[justin-carper]

Summary

Patches the open security advisories, fixes the missing non-cached input tokens from #146, and regenerates the model data so the weekly drift check passes again. Supersedes Dependabot PRs #139, #143 and #144.

Security (npm audit: 10 findings → 0)

• @cursor/sdk 1.0.32 → 1.1.0, @connectrpc/connect-node → 2.3.0
• @opencode-ai/plugin + @opencode-ai/sdk → 1.19.4
• vitest → 5.0.5 (vite 8.3.5, @vitest/mocker 5.0.5), which clears the vite / launch-editor / mocker advisories
• source-map-js → 1.2.2, through a postcss refresh
• New overrides:
  • zod ^4.6.6 under @opencode-ai/plugin (GHSA-mrhx-c7xc-m3w5)
  • toml ^5.0.1 (GHSA-4qx8-w7c3-pj3p, GHSA-9j65-hcg3-gc64, GHSA-9qmh-m7c6-f92p). effect only uses toml in unstable/cli.
• Dropped the undici override: nothing in the tree depends on undici any more.
• @cursor/sdk's peer range for zod is ^3.25.0 || ^4.0.0, so it now dedupes to zod 4.6.7.
• Consumers are still exposed: npm doesn't publish overrides. People who install this package still get zod 4.1.8 and toml 4.x from @opencode-ai/plugin's pinned versions until upstream bumps them.
• Skipped on purpose: tsup 9, TypeScript 7, @ai-sdk/provider 4.

Fix: non-cached input tokens (#146)

opencode showed 0 input tokens for Cursor models, so that input was never priced. The cause differs from the one in the issue:

• Cursor's inputTokens already includes cache reads and writes. @cursor/sdk's toTokenUsage computes totalTokens = inputTokens + outputTokens, and Cursor staff confirmed the same for hook payloads. So inputTokens.total was already correct.
• noCache was left undefined. opencode 2.x reads it directly as the non-cached input, so input came out as 0.
• Now noCache = inputTokens − cacheRead − cacheWrite, clamped at 0. The turn's optional reasoningTokens passes through addUsage to outputTokens.reasoning.

Model data

Regenerated src/model-limits.ts with npm run sync:model-limits, because the scheduled drift check was failing on main:

• claude-sonnet-5-5 cache read $0.2 → $0.1
• gemini-3.7-flash and gemini-3.8-flash output $3.5 → $3.75

Test fix

test/mcp-config.test.ts failed 6 tests on main on any machine with global skills installed. The config hook's skill mirror read the real home directory, and its warning crashed pluginLog on the fake client. The test now mocks homedir to a temp dir, the same way plugin-skill-mirror.test.ts does.

Verification

• npm run prepublishOnly: typecheck clean, 42 files / 646 tests pass, build OK
• npm audit: 0 vulnerabilities
• npm run sync:model-limits -- --check: up to date
• Not run: a live opencode + Cursor turn. The usage mapping is covered by unit tests and a doStream test with a fake agent.

Closes #146