@gitterm/sdk 0.4.0 → 0.6.1

package/dist/direct/index.js

@@ -1,6 +1,5 @@
 // src/direct/client.ts
 import { randomUUID } from "node:crypto";
-import { createOpencodeClient as createOpencodeClient2 } from "@opencode-ai/sdk";
 
 // ../agent-runtime/src/normalize.ts
 var OPENCODE_CUSTOM_OPTION_LABEL = /^type your own answer\W*$/i;
@@ -32,103 +31,6 @@ function normalizeQuestion(question) {
   return changed ? { ...question, options, custom } : question;
 }
 
-// ../agent-runtime/src/opencode.ts
-import { createOpencodeClient } from "@opencode-ai/sdk";
-
-// ../agent-runtime/src/types.ts
-function parseModelRef(model) {
-  if (!model)
-    return;
-  const separator = model.indexOf("/");
-  if (separator <= 0 || separator === model.length - 1) {
-    throw new Error('model must use the "provider/model" format');
-  }
-  return { providerID: model.slice(0, separator), modelID: model.slice(separator + 1) };
-}
-function permissionTitle(permission, patterns) {
-  return patterns.length > 0 ? `${permission}: ${patterns.join(", ")}` : permission;
-}
-function sessionStatusOf(status) {
-  return status === "busy" ? "busy" : status === "retry" ? "retry" : "idle";
-}
-function missingSessionSnapshot() {
-  return {
-    sessionExists: false,
-    busy: false,
-    retry: false,
-    messages: [],
-    finalText: null,
-    assistant: { exists: false, completed: false, error: null },
-    pendingInputs: []
-  };
-}
-var TOOL_OUTPUT_LIMIT = 4000;
-function truncateToolOutput(value) {
-  return value.length > TOOL_OUTPUT_LIMIT ? `${value.slice(0, TOOL_OUTPUT_LIMIT)}
-…[truncated ${value.length - TOOL_OUTPUT_LIMIT} chars]` : value;
-}
-
-// ../agent-runtime/src/opencode.ts
-function isOpencodeRunMessage(info, messageId) {
-  return info.id === messageId || info.role === "assistant" && info.parentID === messageId;
-}
-function snapshotParts(parts) {
-  const result = [];
-  for (const part of parts) {
-    if (part.type === "text") {
-      if (!part.ignored && part.text.trim())
-        result.push({ type: "text", text: part.text });
-    } else if (part.type === "tool") {
-      const state = part.state;
-      result.push({
-        type: "tool",
-        callId: part.callID,
-        tool: part.tool,
-        status: state.status,
-        title: "title" in state && state.title ? state.title : null,
-        input: state.input,
-        output: state.status === "completed" ? truncateToolOutput(state.output) : null,
-        error: state.status === "error" ? state.error : null,
-        startedAt: "time" in state ? new Date(state.time.start).toISOString() : null,
-        completedAt: (state.status === "completed" || state.status === "error") && state.time.end ? new Date(state.time.end).toISOString() : null
-      });
-    }
-  }
-  return result;
-}
-function findLastOpencodeRunAssistant(messages, messageId) {
-  return messages.findLast((message) => message.info.role === "assistant" && isOpencodeRunMessage(message.info, messageId));
-}
-function formatOpencodeError(error, model) {
-  if (!error)
-    return "OpenCode request failed";
-  if (typeof error === "string")
-    return error;
-  let message;
-  if (typeof error === "object" && "data" in error) {
-    const data = error.data;
-    if (typeof data?.message === "string")
-      message = data.message;
-    const name = "name" in error ? error.name : undefined;
-    const providerID = typeof data?.providerID === "string" ? data.providerID : model?.providerID;
-    const authenticationFailed = name === "ProviderAuthError" || (message ? /invalid api key|authentication|unauthorized/i.test(message) : false);
-    if (authenticationFailed && providerID) {
-      const selectedModel = model ? ` for model "${model.providerID}/${model.modelID}"` : "";
-      return `Model provider credential "${providerID}" was rejected${selectedModel}: ${message ?? "Authentication failed"}`;
-    }
-  }
-  return message ?? JSON.stringify(error) ?? "OpenCode request failed";
-}
-function createWorkspaceOpencodeClient(input) {
-  const authorization = input.password ? `Basic ${Buffer.from(`opencode:${input.password}`).toString("base64")}` : undefined;
-  return createOpencodeClient({
-    baseUrl: input.url,
-    directory: input.directory,
-    headers: { ...input.headers, ...authorization ? { Authorization: authorization } : {} },
-    fetch: input.fetch
-  });
-}
-
 // ../agent-runtime/src/http.ts
 class RuntimeHttpError extends Error {
   status;
@@ -149,7 +51,7 @@ function authorizationHeader(password) {
 }
 function runtimeUrl(target, path) {
   const url = new URL(`${target.url.replace(/\/$/, "")}${path}`);
-  if (target.api === "v2" && target.directory && !url.searchParams.has("location")) {
+  if (target.directory && !url.searchParams.has("location")) {
     url.searchParams.set("location", JSON.stringify({ directory: target.directory }));
   }
   return url.toString();
@@ -290,233 +192,37 @@ function asStringArray(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 
-// ../agent-runtime/src/v1.ts
-function createV1Runtime(target) {
-  const client = () => createWorkspaceOpencodeClient(target);
-  const http = createRuntimeHttp(target);
-  const directoryQuery = `?directory=${encodeURIComponent(target.directory)}`;
-  return {
-    api: "v1",
-    async createSession(input) {
-      const created = await client().session.create({
-        body: input.title ? { title: input.title } : undefined,
-        query: { directory: target.directory }
-      });
-      if (created.error || !created.data)
-        throw new Error(formatOpencodeError(created.error));
-      return { id: created.data.id, title: created.data.title };
-    },
-    async prompt(input) {
-      const model = parseModelRef(input.model);
-      const prompted = await client().session.promptAsync({
-        path: { id: input.sessionId },
-        query: { directory: target.directory },
-        body: {
-          messageID: input.messageId,
-          parts: [{ type: "text", text: input.prompt }],
-          agent: input.agent,
-          model
-        }
-      });
-      if (prompted.error)
-        throw new Error(formatOpencodeError(prompted.error));
-    },
-    async abort(sessionId) {
-      const result = await client().session.abort({
-        path: { id: sessionId },
-        query: { directory: target.directory }
-      });
-      if (result.error)
-        throw new Error(formatOpencodeError(result.error));
-    },
-    async deleteSession(sessionId) {
-      const result = await client().session.delete({
-        path: { id: sessionId },
-        query: { directory: target.directory }
-      });
-      if (result.error)
-        throw new Error(formatOpencodeError(result.error));
-    },
-    async snapshot(sessionId, messageId) {
-      const api = client();
-      const [session, statuses, messages, permissions, questions] = await Promise.all([
-        api.session.get({
-          path: { id: sessionId },
-          query: { directory: target.directory },
-          signal: target.signal
-        }),
-        api.session.status({ query: { directory: target.directory }, signal: target.signal }),
-        api.session.messages({
-          path: { id: sessionId },
-          query: { directory: target.directory },
-          signal: target.signal
-        }),
-        http.json(`/permission${directoryQuery}`),
-        http.json(`/question${directoryQuery}`)
-      ]);
-      if (session.response.status === 404)
-        return missingSessionSnapshot();
-      if (session.error || !session.data)
-        throw new Error(formatOpencodeError(session.error));
-      if (statuses.error || !statuses.data)
-        throw new Error(formatOpencodeError(statuses.error));
-      if (messages.error || !messages.data)
-        throw new Error(formatOpencodeError(messages.error));
-      const status = statuses.data[sessionId];
-      const userIndex = messages.data.findIndex((message) => message.info.id === messageId);
-      const superseded = userIndex >= 0 && messages.data.slice(userIndex + 1).some((message) => message.info.role === "user");
-      const assistant = findLastOpencodeRunAssistant(messages.data, messageId);
-      const assistantInfo = assistant?.info.role === "assistant" ? assistant.info : undefined;
-      const assistantModel = assistantInfo ? { providerID: assistantInfo.providerID, modelID: assistantInfo.modelID } : undefined;
-      const finalText = assistant ? textOf(assistant.parts) : "";
-      const pendingInputs = [
-        ...(Array.isArray(permissions) ? permissions : []).map(asRecord).filter((permission) => permission.sessionID === sessionId).map(permissionRequest),
-        ...(Array.isArray(questions) ? questions : []).map(asRecord).filter((question) => question.sessionID === sessionId).map(questionRequest)
-      ];
-      return {
-        sessionExists: true,
-        superseded,
-        busy: status?.type === "busy",
-        retry: status?.type === "retry",
-        messages: messages.data.filter((message) => isOpencodeRunMessage(message.info, messageId)).map((message) => ({
-          id: message.info.id,
-          role: message.info.role,
-          createdAt: new Date(message.info.time.created).toISOString(),
-          completedAt: message.info.role === "assistant" && message.info.time.completed ? new Date(message.info.time.completed).toISOString() : null,
-          text: textOf(message.parts),
-          parts: snapshotParts(message.parts),
-          error: message.info.role === "assistant" && message.info.error ? formatOpencodeError(message.info.error, {
-            providerID: message.info.providerID,
-            modelID: message.info.modelID
-          }) : null
-        })),
-        finalText: finalText || null,
-        assistant: {
-          exists: Boolean(assistant),
-          completed: assistantInfo?.time.completed != null,
-          error: assistantInfo?.error ? {
-            kind: assistantInfo.error.name === "MessageAbortedError" ? "aborted" : "error",
-            message: formatOpencodeError(assistantInfo.error, assistantModel)
-          } : null
-        },
-        pendingInputs: superseded ? [] : pendingInputs
-      };
-    },
-    subscribe: (signal) => signalStream(target, `/event${directoryQuery}`, parseV1Signal, signal),
-    async replyPermission(sessionId, requestId, reply) {
-      const result = await client().postSessionIdPermissionsPermissionId({
-        path: { id: sessionId, permissionID: requestId },
-        query: { directory: target.directory },
-        body: { response: reply }
-      });
-      if (result.response.status === 404)
-        throw new RuntimeHttpError(404, "", null);
-      if (result.error)
-        throw new Error(formatOpencodeError(result.error));
-    },
-    async replyQuestion(_sessionId, request, answers) {
-      await http.send(`/question/${encodeURIComponent(request.id)}/reply${directoryQuery}`, {
-        method: "POST",
-        json: { answers }
-      });
-    },
-    async rejectQuestion(_sessionId, requestId) {
-      await http.send(`/question/${encodeURIComponent(requestId)}/reject${directoryQuery}`, {
-        method: "POST",
-        json: {}
-      });
-    }
-  };
+// ../agent-runtime/src/types.ts
+function parseModelRef(model) {
+  if (!model)
+    return;
+  const separator = model.indexOf("/");
+  if (separator <= 0 || separator === model.length - 1) {
+    throw new Error('model must use the "provider/model" format');
+  }
+  return { providerID: model.slice(0, separator), modelID: model.slice(separator + 1) };
 }
-function textOf(parts) {
-  return parts.filter((part) => part.type === "text" && !part.ignored).map((part) => part.text ?? "").join(`
-`).trim();
+function permissionTitle(permission, patterns) {
+  return patterns.length > 0 ? `${permission}: ${patterns.join(", ")}` : permission;
 }
-function permissionRequest(raw) {
-  const tool = asRecord(raw.tool);
-  const permission = asString(raw.permission) ?? asString(raw.type) ?? "permission";
-  const patterns = asStringArray(raw.patterns).length > 0 ? asStringArray(raw.patterns) : asStringArray(Array.isArray(raw.pattern) ? raw.pattern : [raw.pattern]);
-  const createdMs = asRecord(raw.time).created;
-  return {
-    id: asString(raw.id) ?? "",
-    kind: "permission",
-    createdAt: typeof createdMs === "number" ? new Date(createdMs).toISOString() : null,
-    toolCallId: asString(tool.callID) ?? asString(raw.callID),
-    permission,
-    patterns,
-    always: asStringArray(raw.always),
-    title: asString(raw.title) ?? permissionTitle(permission, patterns)
-  };
+function sessionStatusOf(status) {
+  return status === "busy" ? "busy" : status === "retry" ? "retry" : "idle";
 }
-function questionRequest(raw) {
-  const tool = asRecord(raw.tool);
-  const questions = Array.isArray(raw.questions) ? raw.questions.map(asRecord) : [];
+function missingSessionSnapshot() {
   return {
-    id: asString(raw.id) ?? "",
-    kind: "question",
-    createdAt: null,
-    toolCallId: asString(tool.callID),
-    questions: questions.map((question, index) => normalizeQuestion({
-      key: `q${index}`,
-      header: asString(question.header) ?? `Question ${index + 1}`,
-      question: asString(question.question) ?? "",
-      options: (Array.isArray(question.options) ? question.options.map(asRecord) : []).map((option) => ({
-        label: asString(option.label) ?? "",
-        description: asString(option.description) ?? ""
-      })),
-      multiple: question.multiple === true,
-      custom: question.custom !== false
-    }))
+    sessionExists: false,
+    busy: false,
+    retry: false,
+    messages: [],
+    finalText: null,
+    assistant: { exists: false, completed: false, error: null },
+    pendingInputs: []
   };
 }
-function changed(sessionId) {
-  return sessionId ? { type: "session.changed", sessionId } : null;
-}
-function parseV1Signal(raw) {
-  const properties = asRecord(raw.properties);
-  switch (raw.type) {
-    case "message.updated":
-    case "message.removed":
-      return changed(asString(asRecord(properties.info).sessionID) ?? asString(properties.sessionID));
-    case "message.part.updated":
-    case "message.part.removed":
-      return changed(asString(asRecord(properties.part).sessionID) ?? asString(properties.sessionID));
-    case "session.status": {
-      const sessionId = asString(properties.sessionID);
-      const status = sessionStatusOf(asString(asRecord(properties.status).type));
-      return sessionId ? { type: "session.status", sessionId, status } : null;
-    }
-    case "session.idle": {
-      const sessionId = asString(properties.sessionID);
-      return sessionId ? { type: "session.status", sessionId, status: "idle" } : null;
-    }
-    case "session.error": {
-      const sessionId = asString(properties.sessionID);
-      return sessionId ? { type: "session.error", sessionId, message: formatOpencodeError(properties.error) } : null;
-    }
-    case "session.deleted": {
-      const sessionId = asString(asRecord(properties.info).id);
-      return sessionId ? { type: "session.deleted", sessionId } : null;
-    }
-    case "permission.asked":
-    case "permission.updated": {
-      const sessionId = asString(properties.sessionID);
-      return sessionId ? { type: "input.asked", sessionId, request: permissionRequest(properties) } : null;
-    }
-    case "question.asked": {
-      const sessionId = asString(properties.sessionID);
-      return sessionId ? { type: "input.asked", sessionId, request: questionRequest(properties) } : null;
-    }
-    case "permission.replied":
-    case "question.replied":
-    case "question.rejected": {
-      const sessionId = asString(properties.sessionID);
-      const requestId = asString(properties.requestID) ?? asString(properties.permissionID);
-      return sessionId && requestId ? { type: "input.resolved", sessionId, requestId } : null;
-    }
-    default:
-      return null;
-  }
+var TOOL_OUTPUT_LIMIT = 4000;
+function truncateToolOutput(value) {
+  return value.length > TOOL_OUTPUT_LIMIT ? `${value.slice(0, TOOL_OUTPUT_LIMIT)}
+…[truncated ${value.length - TOOL_OUTPUT_LIMIT} chars]` : value;
 }
 
 // ../agent-runtime/src/v2.ts
@@ -538,7 +244,6 @@ function createV2Runtime(target) {
     }
   }
   return {
-    api: "v2",
     async createSession(input) {
       const modelRef = parseModelRef(input.model);
       const created = await http.json("/api/session", {
@@ -602,7 +307,7 @@ function createV2Runtime(target) {
           } : null
         },
         pendingInputs: superseded ? [] : [
-          ...(permissions.data ?? []).map(asRecord).map(permissionRequest2),
+          ...(permissions.data ?? []).map(asRecord).map(permissionRequest),
           ...(forms.data ?? []).map(asRecord).map(formRequest)
         ]
       };
@@ -720,7 +425,7 @@ function normalizeMessage(message) {
     error: message.error ? asString(error.message) ?? "Agent request failed" : null
   };
 }
-function permissionRequest2(raw) {
+function permissionRequest(raw) {
   const action = asString(raw.action) ?? "permission";
   const patterns = asStringArray(raw.resources);
   return {
@@ -771,15 +476,15 @@ function parseV2Signal(raw) {
   const data = asRecord(raw.data);
   const type = asString(raw.type) ?? "";
   const sessionId = asString(data.sessionID);
-  const changed2 = () => sessionId ? { type: "session.changed", sessionId } : null;
+  const changed = () => sessionId ? { type: "session.changed", sessionId } : null;
   if (type.startsWith("session.step.") || type.startsWith("session.tool."))
-    return changed2();
+    return changed();
   switch (type) {
     case "session.text.ended":
     case "session.reasoning.ended":
     case "session.message.content.updated":
     case "session.inbox.delivered":
-      return changed2();
+      return changed();
     case "session.execution.started":
       return sessionId ? { type: "session.status", sessionId, status: "busy" } : null;
     case "session.execution.succeeded":
@@ -804,7 +509,7 @@ function parseV2Signal(raw) {
       return deleted ? { type: "session.deleted", sessionId: deleted } : null;
     }
     case "permission.asked":
-      return sessionId ? { type: "input.asked", sessionId, request: permissionRequest2(data) } : null;
+      return sessionId ? { type: "input.asked", sessionId, request: permissionRequest(data) } : null;
     case "form.created": {
       const form = asRecord(data.form);
       const formSession = asString(form.sessionID);
@@ -860,9 +565,10 @@ function deriveRunState(snapshot, context) {
     return { status: "running", errorMessage: null };
   return { status: "completed", errorMessage: null };
 }
+
 // ../agent-runtime/src/index.ts
 function getRuntime(target) {
-  return target.api === "v2" ? createV2Runtime(target) : createV1Runtime(target);
+  return createV2Runtime(target);
 }
 
 // ../agent-runtime/src/replies.ts
@@ -1077,7 +783,6 @@ function directRuntime(workspace, fetchImpl, signal) {
     directory: workspace.runtime.directory,
     password: workspace.runtime.password ?? null,
     headers: workspace.runtime.headers,
-    api: workspace.opencodeApi,
     fetch: fetchImpl,
     signal
   });
@@ -1510,6 +1215,220 @@ main().catch(() => {
 });
 `;
 
+// ../agent-runtime/src/opencode-credentials.ts
+var OPENCODE_CREDENTIALS_PATH = "~/.gitterm/opencode/credentials.json";
+var OPENCODE_CREDENTIALS_PLUGIN_PATH = "~/.config/opencode/plugins/gitterm-credentials.js";
+var OPENCODE_CREDENTIAL_LABEL = "Gitterm";
+function opencodeCredentialFiles(entries) {
+  return [
+    {
+      path: OPENCODE_CREDENTIALS_PATH,
+      contentBase64: Buffer.from(JSON.stringify(entries)).toString("base64"),
+      mode: 384
+    },
+    {
+      path: OPENCODE_CREDENTIALS_PLUGIN_PATH,
+      contentBase64: Buffer.from(OPENCODE_CREDENTIALS_PLUGIN).toString("base64")
+    }
+  ];
+}
+var OPENCODE_CREDENTIALS_PLUGIN = String.raw`
+import { readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const METHOD_ID = "gitterm-import";
+const FILE = path.join(process.env.HOME || os.homedir(), ".gitterm/opencode/credentials.json");
+const DEVICE_FLOW = ["github-copilot", "opencode", "xai"];
+// OpenCode only enables ChatGPT routing for its own method IDs. The browser method cannot
+// complete in a remote workspace (its callback is loopback), so managed accounts take it over.
+const MANAGED_METHOD = { openai: "chatgpt-browser" };
+const log = (message, detail) => console.log("[gitterm-credentials] " + message + (detail ? ": " + detail : ""));
+
+// Groups entries by integration and orders each group so the active account is created
+// last: OpenCode makes the most recently created credential the active one.
+function readCredentials() {
+  try {
+    const entries = JSON.parse(readFileSync(FILE, "utf8"));
+    if (!Array.isArray(entries)) return new Map();
+    const groups = new Map();
+    for (const entry of entries) {
+      const integration = typeof entry?.integration === "string" ? entry.integration.replace(/\/+$/, "") : "";
+      const value = entry?.value;
+      if (!integration || typeof entry.label !== "string" || !entry.label) continue;
+      if (!value || (value.type !== "api" && value.type !== "oauth")) continue;
+      if (!groups.has(integration)) groups.set(integration, []);
+      groups.get(integration).push({ label: entry.label, active: entry.active === true, value });
+    }
+    for (const group of groups.values()) {
+      const active = group.findIndex((entry) => entry.active);
+      if (active !== -1 && active !== group.length - 1) group.push(...group.splice(active, 1));
+    }
+    return groups;
+  } catch (error) {
+    if (error?.code !== "ENOENT") log("unreadable credentials file", String(error));
+    return new Map();
+  }
+}
+
+function builtinOAuthMethod(id, methods) {
+  const preferred = id === "openai" ? "chatgpt-browser" : DEVICE_FLOW.includes(id) ? "device" : "oauth";
+  const oauth = methods.filter((method) => method.type === "oauth" && method.id !== METHOD_ID);
+  return (oauth.find((method) => method.id === preferred) ?? oauth[0])?.id;
+}
+
+// Only answers the key method asks for: OpenCode rejects answers when it shows no form
+// (for example because CLOUDFLARE_ACCOUNT_ID is already set).
+function keyAnswer(methods, metadata) {
+  const form = methods.find((method) => method.type === "key")?.form;
+  if (!metadata || !Array.isArray(form)) return undefined;
+  const answer = {};
+  for (const field of form) {
+    if (typeof field?.key === "string" && typeof metadata[field.key] === "string") answer[field.key] = metadata[field.key];
+  }
+  return Object.keys(answer).length ? answer : undefined;
+}
+
+const isManaged = (value) => value?.type === "oauth" && typeof value.metadata?.gittermCredentialId === "string";
+
+// One request per credential at a time; GitTerm serializes across workspaces.
+const inflight = new Map();
+function managedRefresh(credential) {
+  const id = credential.metadata?.gittermCredentialId;
+  if (typeof id !== "string") return Promise.resolve(credential);
+  if (!inflight.has(id)) {
+    inflight.set(id, requestToken(id).then(
+      (token) => ({ ...credential, access: token.access, expires: token.expires, metadata: { ...credential.metadata, ...token.metadata } }),
+    ).finally(() => inflight.delete(id)));
+  }
+  return inflight.get(id);
+}
+
+async function requestToken(credentialId) {
+  const url = process.env.WORKSPACE_API_URL;
+  const auth = process.env.WORKSPACE_AGENT_AUTH_TOKEN;
+  if (!url || !auth) throw new Error("GitTerm workspace identity is unavailable");
+  const response = await fetch(url.replace(/\/$/, "") + "/workspaceOps.modelCredential", {
+    method: "POST",
+    headers: { Authorization: "Bearer " + auth, "Content-Type": "application/json" },
+    body: JSON.stringify({ credentialId }),
+    redirect: "error",
+    signal: AbortSignal.timeout(30000),
+  });
+  const body = await response.json().catch(() => undefined);
+  const data = body?.result?.data?.json ?? body?.result?.data;
+  if (!response.ok || typeof data?.access !== "string" || typeof data?.expires !== "number") {
+    const message = body?.error?.json?.message ?? body?.error?.message ?? "status " + response.status;
+    log("GitTerm token request failed", message);
+    throw new Error("GitTerm could not provide a token: " + message);
+  }
+  return data;
+}
+
+function toOAuthCredential(methodID, value) {
+  const metadata = {
+    ...(value.metadata && typeof value.metadata === "object" ? value.metadata : {}),
+    ...(value.accountId ? { accountID: value.accountId } : {}),
+    ...(value.enterpriseUrl ? { enterpriseUrl: value.enterpriseUrl } : {}),
+  };
+  return {
+    type: "oauth",
+    methodID,
+    refresh: value.refresh,
+    access: value.access ?? "",
+    expires: value.expires ?? 0,
+    ...(Object.keys(metadata).length ? { metadata } : {}),
+  };
+}
+
+async function importOAuth(ctx, id, label) {
+  const attempt = (await ctx.integration.oauth.connect({ integrationID: id, methodID: METHOD_ID, label })).data;
+  for (let i = 0; i < 100; i++) {
+    const status = (await ctx.integration.oauth.status({ integrationID: id, attemptID: attempt.attemptID })).data;
+    if (status.status !== "pending") return status;
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  return { status: "failed", message: "timed out" };
+}
+
+export default {
+  id: "gitterm-credentials",
+  async setup(ctx) {
+    const groups = readCredentials();
+    // One import method per integration; the pending OAuth entry is handed over per attempt.
+    const pending = new Map();
+    const oauthIntegrations = [...groups].filter(([, entries]) => entries.some((entry) => entry.value.type === "oauth"));
+    if (oauthIntegrations.length) {
+      await ctx.integration.transform((editor) => {
+        for (const [id, entries] of oauthIntegrations) {
+          if (!editor.get(id)) continue;
+          const builtin = builtinOAuthMethod(id, editor.method.list(id));
+          const managed = entries.some((entry) => isManaged(entry.value));
+          if (!builtin && !managed) continue;
+          const managedMethod = MANAGED_METHOD[id] ?? METHOD_ID;
+          const authorize = async () => {
+            const value = pending.get(id);
+            return {
+              url: "",
+              instructions: "Importing the credential provided by Gitterm",
+              mode: "auto",
+              callback: Promise.resolve(toOAuthCredential(isManaged(value) ? managedMethod : builtin, value)),
+            };
+          };
+          editor.method.update({
+            integrationID: id,
+            method: { id: METHOD_ID, type: "oauth", label: "Gitterm" },
+            authorize,
+            refresh: managedRefresh,
+          });
+          if (managed && managedMethod !== METHOD_ID) {
+            editor.method.update({
+              integrationID: id,
+              method: { id: managedMethod, type: "oauth", label: "Managed by Gitterm" },
+              authorize,
+              refresh: managedRefresh,
+            });
+          }
+        }
+      });
+    }
+    for (const [id, entries] of groups) {
+      const info = await ctx.integration.get({ integrationID: id }).then((result) => result.data, () => undefined);
+      if (!info) {
+        log("unknown integration, skipping", id);
+        continue;
+      }
+      const existing = new Set(
+        info.connections.filter((connection) => connection.type === "credential").map((connection) => connection.label),
+      );
+      const importable = info.methods.some((method) => method.type === "oauth" && method.id === METHOD_ID);
+      for (const entry of entries) {
+        const target = id + " (" + entry.label + ")";
+        if (existing.has(entry.label)) continue;
+        try {
+          if (entry.value.type === "api") {
+            const answer = keyAnswer(info.methods, entry.value.metadata);
+            await ctx.integration.connect.key({ integrationID: id, key: entry.value.key, label: entry.label, ...(answer ? { answer } : {}) });
+            log("imported API key", target);
+            continue;
+          }
+          if (!importable) {
+            log("no OAuth method available, skipping", target);
+            continue;
+          }
+          pending.set(id, entry.value);
+          const result = await importOAuth(ctx, id, entry.label);
+          if (result.status === "complete") log("imported OAuth credential", target);
+          else log("OAuth import " + result.status, target + (result.message ? " (" + result.message + ")" : ""));
+        } catch (error) {
+          log("import failed", target + " (" + String(error?.message ?? error) + ")");
+        }
+      }
+    }
+  },
+};
+`;
+
 // src/direct/provisioning.ts
 var DIRECT_OPENCODE_PORT = 4096;
 var DIRECT_OPENCODE_COMMAND = `opencode serve --hostname 0.0.0.0 --port ${DIRECT_OPENCODE_PORT}`;
@@ -1621,7 +1540,12 @@ function buildDirectProvisioningPlan(input) {
     if (credentials.has(providerName)) {
       throw new Error(`Duplicate model credential: ${providerName}`);
     }
-    credentials.set(providerName, directModelAuth(credential));
+    credentials.set(providerName, {
+      integration: providerName,
+      label: credential.label?.trim() || OPENCODE_CREDENTIAL_LABEL,
+      active: true,
+      value: directModelAuth(credential)
+    });
   }
   const configuredPlugins = Array.isArray(input.opencode?.config?.plugin) ? input.opencode.config.plugin.filter((plugin) => typeof plugin === "string") : [];
   const plugins = [...new Set([...configuredPlugins, ...input.opencode?.plugins ?? []])];
@@ -1648,10 +1572,7 @@ function buildDirectProvisioningPlan(input) {
   } : undefined);
   const files = [
     ...github?.files ?? [],
-    {
-      path: "~/.local/share/opencode/auth.json",
-      contentBase64: base64(JSON.stringify(Object.fromEntries(credentials)))
-    },
+    ...opencodeCredentialFiles([...credentials.values()]),
     {
       path: "~/.config/opencode/opencode.json",
       contentBase64: base64(JSON.stringify(config))
@@ -1782,8 +1703,8 @@ function basicAuthHeader(password) {
   return `Basic ${Buffer.from(`opencode:${password}`).toString("base64")}`;
 }
 async function waitForDirectRuntime(runtime, timeoutMs = 60000) {
-  const deadline2 = Date.now() + timeoutMs;
-  while (Date.now() < deadline2) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
     const controller = new AbortController;
     const timer = setTimeout(() => controller.abort(), 5000);
     const ready = await fetch(runtime.url, {
@@ -1892,7 +1813,7 @@ function createAsciiDirectProvider(config) {
         });
         await runCommand(handle.boxId, `mkdir -p ${shellQuote(directory)}`);
         for (const command of config.runtimeSetupCommands ?? [
-          "npm install -g opencode-ai --no-audit --fund=false"
+          "npm install -g @opencode/cli@2 --no-audit --fund=false"
         ]) {
           await runCommand(handle.boxId, command, undefined, 600);
         }
@@ -2335,8 +2256,8 @@ function createExeDevDirectProvider(config) {
     return token;
   }
   async function waitUntilRunning(vmName) {
-    const deadline2 = Date.now() + 60000;
-    while (Date.now() < deadline2) {
+    const deadline = Date.now() + 60000;
+    while (Date.now() < deadline) {
       const status = await execute(`ls ${vmName}`).then(resultStatus).catch(() => "pending");
       if (status === "running")
         return;
@@ -2410,9 +2331,9 @@ function createExeDevDirectProvider(config) {
         await startRuntime(handle);
         await execute(`share port ${vmName} ${handle.serve.port}`);
         await execute(`share set-private ${vmName}`);
-        const directRuntime2 = await runtime(handle, input.password);
-        await waitForDirectRuntime(directRuntime2);
-        return { externalId: serializeHandle2(handle), runtime: directRuntime2 };
+        const directRuntime = await runtime(handle, input.password);
+        await waitForDirectRuntime(directRuntime);
+        return { externalId: serializeHandle2(handle), runtime: directRuntime };
       } catch (error) {
         if (handle.owned) {
           await execute(`rm ${vmName}`).catch(() => {
@@ -2447,9 +2368,9 @@ function createExeDevDirectProvider(config) {
       await execute(`share set-private ${handle.vmName}`);
       if (!workspace.runtime.password)
         throw new Error("exe.dev runtime password is missing");
-      const directRuntime2 = await runtime(handle, workspace.runtime.password);
-      await waitForDirectRuntime(directRuntime2);
-      return directRuntime2;
+      const directRuntime = await runtime(handle, workspace.runtime.password);
+      await waitForDirectRuntime(directRuntime);
+      return directRuntime;
     },
     async terminate(workspace) {
       const handle = parseHandle3(workspace.externalId);
@@ -2625,8 +2546,8 @@ function createRailwayDirectProvider(config) {
   };
   const latestDeployment = async (serviceId) => (await serviceSnapshot(serviceId)).serviceInstance?.latestDeployment ?? undefined;
   const waitForDeployment = async (serviceId, previousDeploymentId) => {
-    const deadline2 = Date.now() + DEPLOYMENT_TIMEOUT_MS;
-    while (Date.now() < deadline2) {
+    const deadline = Date.now() + DEPLOYMENT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
       const deployment = await latestDeployment(serviceId);
       if (deployment && deployment.id !== previousDeploymentId) {
         if (deployment.status === "SUCCESS")
@@ -2640,8 +2561,8 @@ function createRailwayDirectProvider(config) {
     throw new Error("Timed out waiting for Railway deployment");
   };
   const waitForDeploymentRemoval = async (serviceId, deploymentId) => {
-    const deadline2 = Date.now() + DEPLOYMENT_TIMEOUT_MS;
-    while (Date.now() < deadline2) {
+    const deadline = Date.now() + DEPLOYMENT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
       const deployment = await latestDeployment(serviceId);
       if (!deployment || deployment.id !== deploymentId || deployment.status === "REMOVED")
         return;
@@ -2884,7 +2805,7 @@ function createVercelDirectProvider(config) {
       });
       try {
         await run(sandbox, `mkdir -p ${shellQuote(handle.directory)}`);
-        for (const command of config.runtimeSetupCommands ?? (config.image ? [] : ["npm install -g opencode-ai --no-audit --fund=false"])) {
+        for (const command of config.runtimeSetupCommands ?? (config.image ? [] : ["npm install -g @opencode/cli@2 --no-audit --fund=false"])) {
           await run(sandbox, command);
         }
         if (plan.repository) {
@@ -3030,21 +2951,7 @@ function resolveProvider(provider) {
       return createVercelDirectProvider(provider);
   }
 }
-function runtimeClient(workspace, fetchImpl) {
-  const authorization = workspace.runtime.password ? `Basic ${Buffer.from(`opencode:${workspace.runtime.password}`).toString("base64")}` : undefined;
-  return createOpencodeClient2({
-    fetch: fetchImpl,
-    baseUrl: workspace.runtime.url,
-    directory: workspace.runtime.directory,
-    headers: {
-      ...workspace.runtime.headers,
-      ...authorization ? { Authorization: authorization } : {}
-    }
-  });
-}
 function createAuthClient(workspace, fetchImpl) {
-  if (workspace.opencodeApi !== "v2")
-    throw new GittermError("BAD_REQUEST", "Runtime OAuth connection management requires OpenCode v2");
   const authorization = workspace.runtime.password ? `Basic ${Buffer.from(`opencode:${workspace.runtime.password}`).toString("base64")}` : undefined;
   return createOpencodeV2Client({
     fetch: fetchImpl,
@@ -3132,7 +3039,6 @@ function createDirectGittermClient(options) {
     url: workspace.runtime.url,
     directory: workspace.runtime.directory,
     password: workspace.runtime.password ?? null,
-    api: workspace.opencodeApi,
     headers: workspace.runtime.headers,
     fetch: options.fetch
   });
@@ -3157,23 +3063,14 @@ function createDirectGittermClient(options) {
     return authStatus(result.data.data);
   }
   async function startPty(workspace, command, title) {
-    const result = await http(workspace).json(workspace.opencodeApi === "v2" ? "/api/pty" : `/pty?directory=${encodeURIComponent(workspace.runtime.directory)}`, {
+    return http(workspace).json("/api/pty", {
       method: "POST",
       json: { command: "bash", args: ["-lc", command], cwd: workspace.runtime.directory, title }
     });
-    return result;
   }
   async function setupFile(workspace, name) {
     try {
-      if (workspace.opencodeApi === "v2") {
-        return (await (await http(workspace).send(`/api/fs/read/${SETUP_DIR}/${name}`)).text()).trim();
-      }
-      const result = await runtimeClient(workspace, options.fetch).file.read({
-        query: { directory: workspace.runtime.directory, path: `${SETUP_DIR}/${name}` }
-      });
-      if (result.error || !result.data || result.data.type !== "text")
-        return null;
-      return result.data.content.trim();
+      return (await (await http(workspace).send(`/api/fs/read/${SETUP_DIR}/${name}`)).text()).trim();
     } catch (error) {
       if (error instanceof RuntimeHttpError && error.status === 404)
         return null;
@@ -3225,20 +3122,10 @@ function createDirectGittermClient(options) {
         if (!providerName) {
           throw new Error("Model credential providerName is required");
         }
-        if (workspace.opencodeApi === "v2") {
-          if (credential.source !== "apiKey")
-            throw new GittermError("BAD_REQUEST", "Use connectOAuth() for v2 credential rotation, or inject an OAuth bundle when creating the workspace");
-          directModelAuth(credential);
-          await http(workspace).send(`/api/integration/${encodeURIComponent(providerName)}/connect/key`, { method: "POST", json: { key: credential.apiKey } });
-          return;
-        }
-        const result = await runtimeClient(workspace, options.fetch).auth.set({
-          path: { id: providerName },
-          query: { directory: workspace.runtime.directory },
-          body: directModelAuth(credential)
-        });
-        if (result.error)
-          throw new Error(errorMessage(result.error));
+        if (credential.source !== "apiKey")
+          throw new GittermError("BAD_REQUEST", "Use connectOAuth() for OAuth credential rotation, or inject an OAuth bundle when creating the workspace");
+        directModelAuth(credential);
+        await http(workspace).send(`/api/integration/${encodeURIComponent(providerName)}/connect/key`, { method: "POST", json: { key: credential.apiKey } });
       },
       async list(workspace) {
         assertWorkspace(workspace);
@@ -3307,8 +3194,8 @@ function createDirectGittermClient(options) {
       async wait(attempt, workspace, wait = {}) {
         assertAuthAttempt(attempt, workspace);
         const { timeoutMs, pollIntervalMs } = pollTiming(wait, Math.max(0, attempt.expiresAt - Date.now()));
-        const deadline2 = Date.now() + timeoutMs;
-        while (Date.now() <= deadline2) {
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() <= deadline) {
           const status = await getAuthStatus(attempt, workspace);
           if (status.status === "complete")
             return status;
@@ -3316,7 +3203,7 @@ function createDirectGittermClient(options) {
             throw new Error(status.message);
           if (status.status === "expired")
             throw new Error("OAuth attempt expired");
-          const remaining = deadline2 - Date.now();
+          const remaining = deadline - Date.now();
           if (remaining <= 0)
             break;
           await new Promise((resolve) => setTimeout(resolve, Math.min(pollIntervalMs, remaining)));
@@ -3334,8 +3221,6 @@ function createDirectGittermClient(options) {
     },
     workspaces: {
       async create(input = {}) {
-        if (input.opencode?.api && !["v1", "v2"].includes(input.opencode.api))
-          throw new GittermError("BAD_REQUEST", "opencode.api must be v1 or v2");
         const lifecycle = input.lifecycle ?? provider.capabilities.recommendedLifecycle;
         if (lifecycle === "persistent" && provider.capabilities.persistence === "unsupported") {
           throw new Error(`${provider.name} does not support persistent direct workspaces`);
@@ -3352,7 +3237,6 @@ function createDirectGittermClient(options) {
           status: "running",
           lifecycle,
           runtime: created.runtime,
-          opencodeApi: input.opencode?.api ?? "v1",
           setup: provisioning.setup.afterAgent.length ? "after_agent" : provisioning.setup.beforeAgent.length ? "before_agent_complete" : "not_requested",
           createdAt: new Date().toISOString()
         };
@@ -3407,7 +3291,7 @@ function createDirectGittermClient(options) {
       setupStatus: getSetupStatus,
       async waitForSetup(workspace, wait = {}) {
         const { timeoutMs, pollIntervalMs } = pollTiming(wait, 10 * 60000);
-        const deadline2 = Date.now() + timeoutMs;
+        const deadline = Date.now() + timeoutMs;
         while (true) {
           const status = await getSetupStatus(workspace);
           if (status.status === "not_requested" || status.status === "succeeded")
@@ -3416,7 +3300,7 @@ function createDirectGittermClient(options) {
             throw new Error(`Workspace setup failed${status.exitCode == null ? "" : ` with exit code ${status.exitCode}`}${status.log ? `
 ${status.log}` : ""}`);
           }
-          if (Date.now() >= deadline2) {
+          if (Date.now() >= deadline) {
             throw new Error(`Workspace setup timed out after ${timeoutMs}ms`);
           }
           await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
@@ -3435,7 +3319,7 @@ ${status.log}` : ""}`);
         if (input.model && !/^[^/]+\/.+$/.test(input.model))
           throw new GittermError("BAD_REQUEST", "Model must use provider/model format");
         if (input.waitForSetup) {
-          const deadline2 = Date.now() + (input.setupTimeoutMs ?? 10 * 60000);
+          const deadline = Date.now() + (input.setupTimeoutMs ?? 10 * 60000);
           while (true) {
             aborted(input.signal);
             const status = await getSetupStatus(input.workspace);
@@ -3443,7 +3327,7 @@ ${status.log}` : ""}`);
               break;
             if (status.status === "failed")
               throw new GittermError("BAD_REQUEST", `Workspace setup failed: ${status.log ?? ""}`);
-            if (Date.now() >= deadline2)
+            if (Date.now() >= deadline)
               throw new GittermError("TIMEOUT", "Workspace setup timed out");
             await new Promise((resolve) => setTimeout(resolve, 1000));
           }
@@ -3460,9 +3344,9 @@ ${status.log}` : ""}`);
         try {
           aborted(input.signal);
           if (!sessionId) {
-            const session2 = await runtime.createSession(input);
-            sessionId = session2.id;
-            title = session2.title;
+            const session = await runtime.createSession(input);
+            sessionId = session.id;
+            title = session.title;
           }
           aborted(input.signal);
           await runtime.prompt({