cli4ai 0.8.2 → 0.9.0

package/src/mcp/adapter.ts

@@ -73,18 +73,26 @@ export async function executeTool(
   entryPath: string,
   runtime: string,
   command: string,
-  args: Record<string, string>
+  args: Record<string, string>,
+  argOrder?: string[]
 ): Promise<McpToolResult> {
   return new Promise((resolve) => {
     // Build command arguments
     const cmdArgs = [command];
-    for (const [key, value] of Object.entries(args)) {
-      if (value !== undefined && value !== '') {
-        cmdArgs.push(value);
-      }
+
+    // Prefer manifest-defined arg order (positional), fall back to stable ordering.
+    const orderedKeys = argOrder ?? Object.keys(args).sort();
+    for (const key of orderedKeys) {
+      const value = args[key];
+      if (value !== undefined && value !== '') cmdArgs.push(value);
     }
 
-    const proc = spawn(runtime, ['run', entryPath, ...cmdArgs], {
+    const runtimeArgs =
+      runtime === 'node'
+        ? [entryPath, ...cmdArgs]
+        : ['run', entryPath, ...cmdArgs];
+
+    const proc = spawn(runtime, runtimeArgs, {
       stdio: ['pipe', 'pipe', 'pipe'],
       env: { ...process.env }
     });

package/src/mcp/config-gen.test.ts

@@ -2,7 +2,7 @@
  * Tests for mcp/config-gen.ts
  */
 
-import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { describe, test, expect, beforeEach, afterEach } from 'vitest';
 import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';

package/src/mcp/server.ts

@@ -251,10 +251,9 @@ export class McpServer {
 
     // Execute the CLI tool
     const entryPath = resolve(this.packagePath, this.manifest.entry);
-    const runtime = this.manifest.runtime || 'bun';
 
     try {
-      const result = await this.executeCommand(runtime, entryPath, cmdArgs);
+      const result = await this.executeCommand(entryPath, cmdArgs);
       auditLog(this.manifest.name, name, args, 'success');
       this.sendResult(id, {
         content: [{ type: 'text', text: result }]
@@ -269,30 +268,25 @@ export class McpServer {
     }
   }
 
-  private executeCommand(runtime: string, entryPath: string, args: string[]): Promise<string> {
+  private executeCommand(entryPath: string, args: string[]): Promise<string> {
     return new Promise((resolve, reject) => {
-      // Build runtime-specific command and arguments
-      // - bun: bun run <file> [args]
-      // - node: node <file> [args]
+      // Use tsx for TypeScript files, node for JavaScript
       let cmd: string;
       let cmdArgs: string[];
-      switch (runtime) {
-        case 'node':
-          cmd = 'node';
-          cmdArgs = [entryPath, ...args];
-          break;
-        case 'bun':
-        default:
-          cmd = 'bun';
-          cmdArgs = ['run', entryPath, ...args];
-          break;
+      if (entryPath.endsWith('.ts') || entryPath.endsWith('.tsx')) {
+        cmd = 'npx';
+        cmdArgs = ['tsx', entryPath, ...args];
+      } else {
+        cmd = 'node';
+        cmdArgs = [entryPath, ...args];
       }
 
       // Inject secrets from manifest env definitions
+      // SECURITY: Use package-scoped secret lookup (tries scoped first, then global)
       const secretsEnv: Record<string, string> = {};
       if (this.manifest.env) {
         for (const key of Object.keys(this.manifest.env)) {
-          const value = getSecret(key);
+          const value = getSecret(key, this.manifest.name);
           if (value) {
             secretsEnv[key] = value;
           }