chore: remove all preconfigured MCP servers - #4
Merged
Conversation
Removes the Sentry MCP server, GitHub MCP server, and bundled Sentry CLI along with their associated environment variables and documentation.
Removes the remaining 'context7' MCP entry from opencode-user-config.json along with CONTEXT7_API_KEY in .env.example and the README env table. The image now ships with no MCP servers preconfigured; users add their own via project-local opencode.json or by editing the user config before building.
Reverts the Sentry CLI install + binary copy that 987ce4a removed. The PR's intent is now strictly 'remove MCP integrations' — the standalone `sentry` CLI in /usr/local/bin (and its SENTRY_* env vars) is back.
MathurAditya724
changed the title
gh CLI auto-detects GH_TOKEN from env on every invocation, so auth survives Railway redeploys without persisting ~/.config/gh (which is on the ephemeral overlay rootfs and wiped each deploy).
MathurAditya724
added a commit
that referenced
this pull request
May 1, 2026
- opencode-webhooks README: replace stale `x-email-from` header reference with JSON `from` field (finding #1). - http.ts: rewrite MAX_BODY_BYTES comment (no longer about RFC822); add MAX_EMAIL_BODY_BYTES = 64 KB and an optional maxBytes arg to readBodyBytes; email handler now uses the tighter cap (finding #2). - cloudflare-email-worker README: note that a malformed regex literal in ALLOWED_SENDERS will throw at module init and the worker won't start (finding #3). - email handler: parseEmailEvent's `str` now throws on non-string for required fields (from/to/subject/message_id) so the 400 detail names the offending field instead of misleading 'missing' messages (finding #4). - Test gap for email identity fallback chain tracked in #14; no tests added in this commit (finding #5).
MathurAditya724
added a commit
that referenced
this pull request
May 1, 2026
… SIDECAR_URL → WEBHOOK_URL (#13) * refactor(email-worker): wrangler.json, inline ALLOWED_SENDERS, rename SIDECAR_URL → WEBHOOK_URL - Replace wrangler.toml with wrangler.json (with $schema reference for editor validation). TOML and JSON are both first-class wrangler config formats; JSON keeps the worker package consistent with the rest of the repo's config files (package.json, tsconfig.json, webhooks.json). - Move ALLOWED_SENDERS out of wrangler vars and into a top-level TypeScript const at the head of src/index.ts. The allowlist is PR-reviewed code now (typed as readonly string[]), compiled once at module load (zero per-request parse overhead), and a malformed regex fails the deploy instead of silently dropping at runtime. The Env shape no longer needs an ALLOWED_SENDERS field. - Rename SIDECAR_URL → WEBHOOK_URL in wrangler.json vars, the Env interface, and the fetch call. 'Sidecar' was misleading anyway — the plugin is in-process with opencode, not a sidecar process. WEBHOOK_URL clearly names what it points at: the plugin's /webhooks/email endpoint. * feat(email): worker becomes dumb pipe — unconditional forward + JSON event The Cloudflare Email Worker now does two things per inbound email: 1. message.forward(env.FORWARD_TO) unconditionally (if set), so every email reaches the operator's real inbox preserving DKIM. Wrapped in try/catch so a misconfigured FORWARD_TO doesn't block webhook dispatch — failure is logged loudly and we continue. 2. If the From address is in ALLOWED_SENDERS, build a small JSON event from the headers we route on (from, to, subject, message_id, in_reply_to, references, list_id, x_github_reason, x_github_sender), HMAC-sign it, and POST as application/json to WEBHOOK_URL. The worker no longer parses RFC822 in the plugin path — it just hands Cloudflare's already-parsed headers to the plugin verbatim. The body is never sent at all (it never was used; canonical state comes from the GitHub API). Plugin side: - handlers/email.ts: reads req.json() instead of parsing RFC822; validates the event shape; everything downstream (identity, synth, dispatch) is unchanged. - email/identity.ts: accepts the EmailEvent JSON shape instead of an EmailHeaders object. Same regex matchers; same in-reply-to / references fallback chain. - email/synthesize.ts: reads metadata directly from the event object. - email/parse.ts: deleted (no more RFC822 parsing). Other changes: - wrangler.json: added FORWARD_TO var (optional) and observability.logs.enabled = true so 'wrangler tail' and the Cloudflare dashboard show structured logs. - READMEs: updated wire format, architecture diagrams, failure-mode table on the worker side. Verified: bun run typecheck passes for both packages; wrangler deploy --dry-run accepts the new config with both vars bound. * fix: review findings on PR #13 (dumb-pipe + wrangler.json) - opencode-webhooks README: replace stale `x-email-from` header reference with JSON `from` field (finding #1). - http.ts: rewrite MAX_BODY_BYTES comment (no longer about RFC822); add MAX_EMAIL_BODY_BYTES = 64 KB and an optional maxBytes arg to readBodyBytes; email handler now uses the tighter cap (finding #2). - cloudflare-email-worker README: note that a malformed regex literal in ALLOWED_SENDERS will throw at module init and the worker won't start (finding #3). - email handler: parseEmailEvent's `str` now throws on non-string for required fields (from/to/subject/message_id) so the 400 detail names the offending field instead of misleading 'missing' messages (finding #4). - Test gap for email identity fallback chain tracked in #14; no tests added in this commit (finding #5).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
context7,github,sentry) fromopencode-user-config.json. Themcpblock is gone entirely; users add their own via project-localopencode.jsonor by editing the user config before building.CONTEXT7_API_KEYandGITHUB_MCP_TOKENare removed from.env.example.GH_TOKENto.env.example+ README env-var table — auth for the bundledghCLI, picked up automatically withoutgh auth login. Survives Railway redeploys with no on-disk state, mirroring howsentry-clireadsSENTRY_AUTH_TOKEN.Not removed
The bundled Sentry CLI (
/usr/local/bin/sentry) and itsSENTRY_AUTH_TOKEN/SENTRY_URLenv vars stay — those are unrelated to the Sentry MCP server.Notes
opencode.jsonwithout affecting the base image.