diff --git a/.idea/checkstyle-idea.xml b/.idea/checkstyle-idea.xml
new file mode 100644
index 00000000000..75470a03192
--- /dev/null
+++ b/.idea/checkstyle-idea.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="CheckStyle-IDEA" serialisationVersion="2">
+    <checkstyleVersion>10.17.0</checkstyleVersion>
+    <scanScope>JavaOnly</scanScope>
+    <option name="thirdPartyClasspath" />
+    <option name="activeLocationIds" />
+    <option name="locations">
+      <list>
+        <ConfigurationLocation id="bundled-sun-checks" type="BUNDLED" scope="All" description="Sun Checks">(bundled)</ConfigurationLocation>
+        <ConfigurationLocation id="bundled-google-checks" type="BUNDLED" scope="All" description="Google Checks">(bundled)</ConfigurationLocation>
+      </list>
+    </option>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/gradle.xml b/.idea/gradle.xml
index c277e816e3b..f6c679e0e08 100644
--- a/.idea/gradle.xml
+++ b/.idea/gradle.xml
@@ -5,7 +5,7 @@
     <option name="linkedExternalProjectsSettings">
       <GradleProjectSettings>
         <option name="externalProjectPath" value="$PROJECT_DIR$/extensions/intellij" />
-        <option name="gradleJvm" value="homebrew-17" />
+        <option name="gradleJvm" value="17" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$/extensions/intellij" />
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 00000000000..4fd9d8b8988
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+@types:registry=https://registry.npmjs.org/
+registry=https://registry.npmjs.org/
\ No newline at end of file
diff --git a/binary/package-lock.json b/binary/package-lock.json
index 11dd6505b87..e740ac359ae 100644
--- a/binary/package-lock.json
+++ b/binary/package-lock.json
@@ -67,9 +67,11 @@
         "cheerio": "^1.0.0-rc.12",
         "commander": "^12.0.0",
         "comment-json": "^4.2.3",
+        "crypto-js": "^4.2.0",
         "dbinfoz": "^0.14.0",
         "diff": "^7.0.0",
         "dotenv": "^16.4.5",
+        "express": "^5.1.0",
         "fastest-levenshtein": "^1.0.16",
         "filtrex": "^3.1.0",
         "follow-redirects": "^1.15.5",
@@ -77,11 +79,13 @@
         "handlebars": "^4.7.8",
         "http-proxy-agent": "^7.0.1",
         "https-proxy-agent": "^7.0.3",
+        "iconv-lite": "^0.6.3",
         "ignore": "^5.3.1",
         "is-localhost-ip": "^2.0.0",
         "jinja-js": "0.1.8",
         "js-tiktoken": "^1.0.8",
         "jsdom": "^24.0.0",
+        "jwt-decode": "4.0.0",
         "launchdarkly-node-client-sdk": "^3.2.0",
         "llm-code-highlighter": "^0.0.14",
         "lru-cache": "^11.0.2",
@@ -90,7 +94,8 @@
         "node-html-markdown": "^1.3.0",
         "ollama": "^0.4.6",
         "onnxruntime-node": "1.14.0",
-        "openai": "^4.76.0",
+        "openai": "^4.104.0",
+        "openid-client": "^5.7.1",
         "p-limit": "^6.1.0",
         "partial-json": "^0.1.7",
         "pg": "^8.11.3",
@@ -123,7 +128,9 @@
         "@google/generative-ai": "^0.11.4",
         "@shikijs/colorized-brackets": "^3.7.0",
         "@shikijs/transformers": "^3.7.0",
+        "@types/crypto-js": "^4.2.2",
         "@types/diff": "^7.0.1",
+        "@types/express": "^5.0.3",
         "@types/follow-redirects": "^1.14.4",
         "@types/jest": "^29.5.12",
         "@types/jquery": "^3.5.29",
diff --git a/core/autocomplete/CompletionProvider.ts b/core/autocomplete/CompletionProvider.ts
index 0d974e31721..fab623d37ad 100644
--- a/core/autocomplete/CompletionProvider.ts
+++ b/core/autocomplete/CompletionProvider.ts
@@ -63,7 +63,7 @@ export class CompletionProvider {
 
     // Ignore empty API keys for Mistral since we currently write
     // a template provider without one during onboarding
-    if (llm.providerName === "mistral" && llm.apiKey === "") {
+    if ((llm.providerName === "mistral" || llm.providerName === "oca") && llm.apiKey === "") {
       return undefined;
     }
 
diff --git a/core/config/load.ts b/core/config/load.ts
index 5206bb8bb04..73bd569fdb0 100644
--- a/core/config/load.ts
+++ b/core/config/load.ts
@@ -653,6 +653,7 @@ function llmToSerializedModelDescription(llm: ILLM): ModelDescription {
     apiKeyLocation: llm.apiKeyLocation,
     envSecretLocations: llm.envSecretLocations,
     sourceFile: llm.sourceFile,
+    modelInfo: llm.getModelInfo(llm.model)
   };
 }
 
diff --git a/core/index.d.ts b/core/index.d.ts
index f9fdc34cf4a..b5b409ef929 100644
--- a/core/index.d.ts
+++ b/core/index.d.ts
@@ -94,6 +94,7 @@ type RequiredLLMOptions =
 export interface ILLM
   extends Omit<LLMOptions, RequiredLLMOptions>,
     Required<Pick<LLMOptions, RequiredLLMOptions>> {
+  getModelInfo(model: string): ModelInfo | undefined;
   get providerName(): string;
   get underlyingProviderName(): string;
 
@@ -1131,6 +1132,26 @@ export interface ModelCapability {
   tools?: boolean;
 }
 
+export interface ModelInfo {
+  maxTokens?: number | undefined;
+  contextWindow?: number | undefined;
+  supportsImages?: boolean | undefined;
+  supportsPromptCache: boolean;
+  inputPrice?: number | undefined;
+  outputPrice?: number | undefined;
+  cacheWritesPrice?: number | undefined;
+  cacheReadsPrice?: number | undefined;
+  description?: string | undefined;
+  temperature?: number | undefined;
+  surveyContent?: string | undefined;
+  surveyId?: string | undefined;
+  bannerContent?: string | undefined;
+  modelName: string;
+}
+
+export interface ModelInfoMap {
+  models: { [key: string]: ModelInfo };
+}
 export interface ModelDescription {
   title: string;
   provider: string;
@@ -1156,6 +1177,7 @@ export interface ModelDescription {
   promptTemplates?: { [key: string]: string };
   cacheBehavior?: CacheBehavior;
   capabilities?: ModelCapability;
+  modelInfo?: ModelInfo
   roles?: ModelRole[];
   configurationStatus?: LLMConfigurationStatuses;
 
diff --git a/core/llm/index.ts b/core/llm/index.ts
index 0df366bbf25..54ea22243f9 100644
--- a/core/llm/index.ts
+++ b/core/llm/index.ts
@@ -29,6 +29,7 @@ import {
   TabAutocompleteOptions,
   TemplateType,
   Usage,
+  type ModelInfo,
 } from "../index.js";
 import mergeJson from "../util/merge.js";
 import { renderChatMessage } from "../util/messageContent.js";
@@ -295,6 +296,12 @@ export abstract class BaseLLM implements ILLM {
     this.autocompleteOptions = options.autocompleteOptions;
     this.sourceFile = options.sourceFile;
   }
+  getModelInfo(model: string): ModelInfo | undefined {
+    return undefined;
+  }
+  useLegacyCompletionsEndpoint?: boolean | undefined;
+  modelArn?: string | undefined;
+  env?: Record<string, string | number | boolean> | undefined;
 
   getConfigurationStatus() {
     return LLMConfigurationStatuses.VALID;
diff --git a/core/llm/llms/BedrockImport.ts b/core/llm/llms/BedrockImport.ts
index 3ab45f373f7..f378561232b 100644
--- a/core/llm/llms/BedrockImport.ts
+++ b/core/llm/llms/BedrockImport.ts
@@ -13,7 +13,7 @@ class BedrockImport extends BaseLLM {
     region: "us-east-1",
   };
   // the BedRock imported custom model ARN
-  modelArn?: string | undefined;
+  declare modelArn?: string | undefined;
 
   constructor(options: LLMOptions) {
     super(options);
diff --git a/core/llm/llms/index.ts b/core/llm/llms/index.ts
index 0522bbda65e..c918150d506 100644
--- a/core/llm/llms/index.ts
+++ b/core/llm/llms/index.ts
@@ -62,6 +62,7 @@ import Vllm from "./Vllm";
 import Voyage from "./Voyage";
 import WatsonX from "./WatsonX";
 import xAI from "./xAI";
+import Oca from "./oca/Oca";
 export const LLMClasses = [
   Anthropic,
   Cohere,
@@ -116,6 +117,7 @@ export const LLMClasses = [
   Inception,
   Voyage,
   LlamaStack,
+  Oca
 ];
 
 export async function llmFromDescription(
diff --git a/core/llm/llms/oca/Oca.ts b/core/llm/llms/oca/Oca.ts
new file mode 100644
index 00000000000..51e11cdf005
--- /dev/null
+++ b/core/llm/llms/oca/Oca.ts
@@ -0,0 +1,249 @@
+import { ChatCompletionCreateParams } from "openai/resources/index";
+
+import { streamSse } from "@continuedev/fetch";
+import {
+  ChatMessage,
+  CompletionOptions,
+  LLMOptions,
+  Tool,
+  type ModelInfo,
+} from "../../../index.js";
+import { renderChatMessage } from "../../../util/messageContent.js";
+import { BaseLLM } from "../../index.js";
+import {
+  fromChatCompletionChunk,
+  LlmApiRequestType,
+  toChatBody,
+} from "../../openaiTypeConverters.js";
+import { OcaTokenManager } from "./util/ocaTokenManager.js";
+import { createOcaHeaders, generateOpcRequestId } from "./util/utils.js";
+import { DEFAULT_OCA_BASE_URL } from "./util/constants.js";
+
+interface ModelInfoMap {
+  models: { [key: string]: ModelInfo };
+}
+
+const parsePrice = (price: any) => {
+  if (price) {
+    return parseFloat(price) * 1_000_000;
+  }
+  return undefined;
+};
+class Oca extends BaseLLM {
+  private modelMap: ModelInfoMap;
+
+  constructor(options: LLMOptions) {
+    super({
+      ...options,
+      template: "none", //AICODE-3372
+      capabilities: {
+        uploadImage: false,
+        tools: true,
+      },
+    });
+    this.uniqueId = options.uniqueId || "no-unique-id";
+    this.apiVersion = options.apiVersion;
+    this.apiBase = options.apiBase;
+    this.modelMap = { models: {} };
+  }
+
+  static providerName = "oca";
+  static defaultOptions: Partial<LLMOptions> | undefined = {
+    apiBase: DEFAULT_OCA_BASE_URL,
+  };
+
+  protected useOpenAIAdapterFor: (LlmApiRequestType | "*")[] = [
+    "list",
+    "streamChat",
+  ];
+
+  protected _convertModelName(model: string): string {
+    return model;
+  }
+
+  private convertTool(tool: Tool): any {
+    return {
+      type: tool.type,
+      function: {
+        name: tool.function.name,
+        description: tool.function.description,
+        parameters: tool.function.parameters,
+        strict: tool.function.strict,
+      },
+    };
+  }
+
+  protected extraBodyProperties(): Record<string, any> {
+    return {};
+  }
+
+  protected getMaxStopWords(): number {
+    return 4;
+  }
+
+  protected _convertArgs(
+    options: CompletionOptions,
+    messages: ChatMessage[],
+  ): ChatCompletionCreateParams {
+    const finalOptions = toChatBody(messages, options);
+
+    finalOptions.stop = options.stop?.slice(0, this.getMaxStopWords());
+    return finalOptions;
+  }
+
+  protected async _getHeaders() {
+    const token = (await OcaTokenManager.getToken()).access_token;
+    if (!token) {
+      throw new Error(
+        "Oracle Code Assist Access Token not found or expired. Please log in again",
+      );
+    }
+    const ocaHeaders = await createOcaHeaders(token, this.uniqueId);
+    console.log(
+      `Making request with customer opc-request-id: ${ocaHeaders["opc-request-id"]}`,
+    );
+    return ocaHeaders;
+  }
+
+  protected async _complete(
+    prompt: string,
+    signal: AbortSignal,
+    options: CompletionOptions,
+  ): Promise<string> {
+    let completion = "";
+    for await (const chunk of this._streamChat(
+      [{ role: "user", content: prompt }],
+      signal,
+      options,
+    )) {
+      completion += chunk.content;
+    }
+
+    return completion;
+  }
+
+  protected _getEndpoint(
+    endpoint: "chat/completions" | "models" | "model/info",
+  ) {
+    if (!this.apiBase) {
+      throw new Error(
+        "No API base URL provided. Please set the 'apiBase' option in config.json",
+      );
+    }
+    // Remove trailing slashes from base and leading/trailing slashes from endpoint
+    const base = this.apiBase.replace(/\/+$/, "");
+    const ep = endpoint.replace(/^\/+|\/+$/g, "");
+
+    // Build the path
+    let urlStr = base;
+    if (ep) urlStr += `/${ep}`;
+
+    return new URL(urlStr);
+  }
+
+  protected async *_streamComplete(
+    prompt: string,
+    signal: AbortSignal,
+    options: CompletionOptions,
+  ): AsyncGenerator<string> {
+    for await (const chunk of this._streamChat(
+      [{ role: "user", content: prompt }],
+      signal,
+      options,
+    )) {
+      yield renderChatMessage(chunk);
+    }
+  }
+
+  protected modifyChatBody(
+    body: ChatCompletionCreateParams,
+  ): ChatCompletionCreateParams {
+    body.stop = body.stop?.slice(0, this.getMaxStopWords());
+    return body;
+  }
+
+  protected async *_streamChat(
+    messages: ChatMessage[],
+    signal: AbortSignal,
+    options: CompletionOptions,
+  ): AsyncGenerator<ChatMessage> {
+    const body = this._convertArgs(options, messages);
+    const headers = await this._getHeaders();
+
+    const response = await this.fetch(this._getEndpoint("chat/completions"), {
+      method: "POST",
+      headers: headers,
+      body: JSON.stringify({
+        ...body,
+        ...this.extraBodyProperties(),
+      }),
+      signal,
+    });
+
+    // Handle non-streaming response
+    if (body.stream === false) {
+      if (response.status === 499) {
+        return; // Aborted by user
+      }
+      const data = await response.json();
+      yield data.choices[0].message;
+      return;
+    }
+
+    for await (const value of streamSse(response)) {
+      const chunk = fromChatCompletionChunk(value);
+      if (chunk) {
+        yield chunk;
+      }
+    }
+  }
+
+  async listModels(): Promise<string[]> {
+    const headers = await this._getHeaders();
+    const response = await this.fetch(this._getEndpoint("model/info"), {
+      method: "GET",
+      headers: headers,
+    });
+
+    const data = (await response.json()).data;
+    // Initialize the map
+    for (const model of data) {
+      if (typeof model?.litellm_params?.model !== "string") {
+        continue;
+      }
+      const modelId: string = model.litellm_params.model;
+      const maxTokens = model.litellm_params?.max_tokens;
+      if (!modelId) {
+        continue;
+      }
+
+      const modelInfo = model.model_info;
+
+      const ocaModelInfo: ModelInfo = {
+        maxTokens: maxTokens || -1,
+        contextWindow: modelInfo.context_window,
+        supportsImages: modelInfo.supports_vision || false,
+        supportsPromptCache: modelInfo.supports_caching || false,
+        inputPrice: parsePrice(modelInfo.input_price) || 0,
+        outputPrice: parsePrice(modelInfo.output_price) || 0,
+        cacheWritesPrice: parsePrice(modelInfo.caching_price) || 0,
+        cacheReadsPrice: parsePrice(modelInfo.cached_price) || 0,
+        description: modelInfo.description,
+        surveyContent: modelInfo.survey_content,
+        surveyId: modelInfo.survey_id,
+        temperature: modelInfo.temperature || 0,
+        bannerContent: modelInfo.banner,
+        modelName: modelId,
+      };
+      this.modelMap.models[modelId] = ocaModelInfo;
+    }
+    console.log("Oca models fetched", this.modelMap);
+    return Object.keys(this.modelMap.models);
+  }
+
+  getModelInfo(model: string): ModelInfo | undefined {
+    return this.modelMap.models[model];
+  }
+}
+
+export default Oca;
diff --git a/core/llm/llms/oca/util/constants.ts b/core/llm/llms/oca/util/constants.ts
new file mode 100644
index 00000000000..6b69af13d7f
--- /dev/null
+++ b/core/llm/llms/oca/util/constants.ts
@@ -0,0 +1,17 @@
+import path from "path"
+import os from "os"
+
+// OAUTH
+export const DEFAULT_IDCS_CLIENT_ID = "a8331954c0cf48ba99b5dd223a14c6ea"
+export const DEFAULT_IDCS_URL = "https://idcs-9dc693e80d9b469480d7afe00e743931.identity.oraclecloud.com"
+export const DEFAULT_IDSC_SCOPES = "openid offline_access"
+export const DEFAULT_IDCS_PORT_CANDIDATES = [8669, 8668, 8667]
+export const DEFAULT_USE_PKCE = true
+export const OCA_CONFIG_PATH = path.join(os.homedir(), ".oca", "config.json")
+export const OCA_RENEW_TOKEN_BUFFER_SEC = 180 // 3 minutes
+
+// OCA LITELLM
+export const DEFAULT_OCA_BASE_URL = "https://code-internal.aiservice.us-chicago-1.oci.oraclecloud.com/20250206/app/litellm"
+
+// OCA SURVEY
+export const DEFAULT_SURVEY_PORT = 3000
diff --git a/core/llm/llms/oca/util/ocaTokenManager.ts b/core/llm/llms/oca/util/ocaTokenManager.ts
new file mode 100644
index 00000000000..1744a790caa
--- /dev/null
+++ b/core/llm/llms/oca/util/ocaTokenManager.ts
@@ -0,0 +1,262 @@
+import express, { Request, Response } from "express";
+import http from "http";
+import fs from "fs/promises";
+import path from "path";
+import os from "os";
+import { Issuer, generators, TokenSet, Client } from "openid-client";
+import {
+  DEFAULT_IDCS_CLIENT_ID,
+  DEFAULT_IDCS_URL,
+  DEFAULT_IDSC_SCOPES,
+  DEFAULT_IDCS_PORT_CANDIDATES,
+  DEFAULT_USE_PKCE,
+} from "./constants";
+import { parseJwtPayload } from "./utils";
+import open from "open";
+export interface OcaStoredToken extends TokenSet {
+  created_at: number;
+  expires_at: number;
+  sub?: string;
+}
+export class OcaTokenManager {
+  private static cachedToken: OcaStoredToken | null = null;
+  private static client: Client | null = null;
+  private static codeVerifier: string | undefined;
+  private static _config: null | {
+    client_id: string;
+    idcs_url: string;
+    client_secret?: string;
+    scopes: string;
+    port_candidates: number[];
+    use_pkce: boolean;
+  } = null;
+  private static readonly TOKEN_CACHE_PATH = path.join(
+    os.homedir(),
+    ".oca",
+    "token_cache.json",
+  );
+  private static readonly RENEW_TOKEN_BUFFER_SEC = 180; // 3 minutes
+  private static readonly OCA_CONFIG_PATH = path.join(
+    os.homedir(),
+    ".oca",
+    "config.json",
+  );
+  private static async getConfig() {
+    if (this._config) {
+      return this._config;
+    }
+    let cfg: any = {};
+    try {
+      const raw = await fs.readFile(this.OCA_CONFIG_PATH, "utf-8");
+      cfg = JSON.parse(raw);
+    } catch {
+      /* ignore - use defaults */
+    }
+    this._config = {
+      client_id: cfg.client_id ?? DEFAULT_IDCS_CLIENT_ID,
+      idcs_url: cfg.idcs_url ?? DEFAULT_IDCS_URL,
+      client_secret: cfg.client_secret, // allow undefined
+      scopes: cfg.scopes ?? DEFAULT_IDSC_SCOPES,
+      port_candidates: cfg.port_candidates ?? DEFAULT_IDCS_PORT_CANDIDATES,
+      use_pkce:
+        typeof cfg.use_pkce === "boolean" ? cfg.use_pkce : DEFAULT_USE_PKCE,
+    };
+    return this._config;
+  }
+  private static async saveToken(token: TokenSet) {
+    const dir = path.dirname(this.TOKEN_CACHE_PATH);
+    await fs.mkdir(dir, { recursive: true });
+    const now = Math.floor(Date.now() / 1000);
+    let expires_at: number | undefined = undefined;
+    let sub: string | undefined = undefined;
+    if (token.access_token) {
+      const payload = parseJwtPayload(token.access_token);
+      if (payload) {
+        expires_at = typeof payload.exp === "number" ? payload.exp : undefined;
+        sub = typeof payload.sub === "string" ? payload.sub : undefined;
+      }
+    }
+    if (!expires_at && typeof token.expires_in === "number") {
+      expires_at = now + token.expires_in;
+    }
+    const toStore: OcaStoredToken = {
+      ...(token as any),
+      created_at: now,
+      expires_at: expires_at!,
+      sub,
+    };
+    await fs.writeFile(this.TOKEN_CACHE_PATH, JSON.stringify(toStore), {
+      encoding: "utf-8",
+    });
+    // On Windows, fs.chmod is a no-op. On POSIX, set 600.
+    /**
+		 * Windows permissions are managed via Access Control Lists (ACLs), which are more complex and flexible than UNIX-style permission bits.
+		 * Windows user profile directories are generally protected from access by other users on the same system.
+		   Sensitivity is typically managed by overall profile folder access (e.g., C:\Users\username is not world-readable by default).
+		   Further restrictions (such as preventing SYSTEM or Administrators from reading files) are neither common nor practical on a typical domain-joined workstation.
+		 */
+    if (os.platform() !== "win32") {
+      await fs.chmod(this.TOKEN_CACHE_PATH, 0o600);
+    }
+    return toStore;
+  }
+
+  private static async loadToken(): Promise<OcaStoredToken | null> {
+    try {
+      const stats = await fs.stat(this.TOKEN_CACHE_PATH);
+      if (os.platform() !== "win32") {
+        const mode = stats.mode & 0o777;
+        if (mode !== 0o600) {
+          await fs.rm(this.TOKEN_CACHE_PATH);
+          throw new Error(
+            "Token file permissions should be owner read and write",
+          );
+        }
+      }
+      const data = await fs.readFile(this.TOKEN_CACHE_PATH, "utf-8");
+      return JSON.parse(data) as OcaStoredToken;
+    } catch {
+      return null;
+    }
+  }
+
+  // Use this method instead of findAvailablePort
+  private static async findAndBindAvailablePort(): Promise<{
+    port: number;
+    server: http.Server;
+  }> {
+    const config = await this.getConfig();
+    for (const port of config.port_candidates) {
+      try {
+        const server = http.createServer();
+        await new Promise((resolve, reject) => {
+          server.once("error", reject);
+          server.listen(port, "127.0.0.1", () => resolve(true));
+        });
+        return { port, server };
+      } catch {
+        continue;
+      }
+    }
+    throw new Error("No available port found.");
+  }
+
+  private static isAccessTokenValid(token: OcaStoredToken): boolean {
+    const now = Math.floor(Date.now() / 1000);
+    return (
+      typeof token.expires_at === "number" &&
+      now < token.expires_at - this.RENEW_TOKEN_BUFFER_SEC
+    );
+  }
+  private static async getClient(): Promise<Client> {
+    if (this.client) {
+      return this.client;
+    }
+    const config = await this.getConfig();
+    const issuer = await Issuer.discover(config.idcs_url);
+    this.client = new issuer.Client({
+      client_id: config.client_id,
+      client_secret: config.client_secret,
+      redirect_uris: [],
+      response_types: ["code"],
+      token_endpoint_auth_method: config.client_secret
+        ? "client_secret_basic"
+        : "none",
+    });
+    return this.client;
+  }
+  public static async refreshToken(): Promise<OcaStoredToken | null> {
+    if (!this.cachedToken) {
+      this.cachedToken = await this.loadToken();
+    }
+    if (!this.cachedToken?.refresh_token) {
+      return null;
+    }
+    const client = await this.getClient();
+    try {
+      const refreshed: TokenSet = await client.refresh(
+        this.cachedToken.refresh_token,
+      );
+      const stored = await this.saveToken(refreshed);
+      this.cachedToken = stored;
+      return stored;
+    } catch (err) {
+      console.warn("⚠️ Refresh failed:", err);
+      return null;
+    }
+  }
+  private static async checkAndRefreshTokenIfNeeded(): Promise<OcaStoredToken | null> {
+    if (this.cachedToken && this.isAccessTokenValid(this.cachedToken)) {
+      return this.cachedToken;
+    }
+    return await this.refreshToken();
+  }
+  public static async getToken(): Promise<OcaStoredToken> {
+    const config = await this.getConfig();
+    const client = await this.getClient();
+    this.cachedToken = await this.loadToken();
+    const refreshed = await this.checkAndRefreshTokenIfNeeded();
+    if (refreshed) {
+      return refreshed;
+    }
+
+    // Change: Find and BIND immediately, and use the returned server instance
+    const { port, server } = await this.findAndBindAvailablePort();
+    const redirect_uri = `http://localhost:${port}/callback`;
+    const app = express();
+
+    const tokenPromise = new Promise<OcaStoredToken>((resolve, reject) => {
+      // Attach Express app to the already opened server
+      server.on("request", app);
+
+      // Initiate OAuth flow after the server is listening
+      (async () => {
+        let authUrl: string;
+        if (config.use_pkce) {
+          this.codeVerifier = generators.codeVerifier();
+          const codeChallenge = generators.codeChallenge(this.codeVerifier);
+          authUrl = client.authorizationUrl({
+            scope: config.scopes,
+            redirect_uri,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+          });
+        } else {
+          authUrl = client.authorizationUrl({
+            scope: config.scopes,
+            redirect_uri,
+          });
+        }
+        await open(authUrl);
+      })().catch((err) => {
+        // Handle or log the error
+        console.error("Error launching browser:", err);
+        reject(err); // Optionally reject the outer promise
+      });
+
+      app.get("/callback", async (req: Request, res: Response) => {
+        try {
+          const params = client.callbackParams(req);
+          let tokenSet: TokenSet;
+          if (config.use_pkce) {
+            tokenSet = await client.callback(redirect_uri, params, {
+              code_verifier: this.codeVerifier,
+            });
+          } else {
+            tokenSet = await client.callback(redirect_uri, params);
+          }
+          const stored = await this.saveToken(tokenSet);
+          this.cachedToken = stored;
+          res.send("✅ Token obtained. You may close this tab.");
+          resolve(stored);
+        } catch (err) {
+          res.status(400).send(`❌ OAuth failed. {error: ${err}}`);
+          reject(err);
+        } finally {
+          server.close();
+        }
+      });
+    });
+    return await tokenPromise;
+  }
+}
diff --git a/core/llm/llms/oca/util/utils.ts b/core/llm/llms/oca/util/utils.ts
new file mode 100644
index 00000000000..39316e27db1
--- /dev/null
+++ b/core/llm/llms/oca/util/utils.ts
@@ -0,0 +1,71 @@
+import { name, version } from "../../../../package.json"
+import { jwtDecode, type JwtPayload } from "jwt-decode"
+import SHA256 from "crypto-js/sha256"
+import { enc } from "crypto-js"
+
+/**
+ * Generates a compliant customer opc-request-id segment.
+ *
+ * Format (32 hex):
+ *   [token hash (8)] [taskId hash (8)] [timestamp (8)] [random (8)]
+ * - token hash:    first 4 bytes of SHA-256(token)
+ * - taskId hash:   first 4 bytes of SHA-256(taskId)
+ * - timestamp:     Unix seconds since epoch, 8 hex digits
+ * - random:        strong random, 8 hex digits
+ *
+ * Use: Send this single value as the opc-request-id header.
+ */
+function hash8(str: string): string {
+  const hash = SHA256(str)
+  // Get first 4 bytes as hex (8 characters)
+  return hash.toString(enc.Hex).substring(0, 8)
+}
+
+function randomHex8(): string {
+  // Generate a random 32-bit (4-byte) number and return as 8 hex digits
+  const arr = new Uint32Array(1)
+  // Use built-in Math.random for cross-platform, or
+  // Use node's crypto if available, but sticking to Math.random for cross-environment
+  arr[0] =
+    Math.floor(Math.random() * 0x100000000) // generate 32-bits
+  return arr[0].toString(16).padStart(8, "0")
+}
+
+export function generateOpcRequestId(taskId: string, token: string): string {
+  const tokenHex = hash8(token)
+  const taskHex = hash8(taskId)
+  const timestampHex = Math.floor(Date.now() / 1000)
+    .toString(16)
+    .padStart(8, "0")
+  return tokenHex + taskHex + timestampHex + randomHex8()
+}
+
+/**
+ * Create headers for OCA requests
+ */
+export function createOcaHeaders(accessToken: string, taskId: string): Record<string, string> {
+  const opcRequestId = generateOpcRequestId(taskId, accessToken)
+  return {
+    Authorization: `Bearer ${accessToken}`,
+    "Content-Type": "application/json",
+    client: "Continue",
+    "client-version": `${name}-${version}`,
+    "client-ide": name,
+    "client-ide-version": version,
+    "opc-request-id": opcRequestId,
+  }
+}
+
+/**
+ * Decodes a JWT payload without validation and returns the 'sub' claim.
+ * Use only for non-security, informational, or display purposes.
+ * @param token JWT string
+ */
+export function parseJwtPayload(token: string): JwtPayload | null {
+  try {
+    const payload = jwtDecode(token)
+    return payload
+  } catch {
+    return null
+  }
+}
\ No newline at end of file
diff --git a/core/package-lock.json b/core/package-lock.json
index d2afa4b76a6..c1154f0d821 100644
--- a/core/package-lock.json
+++ b/core/package-lock.json
@@ -28,9 +28,11 @@
         "cheerio": "^1.0.0-rc.12",
         "commander": "^12.0.0",
         "comment-json": "^4.2.3",
+        "crypto-js": "^4.2.0",
         "dbinfoz": "^0.14.0",
         "diff": "^7.0.0",
         "dotenv": "^16.4.5",
+        "express": "^5.1.0",
         "fastest-levenshtein": "^1.0.16",
         "filtrex": "^3.1.0",
         "follow-redirects": "^1.15.5",
@@ -38,11 +40,13 @@
         "handlebars": "^4.7.8",
         "http-proxy-agent": "^7.0.1",
         "https-proxy-agent": "^7.0.3",
+        "iconv-lite": "^0.6.3",
         "ignore": "^5.3.1",
         "is-localhost-ip": "^2.0.0",
         "jinja-js": "0.1.8",
         "js-tiktoken": "^1.0.8",
         "jsdom": "^24.0.0",
+        "jwt-decode": "4.0.0",
         "launchdarkly-node-client-sdk": "^3.2.0",
         "llm-code-highlighter": "^0.0.14",
         "lru-cache": "^11.0.2",
@@ -52,6 +56,7 @@
         "ollama": "^0.4.6",
         "onnxruntime-node": "1.14.0",
         "openai": "^4.104.0",
+        "openid-client": "^5.7.1",
         "p-limit": "^6.1.0",
         "partial-json": "^0.1.7",
         "pg": "^8.11.3",
@@ -84,7 +89,9 @@
         "@google/generative-ai": "^0.11.4",
         "@shikijs/colorized-brackets": "^3.7.0",
         "@shikijs/transformers": "^3.7.0",
+        "@types/crypto-js": "^4.2.2",
         "@types/diff": "^7.0.1",
+        "@types/express": "^5.0.3",
         "@types/follow-redirects": "^1.14.4",
         "@types/jest": "^29.5.12",
         "@types/jquery": "^3.5.29",
@@ -169,7 +176,7 @@
     },
     "../packages/openai-adapters": {
       "name": "@continuedev/openai-adapters",
-      "version": "1.0.45",
+      "version": "1.0.46",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-sdk/client-bedrock-runtime": "^3.842.0",
@@ -185,13 +192,20 @@
         "zod": "^3.24.2"
       },
       "devDependencies": {
+        "@semantic-release/changelog": "^6.0.3",
+        "@semantic-release/commit-analyzer": "^13.0.1",
+        "@semantic-release/git": "^10.0.1",
+        "@semantic-release/github": "^11.0.3",
+        "@semantic-release/npm": "^12.0.2",
+        "@semantic-release/release-notes-generator": "^14.0.3",
         "@types/follow-redirects": "^1.14.4",
         "@types/jest": "^29.5.14",
         "@types/json-schema": "^7.0.15",
         "cross-env": "^7.0.3",
+        "semantic-release": "^24.2.7",
         "ts-jest": "^29.2.3",
         "ts-node": "^10.9.2",
-        "vitest": "^1.6.1"
+        "vitest": "^3.2.4"
       }
     },
     "node_modules/@75lb/deep-merge": {
@@ -5532,6 +5546,17 @@
         "@babel/types": "^7.20.7"
       }
     },
+    "node_modules/@types/body-parser": {
+      "version": "1.19.6",
+      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
+      "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/connect": "*",
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/caseless": {
       "version": "0.12.5",
       "resolved": "https://registry.npmjs.org/@types/caseless/-/caseless-0.12.5.tgz",
@@ -5550,6 +5575,23 @@
       "integrity": "sha512-n7RlEEJ+4x4TS7ZQddTmNSxP+zziEG0TNsMfiRIxcIVXt71ENJ9ojeXmGO3wPoTdn7pJcU2xc3CJYMktNT6DPg==",
       "peer": true
     },
+    "node_modules/@types/connect": {
+      "version": "3.4.38",
+      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
+      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/crypto-js": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@types/crypto-js/-/crypto-js-4.2.2.tgz",
+      "integrity": "sha512-sDOLlVbHhXpAUAL0YHDUUwDZf3iN4Bwi4W6a0W0b+QcAezUbRtH4FVb+9J4h+XFPW7l/gQ9F8qC7P+Ec4k8QVQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/diff": {
       "version": "7.0.1",
       "resolved": "https://registry.npmjs.org/@types/diff/-/diff-7.0.1.tgz",
@@ -5564,6 +5606,31 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/express": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.3.tgz",
+      "integrity": "sha512-wGA0NX93b19/dZC1J18tKWVIYWyyF2ZjT9vin/NRu0qzzvfVzWjs04iq2rQ3H65vCTQYlRqs3YHfY7zjdV+9Kw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/body-parser": "*",
+        "@types/express-serve-static-core": "^5.0.0",
+        "@types/serve-static": "*"
+      }
+    },
+    "node_modules/@types/express-serve-static-core": {
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.0.7.tgz",
+      "integrity": "sha512-R+33OsgWw7rOhD1emjU7dzCDHucJrgJXMA5PYCzJxVil0dsyx5iBEPHqpPfiKNJQb7lZ1vxwoLR4Z87bBUpeGQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/qs": "*",
+        "@types/range-parser": "*",
+        "@types/send": "*"
+      }
+    },
     "node_modules/@types/follow-redirects": {
       "version": "1.14.4",
       "resolved": "https://registry.npmjs.org/@types/follow-redirects/-/follow-redirects-1.14.4.tgz",
@@ -5592,6 +5659,13 @@
         "@types/unist": "*"
       }
     },
+    "node_modules/@types/http-errors": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
+      "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/istanbul-lib-coverage": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
@@ -5673,6 +5747,13 @@
         "@types/unist": "*"
       }
     },
+    "node_modules/@types/mime": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
+      "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/mozilla-readability": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/@types/mozilla-readability/-/mozilla-readability-0.2.1.tgz",
@@ -5735,6 +5816,20 @@
         "xmlbuilder": ">=11.0.1"
       }
     },
+    "node_modules/@types/qs": {
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.14.0.tgz",
+      "integrity": "sha512-eOunJqu0K1923aExK6y8p6fsihYEn/BYuQ4g0CxAAgFc4b/ZLN4CrsRZ55srTdqoiLzU2B2evC+apEIxprEzkQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/range-parser": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
+      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/readable-stream": {
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@types/readable-stream/-/readable-stream-4.0.18.tgz",
@@ -5776,6 +5871,29 @@
         "node": ">= 0.12"
       }
     },
+    "node_modules/@types/send": {
+      "version": "0.17.5",
+      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.5.tgz",
+      "integrity": "sha512-z6F2D3cOStZvuk2SaP6YrwkNO65iTZcwA2ZkSABegdkAh/lf+Aa/YQndZVfmEXT5vgAp6zv06VQ3ejSVjAny4w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/mime": "^1",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/serve-static": {
+      "version": "1.15.8",
+      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.8.tgz",
+      "integrity": "sha512-roei0UY3LhpOJvjbIP6ZZFngyLKl5dskOtDhxY5THRSpO+ZI+nzJ+m5yUMzGrp89YRa7lvknKkMYjqQFGwA7Sg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/http-errors": "*",
+        "@types/node": "*",
+        "@types/send": "*"
+      }
+    },
     "node_modules/@types/sizzle": {
       "version": "2.3.9",
       "resolved": "https://registry.npmjs.org/@types/sizzle/-/sizzle-2.3.9.tgz",
@@ -7892,6 +8010,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/crypto-js": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz",
+      "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==",
+      "license": "MIT"
+    },
     "node_modules/css-select": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.1.0.tgz",
@@ -12593,6 +12717,15 @@
         "jinjajs": "cli.js"
       }
     },
+    "node_modules/jose": {
+      "version": "4.15.9",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-4.15.9.tgz",
+      "integrity": "sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/js-md4": {
       "version": "0.3.2",
       "resolved": "https://registry.npmjs.org/js-md4/-/js-md4-0.3.2.tgz",
@@ -12821,6 +12954,15 @@
         "safe-buffer": "^5.0.1"
       }
     },
+    "node_modules/jwt-decode": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-4.0.0.tgz",
+      "integrity": "sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -14086,6 +14228,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/object-hash": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz",
+      "integrity": "sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/object-inspect": {
       "version": "1.13.3",
       "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.3.tgz",
@@ -14195,6 +14346,15 @@
       "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==",
       "dev": true
     },
+    "node_modules/oidc-token-hash": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.0.tgz",
+      "integrity": "sha512-y0W+X7Ppo7oZX6eovsRkuzcSM40Bicg2JEJkDJ4irIt1wsYAP5MLSNv+QAogO8xivMffw/9OvV3um1pxXgt1uA==",
+      "license": "MIT",
+      "engines": {
+        "node": "^10.13.0 || >=12.0.0"
+      }
+    },
     "node_modules/ollama": {
       "version": "0.4.9",
       "resolved": "https://registry.npmjs.org/ollama/-/ollama-0.4.9.tgz",
@@ -14404,6 +14564,33 @@
         "webidl-conversions": "^3.0.0"
       }
     },
+    "node_modules/openid-client": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.7.1.tgz",
+      "integrity": "sha512-jDBPgSVfTnkIh71Hg9pRvtJc6wTwqjRkN88+gCFtYWrlP4Yx2Dsrow8uPi3qLr/aeymPF3o2+dS+wOpglK04ew==",
+      "license": "MIT",
+      "dependencies": {
+        "jose": "^4.15.9",
+        "lru-cache": "^6.0.0",
+        "object-hash": "^2.2.0",
+        "oidc-token-hash": "^5.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/openid-client/node_modules/lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/optionator": {
       "version": "0.9.4",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
diff --git a/core/package.json b/core/package.json
index 13830d83b42..44a368cfe80 100644
--- a/core/package.json
+++ b/core/package.json
@@ -35,6 +35,8 @@
     "@types/tar": "^6.1.13",
     "@types/uuid": "^9.0.7",
     "@types/win-ca": "^3.5.4",
+    "@types/express": "^5.0.3",
+    "@types/crypto-js": "^4.2.2",
     "cross-env": "^7.0.3",
     "esbuild": "0.17.19",
     "eslint": "^8",
@@ -117,7 +119,11 @@
     "winston": "^3.17.0",
     "workerpool": "^9.1.3",
     "yaml": "^2.4.2",
-    "zod": "^3.24.2"
+    "zod": "^3.24.2",
+    "jwt-decode": "4.0.0",
+    "openid-client": "^5.7.1",
+    "express": "^5.1.0",
+    "crypto-js": "^4.2.0" 
   },
   "engine-strict": true,
   "engines": {
diff --git a/extensions/vscode/.npmrc b/extensions/vscode/.npmrc
deleted file mode 100644
index aa026a602a1..00000000000
--- a/extensions/vscode/.npmrc
+++ /dev/null
@@ -1,3 +0,0 @@
-# Used by prepackage.js to copy from node_modules into out/node_modules
-public-hoist-pattern[]=@lancedb/*
-public-hoist-pattern[]=@esbuild/*
\ No newline at end of file
diff --git a/extensions/vscode/package-lock.json b/extensions/vscode/package-lock.json
index 8780ab1e28d..dd34fd56571 100644
--- a/extensions/vscode/package-lock.json
+++ b/extensions/vscode/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "continue",
-  "version": "1.1.63",
+  "version": "1.1.67",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "continue",
-      "version": "1.1.63",
+      "version": "1.1.67",
       "license": "Apache-2.0",
       "dependencies": {
         "@continuedev/config-types": "^1.0.14",
@@ -119,9 +119,11 @@
         "cheerio": "^1.0.0-rc.12",
         "commander": "^12.0.0",
         "comment-json": "^4.2.3",
+        "crypto-js": "^4.2.0",
         "dbinfoz": "^0.14.0",
         "diff": "^7.0.0",
         "dotenv": "^16.4.5",
+        "express": "^5.1.0",
         "fastest-levenshtein": "^1.0.16",
         "filtrex": "^3.1.0",
         "follow-redirects": "^1.15.5",
@@ -129,11 +131,13 @@
         "handlebars": "^4.7.8",
         "http-proxy-agent": "^7.0.1",
         "https-proxy-agent": "^7.0.3",
+        "iconv-lite": "^0.6.3",
         "ignore": "^5.3.1",
         "is-localhost-ip": "^2.0.0",
         "jinja-js": "0.1.8",
         "js-tiktoken": "^1.0.8",
         "jsdom": "^24.0.0",
+        "jwt-decode": "4.0.0",
         "launchdarkly-node-client-sdk": "^3.2.0",
         "llm-code-highlighter": "^0.0.14",
         "lru-cache": "^11.0.2",
@@ -142,7 +146,8 @@
         "node-html-markdown": "^1.3.0",
         "ollama": "^0.4.6",
         "onnxruntime-node": "1.14.0",
-        "openai": "^4.76.0",
+        "openai": "^4.104.0",
+        "openid-client": "^5.7.1",
         "p-limit": "^6.1.0",
         "partial-json": "^0.1.7",
         "pg": "^8.11.3",
@@ -175,7 +180,9 @@
         "@google/generative-ai": "^0.11.4",
         "@shikijs/colorized-brackets": "^3.7.0",
         "@shikijs/transformers": "^3.7.0",
+        "@types/crypto-js": "^4.2.2",
         "@types/diff": "^7.0.1",
+        "@types/express": "^5.0.3",
         "@types/follow-redirects": "^1.14.4",
         "@types/jest": "^29.5.12",
         "@types/jquery": "^3.5.29",
diff --git a/gui/package-lock.json b/gui/package-lock.json
index d611543e27b..da85d3ec5a7 100644
--- a/gui/package-lock.json
+++ b/gui/package-lock.json
@@ -130,9 +130,11 @@
         "cheerio": "^1.0.0-rc.12",
         "commander": "^12.0.0",
         "comment-json": "^4.2.3",
+        "crypto-js": "^4.2.0",
         "dbinfoz": "^0.14.0",
         "diff": "^7.0.0",
         "dotenv": "^16.4.5",
+        "express": "^5.1.0",
         "fastest-levenshtein": "^1.0.16",
         "filtrex": "^3.1.0",
         "follow-redirects": "^1.15.5",
@@ -140,11 +142,13 @@
         "handlebars": "^4.7.8",
         "http-proxy-agent": "^7.0.1",
         "https-proxy-agent": "^7.0.3",
+        "iconv-lite": "^0.6.3",
         "ignore": "^5.3.1",
         "is-localhost-ip": "^2.0.0",
         "jinja-js": "0.1.8",
         "js-tiktoken": "^1.0.8",
         "jsdom": "^24.0.0",
+        "jwt-decode": "4.0.0",
         "launchdarkly-node-client-sdk": "^3.2.0",
         "llm-code-highlighter": "^0.0.14",
         "lru-cache": "^11.0.2",
@@ -153,7 +157,8 @@
         "node-html-markdown": "^1.3.0",
         "ollama": "^0.4.6",
         "onnxruntime-node": "1.14.0",
-        "openai": "^4.76.0",
+        "openai": "^4.104.0",
+        "openid-client": "^5.7.1",
         "p-limit": "^6.1.0",
         "partial-json": "^0.1.7",
         "pg": "^8.11.3",
@@ -186,7 +191,9 @@
         "@google/generative-ai": "^0.11.4",
         "@shikijs/colorized-brackets": "^3.7.0",
         "@shikijs/transformers": "^3.7.0",
+        "@types/crypto-js": "^4.2.2",
         "@types/diff": "^7.0.1",
+        "@types/express": "^5.0.3",
         "@types/follow-redirects": "^1.14.4",
         "@types/jest": "^29.5.12",
         "@types/jquery": "^3.5.29",
diff --git a/gui/public/logos/oca.png b/gui/public/logos/oca.png
new file mode 100644
index 00000000000..735f22d24c5
Binary files /dev/null and b/gui/public/logos/oca.png differ
diff --git a/gui/src/components/modelSelection/ModelSelect.tsx b/gui/src/components/modelSelection/ModelSelect.tsx
index d474fe58a68..ecef6ccc8d3 100644
--- a/gui/src/components/modelSelection/ModelSelect.tsx
+++ b/gui/src/components/modelSelection/ModelSelect.tsx
@@ -25,6 +25,7 @@ import {
   ListboxOption,
   ListboxOptions,
 } from "../ui/Listbox";
+import { OcaRestrictivePopup } from "../../forms/ocaRestrictive";
 
 interface ModelOptionProps {
   option: Option;
@@ -64,6 +65,11 @@ function ModelOption({
     }
   }
 
+  function requiresConfirmation(modelTitle: string) {
+    const name = modelTitle.toLowerCase();
+    return name.includes("openai") || name.includes("gpt");
+  }
+
   return (
     <ListboxOption
       key={idx}
@@ -99,6 +105,8 @@ function ModelSelect() {
   const [options, setOptions] = useState<Option[]>([]);
   const [sortedOptions, setSortedOptions] = useState<Option[]>([]);
   const { selectedProfile } = useAuth();
+  const [pendingModel, setPendingModel] = useState<Option | null>(null);
+  const [showPopup, setShowPopup] = useState(false);
 
   let selectedModel = null;
   let allModels = null;
@@ -113,6 +121,50 @@ function ModelSelect() {
     allModels = config.modelsByRole.chat;
   }
 
+  function requiresConfirmation(modelTitle: string) {
+    const name = modelTitle.toLowerCase();
+    return name.includes("openai") || name.includes("gpt");
+  }
+
+  // CHANGED onChange handler
+  const handleModelChange = async (val: string) => {
+    if (val === selectedModel?.title) return;
+    const picked = options.find((opt) => opt.value === val);
+    if (picked && requiresConfirmation(picked.title)) {
+      setPendingModel(picked);
+      setShowPopup(true); // Show confirmation dialog
+      return;
+    }
+    // If no confirmation needed, just switch model
+    void dispatch(
+      updateSelectedModelByRole({
+        selectedProfile,
+        role: isInEdit ? "edit" : "chat",
+        modelTitle: val,
+      }),
+    );
+  };
+
+  // Confirmation popup handlers
+  const handleConfirm = () => {
+    if (pendingModel) {
+      void dispatch(
+        updateSelectedModelByRole({
+          selectedProfile,
+          role: isInEdit ? "edit" : "chat",
+          modelTitle: pendingModel.value,
+        }),
+      );
+      setPendingModel(null);
+    }
+    setShowPopup(false);
+  };
+
+  const handleCancel = () => {
+    setPendingModel(null);
+    setShowPopup(false);
+  };
+
   // Sort so that options without an API key are at the end
   useEffect(() => {
     const alphaSort = options.sort((a, b) => a.title.localeCompare(b.title));
@@ -196,18 +248,7 @@ function ModelSelect() {
   const hasNoModels = allModels?.length === 0;
 
   return (
-    <Listbox
-      onChange={async (val: string) => {
-        if (val === selectedModel?.title) return;
-        void dispatch(
-          updateSelectedModelByRole({
-            selectedProfile,
-            role: isInEdit ? "edit" : "chat",
-            modelTitle: val,
-          }),
-        );
-      }}
-    >
+    <Listbox onChange={handleModelChange}>
       <div className="relative flex">
         <ListboxButton
           data-testid="model-select-button"
@@ -288,6 +329,64 @@ function ModelSelect() {
           )}
         </ListboxOptions>
       </div>
+      {/* Confirm dialog when user picks "openai" or "gpt" */}
+      {showPopup && (
+        <OcaRestrictivePopup
+          onAcknowledge={handleConfirm}
+          bannerText={`<div class="m-auto max-w-full w-[56rem] mx-2 shadow-3xl min-h-fit scrollbar-hidden bg-white dark:bg-gray-900 rounded-2xl svelte-fq1rhy"
+     style="">
+    <div class="px-5 pt-4 dark:text-gray-300 text-gray-700">
+        <div class="flex justify-between items-start">
+            <div class="text-xl font-semibold">Acknowledgement required to access Oracle Code Assist</div>
+        </div>
+    </div>
+    <div class="w-full p-4 px-5 text-gray-700 dark:text-gray-100">
+        <div class="overflow-y-scroll max-h-150 scrollbar-hidden">
+            <div class="mb-3 pr-2 my-2.5 px-1.5">
+                <div class="text-sm mb-2">
+                    <div class="mb-2 mt-1 text-sm/6 leading-6"><h3 class="text-lg/6 font-semibold text-gray-900">
+                        Disclaimer: Prohibited Data Submission</h3>
+                        <p class="mt-4 text-base/6 leading-6 text-gray-900 font-semibold">Attention Employees:</p>
+                        <p>By using this system, you acknowledge and agree that:</p>
+                        <p class="mt-2">You are not located in or accessing this system from China, Guam, Hong Kong,
+                            Macao, Puerto Rico or Ukraine; and</p>
+                        <p class="mt-2">You are strictly <strong>prohibited</strong> from uploading, submitting, or
+                            sharing the following types of data or submitting prompts requesting information about the
+                            following types of data through this platform, tool, or service:</p>
+                        <ul class="list-disc list-outside my-4 ml-8">
+                            <li>Non-public Oracle or line of business quarterly or annual financial results</li>
+                            <li>Any non-public information regarding vulnerabilities in any Oracle software or service
+                            </li>
+                            <li>Oracle Database source code</li>
+                            <li>Oracle policies</li>
+                            <li>Oracle employee PII or other HR data of any kind</li>
+                            <li>Health data of any kind, including but not limited to Protected Health Information
+                                (PHI)
+                            </li>
+                            <li>Any customer credit card or bank account details, or Payment Card Industry (PCI) data
+                            </li>
+                            <li>Data related to any Oracle M&amp;A activity</li>
+                            <li>Data pertaining to any pending, active or potential litigation or dispute</li>
+                            <li>Data with special handling restrictions imposed by law or contract, including data
+                                residency and nonstandard disclosure constraints
+                            </li>
+                            <li>Any usernames, passwords, authentication tokens or other access credentials for any
+                                Oracle or third-party system
+                            </li>
+                        </ul>
+                        <p class="text-base/6 leading-6 text-gray-900 font-semibold">Violation of this policy may result
+                            in disciplinary action, up to and including termination of employment, and/or legal
+                            consequences.
+                            This policy does not supersede any other relevant Oracle policy.</p>
+                        <p class="mt-2">If you are unsure whether your data falls under these categories, please consult
+                            your manager or the Information Security team <strong>before</strong> submission.</p></div>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>`}
+        />
+      )}
     </Listbox>
   );
 }
diff --git a/gui/src/forms/AddModelForm.tsx b/gui/src/forms/AddModelForm.tsx
index 5de78133ccf..2c51851c805 100644
--- a/gui/src/forms/AddModelForm.tsx
+++ b/gui/src/forms/AddModelForm.tsx
@@ -14,6 +14,7 @@ import {
 } from "../pages/AddNewModel/configs/providers";
 import { useAppDispatch } from "../redux/hooks";
 import { updateSelectedModelByRole } from "../redux/thunks/updateSelectedModelByRole";
+import { OcaRestrictivePopup } from "./ocaRestrictive";
 
 interface AddModelFormProps {
   onDone: () => void;
@@ -47,6 +48,7 @@ export function AddModelForm({
     providers["gemini"]?.title || "",
     providers["azure"]?.title || "",
     providers["ollama"]?.title || "",
+    providers["oca"]?.title || "",
   ];
 
   const allProviders = Object.entries(providers)
diff --git a/gui/src/forms/ocaRestrictive.tsx b/gui/src/forms/ocaRestrictive.tsx
new file mode 100644
index 00000000000..a8566d3b884
--- /dev/null
+++ b/gui/src/forms/ocaRestrictive.tsx
@@ -0,0 +1,87 @@
+import React from "react";
+import { Button } from "../components";
+
+
+export const VSC_INPUT_BACKGROUND = "--vscode-input-background"
+export const VSC_INPUT_FOREGROUND = "--vscode-input-foreground"
+export const VSC_SIDEBAR_BACKGROUND = "--vscode-sideBar-background"
+export const VSC_FOREGROUND = "--vscode-foreground"
+export const VSC_EDITOR_FOREGROUND = "--vscode-editor-foreground"
+export const VSC_FOREGROUND_MUTED = "--vscode-foreground-muted"
+export const VSC_DESCRIPTION_FOREGROUND = "--vscode-descriptionForeground"
+export const VSC_INPUT_PLACEHOLDER_FOREGROUND = "--vscode-input-placeholderForeground"
+export const VSC_BUTTON_BACKGROUND = "--vscode-button-background"
+export const VSC_BUTTON_FOREGROUND = "--vscode-button-foreground"
+export const VSC_EDITOR_BACKGROUND = "--vscode-editor-background"
+export const VSC_LIST_SELECTION_BACKGROUND = "--vscode-list-activeSelectionBackground"
+export const VSC_FOCUS_BORDER = "--vscode-focus-border"
+export const VSC_LIST_ACTIVE_FOREGROUND = "--vscode-quickInputList-focusForeground"
+export const VSC_QUICK_INPUT_BACKGROUND = "--vscode-quickInput-background"
+export const VSC_INPUT_BORDER = "--vscode-input-border"
+export const VSC_INPUT_BORDER_FOCUS = "--vscode-focusBorder"
+export const VSC_BADGE_BACKGROUND = "--vscode-badge-background"
+export const VSC_BADGE_FOREGROUND = "--vscode-badge-foreground"
+export const VSC_SIDEBAR_BORDER = "--vscode-sideBar-border"
+export const VSC_DIFF_REMOVED_LINE_BACKGROUND = "--vscode-diffEditor-removedLineBackground"
+export const VSC_DIFF_INSERTED_LINE_BACKGROUND = "--vscode-diffEditor-insertedLineBackground"
+export const VSC_INACTIVE_SELECTION_BACKGROUND = "--vscode-editor-inactiveSelectionBackground"
+export const VSC_TITLEBAR_INACTIVE_FOREGROUND = "--vscode-titleBar-inactiveForeground"
+
+export function getAsVar(varName: string): string {
+	return `var(${varName})`
+}
+
+export function hexToRGB(hexColor: string): { r: number; g: number; b: number } {
+	const hex = hexColor.replace(/^#/, "").slice(0, 6)
+	const [r, g, b] = [0, 2, 4].map((offset) => parseInt(hex.slice(offset, offset + 2), 16))
+	return { r, g, b }
+}
+
+export function colorToHex(colorVar: string): string {
+	const value = getComputedStyle(document.documentElement).getPropertyValue(colorVar).trim()
+	if (value.startsWith("#")) {
+		return value.slice(0, 7)
+	}
+
+	const rgbValues = value.match(/\d+/g)?.slice(0, 3).map(Number) || []
+	return `#${rgbValues.map((x) => x.toString(16).padStart(2, "0")).join("")}`
+}
+
+export const OcaRestrictivePopup: React.FC<{
+  onAcknowledge: () => void;
+  bannerText?: string | null;
+}> = React.memo(({ onAcknowledge, bannerText }) => (
+  <div className="fixed top-0 left-0 w-screen h-screen z-[2000] [background:rgba(0,0,0,0.25)] flex items-center justify-center">
+		<div
+			role="dialog"
+			aria-modal="true"
+			aria-labelledby="oca-popup-title"
+			className={`p-6 max-w-[600px] w-[90%] rounded-[8px] [box-shadow:0_4px_24px_0_var(--vscode-widget-shadow,rgba(0,0,0,.4))] [border:1px_solid_var(--vscode-focusBorder,#007acc)] [background:var(--vscode-editor-background,#252526)] [color:var(${VSC_FOREGROUND},#cccccc)] [font-family:var(--vscode-font-family,sans-serif)] [font-size:var(--vscode-font-size,13px)] flex flex-col max-h-[80vh]`}>
+			<h2 id="oca-popup-title" className={`mt-0 [color:var(${VSC_FOREGROUND},#111)] font-bold`}>
+				Acknowledgement Required
+			</h2>
+			<h4 className={`mb-2 [color:var(${VSC_DESCRIPTION_FOREGROUND},#b3b3b3)] font-semibold`}>
+				Disclaimer: Prohibited Data Submission
+			</h4>
+			<div className="overflow-y-auto flex-1 pr-2 mb-4 text-[13px] leading-[1.5] [color:var(--vscode-foreground,#222)] [mask-image:linear-gradient(to_bottom,black_96%,transparent_100%)]">
+				{bannerText && (
+					<div
+						className={`break-words [background:var(${VSC_INPUT_BACKGROUND},#252526)] [color:var(${VSC_FOREGROUND},#222)]`}
+						dangerouslySetInnerHTML={{ __html: bannerText }}
+					/>
+				)}
+			</div>
+			<div className="text-right">
+				<Button
+					type="button"
+					onClick={onAcknowledge}
+					style={{
+						background: `var(${VSC_BUTTON_BACKGROUND}, #0e639c)`,
+						color: `var(${VSC_BUTTON_FOREGROUND}, #fff)`,
+					}}>
+					I acknowledge and agree
+				</Button>
+			</div>
+		</div>
+	</div>
+));
diff --git a/gui/src/pages/AddNewModel/configs/providers.ts b/gui/src/pages/AddNewModel/configs/providers.ts
index d210da9d662..4cd04d9962a 100644
--- a/gui/src/pages/AddNewModel/configs/providers.ts
+++ b/gui/src/pages/AddNewModel/configs/providers.ts
@@ -997,4 +997,25 @@ To get started, [register](https://dataplatform.cloud.ibm.com/registration/stepo
     packages: [{ ...models.AUTODETECT }],
     apiKeyUrl: "https://venice.ai/chat",
   },
+  oca: {
+    title: "Oracle Code Assist",
+    provider: "oca",
+    icon: "oca.png",
+    description:
+      "For internal Oracle Employees, please see https://confluence.oraclecorp.com/confluence/display/AICODE/Oracle+Code+Assist+via+Cline.",
+    longDescription: "For external customers, contact your IT admin to provision Oracle Code Assist access.",
+    tags: [ModelProviderTags.RequiresApiKey],
+    collectInputFor: [
+      {
+        inputType: "text",
+        key: "apiBase",
+        label: "Use Custom Base URL (optional)",
+        placeholder: "Enter the API Base URL",
+        defaultValue: "https://code-internal.aiservice.us-chicago-1.oci.oraclecloud.com/20250206/app/litellm",
+        required: true,
+      },
+      ...completionParamsInputsConfigs,
+    ],
+    packages: [{ ...models.AUTODETECT }],
+  },
 };
diff --git a/package-lock.json b/package-lock.json
index 0a253884094..b4289d4228a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "wt-openai-adapters-tests",
+  "name": "continue",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
diff --git a/packages/llm-info/src/index.ts b/packages/llm-info/src/index.ts
index fe71f419ddb..0eddc0ba6a8 100644
--- a/packages/llm-info/src/index.ts
+++ b/packages/llm-info/src/index.ts
@@ -4,6 +4,7 @@ import { Bedrock } from "./providers/bedrock.js";
 import { Cohere } from "./providers/cohere.js";
 import { Gemini } from "./providers/gemini.js";
 import { Mistral } from "./providers/mistral.js";
+import { Oca } from "./providers/oca.js";
 import { Ollama } from "./providers/ollama.js";
 import { OpenAi } from "./providers/openai.js";
 import { Vllm } from "./providers/vllm.js";
@@ -23,6 +24,7 @@ export const allModelProviders: ModelProvider[] = [
   Bedrock,
   Cohere,
   xAI,
+  Oca
 ];
 
 export const allLlms: LlmInfo[] = allModelProviders.flatMap((provider) =>
diff --git a/packages/llm-info/src/providers/oca.ts b/packages/llm-info/src/providers/oca.ts
new file mode 100644
index 00000000000..db4504be31a
--- /dev/null
+++ b/packages/llm-info/src/providers/oca.ts
@@ -0,0 +1,7 @@
+import { ModelProvider } from "../types.js";
+
+export const Oca: ModelProvider = {
+  models: [],
+  id: "oca",
+  displayName: "Oracle Code Assist",
+};
diff --git a/scripts/install-dependencies.sh b/scripts/install-dependencies.sh
index 3f3e54f7b74..ec322bd8a00 100755
--- a/scripts/install-dependencies.sh
+++ b/scripts/install-dependencies.sh
@@ -5,6 +5,9 @@
 # - Debug -> Extension
 set -e
 
+# Ensure .npmrc in the repo root is used for all npm commands
+export NPM_CONFIG_USERCONFIG="$(pwd)/.npmrc"
+
 # Check if node version matches .nvmrc
 if [ -f .nvmrc ]; then
     required_node_version=$(cat .nvmrc)