@goodandready/dsh-opencode-provider 0.5.30 → 0.5.32

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.32 — release 9: proxy auth and route switches
+
+- **#71 — authenticated proxy**: `proxyUsername` plus a password stored in the credential service enable Basic auth for HTTP/HTTPS and SOCKS5 proxies. The authenticated URL exists only in memory; `/state` returns the credential-free address and a `configured` flag, never the password.
+- **#80 — route switches**: `goEnabled` and `consoleEnabled` are exposed in Settings. Disabling a route removes it from the provider directory, the picker and request handling at runtime; at least one route stays enabled.
+- 144 tests.
+
+## 0.5.31 — release 8: command localization
+
+- **#48 — `/opencode` localization**: new `commandLocale` setting (`en` default, `zh`) localizes status, usage, accounts, models, rules and errors. Exposed in Settings → OpenCode.
+- **#72 — thinking budgets**: DSH exposes selectable `reasoningEffort` ids only; there is no numeric per-model token-budget seam, and the Anthropic transport uses `output_config.effort`. No synthetic mapping is added; limitation recorded in DESIGN and the issue is closed with evidence.
+- 140 tests.
+
 ## 0.5.30 — release 7: pricing accuracy
 
 - **#74 — peak/off-peak multipliers**: analytics now reads live gateway `cost.multipliers` and evaluates UTC weekday/hour/date conditions at the session timestamp.

package/README.md

@@ -99,7 +99,8 @@ graph LR
 - **Request heatmap** in the quota panel: a Monday-first weekday × hour grid in local time, plus a 24-hour aggregate strip underneath. Selectors switch between all requests, any single model, and any single account. A per-account table shows requests, errors and average latency/TTFT. The adapter appends `{at, provider, model, purpose?, account, reason, ok, latencyMs, ttftMs?, error?}` to `~/.dsh/storages/dsh-opencode/requests.jsonl`; no prompt, response or key is stored. Auxiliary `session-title`/`compaction` calls are excluded from the heatmap and exact duplicate records collapse. The log compacts at 2 MB to the newest 5000 lines. Collection starts with this build — the projection cache only has `lastPromptAt`, not per-request timestamps.
 - **Stable `x-opencode-session`** derived from the durable session id, so retries and every turn of a conversation reuse the same routing key.
 - **Live catalog** from `/v1/models` with a generated `models.dev` fallback.
-- **Proxy support**: one live `proxyUrl` setting routes inference, model discovery and usage checks through HTTP, HTTPS or SOCKS5; the dispatcher is reused until the address changes.
+- **Proxy support**: one live `proxyUrl` setting routes inference, model discovery and usage checks through HTTP, HTTPS or SOCKS5; the dispatcher is reused until the address changes. `proxyUsername` and a password stored in the credential service add Basic auth for both HTTP and SOCKS5. Passwords are never returned to the browser.
+- **Route switches**: enable or disable the Console/Zen and Go/Go Plus routes independently; a disabled route is removed from the picker and refuses requests. At least one route stays enabled.
 - **Per-model subscription limits** from the OpenCode Go pricing table: monthly dollar allowance plus estimated requests for the 5-hour, weekly and monthly windows, for both Go and Go Plus. Shown in the model picker and the settings page; estimates only — the gateway remains the authority.
 - **`/opencode` command** for status, usage, accounts, models, rules, and `test [model]`.
 - **TUI settings section** for the terminal profile (`/settings → OpenCode`) with the key, endpoints, proxy, allowlist, active account, fallback model, sticky routing and timeouts.
@@ -132,12 +133,12 @@ npm pack
 Install the **packed tarball** into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.30.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.32.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.30.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.32.tgz
 
 # Or install the published package:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.30
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.32
 ```
 
 Restart dsh (or DSH Desktop), then pick **OpenCode (plugin)** or **OpenCode Go (plugin)** in the model picker.
@@ -278,6 +279,8 @@ Captured from the exact 0.5.0 release candidate in DSH Desktop in the dark theme
 /opencode test [model]      # minimal real request
 ```
 
+Set **Settings → OpenCode → `/opencode` command language** to `中文` to localize this output. The default is English.
+
 ## Verified API facts
 
 - `GET /inference/go/v1/models` is public and returns the live Go roster.

package/README.ru.md

@@ -108,7 +108,8 @@ graph LR
 - **Почасовой Heatmap запросов**: сетка «день недели × час» в локальном времени плюс суточная полоса агрегации. Фильтры переключают отображение между всеми запросами, конкретной моделью и аккаунтом. Лог `~/.dsh/storages/dsh-opencode/requests.jsonl` хранит только метаданные `{at, provider, model, purpose, account, reason, ok, latencyMs, ttftMs, error}` (промпты и ответы не сохраняются).
 - **Стабильный заголовок `x-opencode-session`**: вычисляется из устойчивого ID сессии DSH, обеспечивая одинаковый ключ маршрутизации при повторах и диалоге.
 - **Живой каталог моделей**: автоматическое чтение `/v1/models` с резервным fallback из `models.dev`.
-- **Proxy**: live-параметр `proxyUrl` направляет инференс, каталог и проверку квот через HTTP, HTTPS или SOCKS5; dispatcher переиспользуется до смены адреса.
+- **Proxy**: live-параметр `proxyUrl` направляет инференс, каталог и проверку квот через HTTP, HTTPS или SOCKS5; dispatcher переиспользуется до смены адреса. `proxyUsername` и пароль из credential-сервиса включают Basic auth для HTTP и SOCKS5. Пароль не возвращается в браузер.
+- **Переключатели маршрутов**: Console/Zen и Go/Go Plus включаются и отключаются независимо; отключённый маршрут исчезает из выбора и отклоняет запросы. Хотя бы один маршрут остаётся включённым.
 - **Оценки лимитов подписки OpenCode Go**: долларовый лимит и расчетное число запросов для окон 5h, недели и месяца для планов Go и Go Plus.
 - **Команда `/opencode`**: быстрый просмотр статуса, квот, аккаунтов, моделей, правил и запуск теста связи `test [model]`.
 - **Настройки в терминале (TUI)**: раздел `/settings → OpenCode` для профиля terminal с ключом, эндпоинтами, allowlist, активным аккаунтом, fallback-моделью, sticky-маршрутизацией и таймаутами.
@@ -131,12 +132,12 @@ npm pack
 Установка из **упакованного tarball**:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.30.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.32.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.30.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.32.tgz
 
 # Либо установка опубликованного пакета из npm:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.30
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.32
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **OpenCode (plugin)** или **OpenCode Go (plugin)** в списке моделей.
@@ -208,6 +209,8 @@ modelAccountRules:
 /opencode test [model]      # проверочный запрос к модели
 ```
 
+Язык вывода задаётся в **Настройки → OpenCode → `/opencode` command language** (`中文` включает китайский). По умолчанию английский.
+
 ## Безопасность и надежность
 
 - Запросы на изменение настроек и ключей разрешены только с loopback (`127.0.0.1` / `::1`) с обязательной проверкой same-origin для защиты от DNS-rebinding атак.

package/README.zh.md

@@ -106,7 +106,8 @@ graph LR
 - **本地时间请求热力图**：星期×小时交互式热力图，排除系统心跳与重复记录，可按模型或账户过滤，仅保存 `{at, provider, model, purpose, account, reason, ok, latencyMs, ttftMs, error}` 元数据，不保存任何提示词与回复。
 - **稳定的 `x-opencode-session` 标头**：根据 DSH 会话 ID 派生，确保重试与连续对话复用相同的网关路由键。
 - **实时模型目录**：自动从 `/v1/models` 同步，并以 `models.dev` 生成文件作为回退。
-- **代理**：一个实时 `proxyUrl` 设置即可让推理、模型目录和额度检查走 HTTP、HTTPS 或 SOCKS5；地址变化前复用 dispatcher。
+- **代理**：一个实时 `proxyUrl` 设置即可让推理、模型目录和额度检查走 HTTP、HTTPS 或 SOCKS5；地址变化前复用 dispatcher。`proxyUsername` 与凭据服务中的密码可为 HTTP 和 SOCKS5 启用 Basic 认证，密码不会返回浏览器。
+- **路由开关**：可独立启用或禁用 Console/Zen 与 Go/Go Plus 路由；禁用的路由会从选择器移除并拒绝请求，至少保留一个路由。
 - **Go 订阅额度估算**：每月美元额度以及 5 小时、每周和每月的估算请求次数。
 - **`/opencode` 斜杠指令**：快速查询状态、配额、账户、模型及执行联通性测试。
 - **TUI 设置**：`/settings → OpenCode` 支持密钥、端点、allowlist、活动账户、回退模型、粘性路由和超时。
@@ -126,12 +127,12 @@ npm pack
 通过**打包文件 (.tgz)**安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.30.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.32.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.30.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.32.tgz
 
 # 或从 npm 安装已发布版本：
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.30
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.32
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型选择器中选择 **OpenCode (plugin)** 或 **OpenCode Go (plugin)** 即可。
@@ -183,6 +184,8 @@ modelAccountRules:
 /opencode test [model]      # 发送最小化测试请求
 ```
 
+在 **设置 → OpenCode → `/opencode` 命令语言** 中选择 `中文` 即可切换输出语言，默认英语。
+
 ## 安全规范
 
 - 写入与配置路由均要求 Loopback（`127.0.0.1` / `::1`）与同源检查，防御 DNS 重新绑定。

package/lib/client.js

@@ -187,8 +187,21 @@ window.__ModuleLoader__.load({
 				requestImagePixelBudget: "Image pixel budget",
 				requestImageMaxBytes: "Per-image max bytes",
 				catalogRefreshMinutes: "Catalog refresh (minutes)",
+				commandLocale: "/opencode command language",
+				commandLocaleHint: "Language for /opencode status, accounts, usage, models and rules.",
 				proxyUrl: "Proxy URL",
-				proxyUrlHint: "HTTP, HTTPS or SOCKS5 proxy for inference, catalog and usage. Empty disables it. Credentials are not supported.",
+				proxyUrlHint: "HTTP, HTTPS or SOCKS5 proxy for inference, catalog and usage. Empty disables it. Do not put credentials in this URL.",
+				proxyUsername: "Proxy username",
+				proxyPassword: "Proxy password",
+				proxyPasswordSet: "configured — enter a new one to replace it",
+				proxyPasswordUnset: "not configured",
+				proxyPasswordHint: "Stored in the credential service, never returned to the browser.",
+				saveProxyPassword: "Save proxy password",
+				clearProxyPassword: "Clear proxy password",
+				enabledRoutes: "Enabled routes",
+				routeConsole: "OpenCode Console / Zen",
+				routeGo: "OpenCode Go / Go Plus",
+				enabledRoutesHint: "Disabled routes are removed from the picker; at least one route stays enabled.",
 				maxOutputTokens: "Output limit (empty = model default, 0 = omit)",
 				contextOverrideShort: "Context",
 				maxOutputOverrideShort: "Max output",
@@ -421,8 +434,21 @@ window.__ModuleLoader__.load({
 				requestImagePixelBudget: "图片像素预算",
 				requestImageMaxBytes: "单图最大字节数",
 				catalogRefreshMinutes: "目录刷新间隔（分钟）",
+				commandLocale: "/opencode 命令语言",
+				commandLocaleHint: "用于 /opencode 的状态、账户、用量、模型和规则输出。",
 				proxyUrl: "代理地址",
-				proxyUrlHint: "用于推理、目录和用量的 HTTP、HTTPS 或 SOCKS5 代理。留空则禁用。不支持代理认证。",
+				proxyUrlHint: "用于推理、目录和用量的 HTTP、HTTPS 或 SOCKS5 代理。留空则禁用。请勿在此 URL 中填写凭据。",
+				proxyUsername: "代理用户名",
+				proxyPassword: "代理密码",
+				proxyPasswordSet: "已配置 — 输入新密码可替换",
+				proxyPasswordUnset: "未配置",
+				proxyPasswordHint: "保存在凭据服务中，不会返回给浏览器。",
+				saveProxyPassword: "保存代理密码",
+				clearProxyPassword: "清除代理密码",
+				enabledRoutes: "启用的路由",
+				routeConsole: "OpenCode Console / Zen",
+				routeGo: "OpenCode Go / Go Plus",
+				enabledRoutesHint: "禁用的路由会从选择器中移除；至少保留一个启用的路由。",
 				maxOutputTokens: "输出上限（空 = 模型默认，0 = 省略）",
 				contextOverrideShort: "上下文",
 				maxOutputOverrideShort: "最大输出",
@@ -552,6 +578,18 @@ window.__ModuleLoader__.load({
 				body: JSON.stringify({ ref })
 			});
 		}
+		function saveProxyPassword(password) {
+			return call("/dsh-opencode/proxy-password", {
+				method: "POST",
+				body: JSON.stringify({ password })
+			});
+		}
+		function clearProxyPassword() {
+			return call("/dsh-opencode/proxy-password/clear", {
+				method: "POST",
+				body: "{}"
+			});
+		}
 		function importAuth(entry, ref) {
 			return call("/dsh-opencode/auth-import", {
 				method: "POST",
@@ -1714,7 +1752,11 @@ window.__ModuleLoader__.load({
 				requestImagePixelBudget: String(state.config.requestImagePixelBudget),
 				requestImageMaxBytes: String(state.config.requestImageMaxBytes),
 				proxyUrl: state.config.proxyUrl,
+				proxyUsername: state.config.proxyUsername,
+				goEnabled: state.config.goEnabled,
+				consoleEnabled: state.config.consoleEnabled,
 				catalogRefreshMinutes: String(state.config.catalogRefreshMinutes),
+				commandLocale: state.config.commandLocale,
 				maxOutputTokens: state.config.maxOutputTokens === null ? "" : String(state.config.maxOutputTokens),
 				contextWindow: state.config.contextWindow === null ? "" : String(state.config.contextWindow),
 				contextWindowOverrides: Object.fromEntries(Object.entries(state.config.contextWindowOverrides).map(([id, value]) => [id, String(value)])),
@@ -1767,7 +1809,11 @@ window.__ModuleLoader__.load({
 				requestImagePixelBudget: numberOrNull(draft.requestImagePixelBudget) ?? 2458624,
 				requestImageMaxBytes: numberOrNull(draft.requestImageMaxBytes) ?? 1048576,
 				proxyUrl: draft.proxyUrl.trim(),
+				proxyUsername: draft.proxyUsername.trim(),
+				goEnabled: draft.goEnabled,
+				consoleEnabled: draft.consoleEnabled,
 				catalogRefreshMinutes: numberOrNull(draft.catalogRefreshMinutes) ?? 10,
+				commandLocale: draft.commandLocale,
 				maxOutputTokens: numberOrNull(draft.maxOutputTokens),
 				contextWindow: numberOrNull(draft.contextWindow),
 				contextWindowOverrides: numberRecordOrNull(draft.contextWindowOverrides),
@@ -2008,6 +2054,8 @@ window.__ModuleLoader__.load({
 			const [error, setError] = (0, react.useState)(null);
 			const [notice, setNotice] = (0, react.useState)(null);
 			const [keyDraft, setKeyDraft] = (0, react.useState)("");
+			const [proxyPassword, setProxyPassword] = (0, react.useState)("");
+			const [proxyBusy, setProxyBusy] = (0, react.useState)(false);
 			const [keyDrafts, setKeyDrafts] = (0, react.useState)({});
 			const [search, setSearch] = (0, react.useState)("");
 			const [testModel, setTestModel] = (0, react.useState)("deepseek-v4.1-flash");
@@ -2071,6 +2119,34 @@ window.__ModuleLoader__.load({
 					setSaving(false);
 				}
 			};
+			const storeProxyPassword = async () => {
+				if (proxyPassword === "") return;
+				setProxyBusy(true);
+				setError(null);
+				try {
+					await saveProxyPassword(proxyPassword);
+					setProxyPassword("");
+					setNotice(t("saved"));
+					await load();
+				} catch (caught) {
+					setError(caught instanceof Error ? caught.message : t("failed"));
+				} finally {
+					setProxyBusy(false);
+				}
+			};
+			const removeProxyPassword = async () => {
+				setProxyBusy(true);
+				setError(null);
+				try {
+					await clearProxyPassword();
+					setNotice(t("saved"));
+					await load();
+				} catch (caught) {
+					setError(caught instanceof Error ? caught.message : t("failed"));
+				} finally {
+					setProxyBusy(false);
+				}
+			};
 			const checkKey = async (label) => {
 				setChecking(label);
 				setError(null);
@@ -3208,12 +3284,115 @@ window.__ModuleLoader__.load({
 									value: draft.catalogRefreshMinutes,
 									onChange: (value) => update({ catalogRefreshMinutes: value })
 								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									className: "oc-field",
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-label",
+											children: t("commandLocale")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+											className: "oc-select",
+											value: draft.commandLocale,
+											onChange: (event) => update({ commandLocale: event.target.value }),
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+												value: "en",
+												children: "English"
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+												value: "zh",
+												children: "中文"
+											})]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-hint",
+											children: t("commandLocaleHint")
+										})
+									]
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
 									label: t("proxyUrl"),
 									hint: t("proxyUrlHint"),
 									value: draft.proxyUrl,
 									onChange: (value) => update({ proxyUrl: value })
 								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
+									label: t("proxyUsername"),
+									value: draft.proxyUsername,
+									onChange: (value) => update({ proxyUsername: value })
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									className: "oc-field",
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-label",
+											children: t("proxyPassword")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											className: "oc-input",
+											type: "password",
+											value: proxyPassword,
+											placeholder: state.proxy.configured ? t("proxyPasswordSet") : t("proxyPasswordUnset"),
+											onChange: (event) => setProxyPassword(event.target.value)
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-hint",
+											children: t("proxyPasswordHint")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: "oc-actions",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "oc-button",
+												disabled: proxyBusy || proxyPassword === "",
+												onClick: () => {
+													storeProxyPassword();
+												},
+												children: t("saveProxyPassword")
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "oc-button",
+												disabled: proxyBusy || !state.proxy.configured,
+												onClick: () => {
+													removeProxyPassword();
+												},
+												children: t("clearProxyPassword")
+											})]
+										})
+									]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									className: "oc-field",
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-label",
+											children: t("enabledRoutes")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: "oc-actions",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+													type: "checkbox",
+													checked: draft.consoleEnabled,
+													onChange: (event) => update({ consoleEnabled: event.target.checked })
+												}),
+												" ",
+												t("routeConsole")
+											] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+													type: "checkbox",
+													checked: draft.goEnabled,
+													onChange: (event) => update({ goEnabled: event.target.checked })
+												}),
+												" ",
+												t("routeGo")
+											] })]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-hint",
+											children: t("enabledRoutesHint")
+										})
+									]
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
 									label: t("maxOutputTokens"),
 									type: "number",

package/lib/index.d.ts

@@ -5,6 +5,7 @@ import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 import { WebServer } from "@deepseek-ai/dsh-host-webserver";
 type TransportId = 'openai-chat' | 'openai-responses' | 'anthropic' | 'google';
 type UsageDisplay = 'auto' | 'always' | 'off';
+type CommandLocale = 'en' | 'zh';
 interface AccountConfig {
   label?: string;
   apiKeyEnv?: string;
@@ -49,8 +50,18 @@ interface Config {
   requestImageMaxBytes?: number;
   /** HTTP/HTTPS/SOCKS5 proxy for inference, catalog and usage requests. */
   proxyUrl?: string;
+  /** Proxy username; the password is resolved from `proxyPasswordRef`. */
+  proxyUsername?: string;
+  /** Credential reference for the proxy password. */
+  proxyPasswordRef?: string;
+  /** Enable the Go / Go Plus subscription route. */
+  goEnabled?: boolean;
+  /** Enable the Console / Zen pay-as-you-go route. */
+  consoleEnabled?: boolean;
   /** Live catalog cache lifetime in minutes; defaults to 10. */
   catalogRefreshMinutes?: number;
+  /** Language for `/opencode` output; defaults to English. */
+  commandLocale?: CommandLocale;
   /** Visible-model allowlist; an empty list means "show everything". */
   visibleModels?: string[];
   /** Per-model visibility overrides; wins over `visibleModels`. */
@@ -103,7 +114,12 @@ interface ResolvedConfig {
   requestImagePixelBudget: number;
   requestImageMaxBytes: number;
   proxyUrl: string;
+  proxyUsername: string;
+  proxyPasswordRef: string;
+  goEnabled: boolean;
+  consoleEnabled: boolean;
   catalogRefreshMinutes: number;
+  commandLocale: CommandLocale;
   visibleModels: readonly string[];
   modelVisibility: Readonly<Record<string, boolean>>;
   filterModelsByPlan: boolean;
@@ -316,6 +332,7 @@ interface CommandDeps {
   readonly pool: KeyPool;
   readonly usage: (provider: string, key?: string) => Promise<UsageResult | undefined>;
   readonly adapter: OpenCodeAdapter;
+  readonly locale: () => 'en' | 'zh';
 }
 declare function applyCommands(ctx: Context, deps: CommandDeps): void;
 interface ModelUsageRow {
@@ -403,6 +420,7 @@ interface RouteDeps {
   readonly analytics?: (days: number) => Promise<AnalyticsReport>;
   readonly heatmap?: (days: number) => Promise<RequestHeatmap>;
   readonly refreshTui?: () => void;
+  readonly syncRoutes?: () => void;
   /** Test seam; defaults to the local managed-credentials registry. */
   readonly managedPath?: string;
 }

package/lib/index.js

@@ -1,3 +1,4 @@
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { appendFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
@@ -6,15 +7,15 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import z from "@deepseek-ai/schemastery";
 import { ProxyAgent, Socks5ProxyAgent } from "undici";
-import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { isIP } from "node:net";
 // src/proxy.ts
 /**
-* Proxy addresses are deliberately credential-free: the settings API returns
-* the configured address to the browser, so embedding a password would leak it.
+* Proxy addresses stay credential-free: the settings API returns the configured
+* address to the browser. Authentication is supplied separately from the
+* credential service and is only assembled in memory.
 */
 function normalizeProxyUrl(raw) {
 	const value = raw?.trim() ?? "";
@@ -31,7 +32,24 @@ function normalizeProxyUrl(raw) {
 		"socks5:"
 	].includes(url.protocol)) throw new Error("proxy address must use http://, https:// or socks5://");
 	if (url.hostname === "" || url.port === "0" || url.pathname !== "" && url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("proxy address must contain a host and optional port, without a path, query or fragment");
-	if (url.username !== "" || url.password !== "") throw new Error("proxy credentials are not supported; use a local proxy without authentication");
+	if (url.username !== "" || url.password !== "") throw new Error("proxy credentials must be set through the proxy username and password fields");
+	return url.href;
+}
+/** Validate a proxy username; the password lives in the credential service. */
+function normalizeProxyUsername(raw) {
+	const value = raw?.trim() ?? "";
+	if (value === "") return "";
+	if (value.length > 256 || value.includes(":") || /[\u0000-\u001f\u007f]/.test(value)) throw new Error("proxy username must be 1–256 characters without a colon or control characters");
+	return value;
+}
+/** Assemble the authenticated proxy URL in memory; never persist or return it. */
+function buildProxyUrl(address, username, password) {
+	const base = normalizeProxyUrl(address);
+	const user = normalizeProxyUsername(username);
+	if (base === "" || user === "") return base;
+	const url = new URL(base);
+	url.username = encodeURIComponent(user);
+	url.password = encodeURIComponent(password ?? "");
 	return url.href;
 }
 /**
@@ -43,7 +61,7 @@ function createProxyFetch(address, baseFetch = fetch) {
 	let disposed = false;
 	const wrapped = (async (input, init) => {
 		if (disposed) throw new Error("proxy transport is disposed");
-		const proxy = normalizeProxyUrl(address());
+		const proxy = normalizeProxyUrl(await address());
 		if (proxy === "") return baseFetch(input, init);
 		let agent = agents.get(proxy);
 		if (agent === void 0) {
@@ -81,7 +99,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.30";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.32";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 65536;
@@ -89,6 +107,7 @@ const DEFAULT_MAX_REQUEST_IMAGE_BYTES = 25165824;
 const DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 2458624;
 const DEFAULT_REQUEST_IMAGE_MAX_BYTES = 1048576;
 const DEFAULT_REQUEST_PREPARATION_TIMEOUT_MS = 6e4;
+const DEFAULT_PROXY_PASSWORD_REF = "OPENCODE_PROXY_PASSWORD";
 function markVolatile(schema) {
 	const mark = schema.volatile;
 	return typeof mark === "function" ? mark.call(schema) : schema;
@@ -109,7 +128,12 @@ const Config = z.object({
 	requestImagePixelBudget: markVolatile(z.number().min(1).max(1e8).step(1).default(DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET)),
 	requestImageMaxBytes: markVolatile(z.number().min(1).max(1e8).step(1).default(DEFAULT_REQUEST_IMAGE_MAX_BYTES)),
 	proxyUrl: markVolatile(z.string().default("")),
+	proxyUsername: markVolatile(z.string().default("")),
+	proxyPasswordRef: markVolatile(z.string().role("credential-ref").default(DEFAULT_PROXY_PASSWORD_REF)),
+	goEnabled: markVolatile(z.boolean().default(true)),
+	consoleEnabled: markVolatile(z.boolean().default(true)),
 	catalogRefreshMinutes: markVolatile(z.number().min(1).max(10080).step(1).default(10)),
+	commandLocale: markVolatile(z.union(["en", "zh"]).default("en")),
 	visibleModels: markVolatile(z.array(z.string()).default([])),
 	modelVisibility: markVolatile(z.dict(z.boolean()).default({})),
 	filterModelsByPlan: markVolatile(z.boolean().default(true)),
@@ -228,7 +252,21 @@ function resolveConfig(config) {
 		requestImagePixelBudget: positiveInt(config.requestImagePixelBudget, DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET),
 		requestImageMaxBytes: positiveInt(config.requestImageMaxBytes, DEFAULT_REQUEST_IMAGE_MAX_BYTES),
 		proxyUrl: normalizeProxyUrl(config.proxyUrl),
+		proxyUsername: normalizeProxyUsername(config.proxyUsername),
+		proxyPasswordRef: typeof config.proxyPasswordRef === "string" && config.proxyPasswordRef.trim() !== "" ? config.proxyPasswordRef.trim() : DEFAULT_PROXY_PASSWORD_REF,
+		...(() => {
+			const goEnabled = config.goEnabled !== false;
+			const consoleEnabled = config.consoleEnabled !== false;
+			return goEnabled || consoleEnabled ? {
+				goEnabled,
+				consoleEnabled
+			} : {
+				goEnabled: true,
+				consoleEnabled: false
+			};
+		})(),
 		catalogRefreshMinutes: positiveInt(config.catalogRefreshMinutes, 10),
+		commandLocale: config.commandLocale === "zh" ? "zh" : "en",
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : [],
 		modelVisibility: booleanRecord(config.modelVisibility),
 		filterModelsByPlan: config.filterModelsByPlan !== false,
@@ -3499,6 +3537,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	}
 	async listModels(provider, opts) {
 		const config = this.deps.config();
+		if (isGoProvider(provider) ? !config.goEnabled : !config.consoleEnabled) return [];
 		let apiKey;
 		try {
 			apiKey = (await this.deps.resolveKey(provider)).key;
@@ -3522,6 +3561,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	}
 	async resolveModel(provider, model) {
 		const config = this.deps.config();
+		if (isGoProvider(provider) ? !config.goEnabled : !config.consoleEnabled) throw new Error(`OpenCode route "${provider}" is disabled`);
 		const meta = effectiveModel(model, config);
 		const maxTokens = effectiveMaxTokens(meta, config);
 		return {
@@ -3544,6 +3584,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	async *run(options, fallback) {
 		const record = this.deps.recordRequest ?? ((provider, model, purpose, account, reason, outcome) => recordRequest(provider, model, outcome?.at ?? Date.now(), purpose, account, reason, outcome));
 		const config = this.deps.config();
+		if (isGoProvider(options.provider) ? !config.goEnabled : !config.consoleEnabled) throw new Error(`OpenCode route "${options.provider}" is disabled`);
 		const runStartedAt = Date.now();
 		const model = effectiveModel(options.model, config);
 		const sessionId = openCodeSessionId(options);
@@ -3978,22 +4019,66 @@ var OpenCodeAdapter = class extends LlmAdapter {
 		return error.code === "RATE_LIMIT" || error.code === "QUOTA" || error.code === "SERVER" || error.code === "TIMEOUT" || error.code === "TRANSPORT" || error.code === "EMPTY_RESPONSE";
 	}
 };
+// src/command-copy.ts
+const en = {
+	provider: "OpenCode provider",
+	noCredential: "no credential",
+	active: "active",
+	cooling: "cooling",
+	rules: "Rules",
+	auth: "Auth",
+	none: "none",
+	noRules: "No model → account rules.",
+	noModels: "No models.",
+	modelsUnavailable: "Models unavailable",
+	unknown: "Unknown /opencode argument",
+	quotaUnavailable: "Quota unavailable",
+	noWindows: "No quota windows returned.",
+	testFailed: "failed",
+	resets: "resets",
+	fiveHour: "5h",
+	weekly: "weekly",
+	monthly: "monthly"
+};
+const zh = {
+	provider: "OpenCode 提供商",
+	noCredential: "未配置凭据",
+	active: "活动",
+	cooling: "冷却中",
+	rules: "规则",
+	auth: "认证",
+	none: "无",
+	noRules: "没有模型 → 账户规则。",
+	noModels: "没有模型。",
+	modelsUnavailable: "模型不可用",
+	unknown: "未知的 /opencode 参数",
+	quotaUnavailable: "配额不可用",
+	noWindows: "未返回配额窗口。",
+	testFailed: "失败",
+	resets: "重置",
+	fiveHour: "5小时",
+	weekly: "每周",
+	monthly: "每月"
+};
+function commandCopy(locale) {
+	return locale === "zh" ? zh : en;
+}
 // src/commands.ts
 function bar(percent, width = 10) {
 	const clamped = Math.max(0, Math.min(100, percent));
 	const filled = Math.round(clamped / 100 * width);
 	return `[${"█".repeat(filled)}${"░".repeat(width - filled)}] ${clamped.toFixed(0)}%`;
 }
-function reset(iso) {
+function reset(iso, copy) {
 	if (iso === void 0) return "";
 	const date = new Date(iso);
 	if (Number.isNaN(date.getTime())) return "";
-	return ` · resets ${date.toISOString().replace("T", " ").slice(0, 16)}Z`;
+	return ` · ${copy.resets} ${date.toISOString().replace("T", " ").slice(0, 16)}Z`;
 }
-function windowLine(label, window) {
+function windowLine(label, window, copy) {
 	if (window === void 0) return void 0;
 	const status = window.status === void 0 || window.status === "ok" ? "" : ` (${window.status})`;
-	return `${label}: ${bar(window.percentUsed)}${status}${reset(window.resetsAt)}`;
+	return `${label}: ${bar(window.percentUsed)}${status}${reset(window.resetsAt, copy)}`;
 }
 function percent(window) {
 	if (window === void 0) return "—";
@@ -4015,18 +4100,18 @@ function relative(until) {
 	if (delta >= 36e5) return `${Math.round(delta / 36e5)}h`;
 	return `${Math.max(1, Math.round(delta / 6e4))}m`;
 }
-async function accountsText(deps) {
+async function accountsText(deps, copy) {
 	const lines = [];
 	for (const provider of [GO_PROVIDER, CONSOLE_PROVIDER]) {
 		let keys;
 		try {
 			keys = await deps.pool.resolveAll(provider);
 		} catch {
-			lines.push(`${provider}: no credential`);
+			lines.push(`${provider}: ${copy.noCredential}`);
 			continue;
 		}
 		if (keys.length === 0) {
-			lines.push(`${provider}: no credential`);
+			lines.push(`${provider}: ${copy.noCredential}`);
 			continue;
 		}
 		const active = keys.find((entry) => deps.adapter.accountHealth(entry.key) === void 0);
@@ -4036,8 +4121,8 @@ async function accountsText(deps) {
 			const usage = provider === "opencode-go-direct" ? await deps.usage(provider, entry.key) : void 0;
 			const tags = [
 				entry.source,
-				entry === active ? "active" : "",
-				health === void 0 ? "" : `cooling ${health.reason} ${relative(health.coolingUntil)}`,
+				entry === active ? copy.active : "",
+				health === void 0 ? "" : `${copy.cooling} ${health.reason} ${relative(health.coolingUntil)}`,
 				usage?.report === void 0 ? usage?.error ?? "" : summary(usage.report)
 			].filter((tag) => tag !== "");
 			lines.push(`  ${index + 1}. ${entry.label ?? "default"}: ${tags.join(" · ")}`);
@@ -4045,27 +4130,27 @@ async function accountsText(deps) {
 	}
 	return lines.join("\n");
 }
-function rulesText(deps) {
+function rulesText(deps, copy) {
 	const rules = deps.config().modelAccountRules;
-	if (rules.length === 0) return "No model → account rules.";
+	if (rules.length === 0) return copy.noRules;
 	return rules.map((rule) => `${rule.pattern} → ${rule.account}`).join("\n");
 }
-async function modelsText(deps) {
+async function modelsText(deps, copy) {
 	const config = deps.config();
 	try {
 		const models = await deps.adapter.listModels(GO_PROVIDER, { unfiltered: true });
-		if (models.length === 0) return "No models.";
+		if (models.length === 0) return copy.noModels;
 		return models.map((model) => {
 			const meta = effectiveModel(model.id, config);
 			const limits = limitsFor(model.id);
-			const tags = [meta.free ? "FREE" : limits === void 0 ? "Console" : "Go", limits === void 0 ? "" : `5h ${formatRequests(limits.go.fiveHour)} / wk ${formatRequests(limits.go.weekly)} / mo ${formatRequests(limits.go.monthly)}`].filter((tag) => tag !== "");
+			const tags = [meta.free ? "FREE" : limits === void 0 ? "Console" : "Go", limits === void 0 ? "" : `${copy.fiveHour} ${formatRequests(limits.go.fiveHour)} / ${copy.weekly} ${formatRequests(limits.go.weekly)} / ${copy.monthly} ${formatRequests(limits.go.monthly)}`].filter((tag) => tag !== "");
 			return `- ${model.id}${tags.length === 0 ? "" : ` · ${tags.join(" · ")}`}`;
 		}).join("\n");
 	} catch (error) {
-		return `Models unavailable: ${error instanceof Error ? error.message : String(error)}`;
+		return `${copy.modelsUnavailable}: ${error instanceof Error ? error.message : String(error)}`;
 	}
 }
-async function testText(deps, model) {
+async function testText(deps, model, copy) {
 	const started = Date.now();
 	let text = "";
 	try {
@@ -4088,18 +4173,18 @@ async function testText(deps, model) {
 	} catch (error) {
 		return {
 			ok: false,
-			text: `${model}: failed — ${error instanceof Error ? error.message : String(error)}`
+			text: `${model}: ${copy.testFailed} — ${error instanceof Error ? error.message : String(error)}`
 		};
 	}
 }
-async function statusText(deps) {
+async function statusText(deps, copy) {
 	const config = deps.config();
-	const rules = config.modelAccountRules.length === 0 ? "none" : config.modelAccountRules.map((rule) => `${rule.pattern} → ${rule.account}`).join(", ");
+	const rules = config.modelAccountRules.length === 0 ? copy.none : config.modelAccountRules.map((rule) => `${rule.pattern} → ${rule.account}`).join(", ");
 	return [
-		"OpenCode provider",
-		await accountsText(deps),
-		`Rules: ${rules}`,
-		`Auth: ${config.openCodeAuthEntry} · ${config.apiKeyEnv}`
+		copy.provider,
+		await accountsText(deps, copy),
+		`${copy.rules}: ${rules}`,
+		`${copy.auth}: ${config.openCodeAuthEntry} · ${config.apiKeyEnv}`
 	].filter((line) => line !== "").join("\n");
 }
 function applyCommands(ctx, deps) {
@@ -4108,6 +4193,7 @@ function applyCommands(ctx, deps) {
 		description: "OpenCode / OpenCode Go status, accounts, quotas, models and rules",
 		input: { hint: "status | usage | accounts | models | rules | test [model]" },
 		handler: async (invocation) => {
+			const copy = commandCopy(deps.locale());
 			const raw = invocation.rawInput.trim();
 			const parts = raw === "" ? ["status"] : raw.split(/\s+/);
 			const verb = parts[0] ?? "status";
@@ -4115,39 +4201,39 @@ function applyCommands(ctx, deps) {
 			switch (verb.toLowerCase()) {
 				case "status": return {
 					kind: "success",
-					text: await statusText(deps)
+					text: await statusText(deps, copy)
 				};
 				case "usage": {
 					const usage = await deps.usage(GO_PROVIDER);
 					if (usage?.report === void 0) return {
 						kind: "error",
-						text: `Quota unavailable: ${usage?.error ?? "no report"}`
+						text: `${copy.quotaUnavailable}: ${usage?.error ?? "no report"}`
 					};
 					const windows = usage.report.windows;
 					const text = [
-						windowLine("5h     ", windows.fiveHour),
-						windowLine("weekly ", windows.weekly),
-						windowLine("monthly", windows.monthly)
+						windowLine(copy.fiveHour, windows.fiveHour, copy),
+						windowLine(copy.weekly, windows.weekly, copy),
+						windowLine(copy.monthly, windows.monthly, copy)
 					].filter((line) => line !== void 0).join("\n");
 					return {
 						kind: "success",
-						text: text === "" ? "No quota windows returned." : text
+						text: text === "" ? copy.noWindows : text
 					};
 				}
 				case "accounts": return {
 					kind: "success",
-					text: await accountsText(deps)
+					text: await accountsText(deps, copy)
 				};
 				case "models": return {
 					kind: "success",
-					text: await modelsText(deps)
+					text: await modelsText(deps, copy)
 				};
 				case "rules": return {
 					kind: "success",
-					text: rulesText(deps)
+					text: rulesText(deps, copy)
 				};
 				case "test": {
-					const result = await testText(deps, arg === "" ? "deepseek-v4.1-flash" : arg);
+					const result = await testText(deps, arg === "" ? "deepseek-v4.1-flash" : arg, copy);
 					return result.ok ? {
 						kind: "success",
 						text: result.text
@@ -4158,7 +4244,7 @@ function applyCommands(ctx, deps) {
 				}
 				default: return {
 					kind: "error",
-					text: `Unknown /opencode argument "${verb}". Use status, usage, accounts, models, rules, or test [model].`
+					text: `${copy.unknown} "${verb}". ${copy.rules}: status | usage | accounts | models | rules | test [model]`
 				};
 			}
 		}
@@ -4988,7 +5074,12 @@ function publicConfig(config) {
 		requestImagePixelBudget: config.requestImagePixelBudget,
 		requestImageMaxBytes: config.requestImageMaxBytes,
 		proxyUrl: config.proxyUrl,
+		proxyUsername: config.proxyUsername,
+		proxyPasswordRef: config.proxyPasswordRef,
+		goEnabled: config.goEnabled,
+		consoleEnabled: config.consoleEnabled,
 		catalogRefreshMinutes: config.catalogRefreshMinutes,
+		commandLocale: config.commandLocale,
 		visibleModels: config.visibleModels,
 		modelVisibility: config.modelVisibility,
 		filterModelsByPlan: config.filterModelsByPlan,
@@ -5190,7 +5281,12 @@ function configOps(patch) {
 	if ("requestImagePixelBudget" in patch) set("requestImagePixelBudget", patch.requestImagePixelBudget);
 	if ("requestImageMaxBytes" in patch) set("requestImageMaxBytes", patch.requestImageMaxBytes);
 	if ("proxyUrl" in patch) set("proxyUrl", normalizeProxyUrl(typeof patch.proxyUrl === "string" ? patch.proxyUrl : ""));
+	if ("proxyUsername" in patch) set("proxyUsername", normalizeProxyUsername(typeof patch.proxyUsername === "string" ? patch.proxyUsername : ""));
+	if ("proxyPasswordRef" in patch) set("proxyPasswordRef", patch.proxyPasswordRef);
+	if ("goEnabled" in patch) set("goEnabled", patch.goEnabled === true);
+	if ("consoleEnabled" in patch) set("consoleEnabled", patch.consoleEnabled === true);
 	if ("catalogRefreshMinutes" in patch) set("catalogRefreshMinutes", patch.catalogRefreshMinutes);
+	if ("commandLocale" in patch) set("commandLocale", patch.commandLocale === "zh" ? "zh" : "en");
 	if ("visibleModels" in patch) set("visibleModels", cleanStringArray(patch.visibleModels));
 	if ("modelVisibility" in patch) set("modelVisibility", cleanBooleanRecord(patch.modelVisibility));
 	if ("filterModelsByPlan" in patch) set("filterModelsByPlan", patch.filterModelsByPlan === true);
@@ -5228,6 +5324,12 @@ async function buildState(ctx, deps) {
 			...info.source === void 0 ? {} : { source: info.source }
 		};
 	} catch {}
+	let proxyConfigured = false;
+	if (config.proxyUsername !== "" && credentials !== void 0) try {
+		proxyConfigured = (await credentials.describe(credentialRef(config.proxyPasswordRef))).configured;
+	} catch {
+		proxyConfigured = false;
+	}
 	const resolved = await deps.pool.resolveAll(GO_PROVIDER).catch(() => []);
 	if (!keyInfo.configured) keyInfo = {
 		...keyInfo,
@@ -5285,9 +5387,10 @@ async function buildState(ctx, deps) {
 			managed: slot.ref !== "" && managedRefs.has(slot.ref)
 		});
 	}
+	const listingProvider = config.goEnabled ? GO_PROVIDER : CONSOLE_PROVIDER;
 	let models = [];
 	try {
-		models = (await deps.adapter.listModels(GO_PROVIDER, { unfiltered: true })).map((model) => {
+		models = (await deps.adapter.listModels(listingProvider, { unfiltered: true })).map((model) => {
 			const meta = effectiveModel(model.id, config);
 			return {
 				id: model.id,
@@ -5302,8 +5405,8 @@ async function buildState(ctx, deps) {
 				input: meta.input,
 				reasoning: meta.reasoning,
 				visible: modelVisible(model.id, config),
-				...catalogReleaseDate("opencode-go-direct", model.id, config) === void 0 ? {} : { releaseDate: catalogReleaseDate(GO_PROVIDER, model.id, config) },
-				isNew: isNewRelease(catalogReleaseDate(GO_PROVIDER, model.id, config))
+				...catalogReleaseDate(listingProvider, model.id, config) === void 0 ? {} : { releaseDate: catalogReleaseDate(listingProvider, model.id, config) },
+				isNew: isNewRelease(catalogReleaseDate(listingProvider, model.id, config))
 			};
 		});
 	} catch {
@@ -5314,9 +5417,14 @@ async function buildState(ctx, deps) {
 	return {
 		config: publicConfig(config),
 		key: keyInfo,
+		proxy: {
+			configured: proxyConfigured,
+			username: config.proxyUsername,
+			passwordRef: config.proxyPasswordRef
+		},
 		accounts,
 		models,
-		catalog: catalogStatus(GO_PROVIDER, config, models.length),
+		catalog: catalogStatus(listingProvider, config, models.length),
 		usage: usage ?? null,
 		service: {
 			...usage?.checkedAt === void 0 ? {} : { usageCheckedAt: usage.checkedAt },
@@ -5452,6 +5560,7 @@ function applyRoutes(ctx, web, deps) {
 			await settings.mutate(NS, ops, revision);
 			deps.usage.clear();
 			deps.refreshTui?.();
+			deps.syncRoutes?.();
 			json(res, 200, { ok: true });
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "config write failed";
@@ -5503,6 +5612,50 @@ function applyRoutes(ctx, web, deps) {
 			json(res, 500, { error: error instanceof Error ? error.message : "key clear failed" });
 		}
 	});
+	route("/dsh-opencode/proxy-password", async (req, res) => {
+		if (!requirePost(req, res)) return;
+		const credentials = getCredentials(ctx);
+		if (credentials === void 0) {
+			json(res, 503, { error: "credentials service unavailable" });
+			return;
+		}
+		try {
+			const body = await readJson(req);
+			const password = typeof body.password === "string" ? body.password : "";
+			if (password === "") {
+				json(res, 400, { error: "proxy password is required" });
+				return;
+			}
+			const refName = deps.config().proxyPasswordRef;
+			await credentials.set(credentialRef(refName), password);
+			await addManagedCredentialRef(refName, deps.managedPath);
+			json(res, 200, {
+				ok: true,
+				ref: refName
+			});
+		} catch (error) {
+			json(res, 500, { error: error instanceof Error ? error.message : "proxy password write failed" });
+		}
+	});
+	route("/dsh-opencode/proxy-password/clear", async (req, res) => {
+		if (!requirePost(req, res)) return;
+		const credentials = getCredentials(ctx);
+		if (credentials === void 0) {
+			json(res, 503, { error: "credentials service unavailable" });
+			return;
+		}
+		try {
+			const refName = deps.config().proxyPasswordRef;
+			await credentials.unset(credentialRef(refName));
+			await removeManagedCredentialRef(refName, deps.managedPath);
+			json(res, 200, {
+				ok: true,
+				ref: refName
+			});
+		} catch (error) {
+			json(res, 500, { error: error instanceof Error ? error.message : "proxy password clear failed" });
+		}
+	});
 	route("/dsh-opencode/auth-import", async (req, res) => {
 		if (!requirePost(req, res)) return;
 		const credentials = getCredentials(ctx);
@@ -6065,7 +6218,19 @@ const inject = ["llm"];
 function apply(ctx, config) {
 	const current = () => resolveConfig(unwrapVolatileConfig(config));
 	const keys = createKeyPool(ctx, current);
-	const proxy = createProxyFetch(() => current().proxyUrl);
+	const proxy = createProxyFetch(async () => {
+		const config = current();
+		let password = "";
+		if (config.proxyUsername !== "") {
+			const credentials = ctx.get("credentials");
+			if (credentials?.resolve !== void 0) try {
+				password = (await credentials.resolve(credentialRef(config.proxyPasswordRef)))?.value ?? "";
+			} catch {
+				password = "";
+			}
+		}
+		return buildProxyUrl(config.proxyUrl, config.proxyUsername, password);
+	});
 	const usage = createUsageReader(current, (provider) => keys.resolve(provider), proxy.fetch);
 	const adapter = new OpenCodeAdapter({
 		config: current,
@@ -6078,19 +6243,30 @@ function apply(ctx, config) {
 	ctx.effect(() => () => {
 		proxy.dispose();
 	});
-	ctx.llm.registerConfigurableProviders([{
+	const providersFor = () => {
+		const config = current();
+		return [...config.consoleEnabled ? [CONSOLE_PROVIDER] : [], ...config.goEnabled ? [GO_PROVIDER] : []];
+	};
+	const entriesFor = (providers) => [...providers.includes("opencode-direct") ? [{
 		provider: CONSOLE_PROVIDER,
 		displayName: "OpenCode (plugin)",
 		settingsNs: NS,
 		settingsPath: []
-	}, {
+	}] : [], ...providers.includes("opencode-go-direct") ? [{
 		provider: GO_PROVIDER,
 		displayName: "OpenCode Go (plugin)",
 		settingsNs: NS,
 		settingsPath: []
-	}]);
-	ctx.llm.registerAdapter([CONSOLE_PROVIDER, GO_PROVIDER], adapter);
-	ctx.logger("llm-opencode").info(`registered providers: ${CONSOLE_PROVIDER}, ${GO_PROVIDER}`);
+	}] : []];
+	const directory = ctx.llm.registerConfigurableProviders(entriesFor(providersFor()));
+	const registration = ctx.llm.registerAdapter(providersFor(), adapter);
+	const syncRoutes = () => {
+		const providers = providersFor();
+		registration.replace(providers);
+		directory.replace(entriesFor(providers));
+		ctx.logger("llm-opencode").info(`enabled providers: ${providers.join(", ")}`);
+	};
+	ctx.logger("llm-opencode").info(`registered providers: ${providersFor().join(", ")}`);
 	ctx.inject(["settings"], (settingsCtx) => {
 		settingsCtx.settings.configure({ auto: false }, ctx.fiber);
 	});
@@ -6099,7 +6275,8 @@ function apply(ctx, config) {
 			config: current,
 			pool: keys,
 			usage,
-			adapter
+			adapter,
+			locale: () => current().commandLocale
 		});
 	});
 	let refreshTuiSettings;
@@ -6133,7 +6310,8 @@ function apply(ctx, config) {
 			pool: keys,
 			usage,
 			heatmap: readRequestHeatmap,
-			refreshTui: () => refreshTuiSettings?.()
+			refreshTui: () => refreshTuiSettings?.(),
+			syncRoutes
 		});
 		webCtx.effect(() => registerPluginUpdater(webCtx, {
 			endpoint: "/dsh-opencode/update",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-opencode-provider",
-  "version": "0.5.30",
+  "version": "0.5.32",
   "description": "OpenCode / OpenCode Go LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",