Harden stitch enable: guard, null mcp, OAuth opt-out (#17)

Match cmd_serena_enable and refuse to overwrite an existing stitch
entry. Write through the normalized mcp dict so "mcp": null fails
closed instead of raising TypeError. Set oauth: false in API-key mode
so a bad STITCH_API_KEY surfaces as an auth error rather than opening
a browser OAuth flow.

Also make the missing-release-tag test skip explicitly when v$VERSION
exists in the checkout; it previously passed in CI only because
actions/checkout does not fetch tags at fetch-depth 1.

Author: kuker24

lib/install.py

@@ -1302,6 +1302,9 @@ def cmd_stitch_enable(oauth: bool = False) -> int:
         "enabled": True,
     }
     if not oauth:
+        # API-key mode: suppress OpenCode's automatic OAuth-on-401 so a bad key
+        # surfaces as an auth error instead of starting a browser OAuth flow.
+        spec["oauth"] = False
         spec["headers"] = {
             "X-Goog-Api-Key": "{env:STITCH_API_KEY}",
         }
@@ -1324,6 +1327,9 @@ def cmd_stitch_enable(oauth: bool = False) -> int:
     mcp = data.get("mcp") or {}
     if not isinstance(mcp, dict):
         die("OPENCODE_CONFIG_INVALID mcp")
+    if "stitch" in mcp:
+        info("stitch MCP already present; not overwriting (run `stitch disable` first to change auth mode)")
+        return 0
     if jsonc.contains_comments(raw):
         try:
             merged = jsonc.upsert_mcp_servers(raw, {"stitch": spec})
@@ -1332,7 +1338,8 @@ def cmd_stitch_enable(oauth: bool = False) -> int:
         except Exception as exc:
             die(f"OPENCODE_CONFIG_JSONC_SURGICAL_FAILED: {exc}")
     else:
-        data.setdefault("mcp", {})["stitch"] = spec
+        mcp["stitch"] = spec
+        data["mcp"] = mcp
         path.write_text(jsonc.dumps(data), encoding="utf-8")
     info(f"enabled stitch MCP in {path}")
     return 0

tests/test_install.py

@@ -306,6 +306,38 @@ def test_stitch_enable_requires_env_or_oauth(self):
         with self.assertRaises(SystemExit):
             cmd_stitch_enable(oauth=False)
 
+    def test_stitch_enable_does_not_overwrite_existing_entry(self):
+        cfg = self.tmp / ".config" / "opencode" / "opencode.jsonc"
+        cfg.parent.mkdir(parents=True, exist_ok=True)
+        original = (
+            "{\n"
+            '  "mcp": {\n'
+            '    "stitch": {\n'
+            '      "type": "remote",\n'
+            '      "url": "https://stitch.googleapis.com/mcp",\n'
+            '      "enabled": true,\n'
+            '      "headers": {"Authorization": "{env:MY_OWN_TOKEN}"}\n'
+            "    }\n"
+            "  }\n"
+            "}\n"
+        )
+        cfg.write_text(original, encoding="utf-8")
+        os.environ["STITCH_API_KEY"] = "mock_secret_key_12345"
+        try:
+            self.assertEqual(cmd_stitch_enable(oauth=False), 0)
+        finally:
+            os.environ.pop("STITCH_API_KEY", None)
+        self.assertEqual(cfg.read_text(encoding="utf-8"), original)
+
+    def test_stitch_enable_null_mcp_fails_closed(self):
+        cfg = self.tmp / ".config" / "opencode" / "opencode.jsonc"
+        cfg.parent.mkdir(parents=True, exist_ok=True)
+        original = '{\n  "mcp": null\n}\n'
+        cfg.write_text(original, encoding="utf-8")
+        self.assertEqual(cmd_stitch_enable(oauth=True), 0)
+        data = jsonc.loads(cfg.read_text(encoding="utf-8"))
+        self.assertEqual(data["mcp"]["stitch"]["url"], "https://stitch.googleapis.com/mcp")
+
     def test_stitch_enable_with_env_key(self):
         os.environ["STITCH_API_KEY"] = "mock_secret_key_12345"
         try:

tests/test_release_artifacts.py

@@ -171,6 +171,18 @@ def test_builder_version_tag_mismatch(self):
 
     def test_builder_missing_release_tag_fails_closed(self):
         head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=ROOT, text=True).strip()
+        version = (ROOT / "VERSION").read_text(encoding="utf-8").strip()
+        expected_tag = f"v{version}"
+        tag_exists = (
+            subprocess.run(
+                ["git", "rev-parse", "-q", "--verify", f"refs/tags/{expected_tag}"],
+                cwd=ROOT,
+                capture_output=True,
+            ).returncode
+            == 0
+        )
+        if tag_exists:
+            self.skipTest(f"{expected_tag} exists in this checkout; missing-tag path not reachable")
         proc = _run_builder("--sha", head)
         self.assertNotEqual(proc.returncode, 0)
         self.assertIn("SOURCE_REF_MISMATCH", proc.stderr)