Summary

• Problem: the bundled opencode Zen provider exposed auth/setup but did not own a Zen model catalog/resolver, so users had to hand-register opencode/<model> rows; review also found route/cost/docs drift around MiniMax, static Zen metadata, and the documented Gemini example.
• Solution: restore the Zen provider-owned catalog, dynamic resolver, runtime discovery filter, route normalization, provider-discovery static catalog, manifest anchor metadata, cost metadata, and regression tests at the opencode plugin boundary.
• Latest follow-up: this update moves the full 49-row offline Zen catalog behind providerCatalogEntry/provider discovery, trims openclaw.plugin.json to four representative route/cost anchors, keeps the documented Gemini and GLM-5.2 examples resolvable, and adds a sync-main follow-up regression for credential-scoped live discovery caching.
• What changed: the PR now filters live discovery to provider-owned rows only, keeps the curated 49-row seed visible through provider discovery when live discovery is unavailable, routes MiniMax through the Zen OpenAI-compatible /v1/chat/completions path, preserves required cost metadata for every runtime row and manifest anchor, verifies the docs examples are resolvable, proves different OpenCode discovery credentials do not share cached live catalog rows, and adds glm-5.2 after authenticated Zen /models returned it.
• Why it matters / User impact: users can select advertised opencode/<model> Zen models without hand-writing every model row, and docs no longer point them at an unresolved Gemini reference.
• Out of scope: this does not change non-OpenCode providers, opencode-go runtime behavior, generic LLM adapter APIs, the shared OpenCode credential fallback policy, or the public model/config cost contract.
• Fixes bug(opencode): Zen provider ships no model catalog — every Zen model must be hand-registered (opencode-go discovers, opencode does not) #92479

Origin / follow-up

• Follows / completes: This updates the existing fix(opencode): restore Zen model catalog #92495 repair branch after ClawSweeper flagged live-only Zen row synthesis, missing successful MiniMax live proof, cost-contract failures, and a stale documented Gemini example.
• Gap this fills: The branch now proves the documented examples resolve, refreshes authenticated Zen /models proof with a redacted key, and keeps MiniMax on the verified OpenAI-compatible Zen route.
• Consistency: The live-discovery behavior matches the shared buildLiveModelProviderConfig shape used by opencode-go: use live discovery when authenticated rows are available, filter to provider-owned metadata rows, and retain the static seed when discovery is unavailable or not provider-owned. The offline static surface also now mirrors opencode-go by exposing the complete catalog through provider discovery instead of forcing every row into the manifest.

Competition / linked PR analysis

• Linked PR(s): fix(opencode): restore Zen model catalog #92495 is the existing linked PR for bug(opencode): Zen provider ships no model catalog — every Zen model must be hand-registered (opencode-go discovers, opencode does not) #92479; check-upstream-fixed found origin/main does not already cover this repair.
• Related open PR / same-contract scan: The linked issue and ClawSweeper review identify this PR as the active candidate fix. I did not find a same-contract canonical PR on origin/main superseding the Zen catalog owner-boundary repair.
• Gap in linked PR(s): The current linked PR itself had author-actionable gaps: live-only discovery rows were exposed with inferred metadata, MiniMax was grouped with the Zen Anthropic Messages route, cost metadata briefly violated the required model contract, and docs referenced gemini-3-pro, which the provider could not resolve.
• Why this patch is better/canonical: It fixes the gaps at the provider-owned catalog/routing/docs boundary instead of adding downstream special cases, publishing guessed live-only rows, or widening the shared model schema from one provider PR.

Real behavior proof

• Behavior or issue addressed: The bundled opencode Zen provider now exposes usable opencode/<model> rows without hand-written user config. Documented Zen examples resolve through the provider runtime, authenticated Zen /models discovery returns the expected curated rows including glm-5.2, unknown live-only IDs are not promoted without owned metadata, MiniMax uses the OpenAI-compatible Zen v1 route, and every static Zen row remains compatible with the required model cost contract.
• Real environment tested: Linux, Node/Vitest/pnpm in the local OpenClaw PR worktree. The OpenCode Zen API key was used only as a transient environment variable for live proof; logs redact secret-like strings and the key is not stored in the repo or PR body.
• Exact steps or command run after this patch:

cd "$TASK_WORKTREE"

git diff --check
node scripts/run-vitest.mjs extensions/opencode/index.test.ts

# Fresh validation after sync-main and the credential-scoped cache regression:
node scripts/run-vitest.mjs extensions/opencode/index.test.ts
git diff --check

pnpm docs:list
pnpm run check:test-types
pnpm run tsgo:prod
pnpm run test:extensions:package-boundary:compile
pnpm run test:extensions:package-boundary:canary

OPENCODE_API_KEY=[REDACTED] node --import tsx <redacted live proof runner>
curl -H "Authorization: Bearer [REDACTED]" -H "Accept: application/json" https://opencode.ai/zen/v1/models

• Evidence after fix: Focused provider regression tests now include the docs/catalog contract, provider-discovery offline catalog contract, manifest-anchor cost contract, live-only discovery filtering, static fallback, and credential-scoped live discovery cache behavior. The earlier branch validation passed all 13 tests, and the fresh sync-main follow-up passes all 14 tests:

Test Files  1 passed (1)
     Tests  13 passed (13)
[test] passed 1 Vitest shard in 56.04s

node scripts/run-vitest.mjs extensions/opencode/index.test.ts
Test Files  1 passed (1)
Tests  14 passed (14)
[test] passed 1 Vitest shard in 29.99s

git diff --check
# passed with no output

The docs list command completed before the type/package-boundary gates, and the type gates completed successfully:

## pnpm docs:list
$ node scripts/docs-list.js
Listing all markdown files in docs folder:
...
## pnpm run check:test-types
$ pnpm tsgo:test
...
## pnpm run tsgo:prod
$ pnpm tsgo:core && pnpm tsgo:extensions

The extension package-boundary checks passed in both compile and canary modes:

extension package boundary check passed
mode: compile
compiled plugins: 115
canary plugins: 0

extension package boundary check passed
mode: canary
compiled plugins: 0
canary plugins: 2

The fresh authenticated Zen live proof passed with the redacted key:

step=documented_examples_resolve
opencode/claude-opus-4-6 -> api=anthropic-messages baseUrl=https://opencode.ai/zen
opencode/gpt-5.5 -> api=openai-responses baseUrl=https://opencode.ai/zen/v1
opencode/gemini-3.1-pro -> api=google-generative-ai baseUrl=https://opencode.ai/zen/v1
opencode/glm-5.2 -> api=openai-completions baseUrl=https://opencode.ai/zen/v1

step=live_catalog_builder
modelCount=49
requiredIdsPresent.claude-opus-4-6=true
requiredIdsPresent.gpt-5.5=true
requiredIdsPresent.gemini-3.1-pro=true
requiredIdsPresent.glm-5.2=true
requiredIdsPresent.minimax-m2.7=true
minimaxRoute.api=openai-completions
minimaxRoute.baseUrl=https://opencode.ai/zen/v1

step=authenticated_models_endpoint
status=200
finalUrl=https://opencode.ai/zen/v1/models
liveModelCount=49
requiredIdsPresentInLiveModels.claude-opus-4-6=true
requiredIdsPresentInLiveModels.gpt-5.5=true
requiredIdsPresentInLiveModels.gemini-3.1-pro=true
requiredIdsPresentInLiveModels.glm-5.2=true
requiredIdsPresentInLiveModels.minimax-m2.7=true
minimaxIds=minimax-m2.5,minimax-m2.7,minimax-m3-free
requiredIdsPresentInLiveModels.minimax-m3=false

step=minimax_openai_compatible_completion
status=200
modelId=minimax-m2.7
api=openai-completions
endpoint=https://opencode.ai/zen/v1/chat/completions
assistantTextLength=324

step=live_proof_result
result=PASS
checks=documented OpenCode Zen examples resolve through provider runtime, including opencode/glm-5.2; runtime live catalog builder consumes authenticated Zen /models rows through its fetch guard and returns required curated rows; GET https://opencode.ai/zen/v1/models succeeds and includes required curated rows including glm-5.2; minimax-m2.7 uses openai-completions at https://opencode.ai/zen/v1 and returns non-empty assistant content; current authenticated Zen catalog does not expose minimax-m3, only minimax-m3-free

The cost-contract summary remains satisfied: the 49-row provider-discovery seed and the four manifest anchors have no missing cost fields, glm-5.2 uses provider-owned OpenCode GLM metadata, tiered public-doc rows keep tieredPricing, and free rows are explicit zero-cost rows.

• Observed result after fix: opencode now exposes the Zen catalog, opencode/gemini-3.1-pro and opencode/glm-5.2 are documented resolvable examples, authenticated Zen /models returns the required curated rows including glm-5.2, minimax-m2.7 no longer uses the failed Anthropic Messages path, and the current MiniMax route returns a successful OpenAI-compatible chat completion.
• What was not tested: This latest live proof does not re-run paid completions for every Zen family; it focuses on authenticated catalog discovery, documented example resolution including GLM-5.2, provider-discovery static catalog coverage, and the MiniMax route ClawSweeper specifically challenged. Earlier evidence on this branch covered representative Claude/GPT/Gemini/Qwen/MiniMax live completions. The authenticated Zen catalog did not expose minimax-m3, so this update does not add or claim a paid MiniMax M3 row. I also did not change or prove final product decisions for the full 49-row seed membership or the shared opencode/opencode-go credential fallback policy.

Review findings addressed

• RF-001 — 49-row static seed drift risk: Reduced the manifest ownership surface by moving the complete 49-row offline catalog behind providerCatalogEntry: "./provider-discovery.ts", while keeping openclaw.plugin.json to four representative route/cost anchors. The focused test now proves provider discovery exposes all 49 rows including glm-5.2, and the manifest anchors still match runtime cost metadata.
• RF-002 — shared OpenCode credential fallback policy: Left the existing shared opencode/opencode-go credential fallback unchanged because it matches current docs and sibling behavior; the split-key policy remains out of scope for [Feature]: Support separate Zen and Go API key env vars #87790. Added a provider-level regression proving different discovery credentials do not reuse the same live catalog cache rows.
• RF-003 — current-head CI/check completion: The previously visible current-head CI, CodeQL Critical Quality, OpenGrep, labeler, dependency guard, security guard, workflow sanity, and Real behavior proof runs were passing for the pre-sync head; after sync-main, fresh local extensions/opencode/index.test.ts validation passes all 14 tests and git diff --check passes. Earlier queued/cancelled entries remain stale workflow noise, not current patch failures.
• RF-004 — maintainer decision boundary: The remaining provider-owner decision is now narrower: accept the provider-owned 49-row TS source-of-truth and four manifest anchors, instead of accepting a full 49-row user-visible manifest blob. No automated repair is needed for the split-key policy decision.
• RF-005 — real behavior proof refresh: Addressed with fresh redacted OpenCode Zen live proof in opencode-zen-live-proof-20260622.log: authenticated /models returned 49 rows including the documented examples and minimax-m2.7, and MiniMax returned a 200 OpenAI-compatible chat completion on https://opencode.ai/zen/v1/chat/completions.
• RF-006 — re-review / proof refresh request: Addressed by syncing the branch to current origin/main, rerunning focused extensions/opencode/index.test.ts validation after the sync, adding the credential-scoped live discovery cache regression, and keeping the existing redacted OpenCode Zen live proof plus explicit not-tested boundaries in this PR body.
• Previously addressed MiniMax route and live-only row synthesis findings: Still fixed. MiniMax M2.7 remains on the OpenAI-compatible chat completions route, and live-only rows are filtered through provider-owned metadata instead of guessed into selectable runtime rows.

Regression Test Plan

• Target test file: extensions/opencode/index.test.ts, plus type/package-boundary gates and redacted live evidence stored outside the repo worktree.
• Scenario locked in: Regression tests assert provider discovery exposes the complete 49-row offline Zen catalog including glm-5.2, the manifest keeps only four representative route/cost anchors, dynamic model resolution works for Zen IDs, documented docs/providers/opencode.md Zen examples are resolvable, shared opencode-go credentials can populate the opencode catalog path, Claude/GPT/Gemini/GLM/Qwen/MiniMax families route to the expected adapter/base URL pairs, live-only discovery rows are filtered until metadata is owned, live discovery cache entries stay scoped to discovery credentials, every provider-discovery/runtime row and manifest anchor has required cost metadata, and static fallback remains visible when live discovery is unavailable or returns no owned IDs.
• Why this is the smallest reliable guardrail: A focused provider test locks the source-of-truth catalog/routing/docs/cost contract without broad adapter mocks, while live proof covers the external Zen catalog and the exact MiniMax route that review requested.

Merge risk

• Risk labels considered: merge-risk: 🚨 compatibility, merge-risk: 🚨 auth-provider, provider catalog/routing, provider-discovery metadata, manifest anchors, docs accuracy, and catalog seed review cost.
• Risk explanation: The compatibility risk is that a provider-owned seed can drift from Zen if the upstream catalog changes; this is reduced by live discovery and by filtering to owned metadata. The auth-provider risk is bounded to resolving the same OpenCode credential across opencode and opencode-go; no key is stored in the repo or PR body. The manifest review risk is reduced because the user-visible manifest now carries only four representative anchors while the complete offline catalog lives in the provider-owned TS discovery source.
• Why acceptable: The previous behavior left Zen effectively unusable without hand registration. This patch restores the provider contract at the owner boundary, keeps live discovery as the preferred source when credentials are present, prevents live-only metadata synthesis, preserves a no-discovery local seed through provider discovery, fixes the concrete MiniMax routing defect, and keeps docs examples aligned with resolvable model rows.

Root Cause

• Root cause: The opencode Zen provider was migrated as an auth/setup surface without owning the Zen model catalog contract that opencode-go already supported. Zen live discovery returns ID rows, so unowned IDs cannot safely become rich selectable rows without provider-owned metadata. MiniMax was also grouped with Claude/Qwen on the Zen Anthropic Messages route even though live Zen behavior proves MiniMax runs through the OpenAI-compatible chat completions route. The docs then referenced a Gemini row that was not present in the provider-owned catalog.
• Why this is root-cause fix: The patch restores the missing provider-owned catalog/resolver boundary, keeps rich metadata owned by the provider seed, fixes MiniMax route selection before downstream adapter execution, keeps the existing required cost contract, and makes docs examples test against the same resolver users rely on.
• Fix classification: Root-cause provider catalog, routing, docs, and model-cost contract repair for the bundled opencode Zen provider.
• Maintainer-ready confidence: High for author-actionable source repair: catalog restoration, live-only synthesis filtering, MiniMax route proof, cost-contract coverage, docs/example regression, type gates, package-boundary checks, and fresh authenticated Zen live proof are all covered.
• Patch quality notes: The fallback/default warnings are intentional provider-catalog boundary behavior, not symptom masking: live Zen discovery is advisory, provider-owned static rows remain visible through provider discovery when discovery is unavailable, and unknown live-only IDs are filtered rather than guessed into selectable rich model rows. This follow-up reduces manifest review cost by moving the full offline catalog out of openclaw.plugin.json and into the provider-owned TS discovery source.
• Architecture / source-of-truth check: The opencode provider plugin is the source-of-truth owner for bundled Zen catalog metadata, route selection, docs examples, provider discovery, and manifest anchor synchronization. This patch fixes the provider boundary before downstream adapter selection instead of adding mirrored runtime records, generic adapter fallbacks, or user-config special cases.
• Out of scope: final provider-owner approval of the full 49-row seed membership, split-key policy changes for opencode versus opencode-go, non-OpenCode provider behavior, and schema-wide model cost contract changes.