opencode-cmd-provider 1.2.2 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 1.3.0 - 2026-08-23
+
+Feature: dual-transport Provider API — non-Go plans now use the documented
+`/provider/v1/*` endpoints with self-healing fallback to the legacy transport.
+
+### Features
+
+- **Provider API routing** (issues #51, #53): non-Go plans (goat, pro, max,
+  max20, teampro, provider aliases) route through the documented Provider API —
+  `claude-*` models to `POST /provider/v1/messages` (Anthropic shape), everything
+  else to `POST /provider/v1/chat/completions` (OpenAI shape) — with retry,
+  timeout, abort, and redaction parity with the legacy transport. Go /
+  individual-go sessions stay byte-for-byte on the legacy `POST /alpha/generate`
+  wire format, proven by golden byte-parity tests.
+- **Session-cached plan resolution** (issue #54): transport is chosen per model
+  instance from the shared plan-resolution seam — explicit override →
+  `COMMANDCODE_PLAN` env → cached `GET /alpha/whoami` → default Provider API.
+  Only a resolved `go` selects the legacy transport; next session after a plan
+  upgrade auto-switches.
+- **Self-healing upgrade flip** (issue #56): if a plan-detection miss sends a
+  true Go user to the Provider API, a documented `403 upgrade_required` pins the
+  session to the legacy transport and retries the same call once there — no
+  second Provider API hit, no double-counted usage.
+- **ZDR passthrough** (issue #57): `CMD_ZDR=1` sends `x-cmd-zdr: 1` on every
+  Provider API request; the documented `422 cmd_zdr_no_providers` flows through
+  the existing error/redaction pipeline. The legacy transport never sends it.
+- **Transport hardening** (issue #58): the finish part now waits for a trailing
+  OpenAI usage-only chunk so cost reflects real token counts; non-image file
+  parts are rejected with a clear role-aware error instead of silently
+  base64-encoding; stateful SSE parsers complete tool calls whose arguments
+  arrive across multiple events.
+
+### Fixes
+
+- Restored the "Command Code" TUI sidebar section for Ox Alpha and DeepSeek V4
+  Flash Vision (exp): the deals-coverage gate now fails loudly when scraped
+  records lack a snapshot model, and the fixtures were refreshed to cover every
+  model (issue #61).
+
+### Chores
+
+- Added the `refresh` project skill documenting the offline catalog refresh
+  (`npm run refresh` from `tests/fixtures/*.html`).
+- New test suites: provider transport, parity, upgrade-fallback, ZDR, and
+  deals coverage — all wired into `test:unit`.
+
 ## 1.2.2 - 2026-08-22
 
 Chore: catalog refresh to `command-code@1.32.1`.

package/dist/src/deals/catalog.js

@@ -13,6 +13,7 @@ export const MODEL_DEALS = {
     "claude-sonnet-4-6": { tier: "premium", benchmark: { "intelligence": 48.4 }, free: false, allowance: { "pro": 20 } },
     "claude-sonnet-5": { tier: "premium", benchmark: { "intelligence": 55.3, "tokPerSec": 81.9 }, free: false, allowance: { "pro": 20 } },
     "deepseek/deepseek-v4-flash": { tier: "opensource", benchmark: { "intelligence": 51.8, "tokPerSec": 114.6 }, peakOffPeak: { "peak": { "input": 0.44, "output": 1.32, "cacheRead": 0.014, "cacheWrite": 0 }, "offPeak": { "input": 0.22, "output": 0.66, "cacheRead": 0.007, "cacheWrite": 0 }, "windows": "01–04 & 06–10 UTC" }, free: false, allowance: { "goat": 60, "pro": 70 } },
+    "deepseek/deepseek-v4-flash-vision-exp": { tier: "opensource", peakOffPeak: { "peak": { "input": 0.44, "output": 1.32, "cacheRead": 0.02, "cacheWrite": 0 }, "offPeak": { "input": 0.22, "output": 0.66, "cacheRead": 0.01, "cacheWrite": 0 }, "windows": "01–04 & 06–10 UTC" }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "deepseek/deepseek-v4-pro": { tier: "opensource", benchmark: { "intelligence": 53.2, "tokPerSec": 75.3 }, peakOffPeak: { "peak": { "input": 1.32, "output": 3.96, "cacheRead": 0.044, "cacheWrite": 0 }, "offPeak": { "input": 0.66, "output": 1.98, "cacheRead": 0.022, "cacheWrite": 0 }, "windows": "01–04 & 06–10 UTC" }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "google/gemini-3.1-flash-lite": { tier: "premium", benchmark: { "intelligence": 25.6 }, free: false, allowance: { "pro": 20 } },
     "google/gemini-3.5-flash": { tier: "premium", benchmark: { "intelligence": 52 }, free: false, allowance: { "pro": 20 } },
@@ -47,6 +48,7 @@ export const MODEL_DEALS = {
     "Qwen/Qwen3.8-27B": { tier: "opensource", benchmark: { "intelligence": 52 }, free: false, allowance: { "goat": 70, "pro": 80 } },
     "Qwen/Qwen3.8-Max": { tier: "opensource", benchmark: { "intelligence": 58.1, "tokPerSec": 46.7 }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "sakana/fugu-ultra": { tier: "premium", free: false },
+    "stealth/ox-alpha": { tier: "opensource", free: true },
     "stepfun/Step-3.5-Flash": { tier: "opensource", benchmark: { "intelligence": 26.5 }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "stepfun/Step-3.7-Flash": { tier: "opensource", benchmark: { "intelligence": 30.9, "tokPerSec": 120.1 }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "tencent/hy3-paid": { tier: "opensource", benchmark: { "intelligence": 42.2, "tokPerSec": 74.8 }, free: false, allowance: { "goat": 70, "pro": 80 } },

package/dist/src/deals/plan-summary.d.ts

@@ -1,7 +1,39 @@
 import { z } from "zod";
 import { type ModelDeals, type PlanId, type PlanInfo } from "./catalog.js";
 export declare function normalizePlan(value: unknown): PlanId | undefined;
-export declare function resolvePlan(planArg: string | undefined, env?: NodeJS.ProcessEnv): Promise<PlanId>;
+/**
+ * Per-instance whoami cache. Passed by transport selection so the
+ * `GET /alpha/whoami` fetch happens at most once per model instance — even
+ * under concurrent first calls, because the cache holds the in-flight
+ * attempt; the Deals tool path resolves without a cache (fetch per call, as
+ * before).
+ */
+export interface PlanResolutionCache {
+    /** The whoami attempt (in flight or settled); its `plan` is the resolved
+     * plan or undefined when the fetch failed / no key was present. */
+    whoami?: Promise<{
+        plan: PlanId | undefined;
+    }>;
+}
+export interface ResolvePlanOptions {
+    /** Fallback when no override resolves and whoami yields nothing. Deals
+     * intelligence keeps the "go" default; transport selection passes
+     * "provider". */
+    defaultPlan?: PlanId;
+    /** Per-instance whoami cache (see PlanResolutionCache). */
+    cache?: PlanResolutionCache;
+    /** Resolved API key for the whoami GET (defaults to the
+     * COMMANDCODE_API_KEY env var); transport selection passes the model's
+     * resolved key. */
+    apiKey?: string;
+    /** Base URL for the whoami GET (defaults to getApiBase(env)); transport
+     * selection passes the model's baseURL option. */
+    baseURL?: string;
+    /** Fetch implementation for the whoami GET (defaults to the global fetch),
+     * so transport selection honours the same injected fetch as inference. */
+    fetch?: typeof fetch;
+}
+export declare function resolvePlan(planArg: string | undefined, env?: NodeJS.ProcessEnv, options?: ResolvePlanOptions): Promise<PlanId>;
 export declare function renderPlanSummary(plan: PlanId, deals?: Readonly<Record<string, ModelDeals>>, catalog?: Readonly<Record<PlanId, PlanInfo>>): string;
 export declare function planSummaryTool(): {
     description: string;

package/dist/src/deals/plan-summary.js

@@ -1,7 +1,9 @@
 // src/deals/plan-summary.ts — cmd_plan_summary tool: plan-aware allowance
 // breakdown. Plan resolution: tool arg → COMMANDCODE_PLAN → live /alpha/whoami
-// (when a key is present and the network works) → default "go". Rendering is a
-// pure function so tests never touch the network.
+// (when a key is present and the network works) → default. Deals intelligence
+// keeps the "go" default; transport selection reuses resolvePlan() with
+// { defaultPlan: "provider" } so only a resolved "go" picks the legacy
+// transport. Rendering is a pure function so tests never touch the network.
 import { z } from "zod";
 import { MODEL_COSTS } from "../catalog/facts.js";
 import { MODEL_DEALS, PLAN_CATALOG, } from "./catalog.js";
@@ -44,31 +46,45 @@ export function normalizePlan(value) {
         return undefined;
     return PLAN_ALIASES[value.toLowerCase()];
 }
-export async function resolvePlan(planArg, env = process.env) {
+export async function resolvePlan(planArg, env = process.env, options = {}) {
     const fromArg = normalizePlan(planArg);
     if (fromArg)
         return fromArg;
     const fromEnv = normalizePlan(env.COMMANDCODE_PLAN);
     if (fromEnv)
         return fromEnv;
-    if (env.COMMANDCODE_API_KEY) {
-        try {
-            const response = await fetch(`${getApiBase(env)}/alpha/whoami`, {
-                headers: { authorization: `Bearer ${env.COMMANDCODE_API_KEY}` },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                const body = (await response.json());
-                const plan = normalizePlan(body.planId ?? body.plan?.id);
-                if (plan)
-                    return plan;
+    const cache = options.cache;
+    const whoamiPlan = cache?.whoami
+        ? (await cache.whoami).plan
+        : (await fetchWhoamiPlan(env, cache, options)).plan;
+    return whoamiPlan ?? options.defaultPlan ?? "go";
+}
+async function fetchWhoamiPlan(env, cache, options) {
+    const key = options.apiKey ?? env.COMMANDCODE_API_KEY;
+    const base = options.baseURL ?? getApiBase(env);
+    const fetchImpl = options.fetch ?? fetch;
+    const attempt = (async () => {
+        let plan;
+        if (key) {
+            try {
+                const response = await fetchImpl(`${base}/alpha/whoami`, {
+                    headers: { authorization: `Bearer ${key}` },
+                    signal: AbortSignal.timeout(5000),
+                });
+                if (response.ok) {
+                    const body = (await response.json());
+                    plan = normalizePlan(body.planId ?? body.plan?.id);
+                }
+            }
+            catch {
+                // offline, timeout or unreachable — fall through to the default
             }
         }
-        catch {
-            // offline or unreachable — fall through to the default
-        }
-    }
-    return "go";
+        return { plan };
+    })();
+    if (cache)
+        cache.whoami = attempt;
+    return attempt;
 }
 const REQUEST_PROFILE = { input: 800, output: 200, cacheRead: 50_000 };
 export function renderPlanSummary(plan, deals = MODEL_DEALS, catalog = PLAN_CATALOG) {

package/dist/src/env.d.ts

@@ -1,2 +1,11 @@
 export declare const DEFAULT_API_BASE = "https://api.commandcode.ai";
 export declare function getApiBase(env?: NodeJS.ProcessEnv): string;
+/**
+ * Zero data retention (ZDR) opt-in, mirroring the CLI's `CMD_ZDR=1` (per the
+ * Provider API docs: "the same opt-in the CLI exposes via CMD_ZDR=1"). Only
+ * the exact value `1` opts in — unset, empty, `0`, or any other value leaves
+ * ZDR off, so no `x-cmd-zdr` header is ever sent unless the user explicitly
+ * asked for it. The legacy /alpha/generate transport never sends the header
+ * regardless of this value.
+ */
+export declare function getCmdZdr(env?: NodeJS.ProcessEnv): boolean;

package/dist/src/env.js

@@ -3,3 +3,14 @@ export const DEFAULT_API_BASE = "https://api.commandcode.ai";
 export function getApiBase(env = process.env) {
     return env.COMMANDCODE_API_BASE ?? DEFAULT_API_BASE;
 }
+/**
+ * Zero data retention (ZDR) opt-in, mirroring the CLI's `CMD_ZDR=1` (per the
+ * Provider API docs: "the same opt-in the CLI exposes via CMD_ZDR=1"). Only
+ * the exact value `1` opts in — unset, empty, `0`, or any other value leaves
+ * ZDR off, so no `x-cmd-zdr` header is ever sent unless the user explicitly
+ * asked for it. The legacy /alpha/generate transport never sends the header
+ * regardless of this value.
+ */
+export function getCmdZdr(env = process.env) {
+    return env.CMD_ZDR === "1";
+}

package/dist/src/provider/command-code-model.d.ts

@@ -10,6 +10,7 @@ export interface CommandCodeModelOptions {
     maxRetries?: number;
     maxRetryDelayMs?: number;
     authPaths?: readonly string[];
+    plan?: string;
 }
 export declare class CommandCodeLanguageModel implements LanguageModelV3 {
     private readonly options;
@@ -22,6 +23,34 @@ export declare class CommandCodeLanguageModel implements LanguageModelV3 {
     constructor(options: CommandCodeModelOptions, modelId: string);
     private apiBase;
     private costForModel;
+    /**
+     * Per-instance whoami cache: the `GET /alpha/whoami` fetch happens at most
+     * once for the lifetime of this model instance and is reused across turns.
+     */
+    private readonly planCache;
+    /**
+     * Safety-net flag (issue #56): once the Provider API answers a documented
+     * `403 upgrade_required`, the session is pinned to the legacy
+     * `/alpha/generate` transport for the lifetime of this model instance —
+     * subsequent turns stay on legacy without re-hitting the Provider API (no
+     * second 403). The Provider API has no path for Go-plan users (that is
+     * exactly what the 403 documents), so the plugin's legacy transport is the
+     * only way to keep serving a plan-detection miss that routed a true Go user
+     * there.
+     */
+    private pinnedToLegacy;
+    /**
+     * Resolves the transport plan through the shared plan-resolution seam:
+     * explicit override (providerOptions plan, model option `plan`) →
+     * COMMANDCODE_PLAN env → cached whoami → default Provider API. Only a
+     * resolved `go` selects the legacy transport; every other resolution
+     * selects the Provider API. The whoami fetch is cached for the lifetime of
+     * this instance (see planCache) and honours the same resolved key, base URL
+     * and injected fetch as inference.
+     */
+    private shouldUseProviderTransport;
+    private planArgFor;
+    private providerEndpoint;
     doGenerate(options: ModelCallOptions): Promise<LanguageModelV3GenerateResult>;
     doStream(options: ModelCallOptions): Promise<{
         stream: ReadableStream<LanguageModelV3StreamPart>;
@@ -35,5 +64,25 @@ export declare class CommandCodeLanguageModel implements LanguageModelV3 {
     private runOnce;
     private bodyFor;
     private headersFor;
+    private providerBodyFor;
+    private providerHeadersFor;
+    private providerRunStream;
     private runStream;
+    /**
+     * Deep internal seam: single SSE transport behind a small interface.
+     * All retry/timeout/abort/redaction/stream-parsing/cost/fallback logic
+     * lives here; callers supply only the endpoint URL, body, headers and
+     * the event→parts mapper. Depth gives leverage (N callers) and locality
+     * (fix once, fixed everywhere). The eventToParts adapter varies across
+     * the seam (CC vs OpenAI vs Anthropic) while the transport stays fixed.
+     *
+     * The optional legacyFallback implements the issue #56 safety net: when the
+     * Provider API answers a documented `403 upgrade_required` (Go plan, no API
+     * access), the session is pinned to the legacy `/alpha/generate` transport
+     * and the same call retries once there — the retry is bounded because only
+     * the provider descriptor carries flipOnUpgradeRequired. The pin is sticky
+     * for the lifetime of this model instance (no second Provider API hit on
+     * later turns).
+     */
+    private transportStream;
 }