Stabilize source credential linking and remove OpenAPI fast-mode remnants

Use source-id based credential keys, infer OpenAPI auth defaults from security schemes, and clean up tools UI source/credential presentation including baseUrl-driven favicons. Also bump tool/OpenAPI cache versions and include related workspace prewarm and MCP config updates.

Rhys Sullivan committed 9 months ago

Commit 9f5774e1 parent 11b3a889 files · +357 −74Browse files

Unified · Split

9 files

executor/apps/web/src/components/tools-view.tsx +121 −50
executor/convex/executorNode.github-profile.e2e.test.ts +61 −0
executor/convex/executorNode.ts +9 −2
executor/convex/http.ts +0 −11
executor/convex/workspace.ts +22 −2
executor/lib/openapi-cache.test.ts +60 −1
executor/lib/tool-sources.test.ts +3 −2
executor/lib/tool_sources.ts +73 −5
opencode.json +8 −1

executor/apps/web/src/components/tools-view.tsx+121−50

   Wrench,
   Plus,
   Trash2,
-  ShieldCheck,
   Globe,
   Server,
   ChevronRight,
 import { convexApi } from "@/lib/convex-api";
 import type {
   ToolSourceRecord,
-  ToolDescriptor,
   CredentialRecord,
   CredentialScope,
   OpenApiSourceQuality,
   }
 }
-function isTemplateHostname(hostname: string): boolean {
-  const lower = hostname.toLowerCase();
-  return (
-    lower === "localhost" ||
-    lower === "example.com" ||
-    lower.endsWith(".example.com") ||
-    lower.startsWith("your-domain") ||
-    lower.includes(".your-domain")
-  );
-}
-function pickFaviconTarget(urls: Array<string | undefined | null>): string | null {
-  const parsed = urls
-    .filter((value): value is string => Boolean(value))
-    .map((value) => {
-      try {
-        return { value, hostname: new URL(value).hostname };
-      } catch {
-        return null;
-      }
-    })
-    .filter((entry): entry is { value: string; hostname: string } => entry !== null);
-  const preferred = parsed.find((entry) => !isTemplateHostname(entry.hostname));
-  if (preferred) return preferred.value;
-  return parsed[0]?.value ?? null;
-}
 function getFaviconUrl(preset: ApiPreset): string | null {
-  return faviconForUrl(pickFaviconTarget([preset.baseUrl, preset.endpoint, preset.url, preset.spec]));
+  if (preset.type === "openapi") {
+    return faviconForUrl(preset.baseUrl ?? null);
+  }
+  if (preset.type === "graphql") {
+    return faviconForUrl(preset.endpoint ?? null);
+  }
+  return faviconForUrl(preset.url ?? null);
 }
 function getSourceFavicon(source: ToolSourceRecord): string | null {
-  const urls =
+  if (source.type === "mcp") {
-    source.type === "mcp"
+    return faviconForUrl((source.config.url as string) ?? null);
-      ? [source.config.url as string]
+  }
-      : source.type === "graphql"
+  if (source.type === "graphql") {
-        ? [source.config.endpoint as string]
+    return faviconForUrl((source.config.endpoint as string) ?? null);
-        : [source.config.baseUrl as string, source.config.spec as string];
+  }
-  return faviconForUrl(pickFaviconTarget(urls));
+  return faviconForUrl((source.config.baseUrl as string) ?? null);
 }
 function sourceKeyForSource(source: ToolSourceRecord): string | null {
-  if (source.type === "openapi") return `openapi:${source.name}`;
+  if (source.type === "openapi") return `source:${source.id}`;
-  if (source.type === "graphql") return `graphql:${source.name}`;
+  if (source.type === "graphql") return `source:${source.id}`;
   return null;
 }
+function toolSourceLabelForSource(source: ToolSourceRecord): string {
+  return `${source.type}:${source.name}`;
+}
+function sourceForCredentialKey(sources: ToolSourceRecord[], sourceKey: string): ToolSourceRecord | null {
+  const prefix = "source:";
+  if (!sourceKey.startsWith(prefix)) return null;
+  const sourceId = sourceKey.slice(prefix.length);
+  if (!sourceId) return null;
+  return sources.find((source) => source.id === sourceId) ?? null;
+}
 type SourceAuthType = "none" | "bearer" | "apiKey" | "basic";
 type SourceAuthMode = "workspace" | "actor";
   return `${auth.type}:${mode}`;
 }
+function credentialStatsForSource(source: ToolSourceRecord, credentials: CredentialRecord[]): {
+  workspaceCount: number;
+  actorCount: number;
+} {
+  const sourceKey = sourceKeyForSource(source);
+  if (!sourceKey) {
+    return { workspaceCount: 0, actorCount: 0 };
+  }
+  let workspaceCount = 0;
+  let actorCount = 0;
+  for (const credential of credentials) {
+    if (credential.sourceKey !== sourceKey) continue;
+    if (credential.scope === "workspace") workspaceCount += 1;
+    if (credential.scope === "actor") actorCount += 1;
+  }
+  return { workspaceCount, actorCount };
+}
 function formatQualityPercent(value: number): string {
   return `${Math.round(value * 100)}%`;
 }
   source,
   quality,
   qualityLoading,
+  credentialStats,
 }: {
   source: ToolSourceRecord;
   quality?: OpenApiSourceQuality;
   qualityLoading?: boolean;
+  credentialStats: { workspaceCount: number; actorCount: number };
 }) {
   const { context } = useSession();
   const deleteToolSource = useMutation(convexApi.workspace.deleteToolSource);
   const TypeIcon = source.type === "mcp" ? Server : Globe;
   const favicon = getSourceFavicon(source);
   const authBadge = formatSourceAuthBadge(source);
+  const auth = readSourceAuth(source);
+  const hasAuthConfigured = auth.type !== "none";
+  const totalCredentials = credentialStats.workspaceCount + credentialStats.actorCount;
   return (
     <div className="flex items-center gap-3 px-3 py-2.5 rounded-md bg-muted/40 group">
               {authBadge}
             </Badge>
           )}
+          {hasAuthConfigured && (
+            <Badge
+              variant="outline"
+              className={cn(
+                "text-[9px] font-mono uppercase tracking-wider",
+                totalCredentials > 0
+                  ? "text-terminal-green border-terminal-green/30"
+                  : "text-terminal-amber border-terminal-amber/30",
+              )}
+            >
+              creds ws:{credentialStats.workspaceCount} actor:{credentialStats.actorCount}
+            </Badge>
+          )}
           {source.type === "openapi" && quality && (
             <Badge
               variant="outline"
   }
 }
-type SourceOption = { source: ToolSourceRecord; key: string };
+type SourceOption = { source: ToolSourceRecord; key: string; label: string };
 function sourceAuthForKey(sourceOptions: SourceOption[], key: string): {
   type: SourceAuthType;
   return readSourceAuth(match.source);
 }
+function sourceOptionLabel(source: ToolSourceRecord): string {
+  return `${source.name} (${source.type})`;
+}
 function parseJsonObject(text: string): { value?: Record<string, unknown>; error?: string } {
   try {
     const parsed = JSON.parse(text);
   const [secretJsonText, setSecretJsonText] = useState("{}");
   const sourceOptions = sources
-    .map((source) => ({ source, key: sourceKeyForSource(source) }))
+    .map((source) => {
-    .filter((entry): entry is { source: ToolSourceRecord; key: string } => entry.key !== null);
+      const key = sourceKeyForSource(source);
+      return {
+        source,
+        key,
+        label: sourceOptionLabel(source),
+      };
+    })
+    .filter((entry): entry is SourceOption => entry.key !== null);
   const selectedAuth = sourceAuthForKey(sourceOptions, sourceKey);
   const selectedAuthBadge = selectedAuth.type === "none"
                 key={`${credential.sourceKey}:${credential.scope}:${credential.actorId ?? "workspace"}`}
                 className="flex items-center gap-3 px-3 py-2.5 rounded-md bg-muted/40"
               >
+                {(() => {
+                  const source = sourceForCredentialKey(sources, credential.sourceKey);
+                  const favicon = source ? getSourceFavicon(source) : null;
+                  return (
+                    <div className="h-8 w-8 rounded bg-muted flex items-center justify-center shrink-0 overflow-hidden">
+                      {favicon ? (
+                        <img src={favicon} alt="" width={20} height={20} className="w-5 h-5" loading="lazy" />
+                      ) : (
+                        <KeyRound className="h-4 w-4 text-muted-foreground" />
+                      )}
+                    </div>
+                  );
+                })()}
                 <div className="flex-1 min-w-0">
+                  {(() => {
+                    const source = sourceForCredentialKey(sources, credential.sourceKey);
+                    if (!source) {
+                      return (
+                        <p className="text-[11px] text-muted-foreground/80 font-mono mb-1">
+                          {credential.sourceKey}
+                        </p>
+                      );
+                    }
+                    return (
+                      <div className="flex items-center gap-1.5 mb-1">
+                        <span className="text-sm font-mono font-medium">{source.name}</span>
+                        <Badge variant="outline" className="text-[9px] font-mono uppercase tracking-wider">
+                          {source.type}
+                        </Badge>
+                      </div>
+                    );
+                  })()}
                   <div className="flex items-center gap-2 flex-wrap">
-                    <span className="text-sm font-mono font-medium">{credential.sourceKey}</span>
                     <Badge variant="outline" className="text-[9px] font-mono uppercase tracking-wider">
                       {credential.scope}
                     </Badge>
           </DialogHeader>
           <div className="space-y-3">
             <div className="space-y-1.5">
-              <Label className="text-xs text-muted-foreground">Source Key</Label>
+              <Label className="text-xs text-muted-foreground">Source</Label>
               {sourceOptions.length > 0 ? (
                 <Select value={sourceKey} onValueChange={handleSourceKeyChange}>
                   <SelectTrigger className="h-8 text-xs bg-background">
                   </SelectTrigger>
                   <SelectContent>
                     {sourceOptions.map((entry) => (
-                      <SelectItem key={entry.key} value={entry.key} className="text-xs font-mono">
+                      <SelectItem key={entry.key} value={entry.key} className="text-xs">
-                        {entry.key}
+                        {entry.label}
                       </SelectItem>
                     ))}
                   </SelectContent>
                 <Input
                   value={sourceKey}
                   onChange={(e) => handleSourceKeyChange(e.target.value)}
-                  placeholder="openapi:github"
+                  placeholder="source:<source-id>"
                   className="h-8 text-xs font-mono bg-background"
                 />
               )}
+              {sourceKey && (
+                <p className="text-[10px] text-muted-foreground font-mono">key: {sourceKey}</p>
+              )}
             </div>
             <div className="flex items-center gap-2 flex-wrap">
                     </div>
                   )}
                   {sourceItems.map((s) => {
-                    const sourceKey = sourceKeyForSource(s);
+                    const quality = sourceQuality[toolSourceLabelForSource(s)];
-                    const quality = sourceKey ? sourceQuality[sourceKey] : undefined;
+                    const credentialStats = credentialStatsForSource(s, credentials ?? []);
                     return (
                       <SourceCard
                         key={s.id}
                         source={s}
                         quality={quality}
                         qualityLoading={toolsLoading}
+                        credentialStats={credentialStats}
                       />
                     );
                   })}

executor/convex/executorNode.github-profile.e2e.test.ts+61−0

@@ -0,0 +1,61 @@
	1	import { expect, test } from "bun:test";
	2	import { convexTest } from "convex-test";
	3	import { internal } from "./_generated/api";
	4	import schema from "./schema";
	5
	6	const GITHUB_OPENAPI_SPEC_URL =
	7	"https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.json?convex_test_profile=github";
	8
	9	function setup() {
	10	return convexTest(schema, {
	11	"./database.ts": () => import("./database"),
	12	"./executorNode.ts": () => import("./executorNode"),
	13	"./workspaceToolCache.ts": () => import("./workspaceToolCache"),
	14	"./openApiSpecCache.ts": () => import("./openApiSpecCache"),
	15	"./_generated/api.js": () => import("./_generated/api.js"),
	16	});
	17	}
	18
	19	test("convex-test keeps GitHub inventory build warm-cache fast", async () => {
	20	const t = setup();
	21	const session = await t.mutation(internal.database.bootstrapAnonymousSession, {});
	22
	23	await t.mutation(internal.database.upsertToolSource, {
	24	workspaceId: session.workspaceId,
	25	name: "github-profile",
	26	type: "openapi",
	27	config: {
	28	spec: GITHUB_OPENAPI_SPEC_URL,
	29	},
	30	});
	31
	32	const coldStart = performance.now();
	33	const cold = await t.action(internal.executorNode.listToolsWithWarningsInternal, {
	34	workspaceId: session.workspaceId,
	35	actorId: session.actorId,
	36	clientId: session.clientId,
	37	});
	38	const coldMs = performance.now() - coldStart;
	39
	40	const warmStart = performance.now();
	41	const warm = await t.action(internal.executorNode.listToolsWithWarningsInternal, {
	42	workspaceId: session.workspaceId,
	43	actorId: session.actorId,
	44	clientId: session.clientId,
	45	});
	46	const warmMs = performance.now() - warmStart;
	47
	48	console.log(
	49	`github openapi convex-test profiling: cold=${coldMs.toFixed(0)}ms warm=${warmMs.toFixed(0)}ms tools=${cold.tools.length}`,
	50	);
	51
	52	expect(cold.tools.length).toBeGreaterThan(500);
	53	expect(cold.tools.length).toBe(warm.tools.length);
	54	expect(cold.warnings.some((warning: string) => warning.includes("skipped bundle"))).toBe(false);
	55	expect(warm.warnings.some((warning: string) => warning.includes("skipped bundle"))).toBe(false);
	56	expect(Object.keys(cold.dtsUrls).length).toBeGreaterThan(0);
	57	expect(Object.keys(warm.dtsUrls).length).toBeGreaterThan(0);
	58
	59	expect(coldMs).toBeLessThan(12_000);
	60	expect(coldMs).toBeGreaterThan(warmMs * 3);
	61	}, 240_000);

executor/convex/executorNode.ts+9−2

 }
 function sourceSignature(workspaceId: string, sources: Array<{ id: string; updatedAt: number; enabled: boolean }>): string {
-  const signatureVersion = "v14";
+  const signatureVersion = "v15";
   const parts = sources
     .map((source) => `${source.id}:${source.updatedAt}:${source.enabled ? 1 : 0}`)
     .sort();
 }
 function normalizeExternalToolSource(raw: {
+  id: string;
   type: ToolSourceRecord["type"];
   name: string;
   config: Record<string, unknown>;
     const result: McpToolSourceConfig = {
       type: "mcp",
       name: raw.name,
+      sourceId: raw.id,
+      sourceKey: `source:${raw.id}`,
       url: config.url,
       transport: config.transport as McpToolSourceConfig["transport"],
       queryParams: config.queryParams as McpToolSourceConfig["queryParams"],
     const result: GraphqlToolSourceConfig = {
       type: "graphql",
       name: raw.name,
+      sourceId: raw.id,
+      sourceKey: `source:${raw.id}`,
       endpoint: config.endpoint,
       schema: config.schema as GraphqlToolSourceConfig["schema"],
       auth: config.auth as GraphqlToolSourceConfig["auth"],
   const result: OpenApiToolSourceConfig = {
     type: "openapi",
     name: raw.name,
+    sourceId: raw.id,
+    sourceKey: `source:${raw.id}`,
     spec: spec as OpenApiToolSourceConfig["spec"],
     baseUrl: config.baseUrl as OpenApiToolSourceConfig["baseUrl"],
     auth: config.auth as OpenApiToolSourceConfig["auth"],
 const OPENAPI_SPEC_CACHE_TTL_MS = 5 * 60 * 60_000;
 /** Cache version — bump when PreparedOpenApiSpec shape changes. */
-const OPENAPI_CACHE_VERSION = "v14";
+const OPENAPI_CACHE_VERSION = "v15";
 async function publish(
   ctx: ActionCtx,

executor/convex/http.ts+0−11

 const http = httpRouter();
 const internalToken = process.env.EXECUTOR_INTERNAL_TOKEN ?? null;
-const mcpJwksByServer = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
 function getMcpAuthorizationServer(): string | null {
   return process.env.MCP_AUTHORIZATION_SERVER
     };
   }
-  const existingJwks = mcpJwksByServer.get(authorizationServer);
-  if (existingJwks) {
-    return {
-      enabled: true,
-      authorizationServer,
-      jwks: existingJwks,
-    };
-  }
   const jwks = createRemoteJWKSet(new URL("/oauth2/jwks", authorizationServer));
-  mcpJwksByServer.set(authorizationServer, jwks);
   return {
     enabled: true,
     authorizationServer,

executor/convex/workspace.ts+22−2

@@ -166,10 +166,20 @@ export const upsertToolSource = workspaceMutation({ · 165 unmodified lines
166	enabled: v.optional(v.boolean()),	166	enabled: v.optional(v.boolean()),
167	},	167	},
168	handler: async (ctx, args) => {	168	handler: async (ctx, args) => {
169	return await ctx.runMutation(internal.database.upsertToolSource, {	169	const source = await ctx.runMutation(internal.database.upsertToolSource, {
170	workspaceId: ctx.workspaceId,	170	workspaceId: ctx.workspaceId,
171	...args,	171	...args,
172	});	172	});
		173
		174	try {
		175	await ctx.scheduler.runAfter(0, internal.executorNode.listToolsWithWarningsInternal, {
		176	workspaceId: ctx.workspaceId,
		177	});
		178	} catch {
		179	// Best effort prewarm only.
		180	}
		181
		182	return source;
173	},	183	},
174	});	184	});
175		185
@@ -186,9 +196,19 @@ export const deleteToolSource = workspaceMutation({ · 10 unmodified lines
186	requireAdmin: true,	196	requireAdmin: true,
187	args: { sourceId: v.string() },	197	args: { sourceId: v.string() },
188	handler: async (ctx, args) => {	198	handler: async (ctx, args) => {
189	return await ctx.runMutation(internal.database.deleteToolSource, {	199	const deleted = await ctx.runMutation(internal.database.deleteToolSource, {
190	workspaceId: ctx.workspaceId,	200	workspaceId: ctx.workspaceId,
191	sourceId: args.sourceId,	201	sourceId: args.sourceId,
192	});	202	});
		203
		204	try {
		205	await ctx.scheduler.runAfter(0, internal.executorNode.listToolsWithWarningsInternal, {
		206	workspaceId: ctx.workspaceId,
		207	});
		208	} catch {
		209	// Best effort prewarm only.
		210	}
		211
		212	return deleted;
193	},	213	},
194	});	214	});

executor/lib/openapi-cache.test.ts+60−1

@@ -176,7 +176,7 @@ describe("prepareOpenApiSpec with large specs", () => { · 175 unmodified lines
176		176
177	expect(Object.keys(prepared.paths)).toHaveLength(250);	177	expect(Object.keys(prepared.paths)).toHaveLength(250);
178	expect(prepared.dts).toBeDefined();	178	expect(prepared.dts).toBeDefined();
179	expect(prepared.warnings.some((warning: string) => warning.includes("fast mode"))).toBe(false);	179	expect(prepared.warnings.some((warning: string) => warning.includes("skipped bundle"))).toBe(false);
180		180
181	const tools = buildOpenApiToolsFromPrepared(	181	const tools = buildOpenApiToolsFromPrepared(
182	{	182	{
@@ -344,6 +344,65 @@ describe("buildOpenApiToolsFromPrepared", () => { · 161 unmodified lines
344	);	344	);
345	});	345	});
346		346
		347	test("infers workspace auth from OpenAPI securitySchemes when source auth is unset", async () => {
		348	const spec: Record<string, unknown> = {
		349	openapi: "3.0.3",
		350	info: { title: "Auth inferred", version: "1.0.0" },
		351	servers: [{ url: "https://api.example.com" }],
		352	security: [{ bearerAuth: [] }],
		353	components: {
		354	securitySchemes: {
		355	bearerAuth: {
		356	type: "http",
		357	scheme: "bearer",
		358	},
		359	},
		360	},
		361	paths: {
		362	"/me": {
		363	get: {
		364	operationId: "getMe",
		365	tags: ["users"],
		366	responses: {
		367	"200": {
		368	description: "ok",
		369	content: {
		370	"application/json": {
		371	schema: {
		372	type: "object",
		373	properties: { id: { type: "string" } },
		374	},
		375	},
		376	},
		377	},
		378	},
		379	},
		380	},
		381	},
		382	};
		383
		384	const prepared = await prepareOpenApiSpec(spec, "auth-inferred");
		385	expect(prepared.inferredAuth).toEqual({ type: "bearer", mode: "workspace" });
		386
		387	const tools = buildOpenApiToolsFromPrepared(
		388	{
		389	type: "openapi",
		390	name: "auth-source",
		391	sourceKey: "source:test-source-id",
		392	spec,
		393	baseUrl: "https://api.example.com",
		394	},
		395	prepared,
		396	);
		397
		398	const meTool = tools.find((tool) => tool.metadata?.operationId === "getMe");
		399	expect(meTool?.credential).toEqual({
		400	sourceKey: "source:test-source-id",
		401	mode: "workspace",
		402	authType: "bearer",
		403	});
		404	});
		405
347	test("resolves shared parameter refs and maps 204 responses to void", async () => {	406	test("resolves shared parameter refs and maps 204 responses to void", async () => {
348	const spec: Record<string, unknown> = {	407	const spec: Record<string, unknown> = {
349	openapi: "3.0.3",	408	openapi: "3.0.3",

executor/lib/tool-sources.test.ts+3−2

       {
         type: "graphql",
         name: "linear",
+        sourceKey: "source:stable-linear-id",
         endpoint: `http://127.0.0.1:${server.port}/graphql`,
         auth: {
           type: "bearer",
     const helperTool = tools.find((tool) => tool.path === "linear.query.teams");
     expect(rawTool?.credential).toEqual({
-      sourceKey: "graphql:linear",
+      sourceKey: "source:stable-linear-id",
       mode: "actor",
       authType: "bearer",
     });
     expect(helperTool?.credential).toEqual({
-      sourceKey: "graphql:linear",
+      sourceKey: "source:stable-linear-id",
       mode: "actor",
       authType: "bearer",
     });

executor/lib/tool_sources.ts+73−5

 export interface McpToolSourceConfig {
   type: "mcp";
   name: string;
+  sourceId?: string;
+  sourceKey?: string;
   url: string;
   transport?: "sse" | "streamable-http";
   queryParams?: Record<string, string>;
 export interface OpenApiToolSourceConfig {
   type: "openapi";
   name: string;
+  sourceId?: string;
+  sourceKey?: string;
   spec: string | Record<string, unknown>;
   baseUrl?: string;
   auth?: OpenApiAuth;
 export interface GraphqlToolSourceConfig {
   type: "graphql";
   name: string;
+  sourceId?: string;
+  sourceKey?: string;
   endpoint: string;
   /** Optional static introspection result — if omitted, we introspect at load time */
   schema?: Record<string, unknown>;
   };
 }
+function getCredentialSourceKey(config: {
+  type: ExternalToolSourceConfig["type"];
+  name: string;
+  sourceKey?: string;
+}): string {
+  return config.sourceKey ?? `${config.type}:${config.name}`;
+}
 function buildOpenApiUrl(
   baseUrl: string,
   pathTemplate: string,
   paths: Record<string, unknown>;
   /** Raw .d.ts from openapiTS — cached as-is, extracted lazily on read */
   dts?: string;
+  /** Auth inferred from OpenAPI security schemes when explicit source auth is not configured. */
+  inferredAuth?: OpenApiAuth;
   warnings: string[];
 }
+function inferOpenApiAuth(spec: Record<string, unknown>): OpenApiAuth | undefined {
+  const components = asRecord(spec.components);
+  const securitySchemes = asRecord(components.securitySchemes);
+  if (Object.keys(securitySchemes).length === 0) {
+    return undefined;
+  }
+  const security = Array.isArray(spec.security)
+    ? spec.security.filter((entry): entry is Record<string, unknown> => Boolean(entry && typeof entry === "object"))
+    : [];
+  const referencedSchemeName = security
+    .flatMap((entry) => Object.keys(entry))
+    .find((name) => typeof securitySchemes[name] === "object");
+  const schemeName = referencedSchemeName ?? Object.keys(securitySchemes)[0];
+  if (!schemeName) return undefined;
+  const scheme = asRecord(securitySchemes[schemeName]);
+  const type = String(scheme.type ?? "").toLowerCase();
+  if (type === "http") {
+    const httpScheme = String(scheme.scheme ?? "").toLowerCase();
+    if (httpScheme === "bearer") {
+      return { type: "bearer", mode: "workspace" };
+    }
+    if (httpScheme === "basic") {
+      return { type: "basic", mode: "workspace" };
+    }
+    return undefined;
+  }
+  if (type === "apikey") {
+    const location = String(scheme.in ?? "").toLowerCase();
+    const header = typeof scheme.name === "string" ? scheme.name.trim() : "";
+    if (location === "header" && header.length > 0) {
+      return { type: "apiKey", mode: "workspace", header };
+    }
+    return undefined;
+  }
+  if (type === "oauth2" || type === "openidconnect") {
+    return { type: "bearer", mode: "workspace" };
+  }
+  return undefined;
+}
 export async function prepareOpenApiSpec(
   spec: string | Record<string, unknown>,
   sourceName = "openapi",
   const operationTypeIds = dts ? extractOperationIdsFromDts(dts) : new Set<string>();
   const servers = Array.isArray(bundled.servers) ? (bundled.servers as Array<{ url?: unknown }>) : [];
+  const inferredAuth = inferOpenApiAuth(bundled);
   return {
     servers: servers
       asRecord(asRecord(bundled.components).requestBodies),
     ),
     dts: dts ?? undefined,
+    ...(inferredAuth ? { inferredAuth } : {}),
     warnings,
   };
 }
     throw new Error(`OpenAPI source ${config.name} has no base URL (set baseUrl)`);
   }
-  const authHeaders = buildStaticAuthHeaders(config.auth);
+  const effectiveAuth = config.auth ?? prepared.inferredAuth;
-  const sourceKey = `openapi:${config.name}`;
+  const authHeaders = buildStaticAuthHeaders(effectiveAuth);
-  const credentialSpec = buildCredentialSpec(sourceKey, config.auth);
+  const sourceLabel = `openapi:${config.name}`;
+  const credentialSourceKey = getCredentialSourceKey(config);
+  const credentialSpec = buildCredentialSpec(credentialSourceKey, effectiveAuth);
   const paths = asRecord(prepared.paths);
   const tools: ToolDefinition[] = [];
       const tool: ToolDefinition & { _runSpec: SerializedTool["runSpec"] } = {
         path: buildOpenApiToolPath(config.name, tagRaw, operationIdRaw, usedToolPaths),
-        source: sourceKey,
+        source: sourceLabel,
         approval,
         description: String(operation.summary ?? operation.description ?? `${method.toUpperCase()} ${pathTemplate}`),
         metadata: {
 async function loadGraphqlTools(config: GraphqlToolSourceConfig): Promise<ToolDefinition[]> {
   const authHeaders = buildStaticAuthHeaders(config.auth);
   const sourceKey = `graphql:${config.name}`;
-  const credentialSpec = buildCredentialSpec(sourceKey, config.auth);
+  const credentialSpec = buildCredentialSpec(getCredentialSourceKey(config), config.auth);
   const sourceName = sanitizeSegment(config.name);
   // Introspect the schema

opencode.json+8−1

@@ -1,3 +1,10 @@
1	{	1	{
2	"$schema": "https://opencode.ai/config.json"	2	"$schema": "https://opencode.ai/config.json",
		3	"mcp":{
		4	"answeroverflow": {
		5	"type": "remote",
		6	"url": "https://www.answeroverflow.com/mcp",
		7	"enabled": true
		8	}
		9	}
3	}	10	}