fix(auth): validate OPENCODE_AUTH_CONTENT against Auth.Info schema - #34654

Issue for this PR

Closes #34075

Type of change

• Bug fix

What does this PR do?

In packages/opencode/src/auth/index.ts Auth.all(), the env-var path of OPENCODE_AUTH_CONTENT returned JSON.parse(...) directly, bypassing the Record.filterMap(decode) schema validation that the file-based path applies. The empty catch block silently swallowed JSON parse errors, so a malformed env var fell through to file-based auth even though the user had explicitly set it.

Two consequences:

1. Invalid entries (unknown type, missing type, non-object values) reached downstream provider code that switches on info.type (e.g. provider/auth.ts:167).
2. A typo in the env var silently inverted precedence — file auth overrode the user's explicit env var.

The fix:

• Replaces the bare try/catch with Effect.try({ try, catch }) to surface parse errors as AuthError.
• Rejects non-object top-level JSON (arrays, primitives, null) with AuthError.
• Applies the same Record.filterMap(decode) validation that the file path already uses, so invalid entries are silently filtered (matching existing file-path behavior) but parse/type errors surface loudly.

The file-path branch is untouched.

How did you verify your code works?

cd packages/opencode
bun typecheck                              # 29 successful, 0 failed
bun test ./test/auth/                      # 10 pass, 0 fail, 24 expect()
bun test ./test/auth/ ./test/provider/header-timeout.test.ts \
         ./test/provider/digitalocean.test.ts \
         ./test/control-plane/ \
         ./test/cli/acp/initialize-auth.test.ts \
         ./test/server/auth.test.ts \
         ./test/mcp/auth.test.ts
                                          # 66 pass, 0 fail, 199 expect()

The 6 new regression tests in test/auth/auth.test.ts reproduce both bugs against the unmodified code (3 of 6 fail before the fix), and verify that empty/unset env vars still fall through to the file path. The cross-cluster run covers every other consumer of Auth (provider, control-plane, server, MCP, CLI/ACP) and confirms no regressions.

Screenshots / recordings

N/A — not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR