opencode-cmd-provider 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 1.4.0 - 2026-08-23
+
+Feature: after a successful `/connect`, the credential is mirrored under
+`command-code` in OpenCode's auth store and to `~/.commandcode/auth.json`
+(official CLI layout), so ecosystem consumers such as OpenChamber's Usage
+page find the key without manual setup.
+
+### Features
+
+- **Credential mirroring** (issue #64): `/connect` now writes the credential
+  under `command-code` in OpenCode's auth store — refreshed on every
+  successful re-auth so the mirror stays in sync — and to
+  `~/.commandcode/auth.json` in the official CLI layout, which is only
+  written when it does not already hold a different credential, so an
+  official CLI login is never clobbered. Writes are atomic; new auth files
+  get owner-only permissions and existing file modes are preserved.
+- Mirroring is best-effort: failures are swallowed and never fail `/connect`
+  itself, and `mirror: false` opts out (used by the oauth tests). Users who
+  authenticate via `COMMANDCODE_API_KEY` alone are unaffected.
+- Existing users re-run `/connect` once (or copy the entry manually) to pick
+  the mirror up.
+
+### Chores
+
+- New `tests/auth-mirror.test.ts` suite: preserves unrelated auth-store
+  entries, owner-only permissions on create, stale-entry refresh on re-auth,
+  no-clobber of a differing CLI credential, idempotent no-op, blank-key
+  guard, and the end-to-end `/connect` flow including `mirror: false` —
+  wired into `test:unit`.
+- Docs: README notes the mirror locations and that mirroring is best-effort.
+
 ## 1.3.0 - 2026-08-23
 
 Feature: dual-transport Provider API — non-Go plans now use the documented

package/README.md

@@ -49,6 +49,8 @@ Select **Command Code**, complete the browser flow, and pick a model with `/mode
 
 Run `/connect` in OpenCode and select **Command Code**. The browser flow stores the returned credential in OpenCode's auth store.
 
+The credential is also mirrored under `command-code` in OpenCode's auth store and to `~/.commandcode/auth.json` (official CLI layout, only written when that file does not already hold a different credential). Ecosystem consumers such as OpenChamber's Usage page read those locations. Mirroring is best-effort; if it fails, `/connect` still succeeds.
+
 If automatic transfer from the browser fails, copy the API key shown by Command Code and export it as `COMMANDCODE_API_KEY` (see below).
 
 ### Environment variable

package/dist/src/plugin/auth-mirror.d.ts

@@ -0,0 +1,11 @@
+export interface MirrorOptions {
+    opencodeAuthFile?: string;
+    legacyAuthFile?: string;
+}
+export interface MirrorResult {
+    opencodeAuthUpdated: boolean;
+    legacyAuthUpdated: boolean;
+}
+export declare function defaultOpencodeAuthFile(): string;
+export declare function defaultLegacyAuthFile(): string;
+export declare function mirrorCredential(key: string, options?: MirrorOptions): MirrorResult;

package/dist/src/plugin/auth-mirror.js

@@ -0,0 +1,74 @@
+// src/plugin/auth-mirror.ts — mirror /connect credentials for ecosystem consumers
+//
+// OpenChamber's command-code quota provider reads the API key from OpenCode's
+// auth store under the key "command-code" (the provider id its own archived
+// plugin used). OpenCode stores this plugin's credential under "commandcode",
+// so after a successful /connect we mirror it under "command-code" as well.
+// We also mirror to ~/.commandcode/auth.json in the official CLI layout,
+// which resolveApiKey already reads as a legacy fallback.
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+function dataHome() {
+    return process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share");
+}
+export function defaultOpencodeAuthFile() {
+    return join(dataHome(), "opencode", "auth.json");
+}
+export function defaultLegacyAuthFile() {
+    return join(homedir(), ".commandcode", "auth.json");
+}
+function readJsonObject(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Missing or malformed file: start from an empty document.
+    }
+    return {};
+}
+function writeJsonAtomic(path, value) {
+    const dir = join(path, "..");
+    mkdirSync(dir, { recursive: true });
+    const existingMode = existsSync(path) ? statSync(path).mode & 0o777 : 0o600;
+    const tmp = join(dir, `.${basename(path)}.${process.pid}.tmp`);
+    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: existingMode });
+    renameSync(tmp, path);
+}
+function isCredentialRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+// OpenCode's auth store is owned by this plugin's ecosystem entry point, so a
+// stale mirror there is refreshed on every successful /connect. The legacy
+// file belongs to the official Command Code CLI; if it already holds a
+// different credential we leave it alone rather than clobber another tool's
+// login.
+export function mirrorCredential(key, options = {}) {
+    const trimmed = key.trim();
+    if (!trimmed)
+        return { opencodeAuthUpdated: false, legacyAuthUpdated: false };
+    const entry = { type: "api", key: trimmed };
+    const opencodeAuthFile = options.opencodeAuthFile ?? defaultOpencodeAuthFile();
+    const opencodeDoc = readJsonObject(opencodeAuthFile);
+    const currentOpencode = opencodeDoc["command-code"];
+    let opencodeAuthUpdated = false;
+    if (!isCredentialRecord(currentOpencode) ||
+        currentOpencode.type !== "api" ||
+        currentOpencode.key !== trimmed) {
+        opencodeDoc["command-code"] = entry;
+        writeJsonAtomic(opencodeAuthFile, opencodeDoc);
+        opencodeAuthUpdated = true;
+    }
+    const legacyAuthFile = options.legacyAuthFile ?? defaultLegacyAuthFile();
+    const legacyDoc = readJsonObject(legacyAuthFile);
+    let legacyAuthUpdated = false;
+    if (!isCredentialRecord(legacyDoc["command-code"])) {
+        legacyDoc["command-code"] = entry;
+        writeJsonAtomic(legacyAuthFile, legacyDoc);
+        legacyAuthUpdated = true;
+    }
+    return { opencodeAuthUpdated, legacyAuthUpdated };
+}

package/dist/src/plugin/auth.d.ts

@@ -1,6 +1,9 @@
+import { type MirrorOptions } from "./auth-mirror.js";
 import type { AuthOAuthResult } from "@opencode-ai/plugin";
 export interface RunAuthFlowOptions {
     startPort?: number;
     timeoutMs?: number;
+    /** Credential mirroring targets; pass `false` to disable mirroring. */
+    mirror?: MirrorOptions | false;
 }
 export declare function runAuthFlow(options?: RunAuthFlowOptions): Promise<AuthOAuthResult>;

package/dist/src/plugin/auth.js

@@ -3,8 +3,12 @@
 // Wraps the local callback server in the opencode AuthOAuthResult shape:
 // the studio URL is opened in the browser, the studio POSTs the API key to
 // the local /callback endpoint, and callback() resolves with the key.
+// On success the credential is also mirrored under "command-code" (see
+// auth-mirror.ts) so ecosystem consumers such as OpenChamber's quota
+// provider can find it.
 import { randomBytes } from "node:crypto";
 import { startAuthServer } from "./auth-server.js";
+import { mirrorCredential } from "./auth-mirror.js";
 const STUDIO_BASE_URL = "https://commandcode.ai";
 const DEFAULT_AUTH_TIMEOUT_MS = 15_000;
 function generateStateToken() {
@@ -27,6 +31,14 @@ export async function runAuthFlow(options = {}) {
                 authServer.server.close();
                 if (callback.state !== stateToken)
                     return { type: "failed" };
+                if (options.mirror !== false) {
+                    try {
+                        mirrorCredential(callback.apiKey, options.mirror ?? {});
+                    }
+                    catch {
+                        // Mirroring is best-effort; it must never fail the login itself.
+                    }
+                }
                 return { type: "success", key: callback.apiKey };
             }
             catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-cmd-provider",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Command Code provider + plugin for opencode",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,7 +22,7 @@
     "refresh:deals": "node scripts/refresh-deals.mjs",
     "refresh": "npm run refresh:snapshot && npm run refresh:deals -- --fixtures",
     "test": "npm run typecheck && npm run test:unit && npm run test:integration && npm run test:contract && npm run format:check",
-    "test:unit": "tsx tests/env.test.ts && tsx tests/auth-key.test.ts && tsx tests/converters.test.ts && tsx tests/stream.test.ts && tsx tests/provider-codecs.test.ts && tsx tests/provider-transport.test.ts && tsx tests/provider-parity.test.ts && tsx tests/provider-upgrade-fallback.test.ts && tsx tests/provider-zdr.test.ts && tsx tests/redact.test.ts && tsx tests/cost.test.ts && tsx tests/retry.test.ts && tsx tests/reasoning.test.ts && tsx tests/modalities.test.ts && tsx tests/snapshot.test.ts && tsx tests/refresh-snapshot.test.ts && tsx tests/oauth.test.ts && tsx tests/parse-facts.test.ts && tsx tests/parse-modalities.test.ts && tsx tests/catalog-metadata.test.ts && tsx tests/plugin-models.test.ts && tsx tests/vendor.test.ts && tsx tests/deals-enrichment.test.ts && tsx tests/deals-coverage.test.ts && tsx tests/plan-summary.test.ts && tsx tests/html-tables.test.ts && tsx tests/parse-docs.test.ts && tsx tests/refresh-deals.test.ts && tsx tests/tui-deals-panel.test.ts && tsx tests/plugin-install.test.ts",
+    "test:unit": "tsx tests/env.test.ts && tsx tests/auth-key.test.ts && tsx tests/converters.test.ts && tsx tests/stream.test.ts && tsx tests/provider-codecs.test.ts && tsx tests/provider-transport.test.ts && tsx tests/provider-parity.test.ts && tsx tests/provider-upgrade-fallback.test.ts && tsx tests/provider-zdr.test.ts && tsx tests/redact.test.ts && tsx tests/cost.test.ts && tsx tests/retry.test.ts && tsx tests/reasoning.test.ts && tsx tests/modalities.test.ts && tsx tests/snapshot.test.ts && tsx tests/refresh-snapshot.test.ts && tsx tests/oauth.test.ts && tsx tests/auth-mirror.test.ts && tsx tests/parse-facts.test.ts && tsx tests/parse-modalities.test.ts && tsx tests/catalog-metadata.test.ts && tsx tests/plugin-models.test.ts && tsx tests/vendor.test.ts && tsx tests/deals-enrichment.test.ts && tsx tests/deals-coverage.test.ts && tsx tests/plan-summary.test.ts && tsx tests/html-tables.test.ts && tsx tests/parse-docs.test.ts && tsx tests/refresh-deals.test.ts && tsx tests/tui-deals-panel.test.ts && tsx tests/plugin-install.test.ts",
     "test:integration": "tsx tests/integration-do-stream.test.ts && tsx tests/integration-do-generate.test.ts",
     "test:contract": "tsx tests/contract.test.ts",
     "test:e2e": "node tests/e2e-opencode.mjs",