opencode-cmd-provider 1.2.2 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 1.4.0 - 2026-08-23
+
+Feature: after a successful `/connect`, the credential is mirrored under
+`command-code` in OpenCode's auth store and to `~/.commandcode/auth.json`
+(official CLI layout), so ecosystem consumers such as OpenChamber's Usage
+page find the key without manual setup.
+
+### Features
+
+- **Credential mirroring** (issue #64): `/connect` now writes the credential
+  under `command-code` in OpenCode's auth store — refreshed on every
+  successful re-auth so the mirror stays in sync — and to
+  `~/.commandcode/auth.json` in the official CLI layout, which is only
+  written when it does not already hold a different credential, so an
+  official CLI login is never clobbered. Writes are atomic; new auth files
+  get owner-only permissions and existing file modes are preserved.
+- Mirroring is best-effort: failures are swallowed and never fail `/connect`
+  itself, and `mirror: false` opts out (used by the oauth tests). Users who
+  authenticate via `COMMANDCODE_API_KEY` alone are unaffected.
+- Existing users re-run `/connect` once (or copy the entry manually) to pick
+  the mirror up.
+
+### Chores
+
+- New `tests/auth-mirror.test.ts` suite: preserves unrelated auth-store
+  entries, owner-only permissions on create, stale-entry refresh on re-auth,
+  no-clobber of a differing CLI credential, idempotent no-op, blank-key
+  guard, and the end-to-end `/connect` flow including `mirror: false` —
+  wired into `test:unit`.
+- Docs: README notes the mirror locations and that mirroring is best-effort.
+
+## 1.3.0 - 2026-08-23
+
+Feature: dual-transport Provider API — non-Go plans now use the documented
+`/provider/v1/*` endpoints with self-healing fallback to the legacy transport.
+
+### Features
+
+- **Provider API routing** (issues #51, #53): non-Go plans (goat, pro, max,
+  max20, teampro, provider aliases) route through the documented Provider API —
+  `claude-*` models to `POST /provider/v1/messages` (Anthropic shape), everything
+  else to `POST /provider/v1/chat/completions` (OpenAI shape) — with retry,
+  timeout, abort, and redaction parity with the legacy transport. Go /
+  individual-go sessions stay byte-for-byte on the legacy `POST /alpha/generate`
+  wire format, proven by golden byte-parity tests.
+- **Session-cached plan resolution** (issue #54): transport is chosen per model
+  instance from the shared plan-resolution seam — explicit override →
+  `COMMANDCODE_PLAN` env → cached `GET /alpha/whoami` → default Provider API.
+  Only a resolved `go` selects the legacy transport; next session after a plan
+  upgrade auto-switches.
+- **Self-healing upgrade flip** (issue #56): if a plan-detection miss sends a
+  true Go user to the Provider API, a documented `403 upgrade_required` pins the
+  session to the legacy transport and retries the same call once there — no
+  second Provider API hit, no double-counted usage.
+- **ZDR passthrough** (issue #57): `CMD_ZDR=1` sends `x-cmd-zdr: 1` on every
+  Provider API request; the documented `422 cmd_zdr_no_providers` flows through
+  the existing error/redaction pipeline. The legacy transport never sends it.
+- **Transport hardening** (issue #58): the finish part now waits for a trailing
+  OpenAI usage-only chunk so cost reflects real token counts; non-image file
+  parts are rejected with a clear role-aware error instead of silently
+  base64-encoding; stateful SSE parsers complete tool calls whose arguments
+  arrive across multiple events.
+
+### Fixes
+
+- Restored the "Command Code" TUI sidebar section for Ox Alpha and DeepSeek V4
+  Flash Vision (exp): the deals-coverage gate now fails loudly when scraped
+  records lack a snapshot model, and the fixtures were refreshed to cover every
+  model (issue #61).
+
+### Chores
+
+- Added the `refresh` project skill documenting the offline catalog refresh
+  (`npm run refresh` from `tests/fixtures/*.html`).
+- New test suites: provider transport, parity, upgrade-fallback, ZDR, and
+  deals coverage — all wired into `test:unit`.
+
 ## 1.2.2 - 2026-08-22
 
 Chore: catalog refresh to `command-code@1.32.1`.

package/README.md

@@ -49,6 +49,8 @@ Select **Command Code**, complete the browser flow, and pick a model with `/mode
 
 Run `/connect` in OpenCode and select **Command Code**. The browser flow stores the returned credential in OpenCode's auth store.
 
+The credential is also mirrored under `command-code` in OpenCode's auth store and to `~/.commandcode/auth.json` (official CLI layout, only written when that file does not already hold a different credential). Ecosystem consumers such as OpenChamber's Usage page read those locations. Mirroring is best-effort; if it fails, `/connect` still succeeds.
+
 If automatic transfer from the browser fails, copy the API key shown by Command Code and export it as `COMMANDCODE_API_KEY` (see below).
 
 ### Environment variable

package/dist/src/deals/catalog.js

@@ -13,6 +13,7 @@ export const MODEL_DEALS = {
     "claude-sonnet-4-6": { tier: "premium", benchmark: { "intelligence": 48.4 }, free: false, allowance: { "pro": 20 } },
     "claude-sonnet-5": { tier: "premium", benchmark: { "intelligence": 55.3, "tokPerSec": 81.9 }, free: false, allowance: { "pro": 20 } },
     "deepseek/deepseek-v4-flash": { tier: "opensource", benchmark: { "intelligence": 51.8, "tokPerSec": 114.6 }, peakOffPeak: { "peak": { "input": 0.44, "output": 1.32, "cacheRead": 0.014, "cacheWrite": 0 }, "offPeak": { "input": 0.22, "output": 0.66, "cacheRead": 0.007, "cacheWrite": 0 }, "windows": "01–04 & 06–10 UTC" }, free: false, allowance: { "goat": 60, "pro": 70 } },
+    "deepseek/deepseek-v4-flash-vision-exp": { tier: "opensource", peakOffPeak: { "peak": { "input": 0.44, "output": 1.32, "cacheRead": 0.02, "cacheWrite": 0 }, "offPeak": { "input": 0.22, "output": 0.66, "cacheRead": 0.01, "cacheWrite": 0 }, "windows": "01–04 & 06–10 UTC" }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "deepseek/deepseek-v4-pro": { tier: "opensource", benchmark: { "intelligence": 53.2, "tokPerSec": 75.3 }, peakOffPeak: { "peak": { "input": 1.32, "output": 3.96, "cacheRead": 0.044, "cacheWrite": 0 }, "offPeak": { "input": 0.66, "output": 1.98, "cacheRead": 0.022, "cacheWrite": 0 }, "windows": "01–04 & 06–10 UTC" }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "google/gemini-3.1-flash-lite": { tier: "premium", benchmark: { "intelligence": 25.6 }, free: false, allowance: { "pro": 20 } },
     "google/gemini-3.5-flash": { tier: "premium", benchmark: { "intelligence": 52 }, free: false, allowance: { "pro": 20 } },
@@ -47,6 +48,7 @@ export const MODEL_DEALS = {
     "Qwen/Qwen3.8-27B": { tier: "opensource", benchmark: { "intelligence": 52 }, free: false, allowance: { "goat": 70, "pro": 80 } },
     "Qwen/Qwen3.8-Max": { tier: "opensource", benchmark: { "intelligence": 58.1, "tokPerSec": 46.7 }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "sakana/fugu-ultra": { tier: "premium", free: false },
+    "stealth/ox-alpha": { tier: "opensource", free: true },
     "stepfun/Step-3.5-Flash": { tier: "opensource", benchmark: { "intelligence": 26.5 }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "stepfun/Step-3.7-Flash": { tier: "opensource", benchmark: { "intelligence": 30.9, "tokPerSec": 120.1 }, free: false, allowance: { "goat": 20, "pro": 30 } },
     "tencent/hy3-paid": { tier: "opensource", benchmark: { "intelligence": 42.2, "tokPerSec": 74.8 }, free: false, allowance: { "goat": 70, "pro": 80 } },

package/dist/src/deals/plan-summary.d.ts

@@ -1,7 +1,39 @@
 import { z } from "zod";
 import { type ModelDeals, type PlanId, type PlanInfo } from "./catalog.js";
 export declare function normalizePlan(value: unknown): PlanId | undefined;
-export declare function resolvePlan(planArg: string | undefined, env?: NodeJS.ProcessEnv): Promise<PlanId>;
+/**
+ * Per-instance whoami cache. Passed by transport selection so the
+ * `GET /alpha/whoami` fetch happens at most once per model instance — even
+ * under concurrent first calls, because the cache holds the in-flight
+ * attempt; the Deals tool path resolves without a cache (fetch per call, as
+ * before).
+ */
+export interface PlanResolutionCache {
+    /** The whoami attempt (in flight or settled); its `plan` is the resolved
+     * plan or undefined when the fetch failed / no key was present. */
+    whoami?: Promise<{
+        plan: PlanId | undefined;
+    }>;
+}
+export interface ResolvePlanOptions {
+    /** Fallback when no override resolves and whoami yields nothing. Deals
+     * intelligence keeps the "go" default; transport selection passes
+     * "provider". */
+    defaultPlan?: PlanId;
+    /** Per-instance whoami cache (see PlanResolutionCache). */
+    cache?: PlanResolutionCache;
+    /** Resolved API key for the whoami GET (defaults to the
+     * COMMANDCODE_API_KEY env var); transport selection passes the model's
+     * resolved key. */
+    apiKey?: string;
+    /** Base URL for the whoami GET (defaults to getApiBase(env)); transport
+     * selection passes the model's baseURL option. */
+    baseURL?: string;
+    /** Fetch implementation for the whoami GET (defaults to the global fetch),
+     * so transport selection honours the same injected fetch as inference. */
+    fetch?: typeof fetch;
+}
+export declare function resolvePlan(planArg: string | undefined, env?: NodeJS.ProcessEnv, options?: ResolvePlanOptions): Promise<PlanId>;
 export declare function renderPlanSummary(plan: PlanId, deals?: Readonly<Record<string, ModelDeals>>, catalog?: Readonly<Record<PlanId, PlanInfo>>): string;
 export declare function planSummaryTool(): {
     description: string;

package/dist/src/deals/plan-summary.js

@@ -1,7 +1,9 @@
 // src/deals/plan-summary.ts — cmd_plan_summary tool: plan-aware allowance
 // breakdown. Plan resolution: tool arg → COMMANDCODE_PLAN → live /alpha/whoami
-// (when a key is present and the network works) → default "go". Rendering is a
-// pure function so tests never touch the network.
+// (when a key is present and the network works) → default. Deals intelligence
+// keeps the "go" default; transport selection reuses resolvePlan() with
+// { defaultPlan: "provider" } so only a resolved "go" picks the legacy
+// transport. Rendering is a pure function so tests never touch the network.
 import { z } from "zod";
 import { MODEL_COSTS } from "../catalog/facts.js";
 import { MODEL_DEALS, PLAN_CATALOG, } from "./catalog.js";
@@ -44,31 +46,45 @@ export function normalizePlan(value) {
         return undefined;
     return PLAN_ALIASES[value.toLowerCase()];
 }
-export async function resolvePlan(planArg, env = process.env) {
+export async function resolvePlan(planArg, env = process.env, options = {}) {
     const fromArg = normalizePlan(planArg);
     if (fromArg)
         return fromArg;
     const fromEnv = normalizePlan(env.COMMANDCODE_PLAN);
     if (fromEnv)
         return fromEnv;
-    if (env.COMMANDCODE_API_KEY) {
-        try {
-            const response = await fetch(`${getApiBase(env)}/alpha/whoami`, {
-                headers: { authorization: `Bearer ${env.COMMANDCODE_API_KEY}` },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                const body = (await response.json());
-                const plan = normalizePlan(body.planId ?? body.plan?.id);
-                if (plan)
-                    return plan;
+    const cache = options.cache;
+    const whoamiPlan = cache?.whoami
+        ? (await cache.whoami).plan
+        : (await fetchWhoamiPlan(env, cache, options)).plan;
+    return whoamiPlan ?? options.defaultPlan ?? "go";
+}
+async function fetchWhoamiPlan(env, cache, options) {
+    const key = options.apiKey ?? env.COMMANDCODE_API_KEY;
+    const base = options.baseURL ?? getApiBase(env);
+    const fetchImpl = options.fetch ?? fetch;
+    const attempt = (async () => {
+        let plan;
+        if (key) {
+            try {
+                const response = await fetchImpl(`${base}/alpha/whoami`, {
+                    headers: { authorization: `Bearer ${key}` },
+                    signal: AbortSignal.timeout(5000),
+                });
+                if (response.ok) {
+                    const body = (await response.json());
+                    plan = normalizePlan(body.planId ?? body.plan?.id);
+                }
+            }
+            catch {
+                // offline, timeout or unreachable — fall through to the default
             }
         }
-        catch {
-            // offline or unreachable — fall through to the default
-        }
-    }
-    return "go";
+        return { plan };
+    })();
+    if (cache)
+        cache.whoami = attempt;
+    return attempt;
 }
 const REQUEST_PROFILE = { input: 800, output: 200, cacheRead: 50_000 };
 export function renderPlanSummary(plan, deals = MODEL_DEALS, catalog = PLAN_CATALOG) {

package/dist/src/env.d.ts

@@ -1,2 +1,11 @@
 export declare const DEFAULT_API_BASE = "https://api.commandcode.ai";
 export declare function getApiBase(env?: NodeJS.ProcessEnv): string;
+/**
+ * Zero data retention (ZDR) opt-in, mirroring the CLI's `CMD_ZDR=1` (per the
+ * Provider API docs: "the same opt-in the CLI exposes via CMD_ZDR=1"). Only
+ * the exact value `1` opts in — unset, empty, `0`, or any other value leaves
+ * ZDR off, so no `x-cmd-zdr` header is ever sent unless the user explicitly
+ * asked for it. The legacy /alpha/generate transport never sends the header
+ * regardless of this value.
+ */
+export declare function getCmdZdr(env?: NodeJS.ProcessEnv): boolean;

package/dist/src/env.js

@@ -3,3 +3,14 @@ export const DEFAULT_API_BASE = "https://api.commandcode.ai";
 export function getApiBase(env = process.env) {
     return env.COMMANDCODE_API_BASE ?? DEFAULT_API_BASE;
 }
+/**
+ * Zero data retention (ZDR) opt-in, mirroring the CLI's `CMD_ZDR=1` (per the
+ * Provider API docs: "the same opt-in the CLI exposes via CMD_ZDR=1"). Only
+ * the exact value `1` opts in — unset, empty, `0`, or any other value leaves
+ * ZDR off, so no `x-cmd-zdr` header is ever sent unless the user explicitly
+ * asked for it. The legacy /alpha/generate transport never sends the header
+ * regardless of this value.
+ */
+export function getCmdZdr(env = process.env) {
+    return env.CMD_ZDR === "1";
+}

package/dist/src/plugin/auth-mirror.d.ts

@@ -0,0 +1,11 @@
+export interface MirrorOptions {
+    opencodeAuthFile?: string;
+    legacyAuthFile?: string;
+}
+export interface MirrorResult {
+    opencodeAuthUpdated: boolean;
+    legacyAuthUpdated: boolean;
+}
+export declare function defaultOpencodeAuthFile(): string;
+export declare function defaultLegacyAuthFile(): string;
+export declare function mirrorCredential(key: string, options?: MirrorOptions): MirrorResult;

package/dist/src/plugin/auth-mirror.js

@@ -0,0 +1,74 @@
+// src/plugin/auth-mirror.ts — mirror /connect credentials for ecosystem consumers
+//
+// OpenChamber's command-code quota provider reads the API key from OpenCode's
+// auth store under the key "command-code" (the provider id its own archived
+// plugin used). OpenCode stores this plugin's credential under "commandcode",
+// so after a successful /connect we mirror it under "command-code" as well.
+// We also mirror to ~/.commandcode/auth.json in the official CLI layout,
+// which resolveApiKey already reads as a legacy fallback.
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+function dataHome() {
+    return process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share");
+}
+export function defaultOpencodeAuthFile() {
+    return join(dataHome(), "opencode", "auth.json");
+}
+export function defaultLegacyAuthFile() {
+    return join(homedir(), ".commandcode", "auth.json");
+}
+function readJsonObject(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Missing or malformed file: start from an empty document.
+    }
+    return {};
+}
+function writeJsonAtomic(path, value) {
+    const dir = join(path, "..");
+    mkdirSync(dir, { recursive: true });
+    const existingMode = existsSync(path) ? statSync(path).mode & 0o777 : 0o600;
+    const tmp = join(dir, `.${basename(path)}.${process.pid}.tmp`);
+    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: existingMode });
+    renameSync(tmp, path);
+}
+function isCredentialRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+// OpenCode's auth store is owned by this plugin's ecosystem entry point, so a
+// stale mirror there is refreshed on every successful /connect. The legacy
+// file belongs to the official Command Code CLI; if it already holds a
+// different credential we leave it alone rather than clobber another tool's
+// login.
+export function mirrorCredential(key, options = {}) {
+    const trimmed = key.trim();
+    if (!trimmed)
+        return { opencodeAuthUpdated: false, legacyAuthUpdated: false };
+    const entry = { type: "api", key: trimmed };
+    const opencodeAuthFile = options.opencodeAuthFile ?? defaultOpencodeAuthFile();
+    const opencodeDoc = readJsonObject(opencodeAuthFile);
+    const currentOpencode = opencodeDoc["command-code"];
+    let opencodeAuthUpdated = false;
+    if (!isCredentialRecord(currentOpencode) ||
+        currentOpencode.type !== "api" ||
+        currentOpencode.key !== trimmed) {
+        opencodeDoc["command-code"] = entry;
+        writeJsonAtomic(opencodeAuthFile, opencodeDoc);
+        opencodeAuthUpdated = true;
+    }
+    const legacyAuthFile = options.legacyAuthFile ?? defaultLegacyAuthFile();
+    const legacyDoc = readJsonObject(legacyAuthFile);
+    let legacyAuthUpdated = false;
+    if (!isCredentialRecord(legacyDoc["command-code"])) {
+        legacyDoc["command-code"] = entry;
+        writeJsonAtomic(legacyAuthFile, legacyDoc);
+        legacyAuthUpdated = true;
+    }
+    return { opencodeAuthUpdated, legacyAuthUpdated };
+}

package/dist/src/plugin/auth.d.ts

@@ -1,6 +1,9 @@
+import { type MirrorOptions } from "./auth-mirror.js";
 import type { AuthOAuthResult } from "@opencode-ai/plugin";
 export interface RunAuthFlowOptions {
     startPort?: number;
     timeoutMs?: number;
+    /** Credential mirroring targets; pass `false` to disable mirroring. */
+    mirror?: MirrorOptions | false;
 }
 export declare function runAuthFlow(options?: RunAuthFlowOptions): Promise<AuthOAuthResult>;

package/dist/src/plugin/auth.js

@@ -3,8 +3,12 @@
 // Wraps the local callback server in the opencode AuthOAuthResult shape:
 // the studio URL is opened in the browser, the studio POSTs the API key to
 // the local /callback endpoint, and callback() resolves with the key.
+// On success the credential is also mirrored under "command-code" (see
+// auth-mirror.ts) so ecosystem consumers such as OpenChamber's quota
+// provider can find it.
 import { randomBytes } from "node:crypto";
 import { startAuthServer } from "./auth-server.js";
+import { mirrorCredential } from "./auth-mirror.js";
 const STUDIO_BASE_URL = "https://commandcode.ai";
 const DEFAULT_AUTH_TIMEOUT_MS = 15_000;
 function generateStateToken() {
@@ -27,6 +31,14 @@ export async function runAuthFlow(options = {}) {
                 authServer.server.close();
                 if (callback.state !== stateToken)
                     return { type: "failed" };
+                if (options.mirror !== false) {
+                    try {
+                        mirrorCredential(callback.apiKey, options.mirror ?? {});
+                    }
+                    catch {
+                        // Mirroring is best-effort; it must never fail the login itself.
+                    }
+                }
                 return { type: "success", key: callback.apiKey };
             }
             catch {

package/dist/src/provider/command-code-model.d.ts

@@ -10,6 +10,7 @@ export interface CommandCodeModelOptions {
     maxRetries?: number;
     maxRetryDelayMs?: number;
     authPaths?: readonly string[];
+    plan?: string;
 }
 export declare class CommandCodeLanguageModel implements LanguageModelV3 {
     private readonly options;
@@ -22,6 +23,34 @@ export declare class CommandCodeLanguageModel implements LanguageModelV3 {
     constructor(options: CommandCodeModelOptions, modelId: string);
     private apiBase;
     private costForModel;
+    /**
+     * Per-instance whoami cache: the `GET /alpha/whoami` fetch happens at most
+     * once for the lifetime of this model instance and is reused across turns.
+     */
+    private readonly planCache;
+    /**
+     * Safety-net flag (issue #56): once the Provider API answers a documented
+     * `403 upgrade_required`, the session is pinned to the legacy
+     * `/alpha/generate` transport for the lifetime of this model instance —
+     * subsequent turns stay on legacy without re-hitting the Provider API (no
+     * second 403). The Provider API has no path for Go-plan users (that is
+     * exactly what the 403 documents), so the plugin's legacy transport is the
+     * only way to keep serving a plan-detection miss that routed a true Go user
+     * there.
+     */
+    private pinnedToLegacy;
+    /**
+     * Resolves the transport plan through the shared plan-resolution seam:
+     * explicit override (providerOptions plan, model option `plan`) →
+     * COMMANDCODE_PLAN env → cached whoami → default Provider API. Only a
+     * resolved `go` selects the legacy transport; every other resolution
+     * selects the Provider API. The whoami fetch is cached for the lifetime of
+     * this instance (see planCache) and honours the same resolved key, base URL
+     * and injected fetch as inference.
+     */
+    private shouldUseProviderTransport;
+    private planArgFor;
+    private providerEndpoint;
     doGenerate(options: ModelCallOptions): Promise<LanguageModelV3GenerateResult>;
     doStream(options: ModelCallOptions): Promise<{
         stream: ReadableStream<LanguageModelV3StreamPart>;
@@ -35,5 +64,25 @@ export declare class CommandCodeLanguageModel implements LanguageModelV3 {
     private runOnce;
     private bodyFor;
     private headersFor;
+    private providerBodyFor;
+    private providerHeadersFor;
+    private providerRunStream;
     private runStream;
+    /**
+     * Deep internal seam: single SSE transport behind a small interface.
+     * All retry/timeout/abort/redaction/stream-parsing/cost/fallback logic
+     * lives here; callers supply only the endpoint URL, body, headers and
+     * the event→parts mapper. Depth gives leverage (N callers) and locality
+     * (fix once, fixed everywhere). The eventToParts adapter varies across
+     * the seam (CC vs OpenAI vs Anthropic) while the transport stays fixed.
+     *
+     * The optional legacyFallback implements the issue #56 safety net: when the
+     * Provider API answers a documented `403 upgrade_required` (Go plan, no API
+     * access), the session is pinned to the legacy `/alpha/generate` transport
+     * and the same call retries once there — the retry is bounded because only
+     * the provider descriptor carries flipOnUpgradeRequired. The pin is sticky
+     * for the lifetime of this model instance (no second Provider API hit on
+     * later turns).
+     */
+    private transportStream;
 }