[TASK-190] Log refused OpenCode proxy routes (#2122)

* fix(cli): log refused OpenCode proxy routes

Co-authored-by: kai <WyJrYWkiLCJkZWZhdWx0Il0@agents.commonly.invalid>
Agent-Model: codex/gpt-6-luna/max

* fix(cli): bump release for proxy diagnostics

Co-authored-by: kai <WyJrYWkiLCJkZWZhdWx0Il0@agents.commonly.invalid>
Agent-Model: codex/gpt-6-luna/max

---------

Co-authored-by: kai <WyJrYWkiLCJkZWZhdWx0Il0@agents.commonly.invalid>

Author: lilyshen0722

cli/__tests__/adapters.opencode.test.mjs

@@ -364,6 +364,55 @@ describe('opencode external provider config', () => {
     });
   });
 
+  test('logs each refused provider route to wrapper stderr using only its normalized path', async () => {
+    await withTemp(async (root) => {
+      const keyFile = join(root, 'provider-key');
+      const proxyTokenFile = join(root, 'proxy-token');
+      await writeFile(keyFile, 'upstream-secret');
+      await chmod(keyFile, 0o600);
+      let upstreamCalls = 0;
+      const upstream = createServer((req, res) => {
+        upstreamCalls += 1;
+        req.resume();
+        res.writeHead(200).end('{}');
+      });
+      await new Promise((resolve) => upstream.listen(0, '127.0.0.1', resolve));
+      const upstreamPort = upstream.address().port;
+      const proxy = await startProviderProxy({
+        provider: { baseURL: `http://127.0.0.1:${upstreamPort}/v1` },
+        keyFile,
+        tokenFile: proxyTokenFile,
+      });
+      const proxyToken = readFileSync(proxyTokenFile, 'utf8');
+      const stderrWrite = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+      try {
+        const unsupported = await fetch(`${proxy.baseURL}/embeddings?secret=do-not-log`, {
+          method: 'POST',
+          headers: { authorization: `Bearer ${proxyToken}` },
+          body: 'request body must not be logged',
+        });
+        expect(unsupported.status).toBe(403);
+        await unsupported.text();
+
+        const malformed = await requestProxy(proxy.port, '/v1/%2fadmin?secret=do-not-log', {
+          authorization: `Bearer ${proxyToken}`,
+        });
+        expect(malformed).toBe(400);
+
+        expect(stderrWrite.mock.calls.map(([line]) => String(line))).toEqual([
+          '[opencode] provider proxy refused POST /v1/embeddings\n',
+          '[opencode] provider proxy refused POST /v1/%2fadmin\n',
+        ]);
+        expect(stderrWrite.mock.calls).toHaveLength(2);
+        expect(upstreamCalls).toBe(0);
+      } finally {
+        stderrWrite.mockRestore();
+        await proxy.close();
+        await new Promise((resolve) => upstream.close(resolve));
+      }
+    });
+  });
+
   test('uses file-backed provider auth and materializes only the selected model when models are omitted', () => {
     const config = buildProviderConfig({
       id: 'litellm',

cli/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.92",
+  "version": "0.1.93",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

cli/package.json

@@ -342,6 +342,18 @@ const startProviderProxy = async ({ provider, keyFile, tokenFile }) => {
   await writeFile(tokenFile, proxyToken, { encoding: 'utf8', mode: 0o600 });
   await chmod(tokenFile, 0o600);
 
+  const logRefusedRequest = (method, requestPath) => {
+    let normalizedPath = '/';
+    try {
+      normalizedPath = new URL(requestPath || '/', 'http://127.0.0.1').pathname || '/';
+    } catch {
+      // Do not include an unparseable raw request target in logs.
+    }
+    const safeMethod = typeof method === 'string' && /^[A-Z]+$/.test(method)
+      ? method : 'UNKNOWN';
+    process.stderr.write(`[opencode] provider proxy refused ${safeMethod} ${normalizedPath}\n`);
+  };
+
   const server = createServer((incoming, outgoing) => {
     const supplied = Buffer.from(incoming.headers.authorization || '');
     const expected = Buffer.from(`Bearer ${proxyToken}`);
@@ -356,22 +368,26 @@ const startProviderProxy = async ({ provider, keyFile, tokenFile }) => {
       return;
     }
     const rejectRoute = (path) => {
+      logRefusedRequest(incoming.method, path);
       incoming.resume();
       outgoing.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
       outgoing.end(`Unsupported provider request: ${incoming.method || 'UNKNOWN'} ${path}`);
     };
+    const rejectBadRequest = () => {
+      logRefusedRequest(incoming.method, incoming.url);
+      incoming.resume();
+      outgoing.writeHead(400).end();
+    };
 
     let target;
     try {
       const requestPath = incoming.url || '/';
       if (!requestPath.startsWith('/') || requestPath.startsWith('//')) {
-        incoming.resume();
-        outgoing.writeHead(400).end();
+        rejectBadRequest();
         return;
       }
       if (/%(?:2f|5c|2e)/i.test(requestPath)) {
-        incoming.resume();
-        outgoing.writeHead(400).end();
+        rejectBadRequest();
         return;
       }
       // OpenCode owns this local request path, so never use it as an outbound
@@ -405,8 +421,7 @@ const startProviderProxy = async ({ provider, keyFile, tokenFile }) => {
         host: upstream.host,
       };
     } catch {
-      incoming.resume();
-      outgoing.writeHead(400).end();
+      rejectBadRequest();
       return;
     }