@neurocode-ai/core 1.18.8

package/src/plugin/provider/gitlab.ts

@@ -0,0 +1,65 @@
+import os from "os"
+import { InstallationVersion } from "../../installation/version"
+import { Effect } from "effect"
+import { define } from "../internal"
+import { ProviderV2 } from "../../provider"
+
+export const GitLabPlugin = define({
+  id: "gitlab",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.package !== "gitlab-ai-provider") return
+        const mod = yield* Effect.promise(() => import("gitlab-ai-provider"))
+        evt.sdk = mod.createGitLab({
+          ...evt.options,
+          instanceUrl:
+            typeof evt.options.instanceUrl === "string"
+              ? evt.options.instanceUrl
+              : (process.env.GITLAB_INSTANCE_URL ?? "https://gitlab.com"),
+          apiKey: typeof evt.options.apiKey === "string" ? evt.options.apiKey : process.env.GITLAB_TOKEN,
+          aiGatewayHeaders: {
+            "User-Agent": `opencode/${InstallationVersion} gitlab-ai-provider/${mod.VERSION} (${os.platform()} ${os.release()}; ${os.arch()})`,
+            "anthropic-beta": "context-1m-2025-08-07",
+            ...evt.options.aiGatewayHeaders,
+          },
+          featureFlags: {
+            duo_agent_platform_agentic_chat: true,
+            duo_agent_platform: true,
+            ...evt.options.featureFlags,
+          },
+        })
+      }),
+    )
+    yield* ctx.aisdk.language(
+      Effect.fn(function* (evt) {
+        if (evt.model.providerID !== ProviderV2.ID.gitlab) return
+        const featureFlags =
+          typeof evt.options.featureFlags === "object" && evt.options.featureFlags ? evt.options.featureFlags : {}
+        if (evt.model.api.id.startsWith("duo-workflow-")) {
+          const gitlab = yield* Effect.promise(() => import("gitlab-ai-provider")).pipe(Effect.orDie)
+          const workflowRef =
+            typeof evt.model.request.body.workflowRef === "string" ? evt.model.request.body.workflowRef : undefined
+          const workflowDefinition =
+            typeof evt.model.request.body.workflowDefinition === "string"
+              ? evt.model.request.body.workflowDefinition
+              : undefined
+          const language = evt.sdk.workflowChat(
+            gitlab.isWorkflowModel(evt.model.api.id) ? evt.model.api.id : "duo-workflow",
+            {
+              featureFlags,
+              workflowDefinition,
+            },
+          )
+          if (workflowRef) language.selectedModelRef = workflowRef
+          evt.language = language
+          return
+        }
+        evt.language = evt.sdk.agenticChat(evt.model.api.id, {
+          aiGatewayHeaders: evt.options.aiGatewayHeaders,
+          featureFlags,
+        })
+      }),
+    )
+  }),
+})

package/src/plugin/provider/google-vertex.ts

@@ -0,0 +1,173 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+import { ProviderV2 } from "../../provider"
+
+function resolveProject(options: Record<string, any>) {
+  // models.dev advertises GOOGLE_VERTEX_PROJECT for Vertex, while Google SDKs
+  // and ADC examples commonly use the broader Google Cloud project aliases.
+  return (
+    options.project ??
+    process.env.GOOGLE_VERTEX_PROJECT ??
+    process.env.GOOGLE_CLOUD_PROJECT ??
+    process.env.GCP_PROJECT ??
+    process.env.GCLOUD_PROJECT
+  )
+}
+
+function resolveLocation(options: Record<string, any>) {
+  return (
+    options.location ??
+    process.env.GOOGLE_VERTEX_LOCATION ??
+    process.env.GOOGLE_CLOUD_LOCATION ??
+    process.env.VERTEX_LOCATION ??
+    "us-central1"
+  )
+}
+
+function vertexEndpoint(location: string) {
+  if (location === "global") return "aiplatform.googleapis.com"
+  return `${location}-aiplatform.googleapis.com`
+}
+
+function replaceVertexVars(value: string, project: string | undefined, location: string) {
+  // Vertex OpenAI-compatible endpoints are stored as templates in the catalog;
+  // expand them after provider config/env project and location have been resolved.
+  return value
+    .replaceAll("${GOOGLE_VERTEX_PROJECT}", project ?? "${GOOGLE_VERTEX_PROJECT}")
+    .replaceAll("${GOOGLE_VERTEX_LOCATION}", location)
+    .replaceAll("${GOOGLE_VERTEX_ENDPOINT}", vertexEndpoint(location))
+}
+
+function authFetch(fetchWithRuntimeOptions?: unknown) {
+  // Native Vertex SDKs handle ADC internally. OpenAI-compatible Vertex endpoints
+  // do not, so inject a Google access token into their fetch path.
+  return async (input: Parameters<typeof fetch>[0], init?: RequestInit) => {
+    const { GoogleAuth } = await import("google-auth-library")
+    const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] })
+    const client = await auth.getClient()
+    const token = await client.getAccessToken()
+    const headers = new Headers(init?.headers)
+    headers.set("Authorization", `Bearer ${token.token}`)
+    return typeof fetchWithRuntimeOptions === "function"
+      ? fetchWithRuntimeOptions(input, { ...init, headers })
+      : fetch(input, { ...init, headers })
+  }
+}
+
+export const GoogleVertexPlugin = define({
+  id: "google-vertex",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.catalog.transform(
+      Effect.fn(function* (evt) {
+        for (const item of evt.provider.list()) {
+          if (item.provider.api.type !== "aisdk") continue
+          if (
+            item.provider.api.package !== "@ai-sdk/google-vertex" &&
+            !(
+              item.provider.id === ProviderV2.ID.googleVertex &&
+              item.provider.api.package.includes("@ai-sdk/openai-compatible")
+            )
+          )
+            continue
+          const project = resolveProject(item.provider.request.body)
+          const location = String(resolveLocation(item.provider.request.body))
+          evt.provider.update(item.provider.id, (provider) => {
+            if (project) provider.request.body.project = project
+            provider.request.body.location = location
+            if (provider.api.type === "aisdk" && provider.api.url) {
+              provider.api.url = replaceVertexVars(provider.api.url, project, location)
+            }
+            if (provider.api.type === "aisdk" && provider.api.package.includes("@ai-sdk/openai-compatible")) {
+              provider.request.body.fetch = authFetch(provider.request.body.fetch)
+            }
+          })
+        }
+      }),
+    )
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.model.providerID === ProviderV2.ID.googleVertex && evt.package.includes("@ai-sdk/openai-compatible")) {
+          evt.options.fetch = authFetch(evt.options.fetch)
+          return
+        }
+        if (evt.package !== "@ai-sdk/google-vertex") return
+        const mod = yield* Effect.promise(() => import("@ai-sdk/google-vertex"))
+        const project = resolveProject(evt.options)
+        const location = resolveLocation(evt.options)
+        const options = { ...evt.options }
+        delete options.fetch
+        evt.sdk = mod.createVertex({
+          ...options,
+          project,
+          location,
+        })
+      }),
+    )
+    yield* ctx.aisdk.language(
+      Effect.fn(function* (evt) {
+        if (evt.model.providerID !== ProviderV2.ID.googleVertex) return
+        evt.language = evt.sdk.languageModel(String(evt.model.api.id).trim())
+      }),
+    )
+  }),
+})
+
+export const GoogleVertexAnthropicPlugin = define({
+  id: "google-vertex-anthropic",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.catalog.transform(
+      Effect.fn(function* (evt) {
+        for (const item of evt.provider.list()) {
+          if (item.provider.api.type !== "aisdk") continue
+          if (item.provider.api.package !== "@ai-sdk/google-vertex/anthropic") continue
+          const project =
+            item.provider.request.body.project ??
+            process.env.GOOGLE_CLOUD_PROJECT ??
+            process.env.GCP_PROJECT ??
+            process.env.GCLOUD_PROJECT
+          const location =
+            item.provider.request.body.location ??
+            process.env.GOOGLE_CLOUD_LOCATION ??
+            process.env.VERTEX_LOCATION ??
+            "global"
+          evt.provider.update(item.provider.id, (provider) => {
+            if (project) provider.request.body.project = project
+            provider.request.body.location = location
+          })
+        }
+      }),
+    )
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.package !== "@ai-sdk/google-vertex/anthropic") return
+        const mod = yield* Effect.promise(() => import("@ai-sdk/google-vertex/anthropic"))
+        const project =
+          typeof evt.options.project === "string"
+            ? evt.options.project
+            : (process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GCP_PROJECT ?? process.env.GCLOUD_PROJECT)
+        const location =
+          typeof evt.options.location === "string"
+            ? evt.options.location
+            : (process.env.GOOGLE_CLOUD_LOCATION ?? process.env.VERTEX_LOCATION ?? "global")
+        evt.sdk = mod.createVertexAnthropic({
+          ...evt.options,
+          project,
+          location,
+          // Continental multi-regions (eu, us) require Regional Endpoint Platform
+          // domains; the default {region}-aiplatform.googleapis.com does not resolve.
+          ...((location === "eu" || location === "us") && project && !evt.options.baseURL
+            ? {
+                baseURL: `https://aiplatform.${location}.rep.googleapis.com/v1/projects/${project}/locations/${location}/publishers/anthropic/models`,
+              }
+            : {}),
+        })
+      }),
+    )
+    yield* ctx.aisdk.language(
+      Effect.fn(function* (evt) {
+        if (evt.model.providerID !== ProviderV2.ID.make("google-vertex-anthropic")) return
+        evt.language = evt.sdk.languageModel(String(evt.model.api.id).trim())
+      }),
+    )
+  }),
+})

package/src/plugin/provider/google.ts

@@ -0,0 +1,15 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+
+export const GooglePlugin = define({
+  id: "google",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.package !== "@ai-sdk/google") return
+        const mod = yield* Effect.promise(() => import("@ai-sdk/google"))
+        evt.sdk = mod.createGoogleGenerativeAI(evt.options)
+      }),
+    )
+  }),
+})

package/src/plugin/provider/groq.ts

@@ -0,0 +1,15 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+
+export const GroqPlugin = define({
+  id: "groq",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.package !== "@ai-sdk/groq") return
+        const mod = yield* Effect.promise(() => import("@ai-sdk/groq"))
+        evt.sdk = mod.createGroq(evt.options)
+      }),
+    )
+  }),
+})

package/src/plugin/provider/kilo.ts

@@ -0,0 +1,21 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+
+export const KiloPlugin = define({
+  id: "kilo",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.catalog.transform(
+      Effect.fn(function* (evt) {
+        for (const item of evt.provider.list()) {
+          if (item.provider.api.type !== "aisdk") continue
+          if (item.provider.api.package !== "@ai-sdk/openai-compatible") continue
+          if (item.provider.api.url !== "https://api.kilo.ai/api/gateway") continue
+          evt.provider.update(item.provider.id, (provider) => {
+            provider.request.headers["HTTP-Referer"] = "https://opencode.ai/"
+            provider.request.headers["X-Title"] = "opencode"
+          })
+        }
+      }),
+    )
+  }),
+})

package/src/plugin/provider/llmgateway.ts

@@ -0,0 +1,26 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+import { Integration } from "../../integration"
+
+export const LLMGatewayPlugin = define({
+  id: "llmgateway",
+  effect: Effect.fn(function* (ctx) {
+    const integrations = yield* Integration.Service
+    yield* ctx.catalog.transform(
+      Effect.fn(function* (evt) {
+        for (const item of evt.provider.list()) {
+          if (item.provider.disabled) continue
+          if (item.provider.api.type !== "aisdk") continue
+          if (item.provider.api.package !== "@ai-sdk/openai-compatible") continue
+          if (item.provider.api.url !== "https://api.llmgateway.io/v1") continue
+          if (!(yield* integrations.get(Integration.ID.make(item.provider.id)))) continue
+          evt.provider.update(item.provider.id, (provider) => {
+            provider.request.headers["HTTP-Referer"] = "https://opencode.ai/"
+            provider.request.headers["X-Title"] = "opencode"
+            provider.request.headers["X-Source"] = "opencode"
+          })
+        }
+      }),
+    )
+  }),
+})

package/src/plugin/provider/mistral.ts

@@ -0,0 +1,15 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+
+export const MistralPlugin = define({
+  id: "mistral",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.package !== "@ai-sdk/mistral") return
+        const mod = yield* Effect.promise(() => import("@ai-sdk/mistral"))
+        evt.sdk = mod.createMistral(evt.options)
+      }),
+    )
+  }),
+})

package/src/plugin/provider/nvidia.ts

@@ -0,0 +1,22 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+
+export const NvidiaPlugin = define({
+  id: "nvidia",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.catalog.transform(
+      Effect.fn(function* (evt) {
+        for (const item of evt.provider.list()) {
+          if (item.provider.api.type !== "aisdk") continue
+          if (item.provider.api.package !== "@ai-sdk/openai-compatible") continue
+          if (item.provider.api.url !== "https://integrate.api.nvidia.com/v1") continue
+          evt.provider.update(item.provider.id, (provider) => {
+            provider.request.headers["HTTP-Referer"] = "https://opencode.ai/"
+            provider.request.headers["X-Title"] = "opencode"
+            provider.request.headers["X-BILLING-INVOKE-ORIGIN"] ??= "OpenCode"
+          })
+        }
+      }),
+    )
+  }),
+})

package/src/plugin/provider/openai-compatible.ts

@@ -0,0 +1,17 @@
+import { Effect } from "effect"
+import { define } from "../internal"
+
+export const OpenAICompatiblePlugin = define({
+  id: "openai-compatible",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.sdk) return
+        if (!evt.package.includes("@ai-sdk/openai-compatible")) return
+        if (evt.options.includeUsage !== false) evt.options.includeUsage = true
+        const mod = yield* Effect.promise(() => import("@ai-sdk/openai-compatible"))
+        evt.sdk = mod.createOpenAICompatible(evt.options as any)
+      }),
+    )
+  }),
+})

package/src/plugin/provider/openai.ts

@@ -0,0 +1,292 @@
+import { createServer } from "node:http"
+import type { IntegrationOAuthMethodRegistration } from "@neurocode-ai/plugin/v2/effect/integration"
+import { define } from "@neurocode-ai/plugin/v2/effect/plugin"
+import { Deferred, Effect } from "effect"
+import type { Scope } from "effect"
+import { Credential } from "../../credential"
+import { InstallationVersion } from "../../installation/version"
+import { Integration } from "../../integration"
+import { ModelV2 } from "../../model"
+import { OauthCallbackPage } from "../../oauth/page"
+import { ProviderV2 } from "../../provider"
+import type { PluginInternal } from "../internal"
+
+const clientID = "app_EMoamEEZ73f0CkXaXp7hrann"
+const issuer = "https://auth.openai.com"
+const callbackPort = 1455
+const pollingSafetyMargin = 3000
+const browserMethodID = Integration.MethodID.make("chatgpt-browser")
+const headlessMethodID = Integration.MethodID.make("chatgpt-headless")
+
+type Pkce = {
+  verifier: string
+  challenge: string
+}
+
+type TokenResponse = {
+  id_token: string
+  access_token: string
+  refresh_token: string
+  expires_in?: number
+}
+
+type Claims = {
+  chatgpt_account_id?: string
+  organizations?: Array<{ id: string }>
+  "https://api.openai.com/auth"?: { chatgpt_account_id?: string }
+}
+
+const browser = {
+  integrationID: Integration.ID.make("openai"),
+  method: {
+    id: browserMethodID,
+    type: "oauth",
+    label: "ChatGPT Pro/Plus (browser)",
+  },
+  authorize: () =>
+    Effect.gen(function* () {
+      const pkce = yield* Effect.promise(generatePKCE)
+      const state = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer)
+      const code = yield* Deferred.make<string, Error>()
+      const redirect = `http://localhost:${callbackPort}/auth/callback`
+      const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", `http://localhost:${callbackPort}`)
+        if (url.pathname !== "/auth/callback") {
+          response.writeHead(404).end("Not found")
+          return
+        }
+        const error = url.searchParams.get("error_description") ?? url.searchParams.get("error")
+        const value = url.searchParams.get("code")
+        if (error) {
+          Effect.runFork(Deferred.fail(code, new Error(error)))
+          response
+            .writeHead(400, { "Content-Type": "text/html" })
+            .end(OauthCallbackPage.error(error, { provider: "ChatGPT" }))
+          return
+        }
+        if (!value || url.searchParams.get("state") !== state) {
+          const message = value ? "Invalid OAuth state" : "Missing authorization code"
+          Effect.runFork(Deferred.fail(code, new Error(message)))
+          response
+            .writeHead(400, { "Content-Type": "text/html" })
+            .end(OauthCallbackPage.error(message, { provider: "ChatGPT" }))
+          return
+        }
+        Effect.runFork(Deferred.succeed(code, value))
+        response.writeHead(200, { "Content-Type": "text/html" }).end(OauthCallbackPage.success({ provider: "ChatGPT" }))
+      })
+      yield* Effect.callback<void, Error>((resume) => {
+        server.once("error", (error) => resume(Effect.fail(error)))
+        server.listen(callbackPort, "localhost", () => resume(Effect.void))
+      })
+      yield* Effect.addFinalizer(() => Effect.sync(() => server.close()))
+      return {
+        mode: "auto" as const,
+        url: authorizeURL(redirect, pkce, state),
+        instructions: "Complete authorization in your browser. This window will close automatically.",
+        callback: Deferred.await(code).pipe(
+          Effect.flatMap((value) => exchange(value, redirect, pkce)),
+          Effect.map((tokens) => credential(browserMethodID, tokens)),
+        ),
+      }
+    }),
+  refresh: (value) => refresh(browserMethodID, value),
+} satisfies IntegrationOAuthMethodRegistration
+
+const headless = {
+  integrationID: Integration.ID.make("openai"),
+  method: {
+    id: headlessMethodID,
+    type: "oauth",
+    label: "ChatGPT Pro/Plus (headless)",
+  },
+  authorize: () =>
+    Effect.gen(function* () {
+      const device = yield* request<{ device_auth_id: string; user_code: string; interval: string }>(
+        `${issuer}/api/accounts/deviceauth/usercode`,
+        {
+          method: "POST",
+          headers: headers("application/json"),
+          body: JSON.stringify({ client_id: clientID }),
+        },
+      )
+      const interval = Math.max(Number.parseInt(device.interval) || 5, 1) * 1000
+      return {
+        mode: "auto" as const,
+        url: `${issuer}/codex/device`,
+        instructions: `Enter code: ${device.user_code}`,
+        callback: Effect.gen(function* () {
+          while (true) {
+            const response = yield* Effect.tryPromise({
+              try: (signal) =>
+                fetch(`${issuer}/api/accounts/deviceauth/token`, {
+                  method: "POST",
+                  headers: headers("application/json"),
+                  body: JSON.stringify({ device_auth_id: device.device_auth_id, user_code: device.user_code }),
+                  signal,
+                }),
+              catch: (cause) => cause,
+            })
+            if (response.ok) {
+              const data = (yield* Effect.promise(() => response.json())) as {
+                authorization_code: string
+                code_verifier: string
+              }
+              return credential(
+                headlessMethodID,
+                yield* exchange(data.authorization_code, `${issuer}/deviceauth/callback`, {
+                  verifier: data.code_verifier,
+                  challenge: "",
+                }),
+              )
+            }
+            if (response.status !== 403 && response.status !== 404) {
+              return yield* Effect.fail(new Error(`Device authorization failed: ${response.status}`))
+            }
+            yield* Effect.sleep(interval + pollingSafetyMargin)
+          }
+        }),
+      }
+    }),
+  refresh: (value) => refresh(headlessMethodID, value),
+} satisfies IntegrationOAuthMethodRegistration
+
+export const OpenAIPlugin = define({
+  id: "openai",
+  effect: Effect.fn(function* (ctx) {
+    yield* ctx.integration.transform((draft) => {
+      draft.method.update(browser)
+      draft.method.update(headless)
+    })
+    yield* ctx.catalog.transform(
+      Effect.fn(function* (evt) {
+        for (const item of evt.provider.list()) {
+          if (item.provider.api.type !== "aisdk") continue
+          if (item.provider.api.package !== "@ai-sdk/openai") continue
+          if (!item.models.has(ModelV2.ID.make("gpt-5-chat-latest"))) continue
+          evt.model.update(item.provider.id, ModelV2.ID.make("gpt-5-chat-latest"), (model) => {
+            // OpenAIPlugin sends OpenAI models through Responses; this alias is a
+            // chat-completions-only model, so hide it only from OpenAI's catalog.
+            model.enabled = false
+          })
+        }
+      }),
+    )
+    yield* ctx.aisdk.sdk(
+      Effect.fn(function* (evt) {
+        if (evt.package !== "@ai-sdk/openai") return
+        const mod = yield* Effect.promise(() => import("@ai-sdk/openai"))
+        evt.sdk = mod.createOpenAI(evt.options)
+      }),
+    )
+    yield* ctx.aisdk.language(
+      Effect.fn(function* (evt) {
+        if (evt.model.providerID !== ProviderV2.ID.openai) return
+        evt.language = evt.sdk.responses(evt.model.api.id)
+      }),
+    )
+  }),
+} satisfies PluginInternal.Plugin<PluginInternal.Requirements | Scope.Scope>)
+
+function headers(contentType: string) {
+  return { "Content-Type": contentType, "User-Agent": `opencode/${InstallationVersion}` }
+}
+
+function exchange(code: string, redirect: string, pkce: Pkce) {
+  return request<TokenResponse>(`${issuer}/oauth/token`, {
+    method: "POST",
+    headers: headers("application/x-www-form-urlencoded"),
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirect,
+      client_id: clientID,
+      code_verifier: pkce.verifier,
+    }).toString(),
+  })
+}
+
+function refresh(methodID: Integration.MethodID, value: Pick<Credential.OAuth, "refresh" | "metadata">) {
+  return request<TokenResponse>(`${issuer}/oauth/token`, {
+    method: "POST",
+    headers: headers("application/x-www-form-urlencoded"),
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: value.refresh,
+      client_id: clientID,
+    }).toString(),
+  }).pipe(
+    Effect.map((tokens) => {
+      const next = credential(methodID, tokens)
+      return Credential.OAuth.make({ ...next, metadata: next.metadata ?? value.metadata })
+    }),
+  )
+}
+
+function request<A>(url: string, init: RequestInit) {
+  return Effect.tryPromise({
+    try: async (signal) => {
+      const response = await fetch(url, { ...init, signal })
+      if (!response.ok) throw new Error(`Request failed: ${response.status}`)
+      return response.json() as Promise<A>
+    },
+    catch: (cause) => cause,
+  })
+}
+
+function credential(methodID: Integration.MethodID, tokens: TokenResponse) {
+  const accountID = extractAccountID(tokens)
+  return Credential.OAuth.make({
+    type: "oauth",
+    methodID,
+    refresh: tokens.refresh_token,
+    access: tokens.access_token,
+    expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+    metadata: accountID ? { accountID } : undefined,
+  })
+}
+
+async function generatePKCE(): Promise<Pkce> {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
+  const verifier = Array.from(crypto.getRandomValues(new Uint8Array(43)), (byte) => chars[byte % chars.length]).join("")
+  const challenge = base64UrlEncode(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)))
+  return { verifier, challenge }
+}
+
+function base64UrlEncode(buffer: ArrayBuffer) {
+  return Buffer.from(buffer).toString("base64url")
+}
+
+function authorizeURL(redirect: string, pkce: Pkce, state: string) {
+  return `${issuer}/oauth/authorize?${new URLSearchParams({
+    response_type: "code",
+    client_id: clientID,
+    redirect_uri: redirect,
+    scope: "openid profile email offline_access",
+    code_challenge: pkce.challenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state,
+    originator: "opencode",
+  })}`
+}
+
+function extractAccountID(tokens: TokenResponse) {
+  return claim(tokens.id_token) ?? claim(tokens.access_token)
+}
+
+function claim(token: string) {
+  const part = token.split(".")[1]
+  if (!part) return
+  try {
+    const claims = JSON.parse(Buffer.from(part, "base64url").toString()) as Claims
+    return (
+      claims.chatgpt_account_id ??
+      claims["https://api.openai.com/auth"]?.chatgpt_account_id ??
+      claims.organizations?.[0]?.id
+    )
+  } catch {
+    return
+  }
+}