devchain-cli 0.25.0 → 0.26.1

package/dist/server/modules/mcp/tool-descriptors/worktree.metadata.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.worktreeMetadata = void 0;
+const mcp_dto_1 = require("../dtos/mcp.dto");
+const sessionId = {
+    type: 'string',
+    minLength: 8,
+    description: 'Session ID (full UUID or 8+ char prefix)',
+};
+const name = {
+    type: 'string',
+    pattern: '^\\s*[a-zA-Z0-9-]{1,40}\\s*$',
+    description: 'Lane name (trimmed, case-insensitive lookup)',
+};
+exports.worktreeMetadata = [
+    {
+        name: 'devchain_worktrees_create',
+        description: 'Creates a git worktree (lane) for one task, outside the project root. Team leads only. The lane contains tracked files only. The agent that works in it must set it up: install dependencies and copy needed ignored files, such as .env, from the project root. Agents keep running in the project root and work in the lane by path: start every shell command with `cd <lane> &&`, use `git -C <lane>`, and use absolute file paths. Link the lane to the task with epicId, so the worker sees it in devchain_get_epic_by_id. WORKTREE_SETUP_FAILED means Git registered the lane but a checkout hook failed; the lane and hook-created files remain managed. Inspect it or remove it with devchain_worktrees_remove.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId'],
+            properties: {
+                sessionId,
+                name: {
+                    type: 'string',
+                    pattern: '^[a-z0-9-]{1,40}$',
+                    description: 'Optional lowercase lane slug; defaults to the task title or an available lane-N name',
+                },
+                baseRef: {
+                    type: 'string',
+                    minLength: 1,
+                    description: 'Optional base branch; defaults to the branch checked out in the root',
+                },
+                epicId: {
+                    type: 'string',
+                    format: 'uuid',
+                    description: 'Optional task UUID in the current project to link to this lane',
+                },
+            },
+            additionalProperties: false,
+        },
+        paramsSchema: mcp_dto_1.WorktreesCreateParamsSchema,
+    },
+    {
+        name: 'devchain_worktrees_list',
+        description: "Lists lane status, head, ahead/behind, dirty files, and linked task with its assignee. Team leads only. Includes the project root's dirty files as a drift warning. With name, returns that lane and a merge-tree conflict preview. Live state is computed from git.",
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId'],
+            properties: { sessionId, name },
+            additionalProperties: false,
+        },
+        paramsSchema: mcp_dto_1.WorktreesListParamsSchema,
+    },
+    {
+        name: 'devchain_worktrees_commit',
+        description: 'Commits all tracked and untracked changes in a lane using normal git hooks and signing. Team leads only. Refuses unresolved merge paths (UNMERGED_PATHS), leftover conflict markers (CONFLICT_MARKERS), and nothing to commit (NOTHING_TO_COMMIT); hook or signing failures return COMMIT_FAILED. Finishes a merge in progress after its conflicts are resolved. Returns the commit SHA and committed files.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId', 'name', 'message'],
+            properties: {
+                sessionId,
+                name,
+                message: {
+                    type: 'string',
+                    minLength: 1,
+                    description: 'Commit message; must not be whitespace-only',
+                },
+            },
+            additionalProperties: false,
+        },
+        paramsSchema: mcp_dto_1.WorktreesCommitParamsSchema,
+    },
+    {
+        name: 'devchain_worktrees_merge',
+        description: "Lands exactly expectedHead by fast-forward only. Team leads only. The lane's base branch must be checked out in the project root. Refuses a dirty lane, an unfinished merge, or a head differing from the reviewed commit. On BEHIND, ask the worker to run `git -C <lane> merge <baseBranch>`, resolve conflicts, and test; then commit the lane and retry with the new reviewed SHA. Passes through Git's refusal when root changes overlap.",
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId', 'name', 'expectedHead'],
+            properties: {
+                sessionId,
+                name,
+                expectedHead: {
+                    type: 'string',
+                    pattern: '^(?:[a-f0-9]{40}|[a-f0-9]{64})$',
+                    description: 'Full reviewed commit SHA; must equal the current lane head',
+                },
+            },
+            additionalProperties: false,
+        },
+        paramsSchema: mcp_dto_1.WorktreesMergeParamsSchema,
+    },
+    {
+        name: 'devchain_worktrees_remove',
+        description: 'Removes a lane. Team leads only. Refuses uncommitted tracked or untracked work (WORKTREE_DIRTY) and ignored .env* files without identical project-root copies (WORKTREE_LOCAL_ENV). Deletes other ignored files and reports their paths/count; the branch is kept. A missing directory prunes git metadata and deletes the lane record.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId', 'name'],
+            properties: { sessionId, name },
+            additionalProperties: false,
+        },
+        paramsSchema: mcp_dto_1.WorktreesRemoveParamsSchema,
+    },
+];
+//# sourceMappingURL=worktree.metadata.js.map

package/dist/server/modules/mcp/tool-descriptors/worktree.metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.metadata.js","sourceRoot":"","sources":["../../../../src/modules/mcp/tool-descriptors/worktree.metadata.ts"],"names":[],"mappings":";;;AAAA,6CAMyB;AAGzB,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,0CAA0C;CACxD,CAAC;AACF,MAAM,IAAI,GAAG;IACX,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,8BAA8B;IACvC,WAAW,EAAE,8CAA8C;CAC5D,CAAC;AAEW,QAAA,gBAAgB,GAAwB;IACnD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,0rBAA0rB;QAC5rB,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,UAAU,EAAE;gBACV,SAAS;gBACT,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,WAAW,EACT,sFAAsF;iBACzF;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,sEAAsE;iBACpF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM;oBACd,WAAW,EAAE,gEAAgE;iBAC9E;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;QACD,YAAY,EAAE,qCAA2B;KAC1C;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,sQAAsQ;QACxQ,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC/B,oBAAoB,EAAE,KAAK;SAC5B;QACD,YAAY,EAAE,mCAAyB;KACxC;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,8YAA8Y;QAChZ,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE;gBACV,SAAS;gBACT,IAAI;gBACJ,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,6CAA6C;iBAC3D;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;QACD,YAAY,EAAE,qCAA2B;KAC1C;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,gbAAgb;QAClb,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC;YAC/C,UAAU,EAAE;gBACV,SAAS;gBACT,IAAI;gBACJ,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC;oBAC1C,WAAW,EAAE,4DAA4D;iBAC1E;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;QACD,YAAY,EAAE,oCAA0B;KACzC;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yUAAyU;QAC3U,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;YAC/B,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC/B,oBAAoB,EAAE,KAAK;SAC5B;QACD,YAAY,EAAE,qCAA2B;KAC1C;CACF,CAAC"}

package/dist/server/modules/provider-auth/opencode-credential-family.v2.d.ts

@@ -0,0 +1,4 @@
+export declare function readOpencodeCredentialFamilyV2(dbPath: string): {
+    content: string;
+    maxTimeUpdated: number;
+} | null;

package/dist/server/modules/provider-auth/opencode-credential-family.v2.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOpencodeCredentialFamilyV2 = readOpencodeCredentialFamilyV2;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const opencode_credentials_1 = require("./opencode-credentials");
+function readOpencodeCredentialFamilyV2(dbPath) {
+    let db;
+    try {
+        db = new better_sqlite3_1.default(dbPath, { readonly: true, fileMustExist: true });
+    }
+    catch {
+        return null;
+    }
+    try {
+        const rows = db
+            .prepare(`SELECT integration_id, value, time_updated FROM credential
+         WHERE id LIKE ? ESCAPE '\\' AND integration_id IS NOT NULL
+         ORDER BY integration_id`)
+            .all(`${opencode_credentials_1.DEVCHAIN_OPENCODE_CREDENTIAL_ID_PREFIX.replace(/_/g, '\\_')}%`);
+        if (rows.length === 0)
+            return null;
+        const entries = {};
+        for (const row of rows) {
+            entries[row.integration_id] = (0, opencode_credentials_1.fromOpencodeV2Credential)(row.integration_id, JSON.parse(row.value));
+        }
+        return {
+            content: JSON.stringify(entries),
+            maxTimeUpdated: Math.max(...rows.map((row) => row.time_updated)),
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=opencode-credential-family.v2.js.map

package/dist/server/modules/provider-auth/opencode-credential-family.v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-credential-family.v2.js","sourceRoot":"","sources":["../../../src/modules/provider-auth/opencode-credential-family.v2.ts"],"names":[],"mappings":";;;;;AAYA,wEAsCC;AAlDD,oEAAsC;AACtC,iEAIgC;AAOhC,SAAgB,8BAA8B,CAC5C,MAAc;IAEd,IAAI,EAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,wBAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;iCAEyB,CAC1B;aACA,GAAG,CAAC,GAAG,6DAAsC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAItE,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,IAAA,+CAAwB,EACpD,GAAG,CAAC,cAAc,EAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA4B,CACjD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/server/modules/provider-auth/opencode-credentials.d.ts

@@ -0,0 +1,25 @@
+export type OpencodeV1Entry = Record<string, unknown>;
+export type OpencodeV2Credential = {
+    type: 'key';
+    key: string;
+    metadata?: Record<string, unknown>;
+} | {
+    type: 'oauth';
+    methodID: string;
+    refresh: string;
+    access: string;
+    expires: number;
+    metadata?: Record<string, unknown>;
+};
+export interface OpencodeV2ExportItem {
+    id: string;
+    integrationID: string;
+    label: string;
+    active: boolean;
+    value: Record<string, unknown>;
+}
+export declare const DEVCHAIN_OPENCODE_CREDENTIAL_ID_PREFIX = "cred_devchain_";
+export declare function opencodeOauthMethodId(integrationId: string): string;
+export declare function toOpencodeV2Credential(integrationId: string, entry: OpencodeV1Entry): OpencodeV2Credential;
+export declare function fromOpencodeV2Credential(integrationId: string, value: Record<string, unknown>): OpencodeV1Entry;
+export declare function parseOpencodeV2Export(stdout: string): Record<string, OpencodeV1Entry>;

package/dist/server/modules/provider-auth/opencode-credentials.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVCHAIN_OPENCODE_CREDENTIAL_ID_PREFIX = void 0;
+exports.opencodeOauthMethodId = opencodeOauthMethodId;
+exports.toOpencodeV2Credential = toOpencodeV2Credential;
+exports.fromOpencodeV2Credential = fromOpencodeV2Credential;
+exports.parseOpencodeV2Export = parseOpencodeV2Export;
+exports.DEVCHAIN_OPENCODE_CREDENTIAL_ID_PREFIX = 'cred_devchain_';
+function opencodeOauthMethodId(integrationId) {
+    if (integrationId === 'openai')
+        return 'chatgpt-browser';
+    if (['github-copilot', 'opencode', 'xai'].includes(integrationId))
+        return 'device';
+    return 'oauth';
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+function requireString(entry, field, what, allowEmpty = false) {
+    const value = entry[field];
+    if (typeof value !== 'string' || (value === '' && !allowEmpty)) {
+        throw new Error(`${what} has no ${field}`);
+    }
+    return value;
+}
+function toOpencodeV2Credential(integrationId, entry) {
+    const what = `OpenCode ${integrationId} login`;
+    switch (entry.type) {
+        case 'api':
+            return {
+                type: 'key',
+                key: requireString(entry, 'key', what),
+                ...(isRecord(entry.metadata) && { metadata: entry.metadata }),
+            };
+        case 'wellknown':
+            return { type: 'key', key: requireString(entry, 'token', what) };
+        case 'oauth': {
+            if (typeof entry.expires !== 'number')
+                throw new Error(`${what} has no expires`);
+            const accountId = typeof entry.accountId === 'string' ? entry.accountId : '';
+            const enterpriseUrl = typeof entry.enterpriseUrl === 'string' ? entry.enterpriseUrl : '';
+            const metadata = {
+                ...(isRecord(entry.metadata) ? entry.metadata : {}),
+                ...(accountId ? { accountID: accountId } : {}),
+                ...(enterpriseUrl ? { enterpriseUrl } : {}),
+            };
+            return {
+                type: 'oauth',
+                methodID: typeof entry.methodID === 'string'
+                    ? entry.methodID
+                    : opencodeOauthMethodId(integrationId),
+                refresh: requireString(entry, 'refresh', what, true),
+                access: requireString(entry, 'access', what),
+                expires: entry.expires,
+                ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
+            };
+        }
+        default:
+            throw new Error(`${what} has the unsupported type ${String(entry.type)}`);
+    }
+}
+function fromOpencodeV2Credential(integrationId, value) {
+    if (value.type === 'key') {
+        return {
+            type: 'api',
+            key: value.key,
+            ...(isRecord(value.metadata) && { metadata: value.metadata }),
+        };
+    }
+    if (value.type === 'oauth') {
+        const { accountID, enterpriseUrl, ...metadata } = isRecord(value.metadata)
+            ? value.metadata
+            : {};
+        return {
+            type: 'oauth',
+            refresh: value.refresh,
+            access: value.access,
+            expires: value.expires,
+            ...(accountID !== undefined && { accountId: accountID }),
+            ...(enterpriseUrl !== undefined && { enterpriseUrl }),
+            ...(value.methodID !== opencodeOauthMethodId(integrationId) && {
+                methodID: value.methodID,
+            }),
+            ...(Object.keys(metadata).length > 0 && { metadata }),
+        };
+    }
+    return { ...value };
+}
+function parseOpencodeV2Export(stdout) {
+    const parsed = JSON.parse(stdout);
+    if (!Array.isArray(parsed))
+        throw new Error('auth export did not print a JSON array');
+    const entries = {};
+    for (const item of parsed) {
+        if (!isRecord(item) || typeof item.integrationID !== 'string' || !isRecord(item.value)) {
+            throw new Error('auth export printed an unexpected credential');
+        }
+        if (item.active === true) {
+            entries[item.integrationID] = fromOpencodeV2Credential(item.integrationID, item.value);
+        }
+    }
+    return entries;
+}
+//# sourceMappingURL=opencode-credentials.js.map

package/dist/server/modules/provider-auth/opencode-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-credentials.js","sourceRoot":"","sources":["../../../src/modules/provider-auth/opencode-credentials.ts"],"names":[],"mappings":";;;AAgCA,sDAIC;AAmBD,wDAwCC;AAUD,4DA6BC;AAMD,sDAaC;AA5HY,QAAA,sCAAsC,GAAG,gBAAgB,CAAC;AAGvE,SAAgB,qBAAqB,CAAC,aAAqB;IACzD,IAAI,aAAa,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC;IACzD,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,SAAS,aAAa,CACpB,KAA8B,EAC9B,KAAa,EACb,IAAY,EACZ,UAAU,GAAG,KAAK;IAElB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,sBAAsB,CACpC,aAAqB,EACrB,KAAsB;IAEtB,MAAM,IAAI,GAAG,YAAY,aAAa,QAAQ,CAAC;IAC/C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,KAAK;YACR,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;gBACtC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aAC9D,CAAC;QAEJ,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACnE,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,aAAa,GAAG,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,QAAQ,GAAG;gBACf,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;oBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;oBAChB,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC;gBAE1C,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;gBACpD,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC;gBAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAUD,SAAgB,wBAAwB,CACtC,aAAqB,EACrB,KAA8B;IAE9B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YACxD,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,qBAAqB,CAAC,aAAa,CAAC,IAAI;gBAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAMD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,MAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/server/modules/provider-auth/opencode-pc-logins.service.d.ts

@@ -0,0 +1,11 @@
+import { ProviderCliVersionProbe } from '../providers/services/provider-cli-version-probe.service';
+import { type ProviderStorage } from '../storage/interfaces/storage.interface';
+import { ProcessExecutor } from '../terminal/services/process-executor/process-executor.port';
+export declare class OpencodePcLoginsReader {
+    private readonly probe;
+    private readonly executor;
+    private readonly storage;
+    constructor(probe: ProviderCliVersionProbe, executor: ProcessExecutor, storage: Pick<ProviderStorage, 'listProviders'>);
+    read(): Promise<Record<string, unknown> | null>;
+    private binPath;
+}

package/dist/server/modules/provider-auth/opencode-pc-logins.service.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpencodePcLoginsReader = void 0;
+const node_os_1 = require("node:os");
+const common_1 = require("@nestjs/common");
+const resolve_binary_1 = require("../../common/resolve-binary");
+const logger_1 = require("../../common/logging/logger");
+const opencode_cli_version_1 = require("../providers/adapters/opencode-cli-version");
+const provider_cli_version_probe_service_1 = require("../providers/services/provider-cli-version-probe.service");
+const storage_interface_1 = require("../storage/interfaces/storage.interface");
+const process_executor_port_1 = require("../terminal/services/process-executor/process-executor.port");
+const opencode_pc_logins_v1_1 = require("./opencode-pc-logins.v1");
+const opencode_pc_logins_v2_1 = require("./opencode-pc-logins.v2");
+const logger = (0, logger_1.createLogger)('OpencodePcLoginsReader');
+let OpencodePcLoginsReader = class OpencodePcLoginsReader {
+    probe;
+    executor;
+    storage;
+    constructor(probe, executor, storage) {
+        this.probe = probe;
+        this.executor = executor;
+        this.storage = storage;
+    }
+    async read() {
+        const binPath = await this.binPath();
+        if (binPath) {
+            const version = await this.probe.probe('opencode', binPath).catch((error) => {
+                logger.warn({ binPath, error: String(error) }, 'Could not read the OpenCode version');
+                return null;
+            });
+            if (version !== null && (0, opencode_cli_version_1.isOpencodeV2)(version)) {
+                return (0, opencode_pc_logins_v2_1.exportOpencodeLoginsV2)(this.executor, binPath);
+            }
+        }
+        return (0, opencode_pc_logins_v1_1.readOpencodeAuthFileV1)((0, node_os_1.homedir)());
+    }
+    async binPath() {
+        const { items } = await this.storage.listProviders();
+        const configured = items.find((row) => row.name.toLowerCase() === 'opencode')?.binPath;
+        return (0, resolve_binary_1.resolveBinary)(configured || 'opencode', this.executor);
+    }
+};
+exports.OpencodePcLoginsReader = OpencodePcLoginsReader;
+exports.OpencodePcLoginsReader = OpencodePcLoginsReader = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(storage_interface_1.STORAGE_SERVICE)),
+    __metadata("design:paramtypes", [provider_cli_version_probe_service_1.ProviderCliVersionProbe,
+        process_executor_port_1.ProcessExecutor, Object])
+], OpencodePcLoginsReader);
+//# sourceMappingURL=opencode-pc-logins.service.js.map

package/dist/server/modules/provider-auth/opencode-pc-logins.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-pc-logins.service.js","sourceRoot":"","sources":["../../../src/modules/provider-auth/opencode-pc-logins.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,qCAAkC;AAClC,2CAAoD;AACpD,gEAA4D;AAC5D,wDAA2D;AAC3D,qFAA0E;AAC1E,iHAAmG;AACnG,+EAAgG;AAChG,uGAA8F;AAC9F,mEAAiE;AACjE,mEAAiE;AAEjE,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,wBAAwB,CAAC,CAAC;AAO/C,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAEd;IACA;IACyB;IAH5C,YACmB,KAA8B,EAC9B,QAAyB,EACA,OAA+C;QAFxE,UAAK,GAAL,KAAK,CAAyB;QAC9B,aAAQ,GAAR,QAAQ,CAAiB;QACA,YAAO,GAAP,OAAO,CAAwC;IACxF,CAAC;IAGJ,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACnF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,IAAI,IAAI,IAAA,mCAAY,EAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAA,8CAAsB,EAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,IAAA,8CAAsB,EAAC,IAAA,iBAAO,GAAE,CAAC,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,EAAE,OAAO,CAAC;QACvF,OAAO,IAAA,8BAAa,EAAC,UAAU,IAAI,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AA3BY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,mCAAe,CAAC,CAAA;qCAFA,4DAAuB;QACpB,uCAAe;GAHjC,sBAAsB,CA2BlC"}

package/dist/server/modules/provider-auth/opencode-pc-logins.v1.d.ts

@@ -0,0 +1 @@
+export declare function readOpencodeAuthFileV1(homedir: string): Promise<Record<string, unknown> | null>;

package/dist/server/modules/provider-auth/opencode-pc-logins.v1.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOpencodeAuthFileV1 = readOpencodeAuthFileV1;
+const promises_1 = require("node:fs/promises");
+const provider_auth_adapters_1 = require("./provider-auth-adapters");
+async function readOpencodeAuthFileV1(homedir) {
+    let content;
+    try {
+        content = await (0, promises_1.readFile)((0, provider_auth_adapters_1.opencodePcAuthFilePath)(homedir), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return null;
+    return parsed;
+}
+//# sourceMappingURL=opencode-pc-logins.v1.js.map

package/dist/server/modules/provider-auth/opencode-pc-logins.v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-pc-logins.v1.js","sourceRoot":"","sources":["../../../src/modules/provider-auth/opencode-pc-logins.v1.ts"],"names":[],"mappings":";;AAIA,wDAiBC;AArBD,+CAA4C;AAC5C,qEAAkE;AAG3D,KAAK,UAAU,sBAAsB,CAC1C,OAAe;IAEf,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAA,+CAAsB,EAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,MAAiC,CAAC;AAC3C,CAAC"}

package/dist/server/modules/provider-auth/opencode-pc-logins.v2.d.ts

@@ -0,0 +1,3 @@
+import type { ProcessExecutor } from '../terminal/services/process-executor/process-executor.port';
+import { type OpencodeV1Entry } from './opencode-credentials';
+export declare function exportOpencodeLoginsV2(executor: ProcessExecutor, binPath: string): Promise<Record<string, OpencodeV1Entry> | null>;

package/dist/server/modules/provider-auth/opencode-pc-logins.v2.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportOpencodeLoginsV2 = exportOpencodeLoginsV2;
+const provider_cli_policy_1 = require("../providers/adapters/provider-cli-policy");
+const opencode_credentials_1 = require("./opencode-credentials");
+const EXPORT_TIMEOUT_MS = 30_000;
+async function exportOpencodeLoginsV2(executor, binPath) {
+    const command = (0, provider_cli_policy_1.applyProviderCliNoUpdate)('opencode', (0, provider_cli_policy_1.opencodeV2CommandArgs)([binPath, 'auth', 'export']), process.env);
+    const result = await executor.run({
+        argv: command.argv,
+        mode: 'pipe',
+        env: command.env,
+        timeout: EXPORT_TIMEOUT_MS,
+        outputLimits: { maxBytes: 1024 * 1024 },
+    });
+    if (!result.success)
+        return null;
+    try {
+        return (0, opencode_credentials_1.parseOpencodeV2Export)(result.stdout);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=opencode-pc-logins.v2.js.map

package/dist/server/modules/provider-auth/opencode-pc-logins.v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-pc-logins.v2.js","sourceRoot":"","sources":["../../../src/modules/provider-auth/opencode-pc-logins.v2.ts"],"names":[],"mappings":";;AAUA,wDAsBC;AAhCD,mFAGmD;AAEnD,iEAAqF;AAErF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAG1B,KAAK,UAAU,sBAAsB,CAC1C,QAAyB,EACzB,OAAe;IAEf,MAAM,OAAO,GAAG,IAAA,8CAAwB,EACtC,UAAU,EACV,IAAA,2CAAqB,EAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,EAClD,OAAO,CAAC,GAAG,CACZ,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,iBAAiB;QAC1B,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAA,4CAAqB,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/server/modules/provider-auth/provider-auth-adapters.d.ts

@@ -16,6 +16,7 @@ export type ProviderAuthAdapterSpec = ProviderAuthEnvSpec | ProviderAuthFilesSpe
 export declare const PROVIDER_AUTH_ADAPTERS: Record<string, ProviderAuthAdapterSpec>;
 export declare function specAcceptsPayload(spec: ProviderAuthAdapterSpec, payloadKind: ProviderAuthPayload['payloadKind']): boolean;
 export declare const OPENCODE_AUTH_FILE_PATH = ".local/share/opencode/auth.json";
+export declare const OPENCODE_DB_FILE_PATH = ".local/share/opencode/opencode.db";
 export declare function opencodeEntries(payload: ProviderAuthPayload): Record<string, Record<string, unknown>>;
 export declare function opencodePcAuthFilePath(homedir: string): string;
 export declare const RESERVED_PROVIDER_AUTH_ENV_KEYS: ReadonlySet<string>;
@@ -60,6 +61,7 @@ export interface ProviderAuthLoginAdapter {
     capture: ProviderAuthCaptureSpec;
     parse(captured: Record<string, string> | string): ProviderAuthGeneratedEntry[];
     verifyCommand(dir: string, entries: ProviderAuthGeneratedEntry[], bin: ProviderAuthBinResolver): ProviderAuthVerifySpec;
+    forCliVersion?(cliVersion: string, binPath: string): ProviderAuthLoginAdapter;
 }
 export type ProviderAuthVerifyOutcome = {
     ok: true;
@@ -68,7 +70,8 @@ export type ProviderAuthVerifyOutcome = {
     hint: string;
 };
 export interface ProviderAuthVerifyCheck {
-    argv(bin: ProviderAuthBinResolver): string[];
+    readonly requiresCliVersion?: true;
+    argv(bin: ProviderAuthBinResolver, cliVersion?: string): string[];
     check(output: string, context: {
         opencodeProviderIds: string[];
     }): ProviderAuthVerifyOutcome;

package/dist/server/modules/provider-auth/provider-auth-adapters.js

@@ -1,9 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROVIDER_AUTH_LOGIN_ADAPTERS = exports.PROVIDER_AUTH_VERIFY = exports.PROVIDER_AUTH_ENV_KEY_PATTERN = exports.RESERVED_PROVIDER_AUTH_ENV_KEYS = exports.OPENCODE_AUTH_FILE_PATH = exports.PROVIDER_AUTH_ADAPTERS = void 0;
+exports.PROVIDER_AUTH_LOGIN_ADAPTERS = exports.PROVIDER_AUTH_VERIFY = exports.PROVIDER_AUTH_ENV_KEY_PATTERN = exports.RESERVED_PROVIDER_AUTH_ENV_KEYS = exports.OPENCODE_DB_FILE_PATH = exports.OPENCODE_AUTH_FILE_PATH = exports.PROVIDER_AUTH_ADAPTERS = void 0;
 exports.specAcceptsPayload = specAcceptsPayload;
 exports.opencodeEntries = opencodeEntries;
 exports.opencodePcAuthFilePath = opencodePcAuthFilePath;
+const opencode_cli_version_1 = require("../providers/adapters/opencode-cli-version");
+const provider_cli_policy_1 = require("../providers/adapters/provider-cli-policy");
+const opencode_credentials_1 = require("./opencode-credentials");
 const AGY_TOKEN_FILE_PATH = '.gemini/antigravity-cli/antigravity-oauth-token';
 exports.PROVIDER_AUTH_ADAPTERS = {
     claude: { kind: 'static', payloadKind: 'env', envKey: 'CLAUDE_CODE_OAUTH_TOKEN' },
@@ -17,6 +20,7 @@ function specAcceptsPayload(spec, payloadKind) {
         (spec.payloadKind === 'opencode-entry' && payloadKind === 'opencode-entries'));
 }
 exports.OPENCODE_AUTH_FILE_PATH = '.local/share/opencode/auth.json';
+exports.OPENCODE_DB_FILE_PATH = '.local/share/opencode/opencode.db';
 function opencodeEntries(payload) {
     switch (payload.payloadKind) {
         case 'opencode-entry':
@@ -92,7 +96,13 @@ exports.PROVIDER_AUTH_VERIFY = {
         check: (output) => output.includes('Logged in') ? { ok: true } : { ok: false, hint: 'Codex is not logged in.' },
     },
     opencode: {
-        argv: (bin) => [bin('opencode'), 'auth', 'list'],
+        requiresCliVersion: true,
+        argv: (bin, cliVersion) => {
+            const argv = [bin('opencode'), 'auth', 'list'];
+            return cliVersion === undefined
+                ? argv
+                : (0, provider_cli_policy_1.opencodeCommandArgs)((0, opencode_cli_version_1.assertSupportedOpencodeVersion)(cliVersion, argv[0]), argv);
+        },
         check: (output, { opencodeProviderIds }) => {
             const listed = alphanumeric(output);
             const missing = opencodeProviderIds.filter((id) => !listed.includes(alphanumeric(id)));
@@ -113,10 +123,10 @@ exports.PROVIDER_AUTH_VERIFY = {
 function opencodeIds(entries) {
     return entries.flatMap((entry) => Object.keys(opencodeEntries(entry.payload)));
 }
-function verifySpec(provider, env, entries, bin) {
+function verifySpec(provider, env, entries, bin, cliVersion) {
     const verify = exports.PROVIDER_AUTH_VERIFY[provider];
     return {
-        argv: verify.argv(bin),
+        argv: verify.argv(bin, cliVersion),
         env,
         accepts: (output) => verify.check(output, { opencodeProviderIds: opencodeIds(entries) }).ok,
     };
@@ -165,6 +175,56 @@ const opencodeIsolation = (dir) => ({
     unset: [],
 });
 const AGY_CAPTURE_FILE = `home/${AGY_TOKEN_FILE_PATH}`;
+function opencodeOauthFamilies(logins, what) {
+    const entries = [];
+    for (const [providerId, entry] of Object.entries(logins)) {
+        if (!entry || typeof entry !== 'object' || entry.type !== 'oauth') {
+            continue;
+        }
+        entries.push({
+            kind: 'family',
+            labelSuffix: providerId,
+            payload: {
+                payloadKind: 'opencode-entry',
+                providerId,
+                entry: entry,
+            },
+            secrets: stringLeaves(entry),
+        });
+    }
+    if (entries.length === 0)
+        throw new Error(`${what} has no oauth login`);
+    return entries;
+}
+function opencodeLoginV2(cliVersion) {
+    return {
+        isolationEnv: opencodeIsolation,
+        prepareDirs: [],
+        loginCommand: (bin) => (0, provider_cli_policy_1.opencodeV2CommandArgs)([bin('opencode'), 'auth', 'login']),
+        capture: {
+            kind: 'command',
+            whenFile: 'opencode/opencode.db',
+            command: (bin) => (0, provider_cli_policy_1.opencodeV2CommandArgs)([bin('opencode'), 'auth', 'export']),
+        },
+        parse: (captured) => {
+            if (typeof captured !== 'string')
+                throw new Error('expected the auth export output');
+            return opencodeOauthFamilies((0, opencode_credentials_1.parseOpencodeV2Export)(captured), 'auth export');
+        },
+        verifyCommand: (dir, entries, bin) => verifySpec('opencode', opencodeIsolation(dir), entries, bin, cliVersion),
+    };
+}
+const opencodeLoginV1 = {
+    isolationEnv: opencodeIsolation,
+    prepareDirs: [],
+    loginCommand: (bin) => [bin('opencode'), 'auth', 'login'],
+    capture: { kind: 'files', files: ['opencode/auth.json'] },
+    parse: (captured) => opencodeOauthFamilies(jsonObject(filesOf(captured)['opencode/auth.json'], 'auth.json'), 'auth.json'),
+    verifyCommand: (dir, entries, bin) => verifySpec('opencode', opencodeIsolation(dir), entries, bin),
+    forCliVersion: (cliVersion, binPath) => (0, opencode_cli_version_1.assertSupportedOpencodeVersion)(cliVersion, binPath).major === 2
+        ? opencodeLoginV2(cliVersion)
+        : opencodeLoginV1,
+};
 exports.PROVIDER_AUTH_LOGIN_ADAPTERS = {
     codex: {
         isolationEnv: codexIsolation,
@@ -196,35 +256,7 @@ exports.PROVIDER_AUTH_LOGIN_ADAPTERS = {
         },
         verifyCommand: (dir, entries, bin) => verifySpec('agy', agyIsolation(dir), entries, bin),
     },
-    opencode: {
-        isolationEnv: opencodeIsolation,
-        prepareDirs: [],
-        loginCommand: (bin) => [bin('opencode'), 'auth', 'login'],
-        capture: { kind: 'files', files: ['opencode/auth.json'] },
-        parse: (captured) => {
-            const auth = jsonObject(filesOf(captured)['opencode/auth.json'], 'auth.json');
-            const entries = [];
-            for (const [providerId, entry] of Object.entries(auth)) {
-                if (!entry || typeof entry !== 'object' || entry.type !== 'oauth') {
-                    continue;
-                }
-                entries.push({
-                    kind: 'family',
-                    labelSuffix: providerId,
-                    payload: {
-                        payloadKind: 'opencode-entry',
-                        providerId,
-                        entry: entry,
-                    },
-                    secrets: stringLeaves(entry),
-                });
-            }
-            if (entries.length === 0)
-                throw new Error('auth.json has no oauth login');
-            return entries;
-        },
-        verifyCommand: (dir, entries, bin) => verifySpec('opencode', opencodeIsolation(dir), entries, bin),
-    },
+    opencode: opencodeLoginV1,
     copilot: {
         isolationEnv: (dir) => ({ set: { GH_CONFIG_DIR: dir }, unset: GITHUB_TOKEN_VARIABLES }),
         prepareDirs: [],