Merge pull request #16 from BaseInfinity/v0.12.0-opencode-zen

v0.12.0: managed tier with OpenCode Zen

Author: BaseInfinity

AGENTS.md

@@ -82,6 +82,7 @@ Tiers (privacy-first ordering):
 | `enterprise` | Stays in your tenant | Azure OpenAI, AWS Bedrock |
 | `hosted_oss` | Open weights, third-party host | Together, Groq, OpenRouter, Cerebras, DeepSeek direct, NVIDIA NIM (`nvidia_nim`) |
 | `proprietary` | Vendor-bound | Anthropic, OpenAI, Google AI Studio (`google_aistudio` — Gemini), Z.AI (`zai` — GLM Coding Plan, post-Anthropic-OAuth-ban migration target) |
+| `managed` | OpenCode-routed PAYG | OpenCode Zen (`opencode` — 40+ models incl. free tier; official new-user entry point) |
 
 See [`docs/cost-ladder.md`](docs/cost-ladder.md) for $0/$20/$200 monthly
 budget paths and a per-job picker (routine fix vs long-context refactor

CHANGELOG.md

@@ -2,6 +2,101 @@
 
 All notable changes to opencode-sdlc-wizard.
 
+## [0.12.0] - 2026-05-18
+
+### Added — `managed` tier with OpenCode Zen as 5th privacy tier
+
+The first new tier since v0.2.0. **OpenCode Zen** is OpenCode's own
+vendor-routed PAYG service — 40+ models including a free tier (Big
+Pickle, DeepSeek V4 Flash Free, MiniMax M2.5 Free, Nemotron 3 Super
+Free), $5 auto-reload trigger. Per May-2026 research, Zen is the
+"official recommended new-user entry point" — the wizard now reflects
+this in both the detector cascade and the tier table.
+
+```bash
+export OPENCODE_ZEN_API_KEY="..."
+npx opencode-sdlc-wizard pick                # auto-detected
+npx opencode-sdlc-wizard pick --tier managed --provider opencode
+npx opencode-sdlc-wizard pick --tier managed --provider zen          # alias
+```
+
+Yields:
+
+```json
+{
+  "model": "opencode/gpt-5.5",
+  "provider": {
+    "opencode": {
+      "npm": "@ai-sdk/openai-compatible",
+      "options": {
+        "apiKey": "{env:OPENCODE_ZEN_API_KEY}",
+        "baseURL": "https://opencode.ai/zen/v1"
+      },
+      "models": { "gpt-5.5": {} }
+    }
+  }
+}
+```
+
+### Verified live (Zen docs, fetched 2026-05-18)
+
+- **Canonical provider id**: `opencode` (per Zen's docs — model pin format `opencode/<model>`)
+- **baseURL**: `https://opencode.ai/zen/v1` (OpenAI-compatible)
+- **Auth**: `{env:OPENCODE_ZEN_API_KEY}` — namespaced to avoid collision with anything else "opencode"
+- **Default model**: `gpt-5.5` (Zen's own documented example string)
+- **Pricing**: PAYG per 1M tokens; free-tier models available; $5 reload trigger / default $20 reload
+
+### New 5th tier — `managed`
+
+| Tier | Privacy semantics |
+|---|---|
+| `private_local` | Your machine, zero egress |
+| `enterprise` | Your tenant (Azure, Bedrock) |
+| `hosted_oss` | Open weights, third-party host (you pick the upstream) |
+| **`managed`** | **OpenCode-routed PAYG; vendor manages routing** |
+| `proprietary` | Vendor-bound (you bring the API key, vendor sees prompts) |
+
+Position is intentional: prompts go through OpenCode's infra (less
+private than DIY hosted, more managed than your own vendor key). Sits
+between `hosted_oss` and `proprietary` in the privacy-first cascade.
+
+### Changed
+
+- `scripts/detect-backends.sh`:
+  - New `M_OPENCODE_ZEN_SET="$(env_set OPENCODE_ZEN_API_KEY)"` probe
+  - New `managed.opencode.{key_set, env}` entry in JSON output
+  - Privacy-first cascade: `managed` placed between `hosted_oss` and `proprietary`
+  - Free-tier-first cascade: `managed` placed between `proprietary/zai` and `proprietary/anthropic` (Zen has free models so beats paid Anthropic on cost)
+- `scripts/configure-backend.sh`:
+  - `PROVIDER_ALIASES` (4 new entries): `opencode → opencode`, `opencode_zen → opencode`, `opencode-zen → opencode`, `zen → opencode`
+  - `fragmentFor` new `managed/opencode` case with the verified config
+- `scripts/pick-backend.sh`:
+  - `default_model_for()` new `managed/opencode|opencode_zen|opencode-zen|zen` → `gpt-5.5` entry
+- `AGENTS.md`: tier table gains a `managed` row
+
+### Tests
+
+- `tests/test-backend-picker.sh` adds T66–T69:
+  - T66: configure-backend writes correct Zen provider block (id, baseURL, apiKey, npm adapter, models entry)
+  - T67: alias resolution (`zen → opencode`)
+  - T68: detector picks up `OPENCODE_ZEN_API_KEY` and recommends `managed/opencode` (fake HOME + stripped PATH)
+  - T69: `managed/opencode` composes with v0.10.x/v0.11.x agent flags (reviewer + sandbox + temp), same-provider coder+reviewer collapses to single provider block
+- `tests/test-pick.sh` T12 default-model drift gate gains `managed/opencode:gpt-5.5` entry
+- **400 tests across 12 suites** (was 395 / 12 in v0.11.2)
+
+### Why minor bump (v0.11.x → v0.12.0)
+
+New top-level tier in the JSON output. Detector schema gained a new
+top-level key (`managed`). User-visible enough to warrant the minor.
+Purely additive — every v0.11.x flag and provider continues to work
+unchanged.
+
+### Compat
+
+- 16 of 16 v0.11.2 default-model entries unchanged.
+- Every existing tier + provider continues to work identically.
+- Every v0.10.x/v0.11.x flag works on the new `managed/opencode` tier+provider exactly as it does on the other tiers (verified by T69's full hybrid test).
+
 ## [0.11.2] - 2026-05-18
 
 ### Added — Security agent (full set: model + temperature + tools-denial sandbox)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-sdlc-wizard",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "SDLC enforcement for OpenCode CLI — privacy-first, any-backend portability with a four-tier backend picker plus an OSS-tier cross-model-review skill so the full SDLC loop can run with zero Anthropic+OpenAI lock-in. Ships JSON Schemas for review artifacts so any consumer (cross-model-review, ditto, CI) can validate. Install with `npx opencode-sdlc-wizard init`. Sibling of agentic-sdlc-wizard and codex-sdlc-wizard.",
   "bin": {
     "opencode-sdlc-wizard": "cli/bin/opencode-sdlc-wizard.js"

scripts/configure-backend.sh

@@ -7,6 +7,7 @@
 #   enterprise      azure_openai / aws_bedrock
 #   hosted_oss      together / groq / openrouter / cerebras / deepseek / nvidia_nim
 #   proprietary     anthropic / openai / google_aistudio / zai
+#   managed         opencode (OpenCode Zen — vendor-routed PAYG over 40+ models)
 #
 # Usage:
 #   configure-backend.sh --tier <tier> --provider <provider> --model <model>
@@ -263,6 +264,13 @@ const PROVIDER_ALIASES = {
   "z.ai": "zai",
   z_ai: "zai",
   glm: "zai",
+  // v0.12.0: OpenCode Zen — managed tier, vendor-routed PAYG over 40+
+  // models. Canonical provider id in opencode.json is "opencode" per
+  // Zen's docs (model pin format: "opencode/<model>").
+  opencode: "opencode",
+  opencode_zen: "opencode",
+  "opencode-zen": "opencode",
+  zen: "opencode",
 };
 const provider = PROVIDER_ALIASES[providerArg] || providerArg;
 
@@ -489,6 +497,26 @@ function fragmentFor(tier, provider, model) {
           },
         },
       };
+    case "managed/opencode":
+      // OpenCode Zen — vendor-managed routing over 40+ models including
+      // a free tier (Big Pickle, DeepSeek V4 Flash Free, MiniMax M2.5
+      // Free, Nemotron 3 Super Free). PAYG, $5 auto-reload trigger.
+      // Provider id is "opencode" per Zen's own docs (model pin format
+      // "opencode/<model>"). OpenAI-compatible endpoint at
+      // https://opencode.ai/zen/v1.
+      return {
+        model: `opencode/${model}`,
+        provider: {
+          opencode: {
+            npm: "@ai-sdk/openai-compatible",
+            options: {
+              apiKey: "{env:OPENCODE_ZEN_API_KEY}",
+              baseURL: "https://opencode.ai/zen/v1",
+            },
+            models: { [model]: {} },
+          },
+        },
+      };
     default:
       throw new Error(`unsupported tier/provider: ${t}`);
   }

scripts/detect-backends.sh

@@ -7,6 +7,7 @@
 #   "enterprise":     { azure_openai, aws_bedrock },
 #   "hosted_oss":     { together, groq, openrouter, cerebras, deepseek, nvidia_nim },
 #   "proprietary":    { anthropic, openai, google_aistudio, zai },
+#   "managed":        { opencode (OpenCode Zen) },
 #   "recommendation": "<tier>/<provider>"
 # }
 #
@@ -118,6 +119,12 @@ PR_ANTHROPIC_SET="$(env_set ANTHROPIC_API_KEY)"
 PR_OPENAI_SET="$(env_set OPENAI_API_KEY)"
 # v0.11.0: Z.AI GLM Coding Plan. Closed weights → proprietary tier.
 PR_ZAI_SET="$(env_set ZAI_API_KEY)"
+# v0.12.0: OpenCode Zen — managed tier. PAYG, OpenCode's hosted routing
+# service over 40+ models with a free tier. New 5th privacy tier
+# between hosted_oss and proprietary: it's vendor-managed (you don't
+# pick the upstream provider, Zen routes for you) but your prompts go
+# through OpenCode's infra, not Anthropic/OpenAI direct.
+M_OPENCODE_ZEN_SET="$(env_set OPENCODE_ZEN_API_KEY)"
 
 # Recommendation cascade — privacy-first by default. When DETECT_FREE_TIER_FIRST=1
 # (set by configure-backend.sh's --free-tier-first), bias toward providers with
@@ -137,6 +144,10 @@ recommend_privacy_first() {
   if [ "$H_NVIDIA_SET" = "true" ]; then echo "hosted_oss/nvidia_nim"; return; fi
   if [ "$H_DEEPSEEK_SET" = "true" ]; then echo "hosted_oss/deepseek"; return; fi
   if [ "$H_OPENROUTER_SET" = "true" ]; then echo "hosted_oss/openrouter"; return; fi
+  # managed tier (OpenCode Zen) sits between hosted_oss and proprietary in
+  # the privacy-first cascade: prompts go through OpenCode's hosted infra
+  # (less private than DIY hosted, more managed than your own vendor key).
+  if [ "$M_OPENCODE_ZEN_SET" = "true" ]; then echo "managed/opencode"; return; fi
   if [ "$PR_ANTHROPIC_SET" = "true" ]; then echo "proprietary/anthropic"; return; fi
   if [ "$PR_OPENAI_SET" = "true" ]; then echo "proprietary/openai"; return; fi
   if [ "$H_GOOGLE_AISTUDIO_SET" = "true" ]; then echo "proprietary/google_aistudio"; return; fi
@@ -167,6 +178,10 @@ recommend_free_tier_first() {
   # community signal (May-2026 post-OAuth-ban migration target) ranks it
   # above the other proprietary tiers when cost matters more than ceiling.
   if [ "$PR_ZAI_SET" = "true" ]; then echo "proprietary/zai"; return; fi
+  # OpenCode Zen also goes here — has a free tier (Big Pickle, DeepSeek
+  # V4 Flash Free, MiniMax M2.5 Free, Nemotron 3 Super Free) so it
+  # beats paid-per-token Anthropic/OpenAI on cost.
+  if [ "$M_OPENCODE_ZEN_SET" = "true" ]; then echo "managed/opencode"; return; fi
   if [ "$PR_ANTHROPIC_SET" = "true" ]; then echo "proprietary/anthropic"; return; fi
   if [ "$PR_OPENAI_SET" = "true" ]; then echo "proprietary/openai"; return; fi
   echo "none"
@@ -207,6 +222,9 @@ cat <<EOF
     "google_aistudio": { "key_set": $H_GOOGLE_AISTUDIO_SET,  "env": "GOOGLE_API_KEY" },
     "zai":             { "key_set": $PR_ZAI_SET,             "env": "ZAI_API_KEY" }
   },
+  "managed": {
+    "opencode": { "key_set": $M_OPENCODE_ZEN_SET, "env": "OPENCODE_ZEN_API_KEY" }
+  },
   "recommendation": "$RECOMMENDATION"
 }
 EOF

scripts/pick-backend.sh

@@ -216,6 +216,8 @@ default_model_for() {
                                   echo "gemini-3.1-pro" ;;
     proprietary/zai|proprietary/z.ai|proprietary/z_ai|proprietary/glm)
                                   echo "glm-4.6" ;;
+    managed/opencode|managed/opencode_zen|managed/opencode-zen|managed/zen)
+                                  echo "gpt-5.5" ;;
     *) return 1 ;;
   esac
 }

tests/test-backend-picker.sh

@@ -1434,6 +1434,102 @@ console.log('ok');
   fi
 fi
 
+# --- v0.12.0: OpenCode Zen as new 5th "managed" tier. Vendor-routed PAYG
+# over 40+ models including a free tier. Provider id `opencode` (per Zen's
+# own docs — model pin format `opencode/<model>`). Aliases: opencode_zen,
+# opencode-zen, zen. baseURL https://opencode.ai/zen/v1, env OPENCODE_ZEN_API_KEY.
+
+# --- T66: configure-backend writes correct OpenCode Zen provider block
+if [ -x "$CONFIG" ]; then
+  T="$TMP_ROOT/t66"; mkdir -p "$T"
+  (cd "$T" && "$CONFIG" --tier managed --provider opencode --model "gpt-5.5" >/dev/null 2>&1) || true
+  if [ -f "$T/opencode.json" ]; then
+    ok="$(node -e "
+const j=require('$T/opencode.json');
+if(j.model!=='opencode/gpt-5.5'){console.log('model-wrong:'+j.model);process.exit(1)}
+if(!j.provider||!j.provider.opencode){console.log('missing-opencode-block');process.exit(1)}
+const opts=j.provider.opencode.options||{};
+if(opts.apiKey!=='{env:OPENCODE_ZEN_API_KEY}'){console.log('wrong-apikey:'+opts.apiKey);process.exit(1)}
+if(opts.baseURL!=='https://opencode.ai/zen/v1'){console.log('wrong-baseurl:'+opts.baseURL);process.exit(1)}
+if(j.provider.opencode.npm!=='@ai-sdk/openai-compatible'){console.log('wrong-npm');process.exit(1)}
+if(!j.provider.opencode.models||!j.provider.opencode.models['gpt-5.5']){console.log('missing-model-entry');process.exit(1)}
+console.log('ok');
+" 2>/dev/null || echo 'failed')"
+    if [ "$ok" = "ok" ]; then
+      pass "configure-backend writes OpenCode Zen provider block (managed/opencode, gpt-5.5)"
+    else
+      fail "T66 — $ok"
+    fi
+  fi
+fi
+
+# --- T67: Zen aliases (zen, opencode_zen, opencode-zen) resolve to canonical 'opencode'
+if [ -x "$CONFIG" ]; then
+  T="$TMP_ROOT/t67"; mkdir -p "$T"
+  (cd "$T" && "$CONFIG" --tier managed --provider zen --model "gpt-5.5" >/dev/null 2>&1) || true
+  if [ -f "$T/opencode.json" ]; then
+    ok="$(node -e "
+const j=require('$T/opencode.json');
+if(j.model!=='opencode/gpt-5.5'){console.log('alias-pin-wrong:'+j.model);process.exit(1)}
+if(!j.provider.opencode){console.log('alias-block-missing');process.exit(1)}
+if(j.provider.zen){console.log('non-canonical-key-present');process.exit(1)}
+console.log('ok');
+" 2>/dev/null || echo 'failed')"
+    if [ "$ok" = "ok" ]; then
+      pass "OpenCode Zen alias 'zen' resolves to canonical 'opencode' provider id"
+    else
+      fail "T67 — $ok"
+    fi
+  fi
+fi
+
+# --- T68: detect-backends picks up OPENCODE_ZEN_API_KEY and emits managed/opencode
+if [ -x "$DETECT" ]; then
+  FAKE_HOME="$TMP_ROOT/t68-home"; mkdir -p "$FAKE_HOME"
+  ok="$(env -i HOME="$FAKE_HOME" PATH="/usr/bin:/bin" OPENCODE_ZEN_API_KEY="x" "$DETECT" 2>/dev/null | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+  try{const j=JSON.parse(d);
+    if(!j.managed||!j.managed.opencode){console.log('no-managed-block');process.exit(1)}
+    if(j.managed.opencode.key_set!==true){console.log('not-detected');process.exit(1)}
+    if(j.managed.opencode.env!=='OPENCODE_ZEN_API_KEY'){console.log('wrong-env');process.exit(1)}
+    if(j.recommendation!=='managed/opencode'){console.log('not-recommended:'+j.recommendation);process.exit(1)}
+    console.log('ok');
+  }catch(e){console.log('parse-fail:'+e.message)}
+})" 2>/dev/null || echo 'failed')"
+  if [ "$ok" = "ok" ]; then
+    pass "detect-backends picks up OPENCODE_ZEN_API_KEY and recommends managed/opencode"
+  else
+    fail "T68 — $ok"
+  fi
+fi
+
+# --- T69: managed tier composes with all v0.10.x/v0.11.x agent flags
+#         (the entire flag surface should work on the new tier too)
+if [ -x "$CONFIG" ]; then
+  T="$TMP_ROOT/t69"; mkdir -p "$T"
+  (cd "$T" && "$CONFIG" \
+     --tier managed --provider opencode --model gpt-5.5 \
+     --reviewer-tier managed --reviewer-provider opencode --reviewer-model claude-opus-4-7 \
+     --sandbox-test-writer --coder-temp 0.3 >/dev/null 2>&1) || true
+  if [ -f "$T/opencode.json" ]; then
+    ok="$(node -e "
+const j=require('$T/opencode.json');
+if(j.model!=='opencode/gpt-5.5'){console.log('coder-wrong');process.exit(1)}
+if(j.agent.review.model!=='opencode/claude-opus-4-7'){console.log('rev-wrong:'+j.agent.review.model);process.exit(1)}
+if(j.agent.build.temperature!==0.3){console.log('temp-wrong');process.exit(1)}
+if(!j.agent['test-writer']){console.log('no-tw');process.exit(1)}
+// Both coder and reviewer use same provider (opencode) — single provider block
+if(Object.keys(j.provider).length!==1){console.log('expected-single-provider-got:'+Object.keys(j.provider).join(','));process.exit(1)}
+console.log('ok');
+" 2>/dev/null || echo 'failed')"
+    if [ "$ok" = "ok" ]; then
+      pass "managed/opencode composes with --reviewer-* / --sandbox-* / --*-temp (full v0.11.x surface)"
+    else
+      fail "T69 — $ok"
+    fi
+  fi
+fi
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ] || exit 1

tests/test-pick.sh

@@ -246,7 +246,8 @@ for combo in \
     "proprietary/anthropic:claude" \
     "proprietary/openai:gpt" \
     "proprietary/google_aistudio:gemini" \
-    "proprietary/zai:glm"; do
+    "proprietary/zai:glm" \
+    "managed/opencode:gpt-5.5"; do
   combo_pair="${combo%%:*}"
   expected_substr="${combo##*:}"
   T="$TMP_ROOT/t12-${combo_pair//\//-}"; make_target "$T" "private_local/ollama"