dsh-opencode 0.1.0 → 0.1.1

package/README.md

@@ -57,12 +57,12 @@ Refreshes run single-flight per source (Models.dev once for both products) with
 
 | Command | Effect |
 |---|---|
-| `/dsh-opencode` | After the key is stored securely, refreshes both catalogs and enables Zen/Go immediately; never accepts key values |
+| `/dsh-opencode [<api-key>]` | Store the API key securely and enable Zen/Go immediately; with no argument, checks status and guides setup |
 | `/opencode-refresh [all\|zen\|go]` | Force a catalog refresh (joins in-flight fetches) |
 | `/opencode-status` | Freshness, per-source errors, ready/pending counts, credential presence |
 | `/opencode-models <zen\|go> [--all]` | Ready models, or every candidate with its state and reason |
 
-None of these commands displays key values or fragments, and none registers a model-visible tool.
+None of these commands displays key values or fragments, and none registers a model-visible tool. `/dsh-opencode` accepts the key only as its single argument and writes it through the DSH credential seam (`recordInput: false` keeps it out of session logs); it never echoes the value back.
 
 ## Configuration
 

package/lib/commands.js

@@ -1,8 +1,8 @@
 import { PRODUCT_BY_ROUTE, ROUTE_BY_PRODUCT, describeNonReadyState } from "./normalize.js";
+import { assertUsableApiKey } from "@deepseek-ai/dsh-llm";
 //#region src/commands.ts
 const USAGE_REFRESH = "Usage: /opencode-refresh [all|zen|go]";
 const USAGE_MODELS = "Usage: /opencode-models <zen|go> [--all]";
-const USAGE_ENABLE = "Usage: /dsh-opencode — never pass the API key in the command line";
 /** Whether one date stamp renders as a short local time. */
 function renderTime(timestamp) {
 	if (timestamp === void 0) return "never";
@@ -37,6 +37,10 @@ function parseProduct(raw) {
 	if (raw === "zen") return "zen";
 	if (raw === "go") return "go";
 }
+/** Distinct credential references across the configured routes. */
+function configuredRefs(services) {
+	return [...new Set([...services.config().providers.values()].map((provider) => provider.apiKeyEnv))];
+}
 /** Build the three command definitions. */
 function commandDefinitions(ctx, services) {
 	return [
@@ -130,25 +134,46 @@ function commandDefinitions(ctx, services) {
 		},
 		{
 			name: "dsh-opencode",
-			description: "Enable OpenCode Zen/Go immediately after the API key is stored securely",
+			description: "Store the OpenCode API key and enable Zen/Go immediately",
 			recordInput: false,
 			handler: async (invocation) => {
-				if (invocation.rawInput.trim().length > 0) return {
-					kind: "error",
-					text: USAGE_ENABLE
-				};
+				const raw = invocation.rawInput.trim();
+				let stored = false;
+				if (raw.length > 0) {
+					try {
+						assertUsableApiKey(raw, "opencode-live", "input");
+					} catch (error) {
+						return {
+							kind: "error",
+							text: error.message
+						};
+					}
+					const failures = [];
+					for (const ref of configuredRefs(services)) try {
+						await services.storeCredential(ref, raw);
+					} catch (error) {
+						failures.push(`${ref}: ${error.message}`);
+					}
+					if (failures.length > 0) return {
+						kind: "error",
+						text: ["Could not store the OpenCode API key:", ...failures].join("\n")
+					};
+					stored = true;
+				}
 				const routes = [ROUTE_BY_PRODUCT.zen, ROUTE_BY_PRODUCT.go];
-				if (!(await Promise.all(routes.map(async (route) => {
-					return (await services.describeCredential(route))?.configured === true;
-				}))).some((configured) => configured)) return {
-					kind: "success",
-					text: [
-						"No OpenCode API key is configured yet.",
-						"Store it securely through the standard credentials input (the web Models page writes it),",
-						"then run /dsh-opencode again to refresh both catalogs and enable the routes immediately.",
-						"This command never accepts, records, or displays key values."
-					].join("\n")
-				};
+				if (!stored) {
+					if (!(await Promise.all(routes.map(async (route) => {
+						return (await services.describeCredential(route))?.configured === true;
+					}))).some((configured) => configured)) return {
+						kind: "success",
+						text: [
+							"No OpenCode API key is configured yet.",
+							"Run /dsh-opencode <your-api-key> to store it securely and enable both routes at once,",
+							"or store it through the standard credentials input (the web Models page writes it) and run /dsh-opencode again.",
+							"This command never displays key values."
+						].join("\n")
+					};
+				}
 				if (invocation.signal.aborted) return {
 					kind: "success",
 					text: "Refresh cancelled."
@@ -159,7 +184,7 @@ function commandDefinitions(ctx, services) {
 						signal: invocation.signal
 					});
 				} catch {}
-				const lines = ["OpenCode API key configured. Zen and Go are enabled:"];
+				const lines = [stored ? "OpenCode API key stored. Zen and Go are enabled:" : "OpenCode API key configured. Zen and Go are enabled:"];
 				for (const route of routes) lines.push(await productStatus(ctx, services, PRODUCT_BY_ROUTE[route]));
 				return {
 					kind: "success",

package/lib/index.js

@@ -154,6 +154,11 @@ function apply(ctx, config = {}) {
 				const provider = currentConfig.providers.get(route);
 				if (provider === void 0) return void 0;
 				return describeCredential(ctx, provider.apiKeyEnv);
+			},
+			storeCredential: async (ref, value) => {
+				const credentials = ctx.get("credentials");
+				if (credentials === void 0) throw new Error("opencode-live: no credentials service is mounted; export the API key in the launch environment instead");
+				await credentials.set(ref, value);
 			}
 		});
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-opencode",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Out-of-tree DSH bundle with live dynamic OpenCode Zen / Go model catalogs",
   "private": false,
   "license": "MIT",