@moxxy/plugin-provider-acp 0.0.0-stage → 0.45.0

package/src/fixtures/acp-session-updates.json

@@ -0,0 +1,19 @@
+{
+  "source": "Agent Client Protocol schema, SessionUpdate (agentclientprotocol.com/protocol/schema, read 2026-10-15); OpenCode 1.19 sends agent_message_chunk, agent_thought_chunk, tool_call, tool_call_update, plan, available_commands_update, config_option_update and usage_update",
+  "updates": [
+    "agent_message_chunk",
+    "agent_thought_chunk",
+    "available_commands_update",
+    "compaction_summary_chunk",
+    "compaction_update",
+    "config_option_update",
+    "current_mode_update",
+    "notice",
+    "plan",
+    "session_info_update",
+    "tool_call",
+    "tool_call_update",
+    "usage_update",
+    "user_message_chunk"
+  ]
+}

package/src/index.test.ts

@@ -0,0 +1,69 @@
+/** The plugin entry: OpenCode is ready once installed, offers its own models, and ends with the conversation. */
+import { describe, expect, it } from 'vitest';
+import { collectTurn } from '@moxxy/core';
+import { assertDefined } from '@moxxy/sdk';
+import { createFakeSession } from '@moxxy/testing';
+import { defaultModePlugin } from '@moxxy/mode-default';
+import { AcpAgentProvider, acpSessions, acpAgentPlugin, opencodeProviderDef, __setOpenCodeCommandRunner } from './index.js';
+import { FakeOpenCode } from './fake-opencode.testkit.js';
+
+const resolveHost = { cwd: '/work/app' } as never;
+
+describe('the OpenCode plugin', () => {
+  it('offers the models the person OpenCode can run once it is switched on', async () => {
+    __setOpenCodeCommandRunner(async (_executable, args) =>
+      args[0] === 'models'
+        ? { code: 0, stdout: 'opencode/big-pickle\nopenai/gpt-6-luna\n', stderr: '' }
+        : { code: 0, stdout: '●  OpenAI oauth\n└  1 credentials\n', stderr: '' },
+    );
+    const resolve = opencodeProviderDef.resolveCredentials;
+    assertDefined(resolve, 'resolveCredentials');
+
+    const config = await resolve({ providerConfig: { model: 'openai/gpt-6-luna' }, host: resolveHost } as never);
+    const client = opencodeProviderDef.createClient(config);
+
+    expect(config).toMatchObject({ cwd: '/work/app', executable: 'opencode', models: ['opencode/big-pickle', 'openai/gpt-6-luna'] });
+    expect(client.models.map((model) => model.id)).toEqual(['openai/gpt-6-luna', 'opencode/big-pickle']);
+  });
+
+  it('lists the models the person OpenCode offers without switching it on', async () => {
+    __setOpenCodeCommandRunner(async (_executable, args) =>
+      args[0] === 'models' ? { code: 0, stdout: 'opencode/big-pickle\nopenai/gpt-6-luna\n', stderr: '' } : { code: 1, stdout: '', stderr: '' },
+    );
+    const models = opencodeProviderDef.agentCli?.models;
+    assertDefined(models, 'agentCli.models');
+
+    const offered = await models();
+
+    expect(offered.map((model) => model.id)).toEqual(['opencode/big-pickle', 'openai/gpt-6-luna']);
+    expect(offered.every((model) => model.contextWindow === 200_000)).toBe(true);
+  });
+
+  it('offers only the free model OpenCode keeps before it is switched on, not a promotional one that comes and goes', () => {
+    expect(opencodeProviderDef.models.map((model) => model.id)).toEqual(['opencode/big-pickle']);
+  });
+
+  it('will not switch on when OpenCode is not installed', async () => {
+    __setOpenCodeCommandRunner(async () => ({ code: 1, stdout: '', stderr: '', error: Object.assign(new Error('ENOENT'), { code: 'ENOENT' }) }));
+    const resolve = opencodeProviderDef.resolveCredentials;
+    assertDefined(resolve, 'resolveCredentials');
+
+    await expect(resolve({ providerConfig: {}, host: resolveHost } as never)).rejects.toThrow(/Install OpenCode/);
+  });
+
+  it('closes the conversation OpenCode when the conversation shuts down', async () => {
+    const opencode = new FakeOpenCode(async (turn) => turn.say('hi'));
+    const provider = new AcpAgentProvider({ startAgent: opencode.start });
+    const session = createFakeSession({ provider, plugins: [defaultModePlugin] });
+    await collectTurn(session, 'hello');
+    expect(acpSessions().size).toBe(1);
+
+    const onShutdown = acpAgentPlugin.hooks?.onShutdown;
+    assertDefined(onShutdown, 'the plugin onShutdown hook');
+    await onShutdown(session.appContext());
+
+    expect(opencode.last.closed).toBe(true);
+    expect(acpSessions().size).toBe(0);
+    await session.close();
+  });
+});

package/src/index.ts

@@ -0,0 +1,83 @@
+import { defineProvider, definePlugin } from '@moxxy/sdk';
+import { OPENCODE_CLI, checkAgentCli } from '@moxxy/agent-connection-kit';
+import { OPENCODE_FREE_MODELS, OPENCODE_PROVIDER_ID, OPENCODE_SERVICE_NAME } from './constants.js';
+import { OPENCODE_AGENT } from './agents.js';
+import { acpModel, acpSessions, createAcpAgentClient, type AcpAgentProviderConfig } from './agent-provider.js';
+import { authError, checkOpenCode, listOpenCodeModels, opencodeLogin, opencodeLogout, opencodeStatus, openCodeSignIn, readOpenCodeRules, resolveOpenCodeExecutable } from './login.js';
+import { openCodeOwnAutoApprove } from './rules.js';
+
+export const opencodeProviderDef = defineProvider({
+  name: OPENCODE_PROVIDER_ID,
+  agentName: OPENCODE_AGENT.label,
+  models: OPENCODE_FREE_MODELS.map(acpModel),
+  agentCli: {
+    check: (opts) => {
+      const command = resolveOpenCodeExecutable();
+      return checkAgentCli(OPENCODE_CLI, { command, refresh: opts?.refresh === true }, { signIn: () => openCodeSignIn(command) });
+    },
+    models: async () => (await listOpenCodeModels(resolveOpenCodeExecutable())).map(acpModel),
+  },
+  ownAutoApprove: ({ cwd }) => openCodeOwnAutoApprove(cwd, readOpenCodeRules(resolveOpenCodeExecutable())),
+  createClient: (config) => createAcpAgentClient(providerConfigFrom(config)),
+  async resolveCredentials({ providerConfig, host }) {
+    const config = { ...providerConfig, cwd: host.cwd };
+    const executable = resolveOpenCodeExecutable(config);
+    const status = await checkOpenCode(executable);
+    if (status.state !== 'signed-in') throw authError(status);
+    // The picker offers exactly what the person's OpenCode can run.
+    return { ...config, executable, models: await listOpenCodeModels(executable) };
+  },
+  // No validateKey: readiness is reported by the installed OpenCode.
+  auth: {
+    kind: 'oauth',
+    serviceName: OPENCODE_SERVICE_NAME,
+    login: opencodeLogin,
+    logout: opencodeLogout,
+    status: opencodeStatus,
+  },
+});
+
+export const acpAgentPlugin = definePlugin({
+  name: '@moxxy/plugin-provider-acp',
+  version: '0.0.0',
+  providers: [opencodeProviderDef],
+  hooks: {
+    // The conversation's agent ends with it; its session stays saved by the agent, to load.
+    onShutdown: (ctx) => acpSessions().close(String(ctx.sessionId)),
+  },
+});
+
+export default acpAgentPlugin;
+
+function providerConfigFrom(config: Readonly<Record<string, unknown>>): AcpAgentProviderConfig {
+  const text = (key: string) => (typeof config[key] === 'string' && config[key] !== '' ? (config[key] as string) : undefined);
+  const executable = text('executable');
+  const model = text('model');
+  const defaultModel = text('defaultModel');
+  const cwd = text('cwd');
+  const models = Array.isArray(config.models) ? config.models.filter((id): id is string => typeof id === 'string' && id !== '') : [];
+  return {
+    ...(executable ? { executable } : {}),
+    ...(model ? { model } : {}),
+    ...(defaultModel ? { defaultModel } : {}),
+    ...(cwd ? { cwd } : {}),
+    ...(models.length > 0 ? { models } : {}),
+  };
+}
+
+export { OPENCODE_PROVIDER_ID, OPENCODE_SERVICE_NAME, OPENCODE_EXECUTABLE_ENV, OPENCODE_DEFAULT_MODEL, OPENCODE_FREE_MODELS } from './constants.js';
+export { OPENCODE_AGENT, type AcpAgentSpec } from './agents.js';
+export { AcpAgentProvider, acpModel, acpSessions, createAcpAgentClient, type AcpAgentProviderConfig } from './agent-provider.js';
+export type { AcpConnection, StartAcpAgent } from './acp-session.js';
+export { opencodeTarget, spawnOpenCodeAcp } from './executable.js';
+export {
+  __setOpenCodeCommandRunner,
+  checkOpenCode,
+  listOpenCodeModels,
+  opencodeLogin,
+  opencodeLogout,
+  opencodeStatus,
+  resolveOpenCodeExecutable,
+  type OpenCodeState,
+  type OpenCodeStatus,
+} from './login.js';

package/src/login.test.ts

@@ -0,0 +1,155 @@
+/** Sign-in, status and models come from the person's own `opencode` CLI; the CLI is the boundary stood in for here. */
+import { afterEach, describe, expect, it } from 'vitest';
+import { MoxxyError, type ProviderAuthContext } from '@moxxy/sdk';
+import {
+  __setOpenCodeCommandRunner,
+  checkOpenCode,
+  listOpenCodeModels,
+  opencodeLogin,
+  opencodeStatus,
+  readOpenCodeMcpServers,
+  readOpenCodeRules,
+  resolveOpenCodeExecutable,
+  type OpenCodeCommandResult,
+} from './login.js';
+
+const AUTH_LIST_ONE = '\u001b[0m\n┌  Credentials \u001b[90m~/.local/share/opencode/auth.json\n│\n●  OpenAI \u001b[90moauth\n│\n└  1 credentials\n';
+const AUTH_LIST_NONE = '\u001b[0m\n┌  Credentials \u001b[90m~/.local/share/opencode/auth.json\n│\n└  0 credentials\n';
+const MODELS = 'opencode/big-pickle\nopencode/space-bunny-free\nopenai/gpt-6-luna\n';
+
+const calls: Array<{ executable: string; args: readonly string[]; inherit: boolean; cwd?: string }> = [];
+function answer(results: Record<string, OpenCodeCommandResult>): void {
+  __setOpenCodeCommandRunner(async (executable, args, options = {}) => {
+    calls.push({ executable, args, inherit: options.inherit === true, ...(options.cwd ? { cwd: options.cwd } : {}) });
+    const result = results[args.join(' ')];
+    if (!result) throw new Error(`unexpected command: ${args.join(' ')}`);
+    return result;
+  });
+}
+const ok = (stdout: string): OpenCodeCommandResult => ({ code: 0, stdout, stderr: '' });
+const missing: OpenCodeCommandResult = { code: 1, stdout: '', stderr: '', error: Object.assign(new Error('spawn opencode ENOENT'), { code: 'ENOENT' }) };
+const ctx = (over: Partial<ProviderAuthContext> = {}): ProviderAuthContext =>
+  ({ vault: {} as never, headless: false, write: () => undefined, ...over }) as ProviderAuthContext;
+
+afterEach(() => {
+  calls.length = 0;
+  delete process.env.OPENCODE_EXECUTABLE;
+});
+
+describe('OpenCode readiness', () => {
+  it('is ready once installed, naming the providers it is signed in to', async () => {
+    answer({ 'auth list': ok(AUTH_LIST_ONE) });
+
+    expect(await checkOpenCode('opencode')).toEqual({
+      state: 'signed-in',
+      executable: 'opencode',
+      accountId: 'OpenAI',
+      message: 'OpenCode is ready, signed in to OpenAI.',
+    });
+  });
+
+  it('is ready without any sign-in, since its free models need none', async () => {
+    answer({ 'auth list': ok(AUTH_LIST_NONE) });
+
+    const status = await checkOpenCode('opencode');
+
+    expect(status.state).toBe('signed-in');
+    expect(status.accountId).toBeUndefined();
+    expect(status.message).toContain('opencode auth login');
+  });
+
+  it('says how to install OpenCode when it is missing', async () => {
+    answer({ 'auth list': missing });
+
+    expect(await checkOpenCode('opencode')).toMatchObject({ state: 'missing', message: expect.stringContaining('OPENCODE_EXECUTABLE') });
+  });
+
+  it('finds OpenCode through the provider config, then OPENCODE_EXECUTABLE, then PATH', () => {
+    process.env.OPENCODE_EXECUTABLE = '/opt/opencode';
+    expect(resolveOpenCodeExecutable({ executable: '/custom/opencode' })).toBe('/custom/opencode');
+    expect(resolveOpenCodeExecutable({})).toBe('/opt/opencode');
+    delete process.env.OPENCODE_EXECUTABLE;
+    expect(resolveOpenCodeExecutable({})).toBe('opencode');
+  });
+
+  it('reports the status for the status surfaces', async () => {
+    answer({ 'auth list': ok(AUTH_LIST_ONE) });
+
+    expect(await opencodeStatus(ctx())).toEqual({ accountId: 'OpenAI', authState: 'signed-in', message: 'OpenCode is ready, signed in to OpenAI.' });
+  });
+});
+
+describe('OpenCode models', () => {
+  it('lists the models the person OpenCode offers', async () => {
+    answer({ models: ok(`${MODELS}\n`) });
+
+    expect(await listOpenCodeModels('opencode')).toEqual(['opencode/big-pickle', 'opencode/space-bunny-free', 'openai/gpt-6-luna']);
+  });
+
+  it('lists none when OpenCode cannot say', async () => {
+    answer({ models: { code: 1, stdout: '', stderr: 'boom' } });
+
+    expect(await listOpenCodeModels('opencode')).toEqual([]);
+  });
+});
+
+describe('signing OpenCode in to a model provider', () => {
+  it('hands the terminal to `opencode auth login`, where OpenCode asks which provider', async () => {
+    answer({ 'auth list': ok(AUTH_LIST_ONE), 'auth login': ok('') });
+
+    const result = await opencodeLogin(ctx());
+
+    expect(calls.find((call) => call.args.join(' ') === 'auth login')).toMatchObject({ inherit: true });
+    expect(result).toEqual({ accountId: 'OpenAI' });
+  });
+
+  it('asks a window without a terminal to have the person run it in a terminal', async () => {
+    answer({ 'auth list': ok(AUTH_LIST_NONE) });
+
+    await expect(opencodeLogin(ctx({ noOpen: true }))).rejects.toThrow(MoxxyError);
+    await expect(opencodeLogin(ctx({ noOpen: true }))).rejects.toMatchObject({ hint: expect.stringContaining('opencode auth login') });
+    expect(calls.some((call) => call.args.join(' ') === 'auth login')).toBe(false);
+  });
+});
+
+describe('how the person OpenCode runs', () => {
+  it('reads an agent rules in the conversation folder, where project config applies', async () => {
+    const agent = { name: 'build', mode: 'primary', permission: [{ permission: '*', action: 'allow', pattern: '*' }, { permission: 'bash', pattern: 'git push *', action: 'deny' }] };
+    answer({ 'debug agent build': ok(JSON.stringify(agent, null, 2)) });
+
+    const rules = await readOpenCodeRules('opencode')({ cwd: '/work/app', agent: 'build' });
+
+    expect(rules).toEqual([
+      { permission: '*', pattern: '*', action: 'allow' },
+      { permission: 'bash', pattern: 'git push *', action: 'deny' },
+    ]);
+    expect(calls[0]).toMatchObject({ args: ['debug', 'agent', 'build'], cwd: '/work/app' });
+  });
+
+  it('cannot say when OpenCode fails or prints something else', async () => {
+    answer({ 'debug agent build': { code: 1, stdout: '', stderr: 'Error: Configuration is invalid' }, 'debug agent plan': ok('not json') });
+
+    expect(await readOpenCodeRules('opencode')({ cwd: '/w', agent: 'build' })).toBeUndefined();
+    expect(await readOpenCodeRules('opencode')({ cwd: '/w', agent: 'plan' })).toBeUndefined();
+  });
+});
+
+describe("the person's own OpenCode MCP servers", () => {
+  it('are the switched-on servers of the config OpenCode resolves where the turn runs', async () => {
+    const config = { mcp: { vault: { type: 'local', command: ['node', 'x.mjs'] }, off: { type: 'local', command: ['node', 'y.mjs'], enabled: false } } };
+    answer({ 'debug config': ok(JSON.stringify(config, null, 2)) });
+
+    const servers = await readOpenCodeMcpServers('opencode')({ cwd: '/work/app' });
+
+    expect(servers).toEqual(['vault']);
+    expect(calls[0]).toMatchObject({ args: ['debug', 'config'], cwd: '/work/app' });
+  });
+
+  it('cannot say when OpenCode fails or prints something else', async () => {
+    answer({ 'debug config': { code: 1, stdout: '', stderr: 'Error: Configuration is invalid' } });
+    expect(await readOpenCodeMcpServers('opencode')({ cwd: '/w' })).toBeUndefined();
+
+    answer({ 'debug config': ok('not json') });
+    expect(await readOpenCodeMcpServers('opencode')({ cwd: '/w' })).toBeUndefined();
+  });
+});

package/src/login.ts

@@ -0,0 +1,222 @@
+import type { AgentSignIn } from '@moxxy/agent-connection-kit';
+import { MoxxyError } from '@moxxy/sdk';
+import { spawnExecutableTarget } from '@moxxy/sdk/server';
+import type { ProviderAuthContext, ProviderOAuthResult, ProviderOAuthStatus } from '@moxxy/sdk';
+import {
+  OPENCODE_DEBUG_AGENT_ARGS,
+  OPENCODE_DEBUG_CONFIG_ARGS,
+  OPENCODE_AUTH_LIST_ARGS,
+  OPENCODE_AUTH_LOGIN_ARGS,
+  OPENCODE_AUTH_LOGOUT_ARGS,
+  OPENCODE_EXECUTABLE_ENV,
+  OPENCODE_MODELS_ARGS,
+  OPENCODE_PROVIDER_ID,
+} from './constants.js';
+import { opencodeTarget } from './executable.js';
+import type { OpenCodeRule, ReadAgentMcpServers, ReadAgentRules } from './rules.js';
+
+export type OpenCodeState = 'signed-in' | 'missing' | 'error';
+
+export interface OpenCodeStatus {
+  readonly state: OpenCodeState;
+  readonly executable: string;
+  /** The model providers OpenCode is signed in to (`OpenAI, Anthropic`). */
+  readonly accountId?: string;
+  readonly message: string;
+}
+
+export interface OpenCodeCommandResult {
+  readonly code: number;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly error?: NodeJS.ErrnoException;
+}
+
+interface CommandOptions {
+  /** Hand OpenCode the terminal (its interactive provider picker). */
+  readonly inherit?: boolean;
+  /** Where OpenCode runs, so the project's own config applies. */
+  readonly cwd?: string;
+}
+
+type CommandRunner = (executable: string, args: readonly string[], options?: CommandOptions) => Promise<OpenCodeCommandResult>;
+
+const ANSI = /\u001b\[[0-9;]*m/g;
+const CREDENTIAL = /^●\s+(.+?)\s+\S+$/;
+const MODEL_ID = /^[\w.@-]+\/\S+$/;
+const LOGIN_HINT = 'Run `opencode auth login` in a terminal to sign OpenCode in to a model provider.';
+
+let runCommandImpl: CommandRunner = runCommand;
+/** Test seam. */
+export function __setOpenCodeCommandRunner(runner: CommandRunner): void {
+  runCommandImpl = runner;
+}
+
+export function resolveOpenCodeExecutable(config: Readonly<Record<string, unknown>> = {}): string {
+  const configured = config.executable;
+  if (typeof configured === 'string' && configured.trim()) return configured;
+  return process.env[OPENCODE_EXECUTABLE_ENV]?.trim() || 'opencode';
+}
+
+/**
+ * Whether the person's OpenCode can work, read from `opencode auth list`.
+ * Installed is enough: OpenCode's free models need no sign-in, and the
+ * providers it is signed in to are named. Moxxy never touches its tokens.
+ */
+export async function checkOpenCode(executable = resolveOpenCodeExecutable()): Promise<OpenCodeStatus> {
+  const result = await runCommandImpl(executable, OPENCODE_AUTH_LIST_ARGS);
+  if (result.error?.code === 'ENOENT') {
+    return { state: 'missing', executable, message: `OpenCode not found: ${executable}. Install OpenCode or set ${OPENCODE_EXECUTABLE_ENV}.` };
+  }
+  if (result.error || result.code !== 0) {
+    const detail = result.error?.message ?? (result.stderr.trim() || `exit code ${result.code}`);
+    return { state: 'error', executable, message: `Could not run OpenCode: ${detail}` };
+  }
+  const providers = result.stdout
+    .replace(ANSI, '')
+    .split('\n')
+    .flatMap((line) => {
+      const match = CREDENTIAL.exec(line.trim());
+      return match?.[1] ? [match[1]] : [];
+    });
+  if (providers.length === 0) {
+    return { state: 'signed-in', executable, message: `OpenCode is ready with its free models. ${LOGIN_HINT}` };
+  }
+  const accountId = providers.join(', ');
+  return { state: 'signed-in', executable, accountId, message: `OpenCode is ready, signed in to ${accountId}.` };
+}
+
+/** Who OpenCode is signed in to, for the connection's row; its free models need no sign-in. */
+export async function openCodeSignIn(executable = resolveOpenCodeExecutable()): Promise<AgentSignIn> {
+  const status = await checkOpenCode(executable);
+  return { signedIn: status.state === 'signed-in', ...(status.accountId ? { account: status.accountId } : {}) };
+}
+
+/** The models the person's OpenCode offers (`opencode models`); none when it cannot say. */
+export async function listOpenCodeModels(executable = resolveOpenCodeExecutable()): Promise<string[]> {
+  const result = await runCommandImpl(executable, OPENCODE_MODELS_ARGS);
+  if (result.error || result.code !== 0) return [];
+  return result.stdout
+    .replace(ANSI, '')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => MODEL_ID.test(line));
+}
+
+/** The rules of one of the person's OpenCode agents (`opencode debug agent <name>`), read where the conversation runs. */
+export function readOpenCodeRules(executable = resolveOpenCodeExecutable()): ReadAgentRules {
+  return async ({ cwd, agent }) => {
+    const result = await runCommandImpl(executable, [...OPENCODE_DEBUG_AGENT_ARGS, agent], { cwd });
+    if (result.error || result.code !== 0) return undefined;
+    try {
+      const { permission } = JSON.parse(result.stdout) as { permission?: unknown };
+      return Array.isArray(permission) ? permission.filter(isRule) : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+}
+
+/** The person's own MCP servers that are on, from the config OpenCode resolves in `cwd` (`opencode debug config`). */
+export function readOpenCodeMcpServers(executable = resolveOpenCodeExecutable()): ReadAgentMcpServers {
+  return async ({ cwd }) => {
+    const result = await runCommandImpl(executable, [...OPENCODE_DEBUG_CONFIG_ARGS], { cwd });
+    if (result.error || result.code !== 0) return undefined;
+    try {
+      const { mcp } = JSON.parse(result.stdout) as { mcp?: Record<string, { enabled?: unknown } | null> };
+      return Object.entries(mcp ?? {}).flatMap(([name, server]) => (server?.enabled === false ? [] : [name]));
+    } catch {
+      return undefined;
+    }
+  };
+}
+
+function isRule(value: unknown): value is OpenCodeRule {
+  const rule = value as Partial<OpenCodeRule> | null;
+  return (
+    typeof rule === 'object' && rule !== null && typeof rule.permission === 'string' && typeof rule.pattern === 'string'
+    && (rule.action === 'allow' || rule.action === 'ask' || rule.action === 'deny')
+  );
+}
+
+export async function opencodeLogin(ctx: ProviderAuthContext): Promise<ProviderOAuthResult> {
+  const executable = resolveOpenCodeExecutable(ctx.providerConfig);
+  const before = await checkOpenCode(executable);
+  if (before.state !== 'signed-in') throw authError(before);
+  // OpenCode asks which provider and how in its own terminal picker; a window cannot answer it.
+  if (ctx.noOpen) {
+    throw new MoxxyError({
+      code: 'AUTH_NO_CREDENTIALS',
+      message: 'OpenCode signs in to model providers in a terminal.',
+      hint: LOGIN_HINT,
+      context: { provider: OPENCODE_PROVIDER_ID },
+    });
+  }
+  const login = await runCommandImpl(executable, OPENCODE_AUTH_LOGIN_ARGS, { inherit: true });
+  if (login.error) throw authError({ state: login.error.code === 'ENOENT' ? 'missing' : 'error', executable, message: login.error.message });
+  if (login.code !== 0) {
+    throw new MoxxyError({
+      code: 'AUTH_DENIED',
+      message: `OpenCode login failed with exit code ${login.code}.`,
+      hint: 'Run `opencode auth login` directly for more detail, then retry.',
+      context: { provider: OPENCODE_PROVIDER_ID },
+    });
+  }
+  const after = await checkOpenCode(executable);
+  if (after.state !== 'signed-in') throw authError(after);
+  return { accountId: after.accountId ?? null };
+}
+
+export async function opencodeLogout(ctx: ProviderAuthContext): Promise<boolean> {
+  const executable = resolveOpenCodeExecutable(ctx.providerConfig);
+  const before = await checkOpenCode(executable);
+  if (before.state !== 'signed-in' || before.accountId === undefined) return false;
+  if (ctx.noOpen) {
+    throw new MoxxyError({
+      code: 'AUTH_INVALID',
+      message: 'OpenCode signs out of model providers in a terminal.',
+      hint: 'Run `opencode auth logout` in a terminal.',
+      context: { provider: OPENCODE_PROVIDER_ID },
+    });
+  }
+  const result = await runCommandImpl(executable, OPENCODE_AUTH_LOGOUT_ARGS, { inherit: true });
+  if (result.error || result.code !== 0) {
+    throw new MoxxyError({ code: 'AUTH_INVALID', message: `OpenCode logout failed${result.stderr ? `: ${result.stderr}` : '.'}` });
+  }
+  return true;
+}
+
+export async function opencodeStatus(ctx: ProviderAuthContext): Promise<ProviderOAuthStatus | null> {
+  const status = await checkOpenCode(resolveOpenCodeExecutable(ctx.providerConfig));
+  return { accountId: status.accountId ?? null, authState: status.state, message: status.message };
+}
+
+export function authError(status: OpenCodeStatus): MoxxyError {
+  return new MoxxyError({
+    code: 'AUTH_INVALID',
+    message: status.message,
+    context: { provider: OPENCODE_PROVIDER_ID, executable: status.executable, state: status.state },
+  });
+}
+
+async function runCommand(executable: string, args: readonly string[], options: CommandOptions = {}): Promise<OpenCodeCommandResult> {
+  let target;
+  try {
+    target = opencodeTarget(executable);
+  } catch (err) {
+    const error = Object.assign(err instanceof Error ? err : new Error(String(err)), { code: 'ENOENT' }) as NodeJS.ErrnoException;
+    return { code: 1, stdout: '', stderr: '', error };
+  }
+  return await new Promise((resolve) => {
+    const where = options.cwd ? { cwd: options.cwd } : {};
+    const child = spawnExecutableTarget(target, [...args], options.inherit ? { ...where, stdio: 'inherit' } : { ...where, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.setEncoding('utf8');
+    child.stderr?.setEncoding('utf8');
+    child.stdout?.on('data', (chunk: string) => (stdout += chunk));
+    child.stderr?.on('data', (chunk: string) => (stderr += chunk));
+    child.once('error', (error: NodeJS.ErrnoException) => resolve({ code: 1, stdout, stderr, error }));
+    child.once('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  });
+}

package/src/opencode-api.ts

@@ -0,0 +1,105 @@
+/**
+ * OpenCode's own HTTP API, which `opencode acp` serves beside ACP. ACP does
+ * not report what a subagent does nor when a subagent working in the
+ * background ends, and has no way to stop one; this API has both: its event
+ * stream (`GET /event`) and `POST /session/{id}/abort`.
+ */
+
+/** Where the API of one running `opencode acp` is, and the credentials Moxxy started it with. */
+export interface OpenCodeApi {
+  readonly url: string;
+  /** The `Authorization` header value. */
+  readonly authorization: string;
+}
+
+/** One event of OpenCode's stream (`session.status`, `message.part.updated`, …). */
+export interface OpenCodeEvent {
+  readonly type: string;
+  readonly properties: Record<string, unknown>;
+}
+
+export interface OpenCodeEventWatch {
+  close(): void;
+}
+
+/** How long to wait before connecting again after the stream failed or ended. */
+const RECONNECT_MS = 250;
+
+/**
+ * Read OpenCode's event stream for the project `directory` until closed,
+ * connecting again whenever it ends (OpenCode serves the API a moment after it
+ * starts). `onConnected` is told each time the stream is up.
+ */
+export function watchOpenCodeEvents(
+  api: OpenCodeApi,
+  directory: string,
+  onEvent: (event: OpenCodeEvent) => void,
+  opts: { readonly onConnected?: () => void; readonly onDisconnected?: () => void } = {},
+): OpenCodeEventWatch {
+  const stop = new AbortController();
+  void (async () => {
+    while (!stop.signal.aborted) {
+      try {
+        const response = await fetch(`${api.url}/event?directory=${encodeURIComponent(directory)}`, {
+          headers: { Authorization: api.authorization, Accept: 'text/event-stream' },
+          signal: stop.signal,
+        });
+        if (response.ok && response.body) {
+          opts.onConnected?.();
+          await readEvents(response.body, onEvent);
+          opts.onDisconnected?.();
+        }
+      } catch {
+        // Not up yet, or gone: try again below while the watch is open.
+      }
+      if (stop.signal.aborted) return;
+      await new Promise((resolve) => setTimeout(resolve, RECONNECT_MS));
+    }
+  })();
+  return { close: () => stop.abort() };
+}
+
+/** Stop what an OpenCode session runs (a subagent's session too). False when OpenCode could not be asked or refused. */
+export async function abortOpenCodeSession(api: OpenCodeApi, directory: string, sessionId: string): Promise<boolean> {
+  try {
+    const response = await fetch(`${api.url}/session/${encodeURIComponent(sessionId)}/abort?directory=${encodeURIComponent(directory)}`, {
+      method: 'POST',
+      headers: { Authorization: api.authorization },
+    });
+    return response.ok && (await response.json().catch(() => false)) === true;
+  } catch {
+    return false;
+  }
+}
+
+/** Server-sent events: each event's `data:` lines are one JSON object. */
+async function readEvents(body: ReadableStream<Uint8Array>, onEvent: (event: OpenCodeEvent) => void): Promise<void> {
+  const decoder = new TextDecoder();
+  let buffer = '';
+  for await (const chunk of body as unknown as AsyncIterable<Uint8Array>) {
+    buffer += decoder.decode(chunk, { stream: true }).replace(/\r\n/g, '\n');
+    for (let end = buffer.indexOf('\n\n'); end >= 0; end = buffer.indexOf('\n\n')) {
+      const block = buffer.slice(0, end);
+      buffer = buffer.slice(end + 2);
+      const data = block
+        .split('\n')
+        .filter((line) => line.startsWith('data:'))
+        .map((line) => line.slice(5).trimStart())
+        .join('\n');
+      const event = parseEvent(data);
+      if (event) onEvent(event);
+    }
+  }
+}
+
+function parseEvent(data: string): OpenCodeEvent | undefined {
+  if (!data) return undefined;
+  try {
+    const value = JSON.parse(data) as { type?: unknown; properties?: unknown };
+    if (typeof value.type !== 'string') return undefined;
+    const properties = typeof value.properties === 'object' && value.properties !== null ? (value.properties as Record<string, unknown>) : {};
+    return { type: value.type, properties };
+  } catch {
+    return undefined;
+  }
+}