providers: stale wellknown API-key wiring in the shared service sends an empty key after auth login/logout #54645

Activity

1. opencode-agent commented on Oct 11, 2026

   

   opencode-agentBot

   on Oct 11, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I reproduced this on 2.0.26, and it still happens on the latest dev (707de58).

   I used a local mock with two well-known origins, A (VAR_A) and B (VAR_B). Each remote config sets the same provider's x-api-key header to {env:VAR_X}, with apiKey: "dummy". A mock gateway logs the key it receives:

   1. auth login A, then run → sends A's key, works
   2. auth login B, then run → sends B's key, works
   3. auth logout B, then run → sends x-api-key: "" and gets Invalid API Key. Error Code: 03, even though auth list shows A's credential is still there
   4. After restarting the service, run still sends an empty key

   The script below reproduces it end to end.

   From reading the code (not tested yet), the likely cause is this: logout removes only the credential, not the well-known source or its cached remote config. That cached config is still applied with no credential, so {env:VAR_B} resolves to an empty string and overrides A's header. That would also explain why a restart doesn't clear it.

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Reproduces anomalyco/opencode#54645. Mock: well-known origins on :4101/:4102, gateway on :4100.
   # OC=opencode (default, uses the shared background service), or OC=./oc-dev.sh MANUAL=1 to run a
   # long-lived `opencode serve` from source and connect with --server (the auto-spawned service fails from source).
   # Self-contained: writes and starts the mock servers (needs bun).
   M=$(mktemp -d /tmp/opencode/mock.XXXX)
   cat > "$M/mock.ts" <<'MOCK'
   // Two well-known origins (A on 4101, B on 4102) and a mock OpenAI-compatible gateway on 4100.
   const providerCfg = (env: string) => ({
     provider: {
       gw: {
         npm: "@ai-sdk/openai-compatible",
         name: "Gateway",
         options: { baseURL: "http://127.0.0.1:4100/v1", apiKey: "dummy", headers: { "x-api-key": `{env:${env}}` } },
         models: { m: { name: "m" } },
       },
     },
   })
   for (const [port, env, key] of [[4101, "VAR_A", "key-a"], [4102, "VAR_B", "key-b"]] as const) {
     Bun.serve({
       port,
       fetch(req) {
         const u = new URL(req.url)
         if (u.pathname === "/.well-known/opencode")
           return Response.json({
             auth: { command: ["sh", "-c", `echo ${key}`], env },
             remote_config: { url: `http://127.0.0.1:${port}/config`, headers: { authorization: `Bearer {env:${env}}` } },
           })
         if (u.pathname === "/config") return Response.json(providerCfg(env))
         return new Response("nf", { status: 404 })
       },
     })
   }
   Bun.serve({
     port: 4100,
     async fetch(req) {
       const k = req.headers.get("x-api-key")
       console.log(`GATEWAY ${req.method} ${new URL(req.url).pathname} x-api-key=${JSON.stringify(k)}`)
       if (k !== "key-a" && k !== "key-b") return Response.json({ error: { message: "Invalid API Key. Error Code: 03" } }, { status: 401 })
       const chunk = (d: any) => `data: ${JSON.stringify(d)}\n\n`
       const base = { id: "x", object: "chat.completion.chunk", created: 0, model: "m" }
       return new Response(
         chunk({ ...base, choices: [{ index: 0, delta: { role: "assistant", content: "OK" } }] }) +
           chunk({ ...base, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] }) + "data: [DONE]\n\n",
         { headers: { "content-type": "text/event-stream" } },
       )
     },
   })
   console.log("mock up")
   MOCK
   bun "$M/mock.ts" > "$M/mock.log" 2>&1 & MOCKPID=$!; sleep 1
   trap 'kill $MOCKPID 2>/dev/null; echo "--- gateway log"; grep GATEWAY "$M/mock.log"' EXIT
   OC=${OC:-opencode}
   export OPENCODE_PASSWORD=${OPENCODE_PASSWORD:-repro-pass}
   export HOME=$(mktemp -d /tmp/opencode/home.XXXX) XDG_CONFIG_HOME= XDG_DATA_HOME= XDG_STATE_HOME= XDG_CACHE_HOME=
   P=$(mktemp -d /tmp/opencode/proj.XXXX); cd "$P"; git init -q
   A=http://127.0.0.1:4101 B=http://127.0.0.1:4102
   S=()
   start(){ [ -n "$MANUAL" ] || return 0; $OC serve --port 4199 >/tmp/opencode/serve.log 2>&1 & SP=$!; sleep 6; }
   stop(){ if [ -n "$MANUAL" ]; then kill $SP 2>/dev/null; wait $SP 2>/dev/null; else timeout 30 $OC service stop >/dev/null 2>&1; pkill -f "[s]erve --service"; fi; }
   [ -n "$MANUAL" ] && S=(--server http://127.0.0.1:4199)
   step(){ echo "=== $*"; }
   run(){ timeout 90 $OC run "${S[@]}" -m gw/m "say hi" 2>&1 | tail -2; }
   stop; start
   step "login A"; timeout 60 $OC auth login "${S[@]}" $A 2>&1 | tail -1
   step "run (A)"; run
   step "login B"; timeout 60 $OC auth login "${S[@]}" $B 2>&1 | tail -1
   step "run (A+B)"; run
   step "logout B"
   CB=$($OC auth list "${S[@]}" --format json | bun -e 'const j=JSON.parse(await Bun.stdin.text());console.log(j.find(i=>i.id==="http://127.0.0.1:4102").connections[0].id)')
   timeout 60 $OC auth logout "${S[@]}" $B "$CB" 2>&1 | tail -1
   echo "credentials left: $($OC auth list "${S[@]}" --format json | grep -c '"credential"')"
   step "run (A only) -> expected OK"; run
   step "restart server/service"; stop; start
   step "run after restart (A only)"; run
   stop

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 11, 2026
3. nosmile99 commented on Oct 12, 2026

   

   nosmile99

   on Oct 12, 2026

   More actions

   I reproduced this and intend to work on it — I have a fix with a regression test ready and will open a PR against dev shortly.

   Root cause (verified empirically): in packages/core/src/config.ts (loadWellknownEntry), when the credential for a well-known endpoint is gone (logged out), the code falls through to wellknown.cached(entry.origin) and substitutes the cached remote config with env: undefined. ConfigVariable.substitute then resolves {env:VAR_B} to "", so the logged-out endpoint still emits a provider document whose empty x-api-key header overlays the still-authenticated endpoint's wiring (later document wins in mergeHeaders) — hence the 401. The stale state survives restarts because the cached config lives in KV until the source is removed.

   The fix: when the manifest declares auth but no usable key credential exists, the entry contributes no documents, so the provider wiring follows the set of currently authenticated endpoints. A failed refresh with a credential present still keeps the last resolved config.

   🚀React with 🚀1Reacted by Bren
4. nosmile99 commented on Oct 12, 2026

   

   nosmile99

   on Oct 12, 2026

   More actions

   PR is up: #54687 (against dev, per the contribution gates). Root cause and verification are in the PR body; happy to adjust if the approach needs rework.