desktop: "Connect OpenCode Go" runs Console sign-in instead of the Go API-key flow, then reports success and fails with "Insufficient account funds" #50611

Summary

On the desktop app, connecting OpenCode Go from the connect picker runs the OpenCode Console sign-in instead of the API-key flow opencode-go actually declares. The app reports success ("OpenCode Go connected"), but the credential is stored under the Console integration (opencode), so /models only shows Zen/Console models and every request fails with Upstream request failed: Insufficient account funds. A paid Go subscription is never used, and no Go models appear.

Environment

• opencode version: v2.0.13 (desktop app, OPENCODE_CLIENT=desktop)
• OS: Windows 11 (10.0.26200.9457)
• Terminal: desktop app
• Shell: cmd.exe
• Install/channel: latest
• Active plugins: @tarquinen/opencode-dcp@latest

Reproduction

1. Have an active OpenCode Go subscription (console Go page: "You are subscribed to OpenCode Go", usage 0%).
2. Open the desktop connect/providers UI and choose OpenCode Go.
3. The dialog titled "Connect OpenCode Go" instead asks: "Sign in with your OpenCode Console account … pick a workspace and select Authorize" (device code).
4. Authorize in the browser. The app shows a success toast: "OpenCode Go connected — you can now use OpenCode Go models."
5. Open /models. The only group is Personal / OpenCode (Console: Claude / Gemini / Big Pickle / …). No opencode-go models are listed.
6. Send any message → Upstream request failed: Insufficient account funds.

Expected Behavior

Either:

• picking OpenCode Go presents the API-key form for the opencode-go integration (its only declared method), or
• Console sign-in actually grants the workspace's Go entitlement, so Go models are listed and usable.

The success toast must not claim "OpenCode Go connected" when only a Console credential was created.

Actual Behavior

Only Console credentials are created — five attempts, none for opencode-go:

11:11:08 credential created ... integrationID=opencode type=oauth
11:23:43 credential created ... integrationID=opencode type=oauth
11:26:58 credential created ... integrationID=opencode type=oauth
11:27:23 credential created ... integrationID=opencode type=oauth
11:30:05 credential created ... integrationID=opencode type=oauth

GET /api/integration confirms the mismatch:

• opencode (OpenCode Console): methods: [key, env, oauth], connections: 5
• opencode-go (OpenCode Go): methods: [key, env], connections: 0

Then every request fails: AI.Error: Upstream request failed: Insufficient account funds, and opencode models lists only opencode/* plus deepseek/* — zero opencode-go/* entries.

Additional Context

The Go key, the subscription and the gateway are all fine — only the onboarding path is broken:

1. Direct probe with the Go API key:
   POST https://opencode.ai/zen/go/v1/chat/completions with Authorization: Bearer <go key>
   → HTTP 400, Error from provider (Console Go): Request is missing x-opencode-session …
   (i.e. authentication succeeded; it only asks for the session header that the CLI normally adds).
2. Connecting the same key via the API:
   POST /api/integration/opencode-go/connect/key with {"key": "..."} → HTTP 204.
3. Immediately after: opencode models lists 30 opencode-go/* models and opencode run succeeds with glm-5.3-flash.

So the fix is purely in the connect UI/flow: the API-key path for opencode-go is buried (or unreachable) in the desktop onboarding.

Related: #50087, #49981, #49935, #50420, and PR #50267 (merged 2026-09-22) which maps the "OpenCode Go" entry to consoleIntegration("opencode-go") → "opencode". For this account that mapping produced Console (Zen) entitlements only, not Go.

Workaround: call the local server directly —

opencode api get /api/integration   # inspect
# POST /api/integration/opencode-go/connect/key  {"key":"<go key>"}   (needs local service basic auth from `opencode pair`)