@ai-sdk/harness-opencode 1.0.109 → 1.0.110

package/dist/index.js

@@ -3,7 +3,7 @@ import path from "path";
 import {
   commonTool,
   HARNESS_V1_BUILTIN_TOOLS,
-  HarnessCapabilityUnsupportedError,
+  HarnessCapabilityUnsupportedError as HarnessCapabilityUnsupportedError2,
   harnessV1DiagnosticFromBridgeFrame
 } from "@ai-sdk/harness";
 import {
@@ -28,7 +28,7 @@ import {
   writeSkills
 } from "@ai-sdk/harness/utils";
 import {
-  safeParseJSON,
+  safeParseJSON as safeParseJSON2,
   tool
 } from "@ai-sdk/provider-utils";
 import { WebSocket } from "ws";
@@ -84,11 +84,19 @@ import {
   getAiGatewayAuthFromEnv,
   isHarnessAuthenticationEnvironment
 } from "@ai-sdk/harness/utils";
+var OPENCODE_SUBSCRIPTION_ACCESS_TOKEN_ENVIRONMENT_VARIABLE = "AI_SDK_OPENCODE_NATIVE_ACCESS_TOKEN";
 var OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES = [
   "AI_GATEWAY_API_KEY",
   "OPENAI_API_KEY",
   "ANTHROPIC_API_KEY",
-  "ANTHROPIC_AUTH_TOKEN"
+  "ANTHROPIC_AUTH_TOKEN",
+  "XAI_API_KEY",
+  "GITHUB_TOKEN",
+  "GITHUB_COPILOT_TOKEN",
+  "POE_API_KEY",
+  "OPENCODE_API_KEY",
+  "GITLAB_TOKEN",
+  OPENCODE_SUBSCRIPTION_ACCESS_TOKEN_ENVIRONMENT_VARIABLE
 ];
 function createOpenCodeRequestTransformations({
   env: environment,
@@ -160,18 +168,53 @@ function createOpenCodeRequestTransformations({
       }
       return transformations;
     }
+    case "xai":
+      return createBearerTransformation({
+        environment,
+        sandboxEnvironment,
+        environmentVariableName: "XAI_API_KEY",
+        matchUrl: environment.XAI_BASE_URL ?? "https://api.x.ai/v1"
+      });
+    case "github-copilot":
+      return createBearerTransformation({
+        environment,
+        sandboxEnvironment,
+        environmentVariableName: environment.GITHUB_COPILOT_TOKEN != null ? "GITHUB_COPILOT_TOKEN" : "GITHUB_TOKEN",
+        matchUrl: "https://api.githubcopilot.com"
+      });
+    case "poe":
+      return createBearerTransformation({
+        environment,
+        sandboxEnvironment,
+        environmentVariableName: "POE_API_KEY",
+        matchUrl: "https://api.poe.com"
+      });
+    case "opencode-go":
+      return createBearerTransformation({
+        environment,
+        sandboxEnvironment,
+        environmentVariableName: "OPENCODE_API_KEY",
+        matchUrl: "https://opencode.ai/zen/go/v1"
+      });
+    case "gitlab":
+      return createBearerTransformation({
+        environment,
+        sandboxEnvironment,
+        environmentVariableName: "GITLAB_TOKEN",
+        matchUrl: environment.GITLAB_INSTANCE_URL ?? "https://gitlab.com"
+      });
   }
 }
 function resolveOpenCodeProvider({
   model,
   provider
 }) {
-  if (provider === "anthropic" || provider === "openai") {
+  if (isDirectProvider(provider)) {
     return provider;
   }
   if (model?.includes("/")) {
     const [modelProvider] = model.split("/");
-    if (modelProvider === "anthropic" || modelProvider === "openai") {
+    if (isDirectProvider(modelProvider)) {
       return modelProvider;
     }
   }
@@ -186,11 +229,11 @@ function resolveOpenCodeEnv({
   const suppliedEnvironment = isHarnessAuthenticationEnvironment(auth);
   const authenticationEnvironment = suppliedEnvironment ? auth : processEnv;
   const selectedProvider = resolveOpenCodeProvider({ model, provider });
-  if (selectedProvider === "openai" && auth === "openai") {
-    return pickOpenAI({ processEnv: authenticationEnvironment });
-  }
-  if (selectedProvider === "anthropic" && auth === "anthropic") {
-    return pickAnthropic({ processEnv: authenticationEnvironment });
+  if (selectedProvider === "openai" && auth === "openai" || selectedProvider === "anthropic" && auth === "anthropic") {
+    return pickDirectProvider({
+      provider: selectedProvider,
+      processEnv: authenticationEnvironment
+    });
   }
   const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({
     env: authenticationEnvironment
@@ -198,7 +241,10 @@ function resolveOpenCodeEnv({
   if (auth === "ai-gateway" || gatewayAuthFromEnv.apiKey) {
     return pickGateway({ gatewayAuthFromEnv });
   }
-  return selectedProvider === "openai" ? pickOpenAI({ processEnv: authenticationEnvironment }) : pickAnthropic({ processEnv: authenticationEnvironment });
+  return pickDirectProvider({
+    provider: selectedProvider,
+    processEnv: authenticationEnvironment
+  });
 }
 function resolveOpenCodeAuthenticationMode({
   auth,
@@ -250,6 +296,51 @@ function pickAnthropic({
   if (baseUrl) env.ANTHROPIC_BASE_URL = baseUrl;
   return env;
 }
+function pickDirectProvider({
+  provider,
+  processEnv
+}) {
+  if (provider === "openai") return pickOpenAI({ processEnv });
+  if (provider === "anthropic") return pickAnthropic({ processEnv });
+  const names = provider === "xai" ? ["XAI_API_KEY", "XAI_BASE_URL"] : provider === "github-copilot" ? ["GITHUB_COPILOT_TOKEN", "GITHUB_TOKEN"] : provider === "poe" ? ["POE_API_KEY"] : provider === "opencode-go" ? ["OPENCODE_API_KEY"] : ["GITLAB_TOKEN", "GITLAB_INSTANCE_URL"];
+  return Object.fromEntries(
+    names.flatMap(
+      (name) => processEnv[name] == null ? [] : [[name, processEnv[name]]]
+    )
+  );
+}
+function hasOpenCodeCredential({
+  environment,
+  authenticationMode
+}) {
+  if (authenticationMode === "ai-gateway") {
+    return environment.AI_GATEWAY_API_KEY != null;
+  }
+  return Object.keys(environment).some(
+    (name) => name.endsWith("_API_KEY") || name.endsWith("_TOKEN") || name === "ANTHROPIC_AUTH_TOKEN"
+  );
+}
+function createBearerTransformation({
+  environment,
+  sandboxEnvironment,
+  environmentVariableName,
+  matchUrl
+}) {
+  const credential = environment[environmentVariableName];
+  const sandboxCredential = sandboxEnvironment[environmentVariableName];
+  return credential == null || sandboxCredential == null ? [] : [
+    createCredentialRequestTransformation({
+      matchUrl,
+      matchHeaders: {
+        Authorization: `Bearer ${sandboxCredential}`
+      },
+      transformHeaders: { Authorization: `Bearer ${credential}` }
+    })
+  ];
+}
+function isDirectProvider(value) {
+  return value === "anthropic" || value === "openai" || value === "xai" || value === "github-copilot" || value === "poe" || value === "opencode-go" || value === "gitlab";
+}
 function pickGateway({
   gatewayAuthFromEnv
 }) {
@@ -265,6 +356,533 @@ function toOpenCodeGatewayBaseUrl(baseUrl) {
   return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;
 }
 
+// src/opencode-subscription.ts
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import {
+  HarnessCapabilityUnsupportedError
+} from "@ai-sdk/harness";
+import {
+  createCredentialRequestTransformation as createCredentialRequestTransformation2,
+  isAccessTokenExpiringSoon,
+  isHarnessAuthenticationEnvironment as isHarnessAuthenticationEnvironment2,
+  isWindows,
+  parseJwtPayload,
+  refreshOAuthAccessToken
+} from "@ai-sdk/harness/utils";
+import { isRecord, safeParseJSON } from "@ai-sdk/provider-utils";
+var OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var XAI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var GITLAB_CLIENT_ID = "1d89f9fdb23ee96d4e603201f6861dab6e143c5c3c00469a018a2d94bdc03d4e";
+var GITLAB_AI_GATEWAY_URL = "https://cloud.gitlab.com";
+var GITLAB_ANTHROPIC_PROVIDER_ID = "ai-sdk-gitlab-anthropic";
+var GITLAB_OPENAI_CHAT_PROVIDER_ID = "ai-sdk-gitlab-openai-chat";
+var GITLAB_OPENAI_RESPONSES_PROVIDER_ID = "ai-sdk-gitlab-openai-responses";
+var OPEN_CODE_GITLAB_MODELS = {
+  "duo-chat-fable-5": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-fable-5"
+  },
+  "duo-chat-opus-5": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-opus-5"
+  },
+  "duo-chat-opus-4-8": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-opus-4-8"
+  },
+  "duo-chat-opus-4-7": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-opus-4-7"
+  },
+  "duo-chat-opus-4-6": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-opus-4-6"
+  },
+  "duo-chat-sonnet-5": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-sonnet-5"
+  },
+  "duo-chat-sonnet-4-6": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-sonnet-4-6"
+  },
+  "duo-chat-opus-4-5": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-opus-4-5-20251101"
+  },
+  "duo-chat-sonnet-4-5": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-sonnet-4-5-20250929"
+  },
+  "duo-chat-haiku-4-5": {
+    providerId: GITLAB_ANTHROPIC_PROVIDER_ID,
+    modelId: "claude-haiku-4-5-20251001"
+  },
+  "duo-chat-gpt-5-1": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5.1-2025-11-13"
+  },
+  "duo-chat-gpt-5-2": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5.2-2025-12-11"
+  },
+  "duo-chat-gpt-5-4": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5.4-2026-03-05"
+  },
+  "duo-chat-gpt-5-5": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5.5-2026-04-23"
+  },
+  "duo-chat-gpt-5-mini": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5-mini-2025-08-07"
+  },
+  "duo-chat-gpt-5-4-mini": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5.4-mini"
+  },
+  "duo-chat-gpt-5-4-nano": {
+    providerId: GITLAB_OPENAI_CHAT_PROVIDER_ID,
+    modelId: "gpt-5.4-nano"
+  },
+  "duo-chat-gpt-5-6-sol": {
+    providerId: GITLAB_OPENAI_RESPONSES_PROVIDER_ID,
+    modelId: "gpt-5.6-sol"
+  },
+  "duo-chat-gpt-5-6-terra": {
+    providerId: GITLAB_OPENAI_RESPONSES_PROVIDER_ID,
+    modelId: "gpt-5.6-terra"
+  },
+  "duo-chat-gpt-5-6-luna": {
+    providerId: GITLAB_OPENAI_RESPONSES_PROVIDER_ID,
+    modelId: "gpt-5.6-luna"
+  },
+  "duo-chat-gpt-5-codex": {
+    providerId: GITLAB_OPENAI_RESPONSES_PROVIDER_ID,
+    modelId: "gpt-5-codex"
+  },
+  "duo-chat-gpt-5-2-codex": {
+    providerId: GITLAB_OPENAI_RESPONSES_PROVIDER_ID,
+    modelId: "gpt-5.2-codex"
+  },
+  "duo-chat-gpt-5-3-codex": {
+    providerId: GITLAB_OPENAI_RESPONSES_PROVIDER_ID,
+    modelId: "gpt-5.3-codex"
+  },
+  "duo-workflow": { providerId: "workflow", modelId: "default" },
+  "duo-workflow-default": { providerId: "workflow", modelId: "default" },
+  "duo-workflow-sonnet-4-5": {
+    providerId: "workflow",
+    modelId: "anthropic/claude-sonnet-4-5-20250929"
+  },
+  "duo-workflow-sonnet-5": {
+    providerId: "workflow",
+    modelId: "claude_sonnet_5"
+  },
+  "duo-workflow-opus-5": {
+    providerId: "workflow",
+    modelId: "claude_opus_5"
+  },
+  "duo-workflow-sonnet-4-6": {
+    providerId: "workflow",
+    modelId: "claude_sonnet_4_6"
+  },
+  "duo-workflow-opus-4-5": {
+    providerId: "workflow",
+    modelId: "anthropic/claude-opus-4-5-20251101"
+  },
+  "duo-workflow-haiku-4-5": {
+    providerId: "workflow",
+    modelId: "claude_haiku_4_5_20251001"
+  },
+  "duo-workflow-opus-4-6": {
+    providerId: "workflow",
+    modelId: "claude_opus_4_6_20260205"
+  }
+};
+async function resolveOpenCodeAuthentication({
+  auth,
+  model,
+  provider,
+  processEnv = process.env,
+  readSubscription = readOpenCodeSubscription
+}) {
+  const environment = resolveOpenCodeEnv({
+    auth,
+    model,
+    provider,
+    processEnv
+  });
+  const authenticationMode = resolveOpenCodeAuthenticationMode({
+    auth,
+    model,
+    provider,
+    processEnv
+  });
+  if (isHarnessAuthenticationEnvironment2(auth) || auth === "ai-gateway" || authenticationMode === "ai-gateway" || hasOpenCodeCredential({ environment, authenticationMode })) {
+    return { environment, authenticationMode };
+  }
+  const subscription = await readSubscription({
+    providerId: authenticationMode,
+    env: processEnv
+  });
+  return subscription == null ? { environment, authenticationMode } : {
+    environment: {
+      ...environment,
+      [OPENCODE_SUBSCRIPTION_ACCESS_TOKEN_ENVIRONMENT_VARIABLE]: subscription.accessToken
+    },
+    authenticationMode,
+    subscription
+  };
+}
+async function readOpenCodeSubscription({
+  providerId,
+  env = process.env,
+  homeDirectory = homedir(),
+  platform = process.platform,
+  fetch
+}) {
+  if (!isSubscriptionProvider(providerId)) return void 0;
+  const stored = await readStore({ env, homeDirectory, platform });
+  if (stored == null) return void 0;
+  const candidate = stored.value[providerId];
+  if (!isRecord(candidate)) return void 0;
+  if (candidate.type === "api") {
+    return typeof candidate.key === "string" && candidate.key.length > 0 ? { providerId, accessToken: candidate.key } : void 0;
+  }
+  if (candidate.type !== "oauth") return void 0;
+  if (providerId === "opencode-go") return void 0;
+  const access = candidate.access;
+  const refresh = candidate.refresh;
+  const expires = candidate.expires;
+  if (typeof access !== "string" || typeof refresh !== "string" || typeof expires !== "number") {
+    return void 0;
+  }
+  if (providerId === "github-copilot") {
+    return {
+      providerId,
+      accessToken: refresh,
+      ...typeof candidate.enterpriseUrl === "string" ? { enterpriseUrl: candidate.enterpriseUrl } : {}
+    };
+  }
+  if (providerId === "poe") {
+    if (isAccessTokenExpiringSoon({ expiresAt: expires })) {
+      throw new Error(
+        "OpenCode Poe subscription API key is expiring soon. Run OpenCode login again."
+      );
+    }
+    return { providerId, accessToken: access };
+  }
+  let accessToken = access;
+  let accountId = typeof candidate.accountId === "string" ? candidate.accountId : providerId === "openai" ? await extractOpenAIAccountId(access) : void 0;
+  if (isAccessTokenExpiringSoon({ expiresAt: expires })) {
+    const refreshSettings = resolveRefreshSettings({
+      providerId,
+      candidate,
+      env
+    });
+    const refreshed = await refreshOAuthAccessToken({
+      ...refreshSettings,
+      refreshToken: refresh,
+      ...fetch == null ? {} : { fetch }
+    });
+    accessToken = refreshed.accessToken;
+    if (providerId === "openai") {
+      accountId = await extractOpenAIAccountId(refreshed.accessToken) ?? accountId;
+    }
+    stored.value[providerId] = {
+      ...candidate,
+      access: refreshed.accessToken,
+      refresh: refreshed.refreshToken ?? refresh,
+      expires: refreshed.expiresAt,
+      ...accountId == null ? {} : { accountId }
+    };
+    await stored.write?.(stored.value);
+  }
+  return {
+    providerId,
+    accessToken,
+    ...accountId == null ? {} : { accountId },
+    ...typeof candidate.enterpriseUrl === "string" ? { enterpriseUrl: candidate.enterpriseUrl } : {}
+  };
+}
+async function requestOpenCodeGitLabDirectAccess({
+  accessToken,
+  instanceUrl = "https://gitlab.com",
+  aiGatewayUrl = GITLAB_AI_GATEWAY_URL,
+  fetch: fetchImplementation = globalThis.fetch
+}) {
+  const response = await fetchImplementation(
+    `${instanceUrl.replace(/\/+$/, "")}/api/v4/ai/third_party_agents/direct_access`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        feature_flags: { DuoAgentPlatformNext: true }
+      })
+    }
+  );
+  if (!response.ok) {
+    throw new Error(
+      `OpenCode GitLab direct access request failed with status ${response.status}.`
+    );
+  }
+  const parsed = await safeParseJSON({ text: await response.text() });
+  if (!parsed.success || !isRecord(parsed.value)) {
+    throw new Error("OpenCode GitLab direct access returned invalid JSON.");
+  }
+  const token = parsed.value.token;
+  const headers = parsed.value.headers;
+  if (typeof token !== "string" || token.length === 0 || !isRecord(headers) || Object.values(headers).some((value) => typeof value !== "string")) {
+    throw new Error(
+      "OpenCode GitLab direct access returned invalid credentials."
+    );
+  }
+  return {
+    accessToken: token,
+    headers,
+    aiGatewayUrl: aiGatewayUrl.replace(/\/+$/, "")
+  };
+}
+function createOpenCodeGitLabSubscriptionRequestTransformations({
+  directAccess,
+  sandboxAccessToken
+}) {
+  const headers = Object.fromEntries(
+    Object.entries(directAccess.headers).filter(
+      ([name]) => name.toLowerCase() !== "authorization" && name.toLowerCase() !== "x-api-key"
+    )
+  );
+  const transformHeaders = {
+    ...headers,
+    Authorization: `Bearer ${directAccess.accessToken}`
+  };
+  return [
+    `${directAccess.aiGatewayUrl}/ai/v1/proxy/anthropic`,
+    `${directAccess.aiGatewayUrl}/ai/v1/proxy/openai/v1`
+  ].map(
+    (matchUrl) => createCredentialRequestTransformation2({
+      matchUrl,
+      matchHeaders: {
+        Authorization: `Bearer ${sandboxAccessToken}`
+      },
+      transformHeaders
+    })
+  );
+}
+function createOpenCodeGitLabSubscriptionConfig({
+  openCodeConfig,
+  sandboxAccessToken,
+  aiGatewayUrl,
+  headers
+}) {
+  const providerOptions = headers == null ? {} : { headers };
+  const providers = {
+    [GITLAB_ANTHROPIC_PROVIDER_ID]: {
+      name: "GitLab Anthropic",
+      npm: "@ai-sdk/anthropic",
+      api: `${aiGatewayUrl}/ai/v1/proxy/anthropic/v1`,
+      options: { authToken: sandboxAccessToken, ...providerOptions },
+      models: createOpenCodeGitLabModels(GITLAB_ANTHROPIC_PROVIDER_ID)
+    },
+    [GITLAB_OPENAI_CHAT_PROVIDER_ID]: {
+      name: "GitLab OpenAI Chat",
+      npm: "@ai-sdk/openai-compatible",
+      api: `${aiGatewayUrl}/ai/v1/proxy/openai/v1`,
+      options: { apiKey: sandboxAccessToken, ...providerOptions },
+      models: createOpenCodeGitLabModels(GITLAB_OPENAI_CHAT_PROVIDER_ID)
+    },
+    [GITLAB_OPENAI_RESPONSES_PROVIDER_ID]: {
+      name: "GitLab OpenAI Responses",
+      npm: "@ai-sdk/openai",
+      api: `${aiGatewayUrl}/ai/v1/proxy/openai/v1`,
+      options: { apiKey: sandboxAccessToken, ...providerOptions },
+      models: createOpenCodeGitLabModels(GITLAB_OPENAI_RESPONSES_PROVIDER_ID)
+    }
+  };
+  const configuredProviders = isRecord(openCodeConfig?.provider) ? openCodeConfig.provider : {};
+  return {
+    ...openCodeConfig,
+    provider: { ...configuredProviders, ...providers }
+  };
+}
+function resolveOpenCodeGitLabSubscriptionModel({
+  model,
+  provider
+}) {
+  if (model == null) {
+    if (provider === "gitlab") {
+      throw new HarnessCapabilityUnsupportedError({
+        harnessId: "opencode",
+        message: "Harness 'opencode' requires an explicit GitLab model when native GitLab subscription credentials are brokered."
+      });
+    }
+    return void 0;
+  }
+  const modelProvider = model.includes("/") ? model.split("/")[0] : provider;
+  if (modelProvider !== "gitlab") return model;
+  const modelId = model.includes("/") ? model.slice(model.indexOf("/") + 1) : model;
+  const mapping = OPEN_CODE_GITLAB_MODELS[modelId];
+  if (mapping == null) {
+    throw new HarnessCapabilityUnsupportedError({
+      harnessId: "opencode",
+      message: `Harness 'opencode' cannot broker native GitLab subscription credentials for unknown model '${modelId}'.`
+    });
+  }
+  if (mapping.providerId === "workflow") {
+    throw new HarnessCapabilityUnsupportedError({
+      harnessId: "opencode",
+      message: `Harness 'opencode' cannot broker native GitLab subscription credentials for workflow model '${modelId}' because it authenticates over WebSocket. Use a sandbox without credential brokering to use the credential-forwarding fallback.`
+    });
+  }
+  return `${mapping.providerId}/${modelId}`;
+}
+function createOpenCodeGitLabModels(providerId) {
+  return Object.fromEntries(
+    Object.entries(OPEN_CODE_GITLAB_MODELS).flatMap(
+      ([id, model]) => model.providerId === providerId ? [[id, { id: model.modelId, name: id }]] : []
+    )
+  );
+}
+function createOpenCodeSubscriptionAuthContent({
+  authentication,
+  accessToken
+}) {
+  const { providerId } = authentication;
+  const value = providerId === "opencode-go" ? { type: "api", key: accessToken } : {
+    type: "oauth",
+    access: accessToken,
+    refresh: providerId === "github-copilot" ? accessToken : "host-managed",
+    expires: Number.MAX_SAFE_INTEGER,
+    ...authentication.accountId == null ? {} : { accountId: authentication.accountId },
+    ...authentication.enterpriseUrl == null ? {} : { enterpriseUrl: authentication.enterpriseUrl }
+  };
+  return JSON.stringify({ [providerId]: value });
+}
+function createOpenCodeSubscriptionRequestTransformations({
+  authentication,
+  sandboxAccessToken
+}) {
+  const matchUrl = resolveRequestUrl(authentication);
+  const transformHeaders = {
+    Authorization: `Bearer ${authentication.accessToken}`,
+    ...authentication.providerId === "openai" && authentication.accountId ? { "ChatGPT-Account-Id": authentication.accountId } : {}
+  };
+  const transformations = [
+    createCredentialRequestTransformation2({
+      matchUrl,
+      matchHeaders: {
+        Authorization: `Bearer ${sandboxAccessToken}`
+      },
+      transformHeaders
+    })
+  ];
+  if (authentication.providerId === "poe" || authentication.providerId === "opencode-go") {
+    transformations.push(
+      createCredentialRequestTransformation2({
+        matchUrl,
+        matchHeaders: { "x-api-key": sandboxAccessToken },
+        transformHeaders: { "x-api-key": authentication.accessToken }
+      })
+    );
+  }
+  return transformations;
+}
+function resolveRefreshSettings({
+  providerId,
+  candidate,
+  env
+}) {
+  if (providerId === "openai") {
+    return {
+      tokenUrl: "https://auth.openai.com/oauth/token",
+      clientId: OPENAI_CLIENT_ID
+    };
+  }
+  if (providerId === "xai") {
+    return {
+      tokenUrl: "https://auth.x.ai/oauth2/token",
+      clientId: XAI_CLIENT_ID
+    };
+  }
+  const instanceUrl = (typeof candidate.enterpriseUrl === "string" ? candidate.enterpriseUrl : env.GITLAB_INSTANCE_URL) ?? "https://gitlab.com";
+  return {
+    tokenUrl: `${instanceUrl.replace(/\/+$/, "")}/oauth/token`,
+    clientId: env.GITLAB_OAUTH_CLIENT_ID ?? GITLAB_CLIENT_ID
+  };
+}
+function resolveRequestUrl(authentication) {
+  switch (authentication.providerId) {
+    case "openai":
+      return "https://chatgpt.com/backend-api/codex";
+    case "xai":
+      return "https://api.x.ai/v1";
+    case "github-copilot":
+      return authentication.enterpriseUrl == null ? "https://api.githubcopilot.com" : `https://copilot-api.${normalizeDomain(authentication.enterpriseUrl)}`;
+    case "poe":
+      return "https://api.poe.com";
+    case "opencode-go":
+      return "https://opencode.ai/zen/go/v1";
+    case "gitlab":
+      return authentication.enterpriseUrl ?? "https://gitlab.com";
+  }
+}
+function normalizeDomain(value) {
+  try {
+    return new URL(value.includes("://") ? value : `https://${value}`).host;
+  } catch {
+    return value.replace(/^https?:\/\//, "").replace(/\/+$/, "");
+  }
+}
+async function extractOpenAIAccountId(accessToken) {
+  const payload = await parseJwtPayload({ token: accessToken });
+  const auth = payload?.["https://api.openai.com/auth"];
+  if (!isRecord(auth)) return void 0;
+  const accountId = auth.chatgpt_account_id;
+  return typeof accountId === "string" ? accountId : void 0;
+}
+async function readStore({
+  env,
+  homeDirectory,
+  platform
+}) {
+  if (env.OPENCODE_AUTH_CONTENT != null) {
+    const parsed2 = await safeParseJSON({ text: env.OPENCODE_AUTH_CONTENT });
+    return parsed2.success && isRecord(parsed2.value) ? { value: parsed2.value } : void 0;
+  }
+  const authPath = env.XDG_DATA_HOME != null ? join(env.XDG_DATA_HOME, "opencode", "auth.json") : isWindows(platform) ? join(homeDirectory, ".opencode", "auth.json") : join(homeDirectory, ".local", "share", "opencode", "auth.json");
+  const text = await readFile(authPath, "utf8").catch(() => void 0);
+  if (text == null) return void 0;
+  const parsed = await safeParseJSON({ text });
+  if (!parsed.success || !isRecord(parsed.value)) return void 0;
+  return {
+    value: parsed.value,
+    write: (value) => writeStore({ authPath, value })
+  };
+}
+async function writeStore({
+  authPath,
+  value
+}) {
+  await mkdir(dirname(authPath), { recursive: true });
+  const temporaryPath = `${authPath}.${process.pid}.tmp`;
+  await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}
+`, {
+    mode: 384
+  });
+  await chmod(temporaryPath, 384);
+  await rename(temporaryPath, authPath);
+}
+function isSubscriptionProvider(value) {
+  return value === "openai" || value === "xai" || value === "github-copilot" || value === "poe" || value === "opencode-go" || value === "gitlab";
+}
+
 // src/opencode-bridge-protocol.ts
 import {
   harnessV1BridgeInboundCommandSchemas,
@@ -291,7 +909,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 ]);
 
 // src/version.ts
-var VERSION = true ? "1.0.109" : "0.0.0-test";
+var VERSION = true ? "1.0.110" : "0.0.0-test";
 
 // src/opencode-harness.ts
 var OPENCODE_CLIENT_APP = `ai-sdk/harness-opencode/${VERSION}`;
@@ -433,7 +1051,7 @@ function createOpenCode(settings = {}) {
         portEndpoint: settings.portEndpoint
       });
       if (settings.mintBridgeToken != null && sandboxId == null) {
-        throw new HarnessCapabilityUnsupportedError({
+        throw new HarnessCapabilityUnsupportedError2({
           harnessId: "opencode",
           message: "The OpenCode harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id."
         });
@@ -448,14 +1066,15 @@ function createOpenCode(settings = {}) {
       const resumeData = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data : void 0;
       const resumeSessionId = typeof resumeData?.openCodeSessionId === "string" && resumeData.openCodeSessionId.length > 0 ? resumeData.openCodeSessionId : void 0;
       const coords = resumeData?.bridge;
-      const authenticationMode = resolveOpenCodeAuthenticationMode({
-        auth: settings.auth,
-        provider: settings.provider
-      });
-      const resolvedAuthEnvironment = resolveOpenCodeEnv({
+      const authentication = await resolveOpenCodeAuthentication({
         auth: settings.auth,
         provider: settings.provider
       });
+      const authenticationMode = authentication.authenticationMode;
+      const resolvedAuthEnvironment = authentication.environment;
+      let resolvedOpenCodeConfig = settings.openCodeConfig;
+      let transformModel;
+      let gitLabSubscriptionBrokered = false;
       let sandboxAuthEnvironment = resolvedAuthEnvironment;
       let sandboxCredentialEnvironment;
       let credentialsBrokered = false;
@@ -469,11 +1088,40 @@ function createOpenCode(settings = {}) {
           ...resolvedAuthEnvironment,
           ...sandboxCredentialEnvironment
         };
-        const requestTransformations = createOpenCodeRequestTransformations({
+        const transformationSources = {
           env: resolvedAuthEnvironment,
           sandboxEnv: sandboxAuthEnvironment,
           auth: authenticationMode
-        });
+        };
+        const sandboxSubscriptionAccessToken = sandboxAuthEnvironment[OPENCODE_SUBSCRIPTION_ACCESS_TOKEN_ENVIRONMENT_VARIABLE];
+        let requestTransformations;
+        if (authentication.subscription?.providerId === "gitlab" && sandboxSubscriptionAccessToken != null) {
+          const directAccess = await requestOpenCodeGitLabDirectAccess({
+            accessToken: authentication.subscription.accessToken,
+            ...authentication.subscription.enterpriseUrl == null ? {} : { instanceUrl: authentication.subscription.enterpriseUrl },
+            ...process.env.GITLAB_AI_GATEWAY_URL == null ? {} : { aiGatewayUrl: process.env.GITLAB_AI_GATEWAY_URL }
+          });
+          requestTransformations = createOpenCodeGitLabSubscriptionRequestTransformations({
+            directAccess,
+            sandboxAccessToken: sandboxSubscriptionAccessToken
+          });
+          resolvedOpenCodeConfig = createOpenCodeGitLabSubscriptionConfig({
+            openCodeConfig: settings.openCodeConfig,
+            sandboxAccessToken: sandboxSubscriptionAccessToken,
+            aiGatewayUrl: directAccess.aiGatewayUrl,
+            ...startOpts.headers == null ? {} : { headers: startOpts.headers }
+          });
+          transformModel = (model) => resolveOpenCodeGitLabSubscriptionModel({
+            model,
+            provider: settings.provider
+          });
+          gitLabSubscriptionBrokered = true;
+        } else {
+          requestTransformations = authentication.subscription == null || sandboxSubscriptionAccessToken == null ? createOpenCodeRequestTransformations(transformationSources) : createOpenCodeSubscriptionRequestTransformations({
+            authentication: authentication.subscription,
+            sandboxAccessToken: sandboxSubscriptionAccessToken
+          });
+        }
         if (requestTransformations.length > 0) {
           await sandboxSession.addRequestTransformations(
             requestTransformations
@@ -537,7 +1185,7 @@ function createOpenCode(settings = {}) {
             proc: void 0,
             provider: settings.provider,
             reasoningVariant: settings.reasoningVariant,
-            openCodeConfig: settings.openCodeConfig,
+            openCodeConfig: resolvedOpenCodeConfig,
             mcpServers: settings.mcpServers,
             headers: startOpts.headers,
             openCodeSessionId: resumeSessionId,
@@ -553,6 +1201,7 @@ function createOpenCode(settings = {}) {
             builtinToolFiltering: startOpts.builtinToolFiltering,
             sandbox: toolSafeSandboxSession,
             sandboxHomeDir,
+            transformModel,
             supportsUserMessageResponses: () => supportsUserMessageResponses2
           });
         } catch {
@@ -587,8 +1236,20 @@ function createOpenCode(settings = {}) {
           credentialEnvironmentVariables: OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES
         });
       }
+      const subscriptionAccessToken = forwardedAuthEnvironment[OPENCODE_SUBSCRIPTION_ACCESS_TOKEN_ENVIRONMENT_VARIABLE];
+      const forwardableAuthEnvironment = Object.fromEntries(
+        Object.entries(forwardedAuthEnvironment).filter(
+          ([name]) => name !== OPENCODE_SUBSCRIPTION_ACCESS_TOKEN_ENVIRONMENT_VARIABLE
+        )
+      );
       const env = {
-        ...forwardedAuthEnvironment,
+        ...forwardableAuthEnvironment,
+        ...gitLabSubscriptionBrokered || authentication.subscription == null || subscriptionAccessToken == null ? {} : {
+          OPENCODE_AUTH_CONTENT: createOpenCodeSubscriptionAuthContent({
+            authentication: authentication.subscription,
+            accessToken: subscriptionAccessToken
+          })
+        },
         AI_SDK_HARNESS_CLIENT_APP: OPENCODE_CLIENT_APP,
         BRIDGE_CHANNEL_TOKEN: token,
         BRIDGE_WS_PORT: String(port),
@@ -670,7 +1331,7 @@ function createOpenCode(settings = {}) {
         proc,
         provider: settings.provider,
         reasoningVariant: settings.reasoningVariant,
-        openCodeConfig: settings.openCodeConfig,
+        openCodeConfig: resolvedOpenCodeConfig,
         mcpServers: settings.mcpServers,
         headers: startOpts.headers,
         openCodeSessionId: resumeSessionId,
@@ -686,6 +1347,7 @@ function createOpenCode(settings = {}) {
         builtinToolFiltering: startOpts.builtinToolFiltering,
         sandbox: toolSafeSandboxSession,
         sandboxHomeDir,
+        transformModel,
         supportsUserMessageResponses: () => supportsUserMessageResponses
       });
     }
@@ -699,7 +1361,7 @@ function resolveBridgePort({
   if ("ports" in sandboxSession && sandboxSession.ports.length > 0) {
     return sandboxSession.ports[0];
   }
-  throw new HarnessCapabilityUnsupportedError({
+  throw new HarnessCapabilityUnsupportedError2({
     harnessId: "opencode",
     message: "The OpenCode harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createOpenCode({ port })`."
   });
@@ -711,13 +1373,13 @@ function validateBasicSandboxSettings({
 }) {
   if ("getPortEndpoint" in sandboxSession) return;
   if (port == null) {
-    throw new HarnessCapabilityUnsupportedError({
+    throw new HarnessCapabilityUnsupportedError2({
       harnessId: "opencode",
       message: "The OpenCode harness requires an explicit `port` when using a basic sandbox session."
     });
   }
   if (portEndpoint == null) {
-    throw new HarnessCapabilityUnsupportedError({
+    throw new HarnessCapabilityUnsupportedError2({
       harnessId: "opencode",
       message: "The OpenCode harness requires an explicit `portEndpoint` when using a basic sandbox session."
     });
@@ -732,7 +1394,7 @@ async function resolveBridgeEndpoint({
   if ("getPortEndpoint" in sandboxSession) {
     return sandboxSession.getPortEndpoint({ port, protocol: "ws" });
   }
-  throw new HarnessCapabilityUnsupportedError({
+  throw new HarnessCapabilityUnsupportedError2({
     harnessId: "opencode",
     message: "The OpenCode harness requires an explicit `portEndpoint` when using a basic sandbox session."
   });
@@ -775,7 +1437,7 @@ function openWebSocket({
     };
     const onMessage = (raw) => {
       void (async () => {
-        const parsed = await safeParseJSON({
+        const parsed = await safeParseJSON2({
           text: webSocketMessageToString(raw)
         });
         if (!parsed.success) return;
@@ -842,6 +1504,7 @@ function createSession({
   builtinToolFiltering,
   sandbox,
   sandboxHomeDir,
+  transformModel,
   supportsUserMessageResponses
 }) {
   let stopped = false;
@@ -986,7 +1649,7 @@ function createSession({
     };
   };
   const startBase = (turnModel) => ({
-    model: turnModel,
+    model: transformModel == null ? turnModel : transformModel(turnModel),
     provider,
     ...reasoningVariant ? { variant: reasoningVariant } : {},
     ...openCodeConfig == null ? {} : { openCodeConfig },
@@ -999,7 +1662,7 @@ function createSession({
   });
   const prepareTurn = async (opts) => {
     if (opts.responseFormat?.type === "json" && opts.responseFormat.schema == null) {
-      throw new HarnessCapabilityUnsupportedError({
+      throw new HarnessCapabilityUnsupportedError2({
         message: "Harness 'opencode' requires a JSON schema for structured output.",
         harnessId: "opencode"
       });
@@ -1068,20 +1731,20 @@ function createSession({
     },
     doCompact: async (customInstructions) => {
       if (customInstructions?.trim()) {
-        throw new HarnessCapabilityUnsupportedError({
+        throw new HarnessCapabilityUnsupportedError2({
           harnessId: "opencode",
           message: "Harness 'opencode' supports native manual compaction, but OpenCode does not expose custom compaction instructions through the supported API."
         });
       }
       if (activeTurn) {
-        throw new HarnessCapabilityUnsupportedError({
+        throw new HarnessCapabilityUnsupportedError2({
           harnessId: "opencode",
           message: "Harness 'opencode' supports manual compaction between turns; compacting during an active turn is not supported by the bridge transport."
         });
       }
       await runCompactOperation({
         channel,
-        model: selectedModel,
+        model: transformModel == null ? selectedModel : transformModel(selectedModel),
         provider,
         permissionMode,
         debug,
@@ -1290,7 +1953,7 @@ function extractUserText(prompt) {
   const parts = [];
   for (const part of content) {
     if (part.type !== "text") {
-      throw new HarnessCapabilityUnsupportedError({
+      throw new HarnessCapabilityUnsupportedError2({
         harnessId: "opencode",
         message: `The OpenCode harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`
       });