opencode-supabase 0.0.3 → 0.0.4-alpha.1

package/README.md

@@ -20,6 +20,16 @@ Launch `opencode` in your project, then run:
 
 Connect your account and ask your agent about Supabase capabilities.
 
+## Debug Logging
+
+If you hit auth or tool errors and need logs for an issue, run OpenCode like this and share `opencode-supabase-debug.log`:
+
+```bash
+opencode --log-level DEBUG --print-logs 2>opencode-supabase-debug.log
+```
+
+Without `--print-logs`, OpenCode writes logs to its default log directory, documented as `~/.local/share/opencode/log/` on macOS/Linux and `%USERPROFILE%\.local\share\opencode\log` on Windows.
+
 ## Available today
 
 - **Connect** your Supabase account from OpenCode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-supabase",
-  "version": "0.0.3",
+  "version": "0.0.4-alpha.1",
   "type": "module",
   "description": "OpenCode plugin for Supabase integration with server and TUI components",
   "license": "Apache-2.0",

package/src/server/auth.ts

@@ -7,6 +7,7 @@ import {
   type BrokerConfig,
 } from "../shared/broker.ts";
 import { readSupabaseConfig } from "../shared/cfg.ts";
+import type { SupabaseLogger } from "../shared/log.ts";
 import { buildAuthorizeUrl, generatePKCE, generateState } from "../shared/oauth.ts";
 import type { FetchLike, SupabaseTokenResponse } from "../shared/types.ts";
 import { HTML_SUCCESS, htmlError } from "./auth-html.ts";
@@ -25,6 +26,8 @@ type PendingAuth = {
 
 type AuthDeps = {
   fetch?: FetchLike;
+  logger?: SupabaseLogger;
+  setCallbackTimeout?: typeof setTimeout;
 };
 
 let server: ReturnType<typeof Bun.serve> | undefined;
@@ -69,6 +72,10 @@ async function ensureServer(
     baseUrl: config.brokerBaseUrl,
   };
 
+  await deps.logger?.info("supabase callback server started", {
+    port,
+  });
+
   server = Bun.serve({
     port,
     async fetch(req) {
@@ -78,6 +85,11 @@ async function ensureServer(
       }
 
       const state = url.searchParams.get("state");
+      await deps.logger?.debug("supabase auth callback received", {
+        has_state: Boolean(state),
+        has_code: Boolean(url.searchParams.get("code")),
+        has_error: Boolean(url.searchParams.get("error")),
+      });
       if (!state) {
         return new Response(htmlError("Missing required state parameter - potential CSRF attack"), {
           status: 400,
@@ -98,6 +110,9 @@ async function ensureServer(
       if (error) {
         clearTimeout(pending.timeout);
         pendingAuths.delete(state);
+        await deps.logger?.error("supabase auth failed", {
+          reason: "provider_denied",
+        });
         pending.reject(new Error(errorDescription || error));
         return new Response(htmlError(errorDescription || error), {
           headers: { "Content-Type": "text/html" },
@@ -108,6 +123,9 @@ async function ensureServer(
       if (!code) {
         clearTimeout(pending.timeout);
         pendingAuths.delete(state);
+        await deps.logger?.error("supabase auth failed", {
+          reason: "missing_code",
+        });
         pending.reject(new Error("Missing authorization code"));
         return new Response(htmlError("Missing authorization code"), {
           status: 400,
@@ -127,6 +145,7 @@ async function ensureServer(
             code_verifier: pending.codeVerifier,
           },
           deps.fetch,
+          deps.logger,
         );
 
         const expires = Date.now() + (tokens.expires_in || 3600) * 1000;
@@ -138,6 +157,10 @@ async function ensureServer(
 
         pending.resolve({ tokens, expires });
 
+        await deps.logger?.info("supabase auth completed", {
+          status: "success",
+        });
+
         return new Response(HTML_SUCCESS, {
           headers: { "Content-Type": "text/html" },
         });
@@ -146,6 +169,11 @@ async function ensureServer(
           ? `Authorization failed: ${cause.message}`
           : "Authorization failed";
 
+        await deps.logger?.error("supabase auth failed", {
+          status: cause instanceof BrokerClientError ? cause.status : 400,
+          broker_error: cause instanceof BrokerClientError,
+        });
+
         pending.reject(cause instanceof Error ? cause : new Error(String(cause)));
 
         return new Response(htmlError(errorMessage), {
@@ -159,11 +187,20 @@ async function ensureServer(
   serverPort = port;
 }
 
-function waitForCallback(state: string, codeVerifier: string, redirectUri: string) {
+function waitForCallback(
+  state: string,
+  codeVerifier: string,
+  redirectUri: string,
+  deps: AuthDeps,
+) {
   return new Promise<{ tokens: SupabaseTokenResponse; expires: number }>((resolve, reject) => {
-    const timeout = setTimeout(() => {
+    const scheduleTimeout = deps.setCallbackTimeout ?? setTimeout;
+    const timeout = scheduleTimeout(() => {
       if (!pendingAuths.has(state)) return;
       pendingAuths.delete(state);
+      void deps.logger?.error("supabase auth callback timed out", {
+        reason: "timeout",
+      });
       reject(new Error("OAuth callback timeout - authorization took too long"));
     }, CALLBACK_TIMEOUT_MS);
 
@@ -192,10 +229,13 @@ export function createSupabaseAuth(
         label: "Supabase",
         async authorize() {
           await ensureServer(config.oauthPort, config, input, deps);
+          await deps.logger?.info("supabase auth started", {
+            port: config.oauthPort,
+          });
           const pkce = await generatePKCE();
           const state = generateState();
           const redirectUri = callbackUrl(config.oauthPort);
-          const callbackPromise = waitForCallback(state, pkce.verifier, redirectUri);
+          const callbackPromise = waitForCallback(state, pkce.verifier, redirectUri, deps);
 
           return {
             url: buildAuthorizeUrl(config, redirectUri, pkce, state),

package/src/server/index.ts

@@ -1,12 +1,17 @@
 import type { Plugin } from "@opencode-ai/plugin";
 
+import { createServerLogWriter, createSupabaseLogger } from "../shared/log.ts";
 import { createSupabaseAuth } from "./auth.ts";
 import { createSupabaseTools } from "./tools.ts";
 
 const server: Plugin = async (input, options) => {
+  const logger = createSupabaseLogger({
+    write: createServerLogWriter(input.client),
+  });
+
   return {
-    auth: createSupabaseAuth(input, options),
-    tool: createSupabaseTools(input, options),
+    auth: createSupabaseAuth(input, options, { logger }),
+    tool: createSupabaseTools(input, options, { logger }),
   };
 };
 

package/src/server/tools.ts

@@ -8,11 +8,13 @@ import {
 } from "../shared/broker.ts";
 import { supabaseManagementApiFetch } from "../shared/api.ts";
 import { readSupabaseConfig } from "../shared/cfg.ts";
+import type { SupabaseLogger } from "../shared/log.ts";
 import type { FetchLike } from "../shared/types.ts";
 import { clearSavedAuth, readSavedAuth, writeSavedAuth, type SavedAuth } from "./store.ts";
 
 type ToolDeps = {
   fetch?: FetchLike;
+  logger?: SupabaseLogger;
 };
 
 type HostAuthWriter = {
@@ -58,40 +60,86 @@ function generateRandomString(length: number) {
     .slice(0, length);
 }
 
+function sanitizeToolArgs(name: string, args: Record<string, unknown>) {
+  const next = { ...args };
+  if (name === "supabase_create_project" && typeof next.db_pass === "string") {
+    next.db_pass = "[redacted]";
+  }
+  return next;
+}
+
 async function executeSupabaseRequest(
   input: SupabaseToolInput,
   options: PluginOptions | undefined,
   deps: ToolDeps,
+  toolName: string,
+  context: SupabaseToolContext,
   path: string,
   errorLabel: string,
   init?: RequestInit,
 ) {
-  const config = readSupabaseConfig(options);
-  const auth = await ensureSupabaseToolAuth(input, options, deps);
-  const response = await supabaseManagementApiFetch(
-    config,
-    auth.access,
-    path,
-    init,
-    deps.fetch,
-  );
+  const startedAt = Date.now();
+  await deps.logger?.info("supabase tool started", {
+    tool: toolName,
+    sessionID: context.sessionID,
+    messageID: context.messageID,
+    agent: context.agent,
+  });
+  try {
+    const config = readSupabaseConfig(options);
+    const auth = await ensureSupabaseToolAuth(input, options, deps);
+    const response = await supabaseManagementApiFetch(
+      config,
+      auth.access,
+      path,
+      init,
+      deps.fetch,
+    );
 
-  if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new Error(`Failed to ${errorLabel}: ${response.status} ${body}`.trim());
-  }
+    await deps.logger?.debug("supabase api response received", {
+      tool: toolName,
+      path,
+      status: response.status,
+    });
+
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      await deps.logger?.error("supabase tool failed", {
+        tool: toolName,
+        path,
+        status: response.status,
+      });
+      throw new Error(`Failed to ${errorLabel}: ${response.status} ${body}`.trim());
+    }
+
+    const payload = await response.json();
+
+    await deps.logger?.info("supabase tool completed", {
+      tool: toolName,
+      duration_ms: Date.now() - startedAt,
+    });
 
-  return JSON.stringify(await response.json(), null, 2);
+    return JSON.stringify(payload, null, 2);
+  } catch (error) {
+    await deps.logger?.error("supabase tool failed", {
+      tool: toolName,
+      path,
+      reason: error instanceof Error ? error.message : String(error),
+    });
+    throw error;
+  }
 }
 
 async function executeSupabaseGet(
   input: SupabaseToolInput,
   options: PluginOptions | undefined,
   deps: ToolDeps,
+  toolName: string,
+  context: SupabaseToolContext,
   path: string,
   errorLabel: string,
 ) {
-  return executeSupabaseRequest(input, options, deps, path, errorLabel);
+  return executeSupabaseRequest(input, options, deps, toolName, context, path, errorLabel);
 }
 
 async function setHostAuth(
@@ -143,6 +191,7 @@ export async function ensureSupabaseToolAuth(
       { baseUrl: config.brokerBaseUrl },
       { refresh_token: saved.auth.refresh },
       deps.fetch,
+      deps.logger,
     );
 
     const nextAuth: SavedAuth = {
@@ -181,14 +230,30 @@ export function createSupabaseTools(
       description: "List all Supabase organizations for the authenticated user.",
       args: {},
       async execute(_args, _context: SupabaseToolContext) {
-        return executeSupabaseGet(input, options, deps, "/organizations", "list organizations");
+        return executeSupabaseGet(
+          input,
+          options,
+          deps,
+          "supabase_list_organizations",
+          _context,
+          "/organizations",
+          "list organizations",
+        );
       },
     }),
     supabase_list_projects: tool({
       description: "List all Supabase projects for the authenticated user.",
       args: {},
       async execute(_args, _context: SupabaseToolContext) {
-        return executeSupabaseGet(input, options, deps, "/projects", "list projects");
+        return executeSupabaseGet(
+          input,
+          options,
+          deps,
+          "supabase_list_projects",
+          _context,
+          "/projects",
+          "list projects",
+        );
       },
     }),
     supabase_get_project_api_keys: tool({
@@ -201,6 +266,8 @@ export function createSupabaseTools(
           input,
           options,
           deps,
+          "supabase_get_project_api_keys",
+          _context,
           `/projects/${args.project_ref}/api-keys`,
           "get API keys",
         );
@@ -215,10 +282,16 @@ export function createSupabaseTools(
         db_pass: tool.schema.string().describe("Database password").optional(),
       },
       async execute(args, _context: SupabaseToolContext) {
+        await deps.logger?.debug("supabase tool args prepared", {
+          tool: "supabase_create_project",
+          args: sanitizeToolArgs("supabase_create_project", args),
+        });
         return executeSupabaseRequest(
           input,
           options,
           deps,
+          "supabase_create_project",
+          _context,
           "/projects",
           "create project",
           {

package/src/shared/broker.ts

@@ -1,4 +1,5 @@
 import type { FetchLike, SupabaseTokenResponse } from "./types.ts";
+import type { SupabaseLogger } from "./log.ts";
 
 export type BrokerConfig = {
   baseUrl: string;
@@ -95,9 +96,14 @@ async function makeBrokerRequest(
   endpoint: string,
   body: unknown,
   fetchImpl: FetchLike,
+  logger?: SupabaseLogger,
 ): Promise<SupabaseTokenResponse> {
   const url = `${config.baseUrl.replace(/\/$/, "")}${endpoint}`;
 
+  await logger?.debug("supabase broker request started", {
+    endpoint,
+  });
+
   let response: Response;
 
   try {
@@ -110,6 +116,10 @@ async function makeBrokerRequest(
       body: JSON.stringify(body),
     });
   } catch (cause) {
+    await logger?.error("supabase broker request failed", {
+      endpoint,
+      status: 502,
+    });
     throw new BrokerClientError({
       code: "upstream_error",
       message: "broker request failed",
@@ -122,6 +132,10 @@ async function makeBrokerRequest(
   try {
     payload = await response.json();
   } catch {
+    await logger?.error("supabase broker response invalid", {
+      endpoint,
+      status: response.status,
+    });
     throw new BrokerClientError({
       code: "upstream_error",
       message: "broker returned an invalid response",
@@ -129,6 +143,11 @@ async function makeBrokerRequest(
     });
   }
 
+  await logger?.debug("supabase broker response received", {
+    endpoint,
+    status: response.status,
+  });
+
   if (!response.ok) {
     const errorBody = payload as Record<string, unknown> | undefined;
     const error = errorBody?.error as Record<string, unknown> | undefined;
@@ -136,6 +155,15 @@ async function makeBrokerRequest(
     const code = (error?.code as BrokerErrorCode) || "upstream_error";
     const message = (error?.message as string) || "broker request failed";
 
+    await logger?.error(
+      endpoint === "/exchange" ? "supabase broker exchange failed" : "supabase broker refresh failed",
+      {
+        endpoint,
+        status: response.status,
+        code,
+      },
+    );
+
     throw new BrokerClientError({
       code,
       message,
@@ -150,6 +178,7 @@ export async function exchangeCodeThroughBroker(
   config: BrokerConfig,
   input: ExchangeRequest,
   fetchImpl: FetchLike = fetch,
+  logger?: SupabaseLogger,
 ): Promise<SupabaseTokenResponse> {
   return makeBrokerRequest(
     config,
@@ -160,6 +189,7 @@ export async function exchangeCodeThroughBroker(
       redirect_uri: input.redirect_uri,
     },
     fetchImpl,
+    logger,
   );
 }
 
@@ -167,6 +197,7 @@ export async function refreshTokenThroughBroker(
   config: BrokerConfig,
   input: RefreshRequest,
   fetchImpl: FetchLike = fetch,
+  logger?: SupabaseLogger,
 ): Promise<SupabaseTokenResponse> {
   return makeBrokerRequest(
     config,
@@ -175,5 +206,6 @@ export async function refreshTokenThroughBroker(
       refresh_token: input.refresh_token,
     },
     fetchImpl,
+    logger,
   );
 }

package/src/shared/log.ts

@@ -0,0 +1,57 @@
+export type SupabaseLogLevel = "debug" | "info" | "warn" | "error";
+
+export type SupabaseLogger = ReturnType<typeof createSupabaseLogger>;
+
+export type LogEntry = {
+  service: string;
+  level: SupabaseLogLevel;
+  message: string;
+  extra?: Record<string, unknown>;
+};
+
+type LogWriter = (entry: LogEntry) => Promise<unknown>;
+
+export function createSupabaseLogger(input: { write: LogWriter }) {
+  async function emit(
+    level: SupabaseLogLevel,
+    message: string,
+    extra?: Record<string, unknown>,
+  ) {
+    try {
+      const result = await input.write({
+        service: "opencode-supabase",
+        level,
+        message,
+        extra,
+      });
+      if (result && typeof result === "object" && "error" in result) {
+        console.error("[opencode-supabase] host log rejected:", (result as { error: unknown }).error);
+      }
+    } catch (error) {
+      console.error("[opencode-supabase] host log failed:", error instanceof Error ? error.message : error);
+    }
+  }
+
+  return {
+    debug(message: string, extra?: Record<string, unknown>) {
+      return emit("debug", message, extra);
+    },
+    info(message: string, extra?: Record<string, unknown>) {
+      return emit("info", message, extra);
+    },
+    warn(message: string, extra?: Record<string, unknown>) {
+      return emit("warn", message, extra);
+    },
+    error(message: string, extra?: Record<string, unknown>) {
+      return emit("error", message, extra);
+    },
+  };
+}
+
+export function createServerLogWriter(client: { app: { log: (input: { body: LogEntry }) => Promise<unknown> } }) {
+  return (entry: LogEntry) => client.app.log({ body: entry });
+}
+
+export function createTuiLogWriter(client: { app: { log: (input: LogEntry, options?: { throwOnError?: boolean }) => Promise<unknown> } }) {
+  return (entry: LogEntry) => client.app.log(entry, { throwOnError: true });
+}

package/src/tui/dialog.tsx

@@ -1,9 +1,12 @@
 import type { TuiPluginApi } from "@opencode-ai/plugin/tui";
 import { createSignal } from "solid-js";
 
+import type { SupabaseLogger } from "../shared/log.ts";
+
 type SupabaseDialogProps = {
   api: TuiPluginApi;
   onClose: () => void;
+  logger: SupabaseLogger;
 };
 
 type OAuthState =
@@ -28,6 +31,9 @@ export function SupabaseDialog(props: SupabaseDialogProps) {
 
   const startOAuth = async () => {
     try {
+      await props.logger.info("supabase auth started", {
+        phase: "authorize",
+      });
       setState({ type: "authorizing", url: "" });
 
       // Start OAuth authorization
@@ -50,19 +56,28 @@ export function SupabaseDialog(props: SupabaseDialogProps) {
       }
 
       const { url, method } = authData;
+      const safeUrl = new URL(url);
       setState({ type: "authorizing", url });
 
+      await props.logger.debug("supabase auth authorize response received", {
+        method,
+        url_origin: safeUrl.origin,
+        url_path: safeUrl.pathname,
+      });
+
       // Attempt to open browser automatically
       if (method === "auto") {
         try {
           const open = await import("open");
           await open.default(url);
         } catch {
+          await props.logger.warn("supabase browser open failed");
           // Browser auto-open failed, user can click the URL manually
         }
       }
 
       setState({ type: "waiting_callback", url });
+      await props.logger.debug("supabase auth waiting for callback");
 
       // Wait for callback
       const callbackResponse = (await props.api.client.provider.oauth.callback({
@@ -79,6 +94,9 @@ export function SupabaseDialog(props: SupabaseDialogProps) {
       const callbackSucceeded = callbackResponse.data === true;
 
       if (callbackSucceeded) {
+        await props.logger.info("supabase auth completed", {
+          status: "success",
+        });
         setState({ type: "success" });
         props.api.ui.toast({
           variant: "success",
@@ -92,6 +110,9 @@ export function SupabaseDialog(props: SupabaseDialogProps) {
     } catch (error) {
       const message =
         error instanceof Error ? error.message : "Authorization failed";
+      await props.logger.error("supabase auth failed", {
+        message,
+      });
       setState({ type: "error", message });
       props.api.ui.toast({
         variant: "error",

package/src/tui/index.tsx

@@ -1,12 +1,17 @@
 import type { TuiPlugin } from "@opencode-ai/plugin/tui";
 
+import { createSupabaseLogger, createTuiLogWriter } from "../shared/log.ts";
 import { createSupabaseCommand } from "./commands";
 import { SupabaseDialog } from "./dialog";
 
 const tui: TuiPlugin = async (api) => {
+  const logger = createSupabaseLogger({
+    write: createTuiLogWriter(api.client),
+  });
+
   api.command.register(() => [
     createSupabaseCommand(() => {
-      api.ui.dialog.replace(() => SupabaseDialog({ api, onClose: () => api.ui.dialog.clear() }));
+      api.ui.dialog.replace(() => SupabaseDialog({ api, logger, onClose: () => api.ui.dialog.clear() }));
     }),
   ]);
 };