Repository navigation
feat(core): merge Console config as a config layer - #57703
Conversation
vimtor
changed the title
# Conflicts: # packages/core/src/plugin/provider/opencode.ts # packages/core/test/plugin/provider-opencode.test.ts
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
The change looks sound overall. The legacy split keeps responses without $schema on their current behaviour, and the precedence order (MDM > Console > user/project) matches the code and the tests. I ran the two closest test files and the core type check, and both pass. I could not run it end to end, because that needs a Console serving the new format.
Public API: Config.Interface gets a new optional integration(integrationID, document) method, and ConfigIntegration.Document / Remote are new. The Console response contract grows a $schema config format with a top-level voice beside it. In that format, MDM policies now outrank Console policies. Legacy responses still work as before, so this is backwards compatible.
Concerns:
- MCP auth (inline): on the new path,
auth: "console"is no longer supported. It is silently dropped, so those MCP servers connect without the Console credential. - Web search ID: on the config path, the Console search provider is always registered as
opencode, and that is theproviderIDsent to/api/websearch. Before, the Console chose the ID. Please confirm the Console endpoint accepts this.
| }), | ||
| ]), | ||
| ), | ||
| // Local servers would run a command on this machine. |
There was a problem hiding this comment.
In the legacy response, an MCP server with auth: "console" got the Console credential headers added (OpencodeLegacy). Config.Info.fields.mcp has no auth field, and the extra key is silently ignored here. So a new-format Console can't define a Console-authenticated MCP server. It would connect without credentials, and static headers in the document would not follow token rotation. Could this path keep auth: "console" and add the connection's headers (for example when the document is built in publish), or reject such servers explicitly?
# Conflicts: # packages/core/src/plugin/provider/opencode.ts # packages/core/test/plugin/provider-opencode.test.ts
There was a problem hiding this comment.
This push merges dev and drops the Console voice host, which matches the base where hosted voice is no longer in the Console plugin. Inlining the connection check in web search keeps the same behaviour. The closest tests (config and provider-opencode) and the core type check (tsc -b) pass. I still couldn't run it end to end without a Console serving the new format.
The earlier point about auth: "console" MCP servers on the config path is not addressed yet. That thread stays open.
Public API: Config.Interface gets a new optional integration() method, and the Console response gets a new $schema config format. The top-level voice offer is no longer part of the new format. Legacy responses are unchanged, so this stays backwards compatible.
# Conflicts: # packages/core/src/plugin/provider/opencode.ts
There was a problem hiding this comment.
This push merges dev. In this pull request's files it only switches to dev's ConsoleAccess helpers for the Console server URL and credential headers, so behaviour is the same. The closest tests and the core type check (tsc -b) pass. I still couldn't run it end to end without a Console serving the new format.
The earlier point about auth: "console" MCP servers on the config path is still open.
Public API: this push changes nothing beyond what I reviewed before. That is the new optional Config.integration() method and the $schema Console config format; legacy responses are unchanged, so it stays backwards compatible.
…emote config layer (v2.2.0) Classification: new-feature (in scope: the harness promises no MCP servers) Source: anomalyco/opencode#57703 (merged 2026-10-25; v2.2.0 release notes 'Apply OpenCode Console workspace configuration as a configuration layer'): the Console's config is merged like a config file - providers, remote MCP servers, policies and the web search selection; its policies outrank user and project config. Cross-check at v2.2.6: packages/core/src/config/integration.ts, ConfigIntegration.Remote allow-lists providers, mcp, policies, websearch for a document delivered by an integration connection. Before: residual leaks listed only .well-known remote config After: one more row for a Console login used as --credential, with the mitigation Co-Authored-By: Claude Fable 5.2 <[email protected]>
A Console that serves a regular OpenCode config, marked by
$schema, is now merged like any config file. This lets the Console manage providers, remote MCP servers, policies, and the web search selection through config itself, with no special cases in the client.providers, remotemcpservers,policies, andwebsearchare kept. Plugins, shell, local MCP servers, agents, commands, permissions, and every other key are dropped. Provider credentials andenvare stripped, and Console providers are bound to the Console connection.Blocked by Acme's policy).websearchselection picks it, and a user's own selection wins.Responses without
$schemakeep today's behaviour unchanged. That code now lives inopencode-legacy.ts, so it can be deleted once every Console serves the new format. Old Consoles and the current Console are unaffected, and the Console will send the new format only to clients that support it.Testing
test/plugin/provider-opencode.test.ts: the existing legacy tests pass unchanged. New config-path tests cover format detection, the allowlist and credential stripping, provider layering, web search selection, and account switch/sign-out.test/config/config.test.ts: integration document layering, plus policy precedence (MDM > Console > user/project) and the organization denial message.Added by the opencode bot (AI-generated).
Public API: adds optional Config.integration() and a
$schemaConsole config format; legacy Console responses unchanged (backwards compatible)