fix custom provider credentials, edit path, and failure UX

Require an API key or {env:VAR} on client and server, add edit/prefill for
existing custom providers, save auth before config, and surface incomplete
auth plus disconnect after partial failures. Add VS Code parity tests and
drop the unused allProvidersConnected locale key.

Co-authored-by: Serhii Dziupin <makeittech@users.noreply.github.com>

packages/vscode/src/DOCUMENTATION.md

@@ -61,7 +61,7 @@ The webview CSP permits `blob:` only for `worker-src` so shared UI parsers can r
   - Includes session activity snapshot bridge handler used by webview parity routes (`/api/session-activity`).
   - Includes Zen utility model parity handler used by shared notification settings (`/api/zen/models`).
   - Owns managed OpenCode upgrade status and mutation handlers, including capability reporting, upgrade serialization, and process restart after a successful upgrade.
-  - Provider handlers cover source lookup, disconnect (`DELETE /api/provider/:id/auth`), and custom provider upsert (`PUT /api/provider`).
+  - Provider handlers cover source lookup, disconnect (`DELETE /api/provider/:id/auth`), and custom provider upsert (`PUT /api/provider`; create/update OpenAI-compatible config; requires `env` or stored auth; secrets via OpenCode auth API).
 
 - `opencode-upgrade-runtime.ts`
   - Owns managed-versus-external capability decisions, latest-version checks, serialized OpenCode self-upgrades, and restart-after-upgrade behavior.

packages/vscode/src/bridge-system-runtime.ts

@@ -521,6 +521,7 @@ export async function handleSystemBridgeMessage(
           config,
           workingDirectory,
           normalizedScope,
+          { hasStoredAuth: Boolean(getProviderAuth(providerId)) },
         );
         await ctx?.manager?.restart();
         return {

packages/vscode/src/opencodeConfig.providers.test.ts

@@ -0,0 +1,176 @@
+import { afterEach, beforeEach, describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import {
+  getProviderSources,
+  removeProviderConfig,
+  upsertProviderConfig,
+  validateCustomProviderConfig,
+} from './opencodeConfig';
+
+let projectDir: string;
+
+const writeJson = (filePath: string, value: unknown) => {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2), 'utf8');
+};
+
+const readJson = (filePath: string) => JSON.parse(fs.readFileSync(filePath, 'utf8'));
+
+describe('custom provider config persistence (VS Code parity)', () => {
+  beforeEach(() => {
+    projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-vscode-provider-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  test('validateCustomProviderConfig rejects invalid endpoint and credentials shape', () => {
+    assert.equal(validateCustomProviderConfig('Bad Id', {
+      name: 'X',
+      options: { baseURL: 'https://api.example.com' },
+      models: { m: { name: 'M' } },
+    }).ok, false);
+
+    const ftp = validateCustomProviderConfig('ok', {
+      name: 'X',
+      options: { baseURL: 'ftp://api.example.com' },
+      models: { m: { name: 'M' } },
+    });
+    assert.equal(ftp.ok, false);
+    assert.match(ftp.error ?? '', /http:\/\//);
+
+    assert.equal(validateCustomProviderConfig('ok', {
+      name: 'X',
+      options: { baseURL: 'https://api.example.com' },
+      models: {},
+    }).ok, false);
+  });
+
+  test('validateCustomProviderConfig rejects missing credentials', () => {
+    assert.equal(validateCustomProviderConfig('ok', {
+      name: 'X',
+      options: { baseURL: 'https://api.example.com' },
+      models: { m: { name: 'M' } },
+    }).ok, false);
+
+    assert.equal(validateCustomProviderConfig('ok', {
+      name: 'X',
+      options: { baseURL: 'https://api.example.com' },
+      models: { m: { name: 'M' } },
+    }, { hasStoredAuth: true }).ok, true);
+
+    assert.equal(validateCustomProviderConfig('ok', {
+      name: 'X',
+      env: ['MY_KEY'],
+      options: { baseURL: 'https://api.example.com' },
+      models: { m: { name: 'M' } },
+    }).ok, true);
+  });
+
+  test('upsertProviderConfig writes and round-trips project config', () => {
+    const result = upsertProviderConfig('campus-llm', {
+      name: 'Campus LLM',
+      npm: '@ai-sdk/openai-compatible',
+      options: {
+        baseURL: 'https://llm.example.edu/v1',
+        headers: { 'X-Campus': '1' },
+      },
+      models: {
+        'fast-model': { name: 'Fast' },
+      },
+      env: ['CAMPUS_KEY'],
+    }, projectDir, 'project');
+
+    assert.equal(result.providerId, 'campus-llm');
+    assert.equal(fs.existsSync(result.path), true);
+    assert.equal(result.path.startsWith(projectDir), true);
+
+    const written = readJson(result.path);
+    assert.deepEqual(written.provider['campus-llm'], {
+      npm: '@ai-sdk/openai-compatible',
+      name: 'Campus LLM',
+      env: ['CAMPUS_KEY'],
+      options: {
+        baseURL: 'https://llm.example.edu/v1',
+        headers: { 'X-Campus': '1' },
+      },
+      models: {
+        'fast-model': { name: 'Fast' },
+      },
+    });
+
+    const sources = getProviderSources('campus-llm', projectDir);
+    assert.equal(sources.project.exists, true);
+    assert.equal(sources.project.path, result.path);
+  });
+
+  test('upsertProviderConfig updates existing entry and clears disabled_providers', () => {
+    const configPath = path.join(projectDir, 'opencode.json');
+    writeJson(configPath, {
+      provider: {
+        'campus-llm': {
+          npm: '@ai-sdk/openai-compatible',
+          name: 'Old',
+          options: { baseURL: 'https://old.example.edu/v1' },
+          models: { a: { name: 'A' } },
+        },
+      },
+      disabled_providers: ['campus-llm', 'other'],
+    });
+
+    upsertProviderConfig('campus-llm', {
+      name: 'Campus LLM',
+      options: { baseURL: 'https://llm.example.edu/v1' },
+      models: { b: { name: 'B' } },
+      env: ['CAMPUS_KEY'],
+    }, projectDir, 'project');
+
+    const written = readJson(configPath);
+    assert.equal(written.provider['campus-llm'].name, 'Campus LLM');
+    assert.deepEqual(written.provider['campus-llm'].models, { b: { name: 'B' } });
+    assert.deepEqual(written.disabled_providers, ['other']);
+  });
+
+  test('upsert then remove restores absence', () => {
+    upsertProviderConfig('temp-provider', {
+      name: 'Temp',
+      options: { baseURL: 'https://api.example.com/v1' },
+      models: { m: { name: 'M' } },
+      env: ['TEMP_KEY'],
+    }, projectDir, 'project');
+
+    assert.equal(getProviderSources('temp-provider', projectDir).project.exists, true);
+    assert.equal(removeProviderConfig('temp-provider', projectDir, 'project'), true);
+    assert.equal(getProviderSources('temp-provider', projectDir).project.exists, false);
+  });
+
+  test('failed validation does not write config', () => {
+    const configPath = path.join(projectDir, 'opencode.json');
+    assert.throws(
+      () => upsertProviderConfig('ok', {
+        name: 'X',
+        options: { baseURL: 'not-a-url' },
+        models: { m: { name: 'M' } },
+        env: ['X'],
+      }, projectDir, 'project'),
+      /Base URL/,
+    );
+    assert.equal(fs.existsSync(configPath), false);
+  });
+
+  test('upsert with hasStoredAuth allows config without env', () => {
+    const result = upsertProviderConfig('keyed-provider', {
+      name: 'Keyed',
+      options: { baseURL: 'https://api.example.com/v1' },
+      models: { m: { name: 'M' } },
+    }, projectDir, 'project', { hasStoredAuth: true });
+
+    assert.equal(result.providerId, 'keyed-provider');
+    assert.equal(result.config.env, undefined);
+  });
+});

packages/vscode/src/opencodeConfig.ts

@@ -2172,7 +2172,11 @@ const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9-_]*$/;
 const BASE_URL_PATTERN = /^https?:\/\//;
 const OPENAI_COMPATIBLE_NPM = '@ai-sdk/openai-compatible';
 
-export const validateCustomProviderConfig = (providerId: string, config: unknown) => {
+export const validateCustomProviderConfig = (
+  providerId: string,
+  config: unknown,
+  options: { hasStoredAuth?: boolean } = {},
+) => {
   if (!providerId || typeof providerId !== 'string' || !PROVIDER_ID_PATTERN.test(providerId)) {
     return { ok: false as const, error: 'Provider ID must match /^[a-z0-9][a-z0-9-_]*$/' };
   }
@@ -2191,12 +2195,12 @@ export const validateCustomProviderConfig = (providerId: string, config: unknown
     return { ok: false as const, error: `Custom providers must use npm package ${OPENAI_COMPATIBLE_NPM}` };
   }
 
-  const options = isPlainObject(config.options) ? config.options : null;
-  if (!options) {
+  const optionsBlock = isPlainObject(config.options) ? config.options : null;
+  if (!optionsBlock) {
     return { ok: false as const, error: 'Provider options are required' };
   }
 
-  const baseURL = typeof options.baseURL === 'string' ? options.baseURL.trim() : '';
+  const baseURL = typeof optionsBlock.baseURL === 'string' ? optionsBlock.baseURL.trim() : '';
   if (!baseURL) {
     return { ok: false as const, error: 'Base URL is required' };
   }
@@ -2234,8 +2238,9 @@ export const validateCustomProviderConfig = (providerId: string, config: unknown
     models: normalizedModels,
   };
 
+  let env: string[] = [];
   if (Array.isArray(config.env)) {
-    const env = config.env
+    env = config.env
       .filter((entry): entry is string => typeof entry === 'string' && entry.trim().length > 0)
       .map((entry) => entry.trim());
     if (env.length > 0) {
@@ -2243,9 +2248,13 @@ export const validateCustomProviderConfig = (providerId: string, config: unknown
     }
   }
 
-  if (isPlainObject(options.headers)) {
+  if (env.length === 0 && !options.hasStoredAuth) {
+    return { ok: false as const, error: 'API key or {env:VAR} credentials are required' };
+  }
+
+  if (isPlainObject(optionsBlock.headers)) {
     const headers: Record<string, string> = {};
-    for (const [headerKey, headerValue] of Object.entries(options.headers)) {
+    for (const [headerKey, headerValue] of Object.entries(optionsBlock.headers)) {
       if (typeof headerKey !== 'string' || !headerKey.trim()) {
         continue;
       }
@@ -2267,8 +2276,9 @@ export const upsertProviderConfig = (
   config: unknown,
   workingDirectory?: string,
   scope: 'user' | 'project' | 'custom' = 'user',
+  options: { hasStoredAuth?: boolean } = {},
 ) => {
-  const validated = validateCustomProviderConfig(providerId, config);
+  const validated = validateCustomProviderConfig(providerId, config, options);
   if (!validated.ok) {
     const error = new Error(validated.error) as Error & { statusCode?: number };
     error.statusCode = 400;