opencode-translate 0.1.2 → 0.2.0

package/src/auth/codex-request.ts

@@ -0,0 +1,108 @@
+import { isRecord } from "./codex-shared"
+import type { CodexBodyRewrite } from "./types"
+
+function textFromContent(content: unknown): string | undefined {
+  if (typeof content === "string") return content
+  if (!Array.isArray(content)) return undefined
+
+  const text = content
+    .map((part) => (isRecord(part) && typeof part.text === "string" ? part.text : undefined))
+    .filter((value): value is string => value !== undefined)
+    .join("\n")
+
+  return text || undefined
+}
+
+function normalizeCodexContent(role: string, content: unknown): Record<string, unknown>[] {
+  const textType = role === "assistant" ? "output_text" : "input_text"
+  if (typeof content === "string") return [{ type: textType, text: content }]
+  if (!Array.isArray(content)) return []
+
+  const result: Record<string, unknown>[] = []
+  for (const part of content) {
+    if (!isRecord(part)) continue
+    const type = part.type
+    if (type === "input_text" || type === "output_text") {
+      result.push({ ...part, type: textType })
+      continue
+    }
+    if (type === "input_image") {
+      result.push({ ...part })
+      continue
+    }
+    if (typeof part.text === "string") result.push({ type: textType, text: part.text })
+  }
+
+  return result
+}
+
+function normalizeCodexInputItem(item: unknown, instructions: string[]): unknown | undefined {
+  if (!isRecord(item)) return item
+  const role = typeof item.role === "string" ? item.role : undefined
+
+  if (role === "system" || role === "developer") {
+    const text = textFromContent(item.content)
+    if (text) instructions.push(text)
+    return undefined
+  }
+
+  if (item.type === "message" && role) {
+    const content = normalizeCodexContent(role, item.content)
+    return content.length > 0 ? { ...item, role, content } : undefined
+  }
+
+  if (role) {
+    const content = normalizeCodexContent(role, item.content)
+    return content.length > 0 ? { type: "message", role, content } : undefined
+  }
+
+  return item
+}
+
+export function rewriteOpenAICodexBody(body: BodyInit | null | undefined): CodexBodyRewrite {
+  if (typeof body !== "string") return { body, originalStream: false }
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(body)
+  } catch {
+    return { body, originalStream: false }
+  }
+
+  if (!isRecord(parsed)) return { body, originalStream: false }
+  const originalStream = parsed.stream === true
+  const sourceInput = Array.isArray(parsed.input)
+    ? parsed.input
+    : Array.isArray(parsed.messages)
+      ? parsed.messages
+      : undefined
+  if (!sourceInput) return { body, originalStream }
+
+  const instructions: string[] = []
+  if (typeof parsed.instructions === "string" && parsed.instructions) instructions.push(parsed.instructions)
+  const input = sourceInput
+    .map((item) => normalizeCodexInputItem(item, instructions))
+    .filter((item): item is unknown => item !== undefined)
+  const include = Array.isArray(parsed.include)
+    ? parsed.include.filter((item): item is string => typeof item === "string")
+    : []
+  if (!include.includes("reasoning.encrypted_content")) include.push("reasoning.encrypted_content")
+
+  return {
+    body: JSON.stringify({
+      ...parsed,
+      instructions: instructions.join("\n\n"),
+      input,
+      tools: Array.isArray(parsed.tools) ? parsed.tools : [],
+      tool_choice: typeof parsed.tool_choice === "string" ? parsed.tool_choice : "auto",
+      parallel_tool_calls: typeof parsed.parallel_tool_calls === "boolean" ? parsed.parallel_tool_calls : false,
+      store: false,
+      stream: true,
+      include,
+      max_output_tokens: undefined,
+      max_completion_tokens: undefined,
+      messages: undefined,
+    }),
+    originalStream,
+  }
+}

package/src/auth/codex-response.ts

@@ -0,0 +1,78 @@
+import { isRecord } from "./codex-shared"
+
+function normalizeCodexOutputItem(item: unknown, index: number): unknown | undefined {
+  if (!isRecord(item)) return undefined
+  if (item.type !== "message" || item.role !== "assistant") return item
+  if (!Array.isArray(item.content)) return undefined
+
+  const content: Record<string, unknown>[] = []
+  for (const part of item.content) {
+    if (!isRecord(part) || part.type !== "output_text" || typeof part.text !== "string") continue
+    content.push({ ...part, annotations: Array.isArray(part.annotations) ? part.annotations : [] })
+  }
+
+  if (content.length === 0) return undefined
+  return {
+    ...item,
+    id: typeof item.id === "string" ? item.id : `msg_opencode_translate_${index}`,
+    role: "assistant",
+    content,
+  }
+}
+
+function buildCodexTextOutput(text: string): Record<string, unknown> {
+  return {
+    type: "message",
+    id: "msg_opencode_translate_0",
+    role: "assistant",
+    content: [{ type: "output_text", text, annotations: [] }],
+  }
+}
+
+function parseCodexSSEResponse(text: string): unknown | undefined {
+  let finalResponse: unknown
+  let deltaText = ""
+  const outputItems: unknown[] = []
+
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.startsWith("data: ")) continue
+    const payload = line.slice(6).trim()
+    if (!payload || payload === "[DONE]") continue
+    try {
+      const parsed = JSON.parse(payload) as Record<string, unknown>
+      if (parsed.type === "response.output_text.delta" && typeof parsed.delta === "string") {
+        deltaText += parsed.delta
+      } else if (
+        (parsed.type === "response.output_item.done" || parsed.type === "response.output_item.added") &&
+        parsed.item
+      ) {
+        outputItems.push(parsed.item)
+      } else if ((parsed.type === "response.done" || parsed.type === "response.completed") && parsed.response) {
+        finalResponse = parsed.response
+      }
+    } catch {}
+  }
+
+  if (!finalResponse && !deltaText && outputItems.length === 0) return undefined
+  const response: Record<string, unknown> = isRecord(finalResponse)
+    ? { ...finalResponse }
+    : { id: "resp_opencode_translate" }
+  const existingOutput: unknown[] = Array.isArray(response.output) ? response.output : []
+  const sourceOutput = existingOutput.length > 0 ? existingOutput : outputItems
+  const normalizedOutput = sourceOutput
+    .map((item, index) => normalizeCodexOutputItem(item, index))
+    .filter((item): item is unknown => item !== undefined)
+
+  response.output = normalizedOutput.length > 0 ? normalizedOutput : deltaText ? [buildCodexTextOutput(deltaText)] : []
+  return response
+}
+
+export async function convertCodexSSEToJSON(response: Response): Promise<Response> {
+  const headers = new Headers(response.headers)
+  const text = await response.text()
+  const parsed = parseCodexSSEResponse(text)
+  if (!parsed) return new Response(text, { status: response.status, statusText: response.statusText, headers })
+
+  headers.set("content-type", "application/json; charset=utf-8")
+  return new Response(JSON.stringify(parsed), { status: response.status, statusText: response.statusText, headers })
+}

package/src/auth/codex-shared.ts

@@ -0,0 +1,3 @@
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value)
+}

package/src/auth/headers.ts

@@ -0,0 +1,18 @@
+import { USER_AGENT } from "../constants"
+
+export function copyHeaders(headers?: HeadersInit): Headers {
+  return new Headers(headers)
+}
+
+export function headerValue(headers: Headers, key: string): string | undefined {
+  const value = headers.get(key)
+  return value === null ? undefined : value
+}
+
+export function packageUserAgent(packageVersion?: string): string {
+  return packageVersion ? USER_AGENT.replace("0.0.0", packageVersion) : USER_AGENT
+}
+
+export function setUserAgent(headers: Headers, packageVersion?: string) {
+  headers.set("User-Agent", packageUserAgent(packageVersion))
+}

package/src/auth/index.ts

@@ -0,0 +1,153 @@
+import { setTimeout as sleep } from "node:timers/promises"
+import {
+  AUTH_ENV_FALLBACK,
+  buildAuthUnavailableError,
+  buildOAuthRefreshError,
+  getEnvVarHint,
+  normalizeReason,
+  OAUTH_DUMMY_KEY,
+  type OAuthInfo,
+  type PluginClientLike,
+  type ProviderInfo,
+  parseTranslatorModel,
+  type ResolvedTranslateOptions,
+  unwrapData,
+} from "../constants"
+import { buildOAuthFetch } from "./oauth-fetch"
+import { refreshAnthropic, refreshOpenAI } from "./refresh"
+import { ensureOAuthInfo, normalizeProviderKey, readAuthMap } from "./store"
+import type { AuthDependencies, AuthRuntime, ResolvedCredential } from "./types"
+
+const credentialCache = new Map<string, ResolvedCredential>()
+const oauthRefreshInflight = new Map<string, Promise<OAuthInfo>>()
+
+export function __resetAuthCachesForTest() {
+  credentialCache.clear()
+  oauthRefreshInflight.clear()
+}
+
+function isMissingCredentialError(error: unknown): boolean {
+  const message = normalizeReason(error).toLowerCase()
+  return (
+    message.includes("api key") ||
+    message.includes("api-key") ||
+    message.includes("missing credentials") ||
+    message.includes("missing authentication") ||
+    message.includes("missing auth") ||
+    message.includes("no auth")
+  )
+}
+
+async function refreshProviderOAuth(
+  providerID: string,
+  info: OAuthInfo,
+  client: PluginClientLike,
+  runtime: AuthRuntime,
+) {
+  let refreshed: OAuthInfo
+  try {
+    if (providerID === "anthropic") refreshed = await refreshAnthropic(info, runtime)
+    else if (providerID === "openai") refreshed = await refreshOpenAI(info, runtime)
+    else return info
+  } catch (error) {
+    if (error instanceof Error && error.message.includes(":OAUTH_REFRESH_FAILED]")) throw error
+    throw buildOAuthRefreshError(providerID, normalizeReason(error))
+  }
+
+  await client.auth.set({ path: { id: providerID }, body: refreshed })
+  return refreshed
+}
+
+async function getProvider(client: PluginClientLike, providerID: string): Promise<ProviderInfo | undefined> {
+  try {
+    const listed = unwrapData(await client.provider.list({ throwOnError: true }))
+    return listed.all.find((provider) => provider.id === providerID)
+  } catch {
+    return undefined
+  }
+}
+
+export function createCredentialResolver(
+  client: PluginClientLike,
+  options: ResolvedTranslateOptions,
+  deps: AuthDependencies = {},
+) {
+  const runtime: AuthRuntime = {
+    fetchImpl: deps.fetchImpl ?? fetch,
+    sleep: deps.sleep ?? ((ms: number) => sleep(ms)),
+  }
+  const now = deps.now ?? (() => Date.now())
+
+  async function resolveOAuth(providerID: string): Promise<OAuthInfo | undefined> {
+    const authMap = await readAuthMap(deps)
+    const info = ensureOAuthInfo(authMap?.[providerID])
+    if (!info) return undefined
+    if (info.expires >= now() + 60_000) return info
+
+    const existing = oauthRefreshInflight.get(providerID)
+    if (existing) return existing
+
+    const refreshPromise = refreshProviderOAuth(providerID, info, client, runtime).finally(() => {
+      oauthRefreshInflight.delete(providerID)
+    })
+    oauthRefreshInflight.set(providerID, refreshPromise)
+    return refreshPromise
+  }
+
+  function credentialFromOAuth(providerID: string, provider?: ProviderInfo): ResolvedCredential {
+    return {
+      providerID,
+      provider,
+      apiKey: "",
+      fetch: buildOAuthFetch({ ...runtime, providerID, resolveOAuth, packageVersion: deps.packageVersion }),
+      mode: "oauth",
+    }
+  }
+
+  async function resolve(providerModel: string): Promise<ResolvedCredential> {
+    const { providerID } = parseTranslatorModel(providerModel)
+    const cached = credentialCache.get(providerID)
+    if (cached) return cached
+
+    const provider = await getProvider(client, providerID)
+    if (options.apiKey) {
+      const resolved = { providerID, provider, apiKey: options.apiKey, mode: "apiKey" as const }
+      credentialCache.set(providerID, resolved)
+      return resolved
+    }
+
+    const providerKey = normalizeProviderKey(provider?.key)
+    if ((provider?.source === "api" || provider?.source === "env") && providerKey) {
+      const resolved = { providerID, provider, apiKey: providerKey, mode: "apiKey" as const }
+      credentialCache.set(providerID, resolved)
+      return resolved
+    }
+
+    if (provider?.source === "custom" || provider?.key === OAUTH_DUMMY_KEY) {
+      const oauthInfo = await resolveOAuth(providerID)
+      if (oauthInfo) {
+        const resolved = credentialFromOAuth(providerID, provider)
+        credentialCache.set(providerID, resolved)
+        return resolved
+      }
+    }
+
+    if (provider?.key === undefined && (provider?.env.length ?? 0) > 1) {
+      const resolved = { providerID, provider, mode: "default" as const }
+      credentialCache.set(providerID, resolved)
+      return resolved
+    }
+
+    return { providerID, provider, mode: "default" }
+  }
+
+  return {
+    resolve,
+    authUnavailable: (providerID: string, provider?: ProviderInfo) =>
+      buildAuthUnavailableError(providerID, getEnvVarHint(provider)),
+    isMissingCredentialError,
+    envFallback: AUTH_ENV_FALLBACK,
+  }
+}
+
+export type { AuthDependencies, ResolvedCredential }

package/src/auth/oauth-fetch.ts

@@ -0,0 +1,100 @@
+import {
+  isAnthropicMessagesRequest,
+  rewriteMessagesBody,
+  rewriteMessagesURL,
+  setOAuthHeaders as setAnthropicOAuthHeaders,
+} from "../anthropic-oauth"
+import type { FetchLike, OAuthInfo } from "../constants"
+import { rewriteOpenAICodexBody } from "./codex-request"
+import { convertCodexSSEToJSON } from "./codex-response"
+import { copyHeaders, packageUserAgent, setUserAgent } from "./headers"
+import { exchangeCopilotToken } from "./refresh"
+import type { AuthRuntime, OAuthResolver } from "./types"
+
+interface OAuthFetchOptions extends AuthRuntime {
+  providerID: string
+  resolveOAuth: OAuthResolver
+  packageVersion?: string
+}
+
+interface RequestState {
+  headers: Headers
+  inputUrl: URL
+  body: BodyInit | null | undefined
+  convertCodexResponse: boolean
+}
+
+function applyAnthropicRequest(state: RequestState, info: OAuthInfo) {
+  setAnthropicOAuthHeaders(state.headers, info.access)
+  state.headers.set("anthropic-version", "2023-06-01")
+  rewriteMessagesURL(state.inputUrl)
+  if (isAnthropicMessagesRequest(state.inputUrl) && typeof state.body === "string") {
+    state.body = rewriteMessagesBody(state.body)
+  }
+}
+
+function applyOpenAIRequest(state: RequestState, info: OAuthInfo) {
+  state.headers.set("Authorization", `Bearer ${info.access}`)
+  if (info.accountId) state.headers.set("ChatGPT-Account-Id", info.accountId)
+  if (
+    state.inputUrl.hostname !== "api.openai.com" ||
+    (state.inputUrl.pathname !== "/v1/chat/completions" && state.inputUrl.pathname !== "/v1/responses")
+  ) {
+    return
+  }
+
+  const rewritten = rewriteOpenAICodexBody(state.body)
+  state.inputUrl.protocol = "https:"
+  state.inputUrl.hostname = "chatgpt.com"
+  state.inputUrl.pathname = "/backend-api/codex/responses"
+  state.inputUrl.search = ""
+  state.body = rewritten.body
+  state.convertCodexResponse = !rewritten.originalStream
+  state.headers.set("OpenAI-Beta", "responses=experimental")
+  state.headers.set("originator", "codex_cli_rs")
+  state.headers.set("accept", "text/event-stream")
+  state.headers.delete("content-length")
+}
+
+async function applyCopilotRequest(state: RequestState, info: OAuthInfo, options: OAuthFetchOptions) {
+  const session = await exchangeCopilotToken(info, options)
+  state.headers.set("Authorization", `Bearer ${session.token}`)
+  state.headers.set("Editor-Version", packageUserAgent(options.packageVersion))
+  state.headers.set("Editor-Plugin-Version", packageUserAgent(options.packageVersion))
+  state.headers.set("Copilot-Integration-Id", "vscode-chat")
+  state.headers.delete("x-api-key")
+
+  if (info.enterpriseUrl) {
+    const target = new URL(info.enterpriseUrl.includes("://") ? info.enterpriseUrl : `https://${info.enterpriseUrl}`)
+    state.inputUrl.protocol = target.protocol
+    state.inputUrl.hostname = target.hostname
+    state.inputUrl.port = target.port
+  }
+}
+
+function inputToURL(input: RequestInfo | URL): URL {
+  return input instanceof URL ? new URL(input.href) : new URL(typeof input === "string" ? input : input.url)
+}
+
+export function buildOAuthFetch(options: OAuthFetchOptions): FetchLike {
+  return async (input, init) => {
+    const info = await options.resolveOAuth(options.providerID)
+    if (!info) return options.fetchImpl(input, init)
+
+    const state: RequestState = {
+      headers: copyHeaders(init?.headers),
+      inputUrl: inputToURL(input),
+      body: init?.body,
+      convertCodexResponse: false,
+    }
+    setUserAgent(state.headers, options.packageVersion)
+
+    if (options.providerID === "anthropic") applyAnthropicRequest(state, info)
+    if (options.providerID === "openai") applyOpenAIRequest(state, info)
+    if (options.providerID === "github-copilot") await applyCopilotRequest(state, info, options)
+
+    const response = await options.fetchImpl(state.inputUrl, { ...init, headers: state.headers, body: state.body })
+    if (state.convertCodexResponse && response.ok) return convertCodexSSEToJSON(response)
+    return response
+  }
+}

package/src/auth/refresh.ts

@@ -0,0 +1,102 @@
+import { buildOAuthRefreshError, normalizeReason, type OAuthInfo } from "../constants"
+import { withRetry } from "./retry"
+import type { AuthRuntime } from "./types"
+
+async function postOAuthToken(url: string, init: RequestInit, deps: AuthRuntime): Promise<Response> {
+  return withRetry(
+    () =>
+      deps.fetchImpl(url, init).then(async (result) => {
+        if (!result.ok) {
+          const error = new Error(`HTTP ${result.status}`) as Error & { response?: Response; status?: number }
+          error.response = result
+          error.status = result.status
+          throw error
+        }
+        return result
+      }),
+    deps,
+  )
+}
+
+export async function refreshAnthropic(info: OAuthInfo, deps: AuthRuntime): Promise<OAuthInfo> {
+  const response = await postOAuthToken(
+    "https://console.anthropic.com/v1/oauth/token",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "refresh_token",
+        refresh_token: info.refresh,
+        client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+      }),
+    },
+    deps,
+  )
+
+  let body: Record<string, unknown>
+  try {
+    body = (await response.json()) as Record<string, unknown>
+  } catch (error) {
+    throw buildOAuthRefreshError("anthropic", normalizeReason(error))
+  }
+
+  if (typeof body.access_token !== "string" || typeof body.refresh_token !== "string") {
+    throw buildOAuthRefreshError("anthropic", "Invalid token response")
+  }
+
+  return {
+    type: "oauth",
+    access: body.access_token,
+    refresh: body.refresh_token,
+    expires: Date.now() + (typeof body.expires_in === "number" ? body.expires_in : 3600) * 1000,
+    accountId: info.accountId,
+    enterpriseUrl: info.enterpriseUrl,
+  }
+}
+
+export async function refreshOpenAI(info: OAuthInfo, deps: AuthRuntime): Promise<OAuthInfo> {
+  const response = await postOAuthToken(
+    "https://auth.openai.com/oauth/token",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: info.refresh,
+        client_id: "app_EMoamEEZ73f0CkXaXp7hrann",
+      }),
+    },
+    deps,
+  )
+
+  let parsed: Record<string, unknown>
+  try {
+    parsed = (await response.json()) as Record<string, unknown>
+  } catch (error) {
+    throw buildOAuthRefreshError("openai", normalizeReason(error))
+  }
+
+  if (typeof parsed.access_token !== "string" || typeof parsed.refresh_token !== "string") {
+    throw buildOAuthRefreshError("openai", "Invalid token response")
+  }
+
+  return {
+    type: "oauth",
+    access: parsed.access_token,
+    refresh: parsed.refresh_token,
+    expires: Date.now() + (typeof parsed.expires_in === "number" ? parsed.expires_in : 3600) * 1000,
+    accountId: info.accountId,
+    enterpriseUrl: info.enterpriseUrl,
+  }
+}
+
+export async function exchangeCopilotToken(info: OAuthInfo, deps: AuthRuntime): Promise<{ token: string }> {
+  const response = await postOAuthToken(
+    "https://api.github.com/copilot_internal/v2/token",
+    { method: "GET", headers: { Authorization: `token ${info.refresh}` } },
+    deps,
+  )
+  const parsed = (await response.json()) as Record<string, unknown>
+  if (typeof parsed.token !== "string") throw buildOAuthRefreshError("github-copilot", "Invalid token response")
+  return { token: parsed.token }
+}

package/src/auth/retry.ts

@@ -0,0 +1,70 @@
+import { normalizeReason } from "../constants"
+import { headerValue } from "./headers"
+import type { AuthDependencies } from "./types"
+
+function getStatus(error: unknown): number | undefined {
+  if (!error || typeof error !== "object") return undefined
+  const record = error as Record<string, unknown>
+  if (typeof record.status === "number") return record.status
+  if (typeof record.statusCode === "number") return record.statusCode
+  const response = record.response
+  if (response && typeof response === "object") {
+    const maybeStatus = (response as Record<string, unknown>).status
+    if (typeof maybeStatus === "number") return maybeStatus
+  }
+  return undefined
+}
+
+function getRetryAfterMs(error: unknown): number {
+  if (!error || typeof error !== "object") return 2000
+  const response = (error as Record<string, unknown>).response
+  if (response && typeof response === "object") {
+    const headers = (response as { headers?: Headers }).headers
+    if (headers instanceof Headers) {
+      const retryAfter = headerValue(headers, "retry-after")
+      if (!retryAfter) return 2000
+      const seconds = Number(retryAfter)
+      if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000)
+      const date = Date.parse(retryAfter)
+      if (Number.isFinite(date)) return Math.max(0, date - Date.now())
+    }
+  }
+  return 2000
+}
+
+function isRetryableError(error: unknown): boolean {
+  const status = getStatus(error)
+  if (status === 429) return true
+  if (status !== undefined) return status >= 500
+  const message = normalizeReason(error).toLowerCase()
+  return (
+    message.includes("network") ||
+    message.includes("fetch") ||
+    message.includes("timeout") ||
+    message.includes("socket") ||
+    message.includes("econn")
+  )
+}
+
+export async function withRetry<T>(
+  task: () => Promise<T>,
+  deps: Required<Pick<AuthDependencies, "sleep">>,
+): Promise<T> {
+  let lastError: unknown
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      return await task()
+    } catch (error) {
+      lastError = error
+      if (!isRetryableError(error)) throw error
+      if (getStatus(error) === 429) {
+        if (attempt >= 1) throw error
+        await deps.sleep(getRetryAfterMs(error))
+        continue
+      }
+      if (attempt >= 2) throw error
+      await deps.sleep(attempt === 0 ? 500 : 1500)
+    }
+  }
+  throw lastError
+}

package/src/auth/store.ts

@@ -0,0 +1,45 @@
+import { readFile, stat } from "node:fs/promises"
+import os from "node:os"
+import path from "node:path"
+import { type AuthInfo, OAUTH_DUMMY_KEY, type OAuthInfo } from "../constants"
+import type { AuthDependencies } from "./types"
+
+// Mirrors opencode's xdg-basedir auth location; see packages/opencode/src/global/index.ts.
+function authFilePath(): string {
+  const xdgDataHome = process.env.XDG_DATA_HOME
+  if (xdgDataHome) return path.join(xdgDataHome, "opencode", "auth.json")
+  if (process.platform === "win32") {
+    return path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), "AppData", "Local"), "opencode", "auth.json")
+  }
+  return path.join(os.homedir(), ".local", "share", "opencode", "auth.json")
+}
+
+export function normalizeProviderKey(value: string | undefined): string | undefined {
+  if (!value || value === OAUTH_DUMMY_KEY) return undefined
+  return value
+}
+
+export function ensureOAuthInfo(value: AuthInfo | undefined): OAuthInfo | undefined {
+  return value && value.type === "oauth" ? value : undefined
+}
+
+export async function readAuthMap(deps: AuthDependencies): Promise<Record<string, AuthInfo> | undefined> {
+  if (process.env.OPENCODE_AUTH_CONTENT) {
+    try {
+      const parsed = JSON.parse(process.env.OPENCODE_AUTH_CONTENT) as Record<string, AuthInfo>
+      if (parsed && typeof parsed === "object") return parsed
+    } catch {}
+    return undefined
+  }
+
+  const filePath = authFilePath()
+  try {
+    const fileStat = await (deps.stat ?? stat)(filePath)
+    if ((fileStat.mode & 0o777) !== 0o600) return undefined
+    const raw = await (deps.readFile ?? readFile)(filePath, "utf8")
+    const parsed = JSON.parse(raw) as Record<string, AuthInfo>
+    return parsed && typeof parsed === "object" ? parsed : undefined
+  } catch {
+    return undefined
+  }
+}