@openchambery/web 2.0.0-beta.25 → 2.0.0-beta.28

package/server/lib/opencode/agents.js

@@ -197,23 +197,12 @@ function getAgentPermissionSource(agentName, workingDirectory, lookupCache = nul
     }
   }
 
-  // Check JSON layers in effective override order. readConfigLayers merges
-  // user -> project -> custom, so custom wins over project, project over user.
+  // Check physical documents in effective override order, including both global files.
   const layers = readConfigLayers(workingDirectory);
-
-  const customJsonPermission = layers.customConfig?.agent?.[agentName]?.permission;
-  if (customJsonPermission !== undefined && layers.paths.customPath) {
-    return { source: 'json', scope: 'custom', path: layers.paths.customPath };
-  }
-
-  const projectJsonPermission = layers.projectConfig?.agent?.[agentName]?.permission;
-  if (projectJsonPermission !== undefined && layers.paths.projectPath) {
-    return { source: 'json', scope: AGENT_SCOPE.PROJECT, path: layers.paths.projectPath };
-  }
-
-  const userJsonPermission = layers.userConfig?.agent?.[agentName]?.permission;
-  if (userJsonPermission !== undefined) {
-    return { source: 'json', scope: AGENT_SCOPE.USER, path: layers.paths.userPath };
+  for (const layer of layers.documents.toReversed()) {
+    if (layer.config?.agent?.[agentName]?.permission !== undefined) {
+      return { source: 'json', scope: layer.scope, path: layer.path };
+    }
   }
 
   return { source: null, scope: null, path: null };
@@ -300,7 +289,7 @@ function getAgentSources(agentName, workingDirectory, lookupCache = createAgentL
   const jsonSource = getJsonEntrySource(layers, 'agent', agentName);
   const jsonSection = jsonSource.section;
   const jsonPath = jsonSource.path || layers.paths.customPath || layers.paths.projectPath || layers.paths.userPath;
-  const jsonScope = jsonSource.path === layers.paths.projectPath ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
+  const jsonScope = layers.projectLayers.some((layer) => layer.path === jsonSource.path) ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
 
   const sources = {
     md: {
@@ -444,7 +433,7 @@ function getAgentConfig(agentName, workingDirectory, lookupCache = createAgentLo
   const jsonSource = getJsonEntrySource(layers, 'agent', agentName);
 
   if (jsonSource.exists && jsonSource.section) {
-    const scope = jsonSource.path === layers.paths.projectPath ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
+    const scope = layers.projectLayers.some((layer) => layer.path === jsonSource.path) ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
     return {
       source: 'json',
       scope,
@@ -756,8 +745,9 @@ function deleteAgent(agentName, workingDirectory, scope) {
   const layers = readConfigLayers(workingDirectory);
 
   if (requestedScope === AGENT_SCOPE.PROJECT) {
-    if (layers.paths.projectPath && deleteJsonAgentEntry(layers.projectConfig, agentName)) {
-      writeConfig(layers.projectConfig, layers.paths.projectPath);
+    const target = layers.projectLayers.toReversed().find((layer) => layer.config?.agent?.[agentName] !== undefined);
+    if (target && deleteJsonAgentEntry(target.config, agentName)) {
+      writeConfig(target.config, target.path);
       console.log(`Removed project-level agent from opencode.json: ${agentName}`);
       return;
     }
@@ -765,8 +755,9 @@ function deleteAgent(agentName, workingDirectory, scope) {
   }
 
   if (requestedScope === AGENT_SCOPE.USER) {
-    const userJsonPath = layers.paths.customPath || layers.paths.userPath;
-    const userJsonConfig = layers.paths.customPath ? layers.customConfig : layers.userConfig;
+    const target = layers.documents.toReversed().find((layer) => layer.scope !== 'project' && layer.config?.agent?.[agentName] !== undefined);
+    const userJsonPath = target?.path;
+    const userJsonConfig = target?.config;
     if (userJsonPath && deleteJsonAgentEntry(userJsonConfig, agentName)) {
       writeConfig(userJsonConfig, userJsonPath);
       console.log(`Removed user-level agent from opencode.json: ${agentName}`);

package/server/lib/opencode/auth-state-runtime.js

@@ -31,7 +31,7 @@ export const createOpenCodeAuthStateRuntime = (dependencies) => {
     const normalized = normalizeOpenCodePassword(password);
     if (!isValidOpenCodePassword(normalized)) {
       setAuthPassword(null);
-      setAuthSource(null);
+      setAuthSource(source || null);
       delete process.env.OPENCODE_SERVER_PASSWORD;
       syncToHmrState();
       return null;
@@ -45,13 +45,13 @@ export const createOpenCodeAuthStateRuntime = (dependencies) => {
   };
 
   const getOpenCodeAuthHeaders = () => {
-    const password = normalizeOpenCodePassword(getAuthPassword() || process.env.OPENCODE_SERVER_PASSWORD || '');
+    const password = normalizeOpenCodePassword(getAuthPassword() || '');
 
     if (!password) {
       return {};
     }
 
-    const username = process.env.OPENCODE_SERVER_USERNAME?.trim() || 'opencode';
+    const username = getAuthSource() === 'shared-service' ? 'opencode' : process.env.OPENCODE_SERVER_USERNAME?.trim() || 'opencode';
     const credentials = Buffer.from(`${username}:${password}`).toString('base64');
     return { Authorization: `Basic ${credentials}` };
   };

package/server/lib/opencode/auth-state-runtime.test.js

@@ -0,0 +1,59 @@
+import crypto from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { createOpenCodeAuthStateRuntime } from './auth-state-runtime.js';
+import { createHmrStateRuntime } from './hmr-state-runtime.js';
+
+const setup = (env = {}) => {
+  const processLike = { env: { ...env } };
+  const hmr = createHmrStateRuntime({ globalThisLike: {}, os: { homedir: () => '/example' }, processLike, stateKey: 'test' });
+  const state = hmr.getOrCreateHmrState();
+  hmr.ensureUserProvidedOpenCodePassword(state);
+  const restore = () => hmr.restoreRuntimeFromState({ hmrState: state, userProvidedOpenCodePassword: hmr.getUserProvidedOpenCodePassword(state) });
+  const runtimeState = restore();
+  const auth = createOpenCodeAuthStateRuntime({ crypto, process: processLike,
+    getAuthPassword: () => runtimeState.openCodeAuthPassword,
+    setAuthPassword: (value) => { runtimeState.openCodeAuthPassword = value; },
+    getAuthSource: () => runtimeState.openCodeAuthSource,
+    setAuthSource: (value) => { runtimeState.openCodeAuthSource = value; },
+    getUserProvidedPassword: () => hmr.getUserProvidedOpenCodePassword(state),
+    syncToHmrState: () => hmr.syncStateFromRuntime(state, runtimeState),
+  });
+  return { auth, restore, runtimeState, processLike, hmr, state };
+};
+
+describe('OpenCode auth ownership', () => {
+  it('uses v2 before legacy credentials and preserves the captured choice through HMR/restart', async () => {
+    const test = setup({ OPENCODE_PASSWORD: 'v2-fixture', OPENCODE_SERVER_PASSWORD: 'legacy-fixture' });
+    const password = await test.auth.ensureLocalOpenCodeServerPassword({ rotateManaged: true });
+    expect(password === 'v2-fixture').toBe(true);
+    expect(test.auth.getOpenCodeAuthHeaders().Authorization === `Basic ${Buffer.from(`opencode:${password}`).toString('base64')}`).toBe(true);
+    test.processLike.env.OPENCODE_PASSWORD = 'later-shell-fixture';
+    test.hmr.ensureUserProvidedOpenCodePassword(test.state);
+    expect((await test.auth.ensureLocalOpenCodeServerPassword({ rotateManaged: true })) === password).toBe(true);
+    expect(test.restore().openCodeAuthPassword === password).toBe(true);
+  });
+
+  it('rotates generated credentials while old credentials fail a controlled auth check', async () => {
+    const { auth, restore } = setup();
+    const old = await auth.ensureLocalOpenCodeServerPassword();
+    const previousHeader = auth.getOpenCodeAuthHeaders().Authorization;
+    const password = await auth.ensureLocalOpenCodeServerPassword({ rotateManaged: true });
+    const accepts = (header) => header === `Basic ${Buffer.from(`opencode:${password}`).toString('base64')}`;
+    expect(password !== old).toBe(true);
+    expect(accepts(previousHeader)).toBe(false);
+    expect(accepts(auth.getOpenCodeAuthHeaders().Authorization)).toBe(true);
+    expect(restore().openCodeAuthPassword === password).toBe(true);
+  });
+
+  it('adopts only shared registration credentials and never falls back to private env after clearing', () => {
+    const { auth, processLike, restore } = setup({ OPENCODE_PASSWORD: 'private-fixture', OPENCODE_SERVER_USERNAME: 'private-user' });
+    auth.adoptOpenCodeServerPassword('registration-fixture', 'shared-service');
+    expect(auth.getOpenCodeAuthHeaders().Authorization === `Basic ${Buffer.from('opencode:registration-fixture').toString('base64')}`).toBe(true);
+    auth.adoptOpenCodeServerPassword(null, 'shared-service');
+    expect(restore().openCodeAuthPassword).toBeNull();
+    expect(restore().openCodeAuthSource).toBe('shared-service');
+    auth.adoptOpenCodeServerPassword(null, null);
+    processLike.env.OPENCODE_SERVER_PASSWORD = 'stale-fixture';
+    expect(auth.getOpenCodeAuthHeaders()).toEqual({});
+  });
+});

package/server/lib/opencode/auth.d.ts

@@ -0,0 +1,13 @@
+import type { OpenCodeClient } from '@opencode/client';
+
+export type ProviderCredential =
+  | { type: 'api'; key: string }
+  | { type: 'oauth'; access: string; refresh: string; expires: number; accountId?: string; enterpriseUrl?: string };
+export function configureOpenCodeCredentials(resolveClient: (() => OpenCodeClient) | null): void;
+export function openCodeCredentialSource(deps: {
+  buildOpenCodeUrl: (path: string, prefix?: string) => string;
+  getOpenCodeAuthHeaders: () => Record<string, string>;
+}): () => OpenCodeClient;
+export function readOpenCodeCredentials(): Promise<Record<string, ProviderCredential>>;
+export function getProviderAuth(providerId: string): Promise<ProviderCredential | null>;
+export function removeProviderAuth(providerId: string): Promise<boolean>;

package/server/lib/opencode/auth.js

@@ -1,81 +1,91 @@
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
+import { makeOpenCodeV2Client } from './v2-client.js';
 
-const OPENCODE_DATA_DIR = path.join(os.homedir(), '.local', 'share', 'opencode');
-const AUTH_FILE = path.join(OPENCODE_DATA_DIR, 'auth.json');
+/** @typedef {{ type: 'api', key: string } | { type: 'oauth', access: string, refresh: string, expires: number, accountId?: string, enterpriseUrl?: string }} ProviderCredential */
+/** @type {null | (() => import('@opencode/client').OpenCodeClient)} */
+let getClient = null;
 
-function readAuthFile() {
-  if (!fs.existsSync(AUTH_FILE)) {
-    return {};
-  }
-  try {
-    const content = fs.readFileSync(AUTH_FILE, 'utf8');
-    const trimmed = content.trim();
-    if (!trimmed) {
-      return {};
-    }
-    return JSON.parse(trimmed);
-  } catch (error) {
-    console.error('Failed to read auth file:', error);
-    throw new Error('Failed to read OpenCode auth configuration');
-  }
+/** Configure only in the trusted host. Resolve endpoint and authentication on every call. */
+export function configureOpenCodeCredentials(resolveClient) {
+  getClient = resolveClient;
 }
 
-function writeAuthFile(auth) {
-  try {
-    if (!fs.existsSync(OPENCODE_DATA_DIR)) {
-      fs.mkdirSync(OPENCODE_DATA_DIR, { recursive: true });
-    }
+export function openCodeCredentialSource({ buildOpenCodeUrl, getOpenCodeAuthHeaders }) {
+  return () => makeOpenCodeV2Client({
+    baseUrl: buildOpenCodeUrl('', '').replace(/\/+$/, ''),
+    authHeaders: getOpenCodeAuthHeaders(),
+  });
+}
 
-    if (fs.existsSync(AUTH_FILE)) {
-      const backupFile = `${AUTH_FILE}.openchamber.backup`;
-      fs.copyFileSync(AUTH_FILE, backupFile);
-      console.log(`Created auth backup: ${backupFile}`);
-    }
+const credentialError = () => new Error('Unable to read OpenCode credentials');
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
 
-    fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), 'utf8');
-    console.log('Successfully wrote auth file');
-  } catch (error) {
-    console.error('Failed to write auth file:', error);
-    throw new Error('Failed to write OpenCode auth configuration');
+/** Validate before projection: malformed/unsupported responses are never empty success. */
+function validateCredentialEntries(entries) {
+  if (!Array.isArray(entries)) throw credentialError();
+  const active = new Set();
+  for (const entry of entries) {
+    if (!record(entry) || typeof entry.id !== 'string' || !entry.id || typeof entry.integrationID !== 'string'
+      || !entry.integrationID || typeof entry.active !== 'boolean' || !record(entry.value)) throw credentialError();
+    const value = entry.value;
+    if (value.type === 'key') {
+      if (typeof value.key !== 'string') throw credentialError();
+    } else if (value.type === 'oauth') {
+      if (typeof value.access !== 'string' || typeof value.refresh !== 'string' || !Number.isFinite(value.expires)) throw credentialError();
+    } else throw credentialError();
+    if (entry.active) {
+      if (active.has(entry.integrationID)) throw credentialError();
+      active.add(entry.integrationID);
+    }
   }
+  return entries;
 }
 
-function removeProviderAuth(providerId) {
-  if (!providerId || typeof providerId !== 'string') {
-    throw new Error('Provider ID is required');
-  }
-
-  const auth = readAuthFile();
-  
-  if (!auth[providerId]) {
-    console.log(`Provider ${providerId} not found in auth file, nothing to remove`);
-    return false;
+async function listCredentials(client) {
+  try {
+    return validateCredentialEntries(await client.credential.list({ signal: AbortSignal.timeout(8000) }));
+  } catch {
+    // Upstream errors can contain response bodies or request headers with secrets.
+    throw credentialError();
   }
+}
 
-  delete auth[providerId];
-  writeAuthFile(auth);
-  console.log(`Removed provider auth: ${providerId}`);
-  return true;
+function currentClient() {
+  if (!getClient) throw credentialError();
+  try { return getClient(); } catch { throw credentialError(); }
 }
 
-function getProviderAuth(providerId) {
-  const auth = readAuthFile();
-  return auth[providerId] || null;
+/** Host-only selected provider credentials. Never serialize this result to a client. */
+export async function readOpenCodeCredentials() {
+  const entries = await listCredentials(currentClient());
+  /** @type {Record<string, ProviderCredential>} */
+  const result = Object.create(null);
+  for (const entry of entries) {
+    if (!entry.active) continue;
+    const value = entry.value;
+    result[entry.integrationID] = value.type === 'key' ? { type: 'api', key: value.key } : {
+      type: 'oauth', access: value.access, refresh: value.refresh, expires: value.expires,
+      ...(typeof value.metadata?.accountID === 'string' ? { accountId: value.metadata.accountID } : {}),
+      ...(typeof value.metadata?.enterpriseUrl === 'string' ? { enterpriseUrl: value.metadata.enterpriseUrl } : {}),
+    };
+  }
+  return result;
 }
 
-function listProviderAuths() {
-  const auth = readAuthFile();
-  return Object.keys(auth);
+export async function getProviderAuth(providerId) {
+  return (await readOpenCodeCredentials())[providerId] || null;
 }
 
-export {
-  readAuthFile,
-  writeAuthFile,
-  removeProviderAuth,
-  getProviderAuth,
-  listProviderAuths,
-  AUTH_FILE,
-  OPENCODE_DATA_DIR
-};
+/** Disconnect every saved account for the provider, so deleting active cannot select another. */
+export async function removeProviderAuth(providerId) {
+  if (typeof providerId !== 'string' || !providerId.trim()) throw new Error('Provider ID is required');
+  const client = currentClient();
+  const entries = (await listCredentials(client)).filter((entry) => entry.integrationID === providerId);
+  for (const entry of entries) {
+    try {
+      await client.credential.remove({ credentialID: entry.id }, { signal: AbortSignal.timeout(8000) });
+    } catch {
+      throw new Error('Unable to remove OpenCode credentials; some accounts may already have been removed. Retry to finish disconnecting.');
+    }
+  }
+  return entries.length > 0;
+}

package/server/lib/opencode/auth.test.js

@@ -0,0 +1,57 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { configureOpenCodeCredentials, getProviderAuth, readOpenCodeCredentials, removeProviderAuth, openCodeCredentialSource } from './auth.js';
+
+const key = (id, active, value = id) => ({ id, integrationID: 'openai', label: id, active, value: { type: 'key', key: value } });
+afterEach(() => { configureOpenCodeCredentials(null); vi.unstubAllGlobals(); });
+
+describe('authoritative host credential API', () => {
+  it('observes active account switching and logout without cached or legacy fallback', async () => {
+    let entries = [key('old', true), key('new', false)];
+    configureOpenCodeCredentials(() => ({ credential: { list: async () => entries } }));
+    await expect(getProviderAuth('openai')).resolves.toEqual({ type: 'api', key: 'old' });
+    entries = [key('old', false), key('new', true)];
+    await expect(getProviderAuth('openai')).resolves.toEqual({ type: 'api', key: 'new' });
+    entries = [];
+    await expect(getProviderAuth('openai')).resolves.toBeNull();
+  });
+  it('maps OAuth metadata without copying arbitrary secret-bearing fields', async () => {
+    configureOpenCodeCredentials(() => ({ credential: { list: async () => [{ ...key('a', true), value: { type: 'oauth', access: 'access', refresh: 'refresh', expires: 123, metadata: { accountID: 'account', enterpriseUrl: 'https://example.com', unrelated: 'private' } } }] } }));
+    await expect(readOpenCodeCredentials()).resolves.toEqual({ openai: { type: 'oauth', access: 'access', refresh: 'refresh', expires: 123, accountId: 'account', enterpriseUrl: 'https://example.com' } });
+  });
+  it.each([null, {}, { data: [] }, [{ ...key('a', true), value: { type: 'unknown' } }], [key('a', true), key('b', true)]])('rejects unsupported payloads without inventing empty success', async (entries) => {
+    configureOpenCodeCredentials(() => ({ credential: { list: async () => entries } }));
+    await expect(readOpenCodeCredentials()).rejects.toThrow('Unable to read OpenCode credentials');
+  });
+  it('redacts transport/auth failures and leaves them retryable', async () => {
+    const list = vi.fn().mockRejectedValueOnce(new Error('Authorization: private-token')).mockResolvedValueOnce([]);
+    configureOpenCodeCredentials(() => ({ credential: { list } }));
+    await expect(readOpenCodeCredentials()).rejects.toThrow(/^Unable to read OpenCode credentials$/);
+    await expect(readOpenCodeCredentials()).resolves.toEqual({});
+  });
+  it('removes all provider accounts, preserves other integrations and supports retry after partial failure', async () => {
+    let entries = [key('old', false), key('new', true), { ...key('other', true), integrationID: 'anthropic' }];
+    const remove = vi.fn(async ({ credentialID }) => { entries = entries.filter((e) => e.id !== credentialID); });
+    configureOpenCodeCredentials(() => ({ credential: { list: async () => entries, remove } }));
+    remove.mockImplementationOnce(async ({ credentialID }) => { entries = entries.filter((e) => e.id !== credentialID); });
+    remove.mockRejectedValueOnce(new Error('private-token'));
+    await expect(removeProviderAuth('openai')).rejects.toThrow('some accounts may already have been removed');
+    await expect(removeProviderAuth('openai')).resolves.toBe(true);
+    expect(entries.map((e) => e.id)).toEqual(['other']);
+    await expect(removeProviderAuth('openai')).resolves.toBe(false);
+  });
+  it('uses the current endpoint/auth through the real SDK for every read', async () => {
+    let origin = 'http://first.invalid';
+    let authorization = 'Basic first';
+    const requests = [];
+    vi.stubGlobal('fetch', vi.fn(async (input, init) => {
+      const req = new Request(input, init);
+      requests.push([req.url, req.headers.get('authorization')]);
+      return Response.json({ data: [key('current', true)] });
+    }));
+    configureOpenCodeCredentials(openCodeCredentialSource({ buildOpenCodeUrl: () => origin, getOpenCodeAuthHeaders: () => ({ Authorization: authorization }) }));
+    await readOpenCodeCredentials();
+    origin = 'http://second.invalid'; authorization = 'Basic second';
+    await readOpenCodeCredentials();
+    expect(requests).toEqual([['http://first.invalid/api/credential', 'Basic first'], ['http://second.invalid/api/credential', 'Basic second']]);
+  });
+});

package/server/lib/opencode/commands.js

@@ -114,7 +114,7 @@ function getCommandSources(commandName, workingDirectory) {
   const jsonSource = getJsonEntrySource(layers, 'command', commandName);
   const jsonSection = jsonSource.section;
   const jsonPath = jsonSource.path || layers.paths.customPath || layers.paths.projectPath || layers.paths.userPath;
-  const jsonScope = jsonSource.path === layers.paths.projectPath ? COMMAND_SCOPE.PROJECT : COMMAND_SCOPE.USER;
+  const jsonScope = layers.projectLayers.some((layer) => layer.path === jsonSource.path) ? COMMAND_SCOPE.PROJECT : COMMAND_SCOPE.USER;
 
   const sources = {
     md: {

package/server/lib/opencode/config-entities-layering.test.js

@@ -0,0 +1,72 @@
+import { beforeEach, afterEach, describe, it, expect, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readConfigFile } from './config-files.js';
+
+let root;
+let directory;
+let mcp;
+let agents;
+let providers;
+let plugins;
+beforeEach(async () => {
+  root = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-entity-layers-'));
+  directory = path.join(root, 'xdg', 'opencode');
+  fs.mkdirSync(directory, { recursive: true });
+  vi.stubEnv('XDG_CONFIG_HOME', path.dirname(directory));
+  vi.stubEnv('OPENCODE_CONFIG', '');
+  vi.stubEnv('OPENCODE_CONFIG_DIR', '');
+  vi.spyOn(os, 'homedir').mockReturnValue(root);
+  vi.resetModules();
+  [mcp, agents, providers, plugins] = await Promise.all([import('./mcp.js'), import('./agents.js'), import('./providers.js'), import('./plugins.js')]);
+});
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllEnvs();
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+describe('Web/Electron entity physical provenance', () => {
+  it('MCP CRUD edits only the source document and preserves comments', () => {
+    const json = path.join(directory, 'opencode.json');
+    const jsonc = path.join(directory, 'opencode.jsonc');
+    fs.writeFileSync(json, '{"mcp":{"lower":{"type":"local","command":["lower"]}}}');
+    fs.writeFileSync(jsonc, '{ // retained\n"mcp":{"higher":{"type":"local","command":["higher"]}}}');
+    expect(mcp.listMcpConfigs().map((entry) => entry.name).sort()).toEqual(['higher', 'lower']);
+    mcp.updateMcpConfig('lower', { enabled: false });
+    expect(readConfigFile(json)).toMatchObject({ mcp: { lower: { enabled: false } } });
+    mcp.createMcpConfig('new', { type: 'local', command: ['new'] });
+    expect(readConfigFile(jsonc).mcp.lower).toBeUndefined();
+    mcp.deleteMcpConfig('higher');
+    expect(readConfigFile(jsonc).mcp.higher).toBeUndefined();
+    expect(fs.readFileSync(jsonc, 'utf8')).toContain('// retained');
+  });
+
+  it('agent and provider metadata point to physical layers, including scoped deletion', () => {
+    const json = path.join(directory, 'opencode.json');
+    const jsonc = path.join(directory, 'opencode.jsonc');
+    fs.writeFileSync(json, '{"agent":{"lower":{"description":"lower"}},"provider":{"lower":{}}}');
+    fs.writeFileSync(jsonc, '{ // retained\n"agent":{"higher":{"description":"higher"}},"provider":{"higher":{}}}');
+    expect(agents.getAgentSources('lower').json.path).toBe(json);
+    expect(agents.getAgentSources('higher').json.path).toBe(jsonc);
+    agents.deleteAgent('lower', undefined, 'user');
+    expect(readConfigFile(json).agent).toBeUndefined();
+    expect(readConfigFile(jsonc).agent.higher).toBeDefined();
+    expect(providers.getProviderSources('lower').sources.user.path).toBe(json);
+    providers.removeProviderConfig('lower');
+    expect(readConfigFile(json).provider).toBeUndefined();
+    expect(readConfigFile(jsonc).provider.higher).toBeDefined();
+  });
+
+  it('plugin edits locate the source containing the requested spec', () => {
+    const json = path.join(directory, 'opencode.json');
+    const jsonc = path.join(directory, 'opencode.jsonc');
+    fs.writeFileSync(json, '{"plugin":["lower-plugin"]}');
+    fs.writeFileSync(jsonc, '{ // retained\n"plugin":["higher-plugin"]}');
+    const entry = plugins.listPluginEntries().find((item) => item.spec === 'lower-plugin');
+    plugins.updatePluginEntry(entry.id, { spec: 'updated-plugin' });
+    expect(readConfigFile(json).plugin).toEqual(['updated-plugin']);
+    expect(readConfigFile(jsonc).plugin).toEqual(['higher-plugin']);
+  });
+});

package/server/lib/opencode/config-entity-routes.js

@@ -1,9 +1,9 @@
 import fs from 'node:fs/promises';
-import os from 'node:os';
 import path from 'node:path';
 import { parse as parseJsonc } from 'jsonc-parser';
 import { OpenCode } from '@opencode/client';
 import { projectProviderCatalog } from './provider-catalog.js';
+import { getGlobalConfigDirectory, writeConfigText } from './config-files.js';
 
 // Compose official v2 provider.list + model.list (+ optional default) into the
 // catalog shape consumed by projectProviderCatalog. Missing arrays are failure.
@@ -60,7 +60,7 @@ const createOpenCodeClient = ({ baseUrl, headers, fetch: fetchImpl }) =>
 
 const MAX_GLOBAL_CONFIG_SIZE = 2 * 1024 * 1024;
 const GLOBAL_CONFIG_FILES = {
-  opencode: ['opencode.json', 'opencode.jsonc'],
+  opencode: ['opencode.jsonc', 'opencode.json'],
   'oh-my-opencode-slim': ['oh-my-opencode-slim.json', 'oh-my-opencode-slim.jsonc'],
   'oh-my-openagent': ['oh-my-openagent.json', 'oh-my-openagent.jsonc'],
 };
@@ -84,6 +84,10 @@ function resolveGlobalConfigPath(target, configDirectory) {
   if (!fileNames) {
     return null;
   }
+  if (target === 'opencode' && process.env.OPENCODE_CONFIG) {
+    const filePath = path.resolve(process.env.OPENCODE_CONFIG);
+    return { target, fileNames: [path.basename(filePath)], fileName: path.basename(filePath), filePath };
+  }
   return {
     target,
     fileNames,
@@ -99,7 +103,7 @@ async function findGlobalConfigPath(target, configDirectory) {
   }
 
   for (const fileName of configPath.fileNames) {
-    const filePath = path.join(configDirectory, fileName);
+    const filePath = path.join(path.dirname(configPath.filePath), fileName);
     try {
       if ((await fs.stat(filePath)).isFile()) {
         return { ...configPath, fileName, filePath };
@@ -153,13 +157,7 @@ export const registerConfigEntityRoutes = (app, dependencies) => {
     createMcpConfig,
     updateMcpConfig,
     deleteMcpConfig,
-    listSnippets,
-    getSnippet,
-    createSnippet,
-    updateSnippet,
-    deleteSnippet,
-    expandSnippets,
-    configDirectory = path.join(os.homedir(), '.config', 'opencode'),
+    configDirectory = getGlobalConfigDirectory(),
   } = dependencies;
 
   app.get('/api/config/catalog/providers', async (req, res) => {
@@ -254,10 +252,7 @@ export const registerConfigEntityRoutes = (app, dependencies) => {
     }
 
     try {
-      await fs.mkdir(configDirectory, { recursive: true });
-      const temporaryPath = `${target.filePath}.${process.pid}.${Date.now()}.tmp`;
-      await fs.writeFile(temporaryPath, content, 'utf8');
-      await fs.rename(temporaryPath, target.filePath);
+      writeConfigText(content, target.filePath);
       return res.json({
         target: req.params.target,
         fileName: target.fileName,
@@ -679,112 +674,4 @@ export const registerConfigEntityRoutes = (app, dependencies) => {
     }
   });
 
-  app.get('/api/config/snippets', async (req, res) => {
-    try {
-      const { directory, error } = await resolveOptionalProjectDirectory(req);
-      if (error) {
-        return res.status(400).json({ error });
-      }
-      res.json(listSnippets(directory));
-    } catch (error) {
-      console.error('[API:GET /api/config/snippets] Failed:', error);
-      res.status(500).json({ error: error.message || 'Failed to list snippets' });
-    }
-  });
-
-  app.post('/api/config/snippets/expand', async (req, res) => {
-    try {
-      const { directory, error } = await resolveOptionalProjectDirectory(req);
-      if (error) {
-        return res.status(400).json({ error });
-      }
-      res.json({ text: expandSnippets(req.body?.text ?? '', directory) });
-    } catch (error) {
-      console.error('[API:POST /api/config/snippets/expand] Failed:', error);
-      res.status(500).json({ error: error.message || 'Failed to expand snippets' });
-    }
-  });
-
-  app.get('/api/config/snippets/:name', async (req, res) => {
-    try {
-      const name = req.params.name;
-      const { directory, error } = await resolveOptionalProjectDirectory(req);
-      if (error) {
-        return res.status(400).json({ error });
-      }
-      const snippet = getSnippet(name, directory);
-      if (!snippet) {
-        return res.status(404).json({ error: `Snippet "${name}" not found` });
-      }
-      res.json(snippet);
-    } catch (error) {
-      console.error('[API:GET /api/config/snippets/:name] Failed:', error);
-      if (error.message?.includes('Snippet name')) {
-        return res.status(400).json({ error: error.message });
-      }
-      res.status(500).json({ error: error.message || 'Failed to get snippet' });
-    }
-  });
-
-  app.post('/api/config/snippets/:name', async (req, res) => {
-    try {
-      const name = req.params.name;
-      const { directory, error } = await resolveOptionalProjectDirectory(req);
-      if (error) {
-        return res.status(400).json({ error });
-      }
-      const snippet = createSnippet(name, req.body || {}, directory, req.body?.scope || 'global');
-      res.json({ success: true, snippet });
-    } catch (error) {
-      console.error('[API:POST /api/config/snippets/:name] Failed:', error);
-      if (error.message?.includes('already exists')) {
-        return res.status(409).json({ error: error.message });
-      }
-      if (error.message?.includes('Snippet name') || error.message?.includes('Project directory')) {
-        return res.status(400).json({ error: error.message });
-      }
-      res.status(500).json({ error: error.message || 'Failed to create snippet' });
-    }
-  });
-
-  app.patch('/api/config/snippets/:name', async (req, res) => {
-    try {
-      const name = req.params.name;
-      const { directory, error } = await resolveOptionalProjectDirectory(req);
-      if (error) {
-        return res.status(400).json({ error });
-      }
-      res.json({ success: true, snippet: updateSnippet(name, req.body || {}, directory) });
-    } catch (error) {
-      console.error('[API:PATCH /api/config/snippets/:name] Failed:', error);
-      if (error.message?.includes('not found')) {
-        return res.status(404).json({ error: error.message });
-      }
-      if (error.message?.includes('Snippet name')) {
-        return res.status(400).json({ error: error.message });
-      }
-      res.status(500).json({ error: error.message || 'Failed to update snippet' });
-    }
-  });
-
-  app.delete('/api/config/snippets/:name', async (req, res) => {
-    try {
-      const name = req.params.name;
-      const { directory, error } = await resolveOptionalProjectDirectory(req);
-      if (error) {
-        return res.status(400).json({ error });
-      }
-      deleteSnippet(name, directory);
-      res.json({ success: true });
-    } catch (error) {
-      console.error('[API:DELETE /api/config/snippets/:name] Failed:', error);
-      if (error.message?.includes('not found')) {
-        return res.status(404).json({ error: error.message });
-      }
-      if (error.message?.includes('Snippet name')) {
-        return res.status(400).json({ error: error.message });
-      }
-      res.status(500).json({ error: error.message || 'Failed to delete snippet' });
-    }
-  });
 };