@vellumai/assistant 0.11.6 → 0.11.7-staging.1

package/src/providers/inference/__tests__/base-url-route-validation.test.ts

@@ -184,6 +184,22 @@ describe("base_url provider-type gate (create)", () => {
     );
   });
 
+  test("accepts base_url on opencode provider", async () => {
+    mockResolvedAddresses = ["93.184.216.34"];
+    const result = await handleCreate({
+      body: {
+        name: "valid-opencode-go",
+        provider: "opencode",
+        auth: { type: "api_key", credential: "cred-opencode" },
+        base_url: "https://opencode.ai/zen/go/v1",
+      },
+    });
+    expect(result).toBeDefined();
+    expect((result as { baseUrl: string }).baseUrl).toBe(
+      "https://opencode.ai/zen/go/v1",
+    );
+  });
+
   test("accepts base_url on ollama provider", async () => {
     mockResolvedAddresses = ["93.184.216.34"];
     const result = await handleCreate({

package/src/providers/inference/__tests__/base-url-security.test.ts

@@ -174,6 +174,18 @@ describe("resolveAuth defense-in-depth", () => {
     }
   });
 
+  test("preserves baseUrl for opencode provider", async () => {
+    const result = await resolveAuth(
+      { type: "api_key", credential: "cred-test" },
+      "opencode",
+      { baseUrl: "https://opencode.ai/zen/go/v1" },
+    );
+    expect(result.ok).toBe(true);
+    if (result.ok && result.resolved.kind === "header") {
+      expect(result.resolved.baseUrl).toBe("https://opencode.ai/zen/go/v1");
+    }
+  });
+
   test("preserves baseUrl for ollama none-auth", async () => {
     const result = await resolveAuth({ type: "none" }, "ollama", {
       baseUrl: "http://192.168.1.50:11434/v1",

package/src/providers/inference/adapter-factory.ts

@@ -18,7 +18,18 @@
  *   3. Register the client in `ADAPTER_FACTORIES` below.
  */
 
+import { resolveDefaultProfileForProvider } from "../../config/default-profile-catalog.js";
+import {
+  FALLBACK_PROFILE_BY_KEY,
+  isDefaultProfileKey,
+} from "../../config/default-profile-names.js";
+import {
+  resolveCallSiteConfigWithProfile,
+  selectWinningProfile,
+} from "../../config/llm-resolver.js";
+import { getConfig } from "../../config/loader.js";
 import { normalizeCredentialRef } from "../../security/credential-key.js";
+import { getLogger } from "../../util/logger.js";
 import { AnthropicProvider } from "../anthropic/client.js";
 import { AtlasCloudProvider } from "../atlascloud/client.js";
 import { BasetenProvider } from "../baseten/client.js";
@@ -29,13 +40,20 @@ import { PROVIDER_CATALOG } from "../model-catalog.js";
 import { OllamaProvider } from "../ollama/client.js";
 import { OpenAIChatCompletionsProvider } from "../openai/chat-completions-provider.js";
 import { OpenAIResponsesProvider } from "../openai/responses-provider.js";
+import { OpenCodeProvider } from "../opencode/client.js";
 import { OpenRouterProvider } from "../openrouter/client.js";
 import { PoolsideProvider } from "../poolside/client.js";
+import { dispatchProviderResolvable } from "../provider-resolvability.js";
 import { RetryProvider } from "../retry.js";
 import { TogetherProvider } from "../together/client.js";
-import type { Provider } from "../types.js";
+import type { Provider, SendMessageOptions } from "../types.js";
 import { UsageTrackingProvider } from "../usage-tracking.js";
-import { isVellumManagedConnection } from "../vellum-model-routing.js";
+import {
+  getManagedUpstream,
+  isVellumManagedConnection,
+  MANAGED_ROUTABLE_PROVIDERS,
+  VELLUM_MANAGED_PROVIDER,
+} from "../vellum-model-routing.js";
 import { VercelAIGatewayProvider } from "../vercel-ai-gateway/client.js";
 import type { ResolvedAuth } from "./auth.js";
 import type { ProviderConnection } from "./auth.js";
@@ -58,6 +76,15 @@ export interface AdapterCreateOpts {
 
 type AdapterFactory = (opts: AdapterCreateOpts) => Provider;
 
+const log = getLogger("adapter-factory");
+
+/** The backup route `RetryProvider` escalates to; see {@link makeFallbackRouteResolver}. */
+interface FallbackRoute {
+  provider: Provider;
+  overrideProfile: string;
+  forwardUsageAttributionHeaders: boolean;
+}
+
 /**
  * Catalog-keyed factory table. Each entry takes a unified
  * `AdapterCreateOpts` and constructs the underlying provider client. The
@@ -138,6 +165,11 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       assistantReasoningField: "reasoning_content",
       ...(baseURL ? { baseURL } : {}),
     }),
+  opencode: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
+    new OpenCodeProvider(apiKey, model, {
+      streamTimeoutMs,
+      ...(baseURL ? { baseURL } : {}),
+    }),
   // Keyless openai-compatible endpoints (e.g. LM Studio) ignore the key; the
   // placeholder satisfies the OpenAI SDK, which requires a non-empty key.
   "openai-compatible": ({ apiKey, model, streamTimeoutMs, baseURL }) =>
@@ -275,6 +307,195 @@ export function createAdapterFromConnection(
     };
   }
 
+  /**
+   * Resolve the backup-profile route for a request whose primary route just
+   * failed with an outage-shaped error, so `RetryProvider` can serve it on a
+   * different provider instead of surfacing the outage.
+   *
+   * The winning profile of the FAILED call is re-resolved from the same
+   * inputs `normalizeSendMessageOptions` uses (call site plus the request's
+   * own override/seed fields), and its `fallbackProfile` pointer names the
+   * backup. The upstream comes from the backup's resolved provider; only the
+   * `vellum` routing identity carries no upstream of its own, and there the
+   * backup's model determines it.
+   *
+   * Returns a RAW adapter, exactly like `makeCredentialRefresher` above:
+   * `RetryProvider` hands the backup route options it has ALREADY normalized
+   * (call site consumed, wire params resolved from the backup profile, usage
+   * attribution headers stamped). A second `RetryProvider` in between would
+   * re-normalize that call-site-less config and strip those headers, leaving
+   * degraded traffic unattributed on the platform's billing events.
+   *
+   * Never throws: a broken backup lookup must surface the original provider
+   * error, not a new one.
+   */
+  function makeFallbackRouteResolver(): (
+    failedOptions: SendMessageOptions | undefined,
+  ) => Promise<FallbackRoute | null> {
+    return async (failedOptions): Promise<FallbackRoute | null> => {
+      const failedConfig = failedOptions?.config;
+      const callSite = failedConfig?.callSite;
+      if (callSite === undefined) {
+        return null;
+      }
+      try {
+        const { llm } = getConfig();
+        const winner = selectWinningProfile(callSite, llm, {
+          overrideProfile: failedConfig?.overrideProfile,
+          forceOverrideProfile: failedConfig?.forceOverrideProfile,
+          selectionSeed: failedConfig?.selectionSeed,
+          isResolvableProvider: dispatchProviderResolvable,
+        });
+        const primaryProfile =
+          winner.profileName ??
+          (winner.source === "default" ? "balanced" : undefined);
+        if (
+          primaryProfile === undefined ||
+          !isDefaultProfileKey(primaryProfile)
+        ) {
+          return null;
+        }
+        const expectedFallback = FALLBACK_PROFILE_BY_KEY[primaryProfile];
+        if (
+          winner.entry?.source !== "managed" ||
+          winner.entry.fallbackProfile !== expectedFallback
+        ) {
+          return null;
+        }
+        const overrideProfile = expectedFallback;
+        // Resolved the provider-aware way the runtime resolver resolves every
+        // profile name: the backups are companions of the managed column and
+        // must not materialize under a BYOK or ChatGPT default provider.
+        const backup = resolveDefaultProfileForProvider(
+          llm.profiles,
+          overrideProfile,
+          llm.defaultProvider ?? null,
+        );
+        if (backup?.model == null) {
+          log.warn(
+            { connectionName: connection.name, overrideProfile },
+            "Backup profile does not resolve on this default provider; keeping the original error",
+          );
+          return null;
+        }
+        const { config: resolvedBackup, profileName: resolvedBackupProfile } =
+          resolveCallSiteConfigWithProfile(callSite, llm, {
+            overrideProfile,
+            forceOverrideProfile: true,
+            selectionSeed: failedConfig?.selectionSeed,
+            isResolvableProvider: dispatchProviderResolvable,
+          });
+        if (resolvedBackupProfile !== overrideProfile) {
+          log.warn(
+            {
+              connectionName: connection.name,
+              overrideProfile,
+              selectedProfile: resolvedBackupProfile,
+            },
+            "Backup profile is not dispatch-resolvable; keeping the original error",
+          );
+          return null;
+        }
+        // The model the adapter serves must be the model the fallback send
+        // carries, so it comes from the same forced-profile resolution.
+        // This callback authenticates the backup with the managed connection
+        // it was built for, so it can only serve a backup that routes through
+        // the managed column. Refusing any other route keeps managed billing
+        // and credentials from being applied to user-owned traffic.
+        // Keyed on the connection, not the provider: a call-site fragment that
+        // pins a concrete upstream over a managed winner keeps the managed
+        // routing and is stamped with this connection's name by the resolver
+        // (see `llm-resolver.ts`), so a concrete `provider` here is still
+        // managed traffic. Only a profile that names a different connection,
+        // or a concrete provider carrying no managed connection at all (a BYOK
+        // winner), routes somewhere this callback cannot authenticate.
+        const backupConnection = resolvedBackup.provider_connection;
+        const routesThroughThisConnection =
+          backupConnection === undefined
+            ? resolvedBackup.provider === VELLUM_MANAGED_PROVIDER
+            : backupConnection === connection.name;
+        if (!routesThroughThisConnection) {
+          log.warn(
+            {
+              connectionName: connection.name,
+              overrideProfile,
+              backupProvider: resolvedBackup.provider,
+              backupConnection,
+            },
+            "Backup profile routes outside the managed connection; keeping the original error",
+          );
+          return null;
+        }
+        // The upstream is the resolved provider, the same way normal dispatch
+        // picks it for this connection: `connection-resolution.ts` threads the
+        // resolved provider through as `providerOverride` for a `vellum`
+        // connection and derives the upstream from the model only when the
+        // provider is the routing-identity sentinel (`resolveRoutingIdentity`,
+        // and the `isVellum && !expectedProvider` branch). Deriving it from the
+        // model here regardless would send a provider-pinned call-site fragment
+        // to a different upstream than a primary send of the same resolution,
+        // and would refuse a managed model the catalog does not list yet even
+        // though normal dispatch serves it. A provider the managed proxy cannot
+        // front (a non-routable id, or another routing identity such as
+        // `chatgpt`) is refused rather than routed.
+        const declaredProvider = resolvedBackup.provider;
+        const upstream =
+          declaredProvider === VELLUM_MANAGED_PROVIDER
+            ? getManagedUpstream(resolvedBackup.model)
+            : MANAGED_ROUTABLE_PROVIDERS.has(declaredProvider)
+              ? declaredProvider
+              : null;
+        if (upstream === null) {
+          log.warn(
+            {
+              connectionName: connection.name,
+              overrideProfile,
+              backupProvider: declaredProvider,
+              backupModel: resolvedBackup.model,
+            },
+            "Backup profile does not resolve to a managed upstream; keeping the original error",
+          );
+          return null;
+        }
+        // Re-resolve auth for the BACKUP upstream: the managed proxy's base URL
+        // is per-upstream, so the primary's resolved auth cannot be reused.
+        const backupAuth = await resolveAuth(
+          effectiveConnectionAuth(connection),
+          upstream,
+          { baseUrl: connection.baseUrl },
+        );
+        if (!backupAuth.ok) {
+          return null;
+        }
+        const backupAdapter = buildConnectionAdapter(
+          connection,
+          backupAuth.resolved,
+          // `useNativeWebSearch` carries over from the primary: it is a
+          // property of this request's web-search config, and every managed
+          // backup pin either supports native search or ignores the flag.
+          { ...opts, model: resolvedBackup.model, provider: upstream },
+        );
+        if (backupAdapter === null) {
+          return null;
+        }
+        return {
+          provider: backupAdapter,
+          overrideProfile,
+          // Always true: this callback is wired only on the managed proxy, so
+          // the backup route runs through it too and its `X-Vellum-*` billing
+          // metadata reaches our own backend, never a third party.
+          forwardUsageAttributionHeaders: true,
+        };
+      } catch (err) {
+        log.warn(
+          { err, connectionName: connection.name, callSite },
+          "Failed to resolve a backup profile route; keeping the original error",
+        );
+        return null;
+      }
+    };
+  }
+
   // Usage-attribution headers (`X-Vellum-*`) are only meaningful when the
   // request is routed through the Vellum-managed proxy. They carry billing
   // metadata for our own backend. Forwarding them to a third-party endpoint
@@ -295,8 +516,15 @@ export function createAdapterFromConnection(
               ? "no-auth"
               : undefined,
       connectionName: connection.name,
+      // Both escalations are managed-route only. A BYOK, oauth-subscription,
+      // or no-auth connection must never fall back: the install may hold no
+      // credential for the backup profile's provider, and only the managed
+      // column carries `fallbackProfile` pointers in the first place.
       ...(isManagedProxy
-        ? { refreshCredentialProvider: makeCredentialRefresher() }
+        ? {
+            refreshCredentialProvider: makeCredentialRefresher(),
+            resolveFallbackRoute: makeFallbackRouteResolver(),
+          }
         : {}),
     }),
   );

package/src/providers/inference/auth.ts

@@ -190,6 +190,7 @@ export const PROVIDERS_REQUIRING_BASE_URL_AND_MODELS: ReadonlySet<string> =
 export const PROVIDERS_ALLOWING_CUSTOM_BASE_URL: ReadonlySet<string> = new Set([
   ...PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
   "ollama",
+  "opencode",
 ]);
 
 // ---------------------------------------------------------------------------

package/src/providers/inference/chatgpt-subscription-auth.ts

@@ -0,0 +1,70 @@
+/**
+ * In-daemon completion of the "ChatGPT Subscription" sign-in: store the tokens
+ * and point the provider connection at them in one step.
+ *
+ * The OAuth client config and the credential writes live in
+ * `chatgpt-subscription-credentials.ts`, which depends on nothing but the
+ * credential store so the CLI can import it without pulling in the database.
+ */
+
+import { getDb } from "../../persistence/db-connection.js";
+import type { OAuth2TokenResult } from "../../security/oauth2.js";
+import { getLogger } from "../../util/logger.js";
+import {
+  CHATGPT_SUBSCRIPTION_AUTH_INPUT,
+  CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+  storeChatgptSubscriptionCredentials,
+} from "./chatgpt-subscription-credentials.js";
+import {
+  createConnection,
+  getConnection,
+  updateConnection,
+} from "./connections.js";
+
+const log = getLogger("chatgpt-subscription-auth");
+
+/**
+ * Store the subscription's tokens and point the `chatgpt-subscription` provider
+ * connection at them, creating the connection when it does not exist yet.
+ */
+export async function storeChatgptSubscriptionTokens(
+  tokens: OAuth2TokenResult,
+): Promise<void> {
+  await storeChatgptSubscriptionCredentials(tokens);
+
+  const db = getDb();
+  const existing = getConnection(db, CHATGPT_SUBSCRIPTION_CONNECTION_NAME);
+
+  if (existing) {
+    // Stamp the provider with the auth: this row IS the subscription route
+    // (auth modality = provider identity), and dispatch derives the openai
+    // upstream from the identity per-request. Stamping also heals a
+    // claiming row whose provider would otherwise misroute the fresh token.
+    const updateResult = updateConnection(
+      db,
+      CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+      { auth: CHATGPT_SUBSCRIPTION_AUTH_INPUT, provider: "chatgpt" },
+    );
+    if (!updateResult.ok) {
+      log.error(
+        { error: updateResult.error },
+        "Failed to update chatgpt-subscription connection",
+      );
+      throw new Error("Failed to update connection");
+    }
+    return;
+  }
+
+  const createResult = createConnection(db, {
+    name: CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+    provider: "chatgpt",
+    auth: CHATGPT_SUBSCRIPTION_AUTH_INPUT,
+  });
+  if (!createResult.ok) {
+    log.error(
+      { error: createResult.error },
+      "Failed to create chatgpt-subscription connection",
+    );
+    throw new Error("Failed to create connection");
+  }
+}

package/src/providers/inference/chatgpt-subscription-credentials.ts

@@ -0,0 +1,84 @@
+/**
+ * OAuth client config and credential writes for the "ChatGPT Subscription"
+ * sign-in.
+ *
+ * Every entry point into the flow (the daemon's device-code routes, the
+ * daemon's copy-paste PKCE routes, and the `assistant inference providers
+ * login-chatgpt` CLI command) authenticates against the same OAuth client and
+ * lands its tokens under the same credential prefix, so the client config and
+ * the credential writes live here rather than in each caller.
+ *
+ * This module deliberately depends on nothing but the credential store: the
+ * CLI is a separate process with no database handle, so it imports this leaf
+ * and pairs it with its own IPC connection upsert. In-daemon callers use
+ * `storeChatgptSubscriptionTokens` from `chatgpt-subscription-auth.ts`, which
+ * writes the credentials and the provider connection together.
+ */
+
+import type { OAuth2Config, OAuth2TokenResult } from "../../security/oauth2.js";
+import { setSecureKeyAsync } from "../../security/secure-keys.js";
+import { getLogger } from "../../util/logger.js";
+import { CHATGPT_SUBSCRIPTION_CONNECTION_NAME } from "./auth.js";
+
+const log = getLogger("chatgpt-subscription-credentials");
+
+export { CHATGPT_SUBSCRIPTION_CONNECTION_NAME };
+
+/** OpenAI's Codex OAuth client. PKCE only, no client secret. */
+export const OPENAI_OAUTH_CONFIG: OAuth2Config = {
+  authorizeUrl: "https://auth.openai.com/oauth/authorize",
+  tokenExchangeUrl: "https://auth.openai.com/oauth/token",
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  scopes: ["openid", "profile", "email", "offline_access"],
+  scopeSeparator: " ",
+  authorizeParams: { id_token_add_organizations: "true" },
+};
+
+/** Credential-store prefix holding the subscription's access/refresh tokens. */
+export const CHATGPT_CREDENTIAL_PREFIX = "credential/chatgpt";
+
+export const CHATGPT_ACCESS_TOKEN_CREDENTIAL = `${CHATGPT_CREDENTIAL_PREFIX}/access_token`;
+
+/** Auth block stamped on the `chatgpt-subscription` provider connection. */
+export const CHATGPT_SUBSCRIPTION_AUTH_INPUT = {
+  type: "oauth_subscription" as const,
+  credential: CHATGPT_ACCESS_TOKEN_CREDENTIAL,
+};
+
+/**
+ * Write the subscription's tokens to the credential store.
+ *
+ * Throws when a write fails: a half-stored credential set leaves the provider
+ * connection pointing at a token the assistant cannot use.
+ */
+export async function storeChatgptSubscriptionCredentials(
+  tokens: OAuth2TokenResult,
+): Promise<void> {
+  const accessStored = await setSecureKeyAsync(
+    CHATGPT_ACCESS_TOKEN_CREDENTIAL,
+    tokens.accessToken,
+  );
+  if (!accessStored) {
+    log.error("Failed to store ChatGPT access token in CES");
+    throw new Error("Failed to store access token");
+  }
+
+  if (tokens.refreshToken) {
+    const refreshStored = await setSecureKeyAsync(
+      `${CHATGPT_CREDENTIAL_PREFIX}/refresh_token`,
+      tokens.refreshToken,
+    );
+    if (!refreshStored) {
+      log.error("Failed to store ChatGPT refresh token in CES");
+      throw new Error("Failed to store refresh token");
+    }
+  }
+
+  if (tokens.expiresIn) {
+    const expiresAt = Math.floor(Date.now() / 1000 + tokens.expiresIn);
+    await setSecureKeyAsync(
+      `${CHATGPT_CREDENTIAL_PREFIX}/expires_at`,
+      String(expiresAt),
+    );
+  }
+}

package/src/providers/inference/resolve-auth.ts

@@ -43,7 +43,7 @@ export async function resolveAuth(
   if (safeBaseUrl && !PROVIDERS_ALLOWING_CUSTOM_BASE_URL.has(provider)) {
     log.warn(
       { provider, baseUrl: safeBaseUrl },
-      `Stripping baseUrl for provider "${provider}": base_url is only valid for openai-compatible and ollama providers.`,
+      `Stripping baseUrl for provider "${provider}": base_url is only valid for openai-compatible, ollama, and opencode providers.`,
     );
     safeBaseUrl = null;
   }

package/src/providers/media-resolve.ts

@@ -79,9 +79,8 @@ export function isUnsendableImageSource(source: MediaSource): boolean {
  * `image/heic` and `image/heif` directly
  * (https://ai.google.dev/gemini-api/docs/image-understanding), while
  * OpenAI-compatible and Anthropic endpoints answer HTTP 400 for the whole
- * request. HEIF bytes reach a provider whenever transcoding was unavailable
- * (`convertImageToJpeg` is backed by macOS `sips`), so a Linux-hosted assistant
- * on Gemini depends on them passing through.
+ * request. HEIF bytes reach a provider whenever transcoding cannot decode the
+ * input, so Gemini depends on them passing through.
  */
 export interface MediaResolveOptions {
   acceptsHeif?: boolean;

package/src/providers/model-catalog.ts

@@ -1374,6 +1374,32 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
       // usage never includes cached tokens. `supportsCaching` therefore stays
       // false; the `cacheReadPer1mTokens` rates below only apply if OpenRouter
       // starts reporting cached tokens in usage.
+      {
+        id: "x-ai/grok-4.6",
+        displayName: "Grok 4.6",
+        contextWindowTokens: 500000,
+        // xAI publishes no completion cap; 30K is the tracker-reported
+        // single-response limit used for sibling Grok 4.x catalog rows.
+        maxOutputTokens: 30000,
+        supportsThinking: true,
+        supportsCaching: false,
+        supportsVision: true,
+        supportsToolUse: true,
+        longContextPricingThresholdTokens: 200000,
+        pricing: {
+          inputPer1mTokens: 2,
+          outputPer1mTokens: 6,
+          cacheReadPer1mTokens: 0.5,
+          tiers: [
+            {
+              inputTokenThreshold: 200000,
+              inputPer1mTokens: 4,
+              outputPer1mTokens: 12,
+              cacheReadPer1mTokens: 1,
+            },
+          ],
+        },
+      },
       {
         id: "x-ai/grok-4.5",
         displayName: "Grok 4.5",
@@ -1697,6 +1723,36 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
         pricing: { inputPer1mTokens: 0.2, outputPer1mTokens: 1.1 },
       },
       // Z.ai
+      {
+        id: "z-ai/glm-5.3",
+        displayName: "GLM-5.3",
+        contextWindowTokens: 1048576,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 1.4,
+          outputPer1mTokens: 4.4,
+          cacheReadPer1mTokens: 0.26,
+        },
+      },
+      {
+        id: "z-ai/glm-5.3-flash",
+        displayName: "GLM-5.3 Flash",
+        contextWindowTokens: 1310720,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: true,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.075,
+          outputPer1mTokens: 0.25,
+          cacheReadPer1mTokens: 0.015,
+        },
+      },
       {
         id: "z-ai/glm-5.2",
         displayName: "GLM-5.2",
@@ -2038,6 +2094,25 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     models: [],
     defaultModel: "",
   },
+  {
+    id: "opencode",
+    displayName: "OpenCode",
+    subtitle:
+      "OpenCode Zen and OpenCode Go. Models come from the endpoint, not a fixed catalog.",
+    setupMode: "api-key",
+    setupHint:
+      "Enter your OpenCode API key. Leave the base URL empty for Zen, or set it to the Go endpoint.",
+    envVar: "OPENCODE_API_KEY",
+    credentialsGuide: {
+      description:
+        "Create an OpenCode API key, then choose Zen or Go as the endpoint.",
+      url: "https://opencode.ai",
+      linkLabel: "OpenCode",
+    },
+    apiKeyPlaceholder: "sk-...",
+    models: [],
+    defaultModel: "",
+  },
   {
     id: "openai-compatible",
     displayName: "OpenAI-compatible",

package/src/providers/openai/__tests__/api-error-normalization.test.ts

@@ -387,6 +387,28 @@ describe("deriveReason", () => {
     ).toBe("vision_unsupported");
   });
 
+  test("chat-template failure prose on a 400 → request_shape_unsupported", () => {
+    // Together's server-side renderer error for MiniMax M3, verbatim.
+    expect(
+      deriveReason(
+        n({
+          message:
+            "Failed to apply chat template: invalid operation: object is not callable (in chat:22)",
+        }),
+        400,
+      ),
+    ).toBe("request_shape_unsupported");
+  });
+
+  test("chat-template prose on a 5xx stays server-side, not request_shape_unsupported", () => {
+    expect(
+      deriveReason(
+        n({ message: "Failed to apply chat template: renderer crashed" }),
+        500,
+      ),
+    ).not.toBe("request_shape_unsupported");
+  });
+
   test("402 → insufficient_credits", () => {
     expect(deriveReason(n(), 402)).toBe("insufficient_credits");
   });