feat(opencode-plugin): headers option for header-based auth proxies (CF Access)

@omniroute/opencode-plugin-v2/src/catalog.ts

@@ -98,6 +98,7 @@ export interface ResolvedOptions extends FreeOptions {
   baseURL: string;
   apiKey: string;
   managementReadToken?: string;
+  headers?: Record<string, string>;
   timeoutMs: number;
   timeouts?: EndpointTimeouts;
   logger?: Logger;
@@ -1124,6 +1125,7 @@ export function buildProviderPayload(
     activation: "enabled",
     package: NPM_OPENAI_COMPAT,
     settings: { baseURL: ensureV1Suffix(opts.baseURL), apiKey: opts.apiKey },
+    headers: opts.headers,
     integrationID: X,
   } as unknown as StableProviderInfo;
   const models: StableModelInfo[] = [];

@omniroute/opencode-plugin-v2/src/index.ts

@@ -177,7 +177,8 @@ export default Plugin.define({
         return await defaultOmniRouteModelsFetcher(
           resolved.baseURL,
           resolved.apiKey,
-          timeouts.models
+          timeouts.models,
+          resolved.headers
         );
       } catch (err) {
         log.warn(
@@ -203,7 +204,8 @@ export default Plugin.define({
           value: await defaultOmniRouteCombosFetcher(
             resolved.baseURL,
             resolved.managementReadToken ?? resolved.apiKey,
-            timeouts.combos
+            timeouts.combos,
+            resolved.headers
           ),
         };
       } catch (err) {
@@ -225,7 +227,8 @@ export default Plugin.define({
             resolved.baseURL,
             resolved.managementReadToken ?? resolved.apiKey,
             timeouts.models,
-            reportSourceError
+            reportSourceError,
+            resolved.headers
           ),
         };
       } catch (err) {
@@ -247,7 +250,8 @@ export default Plugin.define({
             resolved.baseURL,
             resolved.managementReadToken ?? resolved.apiKey,
             timeouts.enrichment,
-            reportSourceError
+            reportSourceError,
+            resolved.headers
           ),
         };
       } catch (err) {

@omniroute/opencode-plugin-v2/src/options.ts

@@ -38,6 +38,13 @@ const pluginOptionsSchema = z
       .trim()
       .refine(isHttpUrl, "baseURL must be an http(s) URL, for example http://localhost:20128"),
     apiKey: z.string().optional(),
+    /**
+     * Extra HTTP headers sent with every gateway fetch (models, combos,
+     * providers, enrichment). Useful for gateways behind Cloudflare Access
+     * or other header-based auth proxies. Merged into the Authorization
+     * header; never overrides the bearer token.
+     */
+    headers: z.record(z.string(), z.string()).optional(),
     displayName: z.string().optional(),
     managementReadToken: z.string().optional(),
     timeoutMs: z.number().positive().default(10000),
@@ -159,6 +166,7 @@ export function toResolvedOptions(parsed: PluginOptions): ResolvedOptions {
     providerId: parsed.providerId,
     baseURL: parsed.baseURL,
     apiKey: parsed.apiKey ?? process.env.OMNIROUTE_API_KEY ?? "",
+    headers: parsed.headers as Record<string, string> | undefined,
     managementReadToken: resolveManagementReadToken(parsed.managementReadToken),
     timeoutMs: parsed.timeoutMs,
     timeouts: parsed.timeouts,

@omniroute/opencode-plugin-v2/src/shared/combos-map.ts

@@ -43,7 +43,8 @@ export interface OmniRouteRawCombo {
 export type OmniRouteCombosFetcher = (
   baseURL: string,
   apiKey: string,
-  timeoutMs?: number
+  timeoutMs?: number,
+  headers?: Record<string, string>
 ) => Promise<OmniRouteRawCombo[]>;
 
 function trimTrailingSlashes(value: string): string {
@@ -73,7 +74,8 @@ function trimTrailingSlashes(value: string): string {
 export const defaultOmniRouteCombosFetcher: OmniRouteCombosFetcher = async (
   baseURL,
   apiKey,
-  timeoutMs = 10_000
+  timeoutMs = 10_000,
+  headers
 ) => {
   if (!apiKey) throw new Error("[omniroute-v2] apiKey required to fetch /api/combos");
   if (!baseURL) throw new Error("[omniroute-v2] baseURL required to fetch /api/combos");
@@ -91,8 +93,9 @@ export const defaultOmniRouteCombosFetcher: OmniRouteCombosFetcher = async (
     const res = await fetch(url, {
       method: "GET",
       headers: {
-        Authorization: `Bearer ${apiKey}`,
         Accept: "application/json",
+        ...(headers ?? {}),
+        Authorization: `Bearer ${apiKey}`,
       },
       signal: controller.signal,
     });

@omniroute/opencode-plugin-v2/src/shared/enrich.ts

@@ -317,7 +317,8 @@ export type OmniRouteEnrichmentFetcher = (
   baseURL: string,
   apiKey: string,
   timeoutMs?: number,
-  onSourceError?: OmniRouteEnrichmentSourceError
+  onSourceError?: OmniRouteEnrichmentSourceError,
+  extraHeaders?: Record<string, string>
 ) => Promise<OmniRouteEnrichmentMap>;
 
 function trimTrailingSlashes(value: string): string {
@@ -355,7 +356,8 @@ export const defaultOmniRouteEnrichmentFetcher: OmniRouteEnrichmentFetcher = asy
   baseURL,
   apiKey,
   timeoutMs = 10_000,
-  onSourceError
+  onSourceError,
+  extraHeaders
 ) => {
   const report = (endpoint: string, reason: unknown): void => {
     onSourceError?.(endpoint, reason instanceof Error ? reason.message : String(reason));
@@ -364,8 +366,9 @@ export const defaultOmniRouteEnrichmentFetcher: OmniRouteEnrichmentFetcher = asy
   if (!baseURL || !apiKey) return out;
   const root = trimTrailingSlashes(baseURL.replace(/\/v1\/?$/, ""));
   const headers = {
-    Authorization: `Bearer ${apiKey}`,
     Accept: "application/json",
+    ...(extraHeaders ?? {}),
+    Authorization: `Bearer ${apiKey}`,
   };
 
   // 1. Catalog with nice display names.

@omniroute/opencode-plugin-v2/src/shared/models-map.ts

@@ -41,7 +41,8 @@ export interface OmniRouteRawModelEntry {
 export type OmniRouteModelsFetcher = (
   baseURL: string,
   apiKey: string,
-  timeoutMs?: number
+  timeoutMs?: number,
+  headers?: Record<string, string>
 ) => Promise<OmniRouteRawModelEntry[]>;
 
 /**
@@ -50,11 +51,15 @@ export type OmniRouteModelsFetcher = (
  * emits today and a bare-array envelope (defensive — keeps the plugin
  * working if a future OmniRoute build trims the wrapper). Anything that
  * isn't an object with a string `id` is filtered out silently.
+ *
+ * `headers` are merged into the request (e.g. Cloudflare Access client
+ * id/secret). User-supplied values never override the bearer token.
  */
 export const defaultOmniRouteModelsFetcher: OmniRouteModelsFetcher = async (
   baseURL,
   apiKey,
-  timeoutMs = 10_000
+  timeoutMs = 10_000,
+  headers
 ) => {
   if (!apiKey) throw new Error("[omniroute-v2] apiKey required to fetch /v1/models");
   if (!baseURL) throw new Error("[omniroute-v2] baseURL required to fetch /v1/models");
@@ -70,8 +75,9 @@ export const defaultOmniRouteModelsFetcher: OmniRouteModelsFetcher = async (
     const res = await fetch(url, {
       method: "GET",
       headers: {
-        Authorization: `Bearer ${apiKey}`,
         Accept: "application/json",
+        ...(headers ?? {}),
+        Authorization: `Bearer ${apiKey}`,
       },
       signal: controller.signal,
     });

@omniroute/opencode-plugin-v2/src/shared/usable.ts

@@ -19,7 +19,8 @@ export type OmniRouteProvidersFetcher = (
   baseURL: string,
   apiKey: string,
   timeoutMs?: number,
-  onSourceError?: (endpoint: string, reason: string) => void
+  onSourceError?: (endpoint: string, reason: string) => void,
+  headers?: Record<string, string>
 ) => Promise<OmniRouteProviderConnection[]>;
 
 export interface UsableProviderSet {
@@ -40,7 +41,8 @@ export const defaultOmniRouteProvidersFetcher: OmniRouteProvidersFetcher = async
   baseURL,
   apiKey,
   timeoutMs = 10_000,
-  onSourceError
+  onSourceError,
+  headers
 ) => {
   const empty: OmniRouteProviderConnection[] = [];
   if (!baseURL || !apiKey) return empty;
@@ -52,8 +54,9 @@ export const defaultOmniRouteProvidersFetcher: OmniRouteProvidersFetcher = async
     const res = await fetch(url, {
       method: "GET",
       headers: {
-        Authorization: `Bearer ${apiKey}`,
         Accept: "application/json",
+        ...(headers ?? {}),
+        Authorization: `Bearer ${apiKey}`,
       },
       signal: ac.signal,
     });