opencode-ext-connector 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+## 0.3.0 - 2026-09-05
+
+- Publish releases to npm from GitHub Actions when a `v*` tag is pushed; the
+  tag must match `package.json`
+- Claude and Command Code no longer require their vendor CLI where OpenCode
+  runs: the client version comes from `ANTHROPIC_CLI_VERSION` /
+  `COMMAND_CODE_CLI_VERSION`, an installed binary, or the latest version
+  published on the npm registry; nothing is pinned in the package
+- The Claude auth loader now takes over the `anthropic` provider whenever
+  credentials exist instead of silently yielding when `claude` is missing
+- Added `credentialRefresh: { mode: "auto" | "never", leadMs }` so one machine
+  can own Claude token refresh while copies of the credential file stay
+  read-only and re-read the file after a 401
+
+## 0.2.0 - 2026-09-04
+
+- Added Ollama as a fourth provider using the local daemon and existing
+  `ollama signin` Cloud subscription session
+- Added automatic Cloud-only online catalog refresh, pulled-local model
+  discovery, local-first deduplication, and pull-on-first-use for Cloud tags
+- Added `ollamaAuthServer` and the `opencode-ext-connector/ollama` SDK export
+- **Breaking:** Removed the `opencode-ext-connector/server` package subpath;
+  import the named plugin functions from `opencode-ext-connector` instead
+- Documented the direct `dist/index.js` plugin URL required for all named auth
+  hooks
+- Cursor direct generation now uses a plugin-owned private Node >=22 child over
+  stdio and Cursor's unpublished AgentService Connect+protobuf/HTTP/2 protocol;
+  there is no plugin listening daemon and no `cursor-agent` generation fallback
+
+## 0.1.0 - 2026-08-20
+
+- OpenCode plugin exposing Claude, Cursor, and Command Code from existing CLI logins
+- Live model catalogs (Anthropic `/v1/models`, `cursor-agent models`, Command Code `/provider/v1/models`)
+- Claude OAuth refresh. Optional writeback (`writeBackCredentials: true`) to Claude files, macOS Keychain, and OpenCode `auth.json`
+- Cursor process pool, tool-call stream parts, `--resume`, `--list-models` fallback
+- Command Code `/alpha/generate` CLI fingerprint request and NDJSON tool/text stream
+- Catalog reload interval and process-exit dispose

package/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, kernalix7
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,207 @@
+<div align="center">
+
+# OpenCode External Provider Connector
+
+**One OpenCode plugin configuration for Claude, Cursor, Command Code, and Ollama — using existing vendor sessions and the local Ollama daemon. No new OAuth.**
+
+<p>
+  <img src="https://img.shields.io/badge/Bun-%3E%3D1.3.14-000000?style=for-the-badge" alt="Bun >=1.3.14" />
+  <img src="https://img.shields.io/badge/TypeScript-6.0.2-3178C6?style=for-the-badge" alt="TypeScript 6.0.2" />
+  <img src="https://img.shields.io/badge/OpenCode-E2E_tested-111111?style=for-the-badge" alt="OpenCode E2E tested" />
+  <img src="https://img.shields.io/badge/License-BSD--3--Clause-blue?style=for-the-badge" alt="BSD-3-Clause" />
+</p>
+
+**English** · [한국어](docs/README.ko.md) · [Documentation](#documentation)
+
+[Status](#status) · [Requirements](#requirements) · [Quick Install](#quick-install) · [Configuration](#configuration) · [First-Time Connection](#first-time-connection) · [Providers](#providers) · [Troubleshooting](#troubleshooting) · [Documentation](#documentation) · [Testing](#testing) · [License and Disclaimer](#license-and-disclaimer)
+
+</div>
+
+## Status
+
+> Independent unofficial community plugin, version **0.3.0**. Package E2E tests exercise the legacy multi-function loader with the OpenCode CLI installed in CI. `@opencode-ai/plugin@1.18.18` is the compile-time plugin API target, not a runtime pin. Source is BSD-3-Clause. This project is not affiliated with, endorsed by, sponsored by, or authorized by OpenCode or any provider. Full terms are in [License and Disclaimer](#license-and-disclaimer).
+
+Reuse the Claude, Cursor, Command Code, and Ollama sessions you already have. One `opencode.json` plugin entry publishes live catalogs into OpenCode. Claude and Cursor stay disconnected until OpenCode has a marker or OAuth record and the vendor session is present. Command Code may use an OpenCode-stored direct API key or an existing CLI session/key. Ollama requires the exact session marker plus a responsive localhost daemon.
+
+## Requirements
+
+| Need | Detail |
+| --- | --- |
+| [Bun](https://bun.sh) | 1.3.14 or later |
+| Node.js | 22 or later, for Cursor direct generation only |
+| OpenCode | Runtime with the legacy multi-function plugin loader; package E2E tests the CLI installed in CI. `@opencode-ai/plugin@1.18.18` is the compile-time API target. |
+| Claude | Existing Claude Code credentials (`~/.claude/.credentials.json` and/or macOS Keychain). The `claude` binary is optional. |
+| Cursor | Existing Cursor CLI login (`~/.config/cursor/auth.json` or `CURSOR_ACCESS_TOKEN`) |
+| Command Code | Existing API key (`COMMAND_CODE_API_KEY` or `~/.commandcode/auth.json`). The `command-code` binary is optional. |
+| Ollama | Installed local daemon running on `localhost:11434`; trust that process; run `ollama signin` separately for Cloud |
+
+No vendor CLI has to be installed where OpenCode runs. Claude and Command Code requests carry a client version: the connector takes `ANTHROPIC_CLI_VERSION` / `COMMAND_CODE_CLI_VERSION` when set, otherwise an installed `claude` / `command-code` binary, otherwise the latest version published on the npm registry (`@anthropic-ai/claude-code`, `command-code`). Nothing is pinned in the package.
+
+## Quick Install
+
+Build this repository, then point OpenCode at the compiled module:
+
+```bash
+bun install
+bun run build
+```
+
+In `opencode.json` / `opencode.jsonc` (official `plugin` field):
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": [
+    "file:///absolute/path/to/opencode-ext-connector/dist/index.js"
+  ]
+}
+```
+
+Use that direct `dist/index.js` URL from a trusted, user-owned `file://` build. A package-directory URL does not load this connector's named legacy auth hooks.
+
+The one package entry exposes the catalog plugin plus the Claude, Cursor, Command Code, and Ollama auth hooks. Provider ids: `claude`, `cursor`, `command-code`, `ollama`. Model ids come from each provider's live catalog, with documented fallbacks `default` (Cursor) and `Qwen/Qwen3.8-Max` (Command Code) when a live list is empty.
+
+## Configuration
+
+OpenCode passes plugin options as the second item of a two-element tuple.
+
+Omitted `providers` enables all four. An explicit list is a strict allow-list. Explicit `[]` disables all.
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `providers` | all four | Provider ids to register: `claude`, `cursor`, `command-code`, `ollama`; explicit `[]` disables all |
+| `writeBackCredentials` | `false` | After Claude OAuth refresh, write tokens to Claude files, Keychain (macOS), and OpenCode `auth.json` |
+| `credentialRefresh.mode` | `"auto"` | `"auto"` refreshes Claude tokens before expiry; `"never"` sends only what the credential file contains and re-reads that file after a 401 |
+| `credentialRefresh.leadMs` | `60000` | How long before expiry `"auto"` starts refreshing |
+| `catalogReloadMs` | `300000` | Re-run catalog snapshots on this interval; `0` disables |
+| `snapshotTimeoutMs` | `30000` | Per-provider snapshot deadline |
+| `health.initialBackoffMs` | `1000` | Health backoff after a failed snapshot |
+| `health.maximumBackoffMs` | `60000` | Health backoff cap |
+
+Writeback is off by default so this plugin does not mutate credential stores unless asked. Enable it explicitly:
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": [
+    [
+      "file:///absolute/path/to/opencode-ext-connector/dist/index.js",
+      {
+        "writeBackCredentials": true
+      }
+    ]
+  ]
+}
+```
+
+Enabled providers remain disconnected until their provider-specific auth rule is met: Claude and Cursor need an OpenCode marker or OAuth record plus the vendor session; Command Code may use an OpenCode-stored direct API key or an existing CLI session/key; Ollama needs the exact session marker plus a responsive localhost daemon.
+
+The connector always performs one initial catalog refresh. `snapshotTimeoutMs` applies to each provider snapshot, while `catalogReloadMs: 0` disables only periodic refresh. Periodic refreshes are fixed-delay and single-flight: the next delay begins after the current refresh settles. Health backoff suppresses repeated failures; transient failures retain the last-known catalog, while an explicit unavailable snapshot removes only connector-owned provider data.
+
+OpenCode builds its active provider registry during instance setup. Periodic refresh updates the connector's retained catalog and health state, but new authentication or changed model membership becomes visible after normal OpenCode instance reconstruction. The connector never forces reconstruction or writes generated provider configuration. The `@opencode-ai/plugin@1.18.18` package is the plugin API this connector targets; it is not an OpenCode runtime pin.
+
+With writeback off, refreshed Claude tokens stay in memory only. A stored refresh token that rotates can then stop working on the next process start — set `writeBackCredentials: true` if you want the files updated too.
+
+### Sharing one Claude login across machines
+
+Anthropic rotates the refresh token on every refresh and invalidates the previous one. Two copies of `~/.claude/.credentials.json` that both refresh will therefore break each other. Copying the file works only if exactly one machine refreshes and every other machine receives the result before its own copy expires:
+
+- **Owner** (where you log in): `writeBackCredentials: true` and a lead time large enough to publish the file before the copies expire, for example `credentialRefresh: { mode: "auto", leadMs: 1800000 }`.
+- **Every copy**: `credentialRefresh: { mode: "never" }`. That machine never contacts the OAuth endpoint; when a request returns 401 it re-reads the file and retries once with whatever the owner pushed.
+- Push `~/.claude/.credentials.json` from the owner to each copy whenever it changes (a file watcher is enough). OpenCode's own `auth.json` only needs the `anthropic` record once; leave its other providers alone.
+
+Machines that refresh on their own — including a Claude Code install that is used interactively — must not share the file. Log in separately there.
+
+## First-Time Connection
+
+1. **Fully restart OpenCode** after adding the plugin URL. Quit the process and start it again so the named legacy auth hooks load. A reload or periodic catalog refresh is not instance reconstruction.
+2. **Confirm local prerequisites** for the providers you enabled. Claude and Cursor need their vendor sessions. Command Code needs either an API key you will store in OpenCode or an existing CLI session/key. Ollama needs a process you trust on `http://localhost:11434`; Cloud still requires a separate `ollama signin`.
+3. **Run `/connect`** for each provider you want. Claude and Cursor record a marker or OAuth entry only after the vendor session is available. Command Code can store a direct API key in OpenCode or reuse an existing CLI session/key. Ollama stores the exact session marker only when the localhost daemon responds. Models publish only after that provider-specific rule is met.
+4. **Verify the catalogs.** Confirm Claude, Cursor, and Command Code models appear in OpenCode. For Ollama, run `opencode models ollama` and confirm locally pulled models plus Cloud tags discovered unauthenticated, without connector-supplied credentials.
+
+Ollama `/connect` probes the local daemon and stores the exact session marker. It does not run `ollama signin` or handle Ollama credentials.
+
+## Providers
+
+| Provider | What it does |
+| --- | --- |
+| **Claude** | Reuses existing Claude Code credentials. Does not mint OAuth. Compatibility fetch sends CLI-compatible request metadata and streams Anthropic SSE on the built-in `anthropic` path. `writeBackCredentials` defaults to `false` (in-memory refresh only); `true` writes refreshed tokens to Claude files, macOS Keychain, and OpenCode `auth.json`. |
+| **Cursor** | Calls Cursor's unpublished client protocol (`api2.cursor.sh` `AgentService`, Connect+protobuf over HTTP/2) with the CLI access token. A plugin-owned Node child communicates over private stdio, keeps tool results on the same bidi Run, never replays parked calls, opens no user-facing daemon, and never spawns `cursor-agent` for generation. Unofficial; not a public Cursor API. After protocol drift there is no implicit fallback — that provider fails. Requires Node.js 22 or later. Live catalog ids are used when present; otherwise the documented fallback is `default`. |
+| **Command Code** | Calls `/alpha/generate` with CLI-compatible request metadata and streams provider-local NDJSON text and tool events. The client version comes from `COMMAND_CODE_CLI_VERSION`, an installed `command-code` binary, or the npm registry. Request metadata includes Node.js version, platform, architecture, and the absolute working directory. Live catalog ids are used when present; otherwise the documented fallback is `Qwen/Qwen3.8-Max`. |
+| **Ollama** | Uses only the local daemon at `http://localhost:11434` with fixed `/api/tags`, `/api/pull`, and `/api/chat`. Trust the process bound to that port. Publishes models already pulled locally, plus exact Cloud tags discovered unauthenticated from Ollama's official Cloud search and library pages, without connector-supplied credentials. Local entries win exact duplicates. Incomplete Cloud refreshes retain the last complete list. Selecting an absent authorized Cloud tag pulls its lightweight remote reference on first use; concurrent pulls of the same tag share one in-flight request, and a failed pull can be retried later. The local daemon may then proxy Cloud-tag prompts under the user's Ollama Cloud subscription. The connector never uses an Ollama API key, the usage-billed direct Cloud API, `OLLAMA_HOST`, or a remote Cloud generation endpoint. |
+
+Provider health is isolated: one provider failing does not remove the others.
+
+The standalone SDK entry is `opencode-ext-connector/ollama`. It can generate with models already present in the local daemon; connector-managed Cloud auto-pull requires an active Ollama catalog lease.
+
+## Troubleshooting
+
+| Symptom | What to check |
+| --- | --- |
+| `/connect` methods missing | The plugin URL must be a trusted, user-owned `file:///absolute/path/to/opencode-ext-connector/dist/index.js`. A package-directory URL does not load named legacy auth hooks. Fully restart OpenCode after changing it. |
+| Provider enabled but no models | Omitted `providers` enables all four; an explicit list is a strict allow-list. Claude and Cursor need a marker or OAuth record plus the vendor session; Command Code may use an OpenCode-stored API key or a CLI session/key; Ollama needs the exact marker plus a responsive localhost daemon. Fully restart after `/connect` so instance reconstruction picks up new membership. |
+| Claude works until the next start | Default `writeBackCredentials: false` keeps refreshed tokens in memory. A rotated refresh token then fails on the next process start unless writeback is enabled. |
+| Claude reports `invalid_grant` on a copied credential file | Another copy of the same login already refreshed and rotated the refresh token. Give one machine ownership of refresh and set `credentialRefresh: { mode: "never" }` on the others, or log in separately. |
+| `Claude Code client version is unavailable` | No `ANTHROPIC_CLI_VERSION`, no `claude` binary, and `registry.npmjs.org` was unreachable. Set the variable or allow registry access. |
+| Cursor generation fails | Node.js 22 or later is required. Generation uses the unpublished protocol through a private Node child, not `cursor-agent`. Protocol drift fails that provider; there is no implicit fallback. |
+| Command Code generation fails | The client version could not be resolved: set `COMMAND_CODE_CLI_VERSION`, install `command-code`, or allow access to `registry.npmjs.org`. Request metadata includes Node.js version, platform, architecture, and the absolute working directory. |
+| Ollama missing from `opencode models ollama` | Start a process you trust on `localhost:11434`, then `/connect` so the exact session marker can be stored. Cloud tags are unauthenticated catalog entries without connector-supplied credentials; the local daemon may proxy Cloud-tag prompts. `OLLAMA_HOST`, API keys, and direct Cloud generation are not used. |
+| One provider is down | Failures are isolated. Transient snapshot failures keep the last-known catalog; an unavailable snapshot removes only that connector-owned provider. |
+
+## Documentation
+
+| Document | Contents |
+| --- | --- |
+| [docs/README.ko.md](docs/README.ko.md) | Korean README |
+| [CHANGELOG.md](CHANGELOG.md) | Release notes |
+| [LICENSE](LICENSE) | BSD 3-Clause License |
+| [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) | Derived upstream work |
+
+## Testing
+
+```bash
+bun run check
+bun test
+bun run test:provider
+bun run test:integration
+bun run test:e2e
+bun run verify:package
+```
+
+The E2E suite runs real isolated `opencode serve` processes under temporary HOME/XDG directories. It must not inherit host credentials, proxy/token variables, or access external vendor endpoints.
+
+## License and Disclaimer
+
+BSD-3-Clause. See [LICENSE](LICENSE). Derived upstream work is listed in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+
+This is an independent and unofficial community project. It is not affiliated
+with, endorsed by, sponsored by, or authorized by OpenCode or any third-party
+service provider.
+
+All product names, trademarks, and registered trademarks belong to their
+respective owners. Their use in this project is solely for identification and
+interoperability purposes and does not imply any affiliation or endorsement.
+
+The license for this project applies only to the source code distributed in
+this repository. It does not grant any right or permission to access, use,
+modify, automate, or bypass restrictions imposed by third-party services.
+
+This project is not intended to encourage circumvention of access controls,
+usage restrictions, authentication requirements, or terms of service. Users
+are solely responsible for determining whether their use is permitted and for
+complying with all applicable laws, agreements, policies, and provider terms.
+
+Third-party providers may change, restrict, suspend, or terminate their
+interfaces, authentication mechanisms, accounts, or services at any time.
+Using this software may result in service interruption, account restriction or
+termination, data loss, unexpected charges, or credential exposure.
+
+This software is provided "as is" and without warranties of any kind. To the
+maximum extent permitted by applicable law, the authors and contributors are
+not liable for any claim, damage, loss, account action, or other consequence
+arising from the use or inability to use this software. Use this software
+entirely at your own risk.
+
+The BSD 3-Clause License in [LICENSE](LICENSE) governs the copying,
+modification, and distribution of this software. If this disclaimer conflicts
+with the license, the license controls.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,201 @@
+# Third-Party Notices
+
+This file lists third-party source that this repository may derive from.
+The BSD-3-Clause license of this repository does not replace these notices.
+Derived TypeScript files must include a header pointing here.
+
+## griffinmartin/opencode-claude-auth
+
+- Repository: https://github.com/griffinmartin/opencode-claude-auth
+- Commit: `0f0ff6f12c367339130cbfd250393863ed2c8d9e`
+- License: MIT
+- Copyright: Copyright (c) 2026 gmartin
+
+```
+MIT License
+
+Copyright (c) 2026 gmartin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## Rahularya01/pi-cursor
+
+- Repository: https://github.com/Rahularya01/pi-cursor
+- Version: `1.4.26`
+- Commit: `d80c12704a5136b441e6d86d1cbbd5f05d5fbcf6`
+- License: MIT
+- Used for: Cursor CLI/IDE token cascade and Connect+protobuf `AgentService` patterns.
+
+```
+MIT License
+
+Copyright (c) Rahul Arya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## otto-assistant/opencode-cursor
+
+- Repository: https://github.com/otto-assistant/opencode-cursor
+- License: MIT
+- Used for: Architectural reference for an OpenCode plugin talking to Cursor over HTTP/2 without `cursor-agent`; no current source file is directly derived from this repository.
+
+```
+MIT License
+
+Copyright (c) 2026 Otto Assistant contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## Nomadcxx/opencode-cursor
+
+- Repository: https://github.com/Nomadcxx/opencode-cursor
+- Commit: `8e14a26c1e080382f471a729436092ef72edf34e`
+- License: BSD-3-Clause (repository `LICENSE`; `package.json` incorrectly says ISC — this notice keeps the LICENSE text)
+- Copyright: Copyright (c) 2026, Nomadcxx
+
+```
+BSD 3-Clause License
+
+Copyright (c) 2026, Nomadcxx
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```
+
+## brent-weatherall/opencode-commandcode-provider
+
+- Repository: https://github.com/brent-weatherall/opencode-commandcode-provider
+- Commit: `6cf3f22d4aae469db3723e589291c736285373c1`
+- License: MIT
+- Copyright: Copyright (c) 2026 Brent Weatherall
+
+```
+MIT License
+
+Copyright (c) 2026 Brent Weatherall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## colinhacks/zod
+
+- Repository: https://github.com/colinhacks/zod
+- Version: `4.1.8`
+- Commit: `a1726d53172ba52ecf90999df73778cf416264fd`
+- License: MIT
+- Copyright: Copyright (c) 2025 Colin McDonnell
+- Used for: Runtime schema validation, including code bundled into the published Cursor HTTP/2 bridge.
+
+```
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/dist/catalog/parse-ids.d.ts

@@ -0,0 +1,2 @@
+import type { AdapterModel } from "../core/models";
+export declare function parseModelIdList(value: unknown): readonly AdapterModel[];

package/dist/catalog/parse-ids.js

@@ -0,0 +1,49 @@
+import { parseModelId } from "../core/ids";
+function idFromUnknown(value) {
+    if (typeof value === "string" && value.length > 0) {
+        return value;
+    }
+    if (typeof value === "object" && value !== null && "id" in value) {
+        const id = Reflect.get(value, "id");
+        return typeof id === "string" && id.length > 0 ? id : null;
+    }
+    return null;
+}
+function collect(values) {
+    const models = [];
+    const seen = new Set();
+    for (const value of values) {
+        const id = idFromUnknown(value);
+        if (id === null || seen.has(id)) {
+            continue;
+        }
+        try {
+            const parsed = parseModelId(id);
+            seen.add(id);
+            models.push({ id: parsed });
+        }
+        catch { }
+    }
+    return models;
+}
+export function parseModelIdList(value) {
+    if (Array.isArray(value)) {
+        return collect(value);
+    }
+    if (typeof value !== "object" || value === null) {
+        return [];
+    }
+    if ("data" in value) {
+        const data = Reflect.get(value, "data");
+        if (Array.isArray(data)) {
+            return collect(data);
+        }
+    }
+    if ("models" in value) {
+        const models = Reflect.get(value, "models");
+        if (Array.isArray(models)) {
+            return collect(models);
+        }
+    }
+    return [];
+}

package/dist/core/adapter.d.ts

@@ -0,0 +1,16 @@
+import type { ProviderId } from "./ids";
+import type { AsyncDisposableHandle } from "./lifecycle";
+import type { ProviderSnapshot } from "./models";
+export interface ProviderAdapter extends AsyncDisposableHandle {
+    readonly providerId: ProviderId;
+    snapshot(signal: AbortSignal): Promise<ProviderSnapshot>;
+}
+export interface CatalogPublisher {
+    publish(snapshot: ProviderSnapshot, signal: AbortSignal): Promise<void>;
+}
+export type RefreshProviderCatalogOptions = {
+    readonly adapter: ProviderAdapter;
+    readonly publisher: CatalogPublisher;
+    readonly signal: AbortSignal;
+};
+export declare function refreshProviderCatalog(options: RefreshProviderCatalogOptions): Promise<ProviderSnapshot>;

package/dist/core/adapter.js

@@ -0,0 +1,20 @@
+import { AdapterError, OperationCancelledError } from "./errors";
+export async function refreshProviderCatalog(options) {
+    if (options.signal.aborted) {
+        throw new OperationCancelledError("refresh-provider-catalog");
+    }
+    const snapshot = await options.adapter.snapshot(options.signal);
+    if (snapshot.providerId !== options.adapter.providerId) {
+        throw new AdapterError({
+            operation: "snapshot-provider-mismatch",
+            retryable: false,
+            cause: null,
+            providerId: options.adapter.providerId,
+        });
+    }
+    if (options.signal.aborted) {
+        throw new OperationCancelledError("refresh-provider-catalog");
+    }
+    await options.publisher.publish(snapshot, options.signal);
+    return snapshot;
+}

package/dist/core/clock.d.ts

@@ -0,0 +1,7 @@
+export interface ScheduledCallback extends Disposable {
+    cancel(): void;
+}
+export interface Clock {
+    nowMs(): number;
+    schedule(delayMs: number, callback: () => void): ScheduledCallback;
+}

package/dist/core/clock.js

@@ -0,0 +1 @@
+export {};

package/dist/core/deadline.d.ts

@@ -0,0 +1,13 @@
+import type { Clock } from "./clock";
+import type { AsyncDisposableHandle } from "./lifecycle";
+export type DeadlineOptions = {
+    readonly clock: Clock;
+    readonly timeoutMs: number;
+    readonly parentSignal: AbortSignal | null;
+};
+export interface Deadline extends AsyncDisposableHandle {
+    readonly signal: AbortSignal;
+    readonly expiresAtMs: number;
+    remainingMs(): number;
+}
+export declare function createDeadline(options: DeadlineOptions): Deadline;

package/dist/core/deadline.js

@@ -0,0 +1,54 @@
+import { DeadlineExceededError, InvalidArgumentError, OperationCancelledError, ResourceDisposedError, } from "./errors";
+import { createAsyncDisposable } from "./lifecycle";
+export function createDeadline(options) {
+    if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 0) {
+        throw new InvalidArgumentError("timeoutMs");
+    }
+    const expiresAtMs = options.clock.nowMs() + options.timeoutMs;
+    if (!Number.isSafeInteger(expiresAtMs)) {
+        throw new InvalidArgumentError("timeoutMs");
+    }
+    const controller = new AbortController();
+    const onParentAbort = () => {
+        scheduled?.cancel();
+        if (!controller.signal.aborted) {
+            controller.abort(new OperationCancelledError("deadline-parent"));
+        }
+    };
+    let scheduled = options.timeoutMs > 0
+        ? options.clock.schedule(options.timeoutMs, () => {
+            if (options.parentSignal !== null) {
+                options.parentSignal.removeEventListener("abort", onParentAbort);
+            }
+            if (!controller.signal.aborted) {
+                controller.abort(new DeadlineExceededError(options.timeoutMs));
+            }
+        })
+        : null;
+    if (options.parentSignal?.aborted === true) {
+        onParentAbort();
+    }
+    else if (options.parentSignal !== null) {
+        options.parentSignal.addEventListener("abort", onParentAbort, { once: true });
+    }
+    if (options.timeoutMs === 0 && !controller.signal.aborted) {
+        controller.abort(new DeadlineExceededError(options.timeoutMs));
+    }
+    const disposal = createAsyncDisposable(() => {
+        scheduled?.cancel();
+        scheduled = null;
+        if (options.parentSignal !== null) {
+            options.parentSignal.removeEventListener("abort", onParentAbort);
+        }
+        if (!controller.signal.aborted) {
+            controller.abort(new ResourceDisposedError("deadline"));
+        }
+    });
+    return {
+        signal: controller.signal,
+        expiresAtMs,
+        remainingMs: () => Math.max(0, expiresAtMs - options.clock.nowMs()),
+        dispose: disposal.dispose,
+        [Symbol.asyncDispose]: disposal[Symbol.asyncDispose],
+    };
+}