Connection billing, subscription routing, and usage (0.4.0)

[BitL8-ByteShort]

Connecting a subscription-backed model could show “Available” alongside “Unknown — Blocked” because public API pricing was being used as the access gate. Empty SDK-default endpoints and provider-owned authentication transports also caused identity conflicts.

This 0.4.0 change separates configured connection access, billing evidence, public prices, and recorded usage:

• Configured Paid policy permits eligible loaded connections when public estimates are unavailable. Free policy still requires verified zero-price evidence. Existing Paid users retain legacy verified-price behavior until explicitly adopting configured Paid access.
• Empty SDK-default URLs are treated as unspecified; custom endpoints cannot inherit another route's prices. Provider-owned authentication fetch is supported without a subscription-to-API fallback. Revoked, missing, or changed explicit bindings stop dispatch.
• The panel exposes connection billing declarations and provenance, exact role bindings, quota when reported, and historical captured usage grouped by billing kind, binding, and currency. Missing values remain unreported. Refresh and conflicts preserve drafts.
• Planner and MCP reload connection evidence. New explicit pins, binding edits, and billing declarations require current connection revisions. Historical assistant usage is immutable, queued work and retention are bounded, and host disposal flushes pending accounting with a deadline.
• Settings schema 4 and managed surface 3 preserve disabled models and requested pins. Plugin upgrades retain the explicit Connect/update and restart boundary. Exact public 0.3.0 Free/Paid migration checks cover private backups and guarded update/recovery; 0.2.1 coverage remains.

Final pre-merge review added per-model route fingerprints for mixed-endpoint providers. Endpoint/SDK changes and swaps invalidate pins and retained repairs, and discard old quota. Homogeneous shared-endpoint additions remain stable. Two independent reviews assessed the original issue and the resulting fix; no unresolved blockers remain.

Local full verification for 060320f: 348 tests passed with zero failures/skips, plus type check and production build on Node 24.14.0 with exact OpenCode 1.18.22. Fresh CI run 34688494703 passed all source, package, and four OS/Node acceptance jobs for this head. CodeQL also passed. Historical candidate CI 34304377304 passed the four OS/Node combinations but predates this correction; its tarball will not be published.

Merged through protected main as 942a94c5eb354da877b22ddc6eb37b098a598f7c with DCO sign-offs. Final artifact CI 34688784337 passed all seven jobs, including Linux/macOS × Node 22.12.0/24.x acceptance. Main CodeQL passed.

Published npm 0.4.0 and immutable GitHub v0.4.0 on 2026-09-12. The release tag resolves to the merge commit. One final tarball was built and published to both channels: SHA-256 1ee2d3ab864f2615ec3f8c750a400694ac8587129bdef78b0d1b275793f0828b.

Public verification completed: independent credential-free npm and GitHub downloads match the final bytes; npm SHA-512/SHA-1 integrity also matches. A fresh version-pinned npm install reports 0.4.0 and matches all 83 package files. Each public download separately passed full installed-package acceptance on Linux / Node 24.14.0: OpenCode 1.18.22 and 1.18.28 each passed 20 scenarios / 57 loopback requests; browser 14/14; 0.3.0 Free/Paid migration, private backups, guarded updates, restart, disconnect, and recovery passed. Zero real-provider inference requests. Release assets contain the four-way final acceptance and public npm evidence; this receipt records the subsequent public GitHub acceptance.

Limits: synthetic loopback credentials and transports do not prove any real account's entitlement. Opaque host transports are host-managed; quota and unreported token semantics are not invented. Captured history is partial and is not added to aggregate host costs. Final-artifact and public-download gates passed; real-account entitlement remains outside synthetic acceptance.