quiver-cli 1.1.0 → 1.2.0

package/README.md

@@ -160,9 +160,15 @@ This is the basis for `sync` and `check`.
   poisoning), shown as a readable before/after.
 
 The first successful introspection records a baseline; subsequent `check` runs
-diff against it. Servers that fail introspection (e.g. requiring interactive
-OAuth) are reported as skipped. stdio servers run foreign code and are only
-introspected with `--introspect-stdio`.
+diff against it. stdio servers run foreign code and are only introspected with
+`--introspect-stdio`.
+
+**OAuth-protected servers** (e.g. Linear): `check` reuses opencode's MCP
+credentials (`~/.local/share/opencode/mcp-auth.json`, read-only — quiver never
+refreshes or rewrites them). Authenticate once with
+`opencode mcp auth <name>`, then re-run `quiver-cli check` to record the tool
+snapshot. Without a valid token the server is skipped with an actionable hint,
+and `quiver-cli list` shows why the tool count is missing.
 
 Pass `--offline` to skip MCP re-introspection entirely and check only digests
 and provider shims — no network, no foreign code, useful for a fast local

package/dist/cli.js

@@ -2569,7 +2569,8 @@ var init_list = __esm({
                 transport: entry.transport,
                 enabled: !disabled.has(name),
                 detail: serverDetail2.get(name) ?? null,
-                toolCount: entry.tools ? Object.keys(entry.tools).length : null
+                toolCount: entry.tools ? Object.keys(entry.tools).length : null,
+                authRequired: entry.authRequired ?? false
               })),
               plugins: plugins.map(({ name, entry }) => ({
                 name,
@@ -2609,6 +2610,7 @@ var init_list = __esm({
         }
       }
       let missingTools = false;
+      const needsAuth = [];
       if (mcp.length) {
         const nameW = Math.max(...mcp.map((e) => e.name.length));
         const toolW = Math.max(
@@ -2620,7 +2622,10 @@ var init_list = __esm({
         lines.push("", `  ${c.bold("mcp servers")}`);
         for (const { name, entry } of mcp) {
           const count = entry.tools ? Object.keys(entry.tools).length : null;
-          if (count === null) missingTools = true;
+          if (count === null) {
+            if (entry.authRequired) needsAuth.push(name);
+            else missingTools = true;
+          }
           const tools = padCell(
             `${count ?? "?"} tools`,
             toolW,
@@ -2647,6 +2652,13 @@ var init_list = __esm({
           `${skills.length} skills \xB7 ${commands.length} commands \xB7 ${mcp.length} MCP servers \xB7 ${plugins.length} plugins`
         )}  ${c.dim(`providers: ${providers2}`)}`
       );
+      for (const name of needsAuth) {
+        lines.push(
+          `  ${c.yellow(`${name} requires OAuth`)} ${c.dim(
+            `\u2014 run 'opencode mcp auth ${name}', then 'quiver-cli check'`
+          )}`
+        );
+      }
       if (missingTools) {
         lines.push(`  ${c.dim("run 'quiver-cli check' to populate tool counts")}`);
       }
@@ -2698,7 +2710,7 @@ var init_diff = __esm({
 });
 
 // src/mcp/introspect.ts
-var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg;
+var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg, isAuthError;
 var init_introspect = __esm({
   "src/mcp/introspect.ts"() {
     "use strict";
@@ -2714,13 +2726,20 @@ var init_introspect = __esm({
         clearTimeout(timer);
       }
     };
-    introspect = async (server, { allowStdio }) => {
+    introspect = async (server, { allowStdio, authToken }) => {
       const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
       let transport;
       try {
         if (server.transport === "http") {
           const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
-          const requestInit = server.headers ? { headers: server.headers } : {};
+          const headers2 = { ...server.headers ?? {} };
+          const hasAuthHeader = Object.keys(headers2).some(
+            (k) => k.toLowerCase() === "authorization"
+          );
+          if (authToken && !hasAuthHeader) {
+            headers2["Authorization"] = `Bearer ${authToken}`;
+          }
+          const requestInit = Object.keys(headers2).length ? { headers: headers2 } : {};
           transport = new StreamableHTTPClientTransport(new URL(server.url), {
             requestInit
           });
@@ -2755,6 +2774,9 @@ var init_introspect = __esm({
         }));
         return { ok: true, tools };
       } catch (e) {
+        if (await isAuthError(e)) {
+          return { ok: false, reason: errMsg(e), authRequired: true };
+        }
         return { ok: false, reason: errMsg(e) };
       } finally {
         try {
@@ -2764,6 +2786,55 @@ var init_introspect = __esm({
       }
     };
     errMsg = (e) => e instanceof Error ? e.message : String(e);
+    isAuthError = async (e) => {
+      try {
+        const { UnauthorizedError } = await import("@modelcontextprotocol/sdk/client/auth.js");
+        if (e instanceof UnauthorizedError) return true;
+      } catch {
+      }
+      if (typeof e === "object" && e !== null && e.code === 401) {
+        return true;
+      }
+      return /\b401\b|unauthorized|invalid_token/i.test(errMsg(e));
+    };
+  }
+});
+
+// src/mcp/opencode-auth.ts
+import { readFileSync as readFileSync10 } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve18 } from "path";
+var EXPIRY_SKEW_MS, authFilePath, normalizeUrl, findOpencodeToken;
+var init_opencode_auth = __esm({
+  "src/mcp/opencode-auth.ts"() {
+    "use strict";
+    EXPIRY_SKEW_MS = 3e4;
+    authFilePath = () => {
+      const base = process.env["XDG_DATA_HOME"] || resolve18(homedir2(), ".local", "share");
+      return resolve18(base, "opencode", "mcp-auth.json");
+    };
+    normalizeUrl = (url) => url.trim().replace(/\/+$/, "").toLowerCase();
+    findOpencodeToken = (name, url) => {
+      let data;
+      try {
+        data = JSON.parse(readFileSync10(authFilePath(), "utf8"));
+      } catch {
+        return { status: "none" };
+      }
+      if (typeof data !== "object" || data === null) return { status: "none" };
+      const entries = data;
+      const target = normalizeUrl(url);
+      const entry = Object.values(entries).find(
+        (e) => e?.serverUrl && normalizeUrl(e.serverUrl) === target
+      ) ?? entries[name];
+      const tokens = entry?.tokens;
+      if (!tokens?.accessToken) return { status: "none" };
+      if (typeof tokens.expiresAt === "number") {
+        const expiresMs = tokens.expiresAt > 1e12 ? tokens.expiresAt : tokens.expiresAt * 1e3;
+        if (expiresMs - EXPIRY_SKEW_MS <= Date.now()) return { status: "expired" };
+      }
+      return { status: "ok", accessToken: tokens.accessToken };
+    };
   }
 });
 
@@ -2789,13 +2860,14 @@ var init_snapshot = __esm({
 // src/commands/check.ts
 var check_exports = {};
 __export(check_exports, {
+  authHint: () => authHint,
   check: () => check,
   hasCommand: () => hasCommand,
   summarize: () => summarize
 });
 import { accessSync as accessSync2, constants as constants2 } from "fs";
-import { delimiter, resolve as resolve18 } from "path";
-var check, report2, driftLines, list2, recommend, summarize, hasCommand, truncate2, fail;
+import { delimiter, resolve as resolve19 } from "path";
+var check, report2, driftLines, list2, recommend, summarize, authHint, hasCommand, truncate2, fail;
 var init_check = __esm({
   "src/commands/check.ts"() {
     "use strict";
@@ -2804,6 +2876,7 @@ var init_check = __esm({
     init_schema();
     init_diff();
     init_introspect();
+    init_opencode_auth();
     init_snapshot();
     init_local_config();
     init_write();
@@ -2867,13 +2940,27 @@ var init_check = __esm({
         }
         checked.mcp += 1;
         const server = interpolateEnvVars(catMcp.server);
-        const res = await introspect(server, { allowStdio: options.introspectStdio });
+        const mcpEntry = entry;
+        const cred = server.transport === "http" ? findOpencodeToken(p.name, server.url) : { status: "none" };
+        const res = await introspect(server, {
+          allowStdio: options.introspectStdio,
+          authToken: cred.status === "ok" ? cred.accessToken : void 0
+        });
         if (!res.ok) {
-          mcpReports.push({ id, status: "skipped", reason: res.reason });
+          if (res.authRequired && !mcpEntry.authRequired) {
+            mcpEntry.authRequired = true;
+            lockChanged = true;
+          }
+          const reason = res.authRequired ? authHint(cred.status, p.name) : res.reason;
+          mcpReports.push({
+            id,
+            status: "skipped",
+            reason,
+            ...res.authRequired ? { authRequired: true } : {}
+          });
           continue;
         }
         const current = toSnapshot(res.tools);
-        const mcpEntry = entry;
         if (!mcpEntry.tools) {
           mcpEntry.tools = current;
           mcpEntry.toolsFetchedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -2942,7 +3029,15 @@ var init_check = __esm({
   - ${shimProblems.join("\n  - ")}`
         );
       }
-      const skipped = mcpReports.filter((r) => r.status === "skipped");
+      const authSkipped = mcpReports.filter(
+        (r) => r.status === "skipped" && r.authRequired
+      );
+      for (const r of authSkipped) {
+        await warn(`${r.id}: ${r.reason}`);
+      }
+      const skipped = mcpReports.filter(
+        (r) => r.status === "skipped" && !r.authRequired
+      );
       if (skipped.length) {
         const names = skipped.map((r) => parseEntryId(r.id)?.name ?? r.id);
         await info(
@@ -3036,13 +3131,19 @@ var init_check = __esm({
       if (c.plugins) parts.push(plural(c.plugins, "plugin"));
       return parts.length ? parts.join(", ") : "nothing";
     };
+    authHint = (cred, name) => {
+      const reauth = `run 'opencode mcp auth ${name}', then 'quiver-cli check'`;
+      if (cred === "expired") return `OAuth token expired \u2014 re-${reauth}`;
+      if (cred === "ok") return `OAuth token rejected \u2014 re-${reauth}`;
+      return `requires OAuth \u2014 ${reauth}`;
+    };
     hasCommand = (command) => {
       if (!/^[A-Za-z0-9._-]+$/.test(command)) return false;
       const extensions = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
       for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
         for (const extension of extensions) {
           try {
-            accessSync2(resolve18(dir, command + extension), constants2.X_OK);
+            accessSync2(resolve19(dir, command + extension), constants2.X_OK);
             return true;
           } catch {
           }
@@ -3064,12 +3165,12 @@ import { execFileSync as execFileSync3 } from "child_process";
 import {
   existsSync as existsSync14,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   rmSync as rmSync7,
   writeFileSync as writeFileSync8
 } from "fs";
 import { tmpdir } from "os";
-import { join, resolve as resolve19 } from "path";
+import { join, resolve as resolve20 } from "path";
 var UPSTREAMS_FILE, upstreamsPath, loadUpstreams, writeUpstreams, fetchLatestCommit, fetchUpstreamDir, short, evaluateOrigin;
 var init_upstreams = __esm({
   "src/catalog/upstreams.ts"() {
@@ -3077,11 +3178,11 @@ var init_upstreams = __esm({
     init_auth();
     init_auth();
     UPSTREAMS_FILE = "upstreams.json";
-    upstreamsPath = (catalog) => resolve19(catalog.root, UPSTREAMS_FILE);
+    upstreamsPath = (catalog) => resolve20(catalog.root, UPSTREAMS_FILE);
     loadUpstreams = (catalog) => {
       const path = upstreamsPath(catalog);
       if (!existsSync14(path)) return {};
-      return JSON.parse(readFileSync10(path, "utf8"));
+      return JSON.parse(readFileSync11(path, "utf8"));
     };
     writeUpstreams = (catalog, map) => {
       writeFileSync8(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
@@ -3149,8 +3250,8 @@ var init_upstreams = __esm({
         const msg = err instanceof Error && "stderr" in err ? String(err.stderr).trim().split("\n").pop() : err instanceof Error ? err.message : "git clone failed";
         return { ok: false, reason: msg || "git clone failed" };
       }
-      const dir = resolve19(tmp, origin.path);
-      if (!existsSync14(resolve19(dir, "SKILL.md"))) {
+      const dir = resolve20(tmp, origin.path);
+      if (!existsSync14(resolve20(dir, "SKILL.md"))) {
         cleanup();
         return { ok: false, reason: `no SKILL.md at ${origin.path} in ${origin.repo}` };
       }
@@ -3443,9 +3544,9 @@ __export(notifier_exports, {
   installHint: () => installHint,
   notifierSuppressed: () => notifierSuppressed
 });
-import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname6, resolve as resolve20 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname6, resolve as resolve21 } from "path";
 var REGISTRY_URL, CHECK_TTL_MS, FETCH_TIMEOUT_MS, INSTALL_HINT, cacheFilePath, installHint, getCurrentVersion, compareSemver, readCache, writeCache, fetchLatestVersion, checkForUpdate, notifierSuppressed;
 var init_notifier = __esm({
   "src/version/notifier.ts"() {
@@ -3456,14 +3557,14 @@ var init_notifier = __esm({
     FETCH_TIMEOUT_MS = 2e3;
     INSTALL_HINT = "pnpm add -g quiver-cli";
     cacheFilePath = () => {
-      const base = process.env["XDG_CACHE_HOME"] || resolve20(homedir2(), ".cache");
-      return resolve20(base, "quiver", "update-check.json");
+      const base = process.env["XDG_CACHE_HOME"] || resolve21(homedir3(), ".cache");
+      return resolve21(base, "quiver", "update-check.json");
     };
     installHint = () => INSTALL_HINT;
     getCurrentVersion = () => {
       try {
         const pkg = JSON.parse(
-          readFileSync11(resolve20(packageRoot, "package.json"), "utf8")
+          readFileSync12(resolve21(packageRoot, "package.json"), "utf8")
         );
         return pkg.version;
       } catch {
@@ -3491,7 +3592,7 @@ var init_notifier = __esm({
       const path = cacheFilePath();
       if (!existsSync15(path)) return null;
       try {
-        return JSON.parse(readFileSync11(path, "utf8"));
+        return JSON.parse(readFileSync12(path, "utf8"));
       } catch {
         return null;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quiver-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Compose selected skills, commands, plugins and MCP servers from a central catalog into any repo as native configs for opencode, Claude Code and Codex - with lockfile-based drift awareness.",
   "type": "module",
   "bin": {