fix(branding): repair branded CodeQ build broken by upstream drift

[Kenny-Heitritter]

Fixes two pre-existing bugs in branding/apply.ts that broke branded (CodeQ) builds after the recent upstream sync (feat/upstream-sync-opus-4-6). Both were found while verifying a branded bun run build --single on macOS arm64 — the branded build failed to compile, and once worked around, the binary crashed at startup.

Bug 1 — external package renamed → build fails

The opencode -> codeq product-name replacement also rewrote the external scoped package @gitlab/opencode-gitlab-auth → @gitlab/codeq-gitlab-auth (in plugin/index.ts import + packages/opencode/package.json). bun install then 404s on the nonexistent package and the build aborts:

error: GET https://registry.npmjs.org/@gitlab%2fcodeq-gitlab-auth - 404

Fix: add a negative lookbehind for scoped packages (@<scope>/) and exclude -gitlab-auth from the product-name regex, so external @scope/opencode-* packages are preserved (matches the existing @opencode-ai exclusion intent).

Bug 2 — LOGO is not defined → branded binary crashes at startup

The CLI logo transform injects a logo() that iterates a const LOGO array, but upstream removed that array (the logo now comes from ./logo as glyphs.left/right). The const LOGO = [...] replacement no-ops while the injected logo() still references LOGO, so the branded binary crashes immediately:

ERROR service=default e=LOGO is not defined exception

Fix: guard both the CLI (ui.ts) and TUI (logo.tsx) logo transforms — if the expected LOGO / LOGO_LEFT/LOGO_RIGHT structures are absent, skip the rewrite and keep the upstream logo (cosmetic loss of the purple-Q branding, but a working binary). Resilient to future upstream logo changes.

Verification (macOS arm64)

On this branch (off dev, no other changes):

• bun branding/apply.ts qbraid → both structures preserved (no @gitlab/codeq..., no broken LOGO).
• bun run build --single → branded codeq binary builds cleanly.
• ./dist/codeq-darwin-arm64/bin/codeq --version → boots without crashing (previously crashed).
• codeq models qbraid (clean config) → lists models, logo renders.

Notes

• Independent of the model-catalog work (feat(provider): first-class qBraid provider with baked-in models + auth login #9); recommend merging this first so branded builds are releasable.
• Branding remains a no-op rewrite where structures drifted — worth a follow-up to re-add purple-Q branding against the new ./logo glyph structure if desired (cosmetic only).

🤖 Generated with opencode