@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/providers/inference/__tests__/adapter-factory-opencode.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, test } from "bun:test";
+
+import { OpenAIChatCompletionsProvider } from "../../openai/chat-completions-provider.js";
+import {
+  OPENCODE_GO_BASE_URL,
+  OPENCODE_ZEN_BASE_URL,
+  OpenCodeProvider,
+} from "../../opencode/client.js";
+import {
+  buildProviderAdapter,
+  createAdapterFromConnection,
+} from "../adapter-factory.js";
+import type { ProviderConnection, ResolvedAuth } from "../auth.js";
+
+describe("opencode adapter factory", () => {
+  test("buildProviderAdapter returns an OpenCodeProvider", () => {
+    const adapter = buildProviderAdapter("opencode", {
+      apiKey: "sk-opencode-test",
+      model: "mimo-v2.5-free",
+      streamTimeoutMs: 60_000,
+      useNativeWebSearch: false,
+    });
+    expect(adapter).toBeInstanceOf(OpenCodeProvider);
+    expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    expect(adapter?.name).toBe("opencode");
+  });
+
+  test("defaults to OpenCode Zen when no baseURL is set", () => {
+    const adapter = buildProviderAdapter("opencode", {
+      apiKey: "sk-opencode-test",
+      model: "mimo-v2.5-free",
+      streamTimeoutMs: 60_000,
+      useNativeWebSearch: false,
+    }) as OpenCodeProvider;
+    const client = (
+      adapter as unknown as { client: { baseURL?: string } }
+    ).client;
+    expect(client.baseURL).toBe(OPENCODE_ZEN_BASE_URL);
+  });
+
+  test("createAdapterFromConnection wires a custom OpenCode Go base URL", () => {
+    const connection: ProviderConnection = {
+      name: "opencode-go",
+      provider: "opencode",
+      auth: { type: "api_key", credential: "cred-opencode" },
+      label: "OpenCode Go",
+      baseUrl: OPENCODE_GO_BASE_URL,
+      models: [{ id: "mimo-v2.5-free" }],
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      isManaged: false,
+    };
+
+    const resolvedAuth: ResolvedAuth = {
+      kind: "header",
+      headers: { Authorization: "Bearer sk-opencode-key" },
+      baseUrl: OPENCODE_GO_BASE_URL,
+    };
+
+    const adapter = createAdapterFromConnection(connection, resolvedAuth, {
+      model: "mimo-v2.5-free",
+      streamTimeoutMs: 60_000,
+    });
+
+    expect(adapter).not.toBeNull();
+  });
+
+  test("createAdapterFromConnection rejects none auth for opencode", () => {
+    const connection: ProviderConnection = {
+      name: "opencode-keyless",
+      provider: "opencode",
+      auth: { type: "none" },
+      label: null,
+      baseUrl: OPENCODE_ZEN_BASE_URL,
+      models: [{ id: "mimo-v2.5-free" }],
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      isManaged: false,
+    };
+
+    const adapter = createAdapterFromConnection(
+      connection,
+      { kind: "none" },
+      {
+        model: "mimo-v2.5-free",
+        streamTimeoutMs: 60_000,
+      },
+    );
+
+    expect(adapter).toBeNull();
+  });
+});

package/src/providers/inference/__tests__/base-url-route-validation.test.ts

@@ -184,6 +184,22 @@ describe("base_url provider-type gate (create)", () => {
     );
   });
 
+  test("accepts base_url on opencode provider", async () => {
+    mockResolvedAddresses = ["93.184.216.34"];
+    const result = await handleCreate({
+      body: {
+        name: "valid-opencode-go",
+        provider: "opencode",
+        auth: { type: "api_key", credential: "cred-opencode" },
+        base_url: "https://opencode.ai/zen/go/v1",
+      },
+    });
+    expect(result).toBeDefined();
+    expect((result as { baseUrl: string }).baseUrl).toBe(
+      "https://opencode.ai/zen/go/v1",
+    );
+  });
+
   test("accepts base_url on ollama provider", async () => {
     mockResolvedAddresses = ["93.184.216.34"];
     const result = await handleCreate({

package/src/providers/inference/__tests__/base-url-security.test.ts

@@ -174,6 +174,18 @@ describe("resolveAuth defense-in-depth", () => {
     }
   });
 
+  test("preserves baseUrl for opencode provider", async () => {
+    const result = await resolveAuth(
+      { type: "api_key", credential: "cred-test" },
+      "opencode",
+      { baseUrl: "https://opencode.ai/zen/go/v1" },
+    );
+    expect(result.ok).toBe(true);
+    if (result.ok && result.resolved.kind === "header") {
+      expect(result.resolved.baseUrl).toBe("https://opencode.ai/zen/go/v1");
+    }
+  });
+
   test("preserves baseUrl for ollama none-auth", async () => {
     const result = await resolveAuth({ type: "none" }, "ollama", {
       baseUrl: "http://192.168.1.50:11434/v1",

package/src/providers/inference/adapter-factory.ts

@@ -18,7 +18,18 @@
  *   3. Register the client in `ADAPTER_FACTORIES` below.
  */
 
+import { resolveDefaultProfileForProvider } from "../../config/default-profile-catalog.js";
+import {
+  FALLBACK_PROFILE_BY_KEY,
+  isDefaultProfileKey,
+} from "../../config/default-profile-names.js";
+import {
+  resolveCallSiteConfigWithProfile,
+  selectWinningProfile,
+} from "../../config/llm-resolver.js";
+import { getConfig } from "../../config/loader.js";
 import { normalizeCredentialRef } from "../../security/credential-key.js";
+import { getLogger } from "../../util/logger.js";
 import { AnthropicProvider } from "../anthropic/client.js";
 import { AtlasCloudProvider } from "../atlascloud/client.js";
 import { BasetenProvider } from "../baseten/client.js";
@@ -29,13 +40,21 @@ import { PROVIDER_CATALOG } from "../model-catalog.js";
 import { OllamaProvider } from "../ollama/client.js";
 import { OpenAIChatCompletionsProvider } from "../openai/chat-completions-provider.js";
 import { OpenAIResponsesProvider } from "../openai/responses-provider.js";
+import { OpenCodeProvider } from "../opencode/client.js";
 import { OpenRouterProvider } from "../openrouter/client.js";
 import { PoolsideProvider } from "../poolside/client.js";
+import { dispatchProviderResolvable } from "../provider-resolvability.js";
 import { RetryProvider } from "../retry.js";
 import { TogetherProvider } from "../together/client.js";
-import type { Provider } from "../types.js";
+import type { Provider, SendMessageOptions } from "../types.js";
 import { UsageTrackingProvider } from "../usage-tracking.js";
-import { isVellumManagedConnection } from "../vellum-model-routing.js";
+import { VellumProvider } from "../vellum/client.js";
+import {
+  getManagedUpstream,
+  isVellumManagedConnection,
+  MANAGED_ROUTABLE_PROVIDERS,
+  VELLUM_MANAGED_PROVIDER,
+} from "../vellum-model-routing.js";
 import { VercelAIGatewayProvider } from "../vercel-ai-gateway/client.js";
 import type { ResolvedAuth } from "./auth.js";
 import type { ProviderConnection } from "./auth.js";
@@ -58,6 +77,15 @@ export interface AdapterCreateOpts {
 
 type AdapterFactory = (opts: AdapterCreateOpts) => Provider;
 
+const log = getLogger("adapter-factory");
+
+/** The backup route `RetryProvider` escalates to; see {@link makeFallbackRouteResolver}. */
+interface FallbackRoute {
+  provider: Provider;
+  overrideProfile: string;
+  forwardUsageAttributionHeaders: boolean;
+}
+
 /**
  * Catalog-keyed factory table. Each entry takes a unified
  * `AdapterCreateOpts` and constructs the underlying provider client. The
@@ -138,6 +166,11 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       assistantReasoningField: "reasoning_content",
       ...(baseURL ? { baseURL } : {}),
     }),
+  opencode: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
+    new OpenCodeProvider(apiKey, model, {
+      streamTimeoutMs,
+      ...(baseURL ? { baseURL } : {}),
+    }),
   // Keyless openai-compatible endpoints (e.g. LM Studio) ignore the key; the
   // placeholder satisfies the OpenAI SDK, which requires a non-empty key.
   "openai-compatible": ({ apiKey, model, streamTimeoutMs, baseURL }) =>
@@ -172,6 +205,11 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       streamTimeoutMs,
       ...(baseURL ? { baseURL } : {}),
     }),
+  vellum: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
+    new VellumProvider(apiKey, model, {
+      streamTimeoutMs,
+      ...(baseURL ? { baseURL } : {}),
+    }),
 };
 
 /**
@@ -275,6 +313,195 @@ export function createAdapterFromConnection(
     };
   }
 
+  /**
+   * Resolve the backup-profile route for a request whose primary route just
+   * failed with an outage-shaped error, so `RetryProvider` can serve it on a
+   * different provider instead of surfacing the outage.
+   *
+   * The winning profile of the FAILED call is re-resolved from the same
+   * inputs `normalizeSendMessageOptions` uses (call site plus the request's
+   * own override/seed fields), and its `fallbackProfile` pointer names the
+   * backup. The upstream comes from the backup's resolved provider; only the
+   * `vellum` routing identity carries no upstream of its own, and there the
+   * backup's model determines it.
+   *
+   * Returns a RAW adapter, exactly like `makeCredentialRefresher` above:
+   * `RetryProvider` hands the backup route options it has ALREADY normalized
+   * (call site consumed, wire params resolved from the backup profile, usage
+   * attribution headers stamped). A second `RetryProvider` in between would
+   * re-normalize that call-site-less config and strip those headers, leaving
+   * degraded traffic unattributed on the platform's billing events.
+   *
+   * Never throws: a broken backup lookup must surface the original provider
+   * error, not a new one.
+   */
+  function makeFallbackRouteResolver(): (
+    failedOptions: SendMessageOptions | undefined,
+  ) => Promise<FallbackRoute | null> {
+    return async (failedOptions): Promise<FallbackRoute | null> => {
+      const failedConfig = failedOptions?.config;
+      const callSite = failedConfig?.callSite;
+      if (callSite === undefined) {
+        return null;
+      }
+      try {
+        const { llm } = getConfig();
+        const winner = selectWinningProfile(callSite, llm, {
+          overrideProfile: failedConfig?.overrideProfile,
+          forceOverrideProfile: failedConfig?.forceOverrideProfile,
+          selectionSeed: failedConfig?.selectionSeed,
+          isResolvableProvider: dispatchProviderResolvable,
+        });
+        const primaryProfile =
+          winner.profileName ??
+          (winner.source === "default" ? "balanced" : undefined);
+        if (
+          primaryProfile === undefined ||
+          !isDefaultProfileKey(primaryProfile)
+        ) {
+          return null;
+        }
+        const expectedFallback = FALLBACK_PROFILE_BY_KEY[primaryProfile];
+        if (
+          winner.entry?.source !== "managed" ||
+          winner.entry.fallbackProfile !== expectedFallback
+        ) {
+          return null;
+        }
+        const overrideProfile = expectedFallback;
+        // Resolved the provider-aware way the runtime resolver resolves every
+        // profile name: the backups are companions of the managed column and
+        // must not materialize under a BYOK or ChatGPT default provider.
+        const backup = resolveDefaultProfileForProvider(
+          llm.profiles,
+          overrideProfile,
+          llm.defaultProvider ?? null,
+        );
+        if (backup?.model == null) {
+          log.warn(
+            { connectionName: connection.name, overrideProfile },
+            "Backup profile does not resolve on this default provider; keeping the original error",
+          );
+          return null;
+        }
+        const { config: resolvedBackup, profileName: resolvedBackupProfile } =
+          resolveCallSiteConfigWithProfile(callSite, llm, {
+            overrideProfile,
+            forceOverrideProfile: true,
+            selectionSeed: failedConfig?.selectionSeed,
+            isResolvableProvider: dispatchProviderResolvable,
+          });
+        if (resolvedBackupProfile !== overrideProfile) {
+          log.warn(
+            {
+              connectionName: connection.name,
+              overrideProfile,
+              selectedProfile: resolvedBackupProfile,
+            },
+            "Backup profile is not dispatch-resolvable; keeping the original error",
+          );
+          return null;
+        }
+        // The model the adapter serves must be the model the fallback send
+        // carries, so it comes from the same forced-profile resolution.
+        // This callback authenticates the backup with the managed connection
+        // it was built for, so it can only serve a backup that routes through
+        // the managed column. Refusing any other route keeps managed billing
+        // and credentials from being applied to user-owned traffic.
+        // Keyed on the connection, not the provider: a call-site fragment that
+        // pins a concrete upstream over a managed winner keeps the managed
+        // routing and is stamped with this connection's name by the resolver
+        // (see `llm-resolver.ts`), so a concrete `provider` here is still
+        // managed traffic. Only a profile that names a different connection,
+        // or a concrete provider carrying no managed connection at all (a BYOK
+        // winner), routes somewhere this callback cannot authenticate.
+        const backupConnection = resolvedBackup.provider_connection;
+        const routesThroughThisConnection =
+          backupConnection === undefined
+            ? resolvedBackup.provider === VELLUM_MANAGED_PROVIDER
+            : backupConnection === connection.name;
+        if (!routesThroughThisConnection) {
+          log.warn(
+            {
+              connectionName: connection.name,
+              overrideProfile,
+              backupProvider: resolvedBackup.provider,
+              backupConnection,
+            },
+            "Backup profile routes outside the managed connection; keeping the original error",
+          );
+          return null;
+        }
+        // The upstream is the resolved provider, the same way normal dispatch
+        // picks it for this connection: `connection-resolution.ts` threads the
+        // resolved provider through as `providerOverride` for a `vellum`
+        // connection and derives the upstream from the model only when the
+        // provider is the routing-identity sentinel (`resolveRoutingIdentity`,
+        // and the `isVellum && !expectedProvider` branch). Deriving it from the
+        // model here regardless would send a provider-pinned call-site fragment
+        // to a different upstream than a primary send of the same resolution,
+        // and would refuse a managed model the catalog does not list yet even
+        // though normal dispatch serves it. A provider the managed proxy cannot
+        // front (a non-routable id, or another routing identity such as
+        // `chatgpt`) is refused rather than routed.
+        const declaredProvider = resolvedBackup.provider;
+        const upstream =
+          declaredProvider === VELLUM_MANAGED_PROVIDER
+            ? getManagedUpstream(resolvedBackup.model)
+            : MANAGED_ROUTABLE_PROVIDERS.has(declaredProvider)
+              ? declaredProvider
+              : null;
+        if (upstream === null) {
+          log.warn(
+            {
+              connectionName: connection.name,
+              overrideProfile,
+              backupProvider: declaredProvider,
+              backupModel: resolvedBackup.model,
+            },
+            "Backup profile does not resolve to a managed upstream; keeping the original error",
+          );
+          return null;
+        }
+        // Re-resolve auth for the BACKUP upstream: the managed proxy's base URL
+        // is per-upstream, so the primary's resolved auth cannot be reused.
+        const backupAuth = await resolveAuth(
+          effectiveConnectionAuth(connection),
+          upstream,
+          { baseUrl: connection.baseUrl },
+        );
+        if (!backupAuth.ok) {
+          return null;
+        }
+        const backupAdapter = buildConnectionAdapter(
+          connection,
+          backupAuth.resolved,
+          // `useNativeWebSearch` carries over from the primary: it is a
+          // property of this request's web-search config, and every managed
+          // backup pin either supports native search or ignores the flag.
+          { ...opts, model: resolvedBackup.model, provider: upstream },
+        );
+        if (backupAdapter === null) {
+          return null;
+        }
+        return {
+          provider: backupAdapter,
+          overrideProfile,
+          // Always true: this callback is wired only on the managed proxy, so
+          // the backup route runs through it too and its `X-Vellum-*` billing
+          // metadata reaches our own backend, never a third party.
+          forwardUsageAttributionHeaders: true,
+        };
+      } catch (err) {
+        log.warn(
+          { err, connectionName: connection.name, callSite },
+          "Failed to resolve a backup profile route; keeping the original error",
+        );
+        return null;
+      }
+    };
+  }
+
   // Usage-attribution headers (`X-Vellum-*`) are only meaningful when the
   // request is routed through the Vellum-managed proxy. They carry billing
   // metadata for our own backend. Forwarding them to a third-party endpoint
@@ -295,8 +522,15 @@ export function createAdapterFromConnection(
               ? "no-auth"
               : undefined,
       connectionName: connection.name,
+      // Both escalations are managed-route only. A BYOK, oauth-subscription,
+      // or no-auth connection must never fall back: the install may hold no
+      // credential for the backup profile's provider, and only the managed
+      // column carries `fallbackProfile` pointers in the first place.
       ...(isManagedProxy
-        ? { refreshCredentialProvider: makeCredentialRefresher() }
+        ? {
+            refreshCredentialProvider: makeCredentialRefresher(),
+            resolveFallbackRoute: makeFallbackRouteResolver(),
+          }
         : {}),
     }),
   );
@@ -323,6 +557,15 @@ function buildConnectionAdapter(
   },
 ): Provider | null {
   const provider = opts.provider ?? connection.provider;
+  // The connection's own `vellum` column is a routing sentinel. Dispatch
+  // only when the caller names an upstream, including Vellum-hosted GPU
+  // models whose catalog id is also `vellum`.
+  if (
+    connection.provider === VELLUM_MANAGED_PROVIDER &&
+    opts.provider === undefined
+  ) {
+    return null;
+  }
   const entry = PROVIDER_CATALOG.find((e) => e.id === provider);
   if (!entry) {
     return null;

package/src/providers/inference/auth.ts

@@ -118,20 +118,20 @@ export type ResolvedAuth =
 // providers at runtime.
 
 export const VALID_CONNECTION_PROVIDERS: readonly string[] = [
-  ...PROVIDER_CATALOG.map((p) => p.id),
-  // The provider-agnostic Vellum-managed connection stores this sentinel in its
-  // `provider` column. It is intentionally not a PROVIDER_CATALOG entry (it
-  // names no single upstream), so it must be allowlisted explicitly or the DB
-  // loaders (getConnection/listConnections) and the create route would reject
-  // persisted `vellum` rows — the routing threaded in via `providerOverride`
-  // never runs on a row that fails to load.
-  VELLUM_MANAGED_PROVIDER,
-  // The ChatGPT-subscription row stores the "chatgpt" routing identity in its
-  // `provider` column for the same reason: the row IS the subscription route
-  // (auth modality = provider identity), and dispatch derives the openai
-  // upstream per-request. Allowlisted explicitly or the DB loaders would drop
-  // the persisted row.
-  "chatgpt",
+  ...new Set([
+    ...PROVIDER_CATALOG.map((p) => p.id),
+    // The provider-agnostic Vellum-managed connection stores this sentinel in
+    // its `provider` column. The same id owns Vellum-hosted GPU models in the
+    // catalog. Keep it allowlisted explicitly so a future catalog rename
+    // cannot drop persisted `vellum` rows from the DB loaders.
+    VELLUM_MANAGED_PROVIDER,
+    // The ChatGPT-subscription row stores the "chatgpt" routing identity in
+    // its `provider` column: the row IS the subscription route (auth
+    // modality = provider identity), and dispatch derives the openai
+    // upstream per-request. Allowlisted explicitly or the DB loaders would
+    // drop the persisted row.
+    "chatgpt",
+  ]),
 ];
 
 export type ConnectionProvider = string;
@@ -190,6 +190,7 @@ export const PROVIDERS_REQUIRING_BASE_URL_AND_MODELS: ReadonlySet<string> =
 export const PROVIDERS_ALLOWING_CUSTOM_BASE_URL: ReadonlySet<string> = new Set([
   ...PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
   "ollama",
+  "opencode",
 ]);
 
 // ---------------------------------------------------------------------------

package/src/providers/inference/chatgpt-subscription-auth.ts

@@ -0,0 +1,70 @@
+/**
+ * In-daemon completion of the "ChatGPT Subscription" sign-in: store the tokens
+ * and point the provider connection at them in one step.
+ *
+ * The OAuth client config and the credential writes live in
+ * `chatgpt-subscription-credentials.ts`, which depends on nothing but the
+ * credential store so the CLI can import it without pulling in the database.
+ */
+
+import { getDb } from "../../persistence/db-connection.js";
+import type { OAuth2TokenResult } from "../../security/oauth2.js";
+import { getLogger } from "../../util/logger.js";
+import {
+  CHATGPT_SUBSCRIPTION_AUTH_INPUT,
+  CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+  storeChatgptSubscriptionCredentials,
+} from "./chatgpt-subscription-credentials.js";
+import {
+  createConnection,
+  getConnection,
+  updateConnection,
+} from "./connections.js";
+
+const log = getLogger("chatgpt-subscription-auth");
+
+/**
+ * Store the subscription's tokens and point the `chatgpt-subscription` provider
+ * connection at them, creating the connection when it does not exist yet.
+ */
+export async function storeChatgptSubscriptionTokens(
+  tokens: OAuth2TokenResult,
+): Promise<void> {
+  await storeChatgptSubscriptionCredentials(tokens);
+
+  const db = getDb();
+  const existing = getConnection(db, CHATGPT_SUBSCRIPTION_CONNECTION_NAME);
+
+  if (existing) {
+    // Stamp the provider with the auth: this row IS the subscription route
+    // (auth modality = provider identity), and dispatch derives the openai
+    // upstream from the identity per-request. Stamping also heals a
+    // claiming row whose provider would otherwise misroute the fresh token.
+    const updateResult = updateConnection(
+      db,
+      CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+      { auth: CHATGPT_SUBSCRIPTION_AUTH_INPUT, provider: "chatgpt" },
+    );
+    if (!updateResult.ok) {
+      log.error(
+        { error: updateResult.error },
+        "Failed to update chatgpt-subscription connection",
+      );
+      throw new Error("Failed to update connection");
+    }
+    return;
+  }
+
+  const createResult = createConnection(db, {
+    name: CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+    provider: "chatgpt",
+    auth: CHATGPT_SUBSCRIPTION_AUTH_INPUT,
+  });
+  if (!createResult.ok) {
+    log.error(
+      { error: createResult.error },
+      "Failed to create chatgpt-subscription connection",
+    );
+    throw new Error("Failed to create connection");
+  }
+}

package/src/providers/inference/chatgpt-subscription-credentials.ts

@@ -0,0 +1,84 @@
+/**
+ * OAuth client config and credential writes for the "ChatGPT Subscription"
+ * sign-in.
+ *
+ * Every entry point into the flow (the daemon's device-code routes, the
+ * daemon's copy-paste PKCE routes, and the `assistant inference providers
+ * login-chatgpt` CLI command) authenticates against the same OAuth client and
+ * lands its tokens under the same credential prefix, so the client config and
+ * the credential writes live here rather than in each caller.
+ *
+ * This module deliberately depends on nothing but the credential store: the
+ * CLI is a separate process with no database handle, so it imports this leaf
+ * and pairs it with its own IPC connection upsert. In-daemon callers use
+ * `storeChatgptSubscriptionTokens` from `chatgpt-subscription-auth.ts`, which
+ * writes the credentials and the provider connection together.
+ */
+
+import type { OAuth2Config, OAuth2TokenResult } from "../../security/oauth2.js";
+import { setSecureKeyAsync } from "../../security/secure-keys.js";
+import { getLogger } from "../../util/logger.js";
+import { CHATGPT_SUBSCRIPTION_CONNECTION_NAME } from "./auth.js";
+
+const log = getLogger("chatgpt-subscription-credentials");
+
+export { CHATGPT_SUBSCRIPTION_CONNECTION_NAME };
+
+/** OpenAI's Codex OAuth client. PKCE only, no client secret. */
+export const OPENAI_OAUTH_CONFIG: OAuth2Config = {
+  authorizeUrl: "https://auth.openai.com/oauth/authorize",
+  tokenExchangeUrl: "https://auth.openai.com/oauth/token",
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  scopes: ["openid", "profile", "email", "offline_access"],
+  scopeSeparator: " ",
+  authorizeParams: { id_token_add_organizations: "true" },
+};
+
+/** Credential-store prefix holding the subscription's access/refresh tokens. */
+export const CHATGPT_CREDENTIAL_PREFIX = "credential/chatgpt";
+
+export const CHATGPT_ACCESS_TOKEN_CREDENTIAL = `${CHATGPT_CREDENTIAL_PREFIX}/access_token`;
+
+/** Auth block stamped on the `chatgpt-subscription` provider connection. */
+export const CHATGPT_SUBSCRIPTION_AUTH_INPUT = {
+  type: "oauth_subscription" as const,
+  credential: CHATGPT_ACCESS_TOKEN_CREDENTIAL,
+};
+
+/**
+ * Write the subscription's tokens to the credential store.
+ *
+ * Throws when a write fails: a half-stored credential set leaves the provider
+ * connection pointing at a token the assistant cannot use.
+ */
+export async function storeChatgptSubscriptionCredentials(
+  tokens: OAuth2TokenResult,
+): Promise<void> {
+  const accessStored = await setSecureKeyAsync(
+    CHATGPT_ACCESS_TOKEN_CREDENTIAL,
+    tokens.accessToken,
+  );
+  if (!accessStored) {
+    log.error("Failed to store ChatGPT access token in CES");
+    throw new Error("Failed to store access token");
+  }
+
+  if (tokens.refreshToken) {
+    const refreshStored = await setSecureKeyAsync(
+      `${CHATGPT_CREDENTIAL_PREFIX}/refresh_token`,
+      tokens.refreshToken,
+    );
+    if (!refreshStored) {
+      log.error("Failed to store ChatGPT refresh token in CES");
+      throw new Error("Failed to store refresh token");
+    }
+  }
+
+  if (tokens.expiresIn) {
+    const expiresAt = Math.floor(Date.now() / 1000 + tokens.expiresIn);
+    await setSecureKeyAsync(
+      `${CHATGPT_CREDENTIAL_PREFIX}/expires_at`,
+      String(expiresAt),
+    );
+  }
+}

package/src/providers/inference/resolve-auth.ts

@@ -43,7 +43,7 @@ export async function resolveAuth(
   if (safeBaseUrl && !PROVIDERS_ALLOWING_CUSTOM_BASE_URL.has(provider)) {
     log.warn(
       { provider, baseUrl: safeBaseUrl },
-      `Stripping baseUrl for provider "${provider}": base_url is only valid for openai-compatible and ollama providers.`,
+      `Stripping baseUrl for provider "${provider}": base_url is only valid for openai-compatible, ollama, and opencode providers.`,
     );
     safeBaseUrl = null;
   }

package/src/providers/media-resolve.ts

@@ -79,9 +79,8 @@ export function isUnsendableImageSource(source: MediaSource): boolean {
  * `image/heic` and `image/heif` directly
  * (https://ai.google.dev/gemini-api/docs/image-understanding), while
  * OpenAI-compatible and Anthropic endpoints answer HTTP 400 for the whole
- * request. HEIF bytes reach a provider whenever transcoding was unavailable
- * (`convertImageToJpeg` is backed by macOS `sips`), so a Linux-hosted assistant
- * on Gemini depends on them passing through.
+ * request. HEIF bytes reach a provider whenever transcoding cannot decode the
+ * input, so Gemini depends on them passing through.
  */
 export interface MediaResolveOptions {
   acceptsHeif?: boolean;