@goodandready/dsh-opencode-provider 0.5.21 → 0.5.23

package/lib/index.d.ts

@@ -36,6 +36,8 @@ interface Config {
   requestTimeoutMs?: number;
   /** Milliseconds a stream may stall; defaults to 300s. */
   streamIdleTimeoutMs?: number;
+  /** HTTP/HTTPS/SOCKS5 proxy for inference, catalog and usage requests. */
+  proxyUrl?: string;
   /** Visible-model allowlist; an empty list means "show everything". */
   visibleModels?: string[];
   /** Per-model visibility overrides; wins over `visibleModels`. */
@@ -50,6 +52,8 @@ interface Config {
   contextWindowOverrides?: Record<string, number>;
   /** Per-turn output cap; `0` omits `max_tokens`. */
   maxOutputTokens?: number;
+  /** Per-model output caps; `0` omits `max_tokens` for that model. */
+  maxOutputTokensOverrides?: Record<string, number>;
   /** Extra accounts for rotation (parsed now, used by the account pool later). */
   accounts?: AccountConfig[];
   /** Preferred account per model glob; other accounts remain fallbacks. */
@@ -76,6 +80,7 @@ interface ResolvedConfig {
   openCodeAuthEntry: string;
   requestTimeoutMs: number;
   streamIdleTimeoutMs: number;
+  proxyUrl: string;
   visibleModels: readonly string[];
   modelVisibility: Readonly<Record<string, boolean>>;
   filterModelsByPlan: boolean;
@@ -83,6 +88,7 @@ interface ResolvedConfig {
   contextWindow?: number;
   contextWindowOverrides: Readonly<Record<string, number>>;
   maxOutputTokens?: number;
+  maxOutputTokensOverrides: Readonly<Record<string, number>>;
   accounts: readonly AccountConfig[];
   modelAccountRules: readonly ModelAccountRule[];
   quotaFallbackModel: string;
@@ -148,7 +154,7 @@ interface RequestHeatmap {
   models: ModelRequestHeatmap[];
   accounts: AccountRequestHeatmap[];
 }
-type RoutingReason = 'rule' | 'sticky' | 'pinned' | 'default' | 'rotation' | 'quota-fallback';
+type RoutingReason = 'rule' | 'sticky' | 'pinned' | 'promoted' | 'default' | 'rotation' | 'quota-fallback';
 interface RoutingTraceEntry {
   readonly at: number;
   readonly provider: string;
@@ -186,6 +192,8 @@ declare class OpenCodeAdapter extends LlmAdapter {
   /** key + model → short soft rejection; other models stay usable. */
   private readonly modelCooldowns;
   private readonly sticky;
+  /** provider → fingerprint of the account that last served a request. */
+  private readonly lastGood;
   private readonly routing;
   private warnedTools;
   constructor(deps: OpenCodeAdapterDeps);
@@ -200,6 +208,8 @@ declare class OpenCodeAdapter extends LlmAdapter {
   stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
   private run;
   private rememberSticky;
+  /** Promote the account that actually served the request on the next call. */
+  private rememberGood;
   /** Await pending sticky persistence writes (tests and shutdown). */
   flushSticky(): Promise<void>;
   private loadSticky;

package/lib/index.js

@@ -5,11 +5,74 @@ import { homedir, networkInterfaces } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import z from "@deepseek-ai/schemastery";
+import { ProxyAgent, Socks5ProxyAgent } from "undici";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { isIP } from "node:net";
+// src/proxy.ts
+/**
+* Proxy addresses are deliberately credential-free: the settings API returns
+* the configured address to the browser, so embedding a password would leak it.
+*/
+function normalizeProxyUrl(raw) {
+	const value = raw?.trim() ?? "";
+	if (value === "") return "";
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("proxy address must be a valid URL");
+	}
+	if (![
+		"http:",
+		"https:",
+		"socks5:"
+	].includes(url.protocol)) throw new Error("proxy address must use http://, https:// or socks5://");
+	if (url.hostname === "" || url.port === "0" || url.pathname !== "" && url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("proxy address must contain a host and optional port, without a path, query or fragment");
+	if (url.username !== "" || url.password !== "") throw new Error("proxy credentials are not supported; use a local proxy without authentication");
+	return url.href;
+}
+/**
+* One fetch wrapper for inference, catalog and usage. Dispatchers are shared by
+* address so a live settings change reuses pools instead of leaking them.
+*/
+function createProxyFetch(address, baseFetch = fetch) {
+	const agents = /* @__PURE__ */ new Map();
+	let disposed = false;
+	const wrapped = (async (input, init) => {
+		if (disposed) throw new Error("proxy transport is disposed");
+		const proxy = normalizeProxyUrl(address());
+		if (proxy === "") return baseFetch(input, init);
+		let agent = agents.get(proxy);
+		if (agent === void 0) {
+			agent = new URL(proxy).protocol === "socks5:" ? new Socks5ProxyAgent(proxy) : new ProxyAgent(proxy);
+			agents.set(proxy, agent);
+			if (agents.size > 8) {
+				const oldest = agents.keys().next().value;
+				if (oldest !== void 0 && oldest !== proxy) {
+					const retired = agents.get(oldest);
+					agents.delete(oldest);
+					retired?.close().catch(() => retired?.destroy());
+				}
+			}
+		}
+		return baseFetch(input, {
+			...init,
+			dispatcher: agent
+		});
+	});
+	return {
+		fetch: wrapped,
+		async dispose() {
+			disposed = true;
+			const open = [...agents.values()];
+			agents.clear();
+			await Promise.all(open.map((agent) => agent.close().catch(() => agent.destroy())));
+		}
+	};
+}
 // src/config.ts
 const NS = "llm-opencode";
 const DEFAULT_API_KEY_ENV = "OPENCODE_API_KEY";
@@ -18,7 +81,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.21";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.23";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 32768;
@@ -36,6 +99,7 @@ const Config = z.object({
 	openCodeAuthEntry: markVolatile(z.string().default(DEFAULT_AUTH_ENTRY)),
 	requestTimeoutMs: markVolatile(z.number().min(1).max(2147483647).default(3e5)),
 	streamIdleTimeoutMs: markVolatile(z.number().min(1).max(2147483647).default(3e5)),
+	proxyUrl: markVolatile(z.string().default("")),
 	visibleModels: markVolatile(z.array(z.string()).default([])),
 	modelVisibility: markVolatile(z.dict(z.boolean()).default({})),
 	filterModelsByPlan: markVolatile(z.boolean().default(true)),
@@ -48,11 +112,12 @@ const Config = z.object({
 	contextWindow: markVolatile(z.number().min(1).max(1e7).step(1)),
 	contextWindowOverrides: markVolatile(z.dict(z.number().min(1).max(1e7).step(1)).default({})),
 	maxOutputTokens: markVolatile(z.number().min(0).max(1e7).step(1)),
+	maxOutputTokensOverrides: markVolatile(z.dict(z.number().min(0).max(1e7).step(1)).default({})),
 	accounts: markVolatile(z.array(z.object({
 		label: z.string(),
 		apiKeyEnv: z.string().role("credential-ref"),
 		apiKey: z.string().role("secret")
-	})).default([])),
+	})).max(20).default([])),
 	modelAccountRules: markVolatile(z.array(z.object({
 		pattern: z.string(),
 		account: z.string()
@@ -88,6 +153,12 @@ function numberRecord(value) {
 	for (const [key, entry] of Object.entries(value)) if (typeof entry === "number" && Number.isInteger(entry) && entry > 0) out[key] = entry;
 	return out;
 }
+function nonNegativeNumberRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (typeof entry === "number" && Number.isInteger(entry) && entry >= 0) out[key] = entry;
+	return out;
+}
 function booleanRecord(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
 	const out = {};
@@ -135,6 +206,7 @@ function resolveConfig(config) {
 		openCodeAuthEntry: typeof config.openCodeAuthEntry === "string" && config.openCodeAuthEntry !== "" ? config.openCodeAuthEntry : DEFAULT_AUTH_ENTRY,
 		requestTimeoutMs: positiveInt(config.requestTimeoutMs, 3e5),
 		streamIdleTimeoutMs: positiveInt(config.streamIdleTimeoutMs, 3e5),
+		proxyUrl: normalizeProxyUrl(config.proxyUrl),
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : [],
 		modelVisibility: booleanRecord(config.modelVisibility),
 		filterModelsByPlan: config.filterModelsByPlan !== false,
@@ -142,6 +214,7 @@ function resolveConfig(config) {
 		...typeof config.contextWindow === "number" && Number.isInteger(config.contextWindow) && config.contextWindow > 0 ? { contextWindow: config.contextWindow } : {},
 		contextWindowOverrides: numberRecord(config.contextWindowOverrides),
 		...typeof config.maxOutputTokens === "number" && Number.isInteger(config.maxOutputTokens) && config.maxOutputTokens >= 0 ? { maxOutputTokens: config.maxOutputTokens } : {},
+		maxOutputTokensOverrides: nonNegativeNumberRecord(config.maxOutputTokensOverrides),
 		accounts: Array.isArray(config.accounts) ? config.accounts : [],
 		modelAccountRules: modelAccountRuleList(config.modelAccountRules),
 		quotaFallbackModel: typeof config.quotaFallbackModel === "string" ? config.quotaFallbackModel.trim() : "",
@@ -1010,9 +1083,10 @@ function effectiveModel(id, config) {
 /** Effective per-request output default; `0` means "omit the field". */
 function effectiveMaxTokens(meta, config) {
 	const ceiling = Math.min(meta.maxTokens, DEFAULT_GENERATE_MAX_TOKENS);
-	if (config.maxOutputTokens === void 0) return ceiling;
-	if (config.maxOutputTokens === 0) return void 0;
-	return Math.min(ceiling, config.maxOutputTokens);
+	const configured = config.maxOutputTokensOverrides[meta.id] ?? config.maxOutputTokens;
+	if (configured === void 0) return ceiling;
+	if (configured === 0) return void 0;
+	return Math.min(ceiling, configured);
 }
 function modelVisible(id, config) {
 	const override = config.modelVisibility[id];
@@ -1866,6 +1940,17 @@ async function* sseEvents(body, idleTimeoutMs, signal) {
 		reader.releaseLock();
 	}
 }
+// src/transports/tool-call.ts
+/** Wire fields are untrusted JSON: never forward null/numeric ids or names. */
+function toolCallId(value, fallback) {
+	return typeof value === "string" && value !== "" ? value : fallback;
+}
+function toolCallName(value) {
+	return typeof value === "string" ? value : "";
+}
+function toolCallArguments(value) {
+	return typeof value === "string" ? value : "";
+}
 // src/transports/anthropic.ts
 const EFFORT_LEVELS$1 = /* @__PURE__ */ new Set([
 	"low",
@@ -2076,8 +2161,8 @@ async function* parseAnthropicStream(response, idleTimeoutMs, signal) {
 					dshIndex,
 					kind: "tool-call",
 					text: "",
-					id: source.id ?? `call_${dshIndex}`,
-					name: source.name ?? "",
+					id: toolCallId(source.id, `call_${dshIndex}`),
+					name: toolCallName(source.name),
 					args: ""
 				};
 				sawContent = true;
@@ -2424,7 +2509,7 @@ async function* parseGoogleStream(response, idleTimeoutMs, signal) {
 				if (part.functionCall !== void 0) {
 					const dshIndex = nextIndex++;
 					const id = typeof part.functionCall.id === "string" && part.functionCall.id !== "" ? part.functionCall.id : `call_${toolCounter++}`;
-					const name = part.functionCall.name ?? "";
+					const name = toolCallName(part.functionCall.name);
 					const args = JSON.stringify(part.functionCall.args ?? {});
 					hasTools = true;
 					sawContent = true;
@@ -2629,15 +2714,17 @@ async function* parseChatStream(response, idleTimeoutMs, signal) {
 				if (entry === void 0) {
 					entry = {
 						dshIndex: nextIndex++,
-						id: toolCall.id ?? `call_${key}`,
+						id: toolCallId(toolCall.id, `call_${key}`),
 						name: "",
 						args: "",
 						started: false
 					};
 					toolCalls.set(key, entry);
 				}
-				if (toolCall.id !== void 0 && toolCall.id !== "") entry.id = toolCall.id;
-				if (toolCall.function?.name !== void 0 && toolCall.function.name !== "") entry.name = toolCall.function.name;
+				const id = toolCallId(toolCall.id, "");
+				if (id !== "") entry.id = id;
+				const name = toolCallName(toolCall.function?.name);
+				if (name !== "") entry.name = name;
 				if (!entry.started) {
 					entry.started = true;
 					yield {
@@ -2646,7 +2733,7 @@ async function* parseChatStream(response, idleTimeoutMs, signal) {
 						blockType: "tool-call"
 					};
 				}
-				const argumentsDelta = toolCall.function?.arguments ?? "";
+				const argumentsDelta = toolCallArguments(toolCall.function?.arguments);
 				if (argumentsDelta !== "") entry.args += argumentsDelta;
 				sawContent = true;
 				yield {
@@ -2756,9 +2843,9 @@ async function* parseCompletion(chunk) {
 		sawContent = true;
 	}
 	for (const call of message?.tool_calls ?? []) {
-		const id = ToolCallId(call.id ?? `call_${index}`);
-		const name = call.function?.name ?? "";
-		const args = call.function?.arguments ?? "{}";
+		const id = ToolCallId(toolCallId(call.id, `call_${index}`));
+		const name = toolCallName(call.function?.name);
+		const args = toolCallArguments(call.function?.arguments) || "{}";
 		yield {
 			type: "block-start",
 			index,
@@ -2973,12 +3060,12 @@ async function* parseResponsesStream(response, idleTimeoutMs, signal) {
 					};
 				}
 			} else if (item?.type === "function_call") {
-				const key = item.id ?? item.call_id ?? `tool_${event.output_index ?? tools.size}`;
+				const key = toolCallId(item.id, toolCallId(item.call_id, `tool_${event.output_index ?? tools.size}`));
 				const live = {
 					dshIndex: nextIndex++,
-					id: item.call_id ?? item.id ?? `call_${tools.size}`,
-					name: item.name ?? "",
-					args: item.arguments ?? ""
+					id: toolCallId(item.call_id, toolCallId(item.id, `call_${tools.size}`)),
+					name: toolCallName(item.name),
+					args: toolCallArguments(item.arguments)
 				};
 				tools.set(key, live);
 				hasTools = true;
@@ -3053,11 +3140,13 @@ async function* parseResponsesStream(response, idleTimeoutMs, signal) {
 		if (type === "response.output_item.done") {
 			const item = event.item;
 			if (item?.type === "function_call") {
-				const key = item.id ?? item.call_id;
-				const live = key === void 0 ? void 0 : tools.get(key);
+				const id = toolCallId(item.id, toolCallId(item.call_id, ""));
+				const live = id === "" ? void 0 : tools.get(id);
 				if (live !== void 0) {
-					if (item.name !== void 0) live.name = item.name;
-					if (item.arguments !== void 0) live.args = item.arguments;
+					const name = toolCallName(item.name);
+					if (name !== "") live.name = name;
+					const args = toolCallArguments(item.arguments);
+					if (args !== "") live.args = args;
 				}
 			}
 			continue;
@@ -3127,6 +3216,8 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	/** key + model → short soft rejection; other models stay usable. */
 	modelCooldowns = /* @__PURE__ */ new Map();
 	sticky = /* @__PURE__ */ new Map();
+	/** provider → fingerprint of the account that last served a request. */
+	lastGood = /* @__PURE__ */ new Map();
 	routing = [];
 	warnedTools = false;
 	constructor(deps) {
@@ -3227,6 +3318,12 @@ var OpenCodeAdapter = class extends LlmAdapter {
 					reason = "sticky";
 				}
 			}
+		} else if (rule === void 0 && this.lastGood.has(options.provider)) {
+			const preferred = rawKeys.find((entry) => this.keyId(entry.key) === this.lastGood.get(options.provider));
+			if (preferred !== void 0 && rawKeys[0] !== preferred) {
+				keys = [preferred, ...rawKeys.filter((entry) => entry !== preferred)];
+				reason = "promoted";
+			}
 		}
 		const eligible = fallback ? keys : keys.filter((entry) => !this.coolingDown(entry.key) && !this.modelCoolingDown(entry.key, options.model));
 		const ordered = eligible.length > 0 ? eligible : keys;
@@ -3298,6 +3395,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 				}
 				logAttempt(true);
 				this.rememberSticky(sessionId, options, entry);
+				this.rememberGood(options.provider, entry);
 				this.pushTrace({
 					at: Date.now(),
 					provider: options.provider,
@@ -3377,13 +3475,22 @@ var OpenCodeAdapter = class extends LlmAdapter {
 		});
 		this.persistSticky();
 	}
+	/** Promote the account that actually served the request on the next call. */
+	rememberGood(provider, entry) {
+		this.lastGood.set(provider, this.keyId(entry.key));
+		this.persistSticky();
+	}
 	/** Await pending sticky persistence writes (tests and shutdown). */
 	async flushSticky() {
 		await this.stickyWrites;
 	}
 	loadSticky() {
 		try {
-			const entries = JSON.parse(readFileSync(this.stickyPath, "utf8")).sticky;
+			const parsed = JSON.parse(readFileSync(this.stickyPath, "utf8"));
+			if (typeof parsed.lastGood === "object" && parsed.lastGood !== null && !Array.isArray(parsed.lastGood)) {
+				for (const [provider, fingerprint] of Object.entries(parsed.lastGood)) if (typeof fingerprint === "string" && fingerprint !== "") this.lastGood.set(provider, fingerprint);
+			}
+			const entries = parsed.sticky;
 			if (typeof entries !== "object" || entries === null || Array.isArray(entries)) return;
 			for (const [sessionId, value] of Object.entries(entries)) {
 				if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
@@ -3419,7 +3526,10 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	}
 	persistSticky() {
 		this.pruneSticky();
-		const payload = JSON.stringify({ sticky: Object.fromEntries(this.sticky) });
+		const payload = JSON.stringify({
+			sticky: Object.fromEntries(this.sticky),
+			lastGood: Object.fromEntries(this.lastGood)
+		});
 		this.stickyWrites = this.stickyWrites.then(async () => {
 			await mkdir(dirname(this.stickyPath), { recursive: true });
 			await writeFile(this.stickyPath, payload, "utf8");
@@ -3588,7 +3698,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 			delayMs = Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : 6e4;
 			reason = "rate-limit";
 		} else if (status === 401 || status === 403) {
-			delayMs = 864e5;
+			delayMs = 3e5;
 			reason = "invalid-credential";
 		}
 		this.cooldowns.set(this.keyId(key), {
@@ -4562,6 +4672,7 @@ function publicConfig(config) {
 		openCodeAuthEntry: config.openCodeAuthEntry,
 		requestTimeoutMs: config.requestTimeoutMs,
 		streamIdleTimeoutMs: config.streamIdleTimeoutMs,
+		proxyUrl: config.proxyUrl,
 		visibleModels: config.visibleModels,
 		modelVisibility: config.modelVisibility,
 		filterModelsByPlan: config.filterModelsByPlan,
@@ -4569,6 +4680,7 @@ function publicConfig(config) {
 		contextWindow: config.contextWindow ?? null,
 		contextWindowOverrides: config.contextWindowOverrides,
 		maxOutputTokens: config.maxOutputTokens ?? null,
+		maxOutputTokensOverrides: config.maxOutputTokensOverrides,
 		accounts: config.accounts.map((account) => ({
 			label: typeof account.label === "string" ? account.label : "",
 			apiKeyEnv: typeof account.apiKeyEnv === "string" ? account.apiKeyEnv : ""
@@ -4600,6 +4712,7 @@ function cleanAccounts(value) {
 		const label = typeof record.label === "string" ? record.label.trim() : "";
 		const apiKeyEnv = typeof record.apiKeyEnv === "string" ? record.apiKeyEnv.trim() : "";
 		if (label === "" && apiKeyEnv === "") continue;
+		if (out.length >= 20) break;
 		out.push({
 			label: label === "" ? `account-${out.length + 2}` : label,
 			apiKeyEnv
@@ -4638,6 +4751,12 @@ function cleanNumberRecord(value) {
 	for (const [key, entry] of Object.entries(value)) if (typeof entry === "number" && Number.isInteger(entry) && entry > 0) out[key] = entry;
 	return out;
 }
+function cleanNonNegativeNumberRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (typeof entry === "number" && Number.isInteger(entry) && entry >= 0) out[key] = entry;
+	return out;
+}
 function cleanTransports(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
 	const out = {};
@@ -4747,6 +4866,7 @@ function configOps(patch) {
 	if ("openCodeAuthEntry" in patch) set("openCodeAuthEntry", patch.openCodeAuthEntry);
 	if ("requestTimeoutMs" in patch) set("requestTimeoutMs", patch.requestTimeoutMs);
 	if ("streamIdleTimeoutMs" in patch) set("streamIdleTimeoutMs", patch.streamIdleTimeoutMs);
+	if ("proxyUrl" in patch) set("proxyUrl", normalizeProxyUrl(typeof patch.proxyUrl === "string" ? patch.proxyUrl : ""));
 	if ("visibleModels" in patch) set("visibleModels", cleanStringArray(patch.visibleModels));
 	if ("modelVisibility" in patch) set("modelVisibility", cleanBooleanRecord(patch.modelVisibility));
 	if ("filterModelsByPlan" in patch) set("filterModelsByPlan", patch.filterModelsByPlan === true);
@@ -4754,6 +4874,7 @@ function configOps(patch) {
 	if ("contextWindow" in patch) set("contextWindow", patch.contextWindow);
 	if ("contextWindowOverrides" in patch) set("contextWindowOverrides", cleanNumberRecord(patch.contextWindowOverrides));
 	if ("maxOutputTokens" in patch) set("maxOutputTokens", patch.maxOutputTokens);
+	if ("maxOutputTokensOverrides" in patch) set("maxOutputTokensOverrides", cleanNonNegativeNumberRecord(patch.maxOutputTokensOverrides));
 	if ("accounts" in patch) set("accounts", cleanAccounts(patch.accounts));
 	if ("modelAccountRules" in patch) set("modelAccountRules", cleanModelAccountRules(patch.modelAccountRules));
 	if ("quotaFallbackModel" in patch) set("quotaFallbackModel", patch.quotaFallbackModel);
@@ -5244,6 +5365,15 @@ function buildOpenCodeTuiSection(deps) {
 				placeholder: "https://opencode.ai/zen/go/v1/usage",
 				parse: setOrClear
 			},
+			{
+				path: ["proxyUrl"],
+				group: "connection",
+				kind: "text",
+				label: "Proxy URL",
+				hint: "HTTP, HTTPS or SOCKS5; empty disables it.",
+				format: () => deps.proxyUrl(),
+				parse: setOrClear
+			},
 			{
 				path: ["visibleModels"],
 				group: "models",
@@ -5526,14 +5656,19 @@ const inject = ["llm"];
 function apply(ctx, config) {
 	const current = () => resolveConfig(unwrapVolatileConfig(config));
 	const keys = createKeyPool(ctx, current);
-	const usage = createUsageReader(current, (provider) => keys.resolve(provider));
+	const proxy = createProxyFetch(() => current().proxyUrl);
+	const usage = createUsageReader(current, (provider) => keys.resolve(provider), proxy.fetch);
 	const adapter = new OpenCodeAdapter({
 		config: current,
 		resolveKey: (provider) => keys.resolve(provider),
 		resolveKeys: (provider) => keys.resolveAll(provider),
 		resolveAttachments: () => ctx.get("attachments"),
+		fetchImpl: proxy.fetch,
 		warn: (message) => ctx.logger("llm-opencode").warn(message)
 	});
+	ctx.effect(() => () => {
+		proxy.dispose();
+	});
 	ctx.llm.registerConfigurableProviders([{
 		provider: CONSOLE_PROVIDER,
 		displayName: "OpenCode (plugin)",
@@ -5572,6 +5707,7 @@ function apply(ctx, config) {
 				label: typeof account.label === "string" && account.label.trim() !== "" ? account.label.trim() : `account-${index + 2}`
 			}))],
 			visibleModels: () => current().visibleModels,
+			proxyUrl: () => current().proxyUrl,
 			activeAccount: () => current().activeAccount,
 			filterModelsByPlan: () => current().filterModelsByPlan,
 			quotaFallbackModel: () => current().quotaFallbackModel,