@route_33/opencode 0.4.2 → 0.4.3

package/README.md

@@ -30,6 +30,8 @@ This plugin never writes your `opencode.json` or `opencode.jsonc`: opencode has
 
 Run `opencode auth login` and choose `route_33`, or set the `ROUTE33_API_KEY` environment variable. Without a key, the TUI wizard offers to save one: per-project inside a git workspace, global otherwise. A globally stored key applies only outside git workspaces — inside a workspace, keys resolve from the environment, the workspace config, or `.opencode/route33.key` (per-project keys are the metering boundary). Skipping the project-key wizard snoozes it for 7 days — "Skip" for that workspace only, "Skip for all workspaces" everywhere (both live in opencode's TUI kv store; remove `project-key-prompt.dismissed-at*` from `~/.local/state/opencode/kv.json` to re-arm sooner). `ROUTE33_BASE_URL` overrides the default gateway URL; `ROUTE33_TUI_PROMPT=0` disables the wizard.
 
+Your key is never written into the resolved provider configuration: authentication is attached per request at fetch time, so `opencode debug config` output contains no credential material.
+
 ## Model catalog
 
 The catalog is discovered dynamically. The plugin calls `GET {baseURL}/models` with your resolved API key, caches the response on disk, and injects only the models that key can see. The refresh ladder is:

package/dist/index.js

@@ -289,16 +289,12 @@ function buildOpenAiChatCompatFetch(fetchImpl) {
 }
 
 // src/config/build-options.ts
-function buildOptions(baseURL, apiKey, resolveKeyNow = () => void 0) {
+function buildOptions(baseURL, resolveKeyNow = () => void 0) {
   const options = { baseURL };
   options.fetch = buildLiveAuthFetch(
     resolveKeyNow,
     buildOpenAiChatCompatFetch()
   );
-  if (apiKey !== void 0) {
-    options.apiKey = apiKey;
-    options.headers = { Authorization: `Bearer ${apiKey}` };
-  }
   return options;
 }
 
@@ -350,7 +346,7 @@ function vendorOf(slug) {
   return slug.slice(0, slug.indexOf("/"));
 }
 function buildProviderBlocks(enriched, options) {
-  const { apiKey, baseURL } = options;
+  const { baseURL } = options;
   const resolveKeyNow = options.resolveKeyNow ?? (() => void 0);
   const route33Models = {};
   for (const slug of Object.keys(enriched).sort()) {
@@ -369,7 +365,7 @@ function buildProviderBlocks(enriched, options) {
     route_33: {
       npm: "@ai-sdk/openai-compatible",
       name: PROVIDER_DISPLAY_NAME,
-      options: buildOptions(baseURL, apiKey, resolveKeyNow),
+      options: buildOptions(baseURL, resolveKeyNow),
       models: route33Models
     }
   };
@@ -1457,11 +1453,10 @@ function createConfigHook(options = {}) {
       const modelsDev = await loadModelsDev(modelsDevOptions);
       const enriched = enrichCatalog(catalog, modelsDev, env);
       const blocks = buildProviderBlocks(enriched, {
-        apiKey: key,
         baseURL,
         // Per-request resolution for the live-auth fetch: a prompt-entered
-        // key applies to the very next request, no restart. The static
-        // apiKey above stays the boot-time/catalog path.
+        // key applies to the very next request, no restart. The block never
+        // carries the key itself, so config dumps stay credential-free.
         resolveKeyNow: () => resolveKey(void 0, env, cwd)
       });
       mergeConfig(cfg, blocks);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@route_33/opencode",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "description": "opencode provider plugin for the route33.ai AI gateway — key-scoped model discovery, cost/limit enrichment, auth, and the key-setup wizard.",