feat(opencode): support separate Zen and Go API key env vars by olisikh · Pull Request #87762 · openclaw/openclaw

olisikh · 2026-05-28T19:31:33Z

Summary

lets Zen and Go OpenCode plugins use separate env vars
documents fallback order for OPENCODE_ZEN_API_KEY, OPENCODE_GO_API_KEY, and shared OPENCODE_API_KEY
formats the Go provider docs table so docs checks do not fail on this PR diff

Real behavior proof

Behavior or issue addressed: OpenCode Zen and Go can be configured independently while retaining shared OPENCODE_API_KEY fallback behavior.

Real environment tested: macOS checkout of this PR branch, Node/pnpm repo toolchain, dependencies installed from the lockfile.

Exact steps or command run after this patch:

node --import tsx -e 'const load=async(path)=>{const plugin=(await import(path)).default; const providers=[]; plugin.register({registerProvider:(p)=>providers.push(p),registerMediaUnderstandingProvider:()=>{}}); return providers[0];}; const zen=await load("./extensions/opencode/index.ts"); const go=await load("./extensions/opencode-go/index.ts"); console.log(JSON.stringify({zen:{provider:zen.id,envVars:zen.envVars},go:{provider:go.id,envVars:go.envVars}},null,2));'
pnpm check:docs

Evidence after fix:

node --import tsx ...
{
  "zen": {
    "provider": "opencode",
    "envVars": [
      "OPENCODE_ZEN_API_KEY",
      "OPENCODE_API_KEY"
    ]
  },
  "go": {
    "provider": "opencode-go",
    "envVars": [
      "OPENCODE_GO_API_KEY",
      "OPENCODE_API_KEY",
      "OPENCODE_ZEN_API_KEY"
    ]
  }
}

Docs formatting clean (650 files).
markdownlint Summary: 0 error(s)
Docs MDX check passed
docs:check-i18n-glossary failed on unrelated changed docs not present in this PR diff:
docs/cli/tui.md
docs/plugins/reference/codex-supervisor.md
docs/specs/claw-supervisor.md
docs/tools/goal.md

Observed result after fix: the runtime plugin registrations expose separate Zen and Go env vars with shared fallback ordering; the OpenCode Go provider page no longer has the markdown table formatting drift that caused this PR's docs failure.

What was not tested: no live OpenCode API call was run because this environment has no OpenCode key available; the remaining docs glossary failure is unrelated to this PR's changed files.

Verification

pnpm install --offline
pnpm check:docs
git diff --name-only upstream/main...HEAD

clawsweeper · 2026-05-28T19:33:15Z

Codex review: needs real behavior proof before merge. Reviewed May 29, 2026, 7:00 PM ET / 23:00 UTC.

Summary
The PR updates OpenCode Zen and Go provider auth env var precedence, manifests, docs, and focused auth tests so provider-specific API key env vars can be used alongside the shared fallback.

PR surface: Source +2, Tests +35, Docs +7. Total +44 across 15 files.

Reproducibility: yes. for the review findings by source inspection: current main writes both OpenCode profiles and the PR removes that fan-out, while AuthStorage still falls back through a map that only knows OPENCODE_API_KEY. No live runtime reproduction was run because this was a read-only review.

Review metrics: 2 noteworthy metrics.

Provider auth env surfaces: 1 added, 1 promoted/reordered across 2 providers. OpenCode Go adds OPENCODE_GO_API_KEY and Zen promotes OPENCODE_ZEN_API_KEY, so credential precedence and upgrade behavior need explicit review.
Shared profile fan-out: 2 fan-out declarations removed. Both OpenCode auth choices stop writing credentials for the sibling provider, changing generated auth profiles for existing setup workflows.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🦪 silver shellfish
Patch quality: 🧂 unranked krab
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Restore or explicitly migrate the shared OPENCODE_API_KEY profile fan-out behavior with focused tests.
Update AuthStorage/getEnvApiKey coverage for OPENCODE_ZEN_API_KEY and OPENCODE_GO_API_KEY precedence.
[P1] Add redacted real behavior proof for onboarding and runtime auth after the patch.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: The PR body supplies terminal output for provider registration metadata, but it does not prove after-fix onboarding, stored auth profiles, AuthStorage fallback, or a real OpenCode auth path; redacted terminal output or logs for those paths are still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Merging as-is can break the existing one-key onboarding behavior where one OpenCode setup stores usable profiles for both Zen and Go.
[P1] Some session/runtime paths using AuthStorage can still miss OPENCODE_ZEN_API_KEY and OPENCODE_GO_API_KEY because the legacy env-key map remains shared-key only.
[P1] The supplied terminal proof confirms provider registration metadata, but not the full onboarding/auth runtime behavior that this PR changes.

Maintainer options:

Preserve shared-key compatibility first (recommended)
Retain provider-specific keys while keeping tested OPENCODE_API_KEY shared profile fan-out, or add a maintainer-approved migration/deprecation path with focused upgrade coverage.
Accept the setup break deliberately
Maintainers can choose the profile split only after documenting the upgrade impact and deciding one OpenCode setup no longer configures both catalogs.
Pause for runtime proof
Hold the PR until redacted onboarding and runtime auth output demonstrates split keys and shared fallback after the patch.

Next step before merge

[P1] A contributor or maintainer needs to resolve the shared-key compatibility decision, repair the AuthStorage lookup gap, and provide real behavior proof; automation cannot supply the contributor's real setup proof.

Security
Cleared: The diff changes auth env-var names, manifests, docs, and tests but does not add dependencies, workflows, lockfile changes, scripts, token exposure, or broader secret access.

Review findings

[P1] Preserve shared-key profile fan-out — extensions/opencode/index.ts:47
[P2] Wire split keys into session env lookup — extensions/opencode-go/index.ts:31

Review details

Best possible solution:

Keep the split provider-specific env vars, but preserve or explicitly migrate shared OPENCODE_API_KEY profile fan-out and update every auth lookup path before asking maintainers to accept the new behavior.

Do we have a high-confidence way to reproduce the issue?

Yes for the review findings by source inspection: current main writes both OpenCode profiles and the PR removes that fan-out, while AuthStorage still falls back through a map that only knows OPENCODE_API_KEY. No live runtime reproduction was run because this was a read-only review.

Is this the best way to solve the issue?

No. Split keys are a reasonable direction, but the best solution needs backward-compatible shared-key profile behavior, complete auth lookup coverage, and runtime proof before changing docs and defaults.

Full review comments:

[P1] Preserve shared-key profile fan-out — extensions/opencode/index.ts:47
Current main writes both opencode:default and opencode-go:default when a user onboards with one shared OpenCode key, and the auth-choice test still documents that behavior. This PR removes profileIds unconditionally, so a user who runs one setup command with a shared key but does not keep the env var exported can lose the sibling catalog's stored auth; preserve fan-out for the shared OPENCODE_API_KEY path or add an explicit maintainer-approved migration/deprecation path with tests.
Confidence: 0.9
[P2] Wire split keys into session env lookup — extensions/opencode-go/index.ts:31
The new OPENCODE_GO_API_KEY metadata feeds resolveEnvApiKey, but AuthStorage.getApiKey() still falls back through src/llm/env-api-keys.ts, where both OpenCode providers only check OPENCODE_API_KEY. SDK/session paths that use AuthStorage directly can still miss the new split keys, so update that map and add coverage for the new precedence.
Confidence: 0.78

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 0e6937cc1be1.

Label changes

Label justifications:

P1: The PR can regress an existing shared OpenCode onboarding/auth workflow if merged as-is.
merge-risk: 🚨 compatibility: It changes public onboarding behavior and generated auth profile compatibility for users with one shared OpenCode key.
merge-risk: 🚨 auth-provider: It changes provider credential precedence while leaving a session auth lookup path out of sync with the new env vars.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body supplies terminal output for provider registration metadata, but it does not prove after-fix onboarding, stored auth profiles, AuthStorage fallback, or a real OpenCode auth path; redacted terminal output or logs for those paths are still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +2, Tests +35, Docs +7. Total +44 across 15 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	5	29	27	+2
Tests	2	39	4	+35
Docs	8	36	29	+7
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	15	104	60	+44

What I checked:

Repository policy applied: Root AGENTS.md and the scoped extensions, plugin-sdk, agents, and docs guides were read; the auth/config compatibility guidance applies because this PR changes provider credentials, onboarding metadata, docs, and fallback behavior. (AGENTS.md:19, 0e6937cc1be1)
Current main stores both OpenCode profiles: Current main configures Zen onboarding with OPENCODE_API_KEY, explicit shared profileIds, and expectedProviders covering both opencode and opencode-go. (extensions/opencode/index.ts:48, 0e6937cc1be1)
Existing test locks shared profile fan-out: The auth-choice test expects opencode-zen setup to write opencode:default and opencode-go:default, proving the one-key setup behavior is current expected behavior. (src/commands/auth-choice.test.ts:1217, 0e6937cc1be1)
PR head removes the fan-out: At the PR head, Zen auth uses OPENCODE_ZEN_API_KEY and no longer passes profileIds or expectedProviders for the sibling provider, so one shared onboarding no longer persists both profiles. (extensions/opencode/index.ts:47, dfb54ea1d66e)
Legacy session env lookup still misses split keys: AuthStorage falls back through getEnvApiKey, while the PR head still maps both opencode providers only to OPENCODE_API_KEY in src/llm/env-api-keys.ts. (src/llm/env-api-keys.ts:184, dfb54ea1d66e)
PR proof is narrower than the changed behavior: The PR body shows terminal output for provider registration envVars and docs checks, but does not run onboarding, stored profile fan-out, resolveEnvApiKey with real env values, AuthStorage fallback, or a live OpenCode request. (dfb54ea1d66e)

Likely related people:

steipete: Recent GitHub file history shows OpenCode provider and agent-runtime/env-key refactor work on the affected provider and env lookup surfaces. (role: recent area contributor; confidence: high; commits: 827b0de0ce74, bb46b79d3c14; files: extensions/opencode/index.ts, extensions/opencode-go/index.ts, src/llm/env-api-keys.ts)
vincentkoc: GitHub history shows the shared OpenCode catalog auth helper was added and maintained in src/plugin-sdk/opencode.ts, which this PR changes. (role: shared helper contributor; confidence: medium; commits: 66701d5a1e16, 5ece17a8659d; files: src/plugin-sdk/opencode.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

olisikh · 2026-05-28T20:33:13Z

@clawsweeper re-review

clawsweeper · 2026-05-28T20:33:17Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26600609698
Updated: 2026-05-28T20:42:40.627Z

olisikh · 2026-05-28T23:14:51Z

@clawsweeper re-review

clawsweeper · 2026-05-28T23:14:55Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26607867602
Updated: 2026-05-28T23:25:45.557Z

… docs - Add OPENCODE_GO_API_KEY to test mock candidate map for opencode-go so the new split-key precedence test actually passes - Restore setup.providers[].envVars in both opencode plugin manifests, keeping providerAuthEnvVars too (deprecated compat metadata) - Update opencode-go.md, model-providers.md, wizard-cli-reference.md, wizard-cli-automation.md, wizard.md, testing-live.md, config-tools.md to document OPENCODE_GO_API_KEY alongside the existing keys

olisikh · 2026-05-28T23:54:18Z

@clawsweeper re-review

clawsweeper · 2026-05-28T23:54:21Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26609325803
Updated: 2026-05-29T00:02:40.523Z

olisikh · 2026-05-29T22:49:55Z

@clawsweeper re-review

clawsweeper · 2026-05-29T22:49:58Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Superseded
Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26666203114
Updated: 2026-05-29T22:53:20.198Z

olisikh · 2026-05-29T22:54:18Z

@clawsweeper re-review

clawsweeper · 2026-05-29T22:55:23Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26666366352
Updated: 2026-05-29T23:01:18.639Z

clawsweeper · 2026-05-29T22:56:00Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

olisikh requested a review from a team as a code owner May 28, 2026 19:31

github-actions Bot added the dependencies-changed PR changes dependency-related files label May 28, 2026

olisikh mentioned this pull request May 28, 2026

[Feature]: Support separate Zen and Go API key env vars #87790

Open

olisikh and others added 2 commits May 29, 2026 01:50

feat(opencode): support separate Zen and Go API key env vars

a709e37

olisikh added 2 commits May 30, 2026 00:14

Merge branch 'main' into feat/opencode-split-provider-keys

33fe642

docs(opencode): format Go provider table

2c87d3c

test(opencode): mock Zen auth env candidates

dfb54ea

Uh oh!

Uh oh!

Conversation

olisikh commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Verification

Uh oh!

clawsweeper Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olisikh commented May 28, 2026

Uh oh!

clawsweeper Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olisikh commented May 28, 2026

Uh oh!

clawsweeper Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olisikh commented May 28, 2026

Uh oh!

clawsweeper Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olisikh commented May 29, 2026

Uh oh!

clawsweeper Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olisikh commented May 29, 2026

Uh oh!

clawsweeper Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

olisikh commented May 28, 2026 •

edited

Loading

clawsweeper Bot commented May 28, 2026 •

edited

Loading

clawsweeper Bot commented May 28, 2026 •

edited

Loading

clawsweeper Bot commented May 28, 2026 •

edited

Loading

clawsweeper Bot commented May 28, 2026 •

edited

Loading

clawsweeper Bot commented May 29, 2026 •

edited

Loading

clawsweeper Bot commented May 29, 2026 •

edited

Loading