Merge remote-tracking branch 'upstream/main' into local/merge-upstream-3.55.1

Author: Zeph Gillen

.changeset/vertex-credentials-field-validation.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Detect when the "Google Cloud Credentials" Vertex field has been given a filesystem path instead of the raw JSON contents of a service-account key file. The runtime now skips JSON.parse for path-shaped input, logs a single specific console warning naming the sibling "Google Cloud Key File Path" field and `GOOGLE_APPLICATION_CREDENTIALS` env var, and the settings UI shows an inline warning under the field while the input still looks like a path. Auth behavior is unchanged for correctly-configured users.

package.json

@@ -34,7 +34,7 @@
 		"@types/glob": "^9.0.0",
 		"@types/node": "^24.1.0",
 		"@vscode/vsce": "3.3.2",
-		"esbuild": "^0.25.0",
+		"esbuild": "0.28.0",
 		"eslint": "^9.27.0",
 		"glob": "^11.1.0",
 		"husky": "^9.1.7",
@@ -60,7 +60,9 @@
 		],
 		"overrides": {
 			"tar-fs": ">=3.1.1",
-			"esbuild": ">=0.25.0",
+			"esbuild": "0.28.0",
+			"rollup": "4.60.4",
+			"vite": "8.0.14",
 			"undici": ">=5.29.0",
 			"form-data": ">=4.0.4",
 			"bluebird": ">=3.7.2",

packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts

@@ -0,0 +1,43 @@
+// npx vitest run packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts
+
+import { safeJsonParse } from "../safeJsonParse.js"
+
+describe("safeJsonParse", () => {
+	let consoleErrorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		consoleErrorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		consoleErrorSpy.mockRestore()
+	})
+
+	it("returns the parsed value for valid JSON", () => {
+		expect(safeJsonParse<{ a: number }>('{"a":1}')).toEqual({ a: 1 })
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value for null, undefined, or empty input", () => {
+		expect(safeJsonParse<string>(null, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>(undefined, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>("", "fallback")).toBe("fallback")
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value and logs the generic message when no context is given (backward compatible)", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined)
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON:")
+	})
+
+	it("includes the context label in the error log when provided", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined, "foo")
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON (foo):")
+	})
+})

packages/core/src/message-utils/safeJsonParse.ts

@@ -3,9 +3,16 @@
  *
  * @param jsonString The string to parse
  * @param defaultValue Value to return if parsing fails
+ * @param context Optional label included in the error log so callers can be
+ *   identified when something other than valid JSON is supplied (e.g. a user
+ *   pasting a file path into a JSON field).
  * @returns Parsed JSON object or defaultValue if parsing fails
  */
-export function safeJsonParse<T>(jsonString: string | null | undefined, defaultValue?: T): T | undefined {
+export function safeJsonParse<T>(
+	jsonString: string | null | undefined,
+	defaultValue?: T,
+	context?: string,
+): T | undefined {
 	if (!jsonString) {
 		return defaultValue
 	}
@@ -14,7 +21,7 @@ export function safeJsonParse<T>(jsonString: string | null | undefined, defaultV
 		return JSON.parse(jsonString) as T
 	} catch (error) {
 		// Log the error to the console for debugging.
-		console.error("Error parsing JSON:", error)
+		console.error(`Error parsing JSON${context ? ` (${context})` : ""}:`, error)
 		return defaultValue
 	}
 }

packages/types/src/__tests__/looksLikeFilePath.spec.ts

@@ -0,0 +1,48 @@
+// npx vitest run src/__tests__/looksLikeFilePath.spec.ts
+
+import { looksLikeFilePath } from "../utils/looksLikeFilePath.js"
+
+describe("looksLikeFilePath", () => {
+	describe("nullish, empty, and whitespace-only input", () => {
+		it.each([
+			["undefined", undefined],
+			["null", null],
+			["empty string", ""],
+			["whitespace only", "   \t\n  "],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+
+	describe("path-shaped input", () => {
+		it.each([
+			["Windows backslash path", "C:\\Users\\dev\\sa.json"],
+			["Windows forward-slash path", "C:/Users/dev/sa.json"],
+			["Windows drive lowercase", "d:\\creds.json"],
+			["POSIX absolute path", "/home/dev/sa.json"],
+			["POSIX absolute root /tmp", "/tmp/creds.json"],
+			["POSIX home path", "~/sa.json"],
+			["POSIX relative ./", "./sa.json"],
+			["POSIX relative ../", "../secrets/sa.json"],
+		])("returns true for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(true)
+		})
+
+		it("returns true after trimming surrounding whitespace", () => {
+			expect(looksLikeFilePath("  /tmp/creds.json  ")).toBe(true)
+			expect(looksLikeFilePath("\tC:\\sa.json\n")).toBe(true)
+		})
+	})
+
+	describe("JSON-shaped or bare-token input", () => {
+		it.each([
+			["JSON object", '{"type":"service_account","client_email":"x@y.z"}'],
+			["JSON array", "[1,2,3]"],
+			["JSON with leading whitespace", '   {"type":"service_account"}'],
+			["bare token", "not-json-and-not-a-path"],
+			["service-account-style email", "sa@project.iam.gserviceaccount.com"],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+})

packages/types/src/global-settings.ts

@@ -279,6 +279,7 @@ export const SECRET_STATE_KEYS = [
 	"zaiApiKey",
 	"fireworksApiKey",
 	"vercelAiGatewayApiKey",
+	"opencodeGoApiKey",
 	"basetenApiKey",
 ] as const
 

packages/types/src/index.ts

@@ -33,3 +33,5 @@ export * from "./vscode.js"
 export * from "./worktree.js"
 
 export * from "./providers/index.js"
+
+export * from "./utils/looksLikeFilePath.js"

packages/types/src/provider-settings.ts

@@ -43,6 +43,7 @@ export const dynamicProviders = [
 	"unbound",
 	"poe",
 	"deepseek",
+	"opencode-go",
 ] as const
 
 export type DynamicProvider = (typeof dynamicProviders)[number]
@@ -402,6 +403,11 @@ const vercelAiGatewaySchema = baseProviderSettingsSchema.extend({
 	vercelAiGatewayModelId: z.string().optional(),
 })
 
+const opencodeGoSchema = baseProviderSettingsSchema.extend({
+	opencodeGoApiKey: z.string().optional(),
+	opencodeGoModelId: z.string().optional(),
+})
+
 const basetenSchema = apiModelIdProviderModelSchema.extend({
 	basetenApiKey: z.string().optional(),
 })
@@ -440,6 +446,7 @@ export const providerSettingsSchemaDiscriminated = z.discriminatedUnion("apiProv
 	fireworksSchema.merge(z.object({ apiProvider: z.literal("fireworks") })),
 	qwenCodeSchema.merge(z.object({ apiProvider: z.literal("qwen-code") })),
 	vercelAiGatewaySchema.merge(z.object({ apiProvider: z.literal("vercel-ai-gateway") })),
+	opencodeGoSchema.merge(z.object({ apiProvider: z.literal("opencode-go") })),
 	defaultSchema,
 ])
 
@@ -474,6 +481,7 @@ export const providerSettingsSchema = z.object({
 	...fireworksSchema.shape,
 	...qwenCodeSchema.shape,
 	...vercelAiGatewaySchema.shape,
+	...opencodeGoSchema.shape,
 	...codebaseIndexProviderSchema.shape,
 })
 
@@ -504,6 +512,7 @@ export const modelIdKeys = [
 	"unboundModelId",
 	"litellmModelId",
 	"vercelAiGatewayModelId",
+	"opencodeGoModelId",
 ] as const satisfies readonly (keyof ProviderSettings)[]
 
 export type ModelIdKey = (typeof modelIdKeys)[number]
@@ -549,6 +558,7 @@ export const modelIdKeysByProvider: Record<TypicalProvider, ModelIdKey> = {
 	zai: "apiModelId",
 	fireworks: "apiModelId",
 	"vercel-ai-gateway": "vercelAiGatewayModelId",
+	"opencode-go": "opencodeGoModelId",
 }
 
 /**
@@ -665,6 +675,7 @@ export const MODELS_BY_PROVIDER: Record<
 	requesty: { id: "requesty", label: "Requesty", models: [] },
 	unbound: { id: "unbound", label: "Unbound", models: [] },
 	"vercel-ai-gateway": { id: "vercel-ai-gateway", label: "Vercel AI Gateway", models: [] },
+	"opencode-go": { id: "opencode-go", label: "Opencode Go", models: [] },
 
 	// Local providers; models discovered from localhost endpoints.
 	lmstudio: { id: "lmstudio", label: "LM Studio", models: [] },

packages/types/src/providers/fireworks.ts

@@ -5,6 +5,7 @@ export type FireworksModelId =
 	| "accounts/fireworks/models/kimi-k2-instruct-0905"
 	| "accounts/fireworks/models/kimi-k2-thinking"
 	| "accounts/fireworks/models/kimi-k2p5"
+	| "accounts/fireworks/models/kimi-k2p6"
 	| "accounts/fireworks/models/minimax-m2"
 	| "accounts/fireworks/models/minimax-m2p1"
 	| "accounts/fireworks/models/qwen3-235b-a22b-instruct-2507"
@@ -13,10 +14,12 @@ export type FireworksModelId =
 	| "accounts/fireworks/models/deepseek-v3"
 	| "accounts/fireworks/models/deepseek-v3p1"
 	| "accounts/fireworks/models/deepseek-v3p2"
+	| "accounts/fireworks/models/deepseek-v4-pro"
 	| "accounts/fireworks/models/glm-4p5"
 	| "accounts/fireworks/models/glm-4p5-air"
 	| "accounts/fireworks/models/glm-4p6"
 	| "accounts/fireworks/models/glm-4p7"
+	| "accounts/fireworks/models/glm-5p1"
 	| "accounts/fireworks/models/gpt-oss-20b"
 	| "accounts/fireworks/models/gpt-oss-120b"
 	| "accounts/fireworks/models/llama-v3p3-70b-instruct"
@@ -240,4 +243,37 @@ export const fireworksModels = {
 		description:
 			"Llama 4 Scout is a smaller, faster variant of Llama 4 with multimodal capabilities, ideal for quick iterations and cost-effective deployments.",
 	},
+	"accounts/fireworks/models/kimi-k2p6": {
+		maxTokens: 16384,
+		contextWindow: 262144,
+		supportsImages: true,
+		supportsPromptCache: true,
+		inputPrice: 0.95,
+		outputPrice: 4.0,
+		cacheReadsPrice: 0.16,
+		description:
+			"Kimi K2.6 is Moonshot AI's latest flagship agentic model, building on K2.5 with stronger long-horizon reasoning, multi-step tool use, and unified vision/text understanding.",
+	},
+	"accounts/fireworks/models/deepseek-v4-pro": {
+		maxTokens: 16384,
+		contextWindow: 1048576,
+		supportsImages: false,
+		supportsPromptCache: true,
+		inputPrice: 1.74,
+		outputPrice: 3.48,
+		cacheReadsPrice: 0.14,
+		description:
+			"DeepSeek V4 Pro is the latest iteration of the DeepSeek model family, with improved reasoning, code generation, and instruction following over the V3 series.",
+	},
+	"accounts/fireworks/models/glm-5p1": {
+		maxTokens: 25344,
+		contextWindow: 202752,
+		supportsImages: false,
+		supportsPromptCache: true,
+		inputPrice: 1.4,
+		outputPrice: 4.4,
+		cacheReadsPrice: 0.26,
+		description:
+			"Z.ai GLM-5.1 is the latest coding-focused model in the GLM family, with exceptional performance on complex programming tasks and enhanced reasoning and code generation quality.",
+	},
 } as const satisfies Record<string, ModelInfo>

packages/types/src/providers/index.ts

@@ -22,6 +22,7 @@ export * from "./vertex.js"
 export * from "./vscode-llm.js"
 export * from "./xai.js"
 export * from "./vercel-ai-gateway.js"
+export * from "./opencode-go.js"
 export * from "./zai.js"
 export * from "./minimax.js"
 export * from "./mimo.js"
@@ -46,6 +47,7 @@ import { vertexDefaultModelId } from "./vertex.js"
 import { vscodeLlmDefaultModelId } from "./vscode-llm.js"
 import { xaiDefaultModelId } from "./xai.js"
 import { vercelAiGatewayDefaultModelId } from "./vercel-ai-gateway.js"
+import { opencodeGoDefaultModelId } from "./opencode-go.js"
 import { internationalZAiDefaultModelId, mainlandZAiDefaultModelId } from "./zai.js"
 import { minimaxDefaultModelId } from "./minimax.js"
 import { mimoDefaultModelId } from "./mimo.js"
@@ -115,6 +117,8 @@ export function getProviderDefaultModelId(
 			return unboundDefaultModelId
 		case "vercel-ai-gateway":
 			return vercelAiGatewayDefaultModelId
+		case "opencode-go":
+			return opencodeGoDefaultModelId
 		case "anthropic":
 		case "gemini-cli":
 		case "fake-ai":