@subrouter/opencode 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -1,14 +1,21 @@
 /**
- * OpenCode plugin that registers the `subrouter` provider.
+ * OpenCode plugins that expose subrouter inside opencode.
  *
- * The config hook injects a custom provider whose npm field points at this
- * package's provider module (file:// URL, so opencode never installs anything).
- * Each subrouter preset becomes a model: pick `subrouter/default` (or any
- * preset created with `subrouter preset create`) in opencode.
+ * `subrouterPlugin` registers the provider: the config hook injects a custom
+ * provider whose npm field points at this package's provider module (file://
+ * URL, so opencode never installs anything). Each subrouter preset becomes a
+ * model: pick `subrouter/default` (or any preset created with
+ * `subrouter preset create`) in opencode.
+ *
+ * `subrouterAuthPlugin` registers the login flow, so `opencode auth login`
+ * (and any harness driving opencode's auth hook, like kimaki's Discord
+ * `/login`) can add subscriptions to the pool without leaving the harness.
+ * It asks which subscription to add first, then defers to that adapter.
  *
  * NOTE: only plugin initializer functions may be exported from this module.
  * OpenCode calls every export as a plugin.
  */
 import type { Plugin } from '@opencode-ai/plugin';
 export declare const subrouterPlugin: Plugin;
+export declare const subrouterAuthPlugin: Plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAQjD,eAAO,MAAM,eAAe,EAAE,MA+B7B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAiBjD,eAAO,MAAM,eAAe,EAAE,MAgC7B,CAAA;AAoBD,eAAO,MAAM,mBAAmB,EAAE,MA0EjC,CAAA"}

package/dist/index.js

@@ -1,15 +1,22 @@
 /**
- * OpenCode plugin that registers the `subrouter` provider.
+ * OpenCode plugins that expose subrouter inside opencode.
  *
- * The config hook injects a custom provider whose npm field points at this
- * package's provider module (file:// URL, so opencode never installs anything).
- * Each subrouter preset becomes a model: pick `subrouter/default` (or any
- * preset created with `subrouter preset create`) in opencode.
+ * `subrouterPlugin` registers the provider: the config hook injects a custom
+ * provider whose npm field points at this package's provider module (file://
+ * URL, so opencode never installs anything). Each subrouter preset becomes a
+ * model: pick `subrouter/default` (or any preset created with
+ * `subrouter preset create`) in opencode.
+ *
+ * `subrouterAuthPlugin` registers the login flow, so `opencode auth login`
+ * (and any harness driving opencode's auth hook, like kimaki's Discord
+ * `/login`) can add subscriptions to the pool without leaving the harness.
+ * It asks which subscription to add first, then defers to that adapter.
  *
  * NOTE: only plugin initializer functions may be exported from this module.
  * OpenCode calls every export as a plugin.
  */
-import { DEFAULT_PRESET_NAME, loadPresets } from '@subrouter/cli';
+import { adapters, addAccount, DEFAULT_PRESET_NAME, isProviderId, loadPresets, PROVIDER_IDS, } from '@subrouter/cli';
+import { addSubrouterHeaders } from "./provider.js";
 function providerEntryUrl() {
     const isDev = import.meta.url.endsWith('.ts');
     return new URL(isDev ? './provider.ts' : './provider.js', import.meta.url).href;
@@ -42,5 +49,95 @@ export const subrouterPlugin = async () => {
                 },
             };
         },
+        'chat.headers': async (input, output) => addSubrouterHeaders(input, output),
+    };
+};
+/**
+ * Map a subrouter account onto the credential shape opencode stores. The
+ * stored copy is redundant (RouterModel only ever reads ~/.subrouter), but
+ * opencode needs a success payload to close the login flow.
+ */
+function toOpencodeCredentials(account) {
+    if (account.type === 'api') {
+        return { type: 'success', key: account.key ?? '' };
+    }
+    return {
+        type: 'success',
+        refresh: account.refresh ?? '',
+        access: account.access ?? '',
+        expires: account.expires ?? 0,
+        accountId: account.accountId,
+    };
+}
+export const subrouterAuthPlugin = async () => {
+    return {
+        auth: {
+            provider: 'subrouter',
+            methods: [
+                {
+                    type: 'oauth',
+                    label: 'Add a subscription',
+                    prompts: [
+                        {
+                            type: 'select',
+                            key: 'provider',
+                            message: 'Which subscription do you want to add?',
+                            options: PROVIDER_IDS.map((id) => {
+                                return { label: adapters[id].name, value: id };
+                            }),
+                        },
+                        {
+                            type: 'select',
+                            key: 'method',
+                            message: 'How do you want to log in to ChatGPT?',
+                            options: [
+                                { label: 'Browser (recommended)', value: 'browser' },
+                                { label: 'Device code', value: 'device', hint: 'May be disabled for your account' },
+                            ],
+                            when: { key: 'provider', op: 'eq', value: 'openai' },
+                        },
+                    ],
+                    authorize: async (inputs) => {
+                        const providerId = inputs?.provider;
+                        if (!providerId || !isProviderId(providerId)) {
+                            // No failure variant exists in AuthOAuthResult, so surface this
+                            // as a request error instead. Harnesses render the message.
+                            throw new Error(`Pick a subscription to add. Expected one of: ${PROVIDER_IDS.join(', ')}`);
+                        }
+                        const adapter = adapters[providerId];
+                        // Remote harnesses (a chat bot, a web UI) authorize in a browser
+                        // that is not on this machine, so a localhost callback never fires
+                        // and the user has to paste the redirect URL back instead.
+                        const session = await adapter.beginLogin({
+                            manualInput: Boolean(process.env.SUBROUTER_MANUAL_OAUTH),
+                            method: inputs?.method,
+                        });
+                        if (session instanceof Error)
+                            throw session;
+                        const finish = async (input) => {
+                            const account = await session.complete(input);
+                            if (account instanceof Error)
+                                return { type: 'failed' };
+                            await addAccount({ provider: providerId, account });
+                            return toOpencodeCredentials(account);
+                        };
+                        if (session.method === 'code') {
+                            return {
+                                url: session.url,
+                                instructions: session.instructions,
+                                method: 'code',
+                                callback: (code) => finish(code),
+                            };
+                        }
+                        return {
+                            url: session.url,
+                            instructions: session.instructions,
+                            method: 'auto',
+                            callback: () => finish(),
+                        };
+                    },
+                },
+            ],
+        },
     };
 };

package/dist/opencode-e2e.test.js

@@ -17,6 +17,8 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { afterAll, beforeAll, describe, expect, test } from 'vitest';
+import { OPENAI_WEBSOCKET_SESSION_HEADER, OPENAI_WEBSOCKET_TITLE_HEADER, } from '@subrouter/cli';
+import { addSubrouterHeaders } from "./provider.js";
 async function startMockServer(handler) {
     const requests = [];
     const server = createServer((req, res) => {
@@ -179,6 +181,24 @@ afterAll(async () => {
     await rm(home, { recursive: true, force: true });
 });
 describe('opencode + subrouter provider', () => {
+    test('adds session affinity headers for subrouter models', async () => {
+        const output = { headers: {} };
+        addSubrouterHeaders({
+            sessionID: 'session-1',
+            agent: 'build',
+            model: { providerID: 'subrouter' },
+        }, output);
+        expect(output.headers).toEqual({ [OPENAI_WEBSOCKET_SESSION_HEADER]: 'session-1' });
+        addSubrouterHeaders({
+            sessionID: 'session-2',
+            agent: 'title',
+            model: { providerID: 'subrouter' },
+        }, output);
+        expect(output.headers).toEqual({
+            [OPENAI_WEBSOCKET_SESSION_HEADER]: 'session-2',
+            [OPENAI_WEBSOCKET_TITLE_HEADER]: 'true',
+        });
+    });
     test('rate-limited provider is cycled to the fallback through opencode', async () => {
         const client = createOpencodeClient({ baseUrl: server.url });
         const session = await client.session.create({

package/dist/plugin.test.js

@@ -1,17 +1,70 @@
+import { createServer } from 'node:http';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { afterEach, beforeEach, expect, test } from 'vitest';
-import { subrouterPlugin } from "./index.js";
+import { loadAccounts, PROVIDER_IDS } from '@subrouter/cli';
+import { subrouterAuthPlugin, subrouterPlugin } from "./index.js";
 let home;
+const openServers = [];
 beforeEach(async () => {
     home = await mkdtemp(path.join(tmpdir(), 'subrouter-plugin-'));
     process.env.SUBROUTER_HOME = home;
 });
 afterEach(async () => {
     delete process.env.SUBROUTER_HOME;
+    delete process.env.SUBROUTER_OPENAI_ISSUER_URL;
+    for (const server of openServers.splice(0)) {
+        await new Promise((resolve) => {
+            server.close(() => {
+                resolve();
+            });
+        });
+    }
     await rm(home, { recursive: true, force: true });
 });
+/** Minimal stand-in for the OpenAI Codex device endpoints. */
+async function startFakeOpenAIIssuer() {
+    const server = createServer((req, res) => {
+        const url = new URL(req.url || '', 'http://localhost');
+        const send = (body) => {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(body));
+        };
+        if (url.pathname === '/api/accounts/deviceauth/usercode') {
+            return send({ device_auth_id: 'dev-1', user_code: 'ABCD-9876', interval: '0' });
+        }
+        if (url.pathname === '/api/accounts/deviceauth/token') {
+            return send({ authorization_code: 'auth-code', code_verifier: 'verifier' });
+        }
+        if (url.pathname === '/oauth/token') {
+            const claims = Buffer.from(JSON.stringify({ email: 'pool@example.com', chatgpt_account_id: 'acct-9' })).toString('base64url');
+            return send({
+                access_token: 'access-9',
+                refresh_token: 'refresh-9',
+                expires_in: 3600,
+                id_token: `header.${claims}.signature`,
+            });
+        }
+        res.writeHead(404).end('{}');
+    });
+    await new Promise((resolve) => {
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    if (typeof address === 'string' || !address)
+        throw new Error('failed to bind fake issuer');
+    openServers.push(server);
+    return `http://127.0.0.1:${address.port}`;
+}
+function authMethod() {
+    return subrouterAuthPlugin({}).then((hooks) => {
+        const method = hooks.auth?.methods[0];
+        if (!method || method.type !== 'oauth')
+            throw new Error('expected an oauth method');
+        return { provider: hooks.auth.provider, method };
+    });
+}
 test('config hook registers the subrouter provider with preset models', async () => {
     await writeFile(path.join(home, 'presets.json'), JSON.stringify({ version: 1, presets: { work: ['anthropic/claude-opus-4-6'] } }));
     const hooks = await subrouterPlugin({});
@@ -24,3 +77,57 @@ test('config hook registers the subrouter provider with preset models', async ()
     expect(Object.keys(provider.models).sort()).toEqual(['default', 'work']);
     expect(provider.models.default.cost).toEqual({ input: 0, output: 0, cache_read: 0, cache_write: 0 });
 });
+test('auth hook asks which subscription to add before authorizing', async () => {
+    const { provider, method } = await authMethod();
+    expect(provider).toBe('subrouter');
+    const prompt = method.prompts?.[0];
+    expect(prompt?.type).toBe('select');
+    expect(prompt?.key).toBe('provider');
+    expect(prompt?.type === 'select' && prompt.options.map((o) => o.value)).toEqual([...PROVIDER_IDS]);
+    const methodPrompt = method.prompts?.[1];
+    expect(methodPrompt?.type).toBe('select');
+    expect(methodPrompt?.key).toBe('method');
+    expect(methodPrompt?.type === 'select' && methodPrompt.options.map((o) => o.value)).toEqual([
+        'browser',
+        'device',
+    ]);
+});
+test('authorize rejects a missing or unknown subscription', async () => {
+    const { method } = await authMethod();
+    await expect(method.authorize({})).rejects.toThrow(/Pick a subscription/);
+    await expect(method.authorize({ provider: 'nope' })).rejects.toThrow(/Pick a subscription/);
+});
+test('authorize dispatches to the chosen adapter and the callback pools the account', async () => {
+    process.env.SUBROUTER_OPENAI_ISSUER_URL = await startFakeOpenAIIssuer();
+    const { method } = await authMethod();
+    const result = await method.authorize({ provider: 'openai', method: 'device' });
+    expect(result.method).toBe('auto');
+    expect(result.instructions).toMatch(/code:\s*ABCD-9876/);
+    if (result.method !== 'auto')
+        throw new Error('expected the device flow');
+    const credentials = await result.callback();
+    expect(credentials).toMatchObject({ type: 'success', access: 'access-9', refresh: 'refresh-9' });
+    const accounts = await loadAccounts();
+    expect(accounts.providers.openai?.accounts).toMatchObject([
+        { type: 'oauth', email: 'pool@example.com', accountId: 'acct-9' },
+    ]);
+});
+test('opencode zen asks for a pasted key and stores it as an api account', async () => {
+    const { method } = await authMethod();
+    const result = await method.authorize({ provider: 'opencode' });
+    expect(result.method).toBe('code');
+    if (result.method !== 'code')
+        throw new Error('expected a pasted-key flow');
+    expect(await result.callback('zen-key-1')).toMatchObject({ type: 'success', key: 'zen-key-1' });
+    const accounts = await loadAccounts();
+    expect(accounts.providers.opencode?.accounts).toMatchObject([{ type: 'api', key: 'zen-key-1' }]);
+});
+test('a failed login reports failure instead of pooling a broken account', async () => {
+    const { method } = await authMethod();
+    const result = await method.authorize({ provider: 'opencode' });
+    if (result.method !== 'code')
+        throw new Error('expected a pasted-key flow');
+    expect(await result.callback('   ')).toEqual({ type: 'failed' });
+    const accounts = await loadAccounts();
+    expect(accounts.providers.opencode).toBeUndefined();
+});

package/dist/provider.d.ts

@@ -4,4 +4,13 @@
  * then `sdk.languageModel(modelId)` where modelId is a subrouter preset name.
  */
 export { createSubrouter } from '@subrouter/cli';
+export declare function addSubrouterHeaders(input: {
+    sessionID: string;
+    agent: string;
+    model: {
+        providerID: string;
+    };
+}, output: {
+    headers: Record<string, string>;
+}): void;
 //# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAC1E,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,QAK5C"}

package/dist/provider.js

@@ -3,4 +3,12 @@
  * OpenCode imports this module, calls the first export starting with `create`,
  * then `sdk.languageModel(modelId)` where modelId is a subrouter preset name.
  */
+import { OPENAI_WEBSOCKET_SESSION_HEADER, OPENAI_WEBSOCKET_TITLE_HEADER, } from '@subrouter/cli';
 export { createSubrouter } from '@subrouter/cli';
+export function addSubrouterHeaders(input, output) {
+    if (input.model.providerID !== 'subrouter')
+        return;
+    output.headers[OPENAI_WEBSOCKET_SESSION_HEADER] = input.sessionID;
+    if (input.agent === 'title')
+        output.headers[OPENAI_WEBSOCKET_TITLE_HEADER] = 'true';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subrouter/opencode",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "OpenCode plugin that registers the subrouter provider: cycle through your personal AI subscriptions when one hits rate limits.",
   "main": "./dist/index.js",
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "errore": "^0.14.1",
-    "@subrouter/cli": "^0.1.0"
+    "@subrouter/cli": "^0.2.0"
   },
   "devDependencies": {
     "@opencode-ai/plugin": "^1.18.23",

package/src/index.ts

@@ -1,17 +1,32 @@
 /**
- * OpenCode plugin that registers the `subrouter` provider.
+ * OpenCode plugins that expose subrouter inside opencode.
  *
- * The config hook injects a custom provider whose npm field points at this
- * package's provider module (file:// URL, so opencode never installs anything).
- * Each subrouter preset becomes a model: pick `subrouter/default` (or any
- * preset created with `subrouter preset create`) in opencode.
+ * `subrouterPlugin` registers the provider: the config hook injects a custom
+ * provider whose npm field points at this package's provider module (file://
+ * URL, so opencode never installs anything). Each subrouter preset becomes a
+ * model: pick `subrouter/default` (or any preset created with
+ * `subrouter preset create`) in opencode.
+ *
+ * `subrouterAuthPlugin` registers the login flow, so `opencode auth login`
+ * (and any harness driving opencode's auth hook, like kimaki's Discord
+ * `/login`) can add subscriptions to the pool without leaving the harness.
+ * It asks which subscription to add first, then defers to that adapter.
  *
  * NOTE: only plugin initializer functions may be exported from this module.
  * OpenCode calls every export as a plugin.
  */
 
 import type { Plugin } from '@opencode-ai/plugin'
-import { DEFAULT_PRESET_NAME, loadPresets } from '@subrouter/cli'
+import {
+  adapters,
+  addAccount,
+  DEFAULT_PRESET_NAME,
+  isProviderId,
+  loadPresets,
+  PROVIDER_IDS,
+  type StoredAccount,
+} from '@subrouter/cli'
+import { addSubrouterHeaders } from './provider.ts'
 
 function providerEntryUrl() {
   const isDev = import.meta.url.endsWith('.ts')
@@ -48,5 +63,100 @@ export const subrouterPlugin: Plugin = async () => {
         },
       }
     },
+    'chat.headers': async (input, output) => addSubrouterHeaders(input, output),
+  }
+}
+
+/**
+ * Map a subrouter account onto the credential shape opencode stores. The
+ * stored copy is redundant (RouterModel only ever reads ~/.subrouter), but
+ * opencode needs a success payload to close the login flow.
+ */
+function toOpencodeCredentials(account: StoredAccount) {
+  if (account.type === 'api') {
+    return { type: 'success' as const, key: account.key ?? '' }
+  }
+  return {
+    type: 'success' as const,
+    refresh: account.refresh ?? '',
+    access: account.access ?? '',
+    expires: account.expires ?? 0,
+    accountId: account.accountId,
+  }
+}
+
+export const subrouterAuthPlugin: Plugin = async () => {
+  return {
+    auth: {
+      provider: 'subrouter',
+      methods: [
+        {
+          type: 'oauth',
+          label: 'Add a subscription',
+          prompts: [
+            {
+              type: 'select',
+              key: 'provider',
+              message: 'Which subscription do you want to add?',
+              options: PROVIDER_IDS.map((id) => {
+                return { label: adapters[id].name, value: id }
+              }),
+            },
+            {
+              type: 'select',
+              key: 'method',
+              message: 'How do you want to log in to ChatGPT?',
+              options: [
+                { label: 'Browser (recommended)', value: 'browser' },
+                { label: 'Device code', value: 'device', hint: 'May be disabled for your account' },
+              ],
+              when: { key: 'provider', op: 'eq', value: 'openai' },
+            },
+          ],
+          authorize: async (inputs) => {
+            const providerId = inputs?.provider
+            if (!providerId || !isProviderId(providerId)) {
+              // No failure variant exists in AuthOAuthResult, so surface this
+              // as a request error instead. Harnesses render the message.
+              throw new Error(
+                `Pick a subscription to add. Expected one of: ${PROVIDER_IDS.join(', ')}`,
+              )
+            }
+
+            const adapter = adapters[providerId]
+            // Remote harnesses (a chat bot, a web UI) authorize in a browser
+            // that is not on this machine, so a localhost callback never fires
+            // and the user has to paste the redirect URL back instead.
+            const session = await adapter.beginLogin({
+              manualInput: Boolean(process.env.SUBROUTER_MANUAL_OAUTH),
+              method: inputs?.method,
+            })
+            if (session instanceof Error) throw session
+
+            const finish = async (input?: string) => {
+              const account = await session.complete(input)
+              if (account instanceof Error) return { type: 'failed' as const }
+              await addAccount({ provider: providerId, account })
+              return toOpencodeCredentials(account)
+            }
+
+            if (session.method === 'code') {
+              return {
+                url: session.url,
+                instructions: session.instructions,
+                method: 'code' as const,
+                callback: (code) => finish(code),
+              }
+            }
+            return {
+              url: session.url,
+              instructions: session.instructions,
+              method: 'auto' as const,
+              callback: () => finish(),
+            }
+          },
+        },
+      ],
+    },
   }
 }

package/src/opencode-e2e.test.ts

@@ -18,6 +18,11 @@ import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { afterAll, beforeAll, describe, expect, test } from 'vitest'
+import {
+  OPENAI_WEBSOCKET_SESSION_HEADER,
+  OPENAI_WEBSOCKET_TITLE_HEADER,
+} from '@subrouter/cli'
+import { addSubrouterHeaders } from './provider.ts'
 
 type MockServer = {
   url: string
@@ -59,7 +64,7 @@ async function startMockServer(
   }
 }
 
-function sseChunk(data: unknown) {
+function sseChunk(data: object) {
   return `data: ${JSON.stringify(data)}\n\n`
 }
 
@@ -208,6 +213,32 @@ afterAll(async () => {
 })
 
 describe('opencode + subrouter provider', () => {
+  test('adds session affinity headers for subrouter models', async () => {
+    const output = { headers: {} }
+    addSubrouterHeaders(
+      {
+        sessionID: 'session-1',
+        agent: 'build',
+        model: { providerID: 'subrouter' },
+      },
+      output,
+    )
+    expect(output.headers).toEqual({ [OPENAI_WEBSOCKET_SESSION_HEADER]: 'session-1' })
+
+    addSubrouterHeaders(
+      {
+        sessionID: 'session-2',
+        agent: 'title',
+        model: { providerID: 'subrouter' },
+      },
+      output,
+    )
+    expect(output.headers).toEqual({
+      [OPENAI_WEBSOCKET_SESSION_HEADER]: 'session-2',
+      [OPENAI_WEBSOCKET_TITLE_HEADER]: 'true',
+    })
+  })
+
   test('rate-limited provider is cycled to the fallback through opencode', async () => {
     const client = createOpencodeClient({ baseUrl: server.url })
 
@@ -229,7 +260,7 @@ describe('opencode + subrouter provider', () => {
     const parts = result.data?.parts ?? []
     const texts = parts
       .filter((part) => part.type === 'text')
-      .map((part) => (part as { text: string }).text)
+      .map((part) => part.text)
       .join('\n')
     expect(texts).toContain('hello from fallback')
 

package/src/plugin.test.ts

@@ -1,11 +1,14 @@
+import { createServer, type Server } from 'node:http'
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, beforeEach, expect, test } from 'vitest'
 import type { PluginInput } from '@opencode-ai/plugin'
-import { subrouterPlugin } from './index.ts'
+import { loadAccounts, PROVIDER_IDS } from '@subrouter/cli'
+import { subrouterAuthPlugin, subrouterPlugin } from './index.ts'
 
 let home: string
+const openServers: Server[] = []
 
 beforeEach(async () => {
   home = await mkdtemp(path.join(tmpdir(), 'subrouter-plugin-'))
@@ -14,9 +17,61 @@ beforeEach(async () => {
 
 afterEach(async () => {
   delete process.env.SUBROUTER_HOME
+  delete process.env.SUBROUTER_OPENAI_ISSUER_URL
+  for (const server of openServers.splice(0)) {
+    await new Promise<void>((resolve) => {
+      server.close(() => {
+        resolve()
+      })
+    })
+  }
   await rm(home, { recursive: true, force: true })
 })
 
+/** Minimal stand-in for the OpenAI Codex device endpoints. */
+async function startFakeOpenAIIssuer() {
+  const server = createServer((req, res) => {
+    const url = new URL(req.url || '', 'http://localhost')
+    const send = (body: unknown) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify(body))
+    }
+    if (url.pathname === '/api/accounts/deviceauth/usercode') {
+      return send({ device_auth_id: 'dev-1', user_code: 'ABCD-9876', interval: '0' })
+    }
+    if (url.pathname === '/api/accounts/deviceauth/token') {
+      return send({ authorization_code: 'auth-code', code_verifier: 'verifier' })
+    }
+    if (url.pathname === '/oauth/token') {
+      const claims = Buffer.from(
+        JSON.stringify({ email: 'pool@example.com', chatgpt_account_id: 'acct-9' }),
+      ).toString('base64url')
+      return send({
+        access_token: 'access-9',
+        refresh_token: 'refresh-9',
+        expires_in: 3600,
+        id_token: `header.${claims}.signature`,
+      })
+    }
+    res.writeHead(404).end('{}')
+  })
+  await new Promise<void>((resolve) => {
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  if (typeof address === 'string' || !address) throw new Error('failed to bind fake issuer')
+  openServers.push(server)
+  return `http://127.0.0.1:${address.port}`
+}
+
+function authMethod() {
+  return subrouterAuthPlugin({} as PluginInput).then((hooks) => {
+    const method = hooks.auth?.methods[0]
+    if (!method || method.type !== 'oauth') throw new Error('expected an oauth method')
+    return { provider: hooks.auth!.provider, method }
+  })
+}
+
 test('config hook registers the subrouter provider with preset models', async () => {
   await writeFile(
     path.join(home, 'presets.json'),
@@ -34,3 +89,69 @@ test('config hook registers the subrouter provider with preset models', async ()
   expect(Object.keys(provider.models).sort()).toEqual(['default', 'work'])
   expect(provider.models.default.cost).toEqual({ input: 0, output: 0, cache_read: 0, cache_write: 0 })
 })
+
+test('auth hook asks which subscription to add before authorizing', async () => {
+  const { provider, method } = await authMethod()
+
+  expect(provider).toBe('subrouter')
+  const prompt = method.prompts?.[0]
+  expect(prompt?.type).toBe('select')
+  expect(prompt?.key).toBe('provider')
+  expect(prompt?.type === 'select' && prompt.options.map((o) => o.value)).toEqual([...PROVIDER_IDS])
+  const methodPrompt = method.prompts?.[1]
+  expect(methodPrompt?.type).toBe('select')
+  expect(methodPrompt?.key).toBe('method')
+  expect(methodPrompt?.type === 'select' && methodPrompt.options.map((o) => o.value)).toEqual([
+    'browser',
+    'device',
+  ])
+})
+
+test('authorize rejects a missing or unknown subscription', async () => {
+  const { method } = await authMethod()
+
+  await expect(method.authorize({})).rejects.toThrow(/Pick a subscription/)
+  await expect(method.authorize({ provider: 'nope' })).rejects.toThrow(/Pick a subscription/)
+})
+
+test('authorize dispatches to the chosen adapter and the callback pools the account', async () => {
+  process.env.SUBROUTER_OPENAI_ISSUER_URL = await startFakeOpenAIIssuer()
+  const { method } = await authMethod()
+
+  const result = await method.authorize({ provider: 'openai', method: 'device' })
+  expect(result.method).toBe('auto')
+  expect(result.instructions).toMatch(/code:\s*ABCD-9876/)
+
+  if (result.method !== 'auto') throw new Error('expected the device flow')
+  const credentials = await result.callback()
+
+  expect(credentials).toMatchObject({ type: 'success', access: 'access-9', refresh: 'refresh-9' })
+  const accounts = await loadAccounts()
+  expect(accounts.providers.openai?.accounts).toMatchObject([
+    { type: 'oauth', email: 'pool@example.com', accountId: 'acct-9' },
+  ])
+})
+
+test('opencode zen asks for a pasted key and stores it as an api account', async () => {
+  const { method } = await authMethod()
+
+  const result = await method.authorize({ provider: 'opencode' })
+  expect(result.method).toBe('code')
+
+  if (result.method !== 'code') throw new Error('expected a pasted-key flow')
+  expect(await result.callback('zen-key-1')).toMatchObject({ type: 'success', key: 'zen-key-1' })
+
+  const accounts = await loadAccounts()
+  expect(accounts.providers.opencode?.accounts).toMatchObject([{ type: 'api', key: 'zen-key-1' }])
+})
+
+test('a failed login reports failure instead of pooling a broken account', async () => {
+  const { method } = await authMethod()
+
+  const result = await method.authorize({ provider: 'opencode' })
+  if (result.method !== 'code') throw new Error('expected a pasted-key flow')
+
+  expect(await result.callback('   ')).toEqual({ type: 'failed' })
+  const accounts = await loadAccounts()
+  expect(accounts.providers.opencode).toBeUndefined()
+})

package/src/provider.ts

@@ -4,4 +4,18 @@
  * then `sdk.languageModel(modelId)` where modelId is a subrouter preset name.
  */
 
+import {
+  OPENAI_WEBSOCKET_SESSION_HEADER,
+  OPENAI_WEBSOCKET_TITLE_HEADER,
+} from '@subrouter/cli'
+
 export { createSubrouter } from '@subrouter/cli'
+
+export function addSubrouterHeaders(
+  input: { sessionID: string; agent: string; model: { providerID: string } },
+  output: { headers: Record<string, string> },
+) {
+  if (input.model.providerID !== 'subrouter') return
+  output.headers[OPENAI_WEBSOCKET_SESSION_HEADER] = input.sessionID
+  if (input.agent === 'title') output.headers[OPENAI_WEBSOCKET_TITLE_HEADER] = 'true'
+}