OCI auth in Wassette component subcommand

[Mossaka]

Wassette component load OCI should support authentication with OCI registry to load private packages

[Mossaka]

/plan break this down

[github-actions]

Agentic Issue Triage triggered by this issue.

[github-actions]

Agentic Plan triggered by this issue comment.

[github-actions]

📋 Implementation Plan

I've analyzed the codebase and broken down this issue into 4 focused, implementable subtasks:

Subtasks Overview

1️⃣ [Subtask 1/4] Add OCI authentication infrastructure and Docker config support

Foundation layer - Implements the core authentication infrastructure by reading Docker config files (~/.docker/config.json), which is the standard way container tools authenticate. This provides a seamless experience for developers who already use Docker/Podman.

Key changes: New oci_auth.rs module, update loader.rs and oci_multi_layer.rs to use authentication instead of hardcoded Anonymous.

2️⃣ [Subtask 2/4] Add CLI flags for explicit OCI authentication credentials

CLI enhancement - Adds command-line flags (--registry-user, --registry-password, --registry-password-stdin) and environment variables for CI/CD and scenarios where Docker config isn't available.

Key changes: Update commands.rs with new flags, pass credentials through the CLI handler chain.

3️⃣ [Subtask 3/4] Add OCI authentication to MCP load-component tool

MCP integration - Extends the built-in load-component MCP tool to accept authentication credentials, enabling AI agents to load private components interactively.

Key changes: Update MCP tool schema, handle credentials in handle_load_component(), ensure password security in logs.

4️⃣ [Subtask 4/4] Add comprehensive tests and documentation for OCI authentication

Production readiness - Comprehensive testing (unit, integration, manual) and documentation updates including new guides for using private registries, security best practices, and CI/CD integration examples.

Key changes: New test files, update cookbook docs, add troubleshooting guides.

---

Implementation Approach

Recommended order: Complete subtasks sequentially (1 → 2 → 3 → 4) as each builds on the previous.

Why this breakdown?

• ✅ Each subtask is independently implementable and testable
• ✅ Clear dependencies and logical progression
• ✅ Incremental value delivery (Docker config works after Subtask 1)
• ✅ Different areas of expertise (CLI, MCP, testing, docs) can work in parallel if needed
• ✅ Follows existing Wassette patterns and architecture

Technical Architecture

┌─────────────────────────────────────────────────────────┐
│  MCP Client (AI Agent) / CLI User                       │
└─────────────┬───────────────────────────────────────────┘
              │
              ├─ MCP Tool: load-component (Subtask 3)
              │  - registry_user (optional)
              │  - registry_password (optional)
              │
              ├─ CLI: wassette component load (Subtask 2)
              │  - --registry-user
              │  - --registry-password / --registry-password-stdin
              │  - OCI_REGISTRY_USER / OCI_REGISTRY_PASSWORD env vars
              │
              v
┌─────────────────────────────────────────────────────────┐
│  Authentication Layer (Subtask 1)                       │
│  ├─ oci_auth.rs                                         │
│  │  └─ Priority: explicit creds > Docker config > Anon  │
│  └─ Docker config: ~/.docker/config.json                │
└─────────────┬───────────────────────────────────────────┘
              │
              v
┌─────────────────────────────────────────────────────────┐
│  OCI Loading (Updated in Subtask 1)                     │
│  ├─ loader.rs (single-layer)                            │
│  └─ oci_multi_layer.rs (multi-layer)                    │
└─────────────────────────────────────────────────────────┘

---

Generated by Plan agent via /plan command. Each subtask includes detailed implementation guidance, acceptance criteria, and testing strategy.

Related Items

• Issue: #564

AI generated by Plan for #559