Release v0.9.0 → prod (OpenCode + multi-provider remote scan)#193
Merged
Conversation
Adds `dop_v1_[a-f0-9]{64}` (severity critical) to the built-in regex scanner in both Node and Python, with tests in each suite. Closes #26.
Co-authored-by: Minh_Nguyen <Minh-Nguyen-2k7@users.noreply.github.com>
Add OpenCode as an MCP-based platform adapter in both the Node and Python implementations, mirroring the existing Cursor/Windsurf/Hermes pattern. OpenCode supports local/stdio MCP servers and reads AGENTS.md natively. Its config schema differs from Cursor/Windsurf: the block is `mcp` (not `mcpServers`), each local server carries `type: "local"`, and command + args are a single `command` array. Registered at ~/.config/opencode/opencode.json with a seeded `$schema` pointer. Verified against https://opencode.ai/docs/mcp-servers/. - Node: installOpenCodeMcp() + --with-opencode flag + auto-detection (~/.config/opencode), dry-run plan, interactive prompt, warnings, next-steps, help hints, and the openCodeMcp() component-registry spec. Wired into status.ts (mcpAgents + detectAgents) and verify.ts (checkOpenCode). - Python: full parity in agent.py and agent_components.py. - recipes/opencode.md, README (platform table, badge, prose lists), and CLI_SPEC.md (--with flag, verify checks table). - Tests: node/tests/agent-init-opencode.test.ts plus mirrored TestInstallOpenCodeMcp / TestOpenCodeDetection in Python; registry ID lists updated (also backfilled the missing hermes.mcp entry). OpenClaw (a separate product) is untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…JSON
Rafter security review flagged a low-severity parity/robustness gap: when an
existing ~/.config/opencode/opencode.json is valid JSON but the top level is
not an object (an array, string, or number), the Node init path would assign
properties onto it and silently mangle the user's file. Python's init already
guarded this with isinstance(loaded, dict).
- Node installOpenCodeMcp: only accept a parsed object (else warn + replace),
mirroring the Python guard.
- Node/Python component openCodeMcp/_opencode_mcp: coerce a non-object read
result to {} in install(), and guard is_installed()/uninstall() so a
non-dict top-level can't raise.
- Regression tests for array/string top-level configs in both suites.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add optional multi-provider support to `rafter run` / `rafter scan` in both the Node and Python implementations. The scan POST body additively gains two OPTIONAL fields — `provider` (gitlab|gitea|bitbucket) and `repo_url` (canonical https clone URL) — sent ONLY for non-github remotes. GitHub requests are byte-identical to today (no provider, no repo_url). - git utils: infer provider from the remote host and normalize both `git@host:owner/repo(.git)` and `https://host/owner/repo(.git)` into a canonical `https://<host>/<owner>/<repo>` repo_url. Host map: github.com→github; gitlab.com / *.gitlab.com→gitlab; bitbucket.org→bitbucket; codeberg.org / *.gitea.io→gitea; anything else→github (backward-compat default). parseRemote/parse_remote return value is left intact for existing callers; detectRepo/detect_repo additively surface provider + repo_url. - backend run + scan command: add optional `--provider` / `--repo-url` flags that override inferred values. Body builder omits both fields whenever the resolved provider is github (or an unknown host that defaulted to github). github_token handling unchanged. - CLI_SPEC.md: document the two flags, the two additive body fields, the host→provider inference table, and the backward-compat rule. - Tests (Node + Python): provider inference per host and both URL forms; github remote produces a body with NO provider/repo_url (byte-identical shape); gitlab/bitbucket/gitea remotes produce the correct provider + normalized repo_url; --provider/--repo-url overrides win. No version bump. No lockfile or .rafter.yml changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Raftersecurity
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes v0.9.0 to prod (triggers npm + PyPI publish via publish.yaml).
What ships
--with-opencodeMCP adapter (10th platform). sable-l8e5.rafter run; GitHub byte-identical. sable-w79q. Backend API-key path landed via securable-bolt PR fix(sable-cg1): openclaw.skills component points at ClawHub canonical path; legacy file removed on uninstall #133 (ship-dark unless MULTI_PROVIDER_BACKEND_READY is on).Verification
tscclean; Node feature tests 92 pass; Python 197 pass; dual-impl parity.Merging triggers the irreversible npm/PyPI publish + create-release tag v0.9.0.
🤖 Generated with Claude Code