You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(opencode): read usage from Console OAuth logins - #33287
Rebase of #27166 onto current main (402d0623d5), with the conflict against #26165 resolved and the Effect 4.1.2 Digest migration preserved.
Read active OpenCode 2 Console OAuth credentials (type: "oauth") as well as stored API keys.
Send the credential's workspace ID in x-opencode-org-id when reading Go usage.
Keep the existing fallback to stored opencode / opencode-go keys and the legacy auth.json / OPENCODE_API_KEY path.
Fingerprint Console credentials by workspace instead of token, so OAuth access-token rotation does not split one workspace into multiple limit accounts.
Isolate the OpenCode driver tests from the host's real credential store.
Why
OpenCode 2 stores a signed-in Console account as an active OAuth credential in opencode.db with its workspace ID in credential metadata. T3 only decoded stored credentials of type key, so it discarded the valid Console login and returned unsupported without attempting the usage endpoint. The account itself works: the same OAuth access token returns HTTP 200 from https://opencode.ai/zen/go/v1/usage.
Fixes#14983. Supersedes #27166; the original two commits are preserved with their authorship.
Verification
pnpm --filter @t3tools/provider-opencode test — 170 passed.
pnpm run check:changed — passed format, lint, both knip checks, typecheck for 10 affected packages, and 53 tests across 3 files.
Live check against this machine's real OpenCode 2 Console OAuth login (no mocks): rolling 4%, weekly 3%, monthly 6%, all three windows returned with no unavailable reason.
Added OPENCODE_AUTH_CONTENT={} to the driver test factory after the full package suite exposed that the new OAuth read could otherwise reach the host's real credential store and the noHttp guard.
Full repository test suites and builds are left to CI.
Notes
Original implementation and commits by @Fushi500 in #27166. Rebase, conflict resolution, and test isolation here were done with DeepSeek V4.1 Flash in OpenCode.
The Mobile Fingerprint Check run is stuck at action_required with no jobs started — GitHub is waiting for a maintainer to approve the fork PR workflow run. This PR only touches packages/provider-opencode, which is outside the workflow's native-input paths (packages/client-runtime, packages/contracts, packages/shared, mobile/assets/scripts/patches, and root package files), so the expected result is "unchanged". Could a maintainer approve that run? The main CI workflow is still running.
Thanks @goncalompontes for rebasing and testing this. #27166 by @Fushi500 implements the same OAuth usage and workspace fingerprint fix, with regression coverage and green checks, so we are keeping that PR. Your rebase and test-isolation work may help update it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
size:M30-99 changed lines (additions + deletions).vouch:unvouchedAuthor is not yet trusted in the VOUCHED list.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
vouch:unvouched
What changed
Rebase of #27166 onto current
main(402d0623d5), with the conflict against #26165 resolved and the Effect 4.1.2Digestmigration preserved.type: "oauth") as well as stored API keys.x-opencode-org-idwhen reading Go usage.opencode/opencode-gokeys and the legacyauth.json/OPENCODE_API_KEYpath.Why
OpenCode 2 stores a signed-in Console account as an active OAuth credential in
opencode.dbwith its workspace ID in credential metadata. T3 only decoded stored credentials of typekey, so it discarded the valid Console login and returnedunsupportedwithout attempting the usage endpoint. The account itself works: the same OAuth access token returns HTTP 200 fromhttps://opencode.ai/zen/go/v1/usage.Fixes #14983. Supersedes #27166; the original two commits are preserved with their authorship.
Verification
pnpm --filter @t3tools/provider-opencode test— 170 passed.pnpm run check:changed— passed format, lint, both knip checks, typecheck for 10 affected packages, and 53 tests across 3 files.unavailablereason.OPENCODE_AUTH_CONTENT={}to the driver test factory after the full package suite exposed that the new OAuth read could otherwise reach the host's real credential store and thenoHttpguard.Full repository test suites and builds are left to CI.
Notes
Original implementation and commits by @Fushi500 in #27166. Rebase, conflict resolution, and test isolation here were done with DeepSeek V4.1 Flash in OpenCode.