pi-multikey 1.11.1 → 1.12.0

package/config.ts

@@ -396,17 +396,34 @@ export function maskKey(key: string): string {
 
 /** OpenCode Zen free tier endpoint that mimics the official OpenCode client. */
 const OPENCODE_ZEN_BASE_URL = "https://opencode.ai/zen/v1";
+/**
+ * Where the v2 client actually sends Zen traffic: the console /api/v2/config
+ * prescribes this as the opencode provider's `settings.baseURL` (verified
+ * live 2026-09-21 — the client's session http.request hook shows POSTs to
+ * this host, never zen/v1). Same free lineup, but served against workspace
+ * quota instead of the anonymous per-IP quota that gates zen/v1.
+ */
+const OPENCODE_INFERENCE_BASE_URL = "https://opencode.ai/inference/openai/v1";
 // The Zen free tier gates on the client version parsed from User-Agent
 // (HTTP 426 "OpenCode 1.17.0 or newer is required" when too old — seen live
-// 2026-09-17 with 0.1.50). Track the official client's InstallationVersion:
-// packages/opencode/src/session/llm/request.ts sends `opencode/${Version}`.
-const OPENCODE_ZEN_USER_AGENT = "opencode/1.18.31";
-const OPENCODE_ZEN_CLIENT = "tui";
-
-/** True when a baseUrl points at OpenCode Zen (case-insensitive, trailing slash ok). */
+// 2026-09-17 with 0.1.50; no such gate exists in the v2 branch console code,
+// so this is production-server-side only). Track the official v2 client:
+// packages/core/src/session/model-request.ts sends App.useragent(app), i.e.
+// `opencode/<channel>/<version>/<name>`, with name defaulting to "cli"
+// (OPENCODE_CLIENT ?? OPENCODE_ARTIFACT) — see packages/cli/src/version.ts
+// and packages/cli/src/server-process.ts. Channel "latest" observed live on a
+// working install (captured via session http.request hook: the client sends
+// `opencode/latest/2.0.11/cli`). Bump alongside official releases.
+const OPENCODE_ZEN_USER_AGENT = "opencode/latest/2.0.11/cli";
+const OPENCODE_ZEN_CLIENT = "cli";
+
+/** True when a baseUrl points at OpenCode Zen (either the legacy zen/v1 path
+ * or the inference gateway the v2 client actually uses; case-insensitive,
+ * trailing slash ok). */
 export function isOpenCodeZenEndpoint(baseUrl: string | undefined): boolean {
 	if (!baseUrl) return false;
-	return baseUrl.replace(/\/+$/, "").toLowerCase() === OPENCODE_ZEN_BASE_URL;
+	const normalized = baseUrl.replace(/\/+$/, "").toLowerCase();
+	return normalized === OPENCODE_ZEN_BASE_URL || normalized === OPENCODE_INFERENCE_BASE_URL;
 }
 
 /**

package/identity.ts

@@ -2,12 +2,13 @@
  * Client identity headers for endpoints that gate on them.
  *
  * OpenCode Zen — opencode.ai/zen identifies the calling client with four headers,
- * set in packages/opencode/src/session/llm/request.ts (LLMRequestPrep.prepare)
+ * set in packages/core/src/session/model-request.ts (SessionModelRequest.prepare)
  * whenever the provider id starts with "opencode":
  *
- *   x-opencode-client   flags.client (official default "cli"; we send "tui",
- *                       verified accepted live 2026-09-17)
- *   User-Agent          opencode/<InstallationVersion> (pinned in config.ts:
+ *   x-opencode-client   app.name (official prod default "cli" via OPENCODE_CLIENT ??
+ *                       OPENCODE_ARTIFACT; we send "cli")
+ *   User-Agent          App.useragent(app), i.e. opencode/<channel>/<version>/<name>
+ *                       (pinned in config.ts, currently opencode/latest/2.0.11/cli:
  *                       the free tier 426-rejects versions < 1.17.0)
  *   x-opencode-session  input.sessionID  ("ses_" + Identifier.create(descending))
  *   x-opencode-request  input.user.id, the id of the user message being answered

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-multikey",
-	"version": "1.11.1",
+	"version": "1.12.0",
 	"description": "One pi provider backed by many API keys: automatic 429 rotation, per-request key leases for concurrent subagents, and a /multikey management TUI",
 	"keywords": [
 		"pi-package",

package/presets.ts

@@ -103,7 +103,12 @@ export const PRESETS: Preset[] = [
 		name: "OpenCode Zen",
 		description: "opencode.ai/zen free tier — Big Pickle, MiMo V2.5, Ling 3.0 Fin, Nemotron 3 Ultra/Lightning, Muse Spark 1.3 (6 free models)",
 		defaultPoolId: "zen",
-		baseUrl: "https://opencode.ai/zen/v1",
+		// Inference gateway, not zen/v1: the v2 client's console /api/v2/config
+		// prescribes this as the opencode provider baseURL, and the free lineup
+		// is served here against workspace quota. zen/v1 only has the anonymous
+		// per-IP quota, which datacenter egress IPs exhaust almost immediately
+		// (HTTP 429 FreeUsageLimitError on every request). Verified live 2026-09-21.
+		baseUrl: "https://opencode.ai/inference/openai/v1",
 		api: "openai-completions",
 		keyHint: "https://opencode.ai/auth → sign in → workspace Keys page (one entry per key; multiple keys share the load)",
 		models: [

package/probe.ts

@@ -1,4 +1,4 @@
-import { endpointHeaders, endpointIdentityHeaders } from "./config.ts";
+import { endpointHeaders, endpointIdentityHeaders, isOpenCodeZenEndpoint } from "./config.ts";
 
 /**
  * Endpoint probing: auto-detect the auth header style and fetch the model list.
@@ -140,14 +140,39 @@ export function parseModelsResponse(body: unknown): RemoteModel[] {
 	return models;
 }
 
+/**
+ * Minimal tool stubs that satisfy OpenCode Zen's free-tier client check.
+ *
+ * Verified live 2026-09-21 (see identity.ts notes): the free tier answers
+ * 403 FreeTierError ("can only be used from within OpenCode") to bare,
+ * non-streaming pings — even with a good key — but accepts the same request
+ * once it looks agentic: `stream: true` plus tool definitions carrying
+ * opencode's tool names. Schemas are irrelevant (empty is fine); a single
+ * tool is not. These stubs are never executed — the probe only reads status.
+ */
+const ZEN_PROBE_TOOLS = ["read", "shell", "edit", "write"].map((name) => ({
+	type: "function" as const,
+	function: {
+		name,
+		description: name,
+		parameters: { type: "object" as const, properties: {} },
+	},
+}));
+
 /**
  * Verify a key with a minimal chat completion (a few tokens at most). Returns
  * "ok" when auth was accepted (2xx, or 4xx that clearly got past auth like a
- * bad-model/params 400/404), "rejected" on 401/403, "error" on network trouble.
+ * bad-model/params 400/404 or a quota 429), "rejected" on 401/403, "error"
+ * on network trouble.
  * `onLog` receives the server's rejection body so the TUI can show why.
+ *
+ * On OpenCode Zen the ping carries the agentic shape (streaming + stub tools,
+ * see ZEN_PROBE_TOOLS): without it the free tier 403-rejects even good keys,
+ * which would misreport a working key as rejected.
  */
 async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId: string, onLog?: (line: string) => void): Promise<"ok" | "rejected" | "error"> {
 	try {
+		const zenShaped = isOpenCodeZenEndpoint(baseUrl);
 		const response = await fetch(`${trimSlash(baseUrl)}/chat/completions`, {
 			method: "POST",
 			headers: {
@@ -156,7 +181,12 @@ async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId
 				...endpointIdentityHeaders(baseUrl),
 				...authHeaders(style, key),
 			},
-			body: JSON.stringify({ model: modelId, max_tokens: 4, messages: [{ role: "user", content: "ping" }] }),
+			body: JSON.stringify({
+				model: modelId,
+				max_tokens: 4,
+				messages: [{ role: "user", content: "ping" }],
+				...(zenShaped ? { tools: ZEN_PROBE_TOOLS, stream: true } : {}),
+			}),
 			signal: AbortSignal.timeout(CHAT_TIMEOUT_MS),
 		});
 		if (response.status === 401 || response.status === 403) {