[trigger2k20]

Summary

This PR adds API-key/Bearer-token support for LM Studio servers that require authentication while preserving the existing OpenCode LM Studio Plugin behavior:

• LM Studio auto-detection
• health checks
• dynamic model discovery through /v1/models
• automatic provider.lmstudio.models augmentation
• existing OpenCode plugin hooks

The package is prepared as opencode-lmstudio@0.3.1.

Authentication behavior

Discovery, health checks, cache warmup, and runtime model validation now send:

Authorization: Bearer <token>

when an API key is configured.

Supported configuration sources:

• explicit provider.lmstudio.options.apiKey
• OpenCode env syntax such as {env:LM_API_TOKEN}
• implicit fallback to LMSTUDIO_API_KEY
• implicit fallback to LM_API_TOKEN

The previous OPENAI_API_KEY fallback was intentionally removed to avoid accidentally sending unrelated OpenAI credentials to LM Studio-compatible endpoints.

Security hardening

Implicit environment fallback is restricted to local/private LM Studio URLs only:

• localhost
• 127.0.0.0/8
• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16
• 169.254.0.0/16
• .local
• local/private IPv6 IP literals covered by the helper

For public or hosted OpenAI-compatible endpoints, users must configure provider.lmstudio.options.apiKey explicitly. This avoids forwarding a local LM Studio token to a malicious or unintended public baseURL purely because an environment variable exists.

Model handling

• Embedding models returned by /v1/models are skipped for OpenCode chat model registration.
• Discovered chat/completion-capable models are marked with OpenCode-compatible text input/output modality metadata.
• Multimodal-looking model IDs are marked with image input modality support.
• Explicit user model whitelist state is preserved.

Packaging/runtime fix

The package entrypoint now exports built JavaScript from dist instead of TypeScript source. This is required for OpenCode Desktop/package-cache loading and avoids relying on runtime TypeScript loading from node_modules.

Tooling

The ESLint blocker in this fork is fixed by using ESLint 10.4.1 with flat config and adding the required TypeScript ESLint parser/plugin packages. The lockfile/dev-dependency churn is limited to making lint/build validation reproducible and generating the dist package artifact used at runtime.

Validation

Validated locally:

npm run validate
npm run build
npm pack --dry-run
npm audit

Results:

• lint: passes on ESLint 10.4.1 with existing console warnings only
• typecheck: passes
• tests: 27 passed
• build: passes
• pack dry-run: package contains the built dist artifact
• npm audit: 0 vulnerabilities

Additional local OpenCode smoke test:

opencode models lmstudio --print-logs --log-level DEBUG

Result:

• plugin loaded as opencode-lmstudio
• logged version 0.3.1
• skipped embedding models
• loaded 8 LM Studio chat models from an authenticated LAN LM Studio instance

Review feedback addressed

• Restricts private IPv6 matching to IP literals so public DNS names starting with fc, fd, or fe80 do not receive implicit environment fallback tokens.
• Builds the generated LM Studio whitelist from discovered non-embedding models, preventing stale built-in defaults from staying visible when LM Studio does not return them.

Security review

A diff-scoped Codex Security review was run against origin/main...HEAD. No reportable findings remain in the final diff after the environment-fallback hardening described above.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd4e5d53f7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[trigger2k20]

@agustif i made an fork since you last version did not work.