@tanstack/ai-opencode 0.2.3 → 0.2.5

package/dist/esm/adapters/projection.js

@@ -1,83 +1,156 @@
-import { resolveGitSkillDir, isSecretRef } from "@tanstack/ai-sandbox";
+import { isSecretRef, resolveGitSkillDir } from "@tanstack/ai-sandbox";
+//#region src/adapters/projection.ts
+/**
+* OpenCode workspace projector — mirrors the Claude Code reference
+* implementation at `packages/ai-claude-code/src/adapters/projection.ts`.
+*
+* `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a
+* secret resolver, and a one-time marker path) via a capability. This adapter
+* reads it in `chatStream` setup and projects workspace inputs into OpenCode's
+* native format:
+*
+*   - MCP servers   → `opencode.json` at the workspace root (mcp section).
+*                     Written on EVERY call (never marker-gated) so rotated
+*                     secrets always re-apply.
+*   - gitSkill repos → OpenCode has no recognised skills directory; we
+*                      warn-and-skip rather than invent a path.
+*   - agentSkill    → no bare-name primitive in opencode; warn-and-skip.
+*   - plugins       → opencode has no `opencode plugin install` command;
+*                     warn-and-skip.
+*
+* The `opencode.json` mcp-section shape mirrors the `OPENCODE_CONFIG_CONTENT`
+* shape already used by the adapter's host-tool-bridge, ensuring both
+* mechanisms use the same server-entry schema:
+*
+*   ```json
+*   { "mcp": { "<name>": { "type": "remote", "url": "...", "enabled": true,
+*                           "headers": { ... } } } }
+*   ```
+*
+* OpenCode merges project-scoped `opencode.json` with its environment config,
+* so the workspace file coexists safely with the runtime `OPENCODE_CONFIG_CONTENT`
+* env written for the host-tool-bridge.
+*
+* External-convention caveat: the `opencode.json` location and the `remote`
+* MCP-entry shape are derived from the adapter's existing `OPENCODE_CONFIG_CONTENT`
+* usage. Where OpenCode has no clean primitive (gitSkill dir, agentSkill,
+* plugins) we no-op with a warning instead of fabricating a command.
+*/
+/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */
 function isBearerMarker(value) {
-  return typeof value === "object" && value !== null && isSecretRef(value.__bearerRef);
+	return typeof value === "object" && value !== null && isSecretRef(value.__bearerRef);
 }
+/**
+* Resolve a single MCP header value: a `SecretRef` resolves to its plaintext,
+* a `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string
+* is passed through unchanged.
+*/
 function resolveHeaderValue(value, resolveSecret) {
-  if (isSecretRef(value)) return resolveSecret(value);
-  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`;
-  return value;
+	if (isSecretRef(value)) return resolveSecret(value);
+	if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`;
+	return value;
 }
+/**
+* Build the `mcp` section of OpenCode's `opencode.json` from the
+* `{ kind: 'mcp' }` skills, resolving every header value (SecretRef / bearer
+* / string). Returns `undefined` when there are no MCP skills so the caller
+* can skip the write.
+*/
 function buildMcpSection(skills, resolveSecret) {
-  const mcp = {};
-  let count = 0;
-  for (const skill of skills) {
-    if (skill.kind !== "mcp") continue;
-    count += 1;
-    const headers = {};
-    const rawHeaders = skill.config.headers ?? {};
-    for (const [name, value] of Object.entries(rawHeaders)) {
-      headers[name] = resolveHeaderValue(value, resolveSecret);
-    }
-    const rawUrl = skill.config["url"];
-    const url = typeof rawUrl === "string" ? rawUrl : "";
-    mcp[skill.name] = { type: "remote", url, enabled: true, headers };
-  }
-  return count > 0 ? mcp : void 0;
+	const mcp = {};
+	let count = 0;
+	for (const skill of skills) {
+		if (skill.kind !== "mcp") continue;
+		count += 1;
+		const headers = {};
+		const rawHeaders = skill.config.headers ?? {};
+		for (const [name, value] of Object.entries(rawHeaders)) headers[name] = resolveHeaderValue(value, resolveSecret);
+		const rawUrl = skill.config["url"];
+		const url = typeof rawUrl === "string" ? rawUrl : "";
+		mcp[skill.name] = {
+			type: "remote",
+			url,
+			enabled: true,
+			headers
+		};
+	}
+	return count > 0 ? mcp : void 0;
 }
+/**
+* Write (or merge-update) `opencode.json` at the workspace root with the
+* project-scoped MCP servers, re-resolving every secret. Runs on EVERY
+* projection call (never marker-gated) so rotated secrets always re-apply.
+*
+* If `opencode.json` already exists (e.g. committed to the repo) we read it,
+* merge only the `mcp` key, and rewrite, preserving other settings. When there
+* are no MCP skills the write is skipped entirely.
+*/
 async function projectMcpServers(handle, projection) {
-  const mcpSection = buildMcpSection(
-    projection.skills,
-    projection.resolveSecret
-  );
-  if (mcpSection === void 0) return;
-  const target = `${projection.root}/opencode.json`;
-  let existing = {};
-  if (await handle.fs.exists(target)) {
-    try {
-      const raw = await handle.fs.read(target);
-      const parsed = JSON.parse(raw);
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-        existing = parsed;
-      }
-    } catch {
-    }
-  }
-  const merged = { ...existing, mcp: mcpSection };
-  await handle.fs.write(target, JSON.stringify(merged, null, 2));
+	const mcpSection = buildMcpSection(projection.skills, projection.resolveSecret);
+	if (mcpSection === void 0) return;
+	const target = `${projection.root}/opencode.json`;
+	let existing = {};
+	if (await handle.fs.exists(target)) try {
+		const raw = await handle.fs.read(target);
+		const parsed = JSON.parse(raw);
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) existing = parsed;
+	} catch {}
+	const merged = {
+		...existing,
+		mcp: mcpSection
+	};
+	await handle.fs.write(target, JSON.stringify(merged, null, 2));
 }
+/**
+* OpenCode has no recognised skills directory where we can drop gitSkill repos.
+* AGENTS.md is already handled by the bootstrap layer (OpenCode reads it
+* natively). We warn-and-skip instead of inventing a path.
+*/
 function projectGitSkills(projection) {
-  for (const skill of projection.skills) {
-    if (skill.kind !== "git") continue;
-    const dir = skill.into ?? resolveGitSkillDir(projection.root, skill);
-    console.warn(
-      `[opencode] gitSkill "${skill.repo}" cloned to ${dir} but OpenCode has no recognised skills directory to link it into. The skill is available at that path — add an AGENTS.md reference to it manually if needed. Skipping.`
-    );
-  }
+	for (const skill of projection.skills) {
+		if (skill.kind !== "git") continue;
+		const dir = skill.into ?? resolveGitSkillDir(projection.root, skill);
+		console.warn(`[opencode] gitSkill "${skill.repo}" cloned to ${dir} but OpenCode has no recognised skills directory to link it into. The skill is available at that path — add an AGENTS.md reference to it manually if needed. Skipping.`);
+	}
 }
+/**
+* `agentSkill` references a public skill by bare name. OpenCode has no command
+* to fetch a skill from a bare name, so we warn and skip.
+*/
 function projectAgentSkills(projection) {
-  for (const skill of projection.skills) {
-    if (skill.kind !== "agent-skill") continue;
-    console.warn(
-      `[opencode] agentSkill "${skill.name}" cannot be projected: OpenCode has no command to install a public skill by bare name. Provide it as a gitSkill instead. Skipping.`
-    );
-  }
+	for (const skill of projection.skills) {
+		if (skill.kind !== "agent-skill") continue;
+		console.warn(`[opencode] agentSkill "${skill.name}" cannot be projected: OpenCode has no command to install a public skill by bare name. Provide it as a gitSkill instead. Skipping.`);
+	}
 }
+/**
+* OpenCode has no plugin install command. We warn-and-skip each declared plugin
+* rather than fabricating a command.
+*/
 function projectPlugins(projection) {
-  for (const name of projection.plugins) {
-    console.warn(
-      `[opencode] plugin "${name}" cannot be installed: OpenCode has no plugin install command. Skipping.`
-    );
-  }
+	for (const name of projection.plugins) console.warn(`[opencode] plugin "${name}" cannot be installed: OpenCode has no plugin install command. Skipping.`);
 }
+/**
+* Project a `WorkspaceProjection` into the OpenCode sandbox. Safe to call on
+* every `chatStream`. The secret-bearing `opencode.json` mcp section is
+* (re)written on every call, re-resolving secrets, so OpenCode always reads
+* current values and a snapshot can never serve a stale or rotated secret.
+* The safe, idempotent, non-secret operations (gitSkill, agentSkill, plugins
+* — all warn-and-skip for OpenCode) are guarded by a one-time marker so they
+* produce at most one warning per sandbox lifetime.
+*
+* @param handle     - The sandbox handle (`fs` + `process`).
+* @param projection - The portable workspace inputs from `withSandbox`.
+*/
 async function projectOpencodeWorkspace(handle, projection) {
-  await projectMcpServers(handle, projection);
-  if (await handle.fs.exists(projection.markerPath)) return;
-  projectGitSkills(projection);
-  projectAgentSkills(projection);
-  projectPlugins(projection);
-  await handle.fs.write(projection.markerPath, "");
+	await projectMcpServers(handle, projection);
+	if (await handle.fs.exists(projection.markerPath)) return;
+	projectGitSkills(projection);
+	projectAgentSkills(projection);
+	projectPlugins(projection);
+	await handle.fs.write(projection.markerPath, "");
 }
-export {
-  projectOpencodeWorkspace
-};
-//# sourceMappingURL=projection.js.map
+//#endregion
+export { projectOpencodeWorkspace };
+
+//# sourceMappingURL=projection.js.map

package/dist/esm/adapters/projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"projection.js","sources":["../../../src/adapters/projection.ts"],"sourcesContent":["/**\n * OpenCode workspace projector — mirrors the Claude Code reference\n * implementation at `packages/ai-claude-code/src/adapters/projection.ts`.\n *\n * `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a\n * secret resolver, and a one-time marker path) via a capability. This adapter\n * reads it in `chatStream` setup and projects workspace inputs into OpenCode's\n * native format:\n *\n *   - MCP servers   → `opencode.json` at the workspace root (mcp section).\n *                     Written on EVERY call (never marker-gated) so rotated\n *                     secrets always re-apply.\n *   - gitSkill repos → OpenCode has no recognised skills directory; we\n *                      warn-and-skip rather than invent a path.\n *   - agentSkill    → no bare-name primitive in opencode; warn-and-skip.\n *   - plugins       → opencode has no `opencode plugin install` command;\n *                     warn-and-skip.\n *\n * The `opencode.json` mcp-section shape mirrors the `OPENCODE_CONFIG_CONTENT`\n * shape already used by the adapter's host-tool-bridge, ensuring both\n * mechanisms use the same server-entry schema:\n *\n *   ```json\n *   { \"mcp\": { \"<name>\": { \"type\": \"remote\", \"url\": \"...\", \"enabled\": true,\n *                           \"headers\": { ... } } } }\n *   ```\n *\n * OpenCode merges project-scoped `opencode.json` with its environment config,\n * so the workspace file coexists safely with the runtime `OPENCODE_CONFIG_CONTENT`\n * env written for the host-tool-bridge.\n *\n * External-convention caveat: the `opencode.json` location and the `remote`\n * MCP-entry shape are derived from the adapter's existing `OPENCODE_CONFIG_CONTENT`\n * usage. Where OpenCode has no clean primitive (gitSkill dir, agentSkill,\n * plugins) we no-op with a warning instead of fabricating a command.\n */\nimport { isSecretRef, resolveGitSkillDir } from '@tanstack/ai-sandbox'\nimport type {\n  BearerRef,\n  SandboxHandle,\n  SecretRef,\n  WorkspaceProjection,\n  WorkspaceSkill,\n} from '@tanstack/ai-sandbox'\n\n/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */\nfunction isBearerMarker(value: unknown): value is BearerRef {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    isSecretRef((value as { __bearerRef?: unknown }).__bearerRef)\n  )\n}\n\n/**\n * Resolve a single MCP header value: a `SecretRef` resolves to its plaintext,\n * a `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string\n * is passed through unchanged.\n */\nfunction resolveHeaderValue(\n  value: string | SecretRef | BearerRef,\n  resolveSecret: (ref: SecretRef) => string,\n): string {\n  if (isSecretRef(value)) return resolveSecret(value)\n  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`\n  return value\n}\n\n/** An OpenCode `remote`-type MCP server entry (mirrors OPENCODE_CONFIG_CONTENT shape). */\ninterface OpencodeMcpServer {\n  type: 'remote'\n  url: string\n  enabled: boolean\n  headers: Record<string, string>\n}\n\n/**\n * Build the `mcp` section of OpenCode's `opencode.json` from the\n * `{ kind: 'mcp' }` skills, resolving every header value (SecretRef / bearer\n * / string). Returns `undefined` when there are no MCP skills so the caller\n * can skip the write.\n */\nfunction buildMcpSection(\n  skills: Array<WorkspaceSkill>,\n  resolveSecret: (ref: SecretRef) => string,\n): Record<string, OpencodeMcpServer> | undefined {\n  const mcp: Record<string, OpencodeMcpServer> = {}\n  let count = 0\n  for (const skill of skills) {\n    if (skill.kind !== 'mcp') continue\n    count += 1\n    const headers: Record<string, string> = {}\n    const rawHeaders = skill.config.headers ?? {}\n    for (const [name, value] of Object.entries(rawHeaders)) {\n      headers[name] = resolveHeaderValue(value, resolveSecret)\n    }\n    const rawUrl = skill.config['url']\n    const url = typeof rawUrl === 'string' ? rawUrl : ''\n    mcp[skill.name] = { type: 'remote', url, enabled: true, headers }\n  }\n  return count > 0 ? mcp : undefined\n}\n\n/**\n * Write (or merge-update) `opencode.json` at the workspace root with the\n * project-scoped MCP servers, re-resolving every secret. Runs on EVERY\n * projection call (never marker-gated) so rotated secrets always re-apply.\n *\n * If `opencode.json` already exists (e.g. committed to the repo) we read it,\n * merge only the `mcp` key, and rewrite, preserving other settings. When there\n * are no MCP skills the write is skipped entirely.\n */\nasync function projectMcpServers(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const mcpSection = buildMcpSection(\n    projection.skills,\n    projection.resolveSecret,\n  )\n  if (mcpSection === undefined) return\n\n  const target = `${projection.root}/opencode.json`\n\n  // Read the existing file if present so we can preserve non-mcp settings.\n  let existing: Record<string, unknown> = {}\n  if (await handle.fs.exists(target)) {\n    try {\n      const raw = await handle.fs.read(target)\n      const parsed: unknown = JSON.parse(raw)\n      if (\n        typeof parsed === 'object' &&\n        parsed !== null &&\n        !Array.isArray(parsed)\n      ) {\n        existing = parsed as Record<string, unknown>\n      }\n    } catch {\n      // Unreadable or invalid JSON — start fresh so the MCP config lands cleanly.\n    }\n  }\n\n  const merged = { ...existing, mcp: mcpSection }\n  await handle.fs.write(target, JSON.stringify(merged, null, 2))\n}\n\n/**\n * OpenCode has no recognised skills directory where we can drop gitSkill repos.\n * AGENTS.md is already handled by the bootstrap layer (OpenCode reads it\n * natively). We warn-and-skip instead of inventing a path.\n */\nfunction projectGitSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'git') continue\n    const dir = skill.into ?? resolveGitSkillDir(projection.root, skill)\n    console.warn(\n      `[opencode] gitSkill \"${skill.repo}\" cloned to ${dir} but OpenCode has no ` +\n        'recognised skills directory to link it into. The skill is available at that ' +\n        'path — add an AGENTS.md reference to it manually if needed. Skipping.',\n    )\n  }\n}\n\n/**\n * `agentSkill` references a public skill by bare name. OpenCode has no command\n * to fetch a skill from a bare name, so we warn and skip.\n */\nfunction projectAgentSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'agent-skill') continue\n    console.warn(\n      `[opencode] agentSkill \"${skill.name}\" cannot be projected: OpenCode has no ` +\n        'command to install a public skill by bare name. Provide it as a gitSkill ' +\n        'instead. Skipping.',\n    )\n  }\n}\n\n/**\n * OpenCode has no plugin install command. We warn-and-skip each declared plugin\n * rather than fabricating a command.\n */\nfunction projectPlugins(projection: WorkspaceProjection): void {\n  for (const name of projection.plugins) {\n    console.warn(\n      `[opencode] plugin \"${name}\" cannot be installed: OpenCode has no plugin ` +\n        'install command. Skipping.',\n    )\n  }\n}\n\n/**\n * Project a `WorkspaceProjection` into the OpenCode sandbox. Safe to call on\n * every `chatStream`. The secret-bearing `opencode.json` mcp section is\n * (re)written on every call, re-resolving secrets, so OpenCode always reads\n * current values and a snapshot can never serve a stale or rotated secret.\n * The safe, idempotent, non-secret operations (gitSkill, agentSkill, plugins\n * — all warn-and-skip for OpenCode) are guarded by a one-time marker so they\n * produce at most one warning per sandbox lifetime.\n *\n * @param handle     - The sandbox handle (`fs` + `process`).\n * @param projection - The portable workspace inputs from `withSandbox`.\n */\nexport async function projectOpencodeWorkspace(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  // Always re-resolve and rewrite the secret-bearing MCP config so rotated\n  // secrets re-apply and snapshots can't serve stale values.\n  await projectMcpServers(handle, projection)\n\n  // Gate only the safe, idempotent, non-secret operations on the marker.\n  if (await handle.fs.exists(projection.markerPath)) return\n\n  projectGitSkills(projection)\n  projectAgentSkills(projection)\n  projectPlugins(projection)\n\n  await handle.fs.write(projection.markerPath, '')\n}\n"],"names":[],"mappings":";AA8CA,SAAS,eAAe,OAAoC;AAC1D,SACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAa,MAAoC,WAAW;AAEhE;AAOA,SAAS,mBACP,OACA,eACQ;AACR,MAAI,YAAY,KAAK,EAAG,QAAO,cAAc,KAAK;AAClD,MAAI,eAAe,KAAK,EAAG,QAAO,UAAU,cAAc,MAAM,WAAW,CAAC;AAC5E,SAAO;AACT;AAgBA,SAAS,gBACP,QACA,eAC+C;AAC/C,QAAM,MAAyC,CAAA;AAC/C,MAAI,QAAQ;AACZ,aAAW,SAAS,QAAQ;AAC1B,QAAI,MAAM,SAAS,MAAO;AAC1B,aAAS;AACT,UAAM,UAAkC,CAAA;AACxC,UAAM,aAAa,MAAM,OAAO,WAAW,CAAA;AAC3C,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACtD,cAAQ,IAAI,IAAI,mBAAmB,OAAO,aAAa;AAAA,IACzD;AACA,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAM,MAAM,OAAO,WAAW,WAAW,SAAS;AAClD,QAAI,MAAM,IAAI,IAAI,EAAE,MAAM,UAAU,KAAK,SAAS,MAAM,QAAA;AAAA,EAC1D;AACA,SAAO,QAAQ,IAAI,MAAM;AAC3B;AAWA,eAAe,kBACb,QACA,YACe;AACf,QAAM,aAAa;AAAA,IACjB,WAAW;AAAA,IACX,WAAW;AAAA,EAAA;AAEb,MAAI,eAAe,OAAW;AAE9B,QAAM,SAAS,GAAG,WAAW,IAAI;AAGjC,MAAI,WAAoC,CAAA;AACxC,MAAI,MAAM,OAAO,GAAG,OAAO,MAAM,GAAG;AAClC,QAAI;AACF,YAAM,MAAM,MAAM,OAAO,GAAG,KAAK,MAAM;AACvC,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UACE,OAAO,WAAW,YAClB,WAAW,QACX,CAAC,MAAM,QAAQ,MAAM,GACrB;AACA,mBAAW;AAAA,MACb;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,SAAS,EAAE,GAAG,UAAU,KAAK,WAAA;AACnC,QAAM,OAAO,GAAG,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC/D;AAOA,SAAS,iBAAiB,YAAuC;AAC/D,aAAW,SAAS,WAAW,QAAQ;AACrC,QAAI,MAAM,SAAS,MAAO;AAC1B,UAAM,MAAM,MAAM,QAAQ,mBAAmB,WAAW,MAAM,KAAK;AACnE,YAAQ;AAAA,MACN,wBAAwB,MAAM,IAAI,eAAe,GAAG;AAAA,IAAA;AAAA,EAIxD;AACF;AAMA,SAAS,mBAAmB,YAAuC;AACjE,aAAW,SAAS,WAAW,QAAQ;AACrC,QAAI,MAAM,SAAS,cAAe;AAClC,YAAQ;AAAA,MACN,0BAA0B,MAAM,IAAI;AAAA,IAAA;AAAA,EAIxC;AACF;AAMA,SAAS,eAAe,YAAuC;AAC7D,aAAW,QAAQ,WAAW,SAAS;AACrC,YAAQ;AAAA,MACN,sBAAsB,IAAI;AAAA,IAAA;AAAA,EAG9B;AACF;AAcA,eAAsB,yBACpB,QACA,YACe;AAGf,QAAM,kBAAkB,QAAQ,UAAU;AAG1C,MAAI,MAAM,OAAO,GAAG,OAAO,WAAW,UAAU,EAAG;AAEnD,mBAAiB,UAAU;AAC3B,qBAAmB,UAAU;AAC7B,iBAAe,UAAU;AAEzB,QAAM,OAAO,GAAG,MAAM,WAAW,YAAY,EAAE;AACjD;"}
+{"version":3,"file":"projection.js","names":[],"sources":["../../../src/adapters/projection.ts"],"sourcesContent":["/**\n * OpenCode workspace projector — mirrors the Claude Code reference\n * implementation at `packages/ai-claude-code/src/adapters/projection.ts`.\n *\n * `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a\n * secret resolver, and a one-time marker path) via a capability. This adapter\n * reads it in `chatStream` setup and projects workspace inputs into OpenCode's\n * native format:\n *\n *   - MCP servers   → `opencode.json` at the workspace root (mcp section).\n *                     Written on EVERY call (never marker-gated) so rotated\n *                     secrets always re-apply.\n *   - gitSkill repos → OpenCode has no recognised skills directory; we\n *                      warn-and-skip rather than invent a path.\n *   - agentSkill    → no bare-name primitive in opencode; warn-and-skip.\n *   - plugins       → opencode has no `opencode plugin install` command;\n *                     warn-and-skip.\n *\n * The `opencode.json` mcp-section shape mirrors the `OPENCODE_CONFIG_CONTENT`\n * shape already used by the adapter's host-tool-bridge, ensuring both\n * mechanisms use the same server-entry schema:\n *\n *   ```json\n *   { \"mcp\": { \"<name>\": { \"type\": \"remote\", \"url\": \"...\", \"enabled\": true,\n *                           \"headers\": { ... } } } }\n *   ```\n *\n * OpenCode merges project-scoped `opencode.json` with its environment config,\n * so the workspace file coexists safely with the runtime `OPENCODE_CONFIG_CONTENT`\n * env written for the host-tool-bridge.\n *\n * External-convention caveat: the `opencode.json` location and the `remote`\n * MCP-entry shape are derived from the adapter's existing `OPENCODE_CONFIG_CONTENT`\n * usage. Where OpenCode has no clean primitive (gitSkill dir, agentSkill,\n * plugins) we no-op with a warning instead of fabricating a command.\n */\nimport { isSecretRef, resolveGitSkillDir } from '@tanstack/ai-sandbox'\nimport type {\n  BearerRef,\n  SandboxHandle,\n  SecretRef,\n  WorkspaceProjection,\n  WorkspaceSkill,\n} from '@tanstack/ai-sandbox'\n\n/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */\nfunction isBearerMarker(value: unknown): value is BearerRef {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    isSecretRef((value as { __bearerRef?: unknown }).__bearerRef)\n  )\n}\n\n/**\n * Resolve a single MCP header value: a `SecretRef` resolves to its plaintext,\n * a `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string\n * is passed through unchanged.\n */\nfunction resolveHeaderValue(\n  value: string | SecretRef | BearerRef,\n  resolveSecret: (ref: SecretRef) => string,\n): string {\n  if (isSecretRef(value)) return resolveSecret(value)\n  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`\n  return value\n}\n\n/** An OpenCode `remote`-type MCP server entry (mirrors OPENCODE_CONFIG_CONTENT shape). */\ninterface OpencodeMcpServer {\n  type: 'remote'\n  url: string\n  enabled: boolean\n  headers: Record<string, string>\n}\n\n/**\n * Build the `mcp` section of OpenCode's `opencode.json` from the\n * `{ kind: 'mcp' }` skills, resolving every header value (SecretRef / bearer\n * / string). Returns `undefined` when there are no MCP skills so the caller\n * can skip the write.\n */\nfunction buildMcpSection(\n  skills: Array<WorkspaceSkill>,\n  resolveSecret: (ref: SecretRef) => string,\n): Record<string, OpencodeMcpServer> | undefined {\n  const mcp: Record<string, OpencodeMcpServer> = {}\n  let count = 0\n  for (const skill of skills) {\n    if (skill.kind !== 'mcp') continue\n    count += 1\n    const headers: Record<string, string> = {}\n    const rawHeaders = skill.config.headers ?? {}\n    for (const [name, value] of Object.entries(rawHeaders)) {\n      headers[name] = resolveHeaderValue(value, resolveSecret)\n    }\n    const rawUrl = skill.config['url']\n    const url = typeof rawUrl === 'string' ? rawUrl : ''\n    mcp[skill.name] = { type: 'remote', url, enabled: true, headers }\n  }\n  return count > 0 ? mcp : undefined\n}\n\n/**\n * Write (or merge-update) `opencode.json` at the workspace root with the\n * project-scoped MCP servers, re-resolving every secret. Runs on EVERY\n * projection call (never marker-gated) so rotated secrets always re-apply.\n *\n * If `opencode.json` already exists (e.g. committed to the repo) we read it,\n * merge only the `mcp` key, and rewrite, preserving other settings. When there\n * are no MCP skills the write is skipped entirely.\n */\nasync function projectMcpServers(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const mcpSection = buildMcpSection(\n    projection.skills,\n    projection.resolveSecret,\n  )\n  if (mcpSection === undefined) return\n\n  const target = `${projection.root}/opencode.json`\n\n  // Read the existing file if present so we can preserve non-mcp settings.\n  let existing: Record<string, unknown> = {}\n  if (await handle.fs.exists(target)) {\n    try {\n      const raw = await handle.fs.read(target)\n      const parsed: unknown = JSON.parse(raw)\n      if (\n        typeof parsed === 'object' &&\n        parsed !== null &&\n        !Array.isArray(parsed)\n      ) {\n        existing = parsed as Record<string, unknown>\n      }\n    } catch {\n      // Unreadable or invalid JSON — start fresh so the MCP config lands cleanly.\n    }\n  }\n\n  const merged = { ...existing, mcp: mcpSection }\n  await handle.fs.write(target, JSON.stringify(merged, null, 2))\n}\n\n/**\n * OpenCode has no recognised skills directory where we can drop gitSkill repos.\n * AGENTS.md is already handled by the bootstrap layer (OpenCode reads it\n * natively). We warn-and-skip instead of inventing a path.\n */\nfunction projectGitSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'git') continue\n    const dir = skill.into ?? resolveGitSkillDir(projection.root, skill)\n    console.warn(\n      `[opencode] gitSkill \"${skill.repo}\" cloned to ${dir} but OpenCode has no ` +\n        'recognised skills directory to link it into. The skill is available at that ' +\n        'path — add an AGENTS.md reference to it manually if needed. Skipping.',\n    )\n  }\n}\n\n/**\n * `agentSkill` references a public skill by bare name. OpenCode has no command\n * to fetch a skill from a bare name, so we warn and skip.\n */\nfunction projectAgentSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'agent-skill') continue\n    console.warn(\n      `[opencode] agentSkill \"${skill.name}\" cannot be projected: OpenCode has no ` +\n        'command to install a public skill by bare name. Provide it as a gitSkill ' +\n        'instead. Skipping.',\n    )\n  }\n}\n\n/**\n * OpenCode has no plugin install command. We warn-and-skip each declared plugin\n * rather than fabricating a command.\n */\nfunction projectPlugins(projection: WorkspaceProjection): void {\n  for (const name of projection.plugins) {\n    console.warn(\n      `[opencode] plugin \"${name}\" cannot be installed: OpenCode has no plugin ` +\n        'install command. Skipping.',\n    )\n  }\n}\n\n/**\n * Project a `WorkspaceProjection` into the OpenCode sandbox. Safe to call on\n * every `chatStream`. The secret-bearing `opencode.json` mcp section is\n * (re)written on every call, re-resolving secrets, so OpenCode always reads\n * current values and a snapshot can never serve a stale or rotated secret.\n * The safe, idempotent, non-secret operations (gitSkill, agentSkill, plugins\n * — all warn-and-skip for OpenCode) are guarded by a one-time marker so they\n * produce at most one warning per sandbox lifetime.\n *\n * @param handle     - The sandbox handle (`fs` + `process`).\n * @param projection - The portable workspace inputs from `withSandbox`.\n */\nexport async function projectOpencodeWorkspace(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  // Always re-resolve and rewrite the secret-bearing MCP config so rotated\n  // secrets re-apply and snapshots can't serve stale values.\n  await projectMcpServers(handle, projection)\n\n  // Gate only the safe, idempotent, non-secret operations on the marker.\n  if (await handle.fs.exists(projection.markerPath)) return\n\n  projectGitSkills(projection)\n  projectAgentSkills(projection)\n  projectPlugins(projection)\n\n  await handle.fs.write(projection.markerPath, '')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,SAAS,eAAe,OAAoC;CAC1D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAa,MAAoC,WAAW;AAEhE;;;;;;AAOA,SAAS,mBACP,OACA,eACQ;CACR,IAAI,YAAY,KAAK,GAAG,OAAO,cAAc,KAAK;CAClD,IAAI,eAAe,KAAK,GAAG,OAAO,UAAU,cAAc,MAAM,WAAW;CAC3E,OAAO;AACT;;;;;;;AAgBA,SAAS,gBACP,QACA,eAC+C;CAC/C,MAAM,MAAyC,CAAC;CAChD,IAAI,QAAQ;CACZ,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,OAAO;EAC1B,SAAS;EACT,MAAM,UAAkC,CAAC;EACzC,MAAM,aAAa,MAAM,OAAO,WAAW,CAAC;EAC5C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,UAAU,GACnD,QAAQ,QAAQ,mBAAmB,OAAO,aAAa;EAEzD,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,MAAM,OAAO,WAAW,WAAW,SAAS;EAClD,IAAI,MAAM,QAAQ;GAAE,MAAM;GAAU;GAAK,SAAS;GAAM;EAAQ;CAClE;CACA,OAAO,QAAQ,IAAI,MAAM,KAAA;AAC3B;;;;;;;;;;AAWA,eAAe,kBACb,QACA,YACe;CACf,MAAM,aAAa,gBACjB,WAAW,QACX,WAAW,aACb;CACA,IAAI,eAAe,KAAA,GAAW;CAE9B,MAAM,SAAS,GAAG,WAAW,KAAK;CAGlC,IAAI,WAAoC,CAAC;CACzC,IAAI,MAAM,OAAO,GAAG,OAAO,MAAM,GAC/B,IAAI;EACF,MAAM,MAAM,MAAM,OAAO,GAAG,KAAK,MAAM;EACvC,MAAM,SAAkB,KAAK,MAAM,GAAG;EACtC,IACE,OAAO,WAAW,YAClB,WAAW,QACX,CAAC,MAAM,QAAQ,MAAM,GAErB,WAAW;CAEf,QAAQ,CAER;CAGF,MAAM,SAAS;EAAE,GAAG;EAAU,KAAK;CAAW;CAC9C,MAAM,OAAO,GAAG,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC/D;;;;;;AAOA,SAAS,iBAAiB,YAAuC;CAC/D,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,OAAO;EAC1B,MAAM,MAAM,MAAM,QAAQ,mBAAmB,WAAW,MAAM,KAAK;EACnE,QAAQ,KACN,wBAAwB,MAAM,KAAK,cAAc,IAAI,uKAGvD;CACF;AACF;;;;;AAMA,SAAS,mBAAmB,YAAuC;CACjE,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,eAAe;EAClC,QAAQ,KACN,0BAA0B,MAAM,KAAK,mIAGvC;CACF;AACF;;;;;AAMA,SAAS,eAAe,YAAuC;CAC7D,KAAK,MAAM,QAAQ,WAAW,SAC5B,QAAQ,KACN,sBAAsB,KAAK,yEAE7B;AAEJ;;;;;;;;;;;;;AAcA,eAAsB,yBACpB,QACA,YACe;CAGf,MAAM,kBAAkB,QAAQ,UAAU;CAG1C,IAAI,MAAM,OAAO,GAAG,OAAO,WAAW,UAAU,GAAG;CAEnD,iBAAiB,UAAU;CAC3B,mBAAmB,UAAU;CAC7B,eAAe,UAAU;CAEzB,MAAM,OAAO,GAAG,MAAM,WAAW,YAAY,EAAE;AACjD"}