fix(opencode): read /api/models with the admin token, not the admission key

Author: cortes-ventures

src/cli/opencode.ts

@@ -40,6 +40,7 @@ import type {
   OpencodeV2ProviderBlock,
 } from "../clients/config-export";
 import { filterCatalogVisibleModels, visibleNativeSlugs } from "../codex/catalog";
+import { configuredAdminToken } from "../lib/admin-secrets";
 import { commandInvocation } from "../lib/win-exec";
 import { loadServiceTokenFromFile, serviceApiTokenFilePath } from "../lib/service-secrets";
 import { providerCodexAccountMode } from "../providers/registry";
@@ -602,6 +603,19 @@ export function opencodeApiKey(config: OcxConfig, env: OpencodeLaunchEnv = proce
   return config.apiKeys?.[0]?.key || "ocx";
 }
 
+/**
+ * Credential for the launcher's `GET /api/models` read.
+ *
+ * That route is a management route, so `requireManagementAuth` only admits the admin credential —
+ * the data-plane admission key {@link opencodeApiKey} returns for the child process is refused there
+ * with `opencodex admin token required`. Prefer the configured admin token, the same credential every
+ * other headless management caller sends (`runningProxyUpdateHeaders`), and keep the admission key as
+ * the fallback for a host that has no admin token configured.
+ */
+export function opencodeManagementToken(config: OcxConfig, env: OpencodeLaunchEnv = process.env): string {
+  return configuredAdminToken(undefined, env) ?? opencodeApiKey(config, env);
+}
+
 async function ensureProxyForOpencode(config: OcxConfig): Promise<LiveProxy | null> {
   const live = await findLiveProxy();
   if (live) return live;
@@ -650,9 +664,10 @@ export async function cmdOpencode(args: string[]): Promise<number> {
   }
 
   const apiKey = opencodeApiKey(startupConfig);
+  const managementToken = opencodeManagementToken(startupConfig);
   let proxyModels: OpencodeProxyModelRow[];
   try {
-    proxyModels = await fetchOpencodeProxyModels(live, apiKey);
+    proxyModels = await fetchOpencodeProxyModels(live, managementToken);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     console.error(`❌ Could not fetch the model catalog from the proxy: ${reason}`);

tests/providers/opencode-cli.test.ts

@@ -25,6 +25,7 @@ import {
   opencodeCatalogFromProxyRows,
   opencodeGlobalConfigPath,
   opencodeLaunchNativeSlugs,
+  opencodeManagementToken,
   opencodeModelKey,
   opencodeNotFoundHint,
   opencodeProviderOverridePath,
@@ -718,6 +719,105 @@ describe("ocx opencode admission key", () => {
   });
 });
 
+describe("ocx opencode management token", () => {
+  // GET /api/models is a management route, so the launcher must present the admin credential there;
+  // sending the data-plane admission key is what produced "opencodex admin token required" (401).
+  const TOUCHED = ["OPENCODEX_ADMIN_AUTH_TOKEN", "OPENCODEX_HOME", "OPENCODEX_API_AUTH_TOKEN", "OCX_API_TOKEN_FILE"] as const;
+
+  function withEnv(overrides: Partial<Record<(typeof TOUCHED)[number], string>>, run: () => void): void {
+    const saved = new Map<string, string | undefined>(TOUCHED.map(key => [key, process.env[key]]));
+    try {
+      for (const key of TOUCHED) delete process.env[key];
+      for (const [key, value] of Object.entries(overrides)) process.env[key] = value;
+      run();
+    } finally {
+      for (const [key, value] of saved) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+  }
+
+  const adminToken = `ocx_admin_${"a".repeat(43)}`;
+
+  test("the configured admin token wins over the admission key", () => {
+    withEnv({}, () => {
+      const config = cfg({ apiKeys: [{ id: "1", name: "main", key: "sk-cfg", createdAt: "2026-01-01" }] });
+      expect(opencodeManagementToken(config, { OPENCODEX_ADMIN_AUTH_TOKEN: adminToken })).toBe(adminToken);
+    });
+  });
+
+  test("falls back to the admin-api-token file in OPENCODEX_HOME", () => {
+    const dir = mkdtempSync(join(tmpdir(), "ocx-opencode-admin-"));
+    writeFileSync(join(dir, "admin-api-token"), `${adminToken}\n`, { mode: 0o600 });
+    try {
+      withEnv({ OPENCODEX_HOME: dir }, () => {
+        const config = cfg({ apiKeys: [{ id: "1", name: "main", key: "sk-cfg", createdAt: "2026-01-01" }] });
+        expect(opencodeManagementToken(config, { OPENCODEX_ADMIN_AUTH_TOKEN: "  " })).toBe(adminToken);
+      });
+    } finally {
+      removeTreeWithRetry(dir);
+    }
+  });
+
+  test("falls back to the admission key when no admin token is configured", () => {
+    // An explicit empty OPENCODEX_HOME keeps this independent of any admin token the runner's
+    // sandbox home may already carry.
+    const dir = mkdtempSync(join(tmpdir(), "ocx-opencode-no-admin-"));
+    try {
+      withEnv({ OPENCODEX_HOME: dir }, () => {
+        const config = cfg({ apiKeys: [{ id: "1", name: "main", key: "sk-cfg", createdAt: "2026-01-01" }] });
+        expect(opencodeManagementToken(config, {})).toBe("sk-cfg");
+      });
+    } finally {
+      removeTreeWithRetry(dir);
+    }
+  });
+
+  test("cmdOpencode sends the admin token — not the admission key — on GET /api/models", async () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-opencode-admin-read-"));
+    const envKeys = [...TOUCHED, "CODEX_HOME", "XDG_CONFIG_HOME", OPENCODE_CONFIG_CONTENT_ENV];
+    const previous = Object.fromEntries(envKeys.map(key => [key, process.env[key]]));
+    const liveness = await import("../../src/server/proxy-liveness");
+    const finder = spyOn(liveness, "findLiveProxy").mockResolvedValue({
+      port: 10123, hostname: "127.0.0.1", pid: null, source: "config",
+    });
+    let sentKey: string | null = null;
+    const fetcher = spyOn(globalThis, "fetch").mockImplementation(async (input, init) => {
+      expect(String(input)).toBe("http://127.0.0.1:10123/api/models");
+      sentKey = new Headers(init?.headers).get("X-OpenCodex-API-Key");
+      return Response.json([]);
+    });
+    const spawn = spyOn(childProcess, "spawn").mockImplementation(() => {
+      const child = new childProcess.ChildProcess();
+      queueMicrotask(() => child.emit("exit", 0, null));
+      return child;
+    });
+    const stderr = spyOn(console, "error").mockImplementation(() => {});
+    try {
+      for (const key of envKeys) delete process.env[key];
+      process.env.OPENCODEX_HOME = home;
+      process.env.CODEX_HOME = join(home, "codex");
+      process.env.XDG_CONFIG_HOME = join(home, "xdg");
+      process.env.OPENCODEX_ADMIN_AUTH_TOKEN = adminToken;
+      mkdirSync(process.env.CODEX_HOME);
+      writeFileSync(join(home, "config.json"), JSON.stringify(
+        cfg({ apiKeys: [{ id: "1", name: "main", key: "sk-cfg", createdAt: "2026-01-01" }] }),
+      ));
+      expect(await cmdOpencode([])).toBe(0);
+      expect(sentKey).toBe(adminToken);
+      expect(sentKey).not.toBe("sk-cfg");
+    } finally {
+      finder.mockRestore(); fetcher.mockRestore(); spawn.mockRestore(); stderr.mockRestore();
+      for (const [key, value] of Object.entries(previous)) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+      removeTreeWithRetry(home);
+    }
+  });
+});
+
 describe("ocx opencode proxy auto-start env", () => {
   test("passes OCX_API_TOKEN_FILE to ocx start when only the hardened service token exists", () => {
     const dir = mkdtempSync(join(tmpdir(), "ocx-opencode-start-"));