opencode-ufr 0.2.2 → 0.2.4

package/README.md

@@ -23,6 +23,23 @@ opencode plugin add opencode-ufr     # registers the plugin
 
 (or add `"plugins": ["opencode-ufr"]` to your `opencode.json` manually.)
 
+## Updating
+
+opencode loads plugins inside a background server (`opencode serve --service`)
+that keeps running after you close the TUI, and it keeps using the plugin
+version it loaded when it started — a new release only arrives once that server
+restarts:
+
+```bash
+bun add -g opencode-ufr@latest          # update the `ufr` CLI
+pkill -f "opencode serve --service"     # stop opencode's background server
+```
+
+The next opencode start installs the latest plugin. If it still loads the old
+one, delete opencode's cached copy (`~/.cache/opencode/npm/opencode-ufr@latest`)
+and start opencode again. On Windows, end the `opencode` server process in Task
+Manager instead of `pkill`.
+
 ## Setup
 
 **Inside opencode — the normal way:** open `/connect`, pick **Uni Freiburg**,
@@ -60,8 +77,16 @@ ufr stats        # requests, tokens and cost
 ufr keys list    # stored aliases
 ufr keys test    # check your keys against UFR
 ufr login show   # the stored uni login
+ufr disconnect   # remove everything: keys, uni login, config, gateway
 ```
 
+Removing the **unifreiburg** integration in opencode's `/connect` panel does the
+same as `ufr disconnect`: the stored keys and uni login are wiped, the gateway
+stops, and the models disappear from the picker on the next opencode start.
+While opencode runs, connecting and removing are noticed within seconds. If
+opencode was closed when you removed the integration, run `ufr disconnect` once
+to wipe what is left.
+
 ## The built-in VPN
 
 On the campus network (or the VPN you already run) UFR is reached directly and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-ufr",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Uni Freiburg (UFR) Open WebUI models in opencode — local gateway with key pool, UFR-aware rate limiting, circuit breaker and fallbacks",
   "license": "MIT",
   "type": "module",

package/src/cli/index.ts

@@ -5,7 +5,7 @@ import { KeyringStore, type SecretStore } from "../shared/secrets"
 import { cmdCatalogDiff } from "./catalog"
 import { cmdConnect } from "./connect"
 import { type Io, terminalIo } from "./io"
-import { cmdKeys, cmdLogin } from "./keys"
+import { cmdDisconnect, cmdKeys, cmdLogin } from "./keys"
 import { cmdStats } from "./stats"
 import { cmdStatus } from "./status"
 import { cmdStop } from "./stop"
@@ -25,6 +25,8 @@ const HELP = `ufr — opencode-ufr gateway
                                    [--keys "<k1>,<k2>"] (comma/newline separated,
                                    whitespace filtered), optional uni login for the
                                    built-in VPN [--login <u> --password <p>]
+  ufr disconnect                   remove everything: stored keys, uni login,
+                                   config and the running gateway
   ufr keys list | remove <alias> | test [alias]   manage stored keys
   ufr login show | remove          the uni login for the built-in VPN
   ufr status                       gateway, keys, limits, breakers, spend today
@@ -55,6 +57,8 @@ export async function main(argv: string[], partial: Partial<CliDeps> = {}): Prom
     switch (cmd) {
       case "connect":
         return await cmdConnect(d, rest)
+      case "disconnect":
+        return await cmdDisconnect(d)
       case "keys":
         return await cmdKeys(d, rest)
       case "login":

package/src/cli/keys.ts

@@ -1,6 +1,6 @@
 import { loadConfig, saveConfig } from "../shared/config"
 import type { Paths } from "../shared/paths"
-import { VPN_PASS, VPN_USER } from "../shared/secrets"
+import { VPN_PASS, VPN_USER, type SecretStore } from "../shared/secrets"
 import { daemonRequest } from "./daemon-client"
 import type { FetchLike } from "../daemon/catalog-source"
 import type { CliDeps } from "./index"
@@ -29,6 +29,41 @@ export async function applyKeyChange(d: { paths: Paths; fetch: FetchLike; log: (
     : "could not stop the gateway — run `ufr stop` so it picks up the new keys")
 }
 
+export type DisconnectResult = { removed: string[]; loginRemoved: boolean }
+
+/**
+ * Provider-removal cleanup: delete every stored key alias and the uni login
+ * from the keyring, clear config.keys, and stop an idle gateway (it reads its
+ * keys at start, so a later start serves nothing). Idempotent.
+ */
+export async function disconnectAll(d: {
+  paths: Paths
+  secrets: SecretStore
+  fetch: FetchLike
+  log: (m: string) => void
+}): Promise<DisconnectResult> {
+  const cfg = await loadConfig(d.paths.configFile)
+  const removed: string[] = []
+  for (const alias of cfg.keys) {
+    if (await d.secrets.delete(alias)) removed.push(alias)
+  }
+  const userRemoved = await d.secrets.delete(VPN_USER)
+  const passRemoved = await d.secrets.delete(VPN_PASS)
+  const loginRemoved = userRemoved || passRemoved
+  cfg.keys = []
+  await saveConfig(d.paths.configFile, cfg)
+  await applyKeyChange(d)
+  return { removed, loginRemoved }
+}
+
+export async function cmdDisconnect(d: CliDeps): Promise<number> {
+  const r = await disconnectAll({ paths: d.paths, secrets: d.secrets, fetch: d.fetch, log: (m) => d.io.out(m + "\n") })
+  d.io.out(r.removed.length > 0 ? `removed from keyring: ${r.removed.join(", ")}\n` : "nothing was stored\n")
+  if (r.loginRemoved) d.io.out("removed the uni login\n")
+  d.io.out("done — reconnect any time with `ufr connect` or /connect in opencode\n")
+  return 0
+}
+
 export async function cmdKeys(d: CliDeps, args: string[]): Promise<number> {
   const [sub, ...rest] = args
   const cfg = await loadConfig(d.paths.configFile)

package/src/plugin/connect.ts

@@ -9,15 +9,25 @@
 
 import { applyConnect, splitKeys } from "../shared/connect"
 import type { Paths } from "../shared/paths"
-import { applyKeyChange } from "../cli/keys"
+import { applyKeyChange, disconnectAll } from "../cli/keys"
 
 export const UFR_INTEGRATION_ID = "unifreiburg"
 
+/** opencode has no connection events for plugins, so the watcher polls; seconds keep /connect feeling immediate. */
+export const CONNECT_POLL_MS = 5_000
+
 export type ConnectDeps = {
   ctx: any // opencode plugin context (integration + storage domains)
   paths: Paths
   secrets: { get(alias: string): Promise<string | null>; set(alias: string, value: string): Promise<void>; delete(alias: string): Promise<boolean> }
   log: (m: string) => void
+  /** (Re-)registers the provider with opencode — called on first connect and after a removal+reconnect.
+   *  Returns false when the registration did not succeed (e.g. no models yet); the watcher retries. */
+  register?: () => Promise<boolean | void> | boolean | void
+  /** Whether setup() already registered the provider (it does when a connection exists at startup). */
+  providerRegistered?: boolean
+  /** Poll interval override (tests). */
+  pollMs?: number
 }
 
 type CredentialValue = { type?: string; key?: string; configuration?: Record<string, unknown> } | undefined
@@ -73,28 +83,52 @@ export async function registerConnect(d: ConnectDeps): Promise<ConnectRegistrati
     })
   })
 
-  // Apply a submitted credential once, then watch for changes.
+  // Apply a submitted credential once, then watch for changes. Phases:
+  // "registered" (provider live), "unregistered" (no provider yet), and
+  // "disconnected" (the connection was removed in opencode — everything
+  // wiped; a later connection re-applies and re-registers).
+  type Phase = "registered" | "unregistered" | "disconnected"
+  let phase: Phase = d.providerRegistered ? "registered" : "unregistered"
   let lastApplied = ""
   const applyOnce = async (): Promise<boolean> => {
     try {
       const connection = await ctx.integration.connection.active(UFR_INTEGRATION_ID)
-      if (!connection) return false
+      if (!connection) {
+        if (phase === "registered") {
+          phase = "disconnected"
+          lastApplied = ""
+          const r = await disconnectAll({ paths: d.paths, secrets: d.secrets, fetch: (u, i) => fetch(u, i), log: d.log })
+          d.log(`unifreiburg removed in opencode — wiped from keyring: ${r.removed.length > 0 ? r.removed.join(", ") : "nothing"}${r.loginRemoved ? " + uni login" : ""}`)
+          return true // the disconnect cleaned something up — a state change
+        }
+        return false
+      }
       const cred = (await ctx.integration.connection.resolve(connection)) as CredentialValue
       const sig = JSON.stringify(cred?.configuration ?? {}) + "|" + (cred?.key ?? "")
-      if (sig === lastApplied) return false
-      lastApplied = sig
-      const input = credentialToInput(cred)
-      if (!input) {
-        d.log("/connect credential has no keys — nothing applied")
-        return false
+      let changed = false
+      if (sig !== lastApplied) {
+        lastApplied = sig
+        const input = credentialToInput(cred)
+        if (!input) {
+          d.log("/connect credential has no keys — nothing applied")
+          return false
+        }
+        const r = await applyConnect(input, { paths: d.paths, secrets: d.secrets, log: d.log })
+        if (r.errors.length > 0) {
+          for (const e of r.errors) d.log(`/connect: ${e}`)
+          lastApplied = "" // retry on the next poll
+          return false
+        }
+        if (r.changed) await applyKeyChange({ paths: d.paths, fetch: (u, i) => fetch(u, i), log: d.log })
+        changed = true
       }
-      const r = await applyConnect(input, { paths: d.paths, secrets: d.secrets, log: d.log })
-      if (r.errors.length > 0) {
-        for (const e of r.errors) d.log(`/connect: ${e}`)
-        return false
+      if (phase !== "registered") {
+        // first connect mid-session, or a reconnect after a removal
+        const ok = await d.register?.()
+        if (ok !== false) phase = "registered" // false = registration failed — retry on the next poll
+        changed = true
       }
-      await applyKeyChange({ paths: d.paths, fetch: (u, i) => fetch(u, i), log: d.log })
-      return true
+      return changed
     } catch (e) {
       d.log(`/connect apply failed: ${(e as Error).message}`)
       return false
@@ -102,7 +136,18 @@ export async function registerConnect(d: ConnectDeps): Promise<ConnectRegistrati
   }
 
   await applyOnce()
-  const timer = setInterval(() => void applyOnce(), 60_000)
+  // A registration can take ~40 s (gateway boot) — never start a second one while it runs.
+  let busy = false
+  const tick = async () => {
+    if (busy) return
+    busy = true
+    try {
+      await applyOnce()
+    } finally {
+      busy = false
+    }
+  }
+  const timer = setInterval(() => void tick(), d.pollMs ?? CONNECT_POLL_MS)
   ;(timer as { unref?: () => void }).unref?.()
   return {
     stop: () => clearInterval(timer),

package/src/plugin/index.ts

@@ -1,10 +1,11 @@
 import { fileURLToPath } from "node:url"
 import type { OpencodeStamp } from "../daemon/catalog"
+import { daemonRequest } from "../cli/daemon-client"
 import { type Paths, resolvePaths } from "../shared/paths"
 import { KeyringStore } from "../shared/secrets"
 import { VERSION } from "../shared/version"
 import { type Conn, ensureDaemon, spawnDaemon } from "./ensure-daemon"
-import { registerConnect } from "./connect"
+import { registerConnect, UFR_INTEGRATION_ID } from "./connect"
 import { toModelInfo } from "./model-info"
 
 const DAEMON_ENTRY = fileURLToPath(new URL("../daemon/main.ts", import.meta.url))
@@ -17,13 +18,69 @@ async function connect(paths: Paths): Promise<Conn> {
   return ensureDaemon({ paths, version: VERSION, spawn: () => spawnDaemon(DAEMON_ENTRY, paths.stateDir) })
 }
 
-async function heartbeat(conn: Conn, paths: Paths): Promise<void> {
-  const ok = await fetch(`http://127.0.0.1:${conn.port}/v1/_client/heartbeat`, {
-    method: "POST",
+/** Whether this opencode exposes the integration API (needed to see connection state). */
+function hasIntegration(ctx: any): boolean {
+  return typeof ctx?.integration?.connection?.active === "function"
+}
+
+/** Starts the daemon if needed, fetches its models and registers the provider with opencode. */
+async function registerProvider(
+  ctx: any,
+  providerId: string,
+  providerName: string,
+  paths: Paths,
+): Promise<boolean> {
+  let conn: Conn
+  try {
+    conn = await connect(paths)
+  } catch (e) {
+    log(`${(e as Error).message} — run \`ufr status\``)
+    return false
+  }
+  const list = await fetch(`http://127.0.0.1:${conn.port}/v1/models`, {
     headers: { Authorization: `Bearer ${conn.token}` },
-    signal: AbortSignal.timeout(5_000),
+    signal: AbortSignal.timeout(10_000),
+  })
+    .then(async (r) => (r.ok ? ((await r.json()) as { data: { id: string; opencode: OpencodeStamp }[] }).data : []))
+    .catch(() => [])
+  if (list.length === 0) {
+    // Never register an empty provider: it breaks the whole model picker.
+    log("no models available — run `ufr setup`, connect to the uni VPN, then `ufr status` for details")
+    return false
+  }
+  if (typeof ctx?.provider?.transform !== "function") {
+    log("this opencode version has no ctx.provider.transform — cannot register the provider")
+    return false
+  }
+  const models = list.map((m) => toModelInfo(providerId, m.id, m.opencode))
+  await ctx.provider.transform((editor: any) => {
+    editor.add({
+      info: {
+        id: providerId,
+        name: providerName,
+        activation: "enabled",
+        package: "@opencode/ai/providers/openai-compatible",
+        settings: { baseURL: `http://127.0.0.1:${conn.port}/v1`, apiKey: conn.token },
+      },
+      models,
+    })
   })
-    .then((r) => r.ok)
+  log(`registered ${providerId} with ${models.length} models`)
+  return true
+}
+
+/**
+ * Keeps the daemon alive while the provider is connected. When the connection
+ * was removed in opencode, the daemon must stay down — the watcher wipes the
+ * keys and opencode no longer offers the provider.
+ */
+export async function heartbeat(ctx: any, paths: Paths): Promise<void> {
+  if (hasIntegration(ctx)) {
+    const active = await ctx.integration.connection.active(UFR_INTEGRATION_ID).catch(() => undefined)
+    if (!active) return
+  }
+  const ok = await daemonRequest(paths, (u, i) => fetch(u, i), "/v1/_client/heartbeat", "POST")
+    .then((r) => r?.ok ?? false)
     .catch(() => false)
   // Port and token are stable, so a restarted daemon serves the provider we already registered.
   if (!ok) await connect(paths).catch((e) => log(`gateway restart failed: ${(e as Error).message}`))
@@ -37,53 +94,38 @@ export default {
     const providerName = typeof options.providerName === "string" ? options.providerName : "Uni Freiburg"
     const paths = resolvePaths()
 
-    let conn: Conn
-    try {
-      conn = await connect(paths)
-    } catch (e) {
-      log(`${(e as Error).message} — run \`ufr status\``)
-      return
-    }
-    const list = await fetch(`http://127.0.0.1:${conn.port}/v1/models`, {
-      headers: { Authorization: `Bearer ${conn.token}` },
-      signal: AbortSignal.timeout(10_000),
-    })
-      .then(async (r) => (r.ok ? ((await r.json()) as { data: { id: string; opencode: OpencodeStamp }[] }).data : []))
-      .catch(() => [])
-    if (list.length === 0) {
-      // Never register an empty provider: it breaks the whole model picker.
-      log("no models available — run `ufr setup`, connect to the uni VPN, then `ufr status` for details")
-      return
-    }
-    if (typeof ctx?.provider?.transform !== "function") {
-      log("this opencode version has no ctx.provider.transform — cannot register the provider")
-      return
+    let registered = false
+    const registerProviderFn = async (): Promise<boolean> => {
+      if (registered) return true
+      registered = await registerProvider(ctx, providerId, providerName, paths)
+      return registered
     }
-    const models = list.map((m) => toModelInfo(providerId, m.id, m.opencode))
-    await ctx.provider.transform((editor: any) => {
-      editor.add({
-        info: {
-          id: providerId,
-          name: providerName,
-          activation: "enabled",
-          package: "@opencode/ai/providers/openai-compatible",
-          settings: { baseURL: `http://127.0.0.1:${conn.port}/v1`, apiKey: conn.token },
-        },
-        models,
-      })
-    })
-    log(`registered ${providerId} with ${models.length} models`)
-    // /connect integration: uni login (optional) form on the unifreiburg entry
+
+    // /connect integration first: it is the only way to connect when no
+    // provider is registered yet, so it must exist even while disconnected.
     const stopConnect = await registerConnect({
       ctx,
       paths,
       secrets: new KeyringStore(),
       log,
+      register: registerProviderFn,
+      providerRegistered: false,
     }).catch((e) => {
       log(`/connect integration failed: ${(e as Error).message}`)
       return { stop: () => {}, applyNow: async () => false }
     })
-    const beat = setInterval(() => void heartbeat(conn, paths), 60_000)
+
+    // The provider is registered only while the integration is connected:
+    // removing it in opencode must remove the models too.
+    if (!hasIntegration(ctx)) {
+      await registerProviderFn() // old opencode without the integration API — register as before
+    } else {
+      const connection = await ctx.integration.connection.active(UFR_INTEGRATION_ID).catch(() => undefined)
+      if (connection) await registerProviderFn()
+      else log(`${providerId} not connected — open /connect in opencode to set it up`)
+    }
+
+    const beat = setInterval(() => void heartbeat(ctx, paths), 60_000)
     ;(beat as { unref?: () => void }).unref?.()
     return () => {
       clearInterval(beat)

package/src/shared/connect.ts

@@ -43,6 +43,8 @@ export type ConnectApplied = {
   aliases: { alias: string; key: string }[]
   removedAliases: string[]
   loginStored: boolean
+  /** False when the submission was byte-identical to what is already stored — no gateway restart needed. */
+  changed: boolean
   errors: string[]
 }
 
@@ -60,15 +62,16 @@ export async function applyConnect(
   const keys = splitKeys(input.keys)
   if (keys.length === 0) {
     errors.push("no keys given")
-    return { aliases: [], removedAliases: [], loginStored: false, errors }
+    return { aliases: [], removedAliases: [], loginStored: false, changed: false, errors }
   }
   if (input.login && !EMAIL_RE.test(input.login.trim())) {
     errors.push(`"${input.login}" does not look like a uni login`)
-    return { aliases: [], removedAliases: [], loginStored: false, errors }
+    return { aliases: [], removedAliases: [], loginStored: false, changed: false, errors }
   }
 
   const cfg = await loadConfig(o.paths.configFile)
   const custom = cfg.keys.filter((k) => !/^key\d+$/.test(k))
+  const beforeKeys = cfg.keys.join("\n")
 
   // replace the managed key1…keyN aliases
   const removedAliases: string[] = []
@@ -80,15 +83,21 @@ export async function applyConnect(
     }
   }
   const aliases: { alias: string; key: string }[] = []
+  let changed = beforeKeys !== [...custom, ...wanted].join("\n") || removedAliases.length > 0
   for (let i = 0; i < keys.length; i++) {
     const alias = wanted[i]!
+    if ((await o.secrets.get(alias)) !== keys[i]!) changed = true
     await o.secrets.set(alias, keys[i]!)
     aliases.push({ alias, key: keys[i]! })
   }
 
   let loginStored = false
   if (input.login?.trim()) {
-    await o.secrets.set(VPN_USER, input.login.trim())
+    const login = input.login.trim()
+    if ((await o.secrets.get(VPN_USER)) !== login || (input.password && (await o.secrets.get(VPN_PASS)) !== input.password)) {
+      changed = true
+    }
+    await o.secrets.set(VPN_USER, login)
     if (input.password) await o.secrets.set(VPN_PASS, input.password)
     loginStored = true
   }
@@ -96,5 +105,5 @@ export async function applyConnect(
   cfg.keys = [...custom, ...wanted]
   await saveConfig(o.paths.configFile, cfg)
   log(`connect applied: ${aliases.length} key(s), login ${loginStored ? "stored" : "unchanged"}`)
-  return { aliases, removedAliases, loginStored, errors }
+  return { aliases, removedAliases, loginStored, changed, errors }
 }