7 +19,7 @@ export async function runTool(
       return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
     }
     return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
-  });
+  }, { targetTool: toolName });
 }
 
 function readStdinJson(): Promise<Record<string, unknown>> {
@@ -30,7 +30,12 @@ function readStdinJson(): Promise<Record<string, unknown>> {
     stdin.on("data", (chunk: string) => (data += chunk));
     stdin.on("end", () => {
       try {
-        resolve(JSON.parse(data));
+        const parsed: unknown = JSON.parse(data);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          reject(new Error("stdin JSON must be an object"));
+          return;
+        }
+        resolve(parsed as Record<string, unknown>);
       } catch (e) {
         reject(e);
       }

package/src/cli/context.ts

@@ -1,10 +1,11 @@
 import { createPaths } from "../paths";
 import { prepareHome } from "../migration";
-import { loadConfig, getConnectionConfig, type McpEnabledServerConfig } from "../config/config";
+import { loadConfig, getConnectionConfig, sanitizeExtensionConnections, type McpEnabledServerConfig } from "../config/config";
 import { SecretsManager } from "../secrets/secrets";
 import { applyLimits, validateConnectionInput } from "../policy/policy";
 import { NativeExtensionProvider } from "../runtime/providers/native/provider";
 import { McpProvider } from "../runtime/providers/mcp/provider";
+import { discoverExtensions } from "../extension/discovery";
 import { createToolRuntime } from "../runtime/runtime";
 import type { ToolDescriptor } from "../runtime/provider";
 
@@ -12,15 +13,24 @@ export function homeDir(): string {
   return createPaths().home;
 }
 
-export async function createRuntime() {
+export interface RuntimeOptions {
+  readonly includeMcp?: boolean;
+  readonly targetTool?: string;
+}
+
+export async function createRuntime(options: RuntimeOptions = {}) {
   const paths = createPaths();
   await prepareHome(paths);
   const config = loadConfig(paths.home);
   const secrets = new SecretsManager();
-  const providers = [new NativeExtensionProvider(paths), ...Object.entries(config.mcp.servers)
+  const extensionConnections = sanitizeExtensionConnections(config);
+  const nativeTarget = options.targetTool !== undefined && discoverExtensions(paths.home)
+    .some((extension) => extension.manifest.tools.some((tool) => tool.name === options.targetTool));
+  const mcpProviders = options.includeMcp === false || nativeTarget ? [] : Object.entries(config.mcp.servers)
     .sort(([a], [b]) => a.localeCompare(b))
     .filter((entry): entry is [string, McpEnabledServerConfig] => entry[1].enabled)
-    .map(([serverId, server]) => new McpProvider({ serverId, config: server, secrets }))];
+    .map(([serverId, server]) => new McpProvider({ serverId, config: server, secrets }));
+  const providers = [new NativeExtensionProvider(paths), ...mcpProviders];
   return createToolRuntime({
     providers,
     policy: {
@@ -42,15 +52,15 @@ export async function createRuntime() {
         : undefined;
       return {
         logger: { debug() {}, info() {}, warn() {}, error() {} },
-        config: (connection ?? {}) as Record<string, unknown>,
+        config: (connection ?? { connections: extensionConnections[extensionId] ?? {} }) as Record<string, unknown>,
         secrets,
       };
     },
   });
 }
 
-export async function withRuntime<T>(operation: (runtime: Awaited<ReturnType<typeof createRuntime>>) => Promise<T>): Promise<T> {
-  const runtime = await createRuntime();
+export async function withRuntime<T>(operation: (runtime: Awaited<ReturnType<typeof createRuntime>>) => Promise<T>, options: RuntimeOptions = {}): Promise<T> {
+  const runtime = await createRuntime(options);
   let operationFailed = false;
   try {
     return await operation(runtime);

package/src/cli/index.ts

@@ -14,17 +14,23 @@ import { AGENT_IDS } from "../integration";
 import { multiselect, isCancel } from "@clack/prompts";
 import { VERSION } from "../version";
 import { runMcpAuth, runMcpList, runMcpLogout } from "./commands/mcp";
+import { runConnectionList, runConnectionCheck, runConfigCheck } from "./commands/connections";
 import { RuntimeError } from "../runtime/errors";
+import { formatAiResult, formatJson, formatOutput, type OutputFormat } from "./output";
 
 const HELP = `Oh My Tool - local and enterprise tools for agents
 
 Usage:
   ohmytool search "<task>"                 search tools by intent
   ohmytool describe <tool>                 inspect a tool and its input schema
-  ohmytool run <tool> [key=value ...]      execute a tool
+  ohmytool run <tool> [key=value ...]      execute a tool (AI-friendly text by default)
   ohmytool run <tool> --stdin              execute with JSON from stdin
+  ohmytool run <tool> ... --json           output the machine-readable JSON result
+  ohmytool connection list                 list configured connections
+  ohmytool connection check                check MySQL/Redis connectivity
+  ohmytool config check                     validate configuration
   ohmytool extension list                  list installed extensions
-  ohmytool extension install <path>        install an extension from a local dir
+  ohmytool extension install <path|package> install a local or npm extension
   ohmytool secret set <name>               set a secret (interactive hidden prompt or stdin pipe)
   ohmytool secret list                     list secret names (Windows only, values never shown)
   ohmytool mcp list                       list configured MCP servers
@@ -95,7 +101,15 @@ function readSecretHidden(prompt: string): Promise<string> {
 }
 
 function print(v: unknown): void {
-  console.log(JSON.stringify(v, null, 2));
+  console.log(formatJson(v));
+}
+
+function outputFormat(parsed: ReturnType<typeof parseArgs>): OutputFormat {
+  const format = parsed.options.format ?? (parsed.options.json === "true" ? "json" : undefined);
+  if (format !== undefined && !["json", "text", "table", "csv"].includes(format)) {
+    throw new RuntimeError("INVALID_FORMAT", `unsupported output format '${format}'`);
+  }
+  return parsed.flags.includes("json") ? "json" : (format as OutputFormat | undefined) ?? "text";
 }
 
 function parseAgentIds(raw?: string): AgentId[] | undefined {
@@ -189,9 +203,15 @@ export interface CliDependencies {
 const defaultCliDependencies: CliDependencies = { runMcpAuth, runMcpLogout, runMcpList };
 
 export async function main(argv: string[], dependencies: CliDependencies = defaultCliDependencies): Promise<number> {
-  const parsed = parseArgs(argv);
-  const cmd = parsed.positional[0];
   try {
+    const parsed = parseArgs(argv);
+    const cmd = parsed.positional[0];
+    const allowedFlags = new Set(["help", "version", "json", "stdin", "yes", "dry-run", "force"]);
+    const allowedOptions = new Set(["format", "json", "agents"]);
+    const unknownFlag = parsed.flags.find((flag) => !allowedFlags.has(flag));
+    const unknownOption = Object.keys(parsed.options).find((option) => !allowedOptions.has(option));
+    if (unknownFlag) throw new RuntimeError("INVALID_ARGUMENT", `unknown option '--${unknownFlag}'`);
+    if (unknownOption) throw new RuntimeError("INVALID_ARGUMENT", `unknown option '--${unknownOption}'`);
     switch (cmd) {
       case "search": {
         const q = parsed.positional.slice(1).join(" ");
@@ -205,9 +225,30 @@ export async function main(argv: string[], dependencies: CliDependencies = defau
       case "run": {
         const tool = parsed.positional[1];
         const res = await runTool(tool, parsed.keyValues, parsed.flags.includes("stdin"));
-        print(res);
+        console.log(formatOutput(res, outputFormat(parsed)));
         return res.ok ? 0 : 1;
       }
+      case "connection": {
+        const action = parsed.positional[1];
+        if (action !== "list" && action !== "check") {
+          console.error("usage: ohmytool connection list | connection check");
+          return 1;
+        }
+        const result = action === "list" ? await runConnectionList() : await runConnectionCheck();
+        const wrapped = { ok: true as const, tool: `connection.${action}`, data: result, meta: {} };
+        console.log(formatOutput(wrapped, outputFormat(parsed)));
+        return 0;
+      }
+      case "config": {
+        if (parsed.positional[1] !== "check") {
+          console.error("usage: ohmytool config check");
+          return 1;
+        }
+        const result = await runConfigCheck();
+        const wrapped = { ok: true as const, tool: "config.check", data: result, meta: {} };
+        console.log(formatOutput(wrapped, outputFormat(parsed)));
+        return 0;
+      }
       case "secret": {
         const sub = parsed.positional[1];
         if (sub === "set") {

package/src/cli/output.ts

@@ -0,0 +1,165 @@
+import type { OmtResult } from "../core/result";
+
+export type OutputFormat = "text" | "json" | "table" | "csv";
+
+export function formatAiResult(result: OmtResult): string {
+  const lines = [`status: ${result.ok ? "ok" : "error"}`, `tool: ${result.tool}`];
+  if (!result.ok) {
+    lines.push("error:");
+    appendObject(lines, result.error, 2);
+    return lines.join("\n");
+  }
+
+  if (isRowsResult(result.data)) {
+    lines.push("rows:");
+    for (const row of result.data.rows) lines.push(formatRow(row));
+    lines.push(`row_count: ${result.data.rows.length}`);
+    if (result.data.truncated === true) lines.push("truncated: true");
+    appendMeta(lines, result.meta, new Set(["returnedRows"]), false);
+  } else {
+    lines.push("data:");
+    appendValue(lines, result.data, 2);
+    appendMeta(lines, result.meta);
+  }
+  return lines.join("\n");
+}
+
+export function formatJson(value: unknown): string {
+  const seen = new WeakSet<object>();
+  return JSON.stringify(value, (_key, entry) => {
+    if (typeof entry === "bigint") return String(entry);
+    if (entry !== null && typeof entry === "object") {
+      if (seen.has(entry)) return "[Circular]";
+      seen.add(entry);
+    }
+    return entry;
+  }, 2) ?? "null";
+}
+
+export function formatOutput(result: OmtResult, format: OutputFormat): string {
+  if (format === "json") return formatJson(result);
+  if (format === "csv" || format === "table") return formatDelimited(result, format === "csv" ? "," : "\t");
+  return formatAiResult(result);
+}
+
+function formatDelimited(result: OmtResult, delimiter: string): string {
+  if (!result.ok) return formatAiResult(result);
+  const rows = isRowsResult(result.data)
+    ? { columns: result.data.columns, rows: result.data.rows }
+    : findObjectArray(result.data);
+  if (!rows) return formatAiResult(result);
+  return [rows.columns, ...rows.rows].map((row) => row.map((value) => quoteDelimited(value, delimiter)).join(delimiter)).join("\n");
+}
+
+function findObjectArray(value: unknown): { columns: unknown[]; rows: unknown[][] } | undefined {
+  if (!isRecord(value)) return undefined;
+  for (const entry of Object.values(value)) {
+    if (!Array.isArray(entry) || !entry.every(isRecord)) continue;
+    const columns = [...new Set(entry.flatMap((item) => Object.keys(item)))];
+    return { columns, rows: entry.map((item) => columns.map((column) => item[column] ?? null)) };
+  }
+  return undefined;
+}
+
+function quoteDelimited(value: unknown, delimiter: string): string {
+  const text = value === null || value === undefined ? "" : typeof value === "string" ? value : formatInline(value);
+  return delimiter === "," && /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
+interface RowsResult {
+  columns: unknown[];
+  rows: unknown[][];
+  truncated?: boolean;
+}
+
+function isRowsResult(value: unknown): value is RowsResult {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value as { columns?: unknown; rows?: unknown };
+  return Array.isArray(candidate.columns) && Array.isArray(candidate.rows) && candidate.rows.every(Array.isArray);
+}
+
+function appendMeta(
+  lines: string[],
+  meta: Record<string, unknown> | undefined,
+  skip = new Set<string>(),
+  grouped = true,
+): void {
+  const entries = Object.entries(meta ?? {}).filter(([key]) => !skip.has(key));
+  if (entries.length === 0) return;
+  if (grouped) lines.push("meta:");
+  for (const [key, value] of entries) appendField(lines, key, value, grouped ? 2 : 0);
+}
+
+function appendValue(lines: string[], value: unknown, indent: number): void {
+  if (isRecord(value)) {
+    appendObject(lines, value, indent);
+    return;
+  }
+  lines.push(`${spaces(indent)}${formatInline(value)}`);
+}
+
+function appendObject(lines: string[], value: Record<string, unknown>, indent: number): void {
+  const entries = Object.entries(value);
+  if (entries.length === 0) {
+    lines.push(`${spaces(indent)}{}`);
+    return;
+  }
+  for (const [key, entry] of entries) appendField(lines, key, entry, indent);
+}
+
+function appendField(lines: string[], key: string, value: unknown, indent: number): void {
+  const prefix = `${spaces(indent)}${key}:`;
+  if (isRecord(value)) {
+    lines.push(prefix);
+    appendObject(lines, value, indent + 2);
+    return;
+  }
+  if (Array.isArray(value) && value.every(isRecord)) {
+    lines.push(prefix);
+    if (value.length === 0) {
+      lines.push(`${spaces(indent + 2)}[]`);
+      return;
+    }
+    for (const item of value) {
+      const entries = Object.entries(item);
+      if (entries.length === 0) {
+        lines.push(`${spaces(indent + 2)}- {}`);
+        continue;
+      }
+      const [firstKey, firstValue] = entries[0];
+      if (isRecord(firstValue)) {
+        lines.push(`${spaces(indent + 2)}- ${firstKey}:`);
+        appendObject(lines, firstValue, indent + 4);
+      } else {
+        lines.push(`${spaces(indent + 2)}- ${firstKey}: ${formatInline(firstValue)}`);
+      }
+      for (const [itemKey, itemValue] of entries.slice(1)) appendField(lines, itemKey, itemValue, indent + 4);
+    }
+    return;
+  }
+  lines.push(`${prefix} ${formatInline(value)}`);
+}
+
+function formatRow(row: unknown[], header = false): string {
+  return `[${row.map((value) => header && typeof value === "string" && /^[A-Za-z_][A-Za-z0-9_$]*$/.test(value)
+    ? value
+    : formatInline(value)).join(", ")}]`;
+}
+
+function formatInline(value: unknown): string {
+  if (value === undefined) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "bigint") return String(value);
+  if (value !== null && typeof value === "object") {
+    try { return JSON.stringify(value); } catch { return String(value); }
+  }
+  return String(value);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function spaces(count: number): string {
+  return " ".repeat(count);
+}

package/src/cli/parseArgs.ts

@@ -26,7 +26,9 @@ export function parseArgs(argv: string[]): ParsedArgs {
     } else {
       const eq = arg.indexOf("=");
       if (eq > 0) {
-        keyValues[arg.slice(0, eq)] = arg.slice(eq + 1);
+        const key = arg.slice(0, eq);
+        if (key in keyValues) throw new Error(`duplicate input key '${key}'`);
+        keyValues[key] = arg.slice(eq + 1);
       } else {
         positional.push(arg);
       }

package/src/config/config.ts

@@ -38,6 +38,37 @@ export interface Config {
 }
 
 function invalid(path: string, reason: string): never { throw new RuntimeError("MCP_INVALID_CONFIG", `${path}: ${reason}`); }
+function invalidConnection(path: string, reason: string): never { throw new RuntimeError("CONFIG_INVALID", `${path}: ${reason}`); }
+
+function parseConnection(extensionId: string, name: string, value: unknown): ConnectionConfig {
+  const path = `extensions.${extensionId}.connections.${name}`;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalidConnection(path, "must be a table");
+  const raw = value as Record<string, unknown>;
+  const stringField = (key: string, fallback = ""): string => {
+    const entry = raw[key];
+    if (entry === undefined) return fallback;
+    if (typeof entry !== "string") invalidConnection(`${path}.${key}`, "must be a string");
+    return entry;
+  };
+  const host = stringField("host");
+  if (host.trim().length === 0) invalidConnection(`${path}.host`, "must be a non-empty string");
+  const defaultPort = extensionId === "redis" ? 6379 : 3306;
+  const port = raw.port === undefined ? defaultPort : raw.port;
+  if (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535) {
+    invalidConnection(`${path}.port`, "must be an integer from 1 through 65535");
+  }
+  const tls = raw.tls === undefined ? false : raw.tls;
+  if (typeof tls !== "boolean") invalidConnection(`${path}.tls`, "must be a boolean");
+  return {
+    environment: stringField("environment"),
+    host,
+    port,
+    database: stringField("database"),
+    username: stringField("username"),
+    secret: stringField("secret"),
+    tls,
+  };
+}
 
 function parseStringMap(value: unknown, path: string): Record<string, string> {
   if (value === undefined) return {};
@@ -129,12 +160,18 @@ export function loadConfig(homeDir: string): Config {
   const parsed = Bun.TOML.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
   const extensions: Config["extensions"] = {};
   const extSection = parsed.extensions;
+  if (extSection !== undefined && (extSection === null || typeof extSection !== "object" || Array.isArray(extSection))) {
+    invalidConnection("extensions", "must be a table");
+  }
   if (extSection && typeof extSection === "object") for (const [extId, extVal] of Object.entries(extSection)) {
+    if (extVal === null || typeof extVal !== "object" || Array.isArray(extVal)) invalidConnection(`extensions.${extId}`, "must be a table");
     const connections: Record<string, ConnectionConfig> = {};
-    const connSection = (extVal as Record<string, any>)?.connections;
+    const connSection = (extVal as Record<string, unknown>).connections;
+    if (connSection !== undefined && (connSection === null || typeof connSection !== "object" || Array.isArray(connSection))) {
+      invalidConnection(`extensions.${extId}.connections`, "must be a table");
+    }
     if (connSection && typeof connSection === "object") for (const [name, rawConn] of Object.entries(connSection)) {
-      const rc = rawConn as Record<string, any>;
-      connections[name] = { environment: String(rc.environment ?? ""), host: String(rc.host ?? ""), port: Number(rc.port ?? 3306), database: String(rc.database ?? ""), username: String(rc.username ?? ""), secret: String(rc.secret ?? ""), tls: Boolean(rc.tls ?? false) };
+      connections[name] = parseConnection(extId, name, rawConn);
     }
     extensions[extId] = { connections };
   }
@@ -153,3 +190,18 @@ export function loadConfig(homeDir: string): Config {
 
 export function getConnectionConfig(cfg: Config, extensionId: string, connection: string): ConnectionConfig | undefined { return cfg.extensions[extensionId]?.connections[connection]; }
 export function listConnections(cfg: Config, extensionId: string): string[] { return Object.keys(cfg.extensions[extensionId]?.connections ?? {}); }
+
+export function sanitizeExtensionConnections(cfg: Config): Record<string, Record<string, Omit<ConnectionConfig, "secret"> & { secretConfigured: boolean }> > {
+  return Object.fromEntries(Object.entries(cfg.extensions).map(([extensionId, extension]) => [
+    extensionId,
+    Object.fromEntries(Object.entries(extension.connections).map(([name, connection]) => [name, {
+      environment: connection.environment,
+      host: connection.host,
+      port: connection.port,
+      database: connection.database,
+      username: connection.username,
+      tls: connection.tls,
+      secretConfigured: connection.secret.length > 0,
+    }])),
+  ]));
+}

package/src/core/executor.ts

@@ -1,7 +1,7 @@
 import type { Logger, SecretStore, ToolContext, ToolResult } from "@oh-my-tool/sdk";
 import { ToolError } from "@oh-my-tool/sdk";
 import type { Config } from "../config/config";
-import { getConnectionConfig } from "../config/config";
+import { getConnectionConfig, sanitizeExtensionConnections } from "../config/config";
 import { resolveTool, OmtError, type Registry } from "./registry";
 import { validateInput, type Schema } from "./schema";
 import { validateConnectionInput, applyLimits, PolicyError } from "../policy/policy";
@@ -53,7 +53,7 @@ export async function executeTool(
     const ctx: ToolContext = {
       toolName,
       logger: deps.logger ?? noopLogger,
-      config: (connectionCfg ?? {}) as Record<string, unknown>,
+      config: (connectionCfg ?? { connections: sanitizeExtensionConnections(deps.config)[extension.id] ?? {} }) as Record<string, unknown>,
       secrets: deps.secrets,
     };
 

package/src/extension/install.ts

@@ -1,24 +1,135 @@
-import { cp, mkdir, readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
 import { parseManifest, validateManifest, checkSdkCompatibility } from "./manifest";
 
+const execFile = promisify(execFileCallback);
+const EXACT_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const OFFICIAL_PACKAGE_RE = /^@oh-my-tool\/[a-z0-9][a-z0-9._-]*$/;
+const EXTENSION_ID_RE = /^[a-z0-9][a-z0-9_-]*$/;
+
 export interface InstalledRef {
   id: string;
   version: string;
   target: string;
 }
 
-export async function installLocalExtension(home: string, srcDir: string): Promise<InstalledRef> {
+export interface NpmExtensionSpec {
+  packageName: string;
+  npmSpec: string;
+  version?: string;
+}
+
+export class ExtensionInstallError extends Error {}
+
+export interface NpmInstallDependencies {
+  install(spec: string, tempDir: string): Promise<void>;
+}
+
+export function normalizeNpmExtensionSpec(spec: string): NpmExtensionSpec {
+  const trimmed = spec.trim();
+  if (!trimmed) throw new ExtensionInstallError("extension package name must not be empty");
+
+  let packageName = trimmed;
+  let version: string | undefined;
+  const separator = trimmed.startsWith("@") ? trimmed.lastIndexOf("@") : trimmed.indexOf("@");
+  if (separator > 0) {
+    packageName = trimmed.slice(0, separator);
+    version = trimmed.slice(separator + 1);
+    if (!EXACT_VERSION_RE.test(version)) {
+      throw new ExtensionInstallError("npm extension versions must be exact semver values, for example 0.3.1");
+    }
+  }
+
+  if (!trimmed.startsWith("@")) packageName = `@oh-my-tool/${packageName}`;
+  if (!OFFICIAL_PACKAGE_RE.test(packageName)) {
+    throw new ExtensionInstallError("only official @oh-my-tool extension packages are supported");
+  }
+  return { packageName, npmSpec: `${packageName}${version === undefined ? "" : `@${version}`}`, ...(version === undefined ? {} : { version }) };
+}
+
+async function installExtensionDirectory(home: string, srcDir: string, expectedPackage?: NpmExtensionSpec): Promise<InstalledRef> {
   const manifest = parseManifest(await readFile(join(srcDir, "omt.manifest.json"), "utf8"));
   validateManifest(manifest);
   checkSdkCompatibility(manifest.sdkVersion);
+  if (!EXTENSION_ID_RE.test(manifest.id)) throw new ExtensionInstallError(`invalid extension id '${manifest.id}'`);
+  if (expectedPackage !== undefined) {
+    const packageJson = JSON.parse(await readFile(join(srcDir, "package.json"), "utf8")) as { name?: unknown; version?: unknown };
+    if (packageJson.name !== expectedPackage.packageName) {
+      throw new ExtensionInstallError(`package manifest mismatch: expected '${expectedPackage.packageName}'`);
+    }
+    if (packageJson.version !== manifest.version) {
+      throw new ExtensionInstallError("package.json and omt.manifest.json versions do not match");
+    }
+    if (expectedPackage.version !== undefined && packageJson.version !== expectedPackage.version) {
+      throw new ExtensionInstallError(`npm package '${expectedPackage.npmSpec}' resolved to an unexpected version`);
+    }
+  }
   const target = join(home, "extensions", manifest.id, manifest.version);
   await mkdir(target, { recursive: true });
   // 显式 force:true：Bun 的 fs.cp 在带 filter 时默认覆盖失效（重装不更新旧文件）
   await cp(srcDir, target, {
     recursive: true,
     force: true,
-    filter: (s: string) => !s.includes("node_modules"),
+    filter: (s: string) => basename(s) !== "node_modules",
   });
   return { id: manifest.id, version: manifest.version, target };
-}
+}
+
+export async function installLocalExtension(home: string, srcDir: string): Promise<InstalledRef> {
+  return installExtensionDirectory(home, srcDir);
+}
+
+export async function installNpmExtension(
+  home: string,
+  spec: string,
+  dependencies: Partial<NpmInstallDependencies> = {},
+): Promise<InstalledRef> {
+  const normalized = normalizeNpmExtensionSpec(spec);
+  const temp = await mkdtemp(join(tmpdir(), "oh-my-tool-npm-"));
+  try {
+    await writeFile(join(temp, "package.json"), JSON.stringify({ private: true }), "utf8");
+    try {
+      if (dependencies.install !== undefined) {
+        await dependencies.install(normalized.npmSpec, temp);
+      } else {
+        await execFile("npm", [
+          "install",
+          "--prefix", temp,
+          "--ignore-scripts",
+          "--no-save",
+          "--no-package-lock",
+          "--omit=dev",
+          "--registry=https://registry.npmjs.org",
+          "--", normalized.npmSpec,
+        ], { timeout: 120_000, maxBuffer: 4 * 1024 * 1024 });
+      }
+    } catch {
+      throw new ExtensionInstallError(`failed to download npm extension '${normalized.npmSpec}'`);
+    }
+
+    const packageDir = join(temp, "node_modules", ...normalized.packageName.split("/"));
+    try {
+      await stat(packageDir);
+    } catch {
+      throw new ExtensionInstallError(`npm extension '${normalized.npmSpec}' was not installed`);
+    }
+    return await installExtensionDirectory(home, packageDir, normalized);
+  } finally {
+    await rm(temp, { recursive: true, force: true });
+  }
+}
+
+export async function installExtension(home: string, spec: string): Promise<InstalledRef> {
+  const candidate = resolve(spec);
+  let isLocal = false;
+  try {
+    await stat(join(candidate, "omt.manifest.json"));
+    isLocal = true;
+  } catch {
+    // Not a local extension directory; interpret the argument as an npm spec.
+  }
+  return isLocal ? installLocalExtension(home, candidate) : installNpmExtension(home, spec);
+}

package/src/extension/manifest.ts

@@ -20,12 +20,18 @@ export function parseManifest(raw: string): ExtensionManifest {
 }
 
 export function validateManifest(manifest: ExtensionManifest): void {
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(manifest.id)) {
+    throw new ManifestError("manifest 'id' must contain only lowercase letters, numbers, underscores, and hyphens");
+  }
   if (!manifest.name || typeof manifest.name !== "string") {
     throw new ManifestError("manifest must contain a string 'name'");
   }
   if (!manifest.version || typeof manifest.version !== "string") {
     throw new ManifestError("manifest must contain a string 'version'");
   }
+  if (!FULL_VERSION_RE.test(manifest.version)) {
+    throw new ManifestError(`invalid manifest version '${manifest.version}'`);
+  }
   if (!manifest.sdkVersion || typeof manifest.sdkVersion !== "string") {
     throw new ManifestError("manifest must contain a string 'sdkVersion'");
   }
@@ -112,4 +118,4 @@ export function validateHandlers(
       );
     }
   }
-}
+}

package/src/policy/policy.ts

@@ -75,7 +75,7 @@ export function assertReadOnly(sql: string): void {
     throw new PolicyError("only a single read-only statement is allowed");
   }
   const cleaned = stripLiteralsAndComments(sql);
-  if (FORBIDDEN.test(cleaned)) {
+  if (!/^(select|with|show|explain|describe|desc)\b/i.test(cleaned.trim()) || FORBIDDEN.test(cleaned) || /\bfor\s+update\b|\block\s+in\s+share\s+mode\b|\binto\s+(out|dump)file\b|\bload_file\s*\(/i.test(cleaned)) {
     throw new PolicyError("sql contains a non read-only statement");
   }
 }

package/src/runtime/provider.ts

@@ -8,7 +8,7 @@ export interface ToolDescriptor {
   risk: "read" | "write" | "admin";
   inputSchema?: Record<string, unknown>;
   provider: { id: string; kind: string };
-  source: { id: string; kind: string };
+  source: { id: string; kind: string; version?: string };
 }
 
 export type ToolSearchResult = Omit<ToolDescriptor, "inputSchema">;

package/src/runtime/providers/mcp/oauth-provider.ts

@@ -33,11 +33,13 @@ import {
 export interface McpOAuthProviderOptions {
   readonly redirectUrl?: URL;
   readonly interactive?: boolean;
+  readonly forceDynamicRegistration?: boolean;
 }
 
 export interface McpOAuthClientProvider extends OAuthClientProvider {
   readonly redirectUrl: URL;
   readonly secretValues: readonly string[];
+  readonly clientConfigurationFingerprint: string;
   authorizationUrl(): URL | undefined;
   authorizationState(): string | undefined;
   clearVerifier(): Promise<void>;
@@ -65,6 +67,7 @@ function oauthAuthRequired(serverId: string): RuntimeError {
 
 class PersistentMcpOAuthProvider implements McpOAuthClientProvider {
   readonly clientMetadata: OAuthClientMetadata;
+  readonly clientConfigurationFingerprint: string;
   private pendingAuthorizationUrl: URL | undefined;
   private pendingState: string | undefined;
 
@@ -85,6 +88,12 @@ class PersistentMcpOAuthProvider implements McpOAuthClientProvider {
       client_name: "Oh My Tool",
       ...(config.auth.scopes.length === 0 ? {} : { scope: config.auth.scopes.join(" ") }),
     };
+    this.clientConfigurationFingerprint = JSON.stringify({
+      redirectUrl: redirectUrl.toString(),
+      clientId: config.auth.clientId ?? null,
+      clientSecretConfigured: config.auth.clientSecretSecret !== undefined,
+      metadata: this.clientMetadata,
+    });
   }
 
   state(): string {
@@ -172,6 +181,9 @@ export async function createMcpOAuthProvider(
   const interactive = options.interactive ?? false;
   const store = createMcpOAuthStore(serverId, secrets);
   if (!interactive && await store.tokens() === undefined) throw oauthAuthRequired(serverId);
+  if (options.forceDynamicRegistration === true && config.auth.clientId === undefined) {
+    await store.clear("client");
+  }
   let preRegisteredClient: StoredOAuthClientInformation | undefined;
   const secretValues: string[] = [];
   if (config.auth.clientId !== undefined) {
@@ -191,7 +203,7 @@ export async function createMcpOAuthProvider(
       client_secret: clientSecret,
     };
   }
-  return new PersistentMcpOAuthProvider(
+  const provider = new PersistentMcpOAuthProvider(
     serverId,
     config,
     store,
@@ -200,6 +212,14 @@ export async function createMcpOAuthProvider(
     secretValues,
     interactive,
   );
+  const previousFingerprint = await store.clientConfiguration();
+  if (previousFingerprint !== provider.clientConfigurationFingerprint) {
+    if (previousFingerprint !== undefined) {
+      await store.clear("client");
+    }
+  }
+  await store.saveClientConfiguration(provider.clientConfigurationFingerprint);
+  return provider;
 }
 
 function oauthConfig(serverId: string, config: McpHttpServerConfig): OAuthMcpServerConfig {
@@ -287,6 +307,7 @@ export async function authorizeMcpServer(
     const activeProvider = await createMcpOAuthProvider(serverId, validated, secrets, {
       redirectUrl: callback.redirectUrl,
       interactive: true,
+      forceDynamicRegistration: true,
     });
     provider = activeProvider;
     firstClient = createClient({ name: "oh-my-tool", version: VERSION });

package/src/runtime/providers/mcp/oauth-store.ts

@@ -11,6 +11,8 @@ export interface McpOAuthStore {
   saveTokens(tokens: StoredOAuthTokens): Promise<void>;
   clientInformation(): Promise<StoredOAuthClientInformation | undefined>;
   saveClientInformation(info: StoredOAuthClientInformation): Promise<void>;
+  clientConfiguration(): Promise<string | undefined>;
+  saveClientConfiguration(fingerprint: string): Promise<void>;
   codeVerifier(): Promise<string | undefined>;
   saveCodeVerifier(value: string): Promise<void>;
   discoveryState(): Promise<OAuthDiscoveryState | undefined>;
@@ -19,13 +21,14 @@ export interface McpOAuthStore {
   clearAll(): Promise<void>;
 }
 
-type CredentialScope = "tokens" | "client" | "verifier" | "discovery";
+type CredentialScope = "tokens" | "client" | "client-config" | "verifier" | "discovery";
 
 function credentialNames(serverId: string): Record<CredentialScope, string> {
   const prefix = `mcp:${serverId}:oauth`;
   return {
     tokens: `${prefix}:tokens`,
     client: `${prefix}:client`,
+    "client-config": `${prefix}:client-config`,
     verifier: `${prefix}:verifier`,
     discovery: `${prefix}:discovery`,
   };
@@ -72,6 +75,14 @@ export class SecretMcpOAuthStore implements McpOAuthStore {
     return this.secrets.set(this.names.client, JSON.stringify(info));
   }
 
+  clientConfiguration(): Promise<string | undefined> {
+    return this.secrets.get(this.names["client-config"]);
+  }
+
+  saveClientConfiguration(fingerprint: string): Promise<void> {
+    return this.secrets.set(this.names["client-config"], fingerprint);
+  }
+
   codeVerifier(): Promise<string | undefined> {
     return this.secrets.get(this.names.verifier);
   }

package/src/runtime/providers/native/provider.ts

@@ -32,7 +32,7 @@ export class NativeExtensionProvider implements ToolProvider {
           risk: tool.risk ?? "read",
           inputSchema: tool.inputSchema,
           provider: { id: this.id, kind: this.kind },
-          source: { id: extension.manifest.id, kind: "extension" },
+          source: { id: extension.manifest.id, kind: "extension", version: extension.manifest.version },
         });
       }
     }

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.3.0";
+export const VERSION = "0.3.2";