optio-opencode 0.3.1__tar.gz → 0.5.0__tar.gz

{optio_opencode-0.3.1 → optio_opencode-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-opencode
-Version: 0.3.1
+Version: 0.5.0
 Summary: Run opencode web as an optio task; local subprocess or remote via SSH.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -20,9 +20,12 @@ Classifier: Topic :: Software Development :: Code Generators
 Classifier: Framework :: AsyncIO
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: optio-core<0.4,>=0.3
-Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.5,>=0.4
+Requires-Dist: optio-core<0.5,>=0.4
+Requires-Dist: optio-host<0.4,>=0.3
+Requires-Dist: optio-agents<0.7,>=0.6
+Requires-Dist: optio-claudecode<0.6,>=0.5
+Requires-Dist: optio-codex<0.4,>=0.3
+Requires-Dist: optio-grok<0.4,>=0.3
 Requires-Dist: asyncssh>=2.14
 Requires-Dist: aiohttp>=3.9
 Provides-Extra: dev

{optio_opencode-0.3.1 → optio_opencode-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "optio-opencode"
-version = "0.3.1"
+version = "0.5.0"
 description = "Run opencode web as an optio task; local subprocess or remote via SSH."
 readme = "README.md"
 license = "Apache-2.0"
@@ -26,11 +26,17 @@ classifiers = [
     "Framework :: AsyncIO",
 ]
 dependencies = [
-    "optio-core>=0.3,<0.4",
+    "optio-core>=0.4,<0.5",
     # 0.1.1 introduces the bind_addr kwarg on Host.establish_tunnel —
     # required for OPTIO_WIDGET_TUNNEL_BIND to work.
-    "optio-host>=0.2,<0.3",
-    "optio-agents>=0.4,<0.5",
+    "optio-host>=0.3,<0.4",
+    "optio-agents>=0.6,<0.7",
+    # The account meta-analyzer's per-provider handlers reuse the extracted
+    # vendor map helpers (account_from_oauth_token / account_from_openai /
+    # account_from_xai) rather than reimplement each vendor's fetch+map.
+    "optio-claudecode>=0.5,<0.6",
+    "optio-codex>=0.3,<0.4",
+    "optio-grok>=0.3,<0.4",
     "asyncssh>=2.14",
     "aiohttp>=3.9",
 ]

{optio_opencode-0.3.1 → optio_opencode-0.5.0}/src/optio_opencode/__init__.py

@@ -8,6 +8,7 @@ from optio_host import (
     RunResult,
     SSHConfig,
 )
+from optio_opencode.account import analyze_accounts, resolve_capture_accounts
 from optio_opencode.info import AGENT_INFO
 from optio_opencode.session import create_opencode_task, run_opencode_session
 from optio_opencode.types import (
@@ -58,4 +59,6 @@ __all__ = [
     "ConversationMode",
     "ToolVerbosity",
     "verify_and_refresh_seed",
+    "analyze_accounts",
+    "resolve_capture_accounts",
 ]

optio_opencode-0.5.0/src/optio_opencode/account.py

@@ -0,0 +1,93 @@
+"""opencode account meta-analyzer.
+
+opencode is a model-selection TUI over third-party providers: a seed's
+``auth.json`` holds credentials for whichever provider(s) the operator logged
+into. So an opencode seed's "account" is really **one account per configured
+provider**. Unlike the single-vendor wrappers, opencode needs a meta-analyzer:
+dispatch each provider entry to its handler (which reuses the vendor map
+helpers), aggregate into a ``list[AccountInfo]``.
+
+Every configured provider yields exactly one ``AccountInfo`` — an analyzed one
+when a handler resolves it, else a placeholder (``"Unknown account · <provider>"``)
+so nothing silently disappears from the pool popover. Fail-soft throughout: a
+provider handler never breaks the others; empty/unreadable auth → ``[]``.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+from dataclasses import replace
+
+from optio_agents.account import EMPTY, AccountInfo
+from optio_opencode.providers import anthropic, deepseek, openai, xai
+
+_LOG = logging.getLogger(__name__)
+
+# models.dev provider id → per-provider handler. Providers absent here (the
+# ~146 remaining) yield a placeholder AccountInfo.
+_REGISTRY = {
+    "anthropic": anthropic.handle,
+    "openai": openai.handle,
+    "xai": xai.handle,           # oauth (grok reuse) + api-key (/v1/api-key) branches
+    "deepseek": deepseek.handle,  # api-key: /user/balance
+}
+
+_AUTH_RELPATH = "home/.local/share/opencode/auth.json"
+
+
+def _placeholder(provider_id: str, entry: dict) -> AccountInfo:
+    """A stand-in for a provider we do not (yet) analyze. Carries the ``provider``
+    so the frame's summary renders ``"<provider> · unknown account"`` — attributed
+    to its provider even though nothing was fetched."""
+    return AccountInfo(
+        provider=provider_id,
+        account_id=entry.get("accountId"),
+        raw={"provider": provider_id, "unanalyzed": True},
+    )
+
+
+async def analyze_accounts(auth: dict) -> "list[AccountInfo]":
+    """Map an opencode ``auth.json`` dict → one ``AccountInfo`` per provider.
+
+    For each ``provider_id -> entry``: skip non-dict entries; dispatch to the
+    registered handler (fail-soft); append the analyzed account, or a
+    placeholder when there is no handler / it declines / it fails / it returns
+    the ``EMPTY`` sentinel. Empty or non-dict auth → ``[]``."""
+    if not isinstance(auth, dict):
+        return []
+    items = [(pid, e) for pid, e in auth.items() if isinstance(e, dict)]
+
+    async def _one(provider_id: str, entry: dict) -> AccountInfo:
+        handler = _REGISTRY.get(provider_id)
+        info: AccountInfo | None = None
+        if handler is not None:
+            try:
+                info = await handler(entry)
+            except Exception:  # noqa: BLE001 — one bad provider never drops the rest
+                _LOG.exception("opencode provider handler failed: %s", provider_id)
+                info = None
+        if info is not None and info != EMPTY:
+            # Attribute every analyzed account to its provider so the summary is
+            # unambiguous across a multi-provider seed ("openai · Plan: …").
+            return replace(info, provider=provider_id)
+        return _placeholder(provider_id, entry)
+
+    # Providers analyzed CONCURRENTLY — each hits a different vendor with its own
+    # (up to 15s) HTTP timeout, so a multi-provider seed must not pay the SUM of
+    # those; the verify/verify-free RPC deadline can't absorb it (see the
+    # asyncio.wait_for budget in verify.py).
+    return list(await asyncio.gather(*(_one(pid, e) for pid, e in items)))
+
+
+async def resolve_capture_accounts(host) -> "list[AccountInfo]":
+    """Live-host capture variant: read the isolated HOME's ``auth.json`` and
+    analyze it. Fail-soft → ``[]`` on any read/parse failure."""
+    path = f"{host.workdir.rstrip('/')}/{_AUTH_RELPATH}"
+    try:
+        raw = await host.fetch_bytes_from_host(path)
+        auth = json.loads(raw.decode("utf-8"))
+    except Exception:  # noqa: BLE001 — missing/unreadable/malformed auth → []
+        return []
+    return await analyze_accounts(auth)

{optio_opencode-0.3.1 → optio_opencode-0.5.0}/src/optio_opencode/cred_watcher.py

@@ -69,6 +69,64 @@ async def capture_gate_ok(host: Host) -> bool:
     return isinstance(cfg, dict) and bool(cfg.get("model"))
 
 
+class UnsliceableSeed(Exception):
+    """The seed's auth.json holds several providers but cannot be safely
+    reduced to the one backing the configured default model."""
+
+
+def _provider_of(model: str | None) -> str | None:
+    """The provider id of a `provider/model` string, or None if it carries no
+    `provider/` prefix."""
+    if not model or "/" not in model:
+        return None
+    return model.split("/", 1)[0]
+
+
+async def _read_json(host: Host, relpath: str) -> dict | None:
+    path = f"{host.workdir.rstrip('/')}/{relpath}"
+    try:
+        raw = await host.fetch_bytes_from_host(path)
+        data = json.loads(raw.decode("utf-8"))
+    except (FileNotFoundError, ValueError, UnicodeDecodeError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+async def slim_auth_to_selected_provider(host: Host) -> bool:
+    """Enforce one-provider-per-seed: prune the live auth.json to the single
+    provider backing the configured default model (`small_model || model`),
+    dropping the rest. Returns True if it rewrote auth.json, False on no-op
+    (auth absent/invalid, or already one provider).
+
+    Raises UnsliceableSeed when the seed cannot be reduced to one provider:
+    the selected model has no `provider/` prefix, `model` and `small_model`
+    resolve to different providers, or the selected provider is absent from
+    auth.json. The caller decides what an un-sliceable seed means (capture
+    refuses it; save-back leaves the seed untouched)."""
+    auth = await _read_json(host, _CRED_RELPATH)
+    if not auth:                      # missing/invalid/empty -> nothing to slim
+        return False
+    if len(auth) <= 1:                # already single-provider
+        return False
+
+    cfg = await _read_json(host, _MODEL_RELPATH) or {}
+    selected = _provider_of(cfg.get("model"))
+    if selected is None:
+        raise UnsliceableSeed("no provider-qualified model in opencode.json")
+    small = _provider_of(cfg.get("small_model"))
+    if small is not None and small != selected:
+        raise UnsliceableSeed(
+            f"model provider {selected!r} != small_model provider {small!r}")
+    if selected not in auth:
+        raise UnsliceableSeed(
+            f"selected provider {selected!r} not in auth.json {sorted(auth)}")
+
+    dropped = sorted(k for k in auth if k != selected)
+    await host.write_text(_CRED_RELPATH, json.dumps({selected: auth[selected]}))
+    _LOG.info("slimmed seed auth to provider %r; dropped %s", selected, dropped)
+    return True
+
+
 async def save_back_if_changed(
     ctx,
     host: Host,
@@ -81,6 +139,11 @@ async def save_back_if_changed(
     """If the live auth.json differs from `baseline` and is valid, save it
     back into the seed and return the new fingerprint. Otherwise return
     `baseline` unchanged. Never raises — save-back is best-effort."""
+    try:
+        await slim_auth_to_selected_provider(host)
+    except UnsliceableSeed as e:
+        _LOG.warning("seed %s: save-back skipped, un-sliceable auth (%s)", seed_id, e)
+        return baseline
     fp = await cred_fingerprint(host)
     if fp is None or fp == baseline:
         return baseline

optio_opencode-0.5.0/src/optio_opencode/fs_allowlist.py

@@ -0,0 +1,49 @@
+"""Build the claustrum filesystem-allowlist flags for an ``opencode web`` launch.
+
+Thin delegator over the shared ``optio_agents.fs_grants`` builder (the system
+baseline + workdir + engine-cache + caller-extras logic lives there, one SSOT
+across every wrapper). opencode contributes ONE engine-specific grant on top:
+
+  * opencode's home/config/data/cache all live under ``<workdir>/home`` — already
+    covered by ``--rwx <workdir>``.
+  * BUT ``OPENCODE_DB`` = ``<taskdir>/opencode.db`` sits ONE LEVEL ABOVE the
+    workdir (the ``taskdir/workdir`` layout). Under-granting there breaks
+    opencode's live DB, so the whole taskdir is granted rwx via ``extra_baseline``.
+  * the opencode binary cache (``_resolve_install_dir``, outside every workdir)
+    is granted read+exec as the engine cache.
+
+Non-existent paths are harmless: claustrum ignores missing paths.
+"""
+
+from __future__ import annotations
+
+from optio_agents import fs_grants
+
+# Re-exported so tests / callers can build extra grants without reaching into
+# optio_agents directly (mirrors the other wrappers' fs_allowlist surface).
+from .types import AllowedDir  # noqa: F401
+
+
+def build_grant_flags(
+    *,
+    workdir: str,
+    taskdir: str,
+    opencode_cache_dir: str,
+    extra_allowed_dirs: "list[AllowedDir] | None",
+    host_home: str | None = None,
+) -> list[str]:
+    """Return the ordered claustrum grant flags for an opencode launch.
+
+    ``workdir`` (the per-task tree incl. the isolated ``home``) is granted rwx.
+    ``taskdir`` (the workdir's parent, holding the live ``opencode.db``) is
+    granted rwx as an engine ``extra_baseline`` so the server can write its DB.
+    ``opencode_cache_dir`` (where the real opencode binary lives, outside every
+    workdir) is granted read+exec. ``~``/``~/`` caller extras expand against
+    ``host_home`` (the REAL host home)."""
+    return fs_grants.build_grant_flags(
+        workdir=workdir,
+        engine_cache_dir=opencode_cache_dir,
+        extra_allowed_dirs=extra_allowed_dirs,
+        host_home=host_home,
+        extra_baseline=[("--rwx", taskdir.rstrip("/"))],
+    )

{optio_opencode-0.3.1 → optio_opencode-0.5.0}/src/optio_opencode/host_actions.py

@@ -28,6 +28,8 @@ from typing import TYPE_CHECKING, Callable
 
 from optio_host.host import ProcessHandle
 
+from optio_agents import claustrum
+
 from optio_opencode.info import AGENT_INFO
 
 if TYPE_CHECKING:
@@ -71,6 +73,72 @@ async def _resolve_install_dir(host: "Host", install_dir: str | None) -> str:
     return path.rstrip("/")
 
 
+# --- claustrum provisioning -------------------------------------------------
+#
+# opencode is wrapped in claustrum (Landlock, fail-closed) so the whole
+# ``opencode web`` server tree — the server and every tool subprocess it spawns
+# — is confined to an explicit filesystem allowlist. The provisioning logic
+# (engine cross-compile, ELF-guarded build cache, functional wrap+exec
+# validation, fail-closed placement) is the shared ``optio_agents.claustrum``
+# module; this wrapper contributes only the opencode-owned cache-dir resolution
+# and, in session.py, the grant set (``fs_allowlist.build_grant_flags``).
+
+
+async def ensure_claustrum_installed(
+    hook_ctx,
+    *,
+    install_dir: str | None = None,
+) -> str:
+    """Ensure a functioning claustrum binary is on the host; return its path.
+
+    Thin wrapper over :func:`optio_agents.claustrum.ensure_claustrum_installed`:
+    resolves the opencode-owned target cache dir (on the worker, beside the
+    opencode binary cache), pins the engine build cache to
+    ``~/.cache/optio-opencode``, and forwards the UI progress callback. All the
+    real work (cross-compile, ELF-guarded engine cache, functional wrap+exec
+    validation) lives in the shared module. Fail-closed — any failure RAISES, so
+    the caller never proceeds to an unconfined launch.
+    """
+    host = hook_ctx._host
+    cache_dir = await _resolve_install_dir(host, install_dir)
+    return await claustrum.ensure_claustrum_installed(
+        host,
+        cache_dir=cache_dir,
+        engine_cache_dir=os.path.expanduser("~/.cache/optio-opencode"),
+        report_progress=hook_ctx.report_progress,
+    )
+
+
+async def claustrum_newer_tag() -> str | None:
+    """Return the newest claustrum tag if it is newer than the pinned one, else None.
+
+    Engine-side egress only. Best-effort: network failure returns None (no notice).
+    """
+    try:
+        p = await asyncio.create_subprocess_exec(
+            "git", "ls-remote", "--tags", "--refs", claustrum.CLAUSTRUM_REPO,
+            stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.DEVNULL,
+        )
+        out, _ = await p.communicate()
+        if p.returncode != 0:
+            return None
+    except Exception:  # noqa: BLE001
+        return None
+    tags = []
+    for line in out.decode().splitlines():
+        ref = line.rsplit("/", 1)[-1].strip()
+        if ref.startswith("v"):
+            tags.append(ref)
+
+    def key(t: str) -> tuple:
+        return tuple(int(x) for x in t.lstrip("v").split(".") if x.isdigit())
+
+    if not tags:
+        return None
+    newest = max(tags, key=key)
+    return newest if key(newest) > key(claustrum.CLAUSTRUM_PINNED_TAG) else None
+
+
 def _isolation_env(host: "Host") -> dict[str, str]:
     """Per-task HOME/XDG isolation env, derived from ``host.workdir``.
 
@@ -437,6 +505,7 @@ async def launch_opencode(
     hostname: str = "127.0.0.1",
     extra_env: dict[str, str] | None = None,
     env_remove: list[str] | None = None,
+    claustrum_wrap: list[str] | None = None,
 ) -> tuple[ProcessHandle, int]:
     """Launch ``opencode web`` on ``host``; wait for the listening URL.
 
@@ -475,10 +544,18 @@ async def launch_opencode(
     # opencode succeeds at opening a real browser window. opencode_executable
     # is an absolute path (resolved by ensure_opencode_installed), so
     # login-shell PATH lookup is not needed to find the binary.
+    #
+    # claustrum_wrap (fs isolation) is spliced BETWEEN the ``env …`` password
+    # assignment and the opencode executable: ``exec env VAR=… claustrum … --
+    # opencode web``. The ``$(cat …)`` runs in the outer shell (before exec), so
+    # the password read happens outside the Landlock confinement; ``env`` then
+    # execs claustrum, which Landlock-confines itself and execs opencode, so the
+    # server and every tool subprocess inherit the allowlist. None → no wrap.
+    wrap_prefix = f"{shlex.join(claustrum_wrap)} " if claustrum_wrap else ""
     cmd = (
         f"exec env "
         f"OPENCODE_SERVER_PASSWORD=\"$(cat {shlex.quote(host.workdir + '/' + pw_file)})\" "
-        f"{opencode_executable} web --port=0 --hostname={shlex.quote(hostname)}"
+        f"{wrap_prefix}{opencode_executable} web --port=0 --hostname={shlex.quote(hostname)}"
     )
 
     # OPENCODE_DB must point at the same per-task db file used by the
@@ -507,19 +584,40 @@ async def launch_opencode(
         cmd, env=env, cwd=host.workdir, env_remove=env_remove,
     )
 
+    # Retain the tail of the launch stream so a failed start surfaces its REASON.
+    # `opencode web` is a plain server (not a TUI), so its startup diagnostics —
+    # a bind error, an auth/config crash, a claustrum "operation not permitted"
+    # denial — arrive as ordinary lines on the merged stdout+stderr the loop
+    # below already consumes. Without retaining them, they are scanned by
+    # _READY_RE, discarded, and the operator sees only "exited before printing a
+    # URL". A bounded deque keeps memory flat on a chatty-but-successful start.
+    # No ANSI strip (unlike the tmux engines' pipe-pane mirror): server logs are
+    # plain text, not PTY-painted TUI frames.
+    from collections import deque
+
+    tail: "deque[str]" = deque(maxlen=40)
+
+    def _reason_suffix() -> str:
+        recent = "\n".join(tail).strip()
+        return f"; last output:\n{recent}" if recent else ""
+
     async def _read_url() -> int:
         async for raw in handle.stdout:
             if isinstance(raw, bytes):
                 line = raw.decode("utf-8", errors="replace").rstrip()
             else:
                 line = str(raw).rstrip()
+            if line:
+                tail.append(line)
             m = _READY_RE.search(line)
             if m:
                 m2 = re.search(r":(\d+)", m.group(1))
                 if not m2:
                     raise RuntimeError(f"could not find port in URL: {line}")
                 return int(m2.group(1))
-        raise RuntimeError("opencode exited before printing a URL")
+        raise RuntimeError(
+            f"opencode exited before printing a URL{_reason_suffix()}"
+        )
 
     try:
         port = await asyncio.wait_for(_read_url(), timeout=ready_timeout_s)
@@ -527,6 +625,7 @@ async def launch_opencode(
         await host.terminate_subprocess(handle, aggressive=True)
         raise TimeoutError(
             f"opencode did not print a listening URL within {ready_timeout_s}s"
+            f"{_reason_suffix()}"
         )
     except BaseException:
         await host.terminate_subprocess(handle, aggressive=True)

optio_opencode-0.5.0/src/optio_opencode/providers/__init__.py

@@ -0,0 +1,13 @@
+"""Per-provider account handlers for the opencode meta-analyzer.
+
+opencode has no native account — a seed's ``auth.json`` holds credentials for
+whichever third-party provider(s) the operator logged into. Each handler
+``async def handle(entry: dict) -> AccountInfo | None`` maps one provider's
+auth entry into the shared ``AccountInfo`` (or ``None`` → the meta-analyzer
+emits a placeholder). This phase ships the three OAuth reuse handlers
+(anthropic, openai, xai), each delegating to the extracted vendor map helper.
+"""
+
+from optio_opencode.providers import anthropic, openai, xai
+
+__all__ = ["anthropic", "openai", "xai"]

optio_opencode-0.5.0/src/optio_opencode/providers/anthropic.py

@@ -0,0 +1,33 @@
+"""anthropic provider handler — reuses claudecode's OAuth map helper.
+
+opencode's anthropic-oauth entry stores the same shape of OAuth access token
+claudecode drives, so we delegate to ``account_from_oauth_token`` rather than
+reimplement the profile+usage fetch. Imported at module scope so tests can
+monkeypatch it here (patch-where-used)."""
+
+from __future__ import annotations
+
+import logging
+
+from optio_agents.account import EMPTY, AccountInfo
+from optio_claudecode.account import account_from_oauth_token
+
+_LOG = logging.getLogger(__name__)
+
+
+async def handle(entry: dict) -> "AccountInfo | None":
+    """Map an anthropic auth entry → AccountInfo, or None (→ placeholder).
+
+    This phase handles ``oauth`` only; ``api`` (raw keys expose ~no account)
+    and any other type decline. Fail-soft: never raises."""
+    if entry.get("type") != "oauth":
+        return None
+    access = entry.get("access")
+    if not access:
+        return None
+    try:
+        info = await account_from_oauth_token(access)
+    except Exception:  # noqa: BLE001 — analysis must never break the meta-analyzer
+        _LOG.exception("anthropic account analysis failed")
+        return None
+    return info if info != EMPTY else None

optio_opencode-0.5.0/src/optio_opencode/providers/deepseek.py

@@ -0,0 +1,91 @@
+"""deepseek provider handler — api-key balance → AccountInfo.
+
+DeepSeek is an api-key-only provider with no identity endpoint: the account's
+only distinguishing surface is its prepaid balance. So this handler fetches
+``GET https://api.deepseek.com/user/balance`` (Bearer <key>) and maps the first
+``balance_infos`` row into ``plan`` — ``"DeepSeek · <total> <currency>"`` — so
+the pool popover shows the balance as the account label. Identity-less
+(name/email/account_id all None), no usage windows.
+
+The urllib GET runs in an executor via the ``_fetch`` seam (mirroring the reuse
+handlers' vendor helpers); tests monkeypatch ``_fetch`` — never the network.
+Fail-soft throughout: any decline/error → None so the meta-analyzer emits a
+placeholder instead of dropping the provider."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import urllib.request
+from urllib.error import HTTPError, URLError
+
+from optio_agents.account import AccountInfo
+
+_LOG = logging.getLogger(__name__)
+
+_BALANCE_URL = "https://api.deepseek.com/user/balance"
+_USER_AGENT = "optio-opencode/account (external)"
+_HTTP_TIMEOUT_S = 15
+
+
+# --- synchronous HTTP (run in an executor; no host) --------------------------
+
+
+def _get_sync(url: str, key: str) -> "dict | None":
+    """Bearer-authed read-only GET → parsed JSON dict, or None on any HTTP/parse
+    error (fail-soft)."""
+    req = urllib.request.Request(
+        url,
+        headers={
+            "Authorization": f"Bearer {key}",
+            "Accept": "application/json",
+            "User-Agent": _USER_AGENT,
+        },
+        method="GET",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT_S) as resp:
+            data = json.loads(resp.read().decode("utf-8"))
+        return data if isinstance(data, dict) else None
+    except (HTTPError, URLError, OSError, ValueError):
+        return None
+
+
+async def _fetch(key: str) -> "dict | None":
+    """Async wrapper around the sync Bearer GET (urllib in an executor). This is
+    the monkeypatch seam the tests replace to avoid network."""
+    return await asyncio.get_event_loop().run_in_executor(
+        None, _get_sync, _BALANCE_URL, key
+    )
+
+
+async def handle(entry: dict) -> "AccountInfo | None":
+    """Map a deepseek auth entry → AccountInfo, or None (→ placeholder).
+
+    Handles ``api`` only (deepseek has no oauth). Fail-soft: never raises. None
+    when the type is not ``api``, the key is missing, the fetch fails, or the
+    balance list is empty."""
+    if entry.get("type") != "api":
+        return None
+    key = entry.get("key")
+    if not key:
+        return None
+    try:
+        body = await _fetch(key)
+    except Exception:  # noqa: BLE001 — analysis must never break the meta-analyzer
+        _LOG.exception("deepseek account analysis failed")
+        return None
+    if not isinstance(body, dict):
+        return None
+    infos = body.get("balance_infos")
+    if not isinstance(infos, list) or not infos:
+        return None
+    first = infos[0]
+    total_balance = first.get("total_balance")
+    currency = first.get("currency")
+    return AccountInfo(
+        plan=f"Balance {total_balance} {currency}",
+        windows=(),
+        raw={"balance": body},
+    )

optio_opencode-0.5.0/src/optio_opencode/providers/openai.py

@@ -0,0 +1,33 @@
+"""openai provider handler — reuses codex's OAuth map helper.
+
+opencode's openai-oauth entry stores ``{access, accountId}`` with **no**
+``id_token``, so identity comes from codex's ``account_from_openai`` (which
+fetches ``GET /backend-api/me`` rather than decoding an id_token). Imported at
+module scope so tests can monkeypatch it here (patch-where-used)."""
+
+from __future__ import annotations
+
+import logging
+
+from optio_agents.account import EMPTY, AccountInfo
+from optio_codex.account import account_from_openai
+
+_LOG = logging.getLogger(__name__)
+
+
+async def handle(entry: dict) -> "AccountInfo | None":
+    """Map an openai auth entry → AccountInfo, or None (→ placeholder).
+
+    This phase handles ``oauth`` only (raw ``api`` keys are admin-gated for
+    account/usage). Fail-soft: never raises."""
+    if entry.get("type") != "oauth":
+        return None
+    access = entry.get("access")
+    if not access:
+        return None
+    try:
+        info = await account_from_openai(access, entry.get("accountId"))
+    except Exception:  # noqa: BLE001 — analysis must never break the meta-analyzer
+        _LOG.exception("openai account analysis failed")
+        return None
+    return info if info != EMPTY else None