@askdkc/dsh-cli 0.12.3 → 0.13.0

package/node_modules/@askdkc/dsh-auth/dsh-plugin.json

@@ -2,9 +2,9 @@
   "$schema": "https://dsh.community/schemas/dsh-plugin-0.15.json",
   "id": "com.dsh-tui.dsh-auth",
   "name": "dsh-auth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "manifestVersion": "0.15",
-  "description": "Subscription OAuth sign-in (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as LLM provider routes for DeepSeek Harness. Registers llm adapter routes through the cordis llm registry; interactive login runs over the user-questions seam and degrades to a clear refusal when no interactive surface is present.",
+  "description": "Provider authentication and OpenCode Zen/Go model routes for DeepSeek Harness. Registers llm adapter routes through the cordis llm registry; interactive login runs over the user-questions seam.",
   "facets": {
     "host": {
       "entry": "lib/index.js",
@@ -29,7 +29,7 @@
     "commands": [
       {
         "id": "dsh.auth",
-        "title": "Sign in with a provider subscription (OAuth)"
+        "title": "Manage provider authentication and models"
       }
     ]
   },

package/node_modules/@askdkc/dsh-auth/lib/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,168 @@
+@ai-sdk/provider@4.0.21 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+zod@4.1.8 (MIT)
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+---
+
+eventsource-parser@3.1.1 (MIT)
+MIT License
+
+Copyright (c) 2026 Espen Hovlandsdal <espen@hovlandsdal.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+---
+
+@workflow/serde@4.1.0 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/provider-utils@5.0.53 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/anthropic@4.0.71 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/openai@4.0.83 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/openai-compatible@3.0.62 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/google@4.0.87 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/node_modules/@askdkc/dsh-auth/lib/abortable.d.ts

@@ -0,0 +1,2 @@
+/** Bound async I/O even when a reader or fixture does not honor fetch cancellation. */
+export declare function abortable<T>(operation: PromiseLike<T>, signal: AbortSignal): Promise<T>;

package/node_modules/@askdkc/dsh-auth/lib/abortable.js

@@ -0,0 +1,9 @@
+/** Bound async I/O even when a reader or fixture does not honor fetch cancellation. */
+export function abortable(operation, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        Promise.resolve(operation).then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+    });
+}

package/node_modules/@askdkc/dsh-auth/lib/auth-contract.d.ts

@@ -0,0 +1,66 @@
+/** Auth-owned persistence and interaction contracts; pi routes adapt structurally. */
+export interface StoredOAuthCredential {
+    type: 'oauth';
+    access: string;
+    refresh: string;
+    expires: number;
+    [key: string]: unknown;
+}
+export interface StoredApiKeyCredential {
+    type: 'api_key';
+    key?: string;
+    env?: Record<string, string>;
+}
+export type StoredCredential = StoredOAuthCredential | StoredApiKeyCredential;
+export interface CredentialInfo {
+    providerId: string;
+    type: StoredCredential['type'];
+}
+export interface AuthInteraction {
+    signal: AbortSignal;
+    prompt(prompt: AuthPrompt): Promise<string>;
+    notify(event: AuthEvent): void;
+}
+export type AuthPrompt = {
+    signal?: AbortSignal;
+} & ({
+    type: 'text' | 'secret' | 'manual_code';
+    message: string;
+    placeholder?: string;
+} | {
+    type: 'select';
+    message: string;
+    options: readonly {
+        id: string;
+        label: string;
+        description?: string;
+    }[];
+});
+export type AuthEvent = {
+    type: 'info';
+    message: string;
+    links?: readonly {
+        url: string;
+        label?: string;
+    }[];
+} | {
+    type: 'auth_url';
+    url: string;
+    instructions?: string;
+} | {
+    type: 'device_code';
+    userCode: string;
+    verificationUri: string;
+    intervalSeconds?: number;
+    expiresInSeconds?: number;
+} | {
+    type: 'progress';
+    message: string;
+};
+export interface OAuthFlow {
+    name: string;
+    loginLabel?: string;
+    login(interaction: AuthInteraction, options?: {
+        getDeviceId?: () => string;
+    }): Promise<StoredOAuthCredential>;
+}

package/node_modules/@askdkc/dsh-auth/lib/auth-contract.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@askdkc/dsh-auth/lib/command.js

@@ -4,7 +4,7 @@
  *
  * @module dsh-auth/command
  */
-const USAGE = 'Usage: /auth [status] | /auth login [provider] | /auth logout <provider>';
+const USAGE = 'Usage: /auth [status] | /auth login [provider] | /auth logout <provider> | /auth models [provider] | /auth refresh [provider]';
 function renderStatus(rows) {
     const lines = rows.map(row => {
         const state = row.signedIn
@@ -33,6 +33,20 @@ export function createAuthCommandHandler(api) {
         const { verb, target, extra } = parseArgs(invocation.rawInput);
         if (extra)
             return { kind: 'error', text: USAGE };
+        if (verb === 'models' || verb === 'refresh') {
+            try {
+                if (!api.catalogStatus || !api.refreshModels)
+                    throw new Error('Model catalog operations are unavailable');
+                const rows = verb === 'refresh' ? await api.refreshModels(target, invocation.signal) : api.catalogStatus(target);
+                if (!rows.length)
+                    throw new Error('No matching OpenCode catalog is mounted');
+                return { kind: rows.some(row => row.warning) && verb === 'refresh' ? 'error' : 'success', text: rows.map(row => `${row.provider}: ${row.available} models (${row.source}); last verified ${new Date(row.fetchedAt).toISOString()}${row.warning ? `; ${row.warning}` : ''}`
+                        + row.excluded.map(entry => `\n  ${entry.id}: ${entry.reason}`).join('')).join('\n') };
+            }
+            catch (error) {
+                return { kind: 'error', text: error instanceof Error ? error.message : 'Model catalog operation failed' };
+            }
+        }
         if (verb === undefined || verb === 'status') {
             if (target !== undefined)
                 return { kind: 'error', text: USAGE };

package/node_modules/@askdkc/dsh-auth/lib/credentials.d.ts

@@ -1,5 +1,5 @@
 /**
- * File-backed credential persistence: a pi-ai `CredentialStore` over
+ * Auth-owned credential persistence, structurally compatible with pi stores, over
  * one JSON document, one credential per provider id.
  *
  * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
@@ -13,16 +13,10 @@
  *
  * @module dsh-auth/credentials
  */
-import type { PiAiCredential, PiAiCredentialInfo, PiAiCredentialStore } from './pi-ai.js';
-/** The stored credential shapes from pi-ai. */
-export type StoredOAuthCredential = Extract<PiAiCredential, {
-    type: 'oauth';
-}>;
-export type StoredApiKeyCredential = Extract<PiAiCredential, {
-    type: 'api_key';
-}>;
+import type { StoredCredential, CredentialInfo } from './auth-contract.js';
+export type { StoredOAuthCredential, StoredApiKeyCredential } from './auth-contract.js';
 /** Narrow an unknown parsed value into a stored credential, or reject it. */
-export declare function asStoredCredential(value: unknown): PiAiCredential | undefined;
+export declare function asStoredCredential(value: unknown): StoredCredential | undefined;
 /** Default credential file location: `$DSH_HOME/dsh-auth/credentials.json` (or `~/.dsh/…`). */
 export declare function defaultCredentialsFile(): string;
 /**
@@ -31,22 +25,22 @@ export declare function defaultCredentialsFile(): string;
  * credential file as "signed out everywhere" would strand every route behind
  * a fresh login for no reason.
  */
-export declare class CredentialFile implements PiAiCredentialStore {
+export declare class CredentialFile {
     readonly path: string;
     /** Serialize all updates in this process; the file lock covers other processes. */
     private chainTail;
     constructor(path: string);
     /** The stored credential for one provider, possibly expired. */
-    read(providerId: string): Promise<PiAiCredential | undefined>;
+    read(providerId: string): Promise<StoredCredential | undefined>;
     /** Stored credential metadata without resolving or exposing secrets. */
-    list(): Promise<readonly PiAiCredentialInfo[]>;
+    list(): Promise<readonly CredentialInfo[]>;
     /**
      * Serialized read-modify-write for one provider. `fn` sees the current
      * credential; returning a new credential persists it, returning
      * `undefined` leaves the entry unchanged. Resolves with the post-write
      * credential. Rejections from `fn` propagate without touching the file.
      */
-    modify(providerId: string, fn: (current: PiAiCredential | undefined) => Promise<PiAiCredential | undefined>): Promise<PiAiCredential | undefined>;
+    modify(providerId: string, fn: (current: StoredCredential | undefined) => Promise<StoredCredential | undefined>): Promise<StoredCredential | undefined>;
     /** Remove one provider's credential (logout). */
     delete(providerId: string): Promise<void>;
     /** Non-secret metadata for every stored credential, for status surfaces. */

package/node_modules/@askdkc/dsh-auth/lib/credentials.js

@@ -1,5 +1,5 @@
 /**
- * File-backed credential persistence: a pi-ai `CredentialStore` over
+ * Auth-owned credential persistence, structurally compatible with pi stores, over
  * one JSON document, one credential per provider id.
  *
  * Writes are atomic (temp file + rename) with 0700 directory / 0600 file

package/node_modules/@askdkc/dsh-auth/lib/index.d.ts

@@ -1,9 +1,10 @@
 /**
  * dsh-auth — provider sign-in as LLM provider routes.
  *
- * One cordis plugin mounts pi-ai catalog and custom provider profiles as
+ * One cordis plugin mounts owned OpenCode routes and legacy pi profiles as
  * `llm` registry routes, so
- * catalog models appear in every model picker after sign-in. `PiAiAdapter` runs with this
+ * catalog models appear in every model picker after sign-in. OpenCode owns
+ * its public catalog and bundled SDK transports. Other routes use `PiAiAdapter` with this
  * plugin's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve stored credentials through the
  * provider's own auth or an explicit API key. Refreshes hold the store lock.
@@ -33,10 +34,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-import type { LlmModelInfo } from '@deepseek-ai/dsh-llm';
-import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai';
-import type { PiAiAdapterOptions } from '@deepseek-ai/dsh-llm-pi-ai';
-import { type ModelOverride } from './profiles.js';
+import { type ModelOverride } from './routes.js';
 export declare const name = "dsh-auth";
 /**
  * Deliberately empty. A hard code-level inject would deadlock any
@@ -72,26 +70,8 @@ export { QuestionBridge, describeEvent } from './interaction.js';
 export type { AskFn, QuestionBridgeHelpers } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, CATALOG_PROVIDER_IDS, AUTH_PROVIDER_IDS, canonicalProvider, buildOAuthProfile, type ModelOverride } from './profiles.js';
-export { freshRosterIds, type FreshRouteId } from './fresh-models.js';
-/**
- * The adapter the plugin registers: a {@link PiAiAdapter} whose *advisory
- * catalog* is credential-gated. A provider with no stored credential
- * lists no models — its rows never reach any model picker, which is the
- * whole point: picking a model that would only fail with "not signed in"
- * is noise. The gate only shapes `listModels`; `resolveModel` and requests
- * are untouched, so a model id already saved in a session (or named
- * explicitly) keeps resolving exactly as the registry contract promises
- * ("advisory and never changes routing").
- *
- * An expired-but-stored credential still lists: token refresh runs on the
- * next request, and a picker that hid a refreshable provider would look
- * signed-out when it is not.
- */
-export declare class CredentialGatedAdapter extends PiAiAdapter {
-    private readonly hasCredential;
-    constructor(options: PiAiAdapterOptions, hasCredential: (provider: string) => Promise<boolean>);
-    listModels(provider: string): Promise<readonly LlmModelInfo[]>;
-}
+export { OAUTH_PROVIDER_IDS, CATALOG_PROVIDER_IDS, AUTH_PROVIDER_IDS, canonicalProvider, type ModelOverride } from './routes.js';
+export { OpenCodeAdapter } from './opencode-adapter.js';
+export { OpenCodeCatalog } from './opencode-catalog.js';
 /** Mount the routes, the service, and the command. */
-export declare function apply(ctx: Context, config: Config): void;
+export declare function apply(ctx: Context, config: Config): Promise<void>;

package/node_modules/@askdkc/dsh-auth/lib/index.js

@@ -1,9 +1,10 @@
 /**
  * dsh-auth — provider sign-in as LLM provider routes.
  *
- * One cordis plugin mounts pi-ai catalog and custom provider profiles as
+ * One cordis plugin mounts owned OpenCode routes and legacy pi profiles as
  * `llm` registry routes, so
- * catalog models appear in every model picker after sign-in. `PiAiAdapter` runs with this
+ * catalog models appear in every model picker after sign-in. OpenCode owns
+ * its public catalog and bundled SDK transports. Other routes use `PiAiAdapter` with this
  * plugin's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve stored credentials through the
  * provider's own auth or an explicit API key. Refreshes hold the store lock.
@@ -31,14 +32,12 @@
  *
  * @module dsh-auth
  */
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
-import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai';
 import { CredentialFile, defaultCredentialsFile } from './credentials.js';
-import { buildOAuthProfile, AUTH_PROVIDER_IDS, canonicalProvider } from './profiles.js';
-import { createCustomProfile, CUSTOM_PROVIDER_IDS } from './custom-profiles.js';
+import { AUTH_PROVIDER_IDS, canonicalProvider } from './routes.js';
+import { OpenCodeAdapter } from './opencode-adapter.js';
+import { OpenCodeCatalog, OPEN_CODE_ROUTES } from './opencode-catalog.js';
+import { OPEN_CODE_SNAPSHOTS } from './opencode-owned.generated.js';
 import { refreshNous } from './nous-oauth.js';
 import { createDshAuthApi, DshAuthService } from './service.js';
 import { createAuthCommandHandler } from './command.js';
@@ -67,49 +66,11 @@ export { createDshAuthApi } from './service.js';
 export { QuestionBridge, describeEvent } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, CATALOG_PROVIDER_IDS, AUTH_PROVIDER_IDS, canonicalProvider, buildOAuthProfile } from './profiles.js';
-export { freshRosterIds } from './fresh-models.js';
-/**
- * The ambient auth context providers may consult while resolving their own
- * auth. `env()` answers from the process environment; `fileExists()` answers
- * about the host process's filesystem (the paths a provider asks about —
- * `~/.aws/credentials` and friends — are facts about where this process
- * runs, not about the project under edit).
- */
-function hostAuthContext() {
-    return {
-        env: async (name) => process.env[name],
-        fileExists: path => Promise.resolve(path.startsWith('~/') ? existsSync(join(homedir(), path.slice(2))) : existsSync(path)),
-    };
-}
-/**
- * The adapter the plugin registers: a {@link PiAiAdapter} whose *advisory
- * catalog* is credential-gated. A provider with no stored credential
- * lists no models — its rows never reach any model picker, which is the
- * whole point: picking a model that would only fail with "not signed in"
- * is noise. The gate only shapes `listModels`; `resolveModel` and requests
- * are untouched, so a model id already saved in a session (or named
- * explicitly) keeps resolving exactly as the registry contract promises
- * ("advisory and never changes routing").
- *
- * An expired-but-stored credential still lists: token refresh runs on the
- * next request, and a picker that hid a refreshable provider would look
- * signed-out when it is not.
- */
-export class CredentialGatedAdapter extends PiAiAdapter {
-    hasCredential;
-    constructor(options, hasCredential) {
-        super(options);
-        this.hasCredential = hasCredential;
-    }
-    async listModels(provider) {
-        if (!(await this.hasCredential(provider)))
-            return [];
-        return super.listModels(provider);
-    }
-}
+export { OAUTH_PROVIDER_IDS, CATALOG_PROVIDER_IDS, AUTH_PROVIDER_IDS, canonicalProvider } from './routes.js';
+export { OpenCodeAdapter } from './opencode-adapter.js';
+export { OpenCodeCatalog } from './opencode-catalog.js';
 /** Mount the routes, the service, and the command. */
-export function apply(ctx, config) {
+export async function apply(ctx, config) {
     const configured = (config.providers ?? [...AUTH_PROVIDER_IDS]).map(canonicalProvider);
     const unknown = configured.filter(id => !AUTH_PROVIDER_IDS.includes(id));
     if (unknown.length > 0 || configured.length === 0) {
@@ -123,14 +84,35 @@ export function apply(ctx, config) {
     if (unknownOverridden.length > 0) {
         throw new Error(`dsh-auth: modelOverrides names provider "${unknownOverridden[0]}", which is not among the mounted providers [${configured.join(', ')}]`);
     }
-    // Profile construction validates the installed catalog loudly: a pi-ai
-    // downgrade that dropped a provider fails the boot that asked for it, and
-    // a per-model miss is refused per route (see buildOAuthProfile).
-    const custom = new Map(CUSTOM_PROVIDER_IDS.filter(id => configured.includes(id))
-        .map(id => [id, createCustomProfile(id, overrides[id])]));
-    const profiles = new Map(configured.map(id => [id,
-        custom.get(id)?.profile ?? buildOAuthProfile(id, overrides[id]),
-    ]));
+    const piIds = configured.filter(id => !OPEN_CODE_ROUTES.includes(id));
+    const custom = new Map();
+    const piProfiles = new Map();
+    const profiles = new Map();
+    let pi;
+    if (piIds.length) {
+        try {
+            pi = await import('./pi-routes.js');
+        }
+        catch {
+            ctx.logger.warn('dsh-auth: pi routes unavailable; OpenCode routes remain available');
+        }
+        if (pi)
+            for (const id of piIds) {
+                try {
+                    const entry = pi.CUSTOM_PROVIDER_IDS.includes(id) ? pi.createCustomProfile(id, overrides[id]) : undefined;
+                    if (entry)
+                        custom.set(id, entry);
+                    const profile = entry?.profile ?? pi.buildOAuthProfile(id, overrides[id]);
+                    piProfiles.set(id, profile);
+                    profiles.set(id, { provider: id, displayName: profile.displayName, oauth: profile.piProvider?.auth.oauth });
+                }
+                catch {
+                    ctx.logger.warn(`dsh-auth: route ${id} unavailable; remaining routes stay mounted`);
+                }
+            }
+    }
+    for (const id of configured.filter(id => OPEN_CODE_ROUTES.includes(id)))
+        profiles.set(id, { provider: id, displayName: id === 'opencode' ? 'OpenCode Zen' : 'OpenCode Go' });
     const store = new CredentialFile(config.credentialsFile ?? defaultCredentialsFile());
     const credentialKey = async (provider) => {
         const current = await store.read(provider);
@@ -161,28 +143,34 @@ export function apply(ctx, config) {
             return false;
         }
     };
-    const adapter = new CredentialGatedAdapter({
+    const adapter = pi ? new pi.CredentialGatedAdapter({
         // One immutable map for the plugin's lifetime: the snapshot memoizes on
         // identity, and route changes here always mean a plugin remount anyway.
-        profiles: () => profiles,
+        profiles: () => piProfiles,
         // Explicit API keys cover catalog routes too. OAuth catalog routes still
         // resolve their grants through pi-ai's injected credential store.
         resolveApiKey: credentialKey,
         auth: {
             credentials: store,
-            authContext: hostAuthContext(),
+            authContext: pi.hostAuthContext(),
         },
         resolveAttachments: () => ctx.get('attachments'),
         onReplayDegrade: ({ provider, model, reason }) => {
             ctx.logger.warn(`dsh-auth: replay state on assistant history for ${provider}/${model} degraded: ${reason}`);
         },
-    }, hasCredential);
+    }, hasCredential) : undefined;
+    const catalogs = new Map();
+    for (const id of OPEN_CODE_ROUTES)
+        if (configured.includes(id))
+            catalogs.set(id, new OpenCodeCatalog(id, OPEN_CODE_SNAPSHOTS[id], { changed: () => service.api?.notifyModelsChanged?.(id) }));
+    const native = new OpenCodeAdapter({ catalogs, store, overrides, attachments: () => ctx.get('attachments'), warn: reason => ctx.logger.warn(reason) });
     // The service is a thin holder so UIs can find the api without importing
     // the plugin module; the defensive get-then-create matches how the TUI
     // mounts userQuestions.
     const service = ctx.get('dshAuth') ?? new DshAuthService(ctx);
     const api = createDshAuthApi({
         profiles,
+        catalogs,
         store,
         resolveAsk: () => {
             const questions = ctx.get('userQuestions');
@@ -191,6 +179,14 @@ export function apply(ctx, config) {
         logger: ctx.logger,
         nousClientId: config.nous?.clientId,
         credentialChanged: async (provider, credential) => {
+            if (catalogs.has(provider)) {
+                if (credential) {
+                    const status = await catalogs.get(provider).refresh();
+                    if (status.warning)
+                        throw new Error(status.warning);
+                }
+                return;
+            }
             const entry = custom.get(provider);
             if (entry === undefined)
                 return;
@@ -207,6 +203,8 @@ export function apply(ctx, config) {
         },
     });
     service.api = api;
+    for (const catalog of catalogs.values())
+        void catalog.start();
     for (const [provider, entry] of custom) {
         void credentialKey(provider).then(key => key === undefined ? undefined : entry.refresh(key))
             .then(count => { if (count !== undefined)
@@ -226,9 +224,11 @@ export function apply(ctx, config) {
         else {
             // Individual registrations: one conflicting route must not strand the
             // rest (the registry keeps the previous owner serving).
-            for (const id of configured) {
+            for (const id of profiles.keys()) {
                 try {
-                    releases.push(llm.registerAdapter([id], adapter));
+                    const owned = catalogs.has(id) ? native : adapter;
+                    if (owned)
+                        releases.push(llm.registerAdapter([id], owned));
                 }
                 catch (error) {
                     ctx.logger.error(`dsh-auth: route "${id}" was not registered: ${error instanceof Error ? error.message : String(error)} `
@@ -244,7 +244,7 @@ export function apply(ctx, config) {
             const handler = createAuthCommandHandler(api);
             releases.push(commands.register({
                 name: 'auth',
-                description: 'Provider authentication: status, login, logout',
+                description: 'Provider authentication and catalogs: status, login, logout, models, refresh',
                 handler: invocation => {
                     const operation = handler(invocation);
                     active.add(operation);
@@ -257,6 +257,8 @@ export function apply(ctx, config) {
         // enter while already-started logins finish their final write.
         yield async () => { await Promise.allSettled([...active]); };
         yield () => {
+            for (const catalog of catalogs.values())
+                catalog.dispose();
             for (const release of releases)
                 release();
         };