Repository navigation
Conversation
OpenCode 2.x no longer writes auth.json; current API keys live in the shared SQLite credential table. Add a read-only, bounded projection that selects only active key rows (OAuth and malformed values are skipped) and the XDG-aware path helper used to locate that database. Serves K-CONFIG-AUTH and K-V2-LEGACY-AUTH. Tests: store platform XDG precedence and fallback; the runtime reader test covers inactive rows, OAuth rows, and newest-active selection. Fake credentials only.
Layer active OpenCode 2.x key credentials over legacy auth for prompts and the provider picker. Keys stay runtime-only: provider/model payloads expose only the provider id and never the secret. Resolve built-in OpenAI-compatible endpoints for keyed providers and require a resolvable endpoint before the v2 picker marks a catalog provider connected. Serves K-CONFIG-AUTH, K-V2-LEGACY-AUTH, D-PROV-ENDPOINTS, and D-V2-LEGACY-AUTH. Tests: runtime provider_key_tests (reader, OpenAI endpoint, active-key picker, key absent from v1/v2 payloads), XDG auth/DB path test, and the v2 wire parity fixture now carries an explicit baseURL. Fake credentials only; no network.
Fingerprint only the active-key projection from OpenCode's shared database so credential changes trigger an auth reload without hashing the growing session database or reloading on unrelated writes. Wire the database path at boot. Serves K-CONFIG-AUTH and K-V2-LEGACY-AUTH. Test: credential_snapshot_ignores_inactive_rows_and_tracks_active_keys proves inactive rows do not reload and active-key changes do. Fake credentials only.
Record the read-only foreign-database projection, XDG data-path precedence, bounded key-only reload, endpoint readiness rule, and the explicit OAuth exclusion in the divergence ledger, storage spec, and traceability matrix. Serves K-CONFIG-AUTH, K-V2-LEGACY-AUTH, D-MODELS-3, D-PROV-ENDPOINTS, and D-V2-LEGACY-AUTH. No behavior change.
Regression test for the OpenCode-host Mistral provider gap (Reliary#1): an active key row in OpenCode 2.x's shared credential table must resolve Mistral's OpenAI-compatible endpoint, count as connected, and expose catalog models without leaking the key. Proven red before the endpoint metadata fix (left: None, right: Some((https://api.mistral.ai/v1, fake-mistral-key))). Fake credential only; no network. Test-only commit, matrix row follows with the fix.
A saved Mistral API key was not enough to mark the provider ready because ocserve's generic request path had no built-in Mistral base URL. Resolve the stable endpoint so an active OpenCode key appears in the provider picker and can authenticate model requests without a custom baseURL. Covers K-CONFIG-AUTH and K-V2-LEGACY-AUTH; narrows D-PROV-ENDPOINTS. The regression test was committed first and shown red before this fix. Provider key tests, workspace tests, clippy, guards, and matrix pass.
Pin the OpenCode-compatible split: connected providers remain visible on /api/provider, while models with no resolvable prompt endpoint stay out of /api/model. Negative control: with the provider-level endpoint gate removed and no model-level gate, the fixture returned authonly/auth-model in /api/model.
Upstream now exposes connected auth-only providers in provider metadata. Keep that contract, but gate catalog models separately on a resolvable prompt endpoint so ocserve never advertises models it cannot route. Serves K-V2-LEGACY-AUTH. The v2 parity regression is red without the model-level endpoint guard and passes with it. Focused v2 parity, provider-key tests, clippy, guards, and matrix pass.
Keep the explicit test seam isolated, but route the production loader through load_auth_for so XDG precedence has one implementation and remains used after the upstream rebase. Serves K-CONFIG-AUTH; workspace clippy passes with warnings denied.
jrzmurray
force-pushed
the
feat/mistral-opencode-endpoint
branch
from
November 13, 2026 21:55
7122f63 to
7b1651a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
cargo fmt --check— passed.cargo clippy --workspace --all-targets -- -D warnings— passed../scripts/check-guards.sh— passed.CARGO_BUILD_JOBS=1 ./scripts/check-matrix.sh— passed.The complete macOS workspace test run is not green: it fails eight unchanged Linux-specific partition/RSS tests and the unchanged HTTP symlink-containment test, which exposes a separate macOS path-containment issue. No live Mistral API request was made.