@expo/code-review-cli 0.4.0 → 0.5.0

package/build/config/load.js

@@ -54,7 +54,14 @@ async function loadConfigDir(dir, schema) {
     const raw = await readFile(configPath, "utf8");
     const rawObject = JSON.parse(stripTrailingCommas(stripJsonComments(raw)));
     const parsed = schema.parse(rawObject);
-    const override = process.env.REVIEWER_MODEL;
+    // An EMPTY REVIEWER_MODEL means "not set", not "use the empty model". GitHub Actions
+    // passes `${{ vars.REVIEWER_MODEL }}` as an empty string whenever that repo variable
+    // doesn't exist — which both scaffolded workflows do — so `??` (which only falls
+    // through on null/undefined) silently replaced every configured model with "". Every
+    // agent and the coordinator then ran on whatever OpenCode picked by default, so a
+    // config saying `anthropic/claude-sonnet-5` reviewed with something else entirely and
+    // nothing anywhere said so. Trim too: a stray newline is the same class of accident.
+    const override = process.env.REVIEWER_MODEL?.trim() || undefined;
     const defaultModel = override ?? parsed.model;
     const resolveModel = (frontmatterModel) => override ?? frontmatterModel ?? defaultModel;
     const resolveTemp = (value, fallback) => {
@@ -112,15 +119,51 @@ async function loadConfigDir(dir, schema) {
         // Scope configs can't declare commentTag (scope schema rejects it);
         // loadScopeConfig overwrites this placeholder with the manifest default.
         commentTag: parsed.commentTag ?? "expo-ai-code-reviewer",
-        auth: {
-            mode: parsed.auth?.mode ?? "api-key",
-            provider: parsed.auth?.provider ?? "anthropic",
-            tokenEnv: parsed.auth?.tokenEnv,
-        },
+        auth: normalizeAuth(parsed.auth),
         review: parsed.review,
     };
     return { config, raw: rawObject };
 }
+/**
+ * Normalize either accepted `auth` shape (legacy single object, or the
+ * per-provider `{ providers }` map) into the canonical entry list. Absent auth
+ * means the schema default (api-key/openai, no tokenEnv).
+ */
+export function normalizeAuth(auth) {
+    if (!auth) {
+        return [{ provider: "openai", mode: "api-key" }];
+    }
+    if ("providers" in auth) {
+        return Object.entries(auth.providers).map(([provider, entry]) => ({
+            provider,
+            mode: entry.mode,
+            tokenEnv: entry.tokenEnv,
+            upstream: entry.upstream,
+        }));
+    }
+    return [{ provider: auth.provider, mode: auth.mode, tokenEnv: auth.tokenEnv }];
+}
+/**
+ * Runtime auth lock: null when the entries' tokenEnv names equal the expected
+ * comma-separated set exactly (order-insensitive), else a human-readable
+ * mismatch. Set semantics because a multi-provider auth block names several
+ * credential envs — a PR must not be able to add, drop, or repoint any of them.
+ */
+export function tokenEnvMismatch(auth, expected) {
+    const declared = [
+        ...new Set(auth.map((entry) => entry.tokenEnv).filter((v) => Boolean(v))),
+    ].sort();
+    const expectedSet = [
+        ...new Set(expected
+            .split(",")
+            .map((name) => name.trim())
+            .filter(Boolean)),
+    ].sort();
+    if (JSON.stringify(declared) === JSON.stringify(expectedSet)) {
+        return null;
+    }
+    return `configured tokenEnv set [${declared.join(", ") || "(none)"}] != ECR_EXPECTED_TOKEN_ENV [${expectedSet.join(", ")}]`;
+}
 /**
  * auth is honored ONLY here: the manifest's `defaults.auth` wins when present,
  * otherwise the root config.jsonc auth. A scope config can never contribute auth
@@ -130,7 +173,7 @@ async function loadConfigDir(dir, schema) {
 export function loadAuthFromRoot(rootConfig, manifest) {
     const override = manifest?.defaults.auth;
     if (override) {
-        return { mode: override.mode, provider: override.provider, tokenEnv: override.tokenEnv };
+        return normalizeAuth(override);
     }
     return rootConfig.auth;
 }

package/build/config/schema.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 export const ReviewConfigSchema = z.object({
     /** Default model for every agent + the coordinator. Override per-agent via
      * frontmatter in the agent's markdown, or globally via REVIEWER_MODEL. */
-    model: z.string().default("anthropic/claude-sonnet-5"),
+    model: z.string().default("openai/gpt-5.5"),
     policy: z
         .object({
         includeSuggestions: z.boolean().default(false),
@@ -52,17 +52,45 @@ export const ReviewConfigSchema = z.object({
         .object({ marker: z.string().default("/skip-review") })
         .default({ marker: "/skip-review" }),
     commentTag: z.string().default("expo-ai-code-reviewer"),
+    // Two accepted shapes (see AuthConfigEntry for the canonical internal form):
+    //  - legacy single credential: { mode, provider, tokenEnv }
+    //  - per-provider map:         { providers: { <id>: { mode, tokenEnv, upstream? } } }
+    // The map form allows a MIXED setup — e.g. the "openai" provider on a ChatGPT/Codex
+    // subscription (mode "oauth", tokenEnv = the refresh token) plus an "openai-api"
+    // alias (upstream "openai") holding a metered API key for pro-tier models the
+    // subscription doesn't offer.
+    //
+    // Union order matters: the map form must be tried FIRST — the legacy object's keys
+    // all have defaults, so a non-strict legacy parse would accept (and gut) a
+    // { providers } object by stripping the unknown key.
     auth: z
-        .object({
-        // "api-key": the token env is sent as the provider's API key (x-api-key).
-        // "oauth": the token env is a Claude Pro/Max style OAuth token, injected
-        // into an isolated OpenCode auth.json so it's sent as a Bearer token.
-        mode: z.enum(["api-key", "oauth"]).default("api-key"),
-        provider: z.string().default("anthropic"),
-        /** Env var holding the key/token. */
-        tokenEnv: z.string().optional(),
-    })
-        .default({ mode: "api-key", provider: "anthropic" }),
+        .union([
+        z.object({
+            providers: z.record(z.string(), z.object({
+                // "api-key": tokenEnv holds the provider's API key.
+                // "oauth": tokenEnv holds an OAuth token, injected into an isolated
+                // OpenCode auth.json. For "openai" this is the REFRESH token from a
+                // ChatGPT/Codex sign-in (OpenCode's codex plugin mints access tokens
+                // from it). NOTE: anthropic oauth cannot work — OpenCode has no
+                // anthropic OAuth plugin and Anthropic prohibits subscription tokens
+                // in third-party tools.
+                mode: z.enum(["api-key", "oauth"]).default("api-key"),
+                tokenEnv: z.string().optional(),
+                // Set ⇒ this provider id is an ALIAS synthesized into the OpenCode
+                // config, backed by the named upstream's SDK ("openai", "anthropic",
+                // anything else = openai-compatible). Lets one upstream be reached
+                // with two credentials at once (subscription + API key).
+                upstream: z.string().optional(),
+            })),
+        }),
+        z.object({
+            mode: z.enum(["api-key", "oauth"]).default("api-key"),
+            provider: z.string().default("openai"),
+            /** Env var holding the key/token. */
+            tokenEnv: z.string().optional(),
+        }),
+    ])
+        .default({ mode: "api-key", provider: "openai" }),
     review: z
         .object({
         // Which PRs `ecr ci` acts on — the source of truth for trigger policy (a
@@ -104,21 +132,23 @@ export const RoutingManifestSchema = z
     budget: z
         .object({
         /** Total passes budget (minutes) split across active scopes. Sized to fit
-         * the scaffolded workflow's `timeout-minutes` (60) with margin for the
-         * coordinator, verification, and git/gh overhead. */
-        totalPassesMinutes: z.number().int().positive().default(32),
+         * the scaffolded workflow's `timeout-minutes` (90) with margin for the
+         * coordinator (10m), verification, and git/gh overhead. The cross-file pass
+         * expands to fill whatever of this window is left (see review.ts), so this
+         * is the knob that decides how long it may trace. */
+        totalPassesMinutes: z.number().int().positive().default(55),
         /** Per-scope floor (minutes): below this a scope review isn't worth
          * starting, so the even split clamps up to it — even when that makes the
          * scopes overshoot the total (ecr ci warns; doctor flags the worst case). */
         minScopeMinutes: z.number().int().positive().default(5),
     })
-        .default({ totalPassesMinutes: 32, minScopeMinutes: 5 }),
+        .default({ totalPassesMinutes: 55, minScopeMinutes: 5 }),
     defaults: z
         .object({
         /** The ONLY manifest-level place auth is honored (locks the root value).
          * Unwrap the inner `.default()` first: in zod v4 a `.default().optional()`
          * chain still fires the default when the key is absent, which would make
-         * `defaults.auth` a phantom `{mode:'api-key',provider:'anthropic'}` for every
+         * `defaults.auth` a phantom `{mode:'api-key',provider:'openai'}` for every
          * manifest that omits auth and silently override the root config's real auth. */
         auth: ReviewConfigSchema.shape.auth.unwrap().optional(),
         /** Agent ids injected into every scope with alwaysRun, from the ROOT roster. */

package/build/core/auth.js

@@ -33,24 +33,93 @@ const FORBIDDEN_TOKEN_ENVS = new Set([
 ]);
 const YEAR_MS = 365 * 24 * 60 * 60 * 1000;
 /**
- * Decide whether the configured model provider has a usable credential, WITHOUT
- * mutating the environment. Shared by `prepareAuth` (fail fast before spinning up
- * the server and every pass) and `doctor` (report), so the two never drift.
+ * Documented Anthropic OAuth token shape: `sk-ant-oat01-` + 95 chars = 108 total
+ * (what `claude setup-token` prints). Treated as a STRONG HINT, not a spec: it comes
+ * from observed tokens and third-party sources, not an Anthropic format guarantee, so
+ * an unrecognized shape only warns. The one exception is below — a value that becomes
+ * exactly this shape by restoring a dropped `sk-` is provably a mangled paste.
+ */
+const ANTHROPIC_OAUTH_PREFIX = "sk-ant-oat";
+/** Anthropic API keys — valid credentials, but for auth.mode "api-key", not "oauth". */
+const ANTHROPIC_API_KEY_PREFIX = "sk-ant-api";
+/** Shorter than any credential of any provider ⇒ truncated, whatever the format. */
+const MIN_TOKEN_LENGTH = 40;
+/**
+ * Catch an OAuth token that CANNOT work before it costs a whole run.
+ *
+ * Motivation: OpenCode refuses a malformed credential by dropping the provider from
+ * its provider list entirely, so every configured model then reports "model not
+ * found" and nothing anywhere mentions credentials. That misdirection cost a full
+ * debugging session for a value that had simply lost its leading `sk-`.
  *
- * We only report `ok: false` when we're confident there is no credential — a
- * missing OAuth token, a forbidden tokenEnv, or an api-key run with neither the
- * configured tokenEnv nor the provider's own key env set. When nothing is
- * configured and no known key env is present, we assume OpenCode's own login may
- * cover it and don't hard-fail. `REVIEWER_MODEL` bypasses provider auth entirely.
+ * The bar for `ok: false` is "this cannot be a valid credential", not "this looks
+ * odd", because a false rejection blocks a working setup — a worse failure than the
+ * one being prevented. Provable: whitespace, absurdly short, an API key in oauth
+ * mode, and an OAuth token missing its `sk-`. Everything else is at most a warning,
+ * and formats of providers we don't know are never judged at all.
  */
-export function checkProviderAuth(config, env = process.env) {
-    const { mode, provider, tokenEnv } = config.auth;
-    if (env.REVIEWER_MODEL) {
+export function checkOauthTokenShape(provider, token, tokenEnv) {
+    const ok = { ok: true, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+    const fix = `Re-generate it with \`claude setup-token\` and set ${tokenEnv} to the full value.`;
+    if (token !== token.trim()) {
         return {
-            ok: true,
-            detail: `REVIEWER_MODEL override (${env.REVIEWER_MODEL}); using OpenCode's own login for that model`,
+            ok: false,
+            detail: `${tokenEnv} has leading/trailing whitespace (a newline from a copy-paste or a ` +
+                `\`cat\`-ed file is the usual cause); the provider will refuse it. ${fix}`,
+        };
+    }
+    if (token.length < MIN_TOKEN_LENGTH) {
+        return {
+            ok: false,
+            detail: `${tokenEnv} holds only ${token.length} characters, too short to be a real ${provider} token — it looks truncated. ${fix}`,
+        };
+    }
+    // Only anthropic's formats are known well enough to say anything about.
+    if (provider !== "anthropic") {
+        return ok;
+    }
+    if (token.startsWith(ANTHROPIC_API_KEY_PREFIX)) {
+        return {
+            ok: false,
+            detail: `${tokenEnv} holds an Anthropic API key ("${ANTHROPIC_API_KEY_PREFIX}…"), but auth.mode is ` +
+                `"oauth", which expects the OAuth token from \`claude setup-token\` ` +
+                `("${ANTHROPIC_OAUTH_PREFIX}…"). Either set auth.mode to "api-key" in ` +
+                `.expo-code-review/config.jsonc, or put an OAuth token in ${tokenEnv}.`,
         };
     }
+    // Provable mangled paste: prepending the dropped "sk-" yields exactly the documented
+    // OAuth shape. Only this reconstruction earns a hard failure — the value is not a
+    // credential of any known kind as it stands, but is one character-for-character with
+    // its prefix restored.
+    if (!token.startsWith("sk-") && `sk-${token}`.startsWith(ANTHROPIC_OAUTH_PREFIX)) {
+        return {
+            ok: false,
+            detail: `${tokenEnv} starts with "${token.slice(0, 10)}…", which is an Anthropic OAuth token ` +
+                `missing its leading "sk-" — the prefix was dropped when the value was copied ` +
+                `(adding it back gives "${ANTHROPIC_OAUTH_PREFIX}…", the shape \`claude setup-token\` ` +
+                `prints). OpenCode refuses a malformed credential by dropping the provider entirely, ` +
+                `which then surfaces as "model not found" for every model. ${fix}`,
+        };
+    }
+    if (!token.startsWith(ANTHROPIC_OAUTH_PREFIX)) {
+        // Unrecognized, but we can't prove it's wrong: Anthropic can mint shapes we don't
+        // know, so advise and continue rather than refusing to run.
+        return {
+            ...ok,
+            warning: `${tokenEnv} does not start with "${ANTHROPIC_OAUTH_PREFIX}…" (the shape ` +
+                `\`claude setup-token\` prints for auth.mode "oauth"). It may still be valid — but if ` +
+                `the run fails with "model not found" for every model, the credential was refused, ` +
+                `and this is the first thing to check.`,
+        };
+    }
+    return ok;
+}
+/**
+ * Decide whether ONE configured credential is usable, WITHOUT mutating the
+ * environment. See checkProviderAuth for the all-entries wrapper.
+ */
+export function checkAuthEntry(entry, env = process.env) {
+    const { mode, provider, tokenEnv, upstream } = entry;
     if (tokenEnv && FORBIDDEN_TOKEN_ENVS.has(tokenEnv)) {
         return {
             ok: false,
@@ -59,11 +128,28 @@ export function checkProviderAuth(config, env = process.env) {
                 `token minted for the provider instead.`,
         };
     }
+    // A well-known provider key env may only feed THAT provider. The tokenEnv guard
+    // locks which env names are forwarded, but not where they go — without this, a
+    // PR-supplied auth entry could keep the locked name (e.g. OPENAI_API_KEY) and
+    // point its provider/upstream somewhere else, sending one provider's key to a
+    // different provider.
+    if (tokenEnv) {
+        const keyOwner = Object.entries(PROVIDER_KEY_ENV).find(([, env]) => env === tokenEnv)?.[0];
+        if (keyOwner && keyOwner !== provider && keyOwner !== upstream) {
+            return {
+                ok: false,
+                detail: `auth for ${provider} names tokenEnv "${tokenEnv}", which is ${keyOwner}'s ` +
+                    `well-known key env — refusing to send one provider's credential to another. ` +
+                    `Use a credential minted for ${provider}${upstream ? ` (upstream ${upstream})` : ""}, ` +
+                    `or fix the provider/upstream mapping.`,
+            };
+        }
+    }
     if (mode === "oauth") {
         if (!tokenEnv) {
             return {
                 ok: false,
-                detail: 'auth.mode "oauth" requires auth.tokenEnv to name the env var holding the OAuth token.',
+                detail: `auth mode "oauth" for ${provider} requires tokenEnv to name the env var holding the OAuth token.`,
             };
         }
         if (!env[tokenEnv]) {
@@ -72,7 +158,32 @@ export function checkProviderAuth(config, env = process.env) {
                 detail: `auth is oauth for ${provider} but token env "${tokenEnv}" is not set.`,
             };
         }
-        return { ok: true, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+        const shape = checkOauthTokenShape(provider, env[tokenEnv], tokenEnv);
+        if (!shape.ok) {
+            return shape;
+        }
+        return { ...shape, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+    }
+    // api-key with an upstream alias: the synthesized provider reads the key
+    // straight from {env:tokenEnv}, so both must exist — there is no ambient
+    // fallback for a provider id we invented.
+    if (upstream) {
+        if (!tokenEnv) {
+            return {
+                ok: false,
+                detail: `auth for ${provider} (upstream ${upstream}) requires tokenEnv — the synthesized provider reads the key from that env var.`,
+            };
+        }
+        if (!env[tokenEnv]) {
+            return {
+                ok: false,
+                detail: `auth for ${provider} (upstream ${upstream}) names token env "${tokenEnv}" but it is not set.`,
+            };
+        }
+        return {
+            ok: true,
+            detail: `api-key for ${provider} (upstream ${upstream}); token env ${tokenEnv} is set`,
+        };
     }
     // api-key: usable if the configured tokenEnv is set, or the provider's own key
     // env is already present in the environment.
@@ -97,27 +208,79 @@ export function checkProviderAuth(config, env = process.env) {
     };
 }
 /**
- * Prepare model credentials for the OpenCode server based on the repo's auth mode.
- * Must run before the server starts (it mutates env). Returns a cleanup handle.
+ * Decide whether EVERY configured provider credential is usable, WITHOUT
+ * mutating the environment. Shared by `prepareAuth` (fail fast before spinning up
+ * the server and every pass) and `doctor` (report), so the two never drift.
+ *
+ * All entries must pass — a mixed setup with one broken credential would fail
+ * exactly the passes routed to it, which is the silent-degradation this check
+ * exists to prevent. `REVIEWER_MODEL` bypasses provider auth entirely.
+ */
+export function checkProviderAuth(config, env = process.env) {
+    if (env.REVIEWER_MODEL) {
+        return {
+            ok: true,
+            detail: `REVIEWER_MODEL override (${env.REVIEWER_MODEL}); using OpenCode's own login for that model`,
+        };
+    }
+    const details = [];
+    const warnings = [];
+    for (const entry of config.auth) {
+        const readiness = checkAuthEntry(entry, env);
+        if (!readiness.ok) {
+            return readiness;
+        }
+        details.push(readiness.detail);
+        if (readiness.warning) {
+            warnings.push(readiness.warning);
+        }
+    }
+    return {
+        ok: true,
+        detail: details.join("; "),
+        ...(warnings.length > 0 ? { warning: warnings.join("; ") } : {}),
+    };
+}
+/**
+ * The auth.json entry for one oauth credential. Provider-shaped:
+ * - openai: the durable secret is the REFRESH token (a ChatGPT/Codex sign-in's
+ *   access tokens live ~1h, shorter than a worst-case run), so store it with
+ *   `expires: 0` and let OpenCode's codex plugin mint access tokens on demand.
+ * - everything else: the token IS the access credential (e.g. long-lived
+ *   setup-token style bearers), far-future expiry so OpenCode never tries to
+ *   refresh a credential that has no refresh half.
+ */
+export function oauthAuthJsonEntry(provider, token) {
+    if (provider === "openai") {
+        return { type: "oauth", access: "", refresh: token, expires: 0 };
+    }
+    return { type: "oauth", access: token, refresh: "", expires: Date.now() + YEAR_MS };
+}
+/**
+ * Prepare model credentials for the OpenCode server from the repo's auth entries
+ * (any mix of modes/providers). Must run before the server starts (it mutates
+ * env). Returns a cleanup handle.
  *
- * - `api-key`: copy the configured token env into the provider's API-key env var
- *   (so the workflow can pass a namespaced secret and OpenCode still finds it).
- * - `oauth`: write an isolated OpenCode `auth.json` with the token as a Bearer
- *   OAuth credential and point OpenCode at it via XDG_DATA_HOME, so it uses its
- *   native Claude Pro/Max path (correct bearer + oauth headers) rather than
- *   x-api-key. Isolated so it never touches the developer's real auth.json.
+ * - `api-key` (standard provider): copy the configured token env into the
+ *   provider's API-key env var (so the workflow can pass a namespaced secret and
+ *   OpenCode still finds it).
+ * - `api-key` (upstream alias): nothing to do here — buildOpencodeConfig
+ *   synthesizes a provider block whose options read `{env:tokenEnv}` directly.
+ * - `oauth`: write ALL oauth credentials into one isolated OpenCode `auth.json`
+ *   and point OpenCode at it via XDG_DATA_HOME (see oauthAuthJsonEntry for the
+ *   per-provider shapes). Isolated so it never touches the developer's real
+ *   auth.json.
  */
 export async function prepareAuth(config) {
     const noop = { cleanup: async () => { } };
-    const { mode, provider, tokenEnv } = config.auth;
     // REVIEWER_MODEL is an explicit "use this model with my own creds" override — a
-    // common local case (e.g. the repo config targets Claude OAuth in CI, but a dev
-    // runs against their own OpenAI login). Don't inject the configured provider's
+    // common local case (e.g. the repo config targets a CI credential, but a dev
+    // runs against their own OpenCode login). Don't inject the configured providers'
     // auth; let OpenCode use whatever it's logged into for the override model.
     if (process.env.REVIEWER_MODEL) {
         return noop;
     }
-    // Fail fast, before starting the server and every pass, if the configured
+    // Fail fast, before starting the server and every pass, if ANY configured
     // provider has no usable credential — otherwise it surfaces as N failed passes
     // mid-run. This is the same readiness check `doctor` reports, and it also covers
     // the forbidden-secret guard (refusing to forward a well-known unrelated secret).
@@ -125,36 +288,32 @@ export async function prepareAuth(config) {
     if (!readiness.ok) {
         throw new Error(readiness.detail);
     }
-    if (mode === "api-key") {
-        if (tokenEnv) {
-            const value = process.env[tokenEnv];
-            const target = PROVIDER_KEY_ENV[provider] ?? "ANTHROPIC_API_KEY";
-            // The explicitly-configured tokenEnv is authoritative — set it even if the
-            // provider env is already present, so config wins over ambient env.
-            if (value) {
+    const authJson = {};
+    for (const entry of config.auth) {
+        const { mode, provider, tokenEnv, upstream } = entry;
+        const value = tokenEnv ? process.env[tokenEnv] : undefined;
+        if (mode === "api-key") {
+            // Upstream aliases read {env:tokenEnv} from the synthesized provider block.
+            if (!upstream && tokenEnv && value) {
+                const target = PROVIDER_KEY_ENV[provider] ?? "ANTHROPIC_API_KEY";
+                // The explicitly-configured tokenEnv is authoritative — set it even if the
+                // provider env is already present, so config wins over ambient env.
                 process.env[target] = value;
             }
+            continue;
         }
-        return noop;
+        // oauth — checkProviderAuth guarantees tokenEnv is set and present; read
+        // defensively so TypeScript narrows and this stays correct if called directly.
+        if (!value) {
+            throw new Error(`auth mode "oauth" for ${provider} requires tokenEnv to name a set OAuth token env.`);
+        }
+        authJson[provider] = oauthAuthJsonEntry(provider, value);
     }
-    // oauth — checkProviderAuth guarantees tokenEnv is set and present; read
-    // defensively so TypeScript narrows and this stays correct if called directly.
-    const token = tokenEnv ? process.env[tokenEnv] : undefined;
-    if (!token) {
-        throw new Error('auth.mode "oauth" requires auth.tokenEnv to name a set OAuth token env.');
+    if (Object.keys(authJson).length === 0) {
+        return noop;
     }
     const dir = await mkdtemp(path.join(tmpdir(), "ecr-auth-"));
     await mkdir(path.join(dir, "opencode"), { recursive: true });
-    const authJson = {
-        [provider]: {
-            type: "oauth",
-            access: token,
-            refresh: "",
-            // Far-future expiry so OpenCode uses the token as-is and does not try to
-            // refresh it (setup-token tokens are long-lived and carry no refresh).
-            expires: Date.now() + YEAR_MS,
-        },
-    };
     await writeFile(path.join(dir, "opencode", "auth.json"), JSON.stringify(authJson), "utf8");
     process.env.XDG_DATA_HOME = dir;
     return {

package/build/core/coordinator.js

@@ -12,7 +12,7 @@ const COORDINATOR_TIMEOUT_MS = 10 * 60 * 1000;
 export async function coordinate(handle, config, metadata, agentFindings, coverageNotes = []) {
     const system = buildCoordinatorSystem(config);
     const text = buildCoordinatorTask(metadata, agentFindings, coverageNotes);
-    const { value, cost, tokens, truncated } = await promptAndParse(handle, {
+    const { value, cost, tokens, truncated, model } = await promptAndParse(handle, {
         agent: "coordinator",
         system,
         text,
@@ -20,5 +20,5 @@ export async function coordinate(handle, config, metadata, agentFindings, covera
         maxWaitMs: COORDINATOR_TIMEOUT_MS,
         finalizeOnTimeout: true,
     }, parseCoordinatorOutput);
-    return { output: value, cost, tokens, truncated };
+    return { output: value, cost, tokens, truncated, model };
 }