@okram78/opencode-provider-guard 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Marko Posio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,70 @@
-# Temporary Holding Version
+# OpenCode Provider Guard
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Restricts which providers OpenCode can use in selected directories. Useful for
+keeping personal, pay-as-you-go providers out of work projects. It blocks
+disallowed providers.
+
+![OpenCode's model picker shows models from multiple providers in personal projects and only GitHub Copilot models in work.](assets/provider-guard-demo.gif)
+
+## Compatibility
+
+- OpenCode **V2**; tested against `@opencode/plugin` 2.0.24.
+- Bun 1.4.2 for development. Node.js 22.12+ is required for Node-based use; the
+  published ESM also works with Bun.
+
+## Build and enable
+
+```sh
+bun install --frozen-lockfile
+bun run check
+```
+
+To enable the plugin, add it to your **global** OpenCode config
+(`~/.config/opencode/opencode.jsonc`):
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugins": [
+    {
+      "package": "/absolute/path/to/opencode-provider-guard/dist",
+      "options": {
+        "rules": [
+          {
+            "root": "~/projects/work",
+            "allowProviders": ["github-copilot"],
+          },
+        ],
+      },
+    },
+  ],
+}
+```
+
+Use a global entry so the guard loads in every project. Preserve other config
+settings. After publication, the local path can be replaced with
+`@okram78/opencode-provider-guard@1.0.0`.
+
+## Rules
+
+- `root` is an absolute path or `~`/`~/...`; it covers the directory and all
+  descendants. Globs, relative paths, and environment-variable expansion are not
+  supported.
+- `allowProviders` contains exact, case-sensitive provider IDs (not model IDs).
+  An empty list denies all providers.
+- Overlapping rules are intersected, so a nested rule can narrow but never relax
+  an outer rule. No matching rule means no restriction.
+- Both lexical and resolved paths are checked, including symlink targets. Invalid
+  paths and filesystem errors fail closed.
+
+## Development
+
+```sh
+bun install --frozen-lockfile
+bun run check
+npm pack --dry-run
+```
+
+## License
+
+[MIT](LICENSE).

package/dist/config.d.ts

@@ -0,0 +1,10 @@
+export interface GuardRule {
+    readonly root: string;
+    readonly allowProviders: readonly string[];
+}
+export interface GuardOptions {
+    readonly rules: readonly GuardRule[];
+}
+/** Reject typos and malformed rules instead of silently weakening protection. */
+export declare function parseOptions(input: unknown): GuardOptions;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;CACrC;AAwBD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAiDzD"}

package/dist/config.js

@@ -0,0 +1,56 @@
+import { isAbsolute } from "node:path";
+import { ProviderGuardError } from "./errors.js";
+function invalid(message) {
+    throw new ProviderGuardError("INVALID_CONFIG", message);
+}
+function record(value, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        invalid(`${label} must be an object.`);
+    }
+    return value;
+}
+function keys(value, allowed, label) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            invalid(`${label}: unknown option ${JSON.stringify(key)}.`);
+    }
+}
+/** Reject typos and malformed rules instead of silently weakening protection. */
+export function parseOptions(input) {
+    const options = record(input, "options");
+    keys(options, ["rules"], "options");
+    if (!Array.isArray(options.rules) || options.rules.length === 0) {
+        invalid("options.rules must be a non-empty array.");
+    }
+    const rules = options.rules.map((input, index) => {
+        const label = `rules[${index}]`;
+        const rule = record(input, label);
+        keys(rule, ["root", "allowProviders"], label);
+        if (typeof rule.root !== "string" ||
+            rule.root.length === 0 ||
+            rule.root !== rule.root.trim() ||
+            /[\0*?]/u.test(rule.root) ||
+            !(isAbsolute(rule.root) ||
+                rule.root === "~" ||
+                rule.root.startsWith("~/"))) {
+            invalid(`${label}.root must be an absolute path or a ~/ path, without wildcards or surrounding whitespace.`);
+        }
+        if (!Array.isArray(rule.allowProviders)) {
+            invalid(`${label}.allowProviders must be an array of exact provider IDs (an empty array denies all providers).`);
+        }
+        const providers = rule.allowProviders.map((provider) => {
+            if (typeof provider !== "string" ||
+                provider !== provider.trim() ||
+                !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/u.test(provider)) {
+                invalid(`${label}.allowProviders must contain exact provider IDs, not model references or patterns.`);
+            }
+            return provider;
+        });
+        return Object.freeze({
+            root: rule.root,
+            allowProviders: Object.freeze([...new Set(providers)]),
+        });
+    });
+    return Object.freeze({ rules: Object.freeze(rules) });
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAWhD,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,IAAI,CACX,KAA8B,EAC9B,OAAiB,EACjB,KAAa;IAEb,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxB,OAAO,CAAC,GAAG,KAAK,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,0CAA0C,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,KAAa,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,SAAS,KAAK,GAAG,CAAA;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAA;QAC7C,IACE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACtB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAC9B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACzB,CAAC,CACC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrB,IAAI,CAAC,IAAI,KAAK,GAAG;gBACjB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAC3B,EACD,CAAC;YACD,OAAO,CACL,GAAG,KAAK,2FAA2F,CACpG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxC,OAAO,CACL,GAAG,KAAK,+FAA+F,CACxG,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,QAAiB,EAAE,EAAE;YAC9D,IACE,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,QAAQ,KAAK,QAAQ,CAAC,IAAI,EAAE;gBAC5B,CAAC,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC/C,CAAC;gBACD,OAAO,CACL,GAAG,KAAK,oFAAoF,CAC7F,CAAA;YACH,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;SACvD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACvD,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,8 @@
+/** Stable error codes for diagnostics without logging prompts or credentials. */
+export type GuardErrorCode = "INVALID_CONFIG" | "PATH_RESOLUTION_FAILED" | "SESSION_LOOKUP_FAILED" | "PROVIDER_BLOCKED";
+export declare class ProviderGuardError extends Error {
+    readonly code: GuardErrorCode;
+    readonly name = "ProviderGuardError";
+    constructor(code: GuardErrorCode, message: string, options?: ErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,MAAM,cAAc,GACtB,gBAAgB,GAChB,wBAAwB,GACxB,uBAAuB,GACvB,kBAAkB,CAAA;AAEtB,qBAAa,kBAAmB,SAAQ,KAAK;IAIzC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAH/B,SAAkB,IAAI,wBAAuB;gBAGlC,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB"}

package/dist/errors.js

@@ -0,0 +1,9 @@
+export class ProviderGuardError extends Error {
+    code;
+    name = "ProviderGuardError";
+    constructor(code, message, options) {
+        super(`[opencode-provider-guard:${code}] ${message}`, options);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAIhC;IAHO,IAAI,GAAG,oBAAoB,CAAA;IAE7C,YACW,IAAoB,EAC7B,OAAe,EACf,OAAsB;QAEtB,KAAK,CAAC,4BAA4B,IAAI,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;QAJrD,SAAI,GAAJ,IAAI,CAAgB;IAK/B,CAAC;CACF"}

package/dist/guard.d.ts

@@ -0,0 +1,6 @@
+import type { Plugin } from "@opencode/plugin";
+type GuardContext = Pick<Plugin.Context, "options" | "location" | "provider" | "model" | "session">;
+/** Kept separate from the entrypoint so contract tests need no running service. */
+export declare function setupGuard(ctx: GuardContext): Promise<() => Promise<void>>;
+export {};
+//# sourceMappingURL=guard.d.ts.map

package/dist/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAM9C,KAAK,YAAY,GAAG,IAAI,CACtB,MAAM,CAAC,OAAO,EACd,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAC1D,CAAA;AAqBD,mFAAmF;AACnF,wBAAsB,UAAU,CAC9B,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAkF9B"}

package/dist/guard.js

@@ -0,0 +1,83 @@
+import { ProviderGuardError } from "./errors.js";
+import { permits, PolicyEngine } from "./policy.js";
+async function dispose(registrations) {
+    const results = await Promise.allSettled([...registrations]
+        .reverse()
+        .map((registration) => Promise.resolve().then(() => registration.dispose())));
+    const errors = results
+        .filter((result) => result.status === "rejected")
+        .map((result) => result.reason);
+    if (errors.length)
+        throw new AggregateError(errors, "Provider guard registration cleanup failed.");
+}
+/** Kept separate from the entrypoint so contract tests need no running service. */
+export async function setupGuard(ctx) {
+    const engine = new PolicyEngine(ctx.options);
+    const registrations = [];
+    const check = async (event) => {
+        let session;
+        try {
+            session = await ctx.session.get({ sessionID: event.sessionID });
+        }
+        catch (cause) {
+            throw new ProviderGuardError("SESSION_LOOKUP_FAILED", "Cannot determine the session location; refusing the model request.", { cause });
+        }
+        // ctx.location belongs to the plugin instance, not necessarily this session.
+        // Never apply a different project's canonical path to an unrelated session.
+        const directories = [session.location.directory];
+        if (session.projectID === ctx.location.project.id) {
+            directories.push(ctx.location.project.canonical);
+        }
+        const policy = await engine.evaluate(directories);
+        if (!permits(policy, event.model.providerID)) {
+            throw new ProviderGuardError("PROVIDER_BLOCKED", `Provider ${JSON.stringify(event.model.providerID)} is blocked in ${JSON.stringify(session.location.directory)}. Matching roots: ${policy.matchedRoots.map((root) => JSON.stringify(root)).join(", ")}. Allowed providers: ${policy.allowProviders?.join(", ") || "none"}. Select an allowed provider; no automatic fallback is performed.`);
+        }
+    };
+    try {
+        // Register even outside protected roots: a session may later move inside.
+        for (const name of [
+            "context",
+            "compaction",
+            "generate",
+            "title",
+            "model.request",
+            "http.request",
+            "experimental.ws.handshake",
+            "experimental.ws.send",
+        ]) {
+            registrations.push(await ctx.session.hook(name, check));
+        }
+        const policy = await engine.evaluate([
+            ctx.location.directory,
+            ctx.location.project.canonical,
+        ]);
+        if (policy.allowProviders !== undefined) {
+            registrations.push(await ctx.provider.transform((editor) => {
+                for (const { provider } of editor.list()) {
+                    if (!permits(policy, provider.id))
+                        editor.remove(provider.id);
+                }
+            }));
+            registrations.push(await ctx.model.transform((editor) => {
+                for (const model of editor.list()) {
+                    // V2's DeepMutable maps branded IDs as object types; their runtime
+                    // values are strings. String() avoids an unsafe type assertion.
+                    const providerID = String(model.providerID);
+                    if (!permits(policy, providerID))
+                        editor.remove(providerID, String(model.id));
+                }
+            }));
+        }
+    }
+    catch (error) {
+        try {
+            await dispose(registrations);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "Provider guard setup and cleanup failed.");
+        }
+        throw error;
+    }
+    return () => dispose(registrations);
+}
+//# sourceMappingURL=guard.js.map

package/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAQnD,KAAK,UAAU,OAAO,CAAC,aAAsC;IAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,CAAC,GAAG,aAAa,CAAC;SACf,OAAO,EAAE;SACT,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACpB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CACrD,CACJ,CAAA;IACD,MAAM,MAAM,GAAG,OAAO;SACnB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;SAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAiB,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,MAAM;QACf,MAAM,IAAI,cAAc,CACtB,MAAM,EACN,6CAA6C,CAC9C,CAAA;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAmB,EAAE,CAAA;IAExC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAsB,EAAiB,EAAE;QAC5D,IAAI,OAAoD,CAAA;QACxD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,oEAAoE,EACpE,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAClD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACjD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,qBAAqB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,mEAAmE,CAC5U,CAAA;QACH,CAAC;IACH,CAAC,CAAA;IAED,IAAI,CAAC;QACH,0EAA0E;QAC1E,KAAK,MAAM,IAAI,IAAI;YACjB,SAAS;YACT,YAAY;YACZ,UAAU;YACV,OAAO;YACP,eAAe;YACf,cAAc;YACd,2BAA2B;YAC3B,sBAAsB;SACd,EAAE,CAAC;YACX,aAAa,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC,SAAS;YACtB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS;SAC/B,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAChB,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC/D,CAAC;YACH,CAAC,CAAC,CACH,CAAA;YACD,aAAa,CAAC,IAAI,CAChB,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE;gBACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBAClC,mEAAmE;oBACnE,gEAAgE;oBAChE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;oBAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;wBAC9B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC/C,CAAC;YACH,CAAC,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,YAAY,CAAC,EACrB,0CAA0C,CAC3C,CAAA;QACH,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;AACrC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+import { Plugin } from "@opencode/plugin";
+export type { GuardOptions, GuardRule } from "./config.js";
+export { ProviderGuardError } from "./errors.js";
+export type { GuardErrorCode } from "./errors.js";
+declare const _default: Plugin.Plugin;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;;AAEjD,wBAGE"}

package/dist/index.js

@@ -0,0 +1,8 @@
+import { Plugin } from "@opencode/plugin";
+import { setupGuard } from "./guard.js";
+export { ProviderGuardError } from "./errors.js";
+export default Plugin.define({
+    id: "opencode-provider-guard",
+    setup: setupGuard,
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGhD,eAAe,MAAM,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,UAAU;CAClB,CAAC,CAAA"}

package/dist/paths.d.ts

@@ -0,0 +1,11 @@
+export declare function expandHome(value: string, home?: string): string;
+/** Component-aware containment: /work never matches /work-personal. */
+export declare function containsPath(root: string, directory: string): boolean;
+/**
+ * Resolve symlinks, including existing ancestors of a not-yet-created path.
+ * Permission errors, dangling links and symlink loops are not treated as misses.
+ */
+export declare function physicalPath(value: string): Promise<string>;
+/** Keep both spellings so symlinks cannot remove a lexical restriction. */
+export declare function pathAliases(value: string): Promise<readonly string[]>;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AASA,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,MAAM,CAIlE;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAMrE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCjE;AAED,2EAA2E;AAC3E,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE3E"}

package/dist/paths.js

@@ -0,0 +1,63 @@
+import { lstat, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { ProviderGuardError } from "./errors.js";
+function missing(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+export function expandHome(value, home = homedir()) {
+    if (value === "~")
+        return home;
+    if (value.startsWith("~/"))
+        return `${home}${sep}${value.slice(2)}`;
+    return value;
+}
+/** Component-aware containment: /work never matches /work-personal. */
+export function containsPath(root, directory) {
+    const suffix = relative(root, directory);
+    return (suffix === "" ||
+        (suffix !== ".." && !suffix.startsWith(`..${sep}`) && !isAbsolute(suffix)));
+}
+/**
+ * Resolve symlinks, including existing ancestors of a not-yet-created path.
+ * Permission errors, dangling links and symlink loops are not treated as misses.
+ */
+export async function physicalPath(value) {
+    if (!isAbsolute(value) || value.includes("\0")) {
+        throw new ProviderGuardError("PATH_RESOLUTION_FAILED", "Expected an absolute filesystem path.");
+    }
+    let current = value;
+    const segments = [];
+    try {
+        for (;;) {
+            try {
+                return resolve(await realpath(current), ...segments);
+            }
+            catch (error) {
+                if (!missing(error))
+                    throw error;
+                // realpath reports ENOENT for dangling links too. Do not walk past one.
+                const info = await lstat(current).catch((statError) => {
+                    if (!missing(statError))
+                        throw statError;
+                    return undefined;
+                });
+                if (info?.isSymbolicLink())
+                    throw error;
+                const parent = dirname(current);
+                if (parent === current)
+                    throw error;
+                segments.unshift(relative(parent, current));
+                current = parent;
+            }
+        }
+    }
+    catch (cause) {
+        throw new ProviderGuardError("PATH_RESOLUTION_FAILED", `Cannot resolve ${JSON.stringify(value)}; refusing to assume it is unprotected.`, { cause });
+    }
+}
+/** Keep both spellings so symlinks cannot remove a lexical restriction. */
+export async function pathAliases(value) {
+    return [...new Set([resolve(value), await physicalPath(value)])];
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAI,GAAG,OAAO,EAAE;IACxD,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACxC,OAAO,CACL,MAAM,KAAK,EAAE;QACb,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC3E,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,uCAAuC,CACxC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAChC,wEAAwE;gBACxE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,SAAkB,EAAE,EAAE;oBAC7D,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;wBAAE,MAAM,SAAS,CAAA;oBACxC,OAAO,SAAS,CAAA;gBAClB,CAAC,CAAC,CAAA;gBACF,IAAI,IAAI,EAAE,cAAc,EAAE;oBAAE,MAAM,KAAK,CAAA;gBACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;gBAC/B,IAAI,MAAM,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAA;gBACnC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;gBAC3C,OAAO,GAAG,MAAM,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yCAAyC,EAChF,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,13 @@
+export interface GuardPolicy {
+    readonly matchedRoots: readonly string[];
+    /** undefined means unrestricted; an empty list means deny all. */
+    readonly allowProviders: readonly string[] | undefined;
+}
+export declare function permits(policy: GuardPolicy, providerID: string): boolean;
+/** All matching rules intersect: a nested rule cannot relax its parent. */
+export declare class PolicyEngine {
+    #private;
+    constructor(options: unknown);
+    evaluate(directories: readonly string[]): Promise<GuardPolicy>;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CACvD;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,2EAA2E;AAC3E,qBAAa,YAAY;;gBAGX,OAAO,EAAE,OAAO;IAOtB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;CAuBrE"}

package/dist/policy.js

@@ -0,0 +1,34 @@
+import { parseOptions } from "./config.js";
+import { containsPath, expandHome, pathAliases } from "./paths.js";
+export function permits(policy, providerID) {
+    return (policy.allowProviders === undefined ||
+        policy.allowProviders.includes(providerID));
+}
+/** All matching rules intersect: a nested rule cannot relax its parent. */
+export class PolicyEngine {
+    #rules;
+    constructor(options) {
+        this.#rules = parseOptions(options).rules.map((rule) => ({
+            ...rule,
+            root: expandHome(rule.root),
+        }));
+    }
+    async evaluate(directories) {
+        // No cached filesystem/session state: moves and changed symlink targets are
+        // re-evaluated on the next request, rather than on the next plugin reload.
+        const paths = (await Promise.all(directories.map(pathAliases))).flat();
+        const matches = await Promise.all(this.#rules.map(async (rule) => {
+            const roots = await pathAliases(rule.root);
+            return roots.some((root) => paths.some((directory) => containsPath(root, directory)))
+                ? rule
+                : undefined;
+        }));
+        const rules = matches.filter((rule) => rule !== undefined);
+        const first = rules[0];
+        return {
+            matchedRoots: rules.map((rule) => rule.root),
+            allowProviders: first?.allowProviders.filter((provider) => rules.every((rule) => rule.allowProviders.includes(provider))),
+        };
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAQlE,MAAM,UAAU,OAAO,CAAC,MAAmB,EAAE,UAAkB;IAC7D,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC3C,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,YAAY;IACd,MAAM,CAAsB;IAErC,YAAY,OAAgB;QAC1B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvD,GAAG,IAAI;YACP,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5B,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAA8B;QAC3C,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACzB,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACzD;gBACC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,SAAS,CAAA;QACf,CAAC,CAAC,CACH,CAAA;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5C,cAAc,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACxD,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAC9D;SACF,CAAA;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,71 @@
 {
   "name": "@okram78/opencode-provider-guard",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Path-based provider allowlists for OpenCode V2",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/okram78/opencode-provider-guard"
+  },
+  "homepage": "https://github.com/okram78/opencode-provider-guard#readme",
+  "bugs": {
+    "url": "https://github.com/okram78/opencode-provider-guard/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./schema.json": "./schema.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src",
+    "schema.json",
+    "README.md",
+    "assets",
+    "LICENSE"
+  ],
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "provider",
+    "guard",
+    "copilot"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:entrypoint": "node scripts/check-entrypoint.mjs",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "check": "bun run format:check && bun run typecheck && bun run test:coverage && bun run build && bun run test:entrypoint",
+    "prepack": "bun run build"
+  },
+  "peerDependencies": {
+    "@opencode/plugin": "2.0.24"
+  },
+  "devDependencies": {
+    "@opencode/plugin": "2.0.24",
+    "@opencode/schema": "2.0.24",
+    "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^5.0.3",
+    "ajv": "^8.20.0",
+    "effect": "4.0.0-rc.112",
+    "prettier": "^3.0.0",
+    "typescript": "^5.9.0",
+    "vitest": "^5.0.3"
+  },
+  "packageManager": "bun@1.4.2"
+}

package/schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "OpenCode Provider Guard options",
+  "description": "Path-based exact provider allowlists. Matching rules intersect.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["rules"],
+  "properties": {
+    "rules": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["root", "allowProviders"],
+        "properties": {
+          "root": {
+            "type": "string",
+            "minLength": 1,
+            "description": "An absolute directory or ~/ path, including its descendants. No globbing. Paths are validated for the host platform at runtime.",
+            "pattern": "^(?!\\s)(?!.*[\\u0000*?])(?!.*\\s$)(?:~(?:/.*)?|/.*|[A-Za-z]:[\\\\/].*|\\\\\\\\[^\\\\]+\\\\[^\\\\]+.*)$"
+          },
+          "allowProviders": {
+            "type": "array",
+            "description": "Exact, case-sensitive provider IDs. Empty means deny all. Duplicates are harmless and deduplicated at runtime.",
+            "items": {
+              "type": "string",
+              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$(?![\\s\\S])"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/src/config.ts

@@ -0,0 +1,85 @@
+import { isAbsolute } from "node:path"
+import { ProviderGuardError } from "./errors.js"
+
+export interface GuardRule {
+  readonly root: string
+  readonly allowProviders: readonly string[]
+}
+
+export interface GuardOptions {
+  readonly rules: readonly GuardRule[]
+}
+
+function invalid(message: string): never {
+  throw new ProviderGuardError("INVALID_CONFIG", message)
+}
+
+function record(value: unknown, label: string): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    invalid(`${label} must be an object.`)
+  }
+  return value as Record<string, unknown>
+}
+
+function keys(
+  value: Record<string, unknown>,
+  allowed: string[],
+  label: string,
+) {
+  for (const key of Object.keys(value)) {
+    if (!allowed.includes(key))
+      invalid(`${label}: unknown option ${JSON.stringify(key)}.`)
+  }
+}
+
+/** Reject typos and malformed rules instead of silently weakening protection. */
+export function parseOptions(input: unknown): GuardOptions {
+  const options = record(input, "options")
+  keys(options, ["rules"], "options")
+  if (!Array.isArray(options.rules) || options.rules.length === 0) {
+    invalid("options.rules must be a non-empty array.")
+  }
+
+  const rules = options.rules.map((input: unknown, index: number) => {
+    const label = `rules[${index}]`
+    const rule = record(input, label)
+    keys(rule, ["root", "allowProviders"], label)
+    if (
+      typeof rule.root !== "string" ||
+      rule.root.length === 0 ||
+      rule.root !== rule.root.trim() ||
+      /[\0*?]/u.test(rule.root) ||
+      !(
+        isAbsolute(rule.root) ||
+        rule.root === "~" ||
+        rule.root.startsWith("~/")
+      )
+    ) {
+      invalid(
+        `${label}.root must be an absolute path or a ~/ path, without wildcards or surrounding whitespace.`,
+      )
+    }
+    if (!Array.isArray(rule.allowProviders)) {
+      invalid(
+        `${label}.allowProviders must be an array of exact provider IDs (an empty array denies all providers).`,
+      )
+    }
+    const providers = rule.allowProviders.map((provider: unknown) => {
+      if (
+        typeof provider !== "string" ||
+        provider !== provider.trim() ||
+        !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/u.test(provider)
+      ) {
+        invalid(
+          `${label}.allowProviders must contain exact provider IDs, not model references or patterns.`,
+        )
+      }
+      return provider
+    })
+    return Object.freeze({
+      root: rule.root,
+      allowProviders: Object.freeze([...new Set(providers)]),
+    })
+  })
+  return Object.freeze({ rules: Object.freeze(rules) })
+}

package/src/errors.ts

@@ -0,0 +1,18 @@
+/** Stable error codes for diagnostics without logging prompts or credentials. */
+export type GuardErrorCode =
+  | "INVALID_CONFIG"
+  | "PATH_RESOLUTION_FAILED"
+  | "SESSION_LOOKUP_FAILED"
+  | "PROVIDER_BLOCKED"
+
+export class ProviderGuardError extends Error {
+  override readonly name = "ProviderGuardError"
+
+  constructor(
+    readonly code: GuardErrorCode,
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(`[opencode-provider-guard:${code}] ${message}`, options)
+  }
+}

package/src/guard.ts

@@ -0,0 +1,116 @@
+import type { Plugin } from "@opencode/plugin"
+import type { Registration } from "@opencode/plugin/promise/registration"
+import type { SessionRequest } from "@opencode/plugin/promise/session"
+import { ProviderGuardError } from "./errors.js"
+import { permits, PolicyEngine } from "./policy.js"
+
+type GuardContext = Pick<
+  Plugin.Context,
+  "options" | "location" | "provider" | "model" | "session"
+>
+type RequestIdentity = Pick<SessionRequest, "sessionID" | "model">
+
+async function dispose(registrations: readonly Registration[]): Promise<void> {
+  const results = await Promise.allSettled(
+    [...registrations]
+      .reverse()
+      .map((registration) =>
+        Promise.resolve().then(() => registration.dispose()),
+      ),
+  )
+  const errors = results
+    .filter((result) => result.status === "rejected")
+    .map((result) => result.reason as unknown)
+  if (errors.length)
+    throw new AggregateError(
+      errors,
+      "Provider guard registration cleanup failed.",
+    )
+}
+
+/** Kept separate from the entrypoint so contract tests need no running service. */
+export async function setupGuard(
+  ctx: GuardContext,
+): Promise<() => Promise<void>> {
+  const engine = new PolicyEngine(ctx.options)
+  const registrations: Registration[] = []
+
+  const check = async (event: RequestIdentity): Promise<void> => {
+    let session: Awaited<ReturnType<typeof ctx.session.get>>
+    try {
+      session = await ctx.session.get({ sessionID: event.sessionID })
+    } catch (cause) {
+      throw new ProviderGuardError(
+        "SESSION_LOOKUP_FAILED",
+        "Cannot determine the session location; refusing the model request.",
+        { cause },
+      )
+    }
+    // ctx.location belongs to the plugin instance, not necessarily this session.
+    // Never apply a different project's canonical path to an unrelated session.
+    const directories = [session.location.directory]
+    if (session.projectID === ctx.location.project.id) {
+      directories.push(ctx.location.project.canonical)
+    }
+    const policy = await engine.evaluate(directories)
+    if (!permits(policy, event.model.providerID)) {
+      throw new ProviderGuardError(
+        "PROVIDER_BLOCKED",
+        `Provider ${JSON.stringify(event.model.providerID)} is blocked in ${JSON.stringify(session.location.directory)}. Matching roots: ${policy.matchedRoots.map((root) => JSON.stringify(root)).join(", ")}. Allowed providers: ${policy.allowProviders?.join(", ") || "none"}. Select an allowed provider; no automatic fallback is performed.`,
+      )
+    }
+  }
+
+  try {
+    // Register even outside protected roots: a session may later move inside.
+    for (const name of [
+      "context",
+      "compaction",
+      "generate",
+      "title",
+      "model.request",
+      "http.request",
+      "experimental.ws.handshake",
+      "experimental.ws.send",
+    ] as const) {
+      registrations.push(await ctx.session.hook(name, check))
+    }
+
+    const policy = await engine.evaluate([
+      ctx.location.directory,
+      ctx.location.project.canonical,
+    ])
+    if (policy.allowProviders !== undefined) {
+      registrations.push(
+        await ctx.provider.transform((editor) => {
+          for (const { provider } of editor.list()) {
+            if (!permits(policy, provider.id)) editor.remove(provider.id)
+          }
+        }),
+      )
+      registrations.push(
+        await ctx.model.transform((editor) => {
+          for (const model of editor.list()) {
+            // V2's DeepMutable maps branded IDs as object types; their runtime
+            // values are strings. String() avoids an unsafe type assertion.
+            const providerID = String(model.providerID)
+            if (!permits(policy, providerID))
+              editor.remove(providerID, String(model.id))
+          }
+        }),
+      )
+    }
+  } catch (error) {
+    try {
+      await dispose(registrations)
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        "Provider guard setup and cleanup failed.",
+      )
+    }
+    throw error
+  }
+
+  return () => dispose(registrations)
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+import { Plugin } from "@opencode/plugin"
+import { setupGuard } from "./guard.js"
+
+export type { GuardOptions, GuardRule } from "./config.js"
+export { ProviderGuardError } from "./errors.js"
+export type { GuardErrorCode } from "./errors.js"
+
+export default Plugin.define({
+  id: "opencode-provider-guard",
+  setup: setupGuard,
+})

package/src/paths.ts

@@ -0,0 +1,68 @@
+import { lstat, realpath } from "node:fs/promises"
+import { homedir } from "node:os"
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path"
+import { ProviderGuardError } from "./errors.js"
+
+function missing(error: unknown): boolean {
+  return error instanceof Error && "code" in error && error.code === "ENOENT"
+}
+
+export function expandHome(value: string, home = homedir()): string {
+  if (value === "~") return home
+  if (value.startsWith("~/")) return `${home}${sep}${value.slice(2)}`
+  return value
+}
+
+/** Component-aware containment: /work never matches /work-personal. */
+export function containsPath(root: string, directory: string): boolean {
+  const suffix = relative(root, directory)
+  return (
+    suffix === "" ||
+    (suffix !== ".." && !suffix.startsWith(`..${sep}`) && !isAbsolute(suffix))
+  )
+}
+
+/**
+ * Resolve symlinks, including existing ancestors of a not-yet-created path.
+ * Permission errors, dangling links and symlink loops are not treated as misses.
+ */
+export async function physicalPath(value: string): Promise<string> {
+  if (!isAbsolute(value) || value.includes("\0")) {
+    throw new ProviderGuardError(
+      "PATH_RESOLUTION_FAILED",
+      "Expected an absolute filesystem path.",
+    )
+  }
+  let current = value
+  const segments: string[] = []
+  try {
+    for (;;) {
+      try {
+        return resolve(await realpath(current), ...segments)
+      } catch (error) {
+        if (!missing(error)) throw error
+        // realpath reports ENOENT for dangling links too. Do not walk past one.
+        const info = await lstat(current).catch((statError: unknown) => {
+          if (!missing(statError)) throw statError
+          return undefined
+        })
+        if (info?.isSymbolicLink()) throw error
+        const parent = dirname(current)
+        if (parent === current) throw error
+        segments.unshift(relative(parent, current))
+        current = parent
+      }
+    }
+  } catch (cause) {
+    throw new ProviderGuardError(
+      "PATH_RESOLUTION_FAILED",
+      `Cannot resolve ${JSON.stringify(value)}; refusing to assume it is unprotected.`,
+      { cause },
+    )
+  }
+}
+
+/** Keep both spellings so symlinks cannot remove a lexical restriction. */
+export async function pathAliases(value: string): Promise<readonly string[]> {
+  return [...new Set([resolve(value), await physicalPath(value)])]
+}

package/src/policy.ts

@@ -0,0 +1,51 @@
+import { parseOptions, type GuardRule } from "./config.js"
+import { containsPath, expandHome, pathAliases } from "./paths.js"
+
+export interface GuardPolicy {
+  readonly matchedRoots: readonly string[]
+  /** undefined means unrestricted; an empty list means deny all. */
+  readonly allowProviders: readonly string[] | undefined
+}
+
+export function permits(policy: GuardPolicy, providerID: string): boolean {
+  return (
+    policy.allowProviders === undefined ||
+    policy.allowProviders.includes(providerID)
+  )
+}
+
+/** All matching rules intersect: a nested rule cannot relax its parent. */
+export class PolicyEngine {
+  readonly #rules: readonly GuardRule[]
+
+  constructor(options: unknown) {
+    this.#rules = parseOptions(options).rules.map((rule) => ({
+      ...rule,
+      root: expandHome(rule.root),
+    }))
+  }
+
+  async evaluate(directories: readonly string[]): Promise<GuardPolicy> {
+    // No cached filesystem/session state: moves and changed symlink targets are
+    // re-evaluated on the next request, rather than on the next plugin reload.
+    const paths = (await Promise.all(directories.map(pathAliases))).flat()
+    const matches = await Promise.all(
+      this.#rules.map(async (rule) => {
+        const roots = await pathAliases(rule.root)
+        return roots.some((root) =>
+          paths.some((directory) => containsPath(root, directory)),
+        )
+          ? rule
+          : undefined
+      }),
+    )
+    const rules = matches.filter((rule) => rule !== undefined)
+    const first = rules[0]
+    return {
+      matchedRoots: rules.map((rule) => rule.root),
+      allowProviders: first?.allowProviders.filter((provider) =>
+        rules.every((rule) => rule.allowProviders.includes(provider)),
+      ),
+    }
+  }
+}