Read OpenCode Go usage from the selected account

[nwparker]

	Files	Added	Deleted	Net
Test	156	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​10366	$\color{#cf222e}{\Huge{\mathbf{−}}}$​552	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​9814
Prod	229	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​5889	$\color{#cf222e}{\Huge{\mathbf{−}}}$​1649	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​4240

ELI5

OpenCode Go usage follows the account selected in Orca. Choosing System uses the host's original account even when Orca inherited a managed profile. A saved key override still wins.

What Changed

Before identifying OpenCode's credential backend or reading its store, the caller copies the host environment, restores the original account through the existing account service, and applies the selected OpenCode profile. Invalid account metadata rejects the lookup. Explicit execution context retains its precedence.

Why

The account service already owns private authentication references and System restoration. Reusing it keeps this lookup consistent with actual OpenCode launches without creating another credential store or changing the host environment.

Linked Issue

Refs #8145, #9362 and #18561. The account, credential and native dependencies are merged (#24636, #24615 and #24647). This fixes selected-account lookup only. The broader Devin/OpenCode account workflow in #18561 remains open.

Visual Proof

N/A — backend credential lookup only; no renderer or input interaction changes. These values come from fresh, captured OpenCode 2.0.16 requests and production caller results:

Selected account	Actual OpenCode request	Caller before	Caller after
System	System credential	Managed credential	System credential
Managed	Managed credential	Managed credential	Managed credential
System again	System credential	Managed credential	System credential

The requests used private placeholder credentials and a loopback server returning 401. This is captured backend evidence, not a rendered usage screen or a paid model request.

Testing

• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

On macOS arm64, the installed OpenCode 2.0.16 enrolled credentials through its real login prompt in private PTYs. Production account import, selection, launch environment, backend detection and credential lookup then exercised System → managed → System. The old caller reproduced the mismatch above; the corrected caller matched all actual request headers. HOME, userData, all four XDG directories and temporary files were isolated. No conversation store was imported and the host environment remained unchanged.

234 tests across 15 relevant files pass, including the original eight caller regressions and 49 focused credential/caller assertions. Seven of the eight original regressions fail before the correction. Node/CLI/web typechecks, changed-line quality checks, formatting, RPC generation, localization and source ratchets pass. Windows, Linux, WSL and SSH execution were not repeated in this local check. Public CI remains required.

Review

The complete original two-file change and its author history are preserved. Current credential lookup and native database discovery remain intact, including filesystem-error reporting, cancellation and the selected environment. The independently tested caller tree is aa0f0afdf8f7b1fd1a8806eebef380accf193bde.

The publication 2d9003031695ed5f9b654cfcfe969b61223fda5d now targets main after account PR #24636 merged as c2dba120727a6839e02899117de342034aee61f6. The complete source tree is byte-for-byte identical to the previously tested caller source a3ab2a9e4c352078d0294af466a8131bf46c7c33: both caller files retain their reviewed contents, and all 32,245 entries outside those two files match the merged main. Both the previous caller head and current main remain ancestors.

The combined implementation passed 518 tests across 29 files, all four typechecks and six quality gates on source 1845f0bd550e95dd9bd413cb31207c6424b957bd. The unchanged current tree also passed 42 PR-contract tests and the RPC catalog check on a3ab2a9. Genuine installed OpenCode requests and the earlier 234-test caller proof remain qualified to the unchanged lookup code. Fresh normal CI on this main-targeted publication passes: 16 successful checks and 16 intentionally skipped checks, with no pending, failed or cancelled checks.

Agent skill upstream boundary

• Not applicable; copies or mechanically translates no upstream skill-installer material.

Notes

The host running OpenCode owns account selection. Explicit environment/backend context still bypasses local account lookup. Folder workspaces and existing remote behavior are preserved; this does not establish a new SSH or Devin login result.

Checklist

• This PR is small and focused
• I explained what changed and why
• N/A with visual-proof reason and captured before/after comparison
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path impact considered
• Normal public CI passes on this exact head; local focused tests, full typechecks and changed-line gates also pass

[pullfrog]

ℹ️ No critical issues — one optional documentation nit.

Reviewed changes

• Selected-account credential lookup — resolveOpenCodeGoApiKey now snapshots process.env, restores the System baseline through the host ManagedDataAccountService, then applies the selected opencode profile when no explicit environment is passed. The settingsOverride and explicit execution context keep precedence, invalid/unreadable selection metadata rejects the lookup, and the process environment is not mutated.
• Regression coverage — a new host-service-backed suite exercises System→selected→System for v1/v2, opaque inline-baseline restoration, malformed/unknown/unreadable metadata refusal with manual-key precedence, and unchanged inherited env. I reverted the production hunk and re-ran it: 7 of 8 cases fail pre-patch, matching the PR claim.

I verified the sequencing matches applyManagedDataAccountEnvironment and confirmed both the new and existing opencode-go-api-key-source.test.ts suites pass.

ℹ️ Nitpicks

• src/main/rate-limits/opencode-go-api-key-source.ts:194 — the input.environment JSDoc ("Process environment to read; injectable for tests") now understates the contract: passing it also bypasses managed-account selection, which is the behavior this PR adds. A sentence noting that would help a future caller avoid passing process.env and silently disabling selection. The @returns also omits that the function can now throw when selection metadata is unreadable or invalid.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1d63bbdc-2686-4620-a22b-16c1d231ade6

📥 Commits

Reviewing files that changed from the base of the PR and between c2dba12 and 2d90030.

📒 Files selected for processing (2)

• src/main/rate-limits/opencode-go-api-key-source.ts
• src/main/rate-limits/opencode-go-managed-account-source.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

When no environment is injected, resolveOpenCodeGoApiKey now copies process.env, restores the managed-account environment, and overlays the OpenCode launch environment before backend detection and key resolution. An injected environment remains unchanged. Added tests cover system and selected account credentials for backends v1 and v2, inline system-auth restoration, invalid account metadata, and manual-key precedence.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 2d900

No actionable issue is established for this change. Complete the required public CI checks before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 2d900

Credential lookup now follows the selected account without changing the host environment, and explicit overrides retain precedence. The remaining uncertainty is whether an inherited API key should remain usable when the selected account has no stored credential.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The evidenced credential path operates within the execution host's original or selected managed account context and reaches an authenticated usage request. The evidence does not establish a broader tenant, service, or deployment exposure.

Trust Boundaries and Controls

• observed — Selected-profile resolution checks account membership and filesystem containment. Private inline-auth restoration requires the recorded reference and matching managed selection and overlay values, rather than accepting a reference alone.

Hardening Proposals

• proposed — Define whether an inherited API key remains an authorized global fallback when a selected profile lacks credentials. If selection is intended to pin credential identity, suppress that fallback in this state and cover it explicitly. This is a policy-hardening proposal, not a verified introduced vulnerability.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: OpenCode Go usage now follows the selected account.
Description check	✅ Passed	The description covers the required sections and explains the user-facing change, implementation, rationale, testing, and visual-proof exception. The Linked Issue section lists issue references but do…

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}