@elliotsystems/eai 0.1.4 → 0.1.5

package/plugin/opencode-plugin/src/elliot-auth.ts

@@ -1,27 +1,70 @@
 /**
- * Elliot token read + refresh — the credential half of the proxy provider.
+ * Reads `~/.elliot/config.json` — written by `eai setup`/`elliot-ai setup`.
  *
- * Ported (trimmed, not imported) from `elliot-cli/src/auth/refresh.ts` and
- * `elliot-cli/src/config.ts`: same `~/.elliot/config.json` shape, same
- * refresh endpoint contract (`POST {backend_url}/auth/refresh` ->
- * `{access_token, expires_in_seconds}`), same "never throw" discipline. This
- * file exists inside `opencode-plugin` rather than importing the CLI package
- * because the plugin ships and is loaded independently of `elliot-cli` — see
- * `docs/superpowers/plans/2026-09-03-eai-proxy-auth.md`.
+ * Used two ways: `readElliotConfig() !== null` is "is the user logged in at
+ * all" (the proxy-provider config hook is a no-op otherwise); and its
+ * `litellm_base_url`/`litellm_master_key` fields are the LLM provider's
+ * connection info directly.
  *
- * `freshToken` is the only export the proxy provider's `auth.loader`/`fetch`
- * needs: it never throws, so a stale/missing/corrupt config degrades to "no
- * token" (the proxy 401s) rather than crashing OpenCode's model call.
+ * Formerly also home to `freshToken`/`isExpired` — a self-refreshing JWT
+ * mechanism for the per-instance credential `/llm-proxy` used to validate.
+ * Removed along with `/llm-proxy`: the LiteLLM gateway this now points at
+ * authenticates with ONE static, shared `litellm_master_key` (LiteLLM is
+ * deliberately DB-less — no per-tenant/per-instance credential is possible
+ * without one), which never expires and so never needs refreshing.
  */
 import * as fs from "node:fs"
 import * as os from "node:os"
 import * as path from "node:path"
 
+/**
+ * One LiteLLM credential this person can use from OpenCode — their own
+ * personal key, or a team's shared key (Phase 4, docs/LITELLM_GATEWAY.md
+ * §14 / PRD PO-4/4.3/4.4). `provider_id` is the OpenCode provider id
+ * `configHook` registers it under directly (e.g. `elliot` for the personal
+ * default, `elliot-team-<slug>` per team) — computed backend-side
+ * (`onboarding.py`), not derived here, so naming stays in one place.
+ */
+export interface ElliotCredential {
+  provider_id: string
+  /** Shown in OpenCode's own model picker, e.g. "Elliot (Personal)" or
+   *  "Elliot — Team Platform". */
+  label: string
+  api_key: string
+  /** Present for a team credential, absent for the personal one. */
+  team_id?: string
+  /**
+   * This credential's own team's Phase 4 model restriction
+   * (docs/LITELLM_GATEWAY.md §14), or absent/null for unrestricted — always
+   * absent on the personal credential, which has no team and so no
+   * restriction concept. LiteLLM gateway audit finding #5: each provider
+   * `configHook` registers must be filtered by ITS OWN credential's
+   * restriction, not a shared list — a user on both a restricted and an
+   * unrestricted team must not have one leak into the other.
+   */
+  allowed_models?: string[] | null
+}
+
 export interface ElliotConfig {
   jwt_token?: string
-  refresh_token?: string
   backend_url?: string
-  access_token_expires_at?: string
+  litellm_base_url?: string
+  litellm_master_key?: string
+  /**
+   * Every credential this person can use, personal key first (Phase 4).
+   * Absent on a config written by an older `eai setup` (or a backend that
+   * predates this field) — `configHook` falls back to the single
+   * `litellm_master_key` provider in that case, so an old config keeps
+   * working unchanged rather than losing LLM access outright.
+   */
+  credentials?: ElliotCredential[]
+  /**
+   * The single scoped team's own Phase 4 model restriction, when
+   * `credentials` is absent and the legacy `litellm_master_key` fallback
+   * provider is registered instead — same field, same meaning as
+   * `ElliotCredential.allowed_models`, just for the one-provider path.
+   */
+  allowed_models?: string[] | null
   [k: string]: unknown
 }
 
@@ -40,94 +83,3 @@ export function readElliotConfig(): ElliotConfig | null {
     return null
   }
 }
-
-/**
- * Persist the config, owner-only (0600) — this file holds a live bearer
- * token. Creates `~/.elliot` (0700) if it doesn't exist yet.
- */
-export function writeElliotConfig(cfg: ElliotConfig): void {
-  const configPath = elliotConfigPath()
-  const configDir = path.dirname(configPath)
-  if (!fs.existsSync(configDir)) {
-    fs.mkdirSync(configDir, { recursive: true, mode: 0o700 })
-  }
-  fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2), { mode: 0o600 })
-  fs.chmodSync(configPath, 0o600)
-}
-
-/** `exp` (seconds since epoch) from a JWT's middle segment, or null. */
-function decodeJwtExp(token: string): number | null {
-  try {
-    const parts = token.split(".")
-    if (parts.length < 2) return null
-    const payload = JSON.parse(Buffer.from(parts[1], "base64").toString("utf-8"))
-    return typeof payload?.exp === "number" ? payload.exp : null
-  } catch {
-    return null
-  }
-}
-
-const REFRESH_SKEW_MS = 60_000
-
-/**
- * True if the access token is expired or within `REFRESH_SKEW_MS` of
- * expiring. Prefers the stored `access_token_expires_at`; falls back to
- * decoding `jwt_token`'s `exp` claim; true (treat as expired -> refresh) when
- * neither is decodable.
- */
-export function isExpired(cfg: ElliotConfig, nowMs = Date.now()): boolean {
-  if (cfg.access_token_expires_at) {
-    const expiresAtMs = new Date(cfg.access_token_expires_at).getTime()
-    if (Number.isFinite(expiresAtMs)) {
-      return expiresAtMs - REFRESH_SKEW_MS <= nowMs
-    }
-  }
-  const exp = cfg.jwt_token ? decodeJwtExp(cfg.jwt_token) : null
-  if (exp === null) return true
-  return exp * 1000 - REFRESH_SKEW_MS <= nowMs
-}
-
-interface RefreshResponse {
-  access_token: string
-  expires_in_seconds: number
-}
-
-interface FreshTokenDeps {
-  fetchImpl?: typeof fetch
-  write?: (cfg: ElliotConfig) => void
-}
-
-/**
- * A valid access token, refreshing + persisting when expired and a
- * `refresh_token`/`backend_url` are present. NEVER throws: any failure
- * (network, non-2xx, malformed response) falls back to the existing
- * `jwt_token` — the proxy 401s on a stale token rather than this crashing the
- * model call.
- */
-export async function freshToken(
-  cfg: ElliotConfig,
-  deps?: FreshTokenDeps,
-): Promise<string | null> {
-  try {
-    if (cfg.jwt_token && !isExpired(cfg)) return cfg.jwt_token
-    if (!cfg.refresh_token || !cfg.backend_url) return cfg.jwt_token ?? null
-
-    const fetchImpl = deps?.fetchImpl ?? fetch
-    const write = deps?.write ?? writeElliotConfig
-
-    const response = await fetchImpl(`${cfg.backend_url}/auth/refresh`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refresh_token: cfg.refresh_token }),
-    })
-    if (!response.ok) return cfg.jwt_token ?? null
-
-    const data = (await response.json()) as RefreshResponse
-    cfg.jwt_token = data.access_token
-    cfg.access_token_expires_at = new Date(Date.now() + data.expires_in_seconds * 1000).toISOString()
-    write(cfg)
-    return data.access_token
-  } catch {
-    return cfg.jwt_token ?? null
-  }
-}

package/plugin/opencode-plugin/src/index.ts

@@ -20,8 +20,7 @@
  * `.opencode/plugin/` file re-export.
  */
 import { isElliotKnowledgeTool, parseOptions, shellVerdict } from "./policy.js"
-import { ELLIOT_PROVIDER_ID, configHook, makeAuthHook } from "./proxy-provider.js"
-import { readElliotConfig } from "./elliot-auth.js"
+import { configHook } from "./proxy-provider.js"
 import { formatScope, scopeForWorktree } from "./scope.js"
 import { applyElliotIdentity } from "./identity.js"
 
@@ -87,25 +86,6 @@ export const ElliotPlugin: Plugin = async (input, rawOptions) => {
   // the one source the model cannot influence.
   const worktree = input.worktree || input.directory
 
-  // Seed a placeholder auth entry for the `elliot` provider so the host's
-  // auth loader fires at all (`provider.ts:1584` skips the loader entirely
-  // when nothing is stored for its provider id — see Task-1 findings). The
-  // value itself is never the credential that reaches the wire; the auth
-  // loader's `fetch` attaches the live bearer token per request. Guarded so
-  // a client-RPC failure never breaks plugin init, and skipped outright when
-  // the user isn't logged into Elliot.
-  if (readElliotConfig()) {
-    try {
-      await input.client?.auth?.set({
-        path: { id: ELLIOT_PROVIDER_ID },
-        body: { type: "api", key: "elliot-managed" },
-      })
-    } catch {
-      // Never break plugin init on a seeding failure — the auth loader
-      // simply won't fire this session, same as the no-login path.
-    }
-  }
-
   return {
     /**
      * One handler, two jobs — a JS object literal may carry only one
@@ -195,13 +175,6 @@ export const ElliotPlugin: Plugin = async (input, rawOptions) => {
     config: async (c) => {
       configHook(c)
     },
-
-    /**
-     * Self-refreshing auth loader for the `elliot` provider — see
-     * `proxy-provider.ts`. Only fires once the seeding above has stored an
-     * auth entry for `ELLIOT_PROVIDER_ID`.
-     */
-    auth: makeAuthHook(),
   }
 }
 

package/plugin/opencode-plugin/src/mcp-keys.ts

@@ -24,7 +24,134 @@ export function sanitizeKey(value: string): string {
 /** The backend tool behind every Elliot knowledge lookup. */
 export const KNOWLEDGE_TOOL = "knowledge_search"
 
-/** The agent-visible key for `KNOWLEDGE_TOOL` on a given MCP server. */
+/** The agent-visible key for `KNOWLEDGE_TOOL` on a given MCP server.
+ *
+ * Still the PRE-GATEWAY spelling, and still correct for a runtime wired
+ * straight to Elliot. It is no longer the only spelling that arrives — see
+ * `toCanonicalTool`.
+ */
 export function knowledgeToolKey(serverName: string): string {
   return `${sanitizeKey(serverName)}_${KNOWLEDGE_TOOL}`
 }
+
+/**
+ * LiteLLM joins its server alias to the tool name with a HYPHEN; OpenCode
+ * joins its own server key with an UNDERSCORE. Both appear in one wire name
+ * and they are not interchangeable.
+ *
+ * The SEPARATOR is LiteLLM's composition rule and is fixed. The ALIAS is
+ * configuration — it is the `mcp_servers` key in `deploy/litellm/config.yaml`
+ * — and this module no longer owns a copy of it. It used to:
+ *
+ *     export const GATEWAY_SERVER_ALIAS = "elliot"
+ *
+ * restated from the backend and "kept in step by a test". That is four copies
+ * of one literal across two languages, and the failure when they diverge is
+ * silent: an unrecognised tool name is one whose repo scope is never injected,
+ * so the agent answers tenant-wide and says nothing about it.
+ *
+ * The alias now arrives as a plugin option, served by the backend from
+ * `litellm_mcp_server_alias` (`routers/well_known.py`).
+ */
+const GATEWAY_SEPARATOR = "-"
+
+/**
+ * The canonical Elliot tool name behind an agent-visible key.
+ *
+ * Runtime traffic now reaches Elliot through LiteLLM's MCP gateway, and each
+ * hop adds its own namespace. All four spellings below are real, depending on
+ * whether the runtime is behind the gateway and how the host composed the key:
+ *
+ *     elliot_elliot-knowledge_search   OpenCode prefix + gateway prefix
+ *     elliot-knowledge_search          gateway prefix only
+ *     elliot_knowledge_search          OpenCode prefix only (pre-gateway)
+ *     knowledge_search                 bare/canonical
+ *
+ * Stripping is DETERMINISTIC and bounded: at most one server prefix, then at
+ * most one gateway prefix, each only from the front. Never a suffix or
+ * substring match — that is what stops a server called `not-elliot` from
+ * collecting scope hints meant for ours, and it is why the configured server
+ * names are required rather than inferred.
+ *
+ * Idempotent: feeding a canonical name back in returns it unchanged.
+ */
+/**
+ * The canonical tool name when the gateway alias is NOT knowable.
+ *
+ * For the TUI only. The TUI plugin entry (`tui: TuiPlugin = async (api)`)
+ * receives no options — the host hands it a UI api and nothing else — so it
+ * cannot be told the configured alias, and inventing a config channel for a
+ * sidebar would be a worse answer than this one.
+ *
+ * So it matches on STRUCTURE rather than on a specific alias: strip one
+ * configured server prefix, then allow ONE unknown `<something>-` layer.
+ *
+ * THIS IS NOT A FALLBACK TO A GUESSED ALIAS, and it does not weaken the
+ * anti-substring property that `toCanonicalTool` exists to hold. That property
+ * comes from the SERVER prefix, which the TUI does know (`api.state.mcp()`
+ * supplies it) and which is still required here. By the time an unknown
+ * gateway layer is considered, the key has already been proven to belong to a
+ * configured Elliot server — `not-elliot_knowledge_search` never reaches that
+ * line.
+ *
+ * Confined to display. Nothing authorizes on this: the sidebar decides which
+ * transcript rows to render, and the cost of a wrong answer is a missing or
+ * extra row, not a wrong scope. Authorization uses `toCanonicalTool` with the
+ * configured alias, on the backend, where the alias is known.
+ */
+export function toCanonicalToolUnderAnyGateway(
+  toolKey: string,
+  serverNames: readonly string[],
+): string {
+  if (!toolKey) return toolKey
+  let rest = toolKey
+  for (const server of serverNames) {
+    const prefix = `${sanitizeKey(server)}_`
+    if (rest.startsWith(prefix)) {
+      rest = rest.slice(prefix.length)
+      break
+    }
+  }
+  // One unknown gateway layer, and only one: `<alias>-<tool>`. The alias may
+  // not itself contain the separator, which is what keeps this bounded.
+  const layer = rest.indexOf(GATEWAY_SEPARATOR)
+  if (layer > 0) {
+    const remainder = rest.slice(layer + GATEWAY_SEPARATOR.length)
+    if (remainder) return remainder
+  }
+  return rest
+}
+
+export function toCanonicalTool(
+  toolKey: string,
+  serverNames: readonly string[],
+  gatewayAlias: string,
+): string {
+  if (!toolKey) return toolKey
+  if (!gatewayAlias) {
+    // No silent `|| "elliot"`. A missing alias means the caller is
+    // misconfigured, and guessing one would restore the duplicated literal
+    // this parameter exists to remove — while hiding the misconfiguration
+    // behind behaviour that happens to be right in one deployment.
+    throw new Error("toCanonicalTool requires the configured gateway alias")
+  }
+  const gatewayPrefix = `${gatewayAlias}${GATEWAY_SEPARATOR}`
+  let rest = toolKey
+
+  // One OpenCode `<server>_` prefix, and only for a server we are configured
+  // for. An unconfigured server's tools are not ours to recognise.
+  for (const server of serverNames) {
+    const prefix = `${sanitizeKey(server)}_`
+    if (rest.startsWith(prefix)) {
+      rest = rest.slice(prefix.length)
+      break
+    }
+  }
+
+  // Then one LiteLLM `<alias>-` prefix.
+  if (rest.startsWith(gatewayPrefix)) {
+    rest = rest.slice(gatewayPrefix.length)
+  }
+
+  return rest
+}

package/plugin/opencode-plugin/src/policy.ts

@@ -19,7 +19,7 @@ import {
   killsAgentRuntime,
   looksLikeCredentialExfiltration,
 } from "./classifier.js"
-import { KNOWLEDGE_TOOL, knowledgeToolKey, sanitizeKey } from "./mcp-keys.js"
+import { KNOWLEDGE_TOOL, sanitizeKey, toCanonicalTool } from "./mcp-keys.js"
 
 const OptionsSchema = z
   .object({
@@ -30,6 +30,27 @@ const OptionsSchema = z
      * what let the hooks recognise Elliot tools.
      */
     serverNames: z.array(z.string().min(1)).min(1).default(["elliot"]),
+    /**
+     * The LiteLLM MCP gateway's alias for Elliot — the `mcp_servers` key in
+     * `deploy/litellm/config.yaml`, which LiteLLM also uses as the prefix on
+     * every tool it proxies (`<alias>-<tool>`).
+     *
+     * REQUIRED, and deliberately without a default. This value used to be a
+     * constant in `mcp-keys.ts`, a fourth copy of a literal that also lives in
+     * the backend settings, the backend namespace module and the LiteLLM YAML.
+     * A default here would be that copy again: a plugin configured without the
+     * option would keep working against a guess, and would break silently on
+     * the day someone renamed the YAML key — recognising no gateway-prefixed
+     * tool, injecting no repo scope, and reporting nothing.
+     *
+     * The backend serves it with the plugin spec (`routers/well_known.py`),
+     * from `litellm_mcp_server_alias`.
+     *
+     * Distinct from `serverNames`, which is OpenCode's own server key and
+     * joins with an UNDERSCORE. Both read "elliot" in the default deployment
+     * and they are not the same value.
+     */
+    gatewayAlias: z.string().min(1),
   })
   .strict()
 
@@ -53,11 +74,22 @@ export { KNOWLEDGE_TOOL, sanitizeKey }
 
 /**
  * Is this agent-visible tool key Elliot's knowledge tool on one of our
- * configured servers? Exact composed-key match only — a suffix match would let
- * an unrelated MCP server named e.g. "not-elliot" receive our scope hints.
+ * configured servers?
+ *
+ * NORMALISED FIRST, then matched exactly. It used to compare against one
+ * composed spelling, which stopped matching the moment runtime traffic moved
+ * behind the LiteLLM MCP gateway and the key gained a second namespace
+ * (`elliot_elliot-knowledge_search`). A knowledge call that is not recognised
+ * here is one that silently loses its repository scope — the agent still
+ * answers, just tenant-wide instead of repo-focused, and nothing in the reply
+ * says so.
+ *
+ * The anti-substring property is unchanged: `toCanonicalTool` strips only a
+ * prefix belonging to a CONFIGURED server, so `not-elliot_knowledge_search`
+ * still does not match.
  */
 export function isElliotKnowledgeTool(toolKey: string, options: ElliotPluginOptions): boolean {
-  return options.serverNames.some((server) => toolKey === knowledgeToolKey(server))
+  return toCanonicalTool(toolKey, options.serverNames, options.gatewayAlias) === KNOWLEDGE_TOOL
 }
 
 // -- Shell policy verdicts ---------------------------------------------------

package/plugin/opencode-plugin/src/proxy-provider.ts

@@ -1,96 +1,148 @@
 /**
- * The Elliot proxy provider: a `config` hook that registers a custom
- * `elliot` OpenCode provider pointed at the Elliot LightLLM proxy, and an
- * `auth` hook whose `loader` returns a self-refreshing `fetch` that attaches
- * a live bearer token per request.
+ * The Elliot provider: a `config` hook that registers a custom `elliot`
+ * OpenCode provider pointed at LiteLLM directly.
  *
- * Mechanism pinned in `.superpowers/sdd/2026-09-03-eai-proxy-auth/task-1-findings.md`:
- *   - `config` hook mutates its input in place (no separate output param).
- *   - `auth.loader`'s return value is spread wholesale into the provider's
- *     resolved `options`, so `{ apiKey, fetch }` land there directly.
- *   - `apiKey` is baked into the AI-SDK client at construction time and
- *     never changes; the actually-rotating credential is injected per
- *     request by `options.fetch`'s `Authorization` header (never the static
- *     `apiKey`) — same pattern as OpenCode's bundled snowflake-cortex plugin.
- *   - The loader only runs once a stored auth entry exists for its
- *     `provider` id (`provider.ts:1584`); the plugin seeds that entry itself
- *     at init (see `index.ts`) so no interactive `opencode auth login` step
- *     is ever required.
+ * Since `/llm-proxy` was removed, this no longer needs a self-refreshing
+ * per-request `auth` hook (Task-1's pinned mechanism, `.superpowers/sdd/
+ * 2026-09-03-eai-proxy-auth/task-1-findings.md` — kept only as history: the
+ * per-instance JWT that mechanism refreshed doesn't authenticate this path
+ * anymore). LiteLLM's `litellm_master_key` is ONE static secret for the whole
+ * gateway — it never expires, so it is baked into `options.apiKey` directly,
+ * the same way OpenCode's own `{env:VAR}` config substitution would, just
+ * read from `~/.elliot/config.json` instead of the process environment.
  *
  * Everything here is a no-op when the user isn't logged in
  * (`readElliotConfig()` returns null) — OpenCode then runs exactly as it
  * would without this plugin.
  */
-import { freshToken, readElliotConfig } from "./elliot-auth.js"
+import { readElliotConfig, type ElliotCredential } from "./elliot-auth.js"
 
-export const ELLIOT_LLM_PROXY_URL = "https://backend.elliotsystemsonline.com/llm-proxy"
 export const ELLIOT_PROVIDER_ID = "elliot"
+export const ELLIOT_GENERAL_MODEL_ID = "elliot-general"
+export const ELLIOT_CODER_MODEL_ID = "elliot-coder"
+
+const ALL_MODELS = {
+  [ELLIOT_GENERAL_MODEL_ID]: { name: "Elliot General" },
+  [ELLIOT_CODER_MODEL_ID]: { name: "Elliot Coder" },
+}
 
 /**
- * Registers the `elliot` provider (baseURL = the LightLLM proxy) and
- * defaults `cfg.model` to it, mutating `cfg` in place. No-op when the user
- * isn't logged in. Never overwrites a model the user already configured, or
- * any other existing key under `cfg.provider`/`cfg.plugin`/`cfg.mcp`/etc.
+ * The `models` block for one registered provider, filtered to
+ * `allowedModels` (Phase 4 governance, docs/LITELLM_GATEWAY.md §14) —
+ * LiteLLM gateway audit finding #5, mirrors the identical fix already made
+ * to `app/services/opencode/teamconfig.py::build_opencode_config` and
+ * `elliot-launcher/lib/setup.js::elliotProvider`. LiteLLM was always the
+ * real enforcement point regardless of what this offers; this only stops
+ * the menu from offering a model that will be rejected. Falsy
+ * (undefined/null/empty) — every team until an admin restricts it — offers
+ * both, unchanged from before this parameter existed.
+ *
+ * A team restricted to ONLY elliot-classifier (never offered here —
+ * internal-only, deploy/litellm/config.yaml §5) would otherwise get an
+ * empty, unusable menu; degrades to offering both for that listing only,
+ * same as the two sibling generators — LiteLLM still rejects any actual
+ * request the team isn't allowed to make either way.
  */
-export function configHook(cfg: any): void {
-  if (!readElliotConfig()) return
+function offeredModels(allowedModels?: string[] | null): typeof ALL_MODELS {
+  if (!allowedModels || allowedModels.length === 0) return ALL_MODELS
 
-  cfg.provider ??= {}
-  cfg.provider[ELLIOT_PROVIDER_ID] = {
-    npm: "@ai-sdk/anthropic",
-    name: "Elliot (governed)",
-    options: { baseURL: ELLIOT_LLM_PROXY_URL },
-    models: { "elliot-governed": { name: "Elliot (governed)" } },
-  }
+  const allowed = new Set(allowedModels)
+  const offered = Object.keys(ALL_MODELS).filter((id) => allowed.has(id)) as Array<
+    keyof typeof ALL_MODELS
+  >
+  if (offered.length === 0) return ALL_MODELS
 
-  cfg.model ??= "elliot/elliot-governed"
+  const filtered = {} as typeof ALL_MODELS
+  for (const id of offered) filtered[id] = ALL_MODELS[id]
+  return filtered
 }
 
-/**
- * Merge `Authorization: Bearer <token>` into whatever headers `init` already
- * carries, without dropping them. Works whether `init.headers` is a plain
- * object, a `Headers` instance, or an array of pairs.
- */
-function withAuthHeader(init: RequestInit | undefined, token: string): RequestInit {
-  const headers = new Headers(init?.headers)
-  headers.set("Authorization", `Bearer ${token}`)
-  return { ...init, headers }
+function registerProvider(
+  cfg: any,
+  base: string,
+  providerId: string,
+  label: string,
+  apiKey: string,
+  allowedModels?: string[] | null,
+): void {
+  cfg.provider ??= {}
+  // Never clobber a provider id the user (or an earlier plugin) already
+  // configured — same "additive only" contract as the single-provider path
+  // this replaces.
+  cfg.provider[providerId] ??= {
+    npm: "@ai-sdk/openai-compatible",
+    name: label,
+    options: { baseURL: `${base}/v1`, apiKey },
+    models: offeredModels(allowedModels),
+  }
 }
 
 /**
- * The per-request fetch wrapper: reads `~/.elliot/config.json` fresh on
- * every call (so a refresh picked up by another process is honored
- * immediately), refreshes via `freshToken` when needed, and attaches the
- * bearer token. Never throws — a missing/expired/unrefreshable token just
- * means the request goes out unauthenticated and the proxy 401s.
+ * Registers one OpenCode provider per LiteLLM credential this person has
+ * (Phase 4, docs/LITELLM_GATEWAY.md §14): their own personal key under
+ * `elliot`, plus one `elliot-team-<slug>` provider per team they belong to —
+ * so `opencode.json`'s own global+project-local merge, not this plugin, is
+ * what decides which key a given folder actually uses (a project-local
+ * config pins `model` to a team's provider; the global default falls back to
+ * the personal one). Mutating `cfg` in place.
+ *
+ * Falls back to registering a single `elliot` provider from the legacy
+ * `litellm_master_key` field when `elliot.credentials` is absent — an
+ * `eai setup` written before this phase, or a backend that predates it,
+ * keeps working unchanged rather than losing LLM access outright.
+ *
+ * No-op when the user isn't logged in. Never overwrites a model the user
+ * already configured, or any other existing key under
+ * `cfg.provider`/`cfg.plugin`/`cfg.mcp`/etc.
  */
-async function elliotFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {
-  try {
-    const cfg = readElliotConfig()
-    const token = cfg ? await freshToken(cfg) : null
-    if (token) {
-      return globalThis.fetch(input, withAuthHeader(init, token))
+export function configHook(cfg: any): void {
+  const elliot = readElliotConfig()
+  if (!elliot?.litellm_base_url) return
+
+  const base = elliot.litellm_base_url.replace(/\/+$/, "")
+
+  // The DEFAULT provider's own offered models decide the default `model`
+  // below — never just `elliot-general` unconditionally, since the
+  // fallback (single-provider) path can itself be restricted. In the
+  // credentials path this is always the personal credential (provider_id
+  // "elliot"), which has no team and so is never restricted — `ALL_MODELS`
+  // unless a future personal restriction concept changes that.
+  let defaultProviderModels: typeof ALL_MODELS = ALL_MODELS
+
+  if (elliot.credentials?.length) {
+    for (const credential of elliot.credentials as ElliotCredential[]) {
+      if (!credential.provider_id || !credential.api_key) continue
+      registerProvider(
+        cfg,
+        base,
+        credential.provider_id,
+        credential.label,
+        credential.api_key,
+        credential.allowed_models,
+      )
+      if (credential.provider_id === ELLIOT_PROVIDER_ID) {
+        defaultProviderModels = offeredModels(credential.allowed_models)
+      }
     }
-    return globalThis.fetch(input, init)
-  } catch {
-    return globalThis.fetch(input, init)
+  } else if (elliot.litellm_master_key) {
+    registerProvider(
+      cfg,
+      base,
+      ELLIOT_PROVIDER_ID,
+      "Elliot (LiteLLM)",
+      elliot.litellm_master_key,
+      elliot.allowed_models,
+    )
+    defaultProviderModels = offeredModels(elliot.allowed_models)
+  } else {
+    return
   }
-}
 
-/**
- * Builds the `auth` hook object per the Task-1 pinned `AuthHook` shape.
- * `methods` is empty — this provider is never set up via interactive
- * `opencode auth login`; the plugin seeds the stored auth entry itself
- * (see `index.ts`) so the loader always fires once the user is logged into
- * Elliot.
- */
-export function makeAuthHook() {
-  return {
-    provider: ELLIOT_PROVIDER_ID,
-    methods: [] as unknown[],
-    loader: async (_auth: () => Promise<unknown>, _provider: unknown) => ({
-      apiKey: "elliot-managed",
-      fetch: elliotFetch,
-    }),
-  }
+  // Follows the restriction, not always General — a team restricted to
+  // Coder-only must not default to a model its own menu just excluded.
+  const defaultModelId =
+    ELLIOT_GENERAL_MODEL_ID in defaultProviderModels
+      ? ELLIOT_GENERAL_MODEL_ID
+      : Object.keys(defaultProviderModels)[0]
+  cfg.model ??= `${ELLIOT_PROVIDER_ID}/${defaultModelId}`
 }

package/plugin/opencode-plugin/src/scope.ts

@@ -2,7 +2,8 @@
  * Repository scope from the session worktree — the trusted-context half of the
  * "the model never names a repository" invariant.
  *
- * Ported (trimmed, not imported) from `elliot-cli/src/project.ts`: the same
+ * Ported (trimmed, not imported) from the retired elliot-ai CLI's
+ * `src/project.ts`: the same
  * `execFile` discipline — a fixed, hardcoded argument array, never a string a
  * shell would parse, and never anything the LLM supplies. The worktree path
  * comes from OpenCode's own `PluginInput`/`ToolContext`, which is session