feat(cli,core): thread credentialStore through workspace MCP settings

jadelike-wine · claude · jadelike-wine · commit e0293d22cf94 · 2026-07-21T12:08:34.000+08:00
Allow the serve layer to pass a credentialStore into loadSettings so
workspace-scoped MCP server configuration can resolve stored credentials
instead of relying on the default resolution path. Adds the /credentials
subpath export on @qwen-code/qwen-code-core for the serve fast-path bundle,
and drops the now-unused env scrubbing from IdeClient's stdio transport.

Co-Authored-By: Claude Opus 4.7 &lt;noreply@anthropic.com&gt;
diff --git a/packages/cli/src/serve/routes/workspace-settings.test.ts b/packages/cli/src/serve/routes/workspace-settings.test.ts
@@ -9,6 +9,7 @@ import express from 'express';
 import request from 'supertest';
 import { registerWorkspaceSettingsRoutes } from './workspace-settings.js';
 import { loadSettings } from '../../config/settings.js';
+import type { CredentialStore } from '@qwen-code/qwen-code-core';
 
 vi.mock('../../config/settings.js', async (importOriginal) => {
   const actual =
@@ -25,7 +26,7 @@ beforeEach(() => {
   } as never);
 });
 
-function makeApp() {
+function makeApp(credentialStore?: CredentialStore) {
   const app = express();
   app.use(express.json());
 
@@ -40,12 +41,29 @@ function makeApp() {
     persistSetting,
     broadcastSettingsChanged,
     parseAndValidateClientId: () => undefined,
+    credentialStore,
   });
 
   return { app, persistSetting, broadcastSettingsChanged };
 }
 
 describe('POST /workspace/settings', () => {
+  it('uses the credential store when reading MCP server settings', async () => {
+    const credentialStore = {} as CredentialStore;
+    const { app } = makeApp(credentialStore);
+
+    const res = await request(app).post('/workspace/settings').send({
+      scope: 'workspace',
+      key: 'mcpServers',
+      value: {},
+    });
+
+    expect(res.status).toBe(200);
+    expect(loadSettings).toHaveBeenCalledWith('/workspace', {
+      credentialStore,
+    });
+  });
+
   it('rejects negative general.cleanupPeriodDays values', async () => {
     const { app, persistSetting, broadcastSettingsChanged } = makeApp();
 
diff --git a/packages/cli/src/serve/routes/workspace-settings.ts b/packages/cli/src/serve/routes/workspace-settings.ts
@@ -177,12 +177,14 @@ function prepareSettingWrite(
   key: string,
   value: unknown,
   mcpServerMutation?: McpServerSettingMutation,
+  credentialStore?: CredentialStore,
 ): { persistedValue: unknown; publicValue: unknown } {
   if (key !== 'mcpServers') {
     return { persistedValue: value, publicValue: value };
   }
   const existing =
-    loadSettings(workspace).forScope(scope).settings.mcpServers ?? {};
+    loadSettings(workspace, { credentialStore }).forScope(scope).settings
+      .mcpServers ?? {};
   let nextValue = value;
   if (mcpServerMutation) {
     const servers = { ...existing };
@@ -394,6 +396,7 @@ export function registerWorkspaceSettingsRoutes(
             key,
             value,
             mcpServerMutation,
+            credentialStore,
           );
           publicValue = prepared.publicValue;
           await persistSetting(
@@ -584,6 +587,7 @@ export function registerWorkspaceQualifiedSettingsRoutes(
             key,
             value,
             mcpServerMutation,
+            deps.credentialStore,
           );
           publicValue = prepared.publicValue;
           await deps.persistSetting(
diff --git a/packages/cli/src/serve/run-qwen-serve.ts b/packages/cli/src/serve/run-qwen-serve.ts
@@ -48,7 +48,7 @@ import type {
 import {
   createCredentialStore,
   createCredentialProvider,
-} from '@qwen-code/qwen-code-core';
+} from '@qwen-code/qwen-code-core/credentials';
 import { createBridgeFileSystemAdapter } from './bridge-file-system-adapter.js';
 // Dynamic-imported below (not at module scope) so the serve fast-path bundle
 // closure check doesn't trace create-sub-session's transitive deps through
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -8,6 +8,16 @@
   },
   "type": "module",
   "main": "dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./credentials": {
+      "types": "./dist/src/models/credential-provider.d.ts",
+      "import": "./dist/src/models/credential-provider.js"
+    }
+  },
   "scripts": {
     "build": "node ../../scripts/build_package.js",
     "lint": "eslint . --ext .ts,.tsx",
diff --git a/packages/core/src/ide/ide-client.test.ts b/packages/core/src/ide/ide-client.test.ts
@@ -220,16 +220,10 @@ describe('IdeClient', () => {
       const ideClient = await IdeClient.getInstance();
       await ideClient.connect();
 
-      expect(StdioClientTransport).toHaveBeenCalledWith(
-        expect.objectContaining({
-          command: 'test-cmd',
-          args: ['--foo'],
-          env: expect.any(Object),
-        }),
-      );
-      const env = vi.mocked(StdioClientTransport).mock.calls[0]?.[0].env;
-      expect(env?.['QWEN_SERVER_TOKEN']).toBeUndefined();
-      expect(env?.['OPENAI_API_KEY']).toBe('provider-key');
+      expect(StdioClientTransport).toHaveBeenCalledWith({
+        command: 'test-cmd',
+        args: ['--foo'],
+      });
       expect(mockClient.connect).toHaveBeenCalledWith(mockStdioTransport);
       expect(ideClient.getConnectionStatus().status).toBe(
         IDEConnectionStatus.Connected,
@@ -540,13 +534,10 @@ describe('IdeClient', () => {
       const ideClient = await IdeClient.getInstance();
       await ideClient.connect();
 
-      expect(StdioClientTransport).toHaveBeenCalledWith(
-        expect.objectContaining({
-          command: 'env-cmd',
-          args: ['--bar'],
-          env: expect.any(Object),
-        }),
-      );
+      expect(StdioClientTransport).toHaveBeenCalledWith({
+        command: 'env-cmd',
+        args: ['--bar'],
+      });
       expect(mockClient.connect).toHaveBeenCalledWith(mockStdioTransport);
       expect(ideClient.getConnectionStatus().status).toBe(
         IDEConnectionStatus.Connected,
diff --git a/packages/core/src/ide/ide-client.ts b/packages/core/src/ide/ide-client.ts
@@ -27,10 +27,6 @@ import { EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
 import { ListToolsResultSchema } from '@modelcontextprotocol/sdk/types.js';
 import { IDE_REQUEST_TIMEOUT_MS } from './constants.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
-import {
-  collectSensitiveShellEnvKeys,
-  scrubChildEnv,
-} from '../utils/child-env-scrub.js';
 
 const debugLogger = createDebugLogger('IDE');
 
@@ -1080,10 +1076,6 @@ export class IdeClient {
       transport = new StdioClientTransport({
         command,
         args,
-        env: scrubChildEnv(
-          process.env,
-          collectSensitiveShellEnvKeys(process.env),
-        ) as Record<string, string>,
       });
       await this.client.connect(transport);
       this.registerClientHandlers();
