@askdkc/dsh-cli 0.12.3 → 0.13.1

package/node_modules/@askdkc/dsh-auth/lib/index.js

@@ -1,9 +1,10 @@
 /**
  * dsh-auth — provider sign-in as LLM provider routes.
  *
- * One cordis plugin mounts pi-ai catalog and custom provider profiles as
+ * One cordis plugin mounts owned OpenCode routes and legacy pi profiles as
  * `llm` registry routes, so
- * catalog models appear in every model picker after sign-in. `PiAiAdapter` runs with this
+ * catalog models appear in every model picker after sign-in. OpenCode owns
+ * its public catalog and bundled SDK transports. Other routes use `PiAiAdapter` with this
  * plugin's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve stored credentials through the
  * provider's own auth or an explicit API key. Refreshes hold the store lock.
@@ -31,14 +32,12 @@
  *
  * @module dsh-auth
  */
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
-import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai';
 import { CredentialFile, defaultCredentialsFile } from './credentials.js';
-import { buildOAuthProfile, AUTH_PROVIDER_IDS, canonicalProvider } from './profiles.js';
-import { createCustomProfile, CUSTOM_PROVIDER_IDS } from './custom-profiles.js';
+import { AUTH_PROVIDER_IDS, canonicalProvider } from './routes.js';
+import { OpenCodeAdapter } from './opencode-adapter.js';
+import { OpenCodeCatalog, OPEN_CODE_ROUTES } from './opencode-catalog.js';
+import { OPEN_CODE_SNAPSHOTS } from './opencode-owned.generated.js';
 import { refreshNous } from './nous-oauth.js';
 import { createDshAuthApi, DshAuthService } from './service.js';
 import { createAuthCommandHandler } from './command.js';
@@ -67,49 +66,11 @@ export { createDshAuthApi } from './service.js';
 export { QuestionBridge, describeEvent } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, CATALOG_PROVIDER_IDS, AUTH_PROVIDER_IDS, canonicalProvider, buildOAuthProfile } from './profiles.js';
-export { freshRosterIds } from './fresh-models.js';
-/**
- * The ambient auth context providers may consult while resolving their own
- * auth. `env()` answers from the process environment; `fileExists()` answers
- * about the host process's filesystem (the paths a provider asks about —
- * `~/.aws/credentials` and friends — are facts about where this process
- * runs, not about the project under edit).
- */
-function hostAuthContext() {
-    return {
-        env: async (name) => process.env[name],
-        fileExists: path => Promise.resolve(path.startsWith('~/') ? existsSync(join(homedir(), path.slice(2))) : existsSync(path)),
-    };
-}
-/**
- * The adapter the plugin registers: a {@link PiAiAdapter} whose *advisory
- * catalog* is credential-gated. A provider with no stored credential
- * lists no models — its rows never reach any model picker, which is the
- * whole point: picking a model that would only fail with "not signed in"
- * is noise. The gate only shapes `listModels`; `resolveModel` and requests
- * are untouched, so a model id already saved in a session (or named
- * explicitly) keeps resolving exactly as the registry contract promises
- * ("advisory and never changes routing").
- *
- * An expired-but-stored credential still lists: token refresh runs on the
- * next request, and a picker that hid a refreshable provider would look
- * signed-out when it is not.
- */
-export class CredentialGatedAdapter extends PiAiAdapter {
-    hasCredential;
-    constructor(options, hasCredential) {
-        super(options);
-        this.hasCredential = hasCredential;
-    }
-    async listModels(provider) {
-        if (!(await this.hasCredential(provider)))
-            return [];
-        return super.listModels(provider);
-    }
-}
+export { OAUTH_PROVIDER_IDS, CATALOG_PROVIDER_IDS, AUTH_PROVIDER_IDS, canonicalProvider } from './routes.js';
+export { OpenCodeAdapter } from './opencode-adapter.js';
+export { OpenCodeCatalog } from './opencode-catalog.js';
 /** Mount the routes, the service, and the command. */
-export function apply(ctx, config) {
+export async function apply(ctx, config) {
     const configured = (config.providers ?? [...AUTH_PROVIDER_IDS]).map(canonicalProvider);
     const unknown = configured.filter(id => !AUTH_PROVIDER_IDS.includes(id));
     if (unknown.length > 0 || configured.length === 0) {
@@ -123,14 +84,35 @@ export function apply(ctx, config) {
     if (unknownOverridden.length > 0) {
         throw new Error(`dsh-auth: modelOverrides names provider "${unknownOverridden[0]}", which is not among the mounted providers [${configured.join(', ')}]`);
     }
-    // Profile construction validates the installed catalog loudly: a pi-ai
-    // downgrade that dropped a provider fails the boot that asked for it, and
-    // a per-model miss is refused per route (see buildOAuthProfile).
-    const custom = new Map(CUSTOM_PROVIDER_IDS.filter(id => configured.includes(id))
-        .map(id => [id, createCustomProfile(id, overrides[id])]));
-    const profiles = new Map(configured.map(id => [id,
-        custom.get(id)?.profile ?? buildOAuthProfile(id, overrides[id]),
-    ]));
+    const piIds = configured.filter(id => !OPEN_CODE_ROUTES.includes(id));
+    const custom = new Map();
+    const piProfiles = new Map();
+    const profiles = new Map();
+    let pi;
+    if (piIds.length) {
+        try {
+            pi = await import('./pi-routes.js');
+        }
+        catch {
+            ctx.logger.warn('dsh-auth: pi routes unavailable; OpenCode routes remain available');
+        }
+        if (pi)
+            for (const id of piIds) {
+                try {
+                    const entry = pi.CUSTOM_PROVIDER_IDS.includes(id) ? pi.createCustomProfile(id, overrides[id]) : undefined;
+                    if (entry)
+                        custom.set(id, entry);
+                    const profile = entry?.profile ?? pi.buildOAuthProfile(id, overrides[id]);
+                    piProfiles.set(id, profile);
+                    profiles.set(id, { provider: id, displayName: profile.displayName, oauth: profile.piProvider?.auth.oauth });
+                }
+                catch {
+                    ctx.logger.warn(`dsh-auth: route ${id} unavailable; remaining routes stay mounted`);
+                }
+            }
+    }
+    for (const id of configured.filter(id => OPEN_CODE_ROUTES.includes(id)))
+        profiles.set(id, { provider: id, displayName: id === 'opencode' ? 'OpenCode Zen' : 'OpenCode Go' });
     const store = new CredentialFile(config.credentialsFile ?? defaultCredentialsFile());
     const credentialKey = async (provider) => {
         const current = await store.read(provider);
@@ -161,28 +143,34 @@ export function apply(ctx, config) {
             return false;
         }
     };
-    const adapter = new CredentialGatedAdapter({
+    const adapter = pi ? new pi.CredentialGatedAdapter({
         // One immutable map for the plugin's lifetime: the snapshot memoizes on
         // identity, and route changes here always mean a plugin remount anyway.
-        profiles: () => profiles,
+        profiles: () => piProfiles,
         // Explicit API keys cover catalog routes too. OAuth catalog routes still
         // resolve their grants through pi-ai's injected credential store.
         resolveApiKey: credentialKey,
         auth: {
             credentials: store,
-            authContext: hostAuthContext(),
+            authContext: pi.hostAuthContext(),
         },
         resolveAttachments: () => ctx.get('attachments'),
         onReplayDegrade: ({ provider, model, reason }) => {
             ctx.logger.warn(`dsh-auth: replay state on assistant history for ${provider}/${model} degraded: ${reason}`);
         },
-    }, hasCredential);
+    }, hasCredential) : undefined;
+    const catalogs = new Map();
+    for (const id of OPEN_CODE_ROUTES)
+        if (configured.includes(id))
+            catalogs.set(id, new OpenCodeCatalog(id, OPEN_CODE_SNAPSHOTS[id], { changed: () => service.api?.notifyModelsChanged?.(id) }));
+    const native = new OpenCodeAdapter({ catalogs, store, overrides, attachments: () => ctx.get('attachments'), warn: reason => ctx.logger.warn(reason) });
     // The service is a thin holder so UIs can find the api without importing
     // the plugin module; the defensive get-then-create matches how the TUI
     // mounts userQuestions.
     const service = ctx.get('dshAuth') ?? new DshAuthService(ctx);
     const api = createDshAuthApi({
         profiles,
+        catalogs,
         store,
         resolveAsk: () => {
             const questions = ctx.get('userQuestions');
@@ -191,6 +179,14 @@ export function apply(ctx, config) {
         logger: ctx.logger,
         nousClientId: config.nous?.clientId,
         credentialChanged: async (provider, credential) => {
+            if (catalogs.has(provider)) {
+                if (credential) {
+                    const status = await catalogs.get(provider).refresh();
+                    if (status.warning)
+                        throw new Error(status.warning);
+                }
+                return;
+            }
             const entry = custom.get(provider);
             if (entry === undefined)
                 return;
@@ -207,6 +203,8 @@ export function apply(ctx, config) {
         },
     });
     service.api = api;
+    for (const catalog of catalogs.values())
+        void catalog.start();
     for (const [provider, entry] of custom) {
         void credentialKey(provider).then(key => key === undefined ? undefined : entry.refresh(key))
             .then(count => { if (count !== undefined)
@@ -226,9 +224,11 @@ export function apply(ctx, config) {
         else {
             // Individual registrations: one conflicting route must not strand the
             // rest (the registry keeps the previous owner serving).
-            for (const id of configured) {
+            for (const id of profiles.keys()) {
                 try {
-                    releases.push(llm.registerAdapter([id], adapter));
+                    const owned = catalogs.has(id) ? native : adapter;
+                    if (owned)
+                        releases.push(llm.registerAdapter([id], owned));
                 }
                 catch (error) {
                     ctx.logger.error(`dsh-auth: route "${id}" was not registered: ${error instanceof Error ? error.message : String(error)} `
@@ -244,7 +244,7 @@ export function apply(ctx, config) {
             const handler = createAuthCommandHandler(api);
             releases.push(commands.register({
                 name: 'auth',
-                description: 'Provider authentication: status, login, logout',
+                description: 'Provider authentication and catalogs: status, login, logout, models, refresh',
                 handler: invocation => {
                     const operation = handler(invocation);
                     active.add(operation);
@@ -257,6 +257,8 @@ export function apply(ctx, config) {
         // enter while already-started logins finish their final write.
         yield async () => { await Promise.allSettled([...active]); };
         yield () => {
+            for (const catalog of catalogs.values())
+                catalog.dispose();
             for (const release of releases)
                 release();
         };

package/node_modules/@askdkc/dsh-auth/lib/interaction.d.ts

@@ -29,7 +29,7 @@
  * @module dsh-auth/interaction
  */
 import type { AskUserQuestionItem, AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-questions';
-import type { PiAiAuthEvent, PiAiAuthInteraction, PiAiAuthPrompt } from './pi-ai.js';
+import type { AuthEvent, AuthInteraction, AuthPrompt } from './auth-contract.js';
 /** The ask surface this bridge drives (usually `ctx.userQuestions.ask`). */
 export type AskFn = (request: {
     questions: AskUserQuestionItem[];
@@ -41,13 +41,13 @@ export interface QuestionBridgeHelpers {
     copyText?: (text: string) => Promise<boolean>;
 }
 /** Human-readable copy for one notify event. */
-export declare function describeEvent(event: PiAiAuthEvent): string;
+export declare function describeEvent(event: AuthEvent): string;
 /**
  * The bridge for one login run. At most one waiting panel exists at a time;
  * `settle()` retires it when the flow ends (any outcome), so a completed or
  * failed login never leaves an interactive dead end on screen.
  */
-export declare class QuestionBridge implements PiAiAuthInteraction {
+export declare class QuestionBridge implements AuthInteraction {
     private readonly ask;
     private readonly runAbort;
     readonly signal: AbortSignal;
@@ -56,8 +56,8 @@ export declare class QuestionBridge implements PiAiAuthInteraction {
     private waiting;
     private waitingClosed;
     constructor(ask: AskFn, runAbort: AbortController, helpers?: QuestionBridgeHelpers);
-    prompt(prompt: PiAiAuthPrompt): Promise<string>;
-    notify(event: PiAiAuthEvent): void;
+    prompt(prompt: AuthPrompt): Promise<string>;
+    notify(event: AuthEvent): void;
     /** Close the waiting panel (if any) and stop answering for this run. */
     settle(): Promise<void>;
     /**

package/node_modules/@askdkc/dsh-auth/lib/opencode-adapter.d.ts

@@ -0,0 +1,37 @@
+/** Native DSH adapter for Zen/Go; catalog and wire dispatch never consult pi. */
+import { LlmAdapter, type GenerateOptions, type StreamChunk, type PreparedAdapterCall, type LlmResolvedModelInfo } from '@deepseek-ai/dsh-llm';
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import { type OpenCodeCatalog, type OpenCodeRoute } from './opencode-catalog.js';
+import type { CredentialFile } from './credentials.js';
+interface Options {
+    catalogs: ReadonlyMap<OpenCodeRoute, OpenCodeCatalog>;
+    store: CredentialFile;
+    attachments?: () => AttachmentStore | undefined;
+    fetcher?: typeof fetch;
+    overrides?: Record<string, Record<string, {
+        contextWindow?: number;
+        maxTokens?: number;
+    }>>;
+    warn?: (reason: string) => void;
+}
+export declare class OpenCodeAdapter extends LlmAdapter {
+    private readonly options;
+    constructor(options: Options);
+    providerInfo(provider: string): {
+        id: string;
+        name: string;
+    };
+    private descriptor;
+    listModels(provider: string): Promise<{
+        provider: string;
+        id: string;
+        name: string;
+        inputModalities: ("text" | "image")[];
+    }[]>;
+    private resolved;
+    resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
+    prepareCall(provider: string, model: string, signal?: AbortSignal): Promise<PreparedAdapterCall>;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    private dispatch;
+}
+export {};

package/node_modules/@askdkc/dsh-auth/lib/opencode-adapter.js

@@ -0,0 +1,206 @@
+/** Native DSH adapter for Zen/Go; catalog and wire dispatch never consult pi. */
+import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm';
+import { encodePrompt } from './opencode-codec.js';
+import { createTransport } from './opencode-transport.js';
+import { abortable } from './abortable.js';
+import { randomUUID } from 'node:crypto';
+import { record, mergeMetadata } from './opencode-replay.js';
+export class OpenCodeAdapter extends LlmAdapter {
+    options;
+    constructor(options) {
+        super();
+        this.options = options;
+        for (const [provider, models] of Object.entries(options.overrides ?? {}))
+            for (const [id, override] of Object.entries(models)) {
+                if (!options.catalogs.has(provider))
+                    continue;
+                this.descriptor(provider, id);
+                for (const value of Object.values(override))
+                    if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0))
+                        throw new Error(`Invalid model override for ${provider}/${id}`);
+            }
+    }
+    providerInfo(provider) { return { id: provider, name: provider === 'opencode' ? 'OpenCode Zen' : 'OpenCode Go' }; }
+    descriptor(provider, id) {
+        const catalog = this.options.catalogs.get(provider);
+        const found = catalog?.models().find(model => model.id === id);
+        if (!found)
+            throw new LlmError(`OpenCode model ${provider}/${id} unavailable: ${catalog?.status().excluded.find(model => model.id === id)?.reason ?? 'not on the verified roster'}`, 'MODEL_NOT_FOUND');
+        const override = this.options.overrides?.[provider]?.[id];
+        return { ...found, ...override };
+    }
+    async listModels(provider) {
+        if (!(await this.options.store.read(provider)))
+            return [];
+        return (this.options.catalogs.get(provider)?.models() ?? []).map(model => ({ provider, id: model.id, name: model.name, inputModalities: model.inputModalities }));
+    }
+    resolved(provider, descriptor) {
+        return { provider, id: descriptor.id, name: descriptor.name, inputModalities: descriptor.inputModalities, context: { contextWindow: descriptor.contextWindow }, defaultMaxTokens: descriptor.maxTokens,
+            ...(descriptor.efforts.length ? { reasoning: { efforts: descriptor.efforts.map(id => ({ id: id, name: id })) } } : {}) };
+    }
+    async resolveModel(provider, model, signal) { signal?.throwIfAborted(); return this.resolved(provider, this.descriptor(provider, model)); }
+    async prepareCall(provider, model, signal) {
+        signal?.throwIfAborted();
+        const descriptor = this.descriptor(provider, model);
+        return { model: this.resolved(provider, descriptor), stream: options => {
+                if (options.provider !== provider || options.model !== model)
+                    throw new LlmError('Prepared OpenCode call identity mismatch', 'INVALID_PREPARED_CALL');
+                return this.dispatch(options, descriptor);
+            } };
+    }
+    stream(options) { return this.dispatch(options, this.descriptor(options.provider, options.model)); }
+    async *dispatch(options, descriptor) {
+        options.signal?.throwIfAborted();
+        if (options.tools?.length && !descriptor.toolCall)
+            throw new LlmError('This OpenCode model does not support tool calls', 'UNSUPPORTED_CAPABILITY');
+        if (options.reasoningEffort && !descriptor.efforts.includes(options.reasoningEffort))
+            throw new LlmError('Unsupported reasoning effort for this model', 'UNSUPPORTED_CAPABILITY');
+        const prompt = await encodePrompt(options, descriptor, this.options.attachments, this.options.warn);
+        const credential = await this.options.store.read(options.provider);
+        if (credential?.type !== 'api_key' || !credential.key?.trim())
+            throw new LlmError(`Run /auth login ${options.provider}`, 'AUTH');
+        const headers = { ...attributionHeaders(), 'x-opencode-session': options.sessionId ?? randomUUID() };
+        const model = createTransport(descriptor, options, credential.key, headers, prompt, this.options.fetcher);
+        const abort = new AbortController();
+        const signal = AbortSignal.any([abort.signal, ...(options.signal ? [options.signal] : [])]);
+        let timer = setTimeout(() => abort.abort(new Error('OpenCode stream idle timeout')), 300_000);
+        timer.unref();
+        let reader;
+        try {
+            const result = await abortable(model.doStream({ prompt, abortSignal: signal, maxOutputTokens: options.maxTokens ?? descriptor.maxTokens,
+                ...(descriptor.temperature ? { temperature: options.temperature } : {}), stopSequences: options.stop,
+                tools: options.tools?.map(tool => ({ type: 'function', name: tool.name, description: tool.description, inputSchema: tool.parameters })),
+                providerOptions: descriptor.protocol === 'responses' ? { openai: { store: false } } : undefined }), signal);
+            reader = result.stream.getReader();
+            const blocks = new Map();
+            let responseId;
+            while (true) {
+                const item = await abortable(reader.read(), signal);
+                if (item.done)
+                    throw new LlmError('OpenCode stream ended without a finish event', 'PROTOCOL_ERROR');
+                clearTimeout(timer);
+                timer = setTimeout(() => abort.abort(new Error('OpenCode stream idle timeout')), 300_000);
+                timer.unref();
+                const part = item.value;
+                if (part.type === 'error')
+                    throw part.error;
+                if (part.type === 'response-metadata') {
+                    responseId = part.id;
+                    continue;
+                }
+                if (part.type === 'text-start' || part.type === 'reasoning-start' || part.type === 'tool-input-start') {
+                    const block = part.type === 'tool-input-start' ? { type: 'tool-call', id: part.id, name: part.toolName, arguments: '' } : { type: part.type === 'text-start' ? 'text' : 'reasoning', text: '' };
+                    const entry = { index: blocks.size, block, ended: false, providerOptions: part.providerMetadata };
+                    blocks.set(part.id, entry);
+                    yield { type: 'block-start', index: entry.index, blockType: block.type };
+                    continue;
+                }
+                if (part.type === 'text-delta' || part.type === 'reasoning-delta' || part.type === 'tool-input-delta') {
+                    const entry = blocks.get(part.id);
+                    if (!entry || entry.ended || entry.inputEnded)
+                        throw new LlmError('Unmatched stream delta', 'PROTOCOL_ERROR');
+                    if (entry.block.type === 'tool-call') {
+                        entry.block.arguments += part.delta;
+                        yield { type: 'tool-call-delta', index: entry.index, id: entry.block.id, argumentsDelta: part.delta };
+                    }
+                    else if (entry.block.type === 'text' || entry.block.type === 'reasoning') {
+                        entry.block.text += part.delta;
+                        yield { type: entry.block.type === 'text' ? 'text-delta' : 'reasoning-delta', index: entry.index, text: part.delta };
+                    }
+                    if (part.providerMetadata)
+                        entry.providerOptions = mergeMetadata(entry.providerOptions, part.providerMetadata);
+                    continue;
+                }
+                if (part.type === 'text-end' || part.type === 'reasoning-end' || part.type === 'tool-input-end') {
+                    const entry = blocks.get(part.id);
+                    if (!entry || entry.ended)
+                        throw new LlmError('Unmatched stream end', 'PROTOCOL_ERROR');
+                    if (part.providerMetadata)
+                        entry.providerOptions = mergeMetadata(entry.providerOptions, part.providerMetadata);
+                    if (entry.block.type === 'tool-call') {
+                        entry.inputEnded = true;
+                        continue;
+                    }
+                    entry.ended = true;
+                    yield { type: 'block-end', index: entry.index, block: entry.block };
+                    continue;
+                }
+                if (part.type === 'tool-call') {
+                    if (part.providerExecuted)
+                        throw new LlmError('Unexpected provider-executed tool', 'PROTOCOL_ERROR');
+                    if (!blocks.has(part.toolCallId)) {
+                        const block = { type: 'tool-call', id: part.toolCallId, name: part.toolName, arguments: part.input };
+                        const index = blocks.size;
+                        blocks.set(part.toolCallId, { index, block, ended: true, providerOptions: part.providerMetadata });
+                        yield { type: 'block-start', index, blockType: 'tool-call' };
+                        yield { type: 'block-end', index, block };
+                    }
+                    else {
+                        const entry = blocks.get(part.toolCallId);
+                        if (entry.block.type !== 'tool-call' || entry.ended || entry.block.name !== part.toolName)
+                            throw new LlmError('Mismatched final tool call', 'PROTOCOL_ERROR');
+                        // Some providers send the complete arguments only in the final
+                        // tool event. Preserve streamed raw JSON when it was supplied.
+                        if (!entry.block.arguments)
+                            entry.block.arguments = part.input;
+                        if (part.providerMetadata)
+                            entry.providerOptions = mergeMetadata(entry.providerOptions, part.providerMetadata);
+                        entry.ended = true;
+                        yield { type: 'block-end', index: entry.index, block: entry.block };
+                    }
+                    continue;
+                }
+                if (part.type === 'finish') {
+                    for (const entry of blocks.values())
+                        if (!entry.ended) {
+                            entry.ended = true;
+                            yield { type: 'block-end', index: entry.index, block: entry.block };
+                        }
+                    const input = part.usage.inputTokens;
+                    const output = part.usage.outputTokens;
+                    // DSH snapshots chunks losslessly: optional SDK values must be absent,
+                    // not own properties containing undefined. Preserve reported zeroes.
+                    yield { type: 'usage', usage: {
+                            inputTokens: input.noCache ?? Math.max(0, (input.total ?? 0) - (input.cacheRead ?? 0) - (input.cacheWrite ?? 0)),
+                            outputTokens: output.total ?? 0,
+                            ...(input.cacheRead !== undefined ? { cacheReadTokens: input.cacheRead } : {}),
+                            ...(input.cacheWrite !== undefined ? { cacheWriteTokens: input.cacheWrite } : {}),
+                            ...(output.reasoning !== undefined ? { reasoningTokens: output.reasoning } : {}),
+                            ...(input.total !== undefined && output.total !== undefined ? { totalTokens: input.total + output.total } : {}),
+                        } };
+                    if (!blocks.size)
+                        throw new LlmError('OpenCode returned no content', 'EMPTY_RESPONSE');
+                    const finish = part.finishReason.unified;
+                    if (finish === 'error' || finish === 'content-filter' || finish === 'other')
+                        throw new LlmError(`OpenCode generation ended: ${finish}`, 'PROVIDER_ERROR');
+                    yield { type: 'finish', reason: { kind: finish === 'tool-calls' ? 'tool-calls' : finish === 'length' ? 'max-tokens' : 'stop' }, replayState: { response: { kind: 'dsh-opencode', version: 1, protocol: descriptor.protocol, provider: options.provider, model: descriptor.id, ...(responseId !== undefined ? { responseId } : {}) }, blocks: [...blocks.values()].map(entry => ({ type: entry.block.type, ...(entry.providerOptions ? { providerOptions: entry.providerOptions } : {}) })) } };
+                    return;
+                }
+            }
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw options.signal.reason;
+            if (signal.aborted)
+                throw new LlmError('OpenCode stream idle timeout', 'TIMEOUT');
+            if (error instanceof LlmError)
+                throw error;
+            const raw = record(error);
+            const status = typeof raw?.statusCode === 'number' ? raw.statusCode : undefined;
+            const responseHeaders = record(raw?.responseHeaders);
+            const retryHeader = responseHeaders?.['retry-after'];
+            const seconds = Number(retryHeader);
+            const retry = typeof retryHeader === 'string' ? Number.isFinite(seconds) ? seconds * 1000 : Date.parse(retryHeader) - Date.now() : undefined;
+            const requestId = responseHeaders?.['x-request-id'] ?? responseHeaders?.['request-id'];
+            throw new LlmError(`OpenCode request failed${status ? `: HTTP ${status}` : ''}`, status === 401 || status === 403 ? 'AUTH' : status === 429 ? 'RATE_LIMIT' : status && status >= 500 ? 'SERVER' : status ? 'PROVIDER_ERROR' : 'TRANSPORT', { status, ...(retry !== undefined && retry > 0 ? { providerRetryAfterMs: retry } : {}), ...(typeof requestId === 'string' && requestId.trim() ? { requestId: requestId } : {}) });
+        }
+        finally {
+            clearTimeout(timer);
+            abort.abort();
+            if (reader) {
+                void reader.cancel().catch(() => undefined);
+                reader.releaseLock();
+            }
+        }
+    }
+}

package/node_modules/@askdkc/dsh-auth/lib/opencode-catalog.d.ts

@@ -0,0 +1,72 @@
+export declare const OPEN_CODE_ROUTES: readonly ["opencode", "opencode-go"];
+export type OpenCodeRoute = typeof OPEN_CODE_ROUTES[number];
+export type OpenCodeProtocol = 'messages' | 'responses' | 'chat' | 'google';
+export declare const OPEN_CODE_URLS: Record<OpenCodeRoute, string>;
+export interface OpenCodeModel {
+    id: string;
+    name: string;
+    protocol: OpenCodeProtocol;
+    contextWindow: number;
+    maxTokens: number;
+    inputModalities: ('text' | 'image')[];
+    toolCall: boolean;
+    reasoning: boolean;
+    temperature: boolean;
+    efforts: string[];
+    cost?: Record<string, number>;
+}
+export interface OpenCodeSnapshot {
+    version: 1;
+    provider: OpenCodeRoute;
+    fetchedAt: number;
+    roster: string[];
+    models: OpenCodeModel[];
+    excluded: {
+        id: string;
+        reason: string;
+    }[];
+}
+export interface OpenCodeCatalogStatus {
+    provider: OpenCodeRoute;
+    source: 'bundled' | 'cache' | 'live';
+    fetchedAt: number;
+    available: number;
+    excluded: readonly {
+        id: string;
+        reason: string;
+    }[];
+    warning?: string;
+}
+export declare function rosterIds(payload: unknown): string[];
+/** Normalize only exact-route metadata; every roster id has an explicit outcome. */
+export declare function normalizeCatalog(provider: OpenCodeRoute, roster: readonly string[], metadata: unknown, fetchedAt: number, previous?: OpenCodeSnapshot): OpenCodeSnapshot;
+/** Validate cache/snapshot data using the same normalizer as fetched metadata. */
+export declare function parseSnapshot(value: unknown, provider: OpenCodeRoute): OpenCodeSnapshot;
+export declare function fetchCatalogJson(url: string, fetcher: typeof fetch, signal?: AbortSignal): Promise<unknown>;
+export declare class OpenCodeCatalog {
+    readonly provider: OpenCodeRoute;
+    private readonly options;
+    private snapshot;
+    private source;
+    private warning?;
+    private pending?;
+    private disposed;
+    private abort;
+    private timer?;
+    private started;
+    constructor(provider: OpenCodeRoute, bundled: unknown, options?: {
+        directory?: string;
+        fetcher?: typeof fetch;
+        changed?: () => void;
+        now?: () => number;
+    });
+    private get path();
+    models(): readonly OpenCodeModel[];
+    status(): OpenCodeCatalogStatus;
+    start(): Promise<void>;
+    refresh(): Promise<OpenCodeCatalogStatus>;
+    private update;
+    /** Compare and replace under a bounded cross-process lock; failed writes retain the old cache. */
+    private save;
+    dispose(): void;
+}