dsh-opencode 0.1.2 → 0.1.3

package/README.md

@@ -20,16 +20,22 @@ pnpm dsh plugin --profile web remove dsh-opencode
 ## 使い方
 
 1. DSH を再起動すると両ルートが登録される(以降のカタログ更新に再起動は不要)
-2. Web の 設定 > モデル > OpenCode Zen (Live) の「編集」を開き、マスク済み API キー入力欄にキーを貼り付けて保存
+2. `/dsh-opencode` を実行して API キーを設定する
+   - キー未設定ならコマンドの入力フィールドにキーを貼って再度実行
+   - DSH の opencode キー保存先(`OPENCODE_API_KEY`)に書き込み、設定や他の参照を変えていないか検証
 3. モデルセレクターから OpenCode のモデルを選んで使う
 
 | コマンド | 効果 |
 |---|---|
-| `/dsh-opencode` | ステータス表示とキー設定場所の案内 |
+| `/dsh-opencode [<api-key>]` | API キーを保存して Zen/Go を有効化(未入力なら状態表示) |
 | `/opencode-refresh [all\|zen\|go]` | カタログを強制更新 |
 | `/opencode-status` | 更新時刻・エラー・モデル数・キー設定状況 |
 | `/opencode-models <zen\|go> [--all]` | モデル一覧(`--all` で非対応含む) |
 
+- API キーはコマンドの入力フィールドで受け取り、`recordInput: false` でログに残さない
+- 保存後、設定セクションと他の認証参照が変わっていないことを検証してから成功を報告する
+- 環境変数 `OPENCODE_API_KEY`(両ルート既定参照)でも可
+
 ## 設定
 
 名前空間 `opencode-live`(デフォルトは `cordis.patch.yml` 参照):
@@ -48,7 +54,6 @@ catalog:
   requireFresh: false
 ```
 
-- API キーは設定 UI から保存(コマンド引数では受け付けない)。環境変数 `OPENCODE_API_KEY` でも可
 - `cachePath` でキャッシュ位置を変更可能(既定は DSH ホーム下 `cache/opencode-live/catalog.json`)
 
 ## 開発

package/lib/commands.js

@@ -1,8 +1,8 @@
 import { PRODUCT_BY_ROUTE, ROUTE_BY_PRODUCT, describeNonReadyState } from "./normalize.js";
+import "./keyring.js";
 //#region src/commands.ts
 const USAGE_REFRESH = "Usage: /opencode-refresh [all|zen|go]";
 const USAGE_MODELS = "Usage: /opencode-models <zen|go> [--all]";
-const USAGE_ENABLE = "Usage: /dsh-opencode — report status; store the API key through the web Models page";
 /** Whether one date stamp renders as a short local time. */
 function renderTime(timestamp) {
 	if (timestamp === void 0) return "never";
@@ -130,21 +130,35 @@ function commandDefinitions(ctx, services) {
 		},
 		{
 			name: "dsh-opencode",
-			description: "Show OpenCode status and where to store the API key",
+			description: "Store the OpenCode API key, or report status",
+			input: { hint: "Paste the OpenCode API key here (required only when unset)" },
 			recordInput: false,
 			handler: async (invocation) => {
-				if (invocation.rawInput.trim().length > 0) return {
-					kind: "error",
-					text: [USAGE_ENABLE, "This command never accepts the key as text; paste it into the masked API key input on the web Models page instead."].join("\n")
-				};
 				const routes = [ROUTE_BY_PRODUCT.zen, ROUTE_BY_PRODUCT.go];
-				if (!(await Promise.all(routes.map(async (route) => {
-					return (await services.describeCredential(route))?.configured === true;
-				}))).some((configured) => configured)) return {
+				const key = invocation.rawInput.trim();
+				if (key.length > 0) {
+					if (invocation.signal.aborted) return {
+						kind: "success",
+						text: "Storing cancelled."
+					};
+					const failure = await services.storeApiKey(key);
+					if (failure !== void 0) return {
+						kind: "error",
+						text: failure
+					};
+					const lines = ["OpenCode API key stored. Zen and Go are enabled:"];
+					for (const route of routes) lines.push(await productStatus(ctx, services, PRODUCT_BY_ROUTE[route]));
+					return {
+						kind: "success",
+						text: lines.join("\n")
+					};
+				}
+				if (!await services.keyConfigured()) return {
 					kind: "success",
 					text: [
 						"No OpenCode API key is configured yet.",
-						"Open Settings > Models, edit the OpenCode Zen (Live) provider, and paste the key into its masked API key input.",
+						"Type the key into this command's input field and run again, or export it in the launch environment.",
+						...await services.keyReadonly() ? ["The credential reference is read-only in this deployment."] : [],
 						"This command never displays key values."
 					].join("\n")
 				};

package/lib/index.js

@@ -4,6 +4,7 @@ import { readySetHash } from "./snapshot.js";
 import { CatalogManager } from "./catalog.js";
 import { Config, DEFAULT_MAX_REQUEST_IMAGE_BYTES, DEFAULT_REQUEST_IMAGE_MAX_BYTES, DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, assertServiceable, resolveConfig } from "./config.js";
 import { apiKeyOnlyAuth, describeCredential, resolveApiKeyFor, staticAuthBridge } from "./credentials.js";
+import { keyConfigured, keyReadonly, storeApiKey } from "./keyring.js";
 import { registerCommands } from "./commands.js";
 import { buildRouteProvider } from "./transport.js";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -154,7 +155,10 @@ function apply(ctx, config = {}) {
 				const provider = currentConfig.providers.get(route);
 				if (provider === void 0) return void 0;
 				return describeCredential(ctx, provider.apiKeyEnv);
-			}
+			},
+			storeApiKey: (value) => storeApiKey(ctx, currentConfig.providers.values(), value),
+			keyConfigured: () => keyConfigured(ctx, currentConfig.providers.values()),
+			keyReadonly: () => keyReadonly(ctx, currentConfig.providers.values())
 		});
 	});
 	let source = () => config;

package/lib/keyring.js

@@ -0,0 +1,109 @@
+import { SETTINGS_NAMESPACE } from "./index.js";
+import { assertUsableApiKey } from "@deepseek-ai/dsh-llm";
+//#region src/keyring.ts
+/**
+* Read one reference's presence, treating an absent credential service as a
+* stable `false` rather than a throw: the caller wants facts, not a diagnosis.
+*/
+async function refState(ctx, ref) {
+	const credentials = ctx.get("credentials");
+	if (credentials === void 0) return {
+		configured: false,
+		writable: false
+	};
+	const described = await credentials.describe(ref);
+	return described === void 0 ? {
+		configured: false,
+		writable: false
+	} : {
+		configured: described.configured,
+		writable: described.writable
+	};
+}
+/**
+* Read the state a key store is about to operate against.
+* @param ctx - the plugin context.
+* @param providers - the currently resolved provider profiles.
+* @returns the immutable snapshot for before/after comparison.
+*/
+async function snapshotKeyring(ctx, providers) {
+	const settings = ctx.get("settings");
+	const sectionValue = settings === void 0 ? void 0 : settings.get(SETTINGS_NAMESPACE);
+	const refs = /* @__PURE__ */ new Map();
+	for (const { apiKeyEnv } of providers) if (!refs.has(apiKeyEnv)) refs.set(apiKeyEnv, await refState(ctx, apiKeyEnv));
+	return {
+		section: JSON.stringify(sectionValue ?? null),
+		refs
+	};
+}
+/**
+* Verify a key store left no stray change. Compares the section snapshot and
+* every reference the plugin knows with a stable JSON text, so a change in
+* either is caught regardless of ordering.
+* @param before - the snapshot taken before the store.
+* @param after - the snapshot taken after the store.
+* @param refs - the references the store wrote (the only ones allowed to move).
+* @returns a failure line, or `undefined` when only the intended refs changed.
+*/
+function verifyNoStrayChange(before, after, refs) {
+	if (before.section !== after.section) return `opencode-live: the settings section changed while storing the key (${SETTINGS_NAMESPACE})`;
+	for (const [ref, state] of before.refs) {
+		const next = after.refs.get(ref);
+		if (next === void 0) return `opencode-live: credential ${ref} vanished after storing the key`;
+		if (state.configured === next.configured && state.writable === next.writable) continue;
+		if (!refs.includes(ref)) return `opencode-live: an unrelated credential reference changed (${ref})`;
+	}
+	for (const [ref, next] of after.refs) {
+		if (before.refs.has(ref)) continue;
+		if (!refs.includes(ref)) return `opencode-live: an unrelated credential reference appeared (${ref})`;
+		if (!next.configured) return `opencode-live: the stored reference ${ref} did not become configured`;
+	}
+}
+/**
+* Store one OpenCode key through the DSH credential seam.
+*
+* This is the whole write surface a command uses. Validation runs before any
+* write, so a key that would be refused is never persisted. The write is
+* fenced by `snapshotKeyring` before and after; a stray settings or unrelated
+* credential change fails the call with a diagnostic instead of silently
+* committing alongside the key.
+* @param ctx - the plugin context.
+* @param providers - the currently resolved provider profiles.
+* @param value - the key typed into the command's input field.
+* @returns `undefined` on success, or a failure line naming the exact problem.
+*/
+async function storeApiKey(ctx, providers, value) {
+	try {
+		assertUsableApiKey(value, "opencode-live", "input");
+	} catch (error) {
+		return error.message;
+	}
+	const credentials = ctx.get("credentials");
+	if (credentials === void 0) return "opencode-live: no credentials service is mounted; export the API key in the launch environment instead";
+	const before = await snapshotKeyring(ctx, providers);
+	const targets = [...new Set([...providers].map(({ apiKeyEnv }) => apiKeyEnv))];
+	try {
+		for (const ref of targets) await credentials.set(ref, value);
+	} catch (error) {
+		return `opencode-live: could not store the API key (${error.message})`;
+	}
+	return verifyNoStrayChange(before, await snapshotKeyring(ctx, providers), targets);
+}
+/**
+* Presence facts for the status path: whether a key is configured, without
+* ever exposing a value.
+* @param ctx - the plugin context.
+* @param providers - the currently resolved provider profiles.
+* @returns whether the shared reference is configured.
+*/
+async function keyConfigured(ctx, providers) {
+	const refs = [...new Set([...providers].map(({ apiKeyEnv }) => apiKeyEnv))];
+	return (await Promise.all(refs.map((ref) => refState(ctx, ref)))).some((state) => state.configured);
+}
+/** Whether any reference is read-only, so the status can say so. */
+async function keyReadonly(ctx, providers) {
+	const refs = [...new Set([...providers].map(({ apiKeyEnv }) => apiKeyEnv))];
+	return (await Promise.all(refs.map((ref) => refState(ctx, ref)))).some((state) => !state.writable);
+}
+//#endregion
+export { keyConfigured, keyReadonly, snapshotKeyring, storeApiKey, verifyNoStrayChange };

package/lib/transport.js

@@ -27,7 +27,7 @@ import { openAIResponsesApi } from "@earendil-works/pi-ai/api/openai-responses.l
 */
 /** The plugin's honest client identification value. */
 const PLUGIN_ID = "opencode-live";
-const PLUGIN_VERSION = "0.1.1";
+const PLUGIN_VERSION = "0.1.2";
 /** Header OpenCode Go documents for coding-agent session identification. */
 const SESSION_HEADER = "x-opencode-session";
 /** Header carrying this plugin's honest client identity alongside DSH attribution. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-opencode",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Out-of-tree DSH bundle with live dynamic OpenCode Zen / Go model catalogs",
   "private": false,
   "license": "MIT",