fix(dashboard): OpenCode 配置顶层 mcp 包裹；bump secrets-mcp 0.1.5

Made-with: Cursor

.gitea/workflows/secrets.yml

@@ -9,6 +9,7 @@ on:
       - 'Cargo.lock'
       # systemd / 部署模板变更也应跑构建（产物无变时可快速跳过 check）
       - 'deploy/**'
+      - '.gitea/workflows/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -19,6 +20,7 @@ permissions:
 
 env:
   MCP_BINARY: secrets-mcp
+  RUST_TOOLCHAIN: 1.94.0
   CARGO_INCREMENTAL: 0
   CARGO_NET_RETRY: 10
   CARGO_TERM_COLOR: always
@@ -144,12 +146,15 @@ jobs:
     steps:
       - name: 安装 Rust
         run: |
-          if ! command -v cargo >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          if ! command -v rustup >/dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain "${RUST_TOOLCHAIN}"
             echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
           fi
           source "$HOME/.cargo/env" 2>/dev/null || true
-          rustup component add rustfmt clippy
+          rustup toolchain install "${RUST_TOOLCHAIN}" --profile minimal --component rustfmt --component clippy
+          rustup default "${RUST_TOOLCHAIN}"
+          rustc -V
+          cargo -V
 
       - uses: actions/checkout@v4
 
@@ -160,9 +165,9 @@ jobs:
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-            target
-          key: cargo-check-${{ hashFiles('Cargo.lock') }}
+          key: cargo-check-${{ env.RUST_TOOLCHAIN }}-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
+            cargo-check-${{ env.RUST_TOOLCHAIN }}-
             cargo-check-
 
       - run: cargo fmt -- --check
@@ -179,12 +184,16 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y pkg-config musl-tools binutils curl
-          if ! command -v cargo >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          if ! command -v rustup >/dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain "${RUST_TOOLCHAIN}"
+            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
           fi
           source "$HOME/.cargo/env" 2>/dev/null || true
-          rustup target add x86_64-unknown-linux-musl
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          rustup toolchain install "${RUST_TOOLCHAIN}" --profile minimal
+          rustup default "${RUST_TOOLCHAIN}"
+          rustup target add x86_64-unknown-linux-musl --toolchain "${RUST_TOOLCHAIN}"
+          rustc -V
+          cargo -V
 
       - uses: actions/checkout@v4
 
@@ -195,9 +204,9 @@ jobs:
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-            target
-          key: cargo-x86_64-unknown-linux-musl-${{ hashFiles('Cargo.lock') }}
+          key: cargo-x86_64-unknown-linux-musl-${{ env.RUST_TOOLCHAIN }}-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
+            cargo-x86_64-unknown-linux-musl-${{ env.RUST_TOOLCHAIN }}-
             cargo-x86_64-unknown-linux-musl-
 
       - name: 构建 secrets-mcp (musl)
@@ -258,13 +267,17 @@ jobs:
 
       - name: 安装 Rust
         run: |
-          if ! command -v cargo >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          if ! command -v rustup >/dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain "${RUST_TOOLCHAIN}"
             echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
           fi
           source "$HOME/.cargo/env" 2>/dev/null || true
           sudo apt-get update -qq && sudo apt-get install -y -qq pkg-config musl-tools
-          rustup target add x86_64-unknown-linux-musl
+          rustup toolchain install "${RUST_TOOLCHAIN}" --profile minimal
+          rustup default "${RUST_TOOLCHAIN}"
+          rustup target add x86_64-unknown-linux-musl --toolchain "${RUST_TOOLCHAIN}"
+          rustc -V
+          cargo -V
 
       - name: 缓存 Cargo
         uses: actions/cache@v4
@@ -273,9 +286,9 @@ jobs:
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-            target
-          key: cargo-x86_64-unknown-linux-musl-${{ hashFiles('Cargo.lock') }}
+          key: cargo-x86_64-unknown-linux-musl-${{ env.RUST_TOOLCHAIN }}-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
+            cargo-x86_64-unknown-linux-musl-${{ env.RUST_TOOLCHAIN }}-
             cargo-x86_64-unknown-linux-musl-
 
       - name: 构建 secrets-mcp

Cargo.lock

@@ -1949,7 +1949,7 @@ dependencies = [
 
 [[package]]
 name = "secrets-mcp"
-version = "0.1.1"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "askama",

crates/secrets-mcp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "secrets-mcp"
-version = "0.1.1"
+version = "0.1.5"
 edition.workspace = true
 
 [[bin]]

crates/secrets-mcp/templates/dashboard.html

@@ -535,12 +535,14 @@ function buildOpencodeEntry(apiKey, encKey) {
     };
 }
 
+/** Full OpenCode config: MCP servers live under top-level `mcp`. */
 function buildOpencodeConfigText(apiKey, encKey) {
-    return JSON.stringify({ secrets: buildOpencodeEntry(apiKey, encKey) }, null, 2);
+    return JSON.stringify({ mcp: { secrets: buildOpencodeEntry(apiKey, encKey) } }, null, 2);
 }
 
+/** Strip outer `{` `}` so user can paste `secrets` under an existing `mcp` object. */
 function buildOpencodeMergeSnippet(apiKey, encKey) {
-    const wrapped = buildOpencodeConfigText(apiKey, encKey);
+    const wrapped = JSON.stringify({ secrets: buildOpencodeEntry(apiKey, encKey) }, null, 2);
     const lines = wrapped.split('\n');
     return lines.length < 3 ? wrapped : lines.slice(1, -1).join('\n');
 }

rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.94.0"
+components = ["rustfmt", "clippy"]