Provider plugins (llmgateway, nvidia, openrouter, vercel, zenmux) now
verify the provider ID before applying attribution headers, preventing
custom-defined providers sharing the same endpoint URL from being
mutated by built-in plugin logic.
Additional changes:
- Add auth-v2.json migration path for multi-account store continuity
- Remove obsolete @ai-sdk/xai patch and ConsoleCommand registration
- Add native LLM session recordings for anthropic, openai-oauth, and zen
- Update CLI help snapshots to reflect Kilo branding
- Expand i18n with usage-exceeded dialog strings (it, nl, uk)
The HttpApi authorization middleware defaulted the username to
"opencode", while the Hono AuthMiddleware already defaulted to "kilo"
(kilocode_change). The parity tests added by upstream in
packages/opencode/test/server/httpapi-sdk.test.ts exposed the
inconsistency. Align the HttpApi middleware to also default to "kilo"
and update the pre-existing basic-auth test creds that hit it.
Two new httpapi-sdk parity tests also hit Kilo overlay routes
(/config/providers, /agent) that aren't yet wired onto the Effect
HttpApi bridge, returning 500. Skip those two with kilocode_change
markers pointing at the same "migrate Kilo overlay routes onto the
HttpApi bridge" follow-up the existing httpapi-bridge.test.ts comment
references.
Imanol Maiztegui