feat: support OpenCode V2 with @opencode-ai/plugin@beta

[pascalandr]

Summary

Adds OpenCode V2 support through the package's ./server entrypoint while preserving the existing V1 root export.

The V2 dependency now follows the published @opencode-ai/plugin@beta dist-tag rather than hardcoding a prerelease. The npm and Bun locks were regenerated from that tag.

Implementation

• Default-exports Plugin.define({ id: "opencode.provider.cursor", setup }) from ./server for V2.
• Starts and reuses the existing Bun HTTP proxy, updates its live model list, and stops it during plugin cleanup.
• Registers the Cursor provider with @opencode-ai/ai/providers/openai-compatible and the process-local proxy settings.baseURL.
• Discovers the authenticated account's Cursor models, publishes exact model/variant selection headers, retains cursor/default auto-routing, and reloads the catalog after login, refresh, and startup discovery.
• Registers Cursor PKCE browser OAuth through ctx.integration.transform; callbacks return V2 OAuth credentials for host-owned persistence rather than writing auth.json.
• Rewrites Cursor requests to /v1/chat/completions through ctx.session.hook("http.request"), strips the host credential before localhost dispatch, and preserves the selected Cursor model/variant header.
• Keeps V1 imports on a stable-tag npm alias because the V2 beta package no longer exposes the legacy compatibility subpath.
• Resolves packaged HTTP/2 bridge files with import.meta.url, allowing normal Node and Bun imports from an installed tarball.

V2 configuration

{
  "$schema": "https://opencode.ai/config.json",
  "plugins": ["@openchamber/opencode-cursor"],
  "providers": {
    "cursor": { "name": "Cursor" }
  }
}

OpenCode V2 selects the package's ./server export. OpenCode V1 continues to use the root export.

Discovery fallback

Live account discovery remains the source of truth. If Cursor discovery is temporarily unavailable, the plugin keeps the authorization bootstrap model or the last discovered in-memory catalog until the next login or token refresh; it does not advertise a fabricated static model list.

Validation

• npm run build
• npx tsc -p tsconfig.json --noEmit
• npm test (focused V2 coverage plus the complete existing proxy smoke suite)
• npm pack, isolated install, and Node imports of both @openchamber/opencode-cursor and @openchamber/opencode-cursor/server
• Real isolated opencode2 server smoke against the current beta: plugin ID loaded, Cursor provider/bootstrap catalog present, OAuth attempt started and cancelled, proxy catalog served, and disabling the plugin closed the proxy listener

The deterministic V2 test covers OAuth authorization and refresh, provider/model transforms, exact variant request rewriting, authorization stripping, and cleanup. The smoke did not complete a real Cursor browser login or send an authenticated Cursor model request, so live account discovery and upstream inference remain credential-dependent validation.