@goodandready/dsh-opencode-provider 0.5.31 → 0.5.33

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.33 — release 10: admin token and dependency audit
+
+- **#41 — authenticated HTTP routes**: optional owner `adminToken` (profile config or `OPENCODE_ADMIN_TOKEN`). When set, every `/dsh-opencode/*` route requires `x-opencode-token` or a Bearer token with constant-time comparison; forged Host/Origin alone no longer passes. The settings UI prompts for the token and keeps it in this browser.
+- **#42 — zod audit**: confirmed `zod` 4.4.3 is pinned by all DSH 0.2.2-rc.1 packages; GHSA-mrhx-c7xc-m3w5 affects `<4.6.6`. No DSH release with the fix exists, this plugin does not bundle zod, and no forced override was added. Residual exposure is documented and must be re-audited after the upstream update.
+- 145 tests.
+
+## 0.5.32 — release 9: proxy auth and route switches
+
+- **#71 — authenticated proxy**: `proxyUsername` plus a password stored in the credential service enable Basic auth for HTTP/HTTPS and SOCKS5 proxies. The authenticated URL exists only in memory; `/state` returns the credential-free address and a `configured` flag, never the password.
+- **#80 — route switches**: `goEnabled` and `consoleEnabled` are exposed in Settings. Disabling a route removes it from the provider directory, the picker and request handling at runtime; at least one route stays enabled.
+- 144 tests.
+
 ## 0.5.31 — release 8: command localization
 
 - **#48 — `/opencode` localization**: new `commandLocale` setting (`en` default, `zh`) localizes status, usage, accounts, models, rules and errors. Exposed in Settings → OpenCode.

package/README.md

@@ -99,7 +99,8 @@ graph LR
 - **Request heatmap** in the quota panel: a Monday-first weekday × hour grid in local time, plus a 24-hour aggregate strip underneath. Selectors switch between all requests, any single model, and any single account. A per-account table shows requests, errors and average latency/TTFT. The adapter appends `{at, provider, model, purpose?, account, reason, ok, latencyMs, ttftMs?, error?}` to `~/.dsh/storages/dsh-opencode/requests.jsonl`; no prompt, response or key is stored. Auxiliary `session-title`/`compaction` calls are excluded from the heatmap and exact duplicate records collapse. The log compacts at 2 MB to the newest 5000 lines. Collection starts with this build — the projection cache only has `lastPromptAt`, not per-request timestamps.
 - **Stable `x-opencode-session`** derived from the durable session id, so retries and every turn of a conversation reuse the same routing key.
 - **Live catalog** from `/v1/models` with a generated `models.dev` fallback.
-- **Proxy support**: one live `proxyUrl` setting routes inference, model discovery and usage checks through HTTP, HTTPS or SOCKS5; the dispatcher is reused until the address changes.
+- **Proxy support**: one live `proxyUrl` setting routes inference, model discovery and usage checks through HTTP, HTTPS or SOCKS5; the dispatcher is reused until the address changes. `proxyUsername` and a password stored in the credential service add Basic auth for both HTTP and SOCKS5. Passwords are never returned to the browser.
+- **Route switches**: enable or disable the Console/Zen and Go/Go Plus routes independently; a disabled route is removed from the picker and refuses requests. At least one route stays enabled.
 - **Per-model subscription limits** from the OpenCode Go pricing table: monthly dollar allowance plus estimated requests for the 5-hour, weekly and monthly windows, for both Go and Go Plus. Shown in the model picker and the settings page; estimates only — the gateway remains the authority.
 - **`/opencode` command** for status, usage, accounts, models, rules, and `test [model]`.
 - **TUI settings section** for the terminal profile (`/settings → OpenCode`) with the key, endpoints, proxy, allowlist, active account, fallback model, sticky routing and timeouts.
@@ -132,12 +133,12 @@ npm pack
 Install the **packed tarball** into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.31.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.31.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
 
 # Or install the published package:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.31
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.33
 ```
 
 Restart dsh (or DSH Desktop), then pick **OpenCode (plugin)** or **OpenCode Go (plugin)** in the model picker.
@@ -314,7 +315,8 @@ GitHub Actions runs `npm run check` and `npm pack` on push/PR (`.github/workflow
 - `opencode-direct` (Console) billing shows no per-model allowance; the Go route is the primary target.
 - The anonymous free lane (`Bearer public` + CLI impersonation) is not implemented. A keyless `big-pickle` probe on 2026-11-05 returned HTTP 429 `FreeUsageLimitError`; use the keyed Console/Zen route for free models.
 - The UI requires a web profile (the Host needs `ctx.webServer`); the TUI keeps the `/opencode` command and the model routes.
-- Write routes are loopback-only; a web profile exposed to a LAN can read state but cannot save configuration or keys until the host auth token is integrated.
+- Same-origin checks are CSRF protection, not authentication. Set an owner admin token in the profile config (`adminToken`) or `OPENCODE_ADMIN_TOKEN`; every `/dsh-opencode/*` route then requires `x-opencode-token` or `Authorization: Bearer`. The settings UI asks for the token once and keeps it in this browser. Without a token, routes retain the loopback/same-origin guard only.
+- `npm audit` still reports `zod < 4.6.6` (GHSA-mrhx-c7xc-m3w5) because every `@deepseek-ai/dsh-*` 0.2.2-rc.1 package pins `zod` 4.4.3. No DSH 0.2.2 release with 4.6.6 exists yet; this plugin does not bundle zod and no forced override is used. Re-audit after the upstream DSH update.
 
 ## License
 

package/README.ru.md

@@ -108,7 +108,8 @@ graph LR
 - **Почасовой Heatmap запросов**: сетка «день недели × час» в локальном времени плюс суточная полоса агрегации. Фильтры переключают отображение между всеми запросами, конкретной моделью и аккаунтом. Лог `~/.dsh/storages/dsh-opencode/requests.jsonl` хранит только метаданные `{at, provider, model, purpose, account, reason, ok, latencyMs, ttftMs, error}` (промпты и ответы не сохраняются).
 - **Стабильный заголовок `x-opencode-session`**: вычисляется из устойчивого ID сессии DSH, обеспечивая одинаковый ключ маршрутизации при повторах и диалоге.
 - **Живой каталог моделей**: автоматическое чтение `/v1/models` с резервным fallback из `models.dev`.
-- **Proxy**: live-параметр `proxyUrl` направляет инференс, каталог и проверку квот через HTTP, HTTPS или SOCKS5; dispatcher переиспользуется до смены адреса.
+- **Proxy**: live-параметр `proxyUrl` направляет инференс, каталог и проверку квот через HTTP, HTTPS или SOCKS5; dispatcher переиспользуется до смены адреса. `proxyUsername` и пароль из credential-сервиса включают Basic auth для HTTP и SOCKS5. Пароль не возвращается в браузер.
+- **Переключатели маршрутов**: Console/Zen и Go/Go Plus включаются и отключаются независимо; отключённый маршрут исчезает из выбора и отклоняет запросы. Хотя бы один маршрут остаётся включённым.
 - **Оценки лимитов подписки OpenCode Go**: долларовый лимит и расчетное число запросов для окон 5h, недели и месяца для планов Go и Go Plus.
 - **Команда `/opencode`**: быстрый просмотр статуса, квот, аккаунтов, моделей, правил и запуск теста связи `test [model]`.
 - **Настройки в терминале (TUI)**: раздел `/settings → OpenCode` для профиля terminal с ключом, эндпоинтами, allowlist, активным аккаунтом, fallback-моделью, sticky-маршрутизацией и таймаутами.
@@ -131,12 +132,12 @@ npm pack
 Установка из **упакованного tarball**:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.31.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.31.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
 
 # Либо установка опубликованного пакета из npm:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.31
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.33
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **OpenCode (plugin)** или **OpenCode Go (plugin)** в списке моделей.
@@ -212,7 +213,8 @@ modelAccountRules:
 
 ## Безопасность и надежность
 
-- Запросы на изменение настроек и ключей разрешены только с loopback (`127.0.0.1` / `::1`) с обязательной проверкой same-origin для защиты от DNS-rebinding атак.
+- Same-origin — это защита от CSRF, а не аутентификация. Задайте admin-токен владельца в конфиге профиля (`adminToken`) или `OPENCODE_ADMIN_TOKEN`; тогда все маршруты `/dsh-opencode/*` требуют `x-opencode-token` или `Authorization: Bearer`. UI спросит токен один раз и сохранит его в браузере. Без токена остаются только loopback и same-origin проверки.
+- `npm audit` по-прежнему показывает `zod < 4.6.6` (GHSA-mrhx-c7xc-m3w5): пакеты `@deepseek-ai/dsh-*` 0.2.2-rc.1 фиксируют zod 4.4.3. Релиза DSH 0.2.2 с 4.6.6 пока нет; плагин не бандлит zod и не применяет принудительный override. Повторить аудит после обновления DSH.
 - Тексты запросов и ответов пользователей никогда не записываются в файлы журнала.
 - При исчерпании квоты на одном ключе диалог пользователя не прерывается благодаря бесшовной ротации.
 

package/README.zh.md

@@ -106,7 +106,8 @@ graph LR
 - **本地时间请求热力图**：星期×小时交互式热力图，排除系统心跳与重复记录，可按模型或账户过滤，仅保存 `{at, provider, model, purpose, account, reason, ok, latencyMs, ttftMs, error}` 元数据，不保存任何提示词与回复。
 - **稳定的 `x-opencode-session` 标头**：根据 DSH 会话 ID 派生，确保重试与连续对话复用相同的网关路由键。
 - **实时模型目录**：自动从 `/v1/models` 同步，并以 `models.dev` 生成文件作为回退。
-- **代理**：一个实时 `proxyUrl` 设置即可让推理、模型目录和额度检查走 HTTP、HTTPS 或 SOCKS5；地址变化前复用 dispatcher。
+- **代理**：一个实时 `proxyUrl` 设置即可让推理、模型目录和额度检查走 HTTP、HTTPS 或 SOCKS5；地址变化前复用 dispatcher。`proxyUsername` 与凭据服务中的密码可为 HTTP 和 SOCKS5 启用 Basic 认证，密码不会返回浏览器。
+- **路由开关**：可独立启用或禁用 Console/Zen 与 Go/Go Plus 路由；禁用的路由会从选择器移除并拒绝请求，至少保留一个路由。
 - **Go 订阅额度估算**：每月美元额度以及 5 小时、每周和每月的估算请求次数。
 - **`/opencode` 斜杠指令**：快速查询状态、配额、账户、模型及执行联通性测试。
 - **TUI 设置**：`/settings → OpenCode` 支持密钥、端点、allowlist、活动账户、回退模型、粘性路由和超时。
@@ -126,12 +127,12 @@ npm pack
 通过**打包文件 (.tgz)**安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.31.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.31.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
 
 # 或从 npm 安装已发布版本：
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.31
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.33
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型选择器中选择 **OpenCode (plugin)** 或 **OpenCode Go (plugin)** 即可。
@@ -187,7 +188,8 @@ modelAccountRules:
 
 ## 安全规范
 
-- 写入与配置路由均要求 Loopback（`127.0.0.1` / `::1`）与同源检查，防御 DNS 重新绑定。
+- 同源检查用于防御 CSRF，并非身份认证。在配置文件（`adminToken`）或 `OPENCODE_ADMIN_TOKEN` 中设置管理员令牌后，所有 `/dsh-opencode/*` 路由都要求 `x-opencode-token` 或 `Authorization: Bearer`；设置界面会要求输入一次并保存在当前浏览器。未设置令牌时仍只有 Loopback 与同源检查。
+- `npm audit` 仍报告 `zod < 4.6.6`（GHSA-mrhx-c7xc-m3w5）：`@deepseek-ai/dsh-*` 0.2.2-rc.1 固定使用 zod 4.4.3。目前没有使用 4.6.6 的 DSH 0.2.2 版本；本插件不打包 zod，也不使用强制 override。待上游 DSH 更新后重新审计。
 - 密钥冷却状态通过 SHA-256 哈希指纹持久化，本地日志不保存提示词与明文密钥。
 
 ## 许可证

package/lib/client.js

@@ -190,7 +190,22 @@ window.__ModuleLoader__.load({
 				commandLocale: "/opencode command language",
 				commandLocaleHint: "Language for /opencode status, accounts, usage, models and rules.",
 				proxyUrl: "Proxy URL",
-				proxyUrlHint: "HTTP, HTTPS or SOCKS5 proxy for inference, catalog and usage. Empty disables it. Credentials are not supported.",
+				proxyUrlHint: "HTTP, HTTPS or SOCKS5 proxy for inference, catalog and usage. Empty disables it. Do not put credentials in this URL.",
+				proxyUsername: "Proxy username",
+				proxyPassword: "Proxy password",
+				proxyPasswordSet: "configured — enter a new one to replace it",
+				proxyPasswordUnset: "not configured",
+				proxyPasswordHint: "Stored in the credential service, never returned to the browser.",
+				saveProxyPassword: "Save proxy password",
+				clearProxyPassword: "Clear proxy password",
+				enabledRoutes: "Enabled routes",
+				routeConsole: "OpenCode Console / Zen",
+				routeGo: "OpenCode Go / Go Plus",
+				enabledRoutesHint: "Disabled routes are removed from the picker; at least one route stays enabled.",
+				adminToken: "Admin token",
+				adminTokenHint: "This Host requires the admin token configured by its owner. It is stored in this browser only.",
+				adminTokenPlaceholder: "Paste the admin token",
+				continue: "Continue",
 				maxOutputTokens: "Output limit (empty = model default, 0 = omit)",
 				contextOverrideShort: "Context",
 				maxOutputOverrideShort: "Max output",
@@ -426,7 +441,22 @@ window.__ModuleLoader__.load({
 				commandLocale: "/opencode 命令语言",
 				commandLocaleHint: "用于 /opencode 的状态、账户、用量、模型和规则输出。",
 				proxyUrl: "代理地址",
-				proxyUrlHint: "用于推理、目录和用量的 HTTP、HTTPS 或 SOCKS5 代理。留空则禁用。不支持代理认证。",
+				proxyUrlHint: "用于推理、目录和用量的 HTTP、HTTPS 或 SOCKS5 代理。留空则禁用。请勿在此 URL 中填写凭据。",
+				proxyUsername: "代理用户名",
+				proxyPassword: "代理密码",
+				proxyPasswordSet: "已配置 — 输入新密码可替换",
+				proxyPasswordUnset: "未配置",
+				proxyPasswordHint: "保存在凭据服务中，不会返回给浏览器。",
+				saveProxyPassword: "保存代理密码",
+				clearProxyPassword: "清除代理密码",
+				enabledRoutes: "启用的路由",
+				routeConsole: "OpenCode Console / Zen",
+				routeGo: "OpenCode Go / Go Plus",
+				enabledRoutesHint: "禁用的路由会从选择器中移除；至少保留一个启用的路由。",
+				adminToken: "管理令牌",
+				adminTokenHint: "此 Host 要求所有者配置的管理令牌。令牌仅保存在当前浏览器中。",
+				adminTokenPlaceholder: "粘贴管理令牌",
+				continue: "继续",
 				maxOutputTokens: "输出上限（空 = 模型默认，0 = 省略）",
 				contextOverrideShort: "上下文",
 				maxOutputOverrideShort: "最大输出",
@@ -483,6 +513,23 @@ window.__ModuleLoader__.load({
 			}
 		};
 		const GO_PROVIDER = "opencode-go-direct";
+		// src/client/admin-token.ts
+		const KEY = "dsh-opencode-admin-token";
+		function storage() {
+			try {
+				return typeof localStorage === "undefined" ? void 0 : localStorage;
+			} catch {
+				return;
+			}
+		}
+		function getAdminToken() {
+			return storage()?.getItem(KEY) ?? "";
+		}
+		function setAdminToken(token) {
+			const value = token.trim();
+			if (value === "") storage()?.removeItem(KEY);
+			else storage()?.setItem(KEY, value);
+		}
 		// src/client/api.ts
 		async function call(path, init) {
 			const response = await fetch(path, {
@@ -491,6 +538,7 @@ window.__ModuleLoader__.load({
 				headers: {
 					accept: "application/json",
 					...init?.body === void 0 ? {} : { "content-type": "application/json" },
+					...getAdminToken() === "" ? {} : { "x-opencode-token": getAdminToken() },
 					...init?.headers ?? {}
 				}
 			});
@@ -556,6 +604,18 @@ window.__ModuleLoader__.load({
 				body: JSON.stringify({ ref })
 			});
 		}
+		function saveProxyPassword(password) {
+			return call("/dsh-opencode/proxy-password", {
+				method: "POST",
+				body: JSON.stringify({ password })
+			});
+		}
+		function clearProxyPassword() {
+			return call("/dsh-opencode/proxy-password/clear", {
+				method: "POST",
+				body: "{}"
+			});
+		}
 		function importAuth(entry, ref) {
 			return call("/dsh-opencode/auth-import", {
 				method: "POST",
@@ -1718,6 +1778,9 @@ window.__ModuleLoader__.load({
 				requestImagePixelBudget: String(state.config.requestImagePixelBudget),
 				requestImageMaxBytes: String(state.config.requestImageMaxBytes),
 				proxyUrl: state.config.proxyUrl,
+				proxyUsername: state.config.proxyUsername,
+				goEnabled: state.config.goEnabled,
+				consoleEnabled: state.config.consoleEnabled,
 				catalogRefreshMinutes: String(state.config.catalogRefreshMinutes),
 				commandLocale: state.config.commandLocale,
 				maxOutputTokens: state.config.maxOutputTokens === null ? "" : String(state.config.maxOutputTokens),
@@ -1772,6 +1835,9 @@ window.__ModuleLoader__.load({
 				requestImagePixelBudget: numberOrNull(draft.requestImagePixelBudget) ?? 2458624,
 				requestImageMaxBytes: numberOrNull(draft.requestImageMaxBytes) ?? 1048576,
 				proxyUrl: draft.proxyUrl.trim(),
+				proxyUsername: draft.proxyUsername.trim(),
+				goEnabled: draft.goEnabled,
+				consoleEnabled: draft.consoleEnabled,
 				catalogRefreshMinutes: numberOrNull(draft.catalogRefreshMinutes) ?? 10,
 				commandLocale: draft.commandLocale,
 				maxOutputTokens: numberOrNull(draft.maxOutputTokens),
@@ -2014,6 +2080,9 @@ window.__ModuleLoader__.load({
 			const [error, setError] = (0, react.useState)(null);
 			const [notice, setNotice] = (0, react.useState)(null);
 			const [keyDraft, setKeyDraft] = (0, react.useState)("");
+			const [proxyPassword, setProxyPassword] = (0, react.useState)("");
+			const [proxyBusy, setProxyBusy] = (0, react.useState)(false);
+			const [tokenDraft, setTokenDraft] = (0, react.useState)("");
 			const [keyDrafts, setKeyDrafts] = (0, react.useState)({});
 			const [search, setSearch] = (0, react.useState)("");
 			const [testModel, setTestModel] = (0, react.useState)("deepseek-v4.1-flash");
@@ -2077,6 +2146,34 @@ window.__ModuleLoader__.load({
 					setSaving(false);
 				}
 			};
+			const storeProxyPassword = async () => {
+				if (proxyPassword === "") return;
+				setProxyBusy(true);
+				setError(null);
+				try {
+					await saveProxyPassword(proxyPassword);
+					setProxyPassword("");
+					setNotice(t("saved"));
+					await load();
+				} catch (caught) {
+					setError(caught instanceof Error ? caught.message : t("failed"));
+				} finally {
+					setProxyBusy(false);
+				}
+			};
+			const removeProxyPassword = async () => {
+				setProxyBusy(true);
+				setError(null);
+				try {
+					await clearProxyPassword();
+					setNotice(t("saved"));
+					await load();
+				} catch (caught) {
+					setError(caught instanceof Error ? caught.message : t("failed"));
+				} finally {
+					setProxyBusy(false);
+				}
+			};
 			const checkKey = async (label) => {
 				setChecking(label);
 				setError(null);
@@ -2125,20 +2222,56 @@ window.__ModuleLoader__.load({
 				className: "oc-hint",
 				children: t("loading")
 			});
-			if (state === null || draft === null) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "oc-page",
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-					className: "oc-error",
-					children: error ?? t("failed")
-				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-					type: "button",
-					className: "oc-button",
-					onClick: () => {
-						load();
-					},
-					children: t("refresh")
-				})]
-			});
+			if (state === null || draft === null) {
+				if (error?.includes("admin token required") === true) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "oc-page",
+					children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "oc-card",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+								className: "oc-card-title",
+								children: t("adminToken")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "oc-hint",
+								children: t("adminTokenHint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								className: "oc-input",
+								type: "password",
+								value: tokenDraft,
+								placeholder: t("adminTokenPlaceholder"),
+								onChange: (event) => setTokenDraft(event.target.value)
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "oc-button",
+								disabled: tokenDraft.trim() === "",
+								onClick: () => {
+									setAdminToken(tokenDraft);
+									setTokenDraft("");
+									load();
+								},
+								children: t("continue")
+							})
+						]
+					})
+				});
+				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "oc-page",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "oc-error",
+						children: error ?? t("failed")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "oc-button",
+						onClick: () => {
+							load();
+						},
+						children: t("refresh")
+					})]
+				});
+			}
 			const dirty = !safeSame(draft, draftOf(state));
 			const activeAccount = state.accounts.find((account) => account.active);
 			const defaultAccount = state.accounts.find((account) => account.default);
@@ -3245,6 +3378,84 @@ window.__ModuleLoader__.load({
 									value: draft.proxyUrl,
 									onChange: (value) => update({ proxyUrl: value })
 								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
+									label: t("proxyUsername"),
+									value: draft.proxyUsername,
+									onChange: (value) => update({ proxyUsername: value })
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									className: "oc-field",
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-label",
+											children: t("proxyPassword")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											className: "oc-input",
+											type: "password",
+											value: proxyPassword,
+											placeholder: state.proxy.configured ? t("proxyPasswordSet") : t("proxyPasswordUnset"),
+											onChange: (event) => setProxyPassword(event.target.value)
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-hint",
+											children: t("proxyPasswordHint")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: "oc-actions",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "oc-button",
+												disabled: proxyBusy || proxyPassword === "",
+												onClick: () => {
+													storeProxyPassword();
+												},
+												children: t("saveProxyPassword")
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "oc-button",
+												disabled: proxyBusy || !state.proxy.configured,
+												onClick: () => {
+													removeProxyPassword();
+												},
+												children: t("clearProxyPassword")
+											})]
+										})
+									]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									className: "oc-field",
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-label",
+											children: t("enabledRoutes")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: "oc-actions",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+													type: "checkbox",
+													checked: draft.consoleEnabled,
+													onChange: (event) => update({ consoleEnabled: event.target.checked })
+												}),
+												" ",
+												t("routeConsole")
+											] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+													type: "checkbox",
+													checked: draft.goEnabled,
+													onChange: (event) => update({ goEnabled: event.target.checked })
+												}),
+												" ",
+												t("routeGo")
+											] })]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "oc-hint",
+											children: t("enabledRoutesHint")
+										})
+									]
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
 									label: t("maxOutputTokens"),
 									type: "number",

package/lib/index.d.ts

@@ -24,6 +24,8 @@ interface Config {
   apiKeyEnv?: string;
   /** Literal key for composition config only; stripped from settings reads by `role('secret')`. */
   apiKey?: string;
+  /** Optional admin token for the Host HTTP routes; also read from `OPENCODE_ADMIN_TOKEN`. */
+  adminToken?: string;
   /** Console/Zen inference root; defaults to `https://opencode.ai/inference`. */
   apiBase?: string;
   /** Go inference root; defaults to `https://opencode.ai/inference/go`. */
@@ -50,6 +52,14 @@ interface Config {
   requestImageMaxBytes?: number;
   /** HTTP/HTTPS/SOCKS5 proxy for inference, catalog and usage requests. */
   proxyUrl?: string;
+  /** Proxy username; the password is resolved from `proxyPasswordRef`. */
+  proxyUsername?: string;
+  /** Credential reference for the proxy password. */
+  proxyPasswordRef?: string;
+  /** Enable the Go / Go Plus subscription route. */
+  goEnabled?: boolean;
+  /** Enable the Console / Zen pay-as-you-go route. */
+  consoleEnabled?: boolean;
   /** Live catalog cache lifetime in minutes; defaults to 10. */
   catalogRefreshMinutes?: number;
   /** Language for `/opencode` output; defaults to English. */
@@ -93,6 +103,7 @@ declare const Config: z<Config>;
 interface ResolvedConfig {
   apiKeyEnv: string;
   apiKey?: string;
+  adminToken: string;
   apiBase: string;
   goApiBase: string;
   goZenBase: string;
@@ -106,6 +117,10 @@ interface ResolvedConfig {
   requestImagePixelBudget: number;
   requestImageMaxBytes: number;
   proxyUrl: string;
+  proxyUsername: string;
+  proxyPasswordRef: string;
+  goEnabled: boolean;
+  consoleEnabled: boolean;
   catalogRefreshMinutes: number;
   commandLocale: CommandLocale;
   visibleModels: readonly string[];
@@ -408,6 +423,8 @@ interface RouteDeps {
   readonly analytics?: (days: number) => Promise<AnalyticsReport>;
   readonly heatmap?: (days: number) => Promise<RequestHeatmap>;
   readonly refreshTui?: () => void;
+  readonly syncRoutes?: () => void;
+  readonly adminToken?: () => string;
   /** Test seam; defaults to the local managed-credentials registry. */
   readonly managedPath?: string;
 }

package/lib/index.js

@@ -1,4 +1,6 @@
-import { createHash } from "node:crypto";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { appendFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
@@ -6,15 +8,14 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { LlmAdapter, LlmError, ReasoningEffortId, ToolCallId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import z from "@deepseek-ai/schemastery";
 import { ProxyAgent, Socks5ProxyAgent } from "undici";
-import { credentialRef } from "@deepseek-ai/dsh-credentials";
-import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { isIP } from "node:net";
 // src/proxy.ts
 /**
-* Proxy addresses are deliberately credential-free: the settings API returns
-* the configured address to the browser, so embedding a password would leak it.
+* Proxy addresses stay credential-free: the settings API returns the configured
+* address to the browser. Authentication is supplied separately from the
+* credential service and is only assembled in memory.
 */
 function normalizeProxyUrl(raw) {
 	const value = raw?.trim() ?? "";
@@ -31,7 +32,24 @@ function normalizeProxyUrl(raw) {
 		"socks5:"
 	].includes(url.protocol)) throw new Error("proxy address must use http://, https:// or socks5://");
 	if (url.hostname === "" || url.port === "0" || url.pathname !== "" && url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("proxy address must contain a host and optional port, without a path, query or fragment");
-	if (url.username !== "" || url.password !== "") throw new Error("proxy credentials are not supported; use a local proxy without authentication");
+	if (url.username !== "" || url.password !== "") throw new Error("proxy credentials must be set through the proxy username and password fields");
+	return url.href;
+}
+/** Validate a proxy username; the password lives in the credential service. */
+function normalizeProxyUsername(raw) {
+	const value = raw?.trim() ?? "";
+	if (value === "") return "";
+	if (value.length > 256 || value.includes(":") || /[\u0000-\u001f\u007f]/.test(value)) throw new Error("proxy username must be 1–256 characters without a colon or control characters");
+	return value;
+}
+/** Assemble the authenticated proxy URL in memory; never persist or return it. */
+function buildProxyUrl(address, username, password) {
+	const base = normalizeProxyUrl(address);
+	const user = normalizeProxyUsername(username);
+	if (base === "" || user === "") return base;
+	const url = new URL(base);
+	url.username = encodeURIComponent(user);
+	url.password = encodeURIComponent(password ?? "");
 	return url.href;
 }
 /**
@@ -43,7 +61,7 @@ function createProxyFetch(address, baseFetch = fetch) {
 	let disposed = false;
 	const wrapped = (async (input, init) => {
 		if (disposed) throw new Error("proxy transport is disposed");
-		const proxy = normalizeProxyUrl(address());
+		const proxy = normalizeProxyUrl(await address());
 		if (proxy === "") return baseFetch(input, init);
 		let agent = agents.get(proxy);
 		if (agent === void 0) {
@@ -81,7 +99,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.31";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.33";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 65536;
@@ -89,6 +107,7 @@ const DEFAULT_MAX_REQUEST_IMAGE_BYTES = 25165824;
 const DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 2458624;
 const DEFAULT_REQUEST_IMAGE_MAX_BYTES = 1048576;
 const DEFAULT_REQUEST_PREPARATION_TIMEOUT_MS = 6e4;
+const DEFAULT_PROXY_PASSWORD_REF = "OPENCODE_PROXY_PASSWORD";
 function markVolatile(schema) {
 	const mark = schema.volatile;
 	return typeof mark === "function" ? mark.call(schema) : schema;
@@ -96,6 +115,7 @@ function markVolatile(schema) {
 const Config = z.object({
 	apiKeyEnv: markVolatile(z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV)),
 	apiKey: z.string().role("secret"),
+	adminToken: z.string().role("secret").default(""),
 	apiBase: markVolatile(z.string().default(DEFAULT_API_BASE)),
 	goApiBase: markVolatile(z.string().default(DEFAULT_GO_API_BASE)),
 	goZenBase: markVolatile(z.string().default(DEFAULT_GO_ZEN_BASE)),
@@ -109,6 +129,10 @@ const Config = z.object({
 	requestImagePixelBudget: markVolatile(z.number().min(1).max(1e8).step(1).default(DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET)),
 	requestImageMaxBytes: markVolatile(z.number().min(1).max(1e8).step(1).default(DEFAULT_REQUEST_IMAGE_MAX_BYTES)),
 	proxyUrl: markVolatile(z.string().default("")),
+	proxyUsername: markVolatile(z.string().default("")),
+	proxyPasswordRef: markVolatile(z.string().role("credential-ref").default(DEFAULT_PROXY_PASSWORD_REF)),
+	goEnabled: markVolatile(z.boolean().default(true)),
+	consoleEnabled: markVolatile(z.boolean().default(true)),
 	catalogRefreshMinutes: markVolatile(z.number().min(1).max(10080).step(1).default(10)),
 	commandLocale: markVolatile(z.union(["en", "zh"]).default("en")),
 	visibleModels: markVolatile(z.array(z.string()).default([])),
@@ -216,6 +240,7 @@ function resolveConfig(config) {
 	return {
 		apiKeyEnv: typeof config.apiKeyEnv === "string" && config.apiKeyEnv.trim() !== "" ? config.apiKeyEnv.trim() : DEFAULT_API_KEY_ENV,
 		...apiKey === void 0 ? {} : { apiKey },
+		adminToken: typeof config.adminToken === "string" ? config.adminToken.trim() : "",
 		apiBase: typeof config.apiBase === "string" && config.apiBase !== "" ? config.apiBase : DEFAULT_API_BASE,
 		goApiBase: typeof config.goApiBase === "string" && config.goApiBase !== "" ? config.goApiBase : DEFAULT_GO_API_BASE,
 		goZenBase: typeof config.goZenBase === "string" && config.goZenBase !== "" ? config.goZenBase : DEFAULT_GO_ZEN_BASE,
@@ -229,6 +254,19 @@ function resolveConfig(config) {
 		requestImagePixelBudget: positiveInt(config.requestImagePixelBudget, DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET),
 		requestImageMaxBytes: positiveInt(config.requestImageMaxBytes, DEFAULT_REQUEST_IMAGE_MAX_BYTES),
 		proxyUrl: normalizeProxyUrl(config.proxyUrl),
+		proxyUsername: normalizeProxyUsername(config.proxyUsername),
+		proxyPasswordRef: typeof config.proxyPasswordRef === "string" && config.proxyPasswordRef.trim() !== "" ? config.proxyPasswordRef.trim() : DEFAULT_PROXY_PASSWORD_REF,
+		...(() => {
+			const goEnabled = config.goEnabled !== false;
+			const consoleEnabled = config.consoleEnabled !== false;
+			return goEnabled || consoleEnabled ? {
+				goEnabled,
+				consoleEnabled
+			} : {
+				goEnabled: true,
+				consoleEnabled: false
+			};
+		})(),
 		catalogRefreshMinutes: positiveInt(config.catalogRefreshMinutes, 10),
 		commandLocale: config.commandLocale === "zh" ? "zh" : "en",
 		visibleModels: Array.isArray(config.visibleModels) ? config.visibleModels.filter((id) => typeof id === "string" && id !== "") : [],
@@ -3501,6 +3539,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	}
 	async listModels(provider, opts) {
 		const config = this.deps.config();
+		if (isGoProvider(provider) ? !config.goEnabled : !config.consoleEnabled) return [];
 		let apiKey;
 		try {
 			apiKey = (await this.deps.resolveKey(provider)).key;
@@ -3524,6 +3563,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	}
 	async resolveModel(provider, model) {
 		const config = this.deps.config();
+		if (isGoProvider(provider) ? !config.goEnabled : !config.consoleEnabled) throw new Error(`OpenCode route "${provider}" is disabled`);
 		const meta = effectiveModel(model, config);
 		const maxTokens = effectiveMaxTokens(meta, config);
 		return {
@@ -3546,6 +3586,7 @@ var OpenCodeAdapter = class extends LlmAdapter {
 	async *run(options, fallback) {
 		const record = this.deps.recordRequest ?? ((provider, model, purpose, account, reason, outcome) => recordRequest(provider, model, outcome?.at ?? Date.now(), purpose, account, reason, outcome));
 		const config = this.deps.config();
+		if (isGoProvider(options.provider) ? !config.goEnabled : !config.consoleEnabled) throw new Error(`OpenCode route "${options.provider}" is disabled`);
 		const runStartedAt = Date.now();
 		const model = effectiveModel(options.model, config);
 		const sessionId = openCodeSessionId(options);
@@ -5035,6 +5076,10 @@ function publicConfig(config) {
 		requestImagePixelBudget: config.requestImagePixelBudget,
 		requestImageMaxBytes: config.requestImageMaxBytes,
 		proxyUrl: config.proxyUrl,
+		proxyUsername: config.proxyUsername,
+		proxyPasswordRef: config.proxyPasswordRef,
+		goEnabled: config.goEnabled,
+		consoleEnabled: config.consoleEnabled,
 		catalogRefreshMinutes: config.catalogRefreshMinutes,
 		commandLocale: config.commandLocale,
 		visibleModels: config.visibleModels,
@@ -5238,6 +5283,10 @@ function configOps(patch) {
 	if ("requestImagePixelBudget" in patch) set("requestImagePixelBudget", patch.requestImagePixelBudget);
 	if ("requestImageMaxBytes" in patch) set("requestImageMaxBytes", patch.requestImageMaxBytes);
 	if ("proxyUrl" in patch) set("proxyUrl", normalizeProxyUrl(typeof patch.proxyUrl === "string" ? patch.proxyUrl : ""));
+	if ("proxyUsername" in patch) set("proxyUsername", normalizeProxyUsername(typeof patch.proxyUsername === "string" ? patch.proxyUsername : ""));
+	if ("proxyPasswordRef" in patch) set("proxyPasswordRef", patch.proxyPasswordRef);
+	if ("goEnabled" in patch) set("goEnabled", patch.goEnabled === true);
+	if ("consoleEnabled" in patch) set("consoleEnabled", patch.consoleEnabled === true);
 	if ("catalogRefreshMinutes" in patch) set("catalogRefreshMinutes", patch.catalogRefreshMinutes);
 	if ("commandLocale" in patch) set("commandLocale", patch.commandLocale === "zh" ? "zh" : "en");
 	if ("visibleModels" in patch) set("visibleModels", cleanStringArray(patch.visibleModels));
@@ -5277,6 +5326,12 @@ async function buildState(ctx, deps) {
 			...info.source === void 0 ? {} : { source: info.source }
 		};
 	} catch {}
+	let proxyConfigured = false;
+	if (config.proxyUsername !== "" && credentials !== void 0) try {
+		proxyConfigured = (await credentials.describe(credentialRef(config.proxyPasswordRef))).configured;
+	} catch {
+		proxyConfigured = false;
+	}
 	const resolved = await deps.pool.resolveAll(GO_PROVIDER).catch(() => []);
 	if (!keyInfo.configured) keyInfo = {
 		...keyInfo,
@@ -5334,9 +5389,10 @@ async function buildState(ctx, deps) {
 			managed: slot.ref !== "" && managedRefs.has(slot.ref)
 		});
 	}
+	const listingProvider = config.goEnabled ? GO_PROVIDER : CONSOLE_PROVIDER;
 	let models = [];
 	try {
-		models = (await deps.adapter.listModels(GO_PROVIDER, { unfiltered: true })).map((model) => {
+		models = (await deps.adapter.listModels(listingProvider, { unfiltered: true })).map((model) => {
 			const meta = effectiveModel(model.id, config);
 			return {
 				id: model.id,
@@ -5351,8 +5407,8 @@ async function buildState(ctx, deps) {
 				input: meta.input,
 				reasoning: meta.reasoning,
 				visible: modelVisible(model.id, config),
-				...catalogReleaseDate("opencode-go-direct", model.id, config) === void 0 ? {} : { releaseDate: catalogReleaseDate(GO_PROVIDER, model.id, config) },
-				isNew: isNewRelease(catalogReleaseDate(GO_PROVIDER, model.id, config))
+				...catalogReleaseDate(listingProvider, model.id, config) === void 0 ? {} : { releaseDate: catalogReleaseDate(listingProvider, model.id, config) },
+				isNew: isNewRelease(catalogReleaseDate(listingProvider, model.id, config))
 			};
 		});
 	} catch {
@@ -5363,9 +5419,14 @@ async function buildState(ctx, deps) {
 	return {
 		config: publicConfig(config),
 		key: keyInfo,
+		proxy: {
+			configured: proxyConfigured,
+			username: config.proxyUsername,
+			passwordRef: config.proxyPasswordRef
+		},
 		accounts,
 		models,
-		catalog: catalogStatus(GO_PROVIDER, config, models.length),
+		catalog: catalogStatus(listingProvider, config, models.length),
 		usage: usage ?? null,
 		service: {
 			...usage?.checkedAt === void 0 ? {} : { usageCheckedAt: usage.checkedAt },
@@ -5382,6 +5443,16 @@ async function buildState(ctx, deps) {
 		revision: settingsRevision(ctx)
 	};
 }
+function adminAllowed(req, deps) {
+	const expected = deps.adminToken?.() ?? "";
+	if (expected === "") return true;
+	const header = req.headers["x-opencode-token"];
+	const authorization = req.headers.authorization;
+	const provided = typeof header === "string" && header !== "" ? header : typeof authorization === "string" && authorization.startsWith("Bearer ") ? authorization.slice(7).trim() : "";
+	const left = Buffer.from(expected);
+	const right = Buffer.from(provided);
+	return left.length === right.length && timingSafeEqual(left, right);
+}
 /** Register the Host HTTP surface consumed by the browser settings page. */
 function applyRoutes(ctx, web, deps) {
 	const disposers = [];
@@ -5389,7 +5460,16 @@ function applyRoutes(ctx, web, deps) {
 		disposers.push(web.register({
 			kind: "exact",
 			path,
-			handler
+			handler: async (req, res) => {
+				if (!adminAllowed(req, deps)) {
+					json(res, 401, {
+						error: "admin token required",
+						authRequired: true
+					});
+					return;
+				}
+				await handler(req, res);
+			}
 		}));
 	};
 	route("/dsh-opencode/state", async (req, res) => {
@@ -5501,6 +5581,7 @@ function applyRoutes(ctx, web, deps) {
 			await settings.mutate(NS, ops, revision);
 			deps.usage.clear();
 			deps.refreshTui?.();
+			deps.syncRoutes?.();
 			json(res, 200, { ok: true });
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "config write failed";
@@ -5552,6 +5633,50 @@ function applyRoutes(ctx, web, deps) {
 			json(res, 500, { error: error instanceof Error ? error.message : "key clear failed" });
 		}
 	});
+	route("/dsh-opencode/proxy-password", async (req, res) => {
+		if (!requirePost(req, res)) return;
+		const credentials = getCredentials(ctx);
+		if (credentials === void 0) {
+			json(res, 503, { error: "credentials service unavailable" });
+			return;
+		}
+		try {
+			const body = await readJson(req);
+			const password = typeof body.password === "string" ? body.password : "";
+			if (password === "") {
+				json(res, 400, { error: "proxy password is required" });
+				return;
+			}
+			const refName = deps.config().proxyPasswordRef;
+			await credentials.set(credentialRef(refName), password);
+			await addManagedCredentialRef(refName, deps.managedPath);
+			json(res, 200, {
+				ok: true,
+				ref: refName
+			});
+		} catch (error) {
+			json(res, 500, { error: error instanceof Error ? error.message : "proxy password write failed" });
+		}
+	});
+	route("/dsh-opencode/proxy-password/clear", async (req, res) => {
+		if (!requirePost(req, res)) return;
+		const credentials = getCredentials(ctx);
+		if (credentials === void 0) {
+			json(res, 503, { error: "credentials service unavailable" });
+			return;
+		}
+		try {
+			const refName = deps.config().proxyPasswordRef;
+			await credentials.unset(credentialRef(refName));
+			await removeManagedCredentialRef(refName, deps.managedPath);
+			json(res, 200, {
+				ok: true,
+				ref: refName
+			});
+		} catch (error) {
+			json(res, 500, { error: error instanceof Error ? error.message : "proxy password clear failed" });
+		}
+	});
 	route("/dsh-opencode/auth-import", async (req, res) => {
 		if (!requirePost(req, res)) return;
 		const credentials = getCredentials(ctx);
@@ -6114,7 +6239,19 @@ const inject = ["llm"];
 function apply(ctx, config) {
 	const current = () => resolveConfig(unwrapVolatileConfig(config));
 	const keys = createKeyPool(ctx, current);
-	const proxy = createProxyFetch(() => current().proxyUrl);
+	const proxy = createProxyFetch(async () => {
+		const config = current();
+		let password = "";
+		if (config.proxyUsername !== "") {
+			const credentials = ctx.get("credentials");
+			if (credentials?.resolve !== void 0) try {
+				password = (await credentials.resolve(credentialRef(config.proxyPasswordRef)))?.value ?? "";
+			} catch {
+				password = "";
+			}
+		}
+		return buildProxyUrl(config.proxyUrl, config.proxyUsername, password);
+	});
 	const usage = createUsageReader(current, (provider) => keys.resolve(provider), proxy.fetch);
 	const adapter = new OpenCodeAdapter({
 		config: current,
@@ -6127,19 +6264,30 @@ function apply(ctx, config) {
 	ctx.effect(() => () => {
 		proxy.dispose();
 	});
-	ctx.llm.registerConfigurableProviders([{
+	const providersFor = () => {
+		const config = current();
+		return [...config.consoleEnabled ? [CONSOLE_PROVIDER] : [], ...config.goEnabled ? [GO_PROVIDER] : []];
+	};
+	const entriesFor = (providers) => [...providers.includes("opencode-direct") ? [{
 		provider: CONSOLE_PROVIDER,
 		displayName: "OpenCode (plugin)",
 		settingsNs: NS,
 		settingsPath: []
-	}, {
+	}] : [], ...providers.includes("opencode-go-direct") ? [{
 		provider: GO_PROVIDER,
 		displayName: "OpenCode Go (plugin)",
 		settingsNs: NS,
 		settingsPath: []
-	}]);
-	ctx.llm.registerAdapter([CONSOLE_PROVIDER, GO_PROVIDER], adapter);
-	ctx.logger("llm-opencode").info(`registered providers: ${CONSOLE_PROVIDER}, ${GO_PROVIDER}`);
+	}] : []];
+	const directory = ctx.llm.registerConfigurableProviders(entriesFor(providersFor()));
+	const registration = ctx.llm.registerAdapter(providersFor(), adapter);
+	const syncRoutes = () => {
+		const providers = providersFor();
+		registration.replace(providers);
+		directory.replace(entriesFor(providers));
+		ctx.logger("llm-opencode").info(`enabled providers: ${providers.join(", ")}`);
+	};
+	ctx.logger("llm-opencode").info(`registered providers: ${providersFor().join(", ")}`);
 	ctx.inject(["settings"], (settingsCtx) => {
 		settingsCtx.settings.configure({ auto: false }, ctx.fiber);
 	});
@@ -6183,7 +6331,9 @@ function apply(ctx, config) {
 			pool: keys,
 			usage,
 			heatmap: readRequestHeatmap,
-			refreshTui: () => refreshTuiSettings?.()
+			refreshTui: () => refreshTuiSettings?.(),
+			syncRoutes,
+			adminToken: () => current().adminToken || launchEnvironmentOf(ctx).get("OPENCODE_ADMIN_TOKEN")?.value || ""
 		});
 		webCtx.effect(() => registerPluginUpdater(webCtx, {
 			endpoint: "/dsh-opencode/update",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-opencode-provider",
-  "version": "0.5.31",
+  "version": "0.5.33",
   "description": "OpenCode / OpenCode Go LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",