opencode-qoder-bridge 0.1.10 → 0.1.12

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases use
 [Semantic Versioning](https://semver.org/).
 
+## [0.1.11] - 2026-09-01
+
+### Added
+
+- Automatically registers `/qoder_usage`, `/qoder_models`, `/qoder_sessions`,
+  `/qoder_session_reset`, `/qoder_session_fork`, `/qoder_mcp_status`,
+  `/qoder_mcp_auth`, and `/qoder_plan_mode` as local OpenCode TUI commands
+  without requiring manual `opencode.json` or `tui.json` edits.
+- Displays command results in local modal boxes without creating an LLM turn or
+  consuming model tokens; the matching tools remain available for agent use.
+- Updated `@qoder-ai/qoder-agent-sdk` to `1.0.31`, paired with qodercli
+  `1.1.38`.
+- Added opt-in SDK-native `memory` and `securityScan` provider options.
+- Flushes configured memory and skill-evolution background work after
+  successful turns with a bounded, non-fatal wait.
+- Added `qoder_mcp_status` and `qoder_mcp_auth` tools for MCP health checks and
+  Qoder's active OAuth flow.
+- Added `qoder_session_fork` for independent local transcript branches.
+
+### Changed
+
+- The bridge package version is `0.1.11`.
+
 ## [0.1.10] - 2026-08-30
 
 ### Changed
@@ -224,3 +247,4 @@ also verified with an in-process MCP transport.
 [0.1.8]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.7...v0.1.8
 [0.1.9]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.8...v0.1.9
 [0.1.10]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.9...v0.1.10
+[0.1.11]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.10...v0.1.11

package/README.md

@@ -44,6 +44,19 @@ A ground-up rewrite focused on reliability, performance, and first-class usage/c
 PAT authentication uses the SDK's worker runtime when available and does not
 require a local `qoder login`. CLI authentication remains supported.
 
+With npm 12, dependency install scripts may be blocked by the consuming
+project's script-approval policy. To download the SDK's bundled Worker
+runtime, approve and rebuild the installed SDK version from that project:
+
+```bash
+npm install-scripts approve @qoder-ai/qoder-agent-sdk
+npm rebuild @qoder-ai/qoder-agent-sdk
+```
+
+If you use a separately installed `qoder` CLI or intentionally set
+`QODER_SKIP_DOWNLOAD=1`, this step is not required; the bridge can use that
+runtime fallback instead.
+
 ## Install
 
 For a published npm installation, add this to
@@ -100,11 +113,12 @@ SDK exposes only a rounded whole-account quota, not its per-request Credits Log.
 The authoritative account balance still comes from SDK `userQuota`, refreshing
 after each completed Qoder turn and every 30 seconds while active.
 
-OpenCode 1.18.5 loads server plugins and TUI plugins independently. On its
-first load, the bridge safely adds its bundled TUI entry to the global
-`tui.json`, preserving existing settings. Restart OpenCode once after initial
-installation so the TUI loader can activate it. The resulting entry is
-equivalent to:
+OpenCode loads server plugins and TUI plugins independently. On its first
+load, the bridge safely adds its bundled TUI entry to the global
+`~/.config/opencode/tui.json`, preserving existing settings. Restart OpenCode
+once after initial installation so the TUI loader can activate it. The regular
+TUI loads these commands; OpenCode's `--mini` interface does not load external
+TUI plugins in current releases. The resulting entry is equivalent to:
 
 ```json
 {
@@ -231,7 +245,33 @@ preserving your configured `permissionMode`:
 }
 ```
 
-Run `/qoder_plan_mode` in OpenCode for quick guidance.
+The plugin automatically registers the following local TUI slash commands in
+OpenCode. No manual `opencode.json` edits are required; restart OpenCode after
+installing or updating the plugin, then select the command from the `/`
+autocomplete list:
+
+The implementations remain registered, but the TUI marks commands as hidden
+when their prerequisites are absent; it does not disable or delete them. With
+the default configuration, only `/qoder_usage` and `/qoder_models` appear.
+Session commands appear when session persistence, `sessionKey`, or `sessionId`
+is configured. MCP commands appear when at least one MCP server is configured.
+`/qoder_plan_mode` remains hidden because it currently provides guidance only.
+
+| Command | Arguments | Purpose |
+|---------|-----------|---------|
+| `/qoder_usage` | none | Show live quota and local cost/token totals. |
+| `/qoder_models` | none | List available Qoder models and capabilities. |
+| `/qoder_sessions` | optional directory and/or limit | List recent Qoder sessions. |
+| `/qoder_session_reset` | optional key, or `all` | Reset persisted session mappings. |
+| `/qoder_session_fork` | optional session ID, directory, title, cutoff | Create an independent session branch. |
+| `/qoder_mcp_status` | none | Inspect MCP connection and OAuth status. |
+| `/qoder_mcp_auth` | server, then optional callback URL | Start or complete MCP OAuth. |
+| `/qoder_plan_mode` | none | Show Plan Mode status and configuration guidance. |
+
+These commands execute in the TUI and show their result in a modal box. They do
+not create an LLM turn or consume model tokens. Commands that accept arguments
+open a local input box first. The same names are also registered as tools for
+agent use, which is a separate model-driven path.
 
 ### Proxy & Network Routing
 
@@ -253,6 +293,68 @@ environment variables (supports `http://`, `https://`, `socks5://`, and `socks:/
 If `proxy` is omitted, the bridge automatically falls back to `HTTPS_PROXY` or
 `HTTP_PROXY` from your environment.
 
+### Memory
+
+Memory is opt-in. Native mode lets Qoder consume project/user memory and run
+turn-completion generation while keeping generated content under Qoder's own
+memory controls:
+
+```json
+{
+  "provider": {
+    "qoder": {
+      "options": {
+        "memory": {
+          "mode": "native",
+          "projectScope": true,
+          "userScope": false
+        }
+      }
+    }
+  }
+}
+```
+
+The bridge waits up to 10 seconds for Qoder's memory/evolution background work
+after a successful turn, then closes the query. A slow or failed background
+operation is logged in debug mode and does not fail the user turn.
+
+### Security Scan
+
+Security checks are opt-in and disabled unless explicitly configured:
+
+```json
+{
+  "provider": {
+    "qoder": {
+      "options": {
+        "securityScan": {
+          "l1StaticCheck": true,
+          "l2LightweightScan": true,
+          "l3DeepScan": false
+        }
+      }
+    }
+  }
+}
+```
+
+L1 runs after supported edits; L2/L3 enable repository scans. These checks do
+not replace the bridge's permission policy and may consume additional Qoder
+credits.
+
+### MCP OAuth and session forks
+
+Use `qoder_mcp_status` to inspect configured server state. For a server with
+`needs-auth`, run `qoder_mcp_auth` without `callbackUrl`, open the returned
+authorization URL, then run it again with the complete OAuth callback URL.
+The bridge keeps the initialized SDK query alive for this two-step flow and
+expires it after ten minutes.
+
+Use `qoder_session_fork` to create an independent local transcript branch.
+The active provider mapping is intentionally unchanged; continue the returned
+session ID explicitly when you want to work on the fork.
+
 ### Skill Evolution
 
 Enable autonomous turn-completion skill analysis and recommendations:
@@ -279,6 +381,9 @@ The plugin registers several built-in OpenCode tools:
 - `qoder_models` — List known Qoder models, context limits, vision/reasoning flags, and multipliers.
 - `qoder_sessions` — List recent Qoder sessions, session IDs, branches, and timestamps via SDK `listSessions()`.
 - `qoder_session_reset` — Forget the persisted Qoder session mapping for the active project.
+- `qoder_session_fork` — Fork a local Qoder transcript without changing the active mapping.
+- `qoder_mcp_status` — Show MCP connection, tool-count, and OAuth state.
+- `qoder_mcp_auth` — Start or complete active MCP OAuth authentication.
 - `qoder_plan_mode` — View Plan Mode status and configuration guidance.
 
 ## Troubleshooting
@@ -290,6 +395,11 @@ The plugin registers several built-in OpenCode tools:
 | Model not found | Run `opencode models qoder` or `/qoder_models`; model IDs are account- and scene-specific |
 | Missing models in the model list | Restart OpenCode; the bridge performs a live catalog lookup automatically and falls back to the last scoped catalog plus the built-ins (`lite`, `auto`, `performance`) when offline. If your account serves models in a different Qoder scene, set `QODER_SCENE` before launching OpenCode |
 
+The SDK package `1.0.31` bundles qodercli `1.1.38`. If the bridge discovers a
+separately installed qodercli first, update that CLI through its normal Qoder
+CLI installer too so the MCP OAuth and oversized-image compaction fixes are
+active on that path.
+
 ### How model discovery works
 
 At startup the bridge performs a bounded live catalog discovery from Qoder
@@ -309,6 +419,7 @@ npm install
 npm run build      # compile to dist/
 npm run typecheck  # type-check only
 npm test           # build and run the test suite
+npm run test:stress # deterministic stress suite; live abort stress is opt-in
 npm run test:e2e   # authenticated real-CLI test; requires QODER_E2E=1
 npm run check      # full pre-publish verification
 ```
@@ -330,6 +441,9 @@ consume account quota. Run it only after `qoder login`:
 QODER_E2E=1 npm run test:e2e
 ```
 
+To include the live concurrent-abort probe in the stress suite, set
+`QODER_STRESS_E2E=1` as well as a valid Qoder credential.
+
 ## Security
 
 Report suspected vulnerabilities privately as described in

package/RELEASING.md

@@ -1,27 +1,28 @@
 # Releasing
 
-## Before the first release
+## Before a public release
 
 1. Confirm that publishing this integration and using the Qoder name and SDK
    complies with the current Qoder Product Service Terms. Keep any written
    permission with the project records.
-2. Create the public GitHub repository:
+2. Confirm the public GitHub repository is available:
    `https://github.com/naoufalelbani/opencode-qoder-bridge`.
 3. Create an npm account, enable two-factor authentication, and run `npm login`.
 4. Review production dependency advisories with `npm audit --omit=dev`. Do not
    apply forced or major-version fixes without running the full integration
    suite.
 
-## First publish
+## Public publish
 
 Run the complete release gate from a clean checkout:
 
 ```bash
 npm ci
 npm run check
+npm run test:stress
 QODER_E2E=1 npm run test:e2e   # requires qoder login; consumes quota
 npm pack --dry-run
-npm publish
+npm publish --access public
 ```
 
 The end-to-end gate is mandatory for any release that touches
@@ -37,6 +38,15 @@ Verify the registry package and install it through OpenCode:
 npm view opencode-qoder-bridge
 ```
 
+When validating a clean consumer with npm 12, transitive install scripts may be
+blocked by the consumer's policy. Approve the SDK script and rebuild it when
+the bundled Worker runtime is required:
+
+```bash
+npm install-scripts approve @qoder-ai/qoder-agent-sdk@1.0.31
+npm rebuild @qoder-ai/qoder-agent-sdk
+```
+
 ```json
 {
   "plugin": ["opencode-qoder-bridge"]

package/dist/command-actions.d.ts

@@ -0,0 +1,92 @@
+import type { Query } from "@qoder-ai/qoder-agent-sdk";
+import type { ModelDiscoveryOptions } from "./models.js";
+import type { QoderBridgeOptions } from "./types.js";
+export declare const QODER_COMMANDS: readonly [{
+    readonly name: "qoder_usage";
+    readonly title: "Qoder Usage";
+    readonly description: "Show live Qoder quota and local cost/token totals.";
+    readonly argumentHint: "";
+}, {
+    readonly name: "qoder_models";
+    readonly title: "Qoder Models";
+    readonly description: "List available Qoder models and capabilities.";
+    readonly argumentHint: "";
+}, {
+    readonly name: "qoder_sessions";
+    readonly title: "Qoder Sessions";
+    readonly description: "List recent Qoder sessions.";
+    readonly argumentHint: "optional: [directory] [limit]";
+}, {
+    readonly name: "qoder_session_reset";
+    readonly title: "Reset Qoder Session";
+    readonly description: "Reset a persisted Qoder session key, or all sessions.";
+    readonly argumentHint: "optional: session key or all";
+}, {
+    readonly name: "qoder_session_fork";
+    readonly title: "Fork Qoder Session";
+    readonly description: "Fork a Qoder session without changing the active mapping.";
+    readonly argumentHint: "optional: sessionId dir title upToMessageId";
+}, {
+    readonly name: "qoder_mcp_status";
+    readonly title: "Qoder MCP Status";
+    readonly description: "Inspect Qoder MCP connection and OAuth status.";
+    readonly argumentHint: "";
+}, {
+    readonly name: "qoder_mcp_auth";
+    readonly title: "Qoder MCP OAuth";
+    readonly description: "Start or complete Qoder MCP OAuth.";
+    readonly argumentHint: "server [callbackUrl] [redirectUri]";
+}, {
+    readonly name: "qoder_plan_mode";
+    readonly title: "Qoder Plan Mode";
+    readonly description: "Show Qoder Plan Mode status and configuration guidance.";
+    readonly argumentHint: "";
+}];
+export type QoderCommandName = (typeof QODER_COMMANDS)[number]["name"];
+export type CommandResult = {
+    title: string;
+    output: string;
+    variant?: "info" | "success" | "warning" | "error";
+};
+export type PendingMcpAuth = {
+    query: Query;
+    close: () => Promise<void>;
+    timer: ReturnType<typeof setTimeout>;
+};
+export type QoderCommandContext = {
+    configuredCwd: string;
+    configuredSessionKey?: string;
+    configuredSessionId?: string;
+    configuredBridgeOptions: QoderBridgeOptions;
+    modelEnvironment?: Record<string, string | undefined>;
+    modelOptions?: ModelDiscoveryOptions;
+    pendingMcpAuth: Map<string, PendingMcpAuth>;
+};
+export type QoderSessionsArguments = {
+    dir?: string;
+    limit?: number;
+};
+export type QoderSessionForkArguments = {
+    sessionId?: string;
+    dir?: string;
+    title?: string;
+    upToMessageId?: string;
+};
+export type QoderMcpAuthArguments = {
+    server: string;
+    callbackUrl?: string;
+    redirectUri?: string;
+};
+export declare function safeDisplay(value: unknown, fallback: string, maxLength?: number): string;
+export declare function closePendingMcpAuth(pendingMcpAuth: Map<string, PendingMcpAuth>, serverName: string): Promise<void>;
+export declare function closeAllPendingMcpAuth(pendingMcpAuth: Map<string, PendingMcpAuth>): Promise<void>;
+export declare function runQoderUsage(_context: QoderCommandContext): Promise<CommandResult>;
+export declare function runQoderModels(context: QoderCommandContext): Promise<CommandResult>;
+export declare function runQoderSessions(_context: QoderCommandContext, input?: QoderSessionsArguments): Promise<CommandResult>;
+export declare function runQoderSessionReset(context: QoderCommandContext, key?: string): Promise<CommandResult>;
+export declare function runQoderSessionFork(context: QoderCommandContext, input?: QoderSessionForkArguments): Promise<CommandResult>;
+export declare function runQoderMcpStatus(context: QoderCommandContext): Promise<CommandResult>;
+export declare function runQoderMcpAuth(context: QoderCommandContext, input: QoderMcpAuthArguments): Promise<CommandResult>;
+export declare function runQoderPlanMode(): CommandResult;
+export declare function executeQoderCommand(name: string, rawArguments: string, context: QoderCommandContext): Promise<CommandResult>;
+//# sourceMappingURL=command-actions.d.ts.map

package/dist/command-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-actions.d.ts","sourceRoot":"","sources":["../src/command-actions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAOrD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiDjB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,EAAE,kBAAkB,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAIrF;AAED,wBAAsB,mBAAmB,CACvC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EAC3C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CASf;AAuBD,wBAAsB,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAyBzF;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAazF;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,GAAE,sBAA2B,GACjC,OAAO,CAAC,aAAa,CAAC,CAkCxB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,mBAAmB,EAC5B,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,GAAE,yBAA8B,GACpC,OAAO,CAAC,aAAa,CAAC,CAqCxB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAW5F;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAwFxB;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAiBhD;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAgCxB"}