tree 3776a645f6d7a2471989496130ce02ed70e8cf78
parent e59a2e151da777fba13a0978c00c16a1ee3b6122
author banksean <banksean@gmail.com> 1751148932 +0000
committer banksean <banksean@gmail.com> 1751149050 +0000

sketch: fix MCP server connection error in -unsafe mode by setting SKETCH_PUB_KEY environment variable

Fix MCP server connection failure with 'no Public-Key' status 400 error when running sketch -unsafe with skaband integration, by properly setting the SKETCH_PUB_KEY environment variable for MCP authentication placeholder replacement.

Problems Solved:

MCP Authentication Failure:
- Running sketch -unsafe with skaband connection fails with 'MCP server connection failed: MCP server "sketchdev": failed to initialize MCP client: transport error: request failed with status 400: no Public-Key'
- setupAndRunAgent receives pubKey parameter from skaband login but doesn't set SKETCH_PUB_KEY environment variable
- MCP placeholder replacement in agent.go expects SKETCH_PUB_KEY environment variable to replace '_sketch_public_key_' placeholder
- Empty placeholder replacement results in missing Public-Key header in MCP requests

Authentication Flow Gap:
- Container mode sets SKETCH_PUB_KEY from environment in runInContainerMode
- Unsafe mode obtains pubKey from skabandclient.Login but doesn't propagate to environment
- setupAndRunAgent receives pubKey parameter but doesn't use it for environment variable setup
- MCP configuration uses '_sketch_public_key_' placeholder expecting environment variable replacement

Solution Implementation:

Environment Variable Setup:
- Added SKETCH_PUB_KEY environment variable setting in setupAndRunAgent when pubKey is provided
- Check for non-empty pubKey before setting environment variable to avoid overwriting existing values
- Environment variable set early in setupAndRunAgent before MCP server initialization
- Maintains consistent behavior between container and unsafe modes

Authentication Flow Completion:
- Container mode: SKETCH_PUB_KEY set from container environment → MCP placeholder replacement
- Unsafe mode: pubKey from skaband login → SKETCH_PUB_KEY environment variable → MCP placeholder replacement
- Both modes now have complete authentication flow for MCP server connections
- MCP requests include proper Public-Key header for skaband authentication

Implementation Details:

Code Changes:
- Added conditional os.Setenv('SKETCH_PUB_KEY', pubKey) in setupAndRunAgent
- Placement before working directory setup ensures early environment configuration
- Only sets environment variable when pubKey is non-empty string
- Preserves existing environment if pubKey is empty to avoid overwrites

Test Coverage:
- Added TestSetupAndRunAgent_SetsPubKeyEnvVar to verify environment variable setting
- Added TestSetupAndRunAgent_DoesNotSetEmptyPubKey to verify empty pubKey handling
- Tests verify environment variable setting and preservation behavior
- Comprehensive coverage of both positive and negative scenarios

Error Resolution:
- MCP server requests now include proper Public-Key header
- skaband /api/mcp endpoint receives authentication for session validation
- Eliminates 'no Public-Key' 400 status errors in unsafe mode
- Maintains existing container mode behavior without changes

Files Modified:
- sketch/cmd/sketch/main.go: Added SKETCH_PUB_KEY environment variable setting in setupAndRunAgent
- sketch/cmd/sketch/main_test.go: Added test coverage for pubKey environment variable behavior

The fix ensures consistent MCP server authentication across both container and unsafe execution modes by properly propagating the public key from skaband login to the MCP placeholder replacement system.

Co-Authored-By: sketch <hello@sketch.dev>
Change-ID: s2564fc63bdd663a0k