chore: initialize qiming workspace repository

qimingcode/packages/opencode/src/plugin/cloudflare.ts

@@ -0,0 +1,76 @@
+import type { Hooks, PluginInput } from "@opencode-ai/plugin"
+
+export async function CloudflareWorkersAuthPlugin(_input: PluginInput): Promise<Hooks> {
+  const prompts = !process.env.CLOUDFLARE_ACCOUNT_ID
+    ? [
+        {
+          type: "text" as const,
+          key: "accountId",
+          message: "Enter your Cloudflare Account ID",
+          placeholder: "e.g. 1234567890abcdef1234567890abcdef",
+        },
+      ]
+    : []
+
+  return {
+    auth: {
+      provider: "cloudflare-workers-ai",
+      methods: [
+        {
+          type: "api",
+          label: "API key",
+          prompts,
+        },
+      ],
+    },
+  }
+}
+
+export async function CloudflareAIGatewayAuthPlugin(_input: PluginInput): Promise<Hooks> {
+  const prompts = [
+    ...(!process.env.CLOUDFLARE_ACCOUNT_ID
+      ? [
+          {
+            type: "text" as const,
+            key: "accountId",
+            message: "Enter your Cloudflare Account ID",
+            placeholder: "e.g. 1234567890abcdef1234567890abcdef",
+          },
+        ]
+      : []),
+    ...(!process.env.CLOUDFLARE_GATEWAY_ID
+      ? [
+          {
+            type: "text" as const,
+            key: "gatewayId",
+            message: "Enter your Cloudflare AI Gateway ID",
+            placeholder: "e.g. my-gateway",
+          },
+        ]
+      : []),
+  ]
+
+  return {
+    auth: {
+      provider: "cloudflare-ai-gateway",
+      methods: [
+        {
+          type: "api",
+          label: "Gateway API token",
+          prompts,
+        },
+      ],
+    },
+    "chat.params": async (input, output) => {
+      if (input.model.providerID !== "cloudflare-ai-gateway") return
+      // The unified gateway routes through @ai-sdk/openai-compatible, which
+      // always emits max_tokens. OpenAI reasoning models (gpt-5.x, o-series)
+      // reject that field and require max_completion_tokens instead, and the
+      // compatible SDK has no way to rename it. Drop the cap so OpenAI falls
+      // back to the model's default output budget.
+      if (!input.model.api.id.toLowerCase().startsWith("openai/")) return
+      if (!input.model.capabilities.reasoning) return
+      output.maxOutputTokens = undefined
+    },
+  }
+}

qimingcode/packages/opencode/src/plugin/codex.ts

@@ -0,0 +1,619 @@
+import type { Hooks, PluginInput } from "@opencode-ai/plugin"
+import { Log } from "../util"
+import { Installation } from "../installation"
+import { InstallationVersion } from "@opencode-ai/core/installation/version"
+import { OAUTH_DUMMY_KEY } from "../auth"
+import os from "os"
+import { setTimeout as sleep } from "node:timers/promises"
+import { createServer } from "http"
+
+const log = Log.create({ service: "plugin.codex" })
+
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+const ISSUER = "https://auth.openai.com"
+const CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses"
+const OAUTH_PORT = 1455
+const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000
+
+interface PkceCodes {
+  verifier: string
+  challenge: string
+}
+
+async function generatePKCE(): Promise<PkceCodes> {
+  const verifier = generateRandomString(43)
+  const encoder = new TextEncoder()
+  const data = encoder.encode(verifier)
+  const hash = await crypto.subtle.digest("SHA-256", data)
+  const challenge = base64UrlEncode(hash)
+  return { verifier, challenge }
+}
+
+function generateRandomString(length: number): string {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
+  const bytes = crypto.getRandomValues(new Uint8Array(length))
+  return Array.from(bytes)
+    .map((b) => chars[b % chars.length])
+    .join("")
+}
+
+function base64UrlEncode(buffer: ArrayBuffer): string {
+  const bytes = new Uint8Array(buffer)
+  const binary = String.fromCharCode(...bytes)
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+}
+
+function generateState(): string {
+  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer)
+}
+
+export interface IdTokenClaims {
+  chatgpt_account_id?: string
+  organizations?: Array<{ id: string }>
+  email?: string
+  "https://api.openai.com/auth"?: {
+    chatgpt_account_id?: string
+  }
+}
+
+export function parseJwtClaims(token: string): IdTokenClaims | undefined {
+  const parts = token.split(".")
+  if (parts.length !== 3) return undefined
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString())
+  } catch {
+    return undefined
+  }
+}
+
+export function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined {
+  return (
+    claims.chatgpt_account_id ||
+    claims["https://api.openai.com/auth"]?.chatgpt_account_id ||
+    claims.organizations?.[0]?.id
+  )
+}
+
+export function extractAccountId(tokens: TokenResponse): string | undefined {
+  if (tokens.id_token) {
+    const claims = parseJwtClaims(tokens.id_token)
+    const accountId = claims && extractAccountIdFromClaims(claims)
+    if (accountId) return accountId
+  }
+  if (tokens.access_token) {
+    const claims = parseJwtClaims(tokens.access_token)
+    return claims ? extractAccountIdFromClaims(claims) : undefined
+  }
+  return undefined
+}
+
+function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string): string {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: redirectUri,
+    scope: "openid profile email offline_access",
+    code_challenge: pkce.challenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state,
+    originator: "opencode",
+  })
+  return `${ISSUER}/oauth/authorize?${params.toString()}`
+}
+
+interface TokenResponse {
+  id_token: string
+  access_token: string
+  refresh_token: string
+  expires_in?: number
+}
+
+async function exchangeCodeForTokens(code: string, redirectUri: string, pkce: PkceCodes): Promise<TokenResponse> {
+  const response = await fetch(`${ISSUER}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: CLIENT_ID,
+      code_verifier: pkce.verifier,
+    }).toString(),
+  })
+  if (!response.ok) {
+    throw new Error(`Token exchange failed: ${response.status}`)
+  }
+  return response.json()
+}
+
+async function refreshAccessToken(refreshToken: string): Promise<TokenResponse> {
+  const response = await fetch(`${ISSUER}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID,
+    }).toString(),
+  })
+  if (!response.ok) {
+    throw new Error(`Token refresh failed: ${response.status}`)
+  }
+  return response.json()
+}
+
+const HTML_SUCCESS = `<!doctype html>
+<html>
+  <head>
+    <title>OpenCode - Codex Authorization Successful</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #f1ecec;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Successful</h1>
+      <p>You can close this window and return to OpenCode.</p>
+    </div>
+    <script>
+      setTimeout(() => window.close(), 2000)
+    </script>
+  </body>
+</html>`
+
+const HTML_ERROR = (error: string) => `<!doctype html>
+<html>
+  <head>
+    <title>OpenCode - Codex Authorization Failed</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #fc533a;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+      .error {
+        color: #ff917b;
+        font-family: monospace;
+        margin-top: 1rem;
+        padding: 1rem;
+        background: #3c140d;
+        border-radius: 0.5rem;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Failed</h1>
+      <p>An error occurred during authorization.</p>
+      <div class="error">${error}</div>
+    </div>
+  </body>
+</html>`
+
+interface PendingOAuth {
+  pkce: PkceCodes
+  state: string
+  resolve: (tokens: TokenResponse) => void
+  reject: (error: Error) => void
+}
+
+let oauthServer: ReturnType<typeof createServer> | undefined
+let pendingOAuth: PendingOAuth | undefined
+
+async function startOAuthServer(): Promise<{ port: number; redirectUri: string }> {
+  if (oauthServer) {
+    return { port: OAUTH_PORT, redirectUri: `http://localhost:${OAUTH_PORT}/auth/callback` }
+  }
+
+  oauthServer = createServer((req, res) => {
+    const url = new URL(req.url || "/", `http://localhost:${OAUTH_PORT}`)
+
+    if (url.pathname === "/auth/callback") {
+      const code = url.searchParams.get("code")
+      const state = url.searchParams.get("state")
+      const error = url.searchParams.get("error")
+      const errorDescription = url.searchParams.get("error_description")
+
+      if (error) {
+        const errorMsg = errorDescription || error
+        pendingOAuth?.reject(new Error(errorMsg))
+        pendingOAuth = undefined
+        res.writeHead(200, { "Content-Type": "text/html" })
+        res.end(HTML_ERROR(errorMsg))
+        return
+      }
+
+      if (!code) {
+        const errorMsg = "Missing authorization code"
+        pendingOAuth?.reject(new Error(errorMsg))
+        pendingOAuth = undefined
+        res.writeHead(400, { "Content-Type": "text/html" })
+        res.end(HTML_ERROR(errorMsg))
+        return
+      }
+
+      if (!pendingOAuth || state !== pendingOAuth.state) {
+        const errorMsg = "Invalid state - potential CSRF attack"
+        pendingOAuth?.reject(new Error(errorMsg))
+        pendingOAuth = undefined
+        res.writeHead(400, { "Content-Type": "text/html" })
+        res.end(HTML_ERROR(errorMsg))
+        return
+      }
+
+      const current = pendingOAuth
+      pendingOAuth = undefined
+
+      exchangeCodeForTokens(code, `http://localhost:${OAUTH_PORT}/auth/callback`, current.pkce)
+        .then((tokens) => current.resolve(tokens))
+        .catch((err) => current.reject(err))
+
+      res.writeHead(200, { "Content-Type": "text/html" })
+      res.end(HTML_SUCCESS)
+      return
+    }
+
+    if (url.pathname === "/cancel") {
+      pendingOAuth?.reject(new Error("Login cancelled"))
+      pendingOAuth = undefined
+      res.writeHead(200)
+      res.end("Login cancelled")
+      return
+    }
+
+    res.writeHead(404)
+    res.end("Not found")
+  })
+
+  await new Promise<void>((resolve, reject) => {
+    oauthServer!.listen(OAUTH_PORT, () => {
+      log.info("codex oauth server started", { port: OAUTH_PORT })
+      resolve()
+    })
+    oauthServer!.on("error", reject)
+  })
+
+  return { port: OAUTH_PORT, redirectUri: `http://localhost:${OAUTH_PORT}/auth/callback` }
+}
+
+function stopOAuthServer() {
+  if (oauthServer) {
+    oauthServer.close(() => {
+      log.info("codex oauth server stopped")
+    })
+    oauthServer = undefined
+  }
+}
+
+function waitForOAuthCallback(pkce: PkceCodes, state: string): Promise<TokenResponse> {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(
+      () => {
+        if (pendingOAuth) {
+          pendingOAuth = undefined
+          reject(new Error("OAuth callback timeout - authorization took too long"))
+        }
+      },
+      5 * 60 * 1000,
+    ) // 5 minute timeout
+
+    pendingOAuth = {
+      pkce,
+      state,
+      resolve: (tokens) => {
+        clearTimeout(timeout)
+        resolve(tokens)
+      },
+      reject: (error) => {
+        clearTimeout(timeout)
+        reject(error)
+      },
+    }
+  })
+}
+
+export async function CodexAuthPlugin(input: PluginInput): Promise<Hooks> {
+  return {
+    auth: {
+      provider: "openai",
+      async loader(getAuth, provider) {
+        const auth = await getAuth()
+        if (auth.type !== "oauth") return {}
+
+        // Filter models to only allowed Codex models for OAuth
+        const allowedModels = new Set([
+          "gpt-5.1-codex",
+          "gpt-5.1-codex-max",
+          "gpt-5.1-codex-mini",
+          "gpt-5.2",
+          "gpt-5.2-codex",
+          "gpt-5.3-codex",
+          "gpt-5.4",
+          "gpt-5.4-mini",
+        ])
+        for (const [modelId, model] of Object.entries(provider.models)) {
+          if (modelId.includes("codex")) continue
+          if (allowedModels.has(model.api.id)) continue
+          const match = model.api.id.match(/^gpt-(\d+\.\d+)/)
+          if (match && parseFloat(match[1]) > 5.4) continue
+          delete provider.models[modelId]
+        }
+
+        // Zero out costs for Codex (included with ChatGPT subscription)
+        for (const model of Object.values(provider.models)) {
+          model.cost = {
+            input: 0,
+            output: 0,
+            cache: { read: 0, write: 0 },
+          }
+
+          // gpt-5.5 models temporarily have restricted context window size for codex plans
+          if (model.id.includes("gpt-5.5")) {
+            model.limit = {
+              context: 400_000,
+              //@ts-expect-error incorrect type for v1 sdk but works
+              input: 272_000,
+              output: 128_000,
+            }
+          }
+        }
+
+        return {
+          apiKey: OAUTH_DUMMY_KEY,
+          async fetch(requestInput: RequestInfo | URL, init?: RequestInit) {
+            // Remove dummy API key authorization header
+            if (init?.headers) {
+              if (init.headers instanceof Headers) {
+                init.headers.delete("authorization")
+                init.headers.delete("Authorization")
+              } else if (Array.isArray(init.headers)) {
+                init.headers = init.headers.filter(([key]) => key.toLowerCase() !== "authorization")
+              } else {
+                delete init.headers["authorization"]
+                delete init.headers["Authorization"]
+              }
+            }
+
+            const currentAuth = await getAuth()
+            if (currentAuth.type !== "oauth") return fetch(requestInput, init)
+
+            // Cast to include accountId field
+            const authWithAccount = currentAuth as typeof currentAuth & { accountId?: string }
+
+            // Check if token needs refresh
+            if (!currentAuth.access || currentAuth.expires < Date.now()) {
+              log.info("refreshing codex access token")
+              const tokens = await refreshAccessToken(currentAuth.refresh)
+              const newAccountId = extractAccountId(tokens) || authWithAccount.accountId
+              await input.client.auth.set({
+                path: { id: "openai" },
+                body: {
+                  type: "oauth",
+                  refresh: tokens.refresh_token,
+                  access: tokens.access_token,
+                  expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                  ...(newAccountId && { accountId: newAccountId }),
+                },
+              })
+              currentAuth.access = tokens.access_token
+              authWithAccount.accountId = newAccountId
+            }
+
+            // Build headers
+            const headers = new Headers()
+            if (init?.headers) {
+              if (init.headers instanceof Headers) {
+                init.headers.forEach((value, key) => headers.set(key, value))
+              } else if (Array.isArray(init.headers)) {
+                for (const [key, value] of init.headers) {
+                  if (value !== undefined) headers.set(key, String(value))
+                }
+              } else {
+                for (const [key, value] of Object.entries(init.headers)) {
+                  if (value !== undefined) headers.set(key, String(value))
+                }
+              }
+            }
+
+            // Set authorization header with access token
+            headers.set("authorization", `Bearer ${currentAuth.access}`)
+
+            // Set ChatGPT-Account-Id header for organization subscriptions
+            if (authWithAccount.accountId) {
+              headers.set("ChatGPT-Account-Id", authWithAccount.accountId)
+            }
+
+            // Rewrite URL to Codex endpoint
+            const parsed =
+              requestInput instanceof URL
+                ? requestInput
+                : new URL(typeof requestInput === "string" ? requestInput : requestInput.url)
+            const url =
+              parsed.pathname.includes("/v1/responses") || parsed.pathname.includes("/chat/completions")
+                ? new URL(CODEX_API_ENDPOINT)
+                : parsed
+
+            return fetch(url, {
+              ...init,
+              headers,
+            })
+          },
+        }
+      },
+      methods: [
+        {
+          label: "ChatGPT Pro/Plus (browser)",
+          type: "oauth",
+          authorize: async () => {
+            const { redirectUri } = await startOAuthServer()
+            const pkce = await generatePKCE()
+            const state = generateState()
+            const authUrl = buildAuthorizeUrl(redirectUri, pkce, state)
+
+            const callbackPromise = waitForOAuthCallback(pkce, state)
+
+            return {
+              url: authUrl,
+              instructions: "Complete authorization in your browser. This window will close automatically.",
+              method: "auto" as const,
+              callback: async () => {
+                const tokens = await callbackPromise
+                stopOAuthServer()
+                const accountId = extractAccountId(tokens)
+                return {
+                  type: "success" as const,
+                  refresh: tokens.refresh_token,
+                  access: tokens.access_token,
+                  expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                  accountId,
+                }
+              },
+            }
+          },
+        },
+        {
+          label: "ChatGPT Pro/Plus (headless)",
+          type: "oauth",
+          authorize: async () => {
+            const deviceResponse = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                "User-Agent": `opencode/${InstallationVersion}`,
+              },
+              body: JSON.stringify({ client_id: CLIENT_ID }),
+            })
+
+            if (!deviceResponse.ok) throw new Error("Failed to initiate device authorization")
+
+            const deviceData = (await deviceResponse.json()) as {
+              device_auth_id: string
+              user_code: string
+              interval: string
+            }
+            const interval = Math.max(parseInt(deviceData.interval) || 5, 1) * 1000
+
+            return {
+              url: `${ISSUER}/codex/device`,
+              instructions: `Enter code: ${deviceData.user_code}`,
+              method: "auto" as const,
+              async callback() {
+                while (true) {
+                  const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
+                    method: "POST",
+                    headers: {
+                      "Content-Type": "application/json",
+                      "User-Agent": `opencode/${InstallationVersion}`,
+                    },
+                    body: JSON.stringify({
+                      device_auth_id: deviceData.device_auth_id,
+                      user_code: deviceData.user_code,
+                    }),
+                  })
+
+                  if (response.ok) {
+                    const data = (await response.json()) as {
+                      authorization_code: string
+                      code_verifier: string
+                    }
+
+                    const tokenResponse = await fetch(`${ISSUER}/oauth/token`, {
+                      method: "POST",
+                      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                      body: new URLSearchParams({
+                        grant_type: "authorization_code",
+                        code: data.authorization_code,
+                        redirect_uri: `${ISSUER}/deviceauth/callback`,
+                        client_id: CLIENT_ID,
+                        code_verifier: data.code_verifier,
+                      }).toString(),
+                    })
+
+                    if (!tokenResponse.ok) {
+                      throw new Error(`Token exchange failed: ${tokenResponse.status}`)
+                    }
+
+                    const tokens: TokenResponse = await tokenResponse.json()
+
+                    return {
+                      type: "success" as const,
+                      refresh: tokens.refresh_token,
+                      access: tokens.access_token,
+                      expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                      accountId: extractAccountId(tokens),
+                    }
+                  }
+
+                  if (response.status !== 403 && response.status !== 404) {
+                    return { type: "failed" as const }
+                  }
+
+                  await sleep(interval + OAUTH_POLLING_SAFETY_MARGIN_MS)
+                }
+              },
+            }
+          },
+        },
+        {
+          label: "Manually enter API Key",
+          type: "api",
+        },
+      ],
+    },
+    "chat.headers": async (input, output) => {
+      if (input.model.providerID !== "openai") return
+      output.headers.originator = "opencode"
+      output.headers["User-Agent"] = `opencode/${InstallationVersion} (${os.platform()} ${os.release()}; ${os.arch()})`
+      output.headers.session_id = input.sessionID
+    },
+    "chat.params": async (input, output) => {
+      if (input.model.providerID !== "openai") return
+      // Match codex cli
+      output.maxOutputTokens = undefined
+    },
+  }
+}

qimingcode/packages/opencode/src/plugin/github-copilot/copilot.ts

@@ -0,0 +1,394 @@
+import type { Hooks, PluginInput } from "@opencode-ai/plugin"
+import type { Model } from "@opencode-ai/sdk/v2"
+import { InstallationVersion } from "@opencode-ai/core/installation/version"
+import { iife } from "@/util/iife"
+import { Log } from "../../util"
+import { setTimeout as sleep } from "node:timers/promises"
+import { CopilotModels } from "./models"
+import { MessageV2 } from "@/session/message-v2"
+
+const log = Log.create({ service: "plugin.copilot" })
+
+const CLIENT_ID = "Ov23li8tweQw6odWQebz"
+// Add a small safety buffer when polling to avoid hitting the server
+// slightly too early due to clock skew / timer drift.
+const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000 // 3 seconds
+function normalizeDomain(url: string) {
+  return url.replace(/^https?:\/\//, "").replace(/\/$/, "")
+}
+
+function getUrls(domain: string) {
+  return {
+    DEVICE_CODE_URL: `https://${domain}/login/device/code`,
+    ACCESS_TOKEN_URL: `https://${domain}/login/oauth/access_token`,
+  }
+}
+
+function base(enterpriseUrl?: string) {
+  return enterpriseUrl ? `https://copilot-api.${normalizeDomain(enterpriseUrl)}` : "https://api.githubcopilot.com"
+}
+
+// Check if a message is a synthetic user msg used to attach an image from a tool call
+function imgMsg(msg: any): boolean {
+  if (msg?.role !== "user") return false
+
+  // Handle the 3 api formats
+
+  const content = msg.content
+  if (typeof content === "string") return content === MessageV2.SYNTHETIC_ATTACHMENT_PROMPT
+  if (!Array.isArray(content)) return false
+  return content.some(
+    (part: any) =>
+      (part?.type === "text" || part?.type === "input_text") && part.text === MessageV2.SYNTHETIC_ATTACHMENT_PROMPT,
+  )
+}
+
+function fix(model: Model, url: string): Model {
+  return {
+    ...model,
+    api: {
+      ...model.api,
+      url,
+      npm: "@ai-sdk/github-copilot",
+    },
+  }
+}
+
+export async function CopilotAuthPlugin(input: PluginInput): Promise<Hooks> {
+  const sdk = input.client
+  return {
+    provider: {
+      id: "github-copilot",
+      async models(provider, ctx) {
+        if (ctx.auth?.type !== "oauth") {
+          return Object.fromEntries(Object.entries(provider.models).map(([id, model]) => [id, fix(model, base())]))
+        }
+
+        const auth = ctx.auth
+
+        return CopilotModels.get(
+          base(auth.enterpriseUrl),
+          {
+            Authorization: `Bearer ${auth.refresh}`,
+            "User-Agent": `opencode/${InstallationVersion}`,
+          },
+          provider.models,
+        ).catch((error) => {
+          log.error("failed to fetch copilot models", { error })
+          return Object.fromEntries(
+            Object.entries(provider.models).map(([id, model]) => [id, fix(model, base(auth.enterpriseUrl))]),
+          )
+        })
+      },
+    },
+    auth: {
+      provider: "github-copilot",
+      async loader(getAuth) {
+        const info = await getAuth()
+        if (!info || info.type !== "oauth") return {}
+
+        return {
+          apiKey: "",
+          async fetch(request: RequestInfo | URL, init?: RequestInit) {
+            const info = await getAuth()
+            if (info.type !== "oauth") return fetch(request, init)
+
+            const url = request instanceof URL ? request.href : typeof request === "string" ? request : request.url
+            const { isVision, isAgent } = iife(() => {
+              try {
+                const body = typeof init?.body === "string" ? JSON.parse(init.body) : init?.body
+
+                // Completions API
+                if (body?.messages && url.includes("completions")) {
+                  const last = body.messages[body.messages.length - 1]
+                  return {
+                    isVision: body.messages.some(
+                      (msg: any) =>
+                        Array.isArray(msg.content) && msg.content.some((part: any) => part.type === "image_url"),
+                    ),
+                    isAgent: last?.role !== "user" || imgMsg(last),
+                  }
+                }
+
+                // Responses API
+                if (body?.input) {
+                  const last = body.input[body.input.length - 1]
+                  return {
+                    isVision: body.input.some(
+                      (item: any) =>
+                        Array.isArray(item?.content) && item.content.some((part: any) => part.type === "input_image"),
+                    ),
+                    isAgent: last?.role !== "user" || imgMsg(last),
+                  }
+                }
+
+                // Messages API
+                if (body?.messages) {
+                  const last = body.messages[body.messages.length - 1]
+                  const hasNonToolCalls =
+                    Array.isArray(last?.content) && last.content.some((part: any) => part?.type !== "tool_result")
+                  return {
+                    isVision: body.messages.some(
+                      (item: any) =>
+                        Array.isArray(item?.content) &&
+                        item.content.some(
+                          (part: any) =>
+                            part?.type === "image" ||
+                            // images can be nested inside tool_result content
+                            (part?.type === "tool_result" &&
+                              Array.isArray(part?.content) &&
+                              part.content.some((nested: any) => nested?.type === "image")),
+                        ),
+                    ),
+                    isAgent: !(last?.role === "user" && hasNonToolCalls) || imgMsg(last),
+                  }
+                }
+              } catch {}
+              return { isVision: false, isAgent: false }
+            })
+
+            const headers: Record<string, string> = {
+              "x-initiator": isAgent ? "agent" : "user",
+              ...(init?.headers as Record<string, string>),
+              "User-Agent": `opencode/${InstallationVersion}`,
+              Authorization: `Bearer ${info.refresh}`,
+              "Openai-Intent": "conversation-edits",
+            }
+
+            if (isVision) {
+              headers["Copilot-Vision-Request"] = "true"
+            }
+
+            delete headers["x-api-key"]
+            delete headers["authorization"]
+
+            return fetch(request, {
+              ...init,
+              headers,
+            })
+          },
+        }
+      },
+      methods: [
+        {
+          type: "oauth",
+          label: "Login with GitHub Copilot",
+          prompts: [
+            {
+              type: "select",
+              key: "deploymentType",
+              message: "Select GitHub deployment type",
+              options: [
+                {
+                  label: "GitHub.com",
+                  value: "github.com",
+                  hint: "Public",
+                },
+                {
+                  label: "GitHub Enterprise",
+                  value: "enterprise",
+                  hint: "Data residency or self-hosted",
+                },
+              ],
+            },
+            {
+              type: "text",
+              key: "enterpriseUrl",
+              message: "Enter your GitHub Enterprise URL or domain",
+              placeholder: "company.ghe.com or https://company.ghe.com",
+              when: { key: "deploymentType", op: "eq", value: "enterprise" },
+              validate: (value) => {
+                if (!value) return "URL or domain is required"
+                try {
+                  const url = value.includes("://") ? new URL(value) : new URL(`https://${value}`)
+                  if (!url.hostname) return "Please enter a valid URL or domain"
+                  return undefined
+                } catch {
+                  return "Please enter a valid URL (e.g., company.ghe.com or https://company.ghe.com)"
+                }
+              },
+            },
+          ],
+          async authorize(inputs = {}) {
+            const deploymentType = inputs.deploymentType || "github.com"
+
+            let domain = "github.com"
+
+            if (deploymentType === "enterprise") {
+              const enterpriseUrl = inputs.enterpriseUrl
+              domain = normalizeDomain(enterpriseUrl!)
+            }
+
+            const urls = getUrls(domain)
+
+            const deviceResponse = await fetch(urls.DEVICE_CODE_URL, {
+              method: "POST",
+              headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+                "User-Agent": `opencode/${InstallationVersion}`,
+              },
+              body: JSON.stringify({
+                client_id: CLIENT_ID,
+                scope: "read:user",
+              }),
+            })
+
+            if (!deviceResponse.ok) {
+              throw new Error("Failed to initiate device authorization")
+            }
+
+            const deviceData = (await deviceResponse.json()) as {
+              verification_uri: string
+              user_code: string
+              device_code: string
+              interval: number
+            }
+
+            return {
+              url: deviceData.verification_uri,
+              instructions: `Enter code: ${deviceData.user_code}`,
+              method: "auto" as const,
+              async callback() {
+                while (true) {
+                  const response = await fetch(urls.ACCESS_TOKEN_URL, {
+                    method: "POST",
+                    headers: {
+                      Accept: "application/json",
+                      "Content-Type": "application/json",
+                      "User-Agent": `opencode/${InstallationVersion}`,
+                    },
+                    body: JSON.stringify({
+                      client_id: CLIENT_ID,
+                      device_code: deviceData.device_code,
+                      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    }),
+                  })
+
+                  if (!response.ok) return { type: "failed" as const }
+
+                  const data = (await response.json()) as {
+                    access_token?: string
+                    error?: string
+                    interval?: number
+                  }
+
+                  if (data.access_token) {
+                    const result: {
+                      type: "success"
+                      refresh: string
+                      access: string
+                      expires: number
+                      provider?: string
+                      enterpriseUrl?: string
+                    } = {
+                      type: "success",
+                      refresh: data.access_token,
+                      access: data.access_token,
+                      expires: 0,
+                    }
+
+                    if (deploymentType === "enterprise") {
+                      result.enterpriseUrl = domain
+                    }
+
+                    return result
+                  }
+
+                  if (data.error === "authorization_pending") {
+                    await sleep(deviceData.interval * 1000 + OAUTH_POLLING_SAFETY_MARGIN_MS)
+                    continue
+                  }
+
+                  if (data.error === "slow_down") {
+                    // Based on the RFC spec, we must add 5 seconds to our current polling interval.
+                    // (See https://www.rfc-editor.org/rfc/rfc8628#section-3.5)
+                    let newInterval = (deviceData.interval + 5) * 1000
+
+                    // GitHub OAuth API may return the new interval in seconds in the response.
+                    // We should try to use that if provided with safety margin.
+                    const serverInterval = data.interval
+                    if (serverInterval && typeof serverInterval === "number" && serverInterval > 0) {
+                      newInterval = serverInterval * 1000
+                    }
+
+                    await sleep(newInterval + OAUTH_POLLING_SAFETY_MARGIN_MS)
+                    continue
+                  }
+
+                  if (data.error) return { type: "failed" as const }
+
+                  await sleep(deviceData.interval * 1000 + OAUTH_POLLING_SAFETY_MARGIN_MS)
+                  continue
+                }
+              },
+            }
+          },
+        },
+      ],
+    },
+    "chat.params": async (incoming, output) => {
+      if (!incoming.model.providerID.includes("github-copilot")) return
+
+      // Match github copilot cli, omit maxOutputTokens for gpt models
+      if (incoming.model.api.id.includes("gpt")) {
+        output.maxOutputTokens = undefined
+      }
+
+      // GitHub Copilot's /v1/messages shim rejects the GA `eager_input_streaming`
+      // field on tool definitions ("Extra inputs are not permitted"). Opt out of
+      // the @ai-sdk/anthropic default so it stops injecting the field.
+      if (incoming.model.api.npm === "@ai-sdk/anthropic") {
+        output.options.toolStreaming = false
+      }
+    },
+    "chat.headers": async (incoming, output) => {
+      if (!incoming.model.providerID.includes("github-copilot")) return
+
+      if (incoming.model.api.npm === "@ai-sdk/anthropic") {
+        output.headers["anthropic-beta"] = "interleaved-thinking-2025-05-14"
+      }
+
+      const parts = await sdk.session
+        .message({
+          path: {
+            id: incoming.message.sessionID,
+            messageID: incoming.message.id,
+          },
+          query: {
+            directory: input.directory,
+          },
+          throwOnError: true,
+        })
+        .catch(() => undefined)
+
+      if (
+        parts?.data.parts?.some(
+          (part) =>
+            part.type === "compaction" ||
+            // Auto-compaction resumes via a synthetic user text part. Treat only
+            // that marked followup as agent-initiated so manual prompts stay user-initiated.
+            (part.type === "text" && part.synthetic && part.metadata?.compaction_continue === true),
+        )
+      ) {
+        output.headers["x-initiator"] = "agent"
+        return
+      }
+
+      const session = await sdk.session
+        .get({
+          path: {
+            id: incoming.sessionID,
+          },
+          query: {
+            directory: input.directory,
+          },
+          throwOnError: true,
+        })
+        .catch(() => undefined)
+      if (!session || !session.data.parentID) return
+      // mark subagent sessions as agent initiated matching standard that other copilot tools have
+      output.headers["x-initiator"] = "agent"
+    },
+  }
+}

qimingcode/packages/opencode/src/plugin/github-copilot/models.ts

@@ -0,0 +1,153 @@
+import { z } from "zod"
+import type { Model } from "@opencode-ai/sdk/v2"
+
+export const schema = z.object({
+  data: z.array(
+    z.object({
+      model_picker_enabled: z.boolean(),
+      id: z.string(),
+      name: z.string(),
+      // every version looks like: `{model.id}-YYYY-MM-DD`
+      version: z.string(),
+      supported_endpoints: z.array(z.string()).optional(),
+      policy: z
+        .object({
+          state: z.string().optional(),
+        })
+        .optional(),
+      capabilities: z.object({
+        family: z.string(),
+        limits: z.object({
+          max_context_window_tokens: z.number(),
+          max_output_tokens: z.number(),
+          max_prompt_tokens: z.number(),
+          vision: z
+            .object({
+              max_prompt_image_size: z.number(),
+              max_prompt_images: z.number(),
+              supported_media_types: z.array(z.string()),
+            })
+            .optional(),
+        }),
+        supports: z.object({
+          adaptive_thinking: z.boolean().optional(),
+          max_thinking_budget: z.number().optional(),
+          min_thinking_budget: z.number().optional(),
+          reasoning_effort: z.array(z.string()).optional(),
+          streaming: z.boolean(),
+          structured_outputs: z.boolean().optional(),
+          tool_calls: z.boolean(),
+          vision: z.boolean().optional(),
+        }),
+      }),
+    }),
+  ),
+})
+
+type Item = z.infer<typeof schema>["data"][number]
+
+function build(key: string, remote: Item, url: string, prev?: Model): Model {
+  const reasoning =
+    !!remote.capabilities.supports.adaptive_thinking ||
+    !!remote.capabilities.supports.reasoning_effort?.length ||
+    remote.capabilities.supports.max_thinking_budget !== undefined ||
+    remote.capabilities.supports.min_thinking_budget !== undefined
+  const image =
+    (remote.capabilities.supports.vision ?? false) ||
+    (remote.capabilities.limits.vision?.supported_media_types ?? []).some((item) => item.startsWith("image/"))
+
+  const isMsgApi = remote.supported_endpoints?.includes("/v1/messages")
+
+  return {
+    id: key,
+    providerID: "github-copilot",
+    api: {
+      id: remote.id,
+      url: isMsgApi ? `${url}/v1` : url,
+      npm: isMsgApi ? "@ai-sdk/anthropic" : "@ai-sdk/github-copilot",
+    },
+    // API response wins
+    status: "active",
+    limit: {
+      context: remote.capabilities.limits.max_context_window_tokens,
+      input: remote.capabilities.limits.max_prompt_tokens,
+      output: remote.capabilities.limits.max_output_tokens,
+    },
+    capabilities: {
+      temperature: prev?.capabilities.temperature ?? true,
+      reasoning: prev?.capabilities.reasoning ?? reasoning,
+      attachment: prev?.capabilities.attachment ?? true,
+      toolcall: remote.capabilities.supports.tool_calls,
+      input: {
+        text: true,
+        audio: false,
+        image,
+        video: false,
+        pdf: false,
+      },
+      output: {
+        text: true,
+        audio: false,
+        image: false,
+        video: false,
+        pdf: false,
+      },
+      interleaved: false,
+    },
+    // existing wins
+    family: prev?.family ?? remote.capabilities.family,
+    name: prev?.name ?? remote.name,
+    cost: {
+      input: 0,
+      output: 0,
+      cache: { read: 0, write: 0 },
+    },
+    options: prev?.options ?? {},
+    headers: prev?.headers ?? {},
+    release_date:
+      prev?.release_date ??
+      (remote.version.startsWith(`${remote.id}-`) ? remote.version.slice(remote.id.length + 1) : remote.version),
+    variants: prev?.variants ?? {},
+  }
+}
+
+export async function get(
+  baseURL: string,
+  headers: HeadersInit = {},
+  existing: Record<string, Model> = {},
+): Promise<Record<string, Model>> {
+  const data = await fetch(`${baseURL}/models`, {
+    headers,
+    signal: AbortSignal.timeout(5_000),
+  }).then(async (res) => {
+    if (!res.ok) {
+      throw new Error(`Failed to fetch models: ${res.status}`)
+    }
+    return schema.parse(await res.json())
+  })
+
+  const result = { ...existing }
+  const remote = new Map(
+    data.data.filter((m) => m.model_picker_enabled && m.policy?.state !== "disabled").map((m) => [m.id, m] as const),
+  )
+
+  // prune existing models whose api.id isn't in the endpoint response
+  for (const [key, model] of Object.entries(result)) {
+    const m = remote.get(model.api.id)
+    if (!m) {
+      delete result[key]
+      continue
+    }
+    result[key] = build(key, m, baseURL, model)
+  }
+
+  // add new endpoint models not already keyed in result
+  for (const [id, m] of remote) {
+    if (id in result) continue
+    result[id] = build(id, m, baseURL)
+  }
+
+  return result
+}
+
+export * as CopilotModels from "./models"

qimingcode/packages/opencode/src/plugin/index.ts

@@ -0,0 +1,289 @@
+import type {
+  Hooks,
+  PluginInput,
+  Plugin as PluginInstance,
+  PluginModule,
+  WorkspaceAdaptor as PluginWorkspaceAdaptor,
+} from "@opencode-ai/plugin"
+import { Config } from "../config"
+import { Bus } from "../bus"
+import { Log } from "../util"
+import { createOpencodeClient } from "@opencode-ai/sdk"
+import { Flag } from "@opencode-ai/core/flag/flag"
+import { CodexAuthPlugin } from "./codex"
+import { Session } from "../session"
+import { NamedError } from "@opencode-ai/core/util/error"
+import { CopilotAuthPlugin } from "./github-copilot/copilot"
+import { gitlabAuthPlugin as GitlabAuthPlugin } from "opencode-gitlab-auth"
+import { PoeAuthPlugin } from "opencode-poe-auth"
+import { CloudflareAIGatewayAuthPlugin, CloudflareWorkersAuthPlugin } from "./cloudflare"
+import { Effect, Layer, Context, Stream } from "effect"
+import { EffectBridge } from "@/effect"
+import { InstanceState } from "@/effect"
+import { errorMessage } from "@/util/error"
+import { PluginLoader } from "./loader"
+import { parsePluginSpecifier, readPluginId, readV1Plugin, resolvePluginId } from "./shared"
+import { registerAdaptor } from "@/control-plane/adaptors"
+import type { WorkspaceAdaptor } from "@/control-plane/types"
+
+const log = Log.create({ service: "plugin" })
+
+type State = {
+  hooks: Hooks[]
+}
+
+// Hook names that follow the (input, output) => Promise<void> trigger pattern
+type TriggerName = {
+  [K in keyof Hooks]-?: NonNullable<Hooks[K]> extends (input: any, output: any) => Promise<void> ? K : never
+}[keyof Hooks]
+
+export interface Interface {
+  readonly trigger: <
+    Name extends TriggerName,
+    Input = Parameters<Required<Hooks>[Name]>[0],
+    Output = Parameters<Required<Hooks>[Name]>[1],
+  >(
+    name: Name,
+    input: Input,
+    output: Output,
+  ) => Effect.Effect<Output>
+  readonly list: () => Effect.Effect<Hooks[]>
+  readonly init: () => Effect.Effect<void>
+}
+
+export class Service extends Context.Service<Service, Interface>()("@opencode/Plugin") {}
+
+// Built-in plugins that are directly imported (not installed from npm)
+const INTERNAL_PLUGINS: PluginInstance[] = [
+  CodexAuthPlugin,
+  CopilotAuthPlugin,
+  GitlabAuthPlugin,
+  PoeAuthPlugin,
+  CloudflareWorkersAuthPlugin,
+  CloudflareAIGatewayAuthPlugin,
+]
+
+function isServerPlugin(value: unknown): value is PluginInstance {
+  return typeof value === "function"
+}
+
+function getServerPlugin(value: unknown) {
+  if (isServerPlugin(value)) return value
+  if (!value || typeof value !== "object" || !("server" in value)) return
+  if (!isServerPlugin(value.server)) return
+  return value.server
+}
+
+function getLegacyPlugins(mod: Record<string, unknown>) {
+  const seen = new Set<unknown>()
+  const result: PluginInstance[] = []
+
+  for (const entry of Object.values(mod)) {
+    if (seen.has(entry)) continue
+    seen.add(entry)
+    const plugin = getServerPlugin(entry)
+    if (!plugin) throw new TypeError("Plugin export is not a function")
+    result.push(plugin)
+  }
+
+  return result
+}
+
+async function applyPlugin(load: PluginLoader.Loaded, input: PluginInput, hooks: Hooks[]) {
+  const plugin = readV1Plugin(load.mod, load.spec, "server", "detect")
+  if (plugin) {
+    await resolvePluginId(load.source, load.spec, load.target, readPluginId(plugin.id, load.spec), load.pkg)
+    hooks.push(await (plugin as PluginModule).server(input, load.options))
+    return
+  }
+
+  for (const server of getLegacyPlugins(load.mod)) {
+    hooks.push(await server(input, load.options))
+  }
+}
+
+export const layer = Layer.effect(
+  Service,
+  Effect.gen(function* () {
+    const bus = yield* Bus.Service
+    const config = yield* Config.Service
+
+    const state = yield* InstanceState.make<State>(
+      Effect.fn("Plugin.state")(function* (ctx) {
+        const hooks: Hooks[] = []
+        const bridge = yield* EffectBridge.make()
+
+        function publishPluginError(message: string) {
+          bridge.fork(bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() }))
+        }
+
+        const { Server } = yield* Effect.promise(() => import("../server/server"))
+
+        const client = createOpencodeClient({
+          baseUrl: "http://localhost:4096",
+          directory: ctx.directory,
+          headers: Flag.OPENCODE_SERVER_PASSWORD
+            ? {
+                Authorization: `Basic ${Buffer.from(`${Flag.OPENCODE_SERVER_USERNAME ?? "opencode"}:${Flag.OPENCODE_SERVER_PASSWORD}`).toString("base64")}`,
+              }
+            : undefined,
+          fetch: async (...args) => (await Server.Default()).app.fetch(...args),
+        })
+        const cfg = yield* config.get()
+        const input: PluginInput = {
+          client,
+          project: ctx.project,
+          worktree: ctx.worktree,
+          directory: ctx.directory,
+          experimental_workspace: {
+            register(type: string, adaptor: PluginWorkspaceAdaptor) {
+              registerAdaptor(ctx.project.id, type, adaptor as WorkspaceAdaptor)
+            },
+          },
+          get serverUrl(): URL {
+            return Server.url ?? new URL("http://localhost:4096")
+          },
+          // @ts-expect-error
+          $: typeof Bun === "undefined" ? undefined : Bun.$,
+        }
+
+        for (const plugin of INTERNAL_PLUGINS) {
+          log.info("loading internal plugin", { name: plugin.name })
+          const init = yield* Effect.tryPromise({
+            try: () => plugin(input),
+            catch: (err) => {
+              log.error("failed to load internal plugin", { name: plugin.name, error: err })
+            },
+          }).pipe(Effect.option)
+          if (init._tag === "Some") hooks.push(init.value)
+        }
+
+        const plugins = Flag.OPENCODE_PURE ? [] : (cfg.plugin_origins ?? [])
+        if (Flag.OPENCODE_PURE && cfg.plugin_origins?.length) {
+          log.info("skipping external plugins in pure mode", { count: cfg.plugin_origins.length })
+        }
+        if (plugins.length) yield* config.waitForDependencies()
+
+        const loaded = yield* Effect.promise(() =>
+          PluginLoader.loadExternal({
+            items: plugins,
+            kind: "server",
+            report: {
+              start(candidate) {
+                log.info("loading plugin", { path: candidate.plan.spec })
+              },
+              missing(candidate, _retry, message) {
+                log.warn("plugin has no server entrypoint", { path: candidate.plan.spec, message })
+              },
+              error(candidate, _retry, stage, error, resolved) {
+                const spec = candidate.plan.spec
+                const cause = error instanceof Error ? (error.cause ?? error) : error
+                const message = stage === "load" ? errorMessage(error) : errorMessage(cause)
+
+                if (stage === "install") {
+                  const parsed = parsePluginSpecifier(spec)
+                  log.error("failed to install plugin", { pkg: parsed.pkg, version: parsed.version, error: message })
+                  publishPluginError(`Failed to install plugin ${parsed.pkg}@${parsed.version}: ${message}`)
+                  return
+                }
+
+                if (stage === "compatibility") {
+                  log.warn("plugin incompatible", { path: spec, error: message })
+                  publishPluginError(`Plugin ${spec} skipped: ${message}`)
+                  return
+                }
+
+                if (stage === "entry") {
+                  log.error("failed to resolve plugin server entry", { path: spec, error: message })
+                  publishPluginError(`Failed to load plugin ${spec}: ${message}`)
+                  return
+                }
+
+                log.error("failed to load plugin", { path: spec, target: resolved?.entry, error: message })
+                publishPluginError(`Failed to load plugin ${spec}: ${message}`)
+              },
+            },
+          }),
+        )
+        for (const load of loaded) {
+          if (!load) continue
+
+          // Keep plugin execution sequential so hook registration and execution
+          // order remains deterministic across plugin runs.
+          yield* Effect.tryPromise({
+            try: () => applyPlugin(load, input, hooks),
+            catch: (err) => {
+              const message = errorMessage(err)
+              log.error("failed to load plugin", { path: load.spec, error: message })
+              return message
+            },
+          }).pipe(
+            Effect.catch(() => {
+              // TODO: make proper events for this
+              // bus.publish(Session.Event.Error, {
+              //   error: new NamedError.Unknown({
+              //     message: `Failed to load plugin ${load.spec}: ${message}`,
+              //   }).toObject(),
+              // })
+              return Effect.void
+            }),
+          )
+        }
+
+        // Notify plugins of current config
+        for (const hook of hooks) {
+          yield* Effect.tryPromise({
+            try: () => Promise.resolve((hook as any).config?.(cfg)),
+            catch: (err) => {
+              log.error("plugin config hook failed", { error: err })
+            },
+          }).pipe(Effect.ignore)
+        }
+
+        // Subscribe to bus events, fiber interrupted when scope closes
+        yield* bus.subscribeAll().pipe(
+          Stream.runForEach((input) =>
+            Effect.sync(() => {
+              for (const hook of hooks) {
+                void hook["event"]?.({ event: input as any })
+              }
+            }),
+          ),
+          Effect.forkScoped,
+        )
+
+        return { hooks }
+      }),
+    )
+
+    const trigger = Effect.fn("Plugin.trigger")(function* <
+      Name extends TriggerName,
+      Input = Parameters<Required<Hooks>[Name]>[0],
+      Output = Parameters<Required<Hooks>[Name]>[1],
+    >(name: Name, input: Input, output: Output) {
+      if (!name) return output
+      const s = yield* InstanceState.get(state)
+      for (const hook of s.hooks) {
+        const fn = hook[name] as any
+        if (!fn) continue
+        yield* Effect.promise(async () => fn(input, output))
+      }
+      return output
+    })
+
+    const list = Effect.fn("Plugin.list")(function* () {
+      const s = yield* InstanceState.get(state)
+      return s.hooks
+    })
+
+    const init = Effect.fn("Plugin.init")(function* () {
+      yield* InstanceState.get(state)
+    })
+
+    return Service.of({ trigger, list, init })
+  }),
+)
+
+export const defaultLayer = layer.pipe(Layer.provide(Bus.layer), Layer.provide(Config.defaultLayer))
+
+export * as Plugin from "."

qimingcode/packages/opencode/src/plugin/install.ts

@@ -0,0 +1,439 @@
+import path from "path"
+import {
+  type ParseError as JsoncParseError,
+  applyEdits,
+  modify,
+  parse as parseJsonc,
+  printParseErrorCode,
+} from "jsonc-parser"
+
+import * as ConfigPaths from "@/config/paths"
+import { Global } from "@opencode-ai/core/global"
+import { Filesystem } from "@/util"
+import { Flock } from "@opencode-ai/core/util/flock"
+import { isRecord } from "@/util/record"
+
+import { parsePluginSpecifier, readPackageThemes, readPluginPackage, resolvePluginTarget } from "./shared"
+
+type Mode = "noop" | "add" | "replace"
+type Kind = "server" | "tui"
+
+export type Target = {
+  kind: Kind
+  opts?: Record<string, unknown>
+}
+
+export type InstallDeps = {
+  resolve: (spec: string) => Promise<string>
+}
+
+export type PatchDeps = {
+  readText: (file: string) => Promise<string>
+  write: (file: string, text: string) => Promise<void>
+  exists: (file: string) => Promise<boolean>
+  files: (dir: string, name: "opencode" | "tui") => string[]
+}
+
+export type PatchInput = {
+  spec: string
+  targets: Target[]
+  force?: boolean
+  global?: boolean
+  vcs?: string
+  worktree: string
+  directory: string
+  config?: string
+}
+
+type Ok<T> = {
+  ok: true
+} & T
+
+type Err<C extends string, T> = {
+  ok: false
+  code: C
+} & T
+
+export type InstallResult = Ok<{ target: string }> | Err<"install_failed", { error: unknown }>
+
+export type ManifestResult =
+  | Ok<{ targets: Target[] }>
+  | Err<"manifest_read_failed", { file: string; error: unknown }>
+  | Err<"manifest_no_targets", { file: string }>
+
+export type PatchItem = {
+  kind: Kind
+  mode: Mode
+  file: string
+}
+
+type PatchErr =
+  | Err<"invalid_json", { kind: Kind; file: string; line: number; col: number; parse: string }>
+  | Err<"patch_failed", { kind: Kind; error: unknown }>
+
+type PatchOne = Ok<{ item: PatchItem }> | PatchErr
+
+export type PatchResult = Ok<{ dir: string; items: PatchItem[] }> | (PatchErr & { dir: string })
+
+const defaultInstallDeps: InstallDeps = {
+  resolve: (spec) => resolvePluginTarget(spec),
+}
+
+const defaultPatchDeps: PatchDeps = {
+  readText: (file) => Filesystem.readText(file),
+  write: async (file, text) => {
+    await Filesystem.write(file, text)
+  },
+  exists: (file) => Filesystem.exists(file),
+  files: (dir, name) => ConfigPaths.fileInDirectory(dir, name),
+}
+
+function pluginSpec(item: unknown) {
+  if (typeof item === "string") return item
+  if (!Array.isArray(item)) return
+  if (typeof item[0] !== "string") return
+  return item[0]
+}
+
+function pluginList(data: unknown) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return
+  const item = data as { plugin?: unknown }
+  if (!Array.isArray(item.plugin)) return
+  return item.plugin
+}
+
+function exportValue(value: unknown): string | undefined {
+  if (typeof value === "string") {
+    const next = value.trim()
+    if (next) return next
+    return
+  }
+  if (!isRecord(value)) return
+  for (const key of ["import", "default"]) {
+    const next = value[key]
+    if (typeof next !== "string") continue
+    const hit = next.trim()
+    if (!hit) continue
+    return hit
+  }
+}
+
+function exportOptions(value: unknown): Record<string, unknown> | undefined {
+  if (!isRecord(value)) return
+  const config = value.config
+  if (!isRecord(config)) return
+  return config
+}
+
+function exportTarget(pkg: Record<string, unknown>, kind: Kind) {
+  const exports = pkg.exports
+  if (!isRecord(exports)) return
+  const value = exports[`./${kind}`]
+  const entry = exportValue(value)
+  if (!entry) return
+  return {
+    opts: exportOptions(value),
+  }
+}
+
+function hasMainTarget(pkg: Record<string, unknown>) {
+  const main = pkg.main
+  if (typeof main !== "string") return false
+  return Boolean(main.trim())
+}
+
+function packageTargets(pkg: { json: Record<string, unknown>; dir: string; pkg: string }) {
+  const spec =
+    typeof pkg.json.name === "string" && pkg.json.name.trim().length > 0 ? pkg.json.name.trim() : path.basename(pkg.dir)
+  const targets: Target[] = []
+  const server = exportTarget(pkg.json, "server")
+  if (server) {
+    targets.push({ kind: "server", opts: server.opts })
+  } else if (hasMainTarget(pkg.json)) {
+    targets.push({ kind: "server" })
+  }
+
+  const tui = exportTarget(pkg.json, "tui")
+  if (tui) {
+    targets.push({ kind: "tui", opts: tui.opts })
+  }
+
+  if (!targets.some((item) => item.kind === "tui") && readPackageThemes(spec, pkg).length) {
+    targets.push({ kind: "tui" })
+  }
+
+  return targets
+}
+
+function patch(text: string, path: Array<string | number>, value: unknown, insert = false) {
+  return applyEdits(
+    text,
+    modify(text, path, value, {
+      formattingOptions: {
+        tabSize: 2,
+        insertSpaces: true,
+      },
+      isArrayInsertion: insert,
+    }),
+  )
+}
+
+function patchPluginList(
+  text: string,
+  list: unknown[] | undefined,
+  spec: string,
+  next: unknown,
+  force = false,
+): { mode: Mode; text: string } {
+  const pkg = parsePluginSpecifier(spec).pkg
+  const rows = (list ?? []).map((item, i) => ({
+    item,
+    i,
+    spec: pluginSpec(item),
+  }))
+  const dup = rows.filter((item) => {
+    if (!item.spec) return false
+    if (item.spec === spec) return true
+    if (item.spec.startsWith("file://")) return false
+    return parsePluginSpecifier(item.spec).pkg === pkg
+  })
+
+  if (!dup.length) {
+    if (!list) {
+      return {
+        mode: "add",
+        text: patch(text, ["plugin"], [next]),
+      }
+    }
+    return {
+      mode: "add",
+      text: patch(text, ["plugin", list.length], next, true),
+    }
+  }
+
+  if (!force) {
+    return {
+      mode: "noop",
+      text,
+    }
+  }
+
+  const keep = dup[0]
+  if (!keep) {
+    return {
+      mode: "noop",
+      text,
+    }
+  }
+
+  if (dup.length === 1 && keep.spec === spec) {
+    return {
+      mode: "noop",
+      text,
+    }
+  }
+
+  let out = text
+  if (typeof keep.item === "string") {
+    out = patch(out, ["plugin", keep.i], next)
+  }
+  if (Array.isArray(keep.item) && typeof keep.item[0] === "string") {
+    out = patch(out, ["plugin", keep.i, 0], spec)
+  }
+
+  const del = dup
+    .map((item) => item.i)
+    .filter((i) => i !== keep.i)
+    .sort((a, b) => b - a)
+
+  for (const i of del) {
+    out = patch(out, ["plugin", i], undefined)
+  }
+
+  return {
+    mode: "replace",
+    text: out,
+  }
+}
+
+export async function installPlugin(spec: string, dep: InstallDeps = defaultInstallDeps): Promise<InstallResult> {
+  const target = await dep.resolve(spec).then(
+    (item) => ({
+      ok: true as const,
+      item,
+    }),
+    (error: unknown) => ({
+      ok: false as const,
+      error,
+    }),
+  )
+  if (!target.ok) {
+    return {
+      ok: false,
+      code: "install_failed",
+      error: target.error,
+    }
+  }
+  return {
+    ok: true,
+    target: target.item,
+  }
+}
+
+export async function readPluginManifest(target: string): Promise<ManifestResult> {
+  const pkg = await readPluginPackage(target).then(
+    (item) => ({
+      ok: true as const,
+      item,
+    }),
+    (error: unknown) => ({
+      ok: false as const,
+      error,
+    }),
+  )
+  if (!pkg.ok) {
+    return {
+      ok: false,
+      code: "manifest_read_failed",
+      file: target,
+      error: pkg.error,
+    }
+  }
+
+  const targets = await Promise.resolve()
+    .then(() => packageTargets(pkg.item))
+    .then(
+      (item) => ({ ok: true as const, item }),
+      (error: unknown) => ({ ok: false as const, error }),
+    )
+
+  if (!targets.ok) {
+    return {
+      ok: false,
+      code: "manifest_read_failed",
+      file: pkg.item.pkg,
+      error: targets.error,
+    }
+  }
+
+  if (!targets.item.length) {
+    return {
+      ok: false,
+      code: "manifest_no_targets",
+      file: pkg.item.pkg,
+    }
+  }
+
+  return {
+    ok: true,
+    targets: targets.item,
+  }
+}
+
+function patchDir(input: PatchInput) {
+  if (input.global) return input.config ?? Global.Path.config
+  const git = input.vcs === "git" && input.worktree !== "/"
+  const root = git ? input.worktree : input.directory
+  return path.join(root, ".opencode")
+}
+
+function patchName(kind: Kind): "opencode" | "tui" {
+  if (kind === "server") return "opencode"
+  return "tui"
+}
+
+async function patchOne(dir: string, target: Target, spec: string, force: boolean, dep: PatchDeps): Promise<PatchOne> {
+  const name = patchName(target.kind)
+  await using _ = await Flock.acquire(`plug-config:${Filesystem.resolve(path.join(dir, name))}`)
+
+  const files = dep.files(dir, name)
+  let cfg = files[0]
+  for (const file of files) {
+    if (!(await dep.exists(file))) continue
+    cfg = file
+    break
+  }
+
+  const src = await dep.readText(cfg).catch((err: NodeJS.ErrnoException) => {
+    if (err.code === "ENOENT") return "{}"
+    return err
+  })
+  if (src instanceof Error) {
+    return {
+      ok: false,
+      code: "patch_failed",
+      kind: target.kind,
+      error: src,
+    }
+  }
+  const text = src.trim() ? src : "{}"
+
+  const errs: JsoncParseError[] = []
+  const data = parseJsonc(text, errs, { allowTrailingComma: true })
+  if (errs.length) {
+    const err = errs[0]
+    const lines = text.substring(0, err.offset).split("\n")
+    return {
+      ok: false,
+      code: "invalid_json",
+      kind: target.kind,
+      file: cfg,
+      line: lines.length,
+      col: lines[lines.length - 1].length + 1,
+      parse: printParseErrorCode(err.error),
+    }
+  }
+
+  const list = pluginList(data)
+  const item = target.opts ? ([spec, target.opts] as const) : spec
+  const out = patchPluginList(text, list, spec, item, force)
+  if (out.mode === "noop") {
+    return {
+      ok: true,
+      item: {
+        kind: target.kind,
+        mode: out.mode,
+        file: cfg,
+      },
+    }
+  }
+
+  const write = await dep.write(cfg, out.text).catch((error: unknown) => error)
+  if (write instanceof Error) {
+    return {
+      ok: false,
+      code: "patch_failed",
+      kind: target.kind,
+      error: write,
+    }
+  }
+
+  return {
+    ok: true,
+    item: {
+      kind: target.kind,
+      mode: out.mode,
+      file: cfg,
+    },
+  }
+}
+
+export async function patchPluginConfig(input: PatchInput, dep: PatchDeps = defaultPatchDeps): Promise<PatchResult> {
+  const dir = patchDir(input)
+  const items: PatchItem[] = []
+  for (const target of input.targets) {
+    const hit = await patchOne(dir, target, input.spec, Boolean(input.force), dep)
+    if (!hit.ok) {
+      return {
+        ...hit,
+        dir,
+      }
+    }
+    items.push(hit.item)
+  }
+  return {
+    ok: true,
+    dir,
+    items,
+  }
+}

qimingcode/packages/opencode/src/plugin/loader.ts

@@ -0,0 +1,216 @@
+import {
+  checkPluginCompatibility,
+  createPluginEntry,
+  isDeprecatedPlugin,
+  pluginSource,
+  resolvePluginTarget,
+  type PluginKind,
+  type PluginPackage,
+  type PluginSource,
+} from "./shared"
+import { ConfigPlugin } from "@/config/plugin"
+import { InstallationVersion } from "@opencode-ai/core/installation/version"
+
+export namespace PluginLoader {
+  // A normalized plugin declaration derived from config before any filesystem or npm work happens.
+  export type Plan = {
+    spec: string
+    options: ConfigPlugin.Options | undefined
+    deprecated: boolean
+  }
+
+  // A plugin that has been resolved to a concrete target and entrypoint on disk.
+  export type Resolved = Plan & {
+    source: PluginSource
+    target: string
+    entry: string
+    pkg?: PluginPackage
+  }
+
+  // A plugin target we could inspect, but which does not expose the requested kind of entrypoint.
+  export type Missing = Plan & {
+    source: PluginSource
+    target: string
+    pkg?: PluginPackage
+    message: string
+  }
+
+  // A resolved plugin whose module has been imported successfully.
+  export type Loaded = Resolved & {
+    mod: Record<string, unknown>
+  }
+
+  type Candidate = { origin: ConfigPlugin.Origin; plan: Plan }
+  type Report = {
+    // Called before each attempt so callers can log initial load attempts and retries uniformly.
+    start?: (candidate: Candidate, retry: boolean) => void
+    // Called when the package exists but does not provide the requested entrypoint.
+    missing?: (candidate: Candidate, retry: boolean, message: string, resolved: Missing) => void
+    // Called for operational failures such as install, compatibility, or dynamic import errors.
+    error?: (
+      candidate: Candidate,
+      retry: boolean,
+      stage: "install" | "entry" | "compatibility" | "load",
+      error: unknown,
+      resolved?: Resolved,
+    ) => void
+  }
+
+  // Normalize a config item into the loader's internal representation.
+  function plan(item: ConfigPlugin.Spec): Plan {
+    const spec = ConfigPlugin.pluginSpecifier(item)
+    return { spec, options: ConfigPlugin.pluginOptions(item), deprecated: isDeprecatedPlugin(spec) }
+  }
+
+  // Resolve a configured plugin into a concrete entrypoint that can later be imported.
+  //
+  // The stages here intentionally separate install/target resolution, entrypoint detection,
+  // and compatibility checks so callers can report the exact reason a plugin was skipped.
+  export async function resolve(
+    plan: Plan,
+    kind: PluginKind,
+  ): Promise<
+    | { ok: true; value: Resolved }
+    | { ok: false; stage: "missing"; value: Missing }
+    | { ok: false; stage: "install" | "entry" | "compatibility"; error: unknown }
+  > {
+    // First make sure the plugin exists locally, installing npm plugins on demand.
+    let target = ""
+    try {
+      target = await resolvePluginTarget(plan.spec)
+    } catch (error) {
+      return { ok: false, stage: "install", error }
+    }
+    if (!target) return { ok: false, stage: "install", error: new Error(`Plugin ${plan.spec} target is empty`) }
+
+    // Then inspect the target for the requested server/tui entrypoint.
+    let base
+    try {
+      base = await createPluginEntry(plan.spec, target, kind)
+    } catch (error) {
+      return { ok: false, stage: "entry", error }
+    }
+    if (!base.entry)
+      return {
+        ok: false,
+        stage: "missing",
+        value: {
+          ...plan,
+          source: base.source,
+          target: base.target,
+          pkg: base.pkg,
+          message: `Plugin ${plan.spec} does not expose a ${kind} entrypoint`,
+        },
+      }
+
+    // npm plugins can declare which opencode versions they support; file plugins are treated
+    // as local development code and skip this compatibility gate.
+    if (base.source === "npm") {
+      try {
+        await checkPluginCompatibility(base.target, InstallationVersion, base.pkg)
+      } catch (error) {
+        return { ok: false, stage: "compatibility", error }
+      }
+    }
+    return { ok: true, value: { ...plan, source: base.source, target: base.target, entry: base.entry, pkg: base.pkg } }
+  }
+
+  // Import the resolved module only after all earlier validation has succeeded.
+  export async function load(row: Resolved): Promise<{ ok: true; value: Loaded } | { ok: false; error: unknown }> {
+    let mod
+    try {
+      mod = await import(row.entry)
+    } catch (error) {
+      return { ok: false, error }
+    }
+    if (!mod) return { ok: false, error: new Error(`Plugin ${row.spec} module is empty`) }
+    return { ok: true, value: { ...row, mod } }
+  }
+
+  // Run one candidate through the full pipeline: resolve, optionally surface a missing entry,
+  // import the module, and finally let the caller transform the loaded plugin into any result type.
+  async function attempt<R>(
+    candidate: Candidate,
+    kind: PluginKind,
+    retry: boolean,
+    finish: ((load: Loaded, origin: ConfigPlugin.Origin, retry: boolean) => Promise<R | undefined>) | undefined,
+    missing: ((value: Missing, origin: ConfigPlugin.Origin, retry: boolean) => Promise<R | undefined>) | undefined,
+    report: Report | undefined,
+  ): Promise<R | undefined> {
+    const plan = candidate.plan
+
+    // Deprecated plugin packages are silently ignored because they are now built in.
+    if (plan.deprecated) return
+
+    report?.start?.(candidate, retry)
+
+    const resolved = await resolve(plan, kind)
+    if (!resolved.ok) {
+      if (resolved.stage === "missing") {
+        // Missing entrypoints are handled separately so callers can still inspect package metadata,
+        // for example to load theme files from a tui plugin package that has no code entrypoint.
+        if (missing) {
+          const value = await missing(resolved.value, candidate.origin, retry)
+          if (value !== undefined) return value
+        }
+        report?.missing?.(candidate, retry, resolved.value.message, resolved.value)
+        return
+      }
+      report?.error?.(candidate, retry, resolved.stage, resolved.error)
+      return
+    }
+
+    const loaded = await load(resolved.value)
+    if (!loaded.ok) {
+      report?.error?.(candidate, retry, "load", loaded.error, resolved.value)
+      return
+    }
+
+    // The default behavior is to return the successfully loaded plugin as-is, but callers can
+    // provide a finisher to adapt the result into a more specific runtime shape.
+    if (!finish) return loaded.value as R
+    return finish(loaded.value, candidate.origin, retry)
+  }
+
+  type Input<R> = {
+    items: ConfigPlugin.Origin[]
+    kind: PluginKind
+    wait?: () => Promise<void>
+    finish?: (load: Loaded, origin: ConfigPlugin.Origin, retry: boolean) => Promise<R | undefined>
+    missing?: (value: Missing, origin: ConfigPlugin.Origin, retry: boolean) => Promise<R | undefined>
+    report?: Report
+  }
+
+  // Resolve and load all configured plugins in parallel.
+  //
+  // If `wait` is provided, file-based plugins that initially failed are retried once after the
+  // caller finishes preparing dependencies. This supports local plugins that depend on an install
+  // step happening elsewhere before their entrypoint becomes loadable.
+  export async function loadExternal<R = Loaded>(input: Input<R>): Promise<R[]> {
+    const candidates = input.items.map((origin) => ({ origin, plan: plan(origin.spec) }))
+    const list: Array<Promise<R | undefined>> = []
+    for (const candidate of candidates) {
+      list.push(attempt(candidate, input.kind, false, input.finish, input.missing, input.report))
+    }
+    const out = await Promise.all(list)
+    if (input.wait) {
+      let deps: Promise<void> | undefined
+      for (let i = 0; i < candidates.length; i++) {
+        if (out[i] !== undefined) continue
+
+        // Only local file plugins are retried. npm plugins already attempted installation during
+        // the first pass, while file plugins may need the caller's dependency preparation to finish.
+        const candidate = candidates[i]
+        if (!candidate || pluginSource(candidate.plan.spec) !== "file") continue
+        deps ??= input.wait()
+        await deps
+        out[i] = await attempt(candidate, input.kind, true, input.finish, input.missing, input.report)
+      }
+    }
+
+    // Drop skipped/failed entries while preserving the successful result order.
+    const ready: R[] = []
+    for (const item of out) if (item !== undefined) ready.push(item)
+    return ready
+  }
+}

qimingcode/packages/opencode/src/plugin/meta.ts

@@ -0,0 +1,188 @@
+import path from "path"
+import { fileURLToPath } from "url"
+
+import { Flag } from "@opencode-ai/core/flag/flag"
+import { Global } from "@opencode-ai/core/global"
+import { Filesystem } from "@/util"
+import { Flock } from "@opencode-ai/core/util/flock"
+
+import { parsePluginSpecifier, pluginSource } from "./shared"
+
+type Source = "file" | "npm"
+
+export type Theme = {
+  src: string
+  dest: string
+  mtime?: number
+  size?: number
+}
+
+export type Entry = {
+  id: string
+  source: Source
+  spec: string
+  target: string
+  requested?: string
+  version?: string
+  modified?: number
+  first_time: number
+  last_time: number
+  time_changed: number
+  load_count: number
+  fingerprint: string
+  themes?: Record<string, Theme>
+}
+
+export type State = "first" | "updated" | "same"
+
+export type Touch = {
+  spec: string
+  target: string
+  id: string
+}
+
+type Store = Record<string, Entry>
+type Core = Omit<Entry, "first_time" | "last_time" | "time_changed" | "load_count" | "fingerprint" | "themes">
+type Row = Touch & { core: Core }
+
+function storePath() {
+  return Flag.OPENCODE_PLUGIN_META_FILE ?? path.join(Global.Path.state, "plugin-meta.json")
+}
+
+function lock(file: string) {
+  return `plugin-meta:${file}`
+}
+
+function fileTarget(spec: string, target: string) {
+  if (spec.startsWith("file://")) return fileURLToPath(spec)
+  if (target.startsWith("file://")) return fileURLToPath(target)
+  return
+}
+
+async function modifiedAt(file: string) {
+  const stat = await Filesystem.statAsync(file)
+  if (!stat) return
+  const mtime = stat.mtimeMs
+  return Math.floor(typeof mtime === "bigint" ? Number(mtime) : mtime)
+}
+
+function resolvedTarget(target: string) {
+  if (target.startsWith("file://")) return fileURLToPath(target)
+  return target
+}
+
+async function npmVersion(target: string) {
+  const resolved = resolvedTarget(target)
+  const stat = await Filesystem.statAsync(resolved)
+  const dir = stat?.isDirectory() ? resolved : path.dirname(resolved)
+  return Filesystem.readJson<{ version?: string }>(path.join(dir, "package.json"))
+    .then((item) => item.version)
+    .catch(() => undefined)
+}
+
+async function entryCore(item: Touch): Promise<Core> {
+  const spec = item.spec
+  const target = item.target
+  const source = pluginSource(spec)
+  if (source === "file") {
+    const file = fileTarget(spec, target)
+    return {
+      id: item.id,
+      source,
+      spec,
+      target,
+      modified: file ? await modifiedAt(file) : undefined,
+    }
+  }
+
+  return {
+    id: item.id,
+    source,
+    spec,
+    target,
+    requested: parsePluginSpecifier(spec).version,
+    version: await npmVersion(target),
+  }
+}
+
+function fingerprint(value: Core) {
+  if (value.source === "file") return [value.target, value.modified ?? ""].join("|")
+  return [value.target, value.requested ?? "", value.version ?? ""].join("|")
+}
+
+async function read(file: string): Promise<Store> {
+  return Filesystem.readJson<Store>(file).catch(() => ({}) as Store)
+}
+
+async function row(item: Touch): Promise<Row> {
+  return {
+    ...item,
+    core: await entryCore(item),
+  }
+}
+
+function next(prev: Entry | undefined, core: Core, now: number): { state: State; entry: Entry } {
+  const entry: Entry = {
+    ...core,
+    first_time: prev?.first_time ?? now,
+    last_time: now,
+    time_changed: prev?.time_changed ?? now,
+    load_count: (prev?.load_count ?? 0) + 1,
+    fingerprint: fingerprint(core),
+    themes: prev?.themes,
+  }
+  const state: State = !prev ? "first" : prev.fingerprint === entry.fingerprint ? "same" : "updated"
+  if (state === "updated") entry.time_changed = now
+  return {
+    state,
+    entry,
+  }
+}
+
+export async function touchMany(items: Touch[]): Promise<Array<{ state: State; entry: Entry }>> {
+  if (!items.length) return []
+  const file = storePath()
+  const rows = await Promise.all(items.map((item) => row(item)))
+
+  return Flock.withLock(lock(file), async () => {
+    const store = await read(file)
+    const now = Date.now()
+    const out: Array<{ state: State; entry: Entry }> = []
+    for (const item of rows) {
+      const hit = next(store[item.id], item.core, now)
+      store[item.id] = hit.entry
+      out.push(hit)
+    }
+    await Filesystem.writeJson(file, store)
+    return out
+  })
+}
+
+export async function touch(spec: string, target: string, id: string): Promise<{ state: State; entry: Entry }> {
+  return touchMany([{ spec, target, id }]).then((item) => {
+    const hit = item[0]
+    if (hit) return hit
+    throw new Error("Failed to touch plugin metadata.")
+  })
+}
+
+export async function setTheme(id: string, name: string, theme: Theme): Promise<void> {
+  const file = storePath()
+  await Flock.withLock(lock(file), async () => {
+    const store = await read(file)
+    const entry = store[id]
+    if (!entry) return
+    entry.themes = {
+      ...entry.themes,
+      [name]: theme,
+    }
+    await Filesystem.writeJson(file, store)
+  })
+}
+
+export async function list(): Promise<Store> {
+  const file = storePath()
+  return Flock.withLock(lock(file), async () => read(file))
+}
+
+export * as PluginMeta from "./meta"

qimingcode/packages/opencode/src/plugin/shared.ts

@@ -0,0 +1,323 @@
+import path from "path"
+import { fileURLToPath, pathToFileURL } from "url"
+import npa from "npm-package-arg"
+import semver from "semver"
+import { Filesystem } from "@/util"
+import { isRecord } from "@/util/record"
+import { Npm } from "@opencode-ai/core/npm"
+
+// Old npm package names for plugins that are now built-in
+export const DEPRECATED_PLUGIN_PACKAGES = ["opencode-openai-codex-auth", "opencode-copilot-auth"]
+
+export function isDeprecatedPlugin(spec: string) {
+  return DEPRECATED_PLUGIN_PACKAGES.some((pkg) => spec.includes(pkg))
+}
+
+function parse(spec: string) {
+  try {
+    return npa(spec)
+  } catch {}
+}
+
+export function parsePluginSpecifier(spec: string) {
+  const hit = parse(spec)
+  if (hit?.type === "alias" && !hit.name) {
+    const sub = (hit as npa.AliasResult).subSpec
+    if (sub?.name) {
+      const version = !sub.rawSpec || sub.rawSpec === "*" ? "latest" : sub.rawSpec
+      return { pkg: sub.name, version }
+    }
+  }
+  if (!hit?.name) return { pkg: spec, version: "" }
+  if (hit.raw === hit.name) return { pkg: hit.name, version: "latest" }
+  return { pkg: hit.name, version: hit.rawSpec }
+}
+
+export type PluginSource = "file" | "npm"
+export type PluginKind = "server" | "tui"
+type PluginMode = "strict" | "detect"
+
+export type PluginPackage = {
+  dir: string
+  pkg: string
+  json: Record<string, unknown>
+}
+
+export type PluginEntry = {
+  spec: string
+  source: PluginSource
+  target: string
+  pkg?: PluginPackage
+  entry?: string
+}
+
+const INDEX_FILES = ["index.ts", "index.tsx", "index.js", "index.mjs", "index.cjs"]
+
+export function pluginSource(spec: string): PluginSource {
+  if (isPathPluginSpec(spec)) return "file"
+  return "npm"
+}
+
+function resolveExportPath(raw: string, dir: string) {
+  if (raw.startsWith("file://")) return fileURLToPath(raw)
+  if (path.isAbsolute(raw)) return raw
+  return path.resolve(dir, raw)
+}
+
+function isAbsolutePath(raw: string) {
+  return path.isAbsolute(raw) || /^[A-Za-z]:[\\/]/.test(raw)
+}
+
+function extractExportValue(value: unknown): string | undefined {
+  if (typeof value === "string") return value
+  if (!isRecord(value)) return undefined
+  for (const key of ["import", "default"]) {
+    const nested = value[key]
+    if (typeof nested === "string") return nested
+  }
+  return undefined
+}
+
+function packageMain(pkg: PluginPackage) {
+  const value = pkg.json.main
+  if (typeof value !== "string") return
+  const next = value.trim()
+  if (!next) return
+  return next
+}
+
+function resolvePackageFile(spec: string, raw: string, kind: string, pkg: PluginPackage) {
+  const resolved = resolveExportPath(raw, pkg.dir)
+  const root = Filesystem.resolve(pkg.dir)
+  const next = Filesystem.resolve(resolved)
+  if (!Filesystem.contains(root, next)) {
+    throw new Error(`Plugin ${spec} resolved ${kind} entry outside plugin directory`)
+  }
+  return next
+}
+
+function resolvePackagePath(spec: string, raw: string, kind: PluginKind, pkg: PluginPackage) {
+  return pathToFileURL(resolvePackageFile(spec, raw, kind, pkg)).href
+}
+
+function resolvePackageEntrypoint(spec: string, kind: PluginKind, pkg: PluginPackage) {
+  const exports = pkg.json.exports
+  if (isRecord(exports)) {
+    const raw = extractExportValue(exports[`./${kind}`])
+    if (raw) return resolvePackagePath(spec, raw, kind, pkg)
+  }
+
+  if (kind !== "server") return
+  const main = packageMain(pkg)
+  if (!main) return
+  return resolvePackagePath(spec, main, kind, pkg)
+}
+
+function targetPath(target: string) {
+  if (target.startsWith("file://")) return fileURLToPath(target)
+  if (path.isAbsolute(target)) return target
+}
+
+async function resolveDirectoryIndex(dir: string) {
+  for (const name of INDEX_FILES) {
+    const file = path.join(dir, name)
+    if (await Filesystem.exists(file)) return file
+  }
+}
+
+async function resolveTargetDirectory(target: string) {
+  const file = targetPath(target)
+  if (!file) return
+  const stat = await Filesystem.statAsync(file)
+  if (!stat?.isDirectory()) return
+  return file
+}
+
+async function resolvePluginEntrypoint(spec: string, target: string, kind: PluginKind, pkg?: PluginPackage) {
+  const source = pluginSource(spec)
+  const hit =
+    pkg ?? (source === "npm" ? await readPluginPackage(target) : await readPluginPackage(target).catch(() => undefined))
+  if (!hit) return target
+
+  const entry = resolvePackageEntrypoint(spec, kind, hit)
+  if (entry) return entry
+
+  const dir = await resolveTargetDirectory(target)
+
+  if (kind === "tui") {
+    if (source === "file" && dir) {
+      const index = await resolveDirectoryIndex(dir)
+      if (index) return pathToFileURL(index).href
+    }
+
+    if (source === "npm") return
+    if (dir) return
+
+    return target
+  }
+
+  if (dir && isRecord(hit.json.exports)) {
+    if (source === "file") {
+      const index = await resolveDirectoryIndex(dir)
+      if (index) return pathToFileURL(index).href
+    }
+
+    return
+  }
+
+  return target
+}
+
+export function isPathPluginSpec(spec: string) {
+  return spec.startsWith("file://") || spec.startsWith(".") || isAbsolutePath(spec)
+}
+
+export async function resolvePathPluginTarget(spec: string) {
+  const raw = spec.startsWith("file://") ? fileURLToPath(spec) : spec
+  const file = path.isAbsolute(raw) || /^[A-Za-z]:[\\/]/.test(raw) ? raw : path.resolve(raw)
+  const stat = await Filesystem.statAsync(file)
+  if (!stat?.isDirectory()) {
+    if (spec.startsWith("file://")) return spec
+    return pathToFileURL(file).href
+  }
+
+  if (await Filesystem.exists(path.join(file, "package.json"))) {
+    return pathToFileURL(file).href
+  }
+
+  const index = await resolveDirectoryIndex(file)
+  if (index) return pathToFileURL(index).href
+
+  throw new Error(`Plugin directory ${file} is missing package.json or index file`)
+}
+
+export async function checkPluginCompatibility(target: string, opencodeVersion: string, pkg?: PluginPackage) {
+  if (!semver.valid(opencodeVersion) || semver.major(opencodeVersion) === 0) return
+  const hit = pkg ?? (await readPluginPackage(target).catch(() => undefined))
+  if (!hit) return
+  const engines = hit.json.engines
+  if (!isRecord(engines)) return
+  const range = engines.opencode
+  if (typeof range !== "string") return
+  if (!semver.satisfies(opencodeVersion, range)) {
+    throw new Error(`Plugin requires opencode ${range} but running ${opencodeVersion}`)
+  }
+}
+
+export async function resolvePluginTarget(spec: string) {
+  if (isPathPluginSpec(spec)) return resolvePathPluginTarget(spec)
+  const hit = parse(spec)
+  const pkg = hit?.name && hit.raw === hit.name ? `${hit.name}@latest` : spec
+  const result = await Npm.add(pkg)
+  return result.directory
+}
+
+export async function readPluginPackage(target: string): Promise<PluginPackage> {
+  const file = target.startsWith("file://") ? fileURLToPath(target) : target
+  const stat = await Filesystem.statAsync(file)
+  const dir = stat?.isDirectory() ? file : path.dirname(file)
+  const pkg = path.join(dir, "package.json")
+  const json = await Filesystem.readJson<Record<string, unknown>>(pkg)
+  return { dir, pkg, json }
+}
+
+export async function createPluginEntry(spec: string, target: string, kind: PluginKind): Promise<PluginEntry> {
+  const source = pluginSource(spec)
+  const pkg =
+    source === "npm" ? await readPluginPackage(target) : await readPluginPackage(target).catch(() => undefined)
+  const entry = await resolvePluginEntrypoint(spec, target, kind, pkg)
+  return {
+    spec,
+    source,
+    target,
+    pkg,
+    entry,
+  }
+}
+
+export function readPackageThemes(spec: string, pkg: PluginPackage) {
+  const field = pkg.json["oc-themes"]
+  if (field === undefined) return []
+  if (!Array.isArray(field)) {
+    throw new TypeError(`Plugin ${spec} has invalid oc-themes field`)
+  }
+
+  const list = field.map((item) => {
+    if (typeof item !== "string") {
+      throw new TypeError(`Plugin ${spec} has invalid oc-themes entry`)
+    }
+
+    const raw = item.trim()
+    if (!raw) {
+      throw new TypeError(`Plugin ${spec} has empty oc-themes entry`)
+    }
+    if (raw.startsWith("file://") || isAbsolutePath(raw)) {
+      throw new TypeError(`Plugin ${spec} oc-themes entry must be relative: ${item}`)
+    }
+
+    return resolvePackageFile(spec, raw, "oc-themes", pkg)
+  })
+
+  return Array.from(new Set(list))
+}
+
+export function readPluginId(id: unknown, spec: string) {
+  if (id === undefined) return
+  if (typeof id !== "string") throw new TypeError(`Plugin ${spec} has invalid id type ${typeof id}`)
+  const value = id.trim()
+  if (!value) throw new TypeError(`Plugin ${spec} has an empty id`)
+  return value
+}
+
+export function readV1Plugin(
+  mod: Record<string, unknown>,
+  spec: string,
+  kind: PluginKind,
+  mode: PluginMode = "strict",
+) {
+  const value = mod.default
+  if (!isRecord(value)) {
+    if (mode === "detect") return
+    throw new TypeError(`Plugin ${spec} must default export an object with ${kind}()`)
+  }
+  if (mode === "detect" && !("id" in value) && !("server" in value) && !("tui" in value)) return
+
+  const server = "server" in value ? value.server : undefined
+  const tui = "tui" in value ? value.tui : undefined
+  if (server !== undefined && typeof server !== "function") {
+    throw new TypeError(`Plugin ${spec} has invalid server export`)
+  }
+  if (tui !== undefined && typeof tui !== "function") {
+    throw new TypeError(`Plugin ${spec} has invalid tui export`)
+  }
+  if (server !== undefined && tui !== undefined) {
+    throw new TypeError(`Plugin ${spec} must default export either server() or tui(), not both`)
+  }
+  if (kind === "server" && server === undefined) {
+    throw new TypeError(`Plugin ${spec} must default export an object with server()`)
+  }
+  if (kind === "tui" && tui === undefined) {
+    throw new TypeError(`Plugin ${spec} must default export an object with tui()`)
+  }
+
+  return value
+}
+
+export async function resolvePluginId(
+  source: PluginSource,
+  spec: string,
+  target: string,
+  id: string | undefined,
+  pkg?: PluginPackage,
+) {
+  if (source === "file") {
+    if (id) return id
+    throw new TypeError(`Path plugin ${spec} must export id`)
+  }
+  if (id) return id
+  const hit = pkg ?? (await readPluginPackage(target))
+  if (typeof hit.json.name !== "string" || !hit.json.name.trim()) {
+    throw new TypeError(`Plugin package ${hit.pkg} is missing name`)
+  }
+  return hit.json.name.trim()
+}