@openchambery/web 2.0.0-beta.26 → 2.0.0-beta.28

package/server/lib/opencode/lifecycle.js

@@ -29,8 +29,6 @@ const OPENCODE_CHILD_SIGTERM_GRACE_MS = 2500;
 const OPENCODE_CHILD_SIGKILL_WAIT_MS = 1000;
 // Last-used directory plus recently opened projects — deeper tails are unlikely
 // to be the user's first click and just add background work.
-const WARMUP_DIRECTORY_LIMIT = 4;
-const WARMUP_REQUEST_TIMEOUT_MS = 30000;
 
 export const createOpenCodeLifecycleRuntime = (deps) => {
   const {
@@ -57,7 +55,6 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
     getManagedOpenCodeShellEnvSnapshot,
     managedCapabilitiesRuntime = null,
     getActiveSessionCount = () => 0,
-    getWarmupDirectories = async () => [],
     // Official background service (shared-service.js). null keeps the private
     // managed `opencode serve` path.
     sharedService = null,
@@ -796,6 +793,7 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
         ...shellEnv,
         ...process.env,
         PATH: envPath,
+        OPENCODE_PASSWORD: openCodePassword,
         OPENCODE_SERVER_PASSWORD: openCodePassword,
       };
       const managedEnv = managedCapabilitiesRuntime
@@ -1253,11 +1251,6 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
       await waitForOpenCodePort();
       try {
         await waitForOpenCodeReady();
-        // Warm only after readiness admits; a failed gate must not kick off
-        // directory-scoped traffic against an unready upstream.
-        if (state.isOpenCodeReady) {
-          void warmOpenCodeDirectories();
-        }
       } catch (error) {
         console.error(`OpenCode readiness check failed: ${error.message}`);
       }
@@ -1268,47 +1261,6 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
     }
   };
 
-  // OpenCode initializes each project directory lazily on its first
-  // directory-scoped request, and that initialization takes seconds on large
-  // session stores. Without warming, the user's first session open pays it
-  // interactively. Warm the most recently used directories right after
-  // readiness so the work overlaps UI startup instead. Sequential and
-  // best-effort: a failed or slow directory never blocks the others for long,
-  // and a restart invalidates the pass via the port/readiness guard.
-  const warmOpenCodeDirectories = async () => {
-    let directories = [];
-    try {
-      directories = await getWarmupDirectories();
-    } catch {
-      return;
-    }
-    if (!Array.isArray(directories) || directories.length === 0) return;
-
-    const warmedPort = state.openCodePort;
-    for (const directory of directories.slice(0, WARMUP_DIRECTORY_LIMIT)) {
-      if (typeof directory !== 'string' || !directory) continue;
-      if (!state.isOpenCodeReady || state.openCodePort !== warmedPort) return;
-      let timeout = null;
-      try {
-        const controller = new AbortController();
-        timeout = setTimeout(() => controller.abort(), WARMUP_REQUEST_TIMEOUT_MS);
-        // Warming a directory is the point, not the answer: any directory-scoped
-        // read makes OpenCode initialise it. `/api/session` is the cheapest one
-        // that takes a directory.
-        const url = `${buildOpenCodeUrl('/api/session', '')}?directory=${encodeURIComponent(directory)}&limit=1`;
-        await fetch(url, {
-          method: 'GET',
-          headers: { Accept: 'application/json', ...getOpenCodeAuthHeaders() },
-          signal: controller.signal,
-        });
-      } catch {
-        // Best-effort — the directory stays lazy and the UI's own request warms it.
-      } finally {
-        if (timeout) clearTimeout(timeout);
-      }
-    }
-  };
-
   const bootstrapOpenCodeAtStartup = () => {
     if (!bootstrapOpenCodePromise) {
       bootstrapOpenCodePromise = runBootstrapOpenCodeAtStartup().finally(() => {

package/server/lib/opencode/lifecycle.test.js

@@ -10,6 +10,8 @@ vi.mock('node:child_process', () => ({
 
 const { createOpenCodeLifecycleRuntime } = await import('./lifecycle.js');
 const { createOpenCodeNetworkRuntime } = await import('./network-runtime.js');
+const { resolveOpenCodeEnvConfig } = await import('./env-config.js');
+const { RUNTIME_CONTRACT_MIN_VERIFIED } = await import('./runtime-contract.js');
 
 const originalOpencodeBinary = process.env.OPENCODE_BINARY;
 const originalPath = process.env.PATH;
@@ -106,6 +108,7 @@ const createRuntime = (overrides = {}, stateRef = null) => {
     getManagedOpenCodeShellEnvSnapshot: vi.fn(() => ({
       PATH: '/home/user/.bun/bin:/usr/local/bin:/usr/bin',
       SHELL_ONLY: 'yes',
+      OPENCODE_PASSWORD: 'shell-v2-password',
       OPENCODE_SERVER_PASSWORD: 'shell-password',
     })),
     ...overrides,
@@ -160,6 +163,28 @@ const startListeningChild = () => {
 };
 
 describe('OpenCode lifecycle', () => {
+  it.each(['http://example.test:80', 'https://example.test:443', 'http://[::1]:80'])('attaches explicit default-port host %s without spawning', async (host) => {
+    const config = resolveOpenCodeEnvConfig({ env: { OPENCODE_HOST: host, OPENCODE_PORT: '9999' } });
+    const stateRef = {};
+    const runtime = createRuntime({
+      env: {
+        ENV_CONFIGURED_OPENCODE_PORT: config.configuredOpenCodePort,
+        ENV_CONFIGURED_OPENCODE_HOST: config.configuredOpenCodeHost,
+        ENV_EFFECTIVE_PORT: config.effectivePort,
+        ENV_CONFIGURED_OPENCODE_HOSTNAME: '127.0.0.1',
+        ENV_SKIP_OPENCODE_START: true,
+      },
+      buildOpenCodeUrl: (route) => new URL(route, config.configuredOpenCodeHost.origin).href,
+    }, stateRef);
+    const fetchMock = stubOpenCodeFetch({ health: { ...DEFAULT_V2_HEALTH, version: '2.0.23' } });
+    await runtime.bootstrapOpenCodeAtStartup();
+    await runtime.waitForOpenCodeReady(1000, 1);
+    expect(stateRef.current.isExternalOpenCode).toBe(true);
+    expect(stateRef.current.openCodePort).toBe(config.effectivePort);
+    expect(fetchMock.mock.calls.some(([url]) => String(url) === `${config.configuredOpenCodeHost.origin}/api/info`)).toBe(true);
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
   it('launches managed OpenCode with the managed PATH', async () => {
     delete process.env.OPENCODE_BINARY;
     const child = createMockChild();
@@ -179,6 +204,7 @@ describe('OpenCode lifecycle', () => {
     expect(options.env.PATH).toBe('/home/user/.bun/bin:/usr/local/bin:/usr/bin');
     expect(options.env.SHELL_ONLY).toBe('yes');
     expect(options.env.OPENCODE_SERVER_PASSWORD).toBe('password');
+    expect(options.env.OPENCODE_PASSWORD).toBe('password');
 
     await server.close();
   });
@@ -847,7 +873,7 @@ describe('OpenCode lifecycle', () => {
     stateRef.current.runtimeContract = {
       executionAllowed: true,
       phase: 'ready',
-      serveVersion: '2.0.12',
+      serveVersion: RUNTIME_CONTRACT_MIN_VERIFIED,
       instanceGeneration: 1,
     };
 
@@ -861,7 +887,7 @@ describe('OpenCode lifecycle', () => {
     runtime.refreshRuntimeContractFromProbe(
       {
         ok: true,
-        version: '2.0.12',
+        version: RUNTIME_CONTRACT_MIN_VERIFIED,
         authenticated: true,
         healthOk: true,
       },
@@ -875,7 +901,7 @@ describe('OpenCode lifecycle', () => {
     runtime.refreshRuntimeContractFromProbe(
       {
         ok: true,
-        version: '2.0.12',
+        version: RUNTIME_CONTRACT_MIN_VERIFIED,
         authenticated: true,
         healthOk: true,
       },
@@ -884,7 +910,7 @@ describe('OpenCode lifecycle', () => {
     );
     expect(stateRef.current.runtimeContract.executionAllowed).toBe(true);
     expect(stateRef.current.runtimeContract.instanceGeneration).toBe(2);
-    expect(stateRef.current.runtimeContract.serveVersion).toBe('2.0.12');
+    expect(stateRef.current.runtimeContract.serveVersion).toBe(RUNTIME_CONTRACT_MIN_VERIFIED);
   });
 
   it('does not mark external skip-start ready before version and migration admit', async () => {

package/server/lib/opencode/location-release.d.ts

@@ -0,0 +1,8 @@
+import type { OpenCodeClient } from '@opencode/client';
+
+export type LocationReleaseResult = { state: 'released' | 'timeout' | 'failed' | 'unavailable' };
+export function releaseDeletedWorktreeLocation(input: {
+  getClient: () => OpenCodeClient | null;
+  directory: string;
+  timeoutMs?: number;
+}): Promise<LocationReleaseResult>;

package/server/lib/opencode/location-release.js

@@ -0,0 +1,32 @@
+/**
+ * Explicit worktree deletion only. An eviction acknowledgement detaches cached
+ * services; it does not prove that borrowers have released every OS handle.
+ * Never use this operation for automatic navigation cleanup on a shared serve.
+ *
+ * @param {{ getClient: () => import('@opencode/client').OpenCodeClient | null, directory: string, timeoutMs?: number }} input
+ * @returns {Promise<{ state: 'released' | 'timeout' | 'failed' | 'unavailable' }>}
+ */
+export async function releaseDeletedWorktreeLocation({ getClient, directory, timeoutMs = 2000 }) {
+  const controller = new AbortController();
+  let timer;
+  try {
+    if (!directory || !directory.trim()) return { state: 'unavailable' };
+    const client = getClient();
+    if (!client) return { state: 'unavailable' };
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve({ state: 'timeout' });
+      }, timeoutMs);
+    });
+    const request = Promise.resolve().then(() => client.debug.location.evict(
+      { location: { directory } },
+      { signal: controller.signal },
+    )).then(() => ({ state: 'released' }), () => ({ state: controller.signal.aborted ? 'timeout' : 'failed' }));
+    return await Promise.race([request, deadline]);
+  } catch {
+    return { state: 'failed' };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/server/lib/opencode/location-release.test.js

@@ -0,0 +1,43 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { OpenCode } from '@opencode/client';
+import { releaseDeletedWorktreeLocation } from './location-release.js';
+
+afterEach(() => vi.useRealTimers());
+
+describe('explicit worktree location release', () => {
+  it('uses the official SDK exact target, current origin and auth', async () => {
+    const requests = [];
+    let origin = 'https://old.invalid';
+    const getClient = () => OpenCode.make({ baseUrl: origin, headers: { Authorization: 'test-auth' }, fetch: async (input, init) => {
+      requests.push(new Request(input, init));
+      return new Response(null, { status: 204 });
+    } });
+    origin = 'https://current.invalid';
+    expect(await releaseDeletedWorktreeLocation({ getClient, directory: '/repo/work tree' })).toEqual({ state: 'released' });
+    expect(requests).toHaveLength(1);
+    const url = new URL(requests[0].url);
+    expect(url.origin + url.pathname).toBe('https://current.invalid/api/debug/location');
+    expect(url.searchParams.get('location[directory]')).toBe('/repo/work tree');
+    expect(requests[0].method).toBe('DELETE');
+    expect(requests[0].headers.get('Authorization')).toBe('test-auth');
+  });
+
+  it('reports failure without claiming successful disposal', async () => {
+    const getClient = () => ({ debug: { location: { evict: async () => { throw new Error('unavailable'); } } } });
+    expect(await releaseDeletedWorktreeLocation({ getClient, directory: '/repo' })).toEqual({ state: 'failed' });
+    expect(await releaseDeletedWorktreeLocation({ getClient: () => null, directory: '/repo' })).toEqual({ state: 'unavailable' });
+  });
+
+  it('bounds even a transport that ignores abort and never settles', async () => {
+    vi.useFakeTimers();
+    let signal;
+    const getClient = () => ({ debug: { location: { evict: (_input, options) => {
+      signal = options.signal;
+      return new Promise(() => {});
+    } } } });
+    const result = releaseDeletedWorktreeLocation({ getClient, directory: '/repo', timeoutMs: 50 });
+    await vi.advanceTimersByTimeAsync(50);
+    expect(await result).toEqual({ state: 'timeout' });
+    expect(signal.aborted).toBe(true);
+  });
+});

package/server/lib/opencode/mcp.js

@@ -29,7 +29,7 @@ function validateMcpName(name) {
  */
 function resolveMcpScopeFromPath(layers, sourcePath) {
   if (!sourcePath) return null;
-  return sourcePath === layers.paths.projectPath ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
+  return layers.projectLayers.some((layer) => layer.path === sourcePath) ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
 }
 
 function ensureProjectMcpConfigPath(workingDirectory) {

package/server/lib/opencode/opencode2-pin.js

@@ -1,5 +1,6 @@
 // Pinned desktop/runtime opencode2. Upgrade and prepare must not fall back to 1.18.x.
-export const PINNED_OPENCODE2_VERSION = '2.0.12';
+export const PINNED_OPENCODE2_VERSION = '2.0.23';
+export const MINIMUM_OPENCODE2_VERSION = '2.0.20';
 
 // Global npm/bun package that installs the opencode v2 binary (not 1.x opencode-ai).
 export const OPENCODE2_NPM_PACKAGE = '@opencode/cli';

package/server/lib/opencode/owned-runtime-upgrade.test.js

@@ -86,15 +86,15 @@ describe('owned runtime upgrade (ticket 12)', () => {
 
   it('verifies running serve identity before upgrade success', () => {
     const contractOk = evaluateRuntimeContract({
-      serveVersion: '2.0.14',
+      serveVersion: '2.0.23',
       reachable: true,
       authenticated: true,
       healthOk: true,
       migrationAdmitTranscript: true,
     });
     expect(evaluateOwnedUpgradeResult({
-      targetVersion: '2.0.14',
-      serveVersion: '2.0.14',
+      targetVersion: '2.0.23',
+      serveVersion: '2.0.23',
       binaryPath: ownedBinary,
       expectedBinaryPath: ownedBinary,
       contract: contractOk,
@@ -116,8 +116,8 @@ describe('owned runtime upgrade (ticket 12)', () => {
     });
 
     expect(evaluateOwnedUpgradeResult({
-      targetVersion: '2.0.14',
-      serveVersion: '2.0.14',
+      targetVersion: '2.0.23',
+      serveVersion: '2.0.23',
       binaryPath: '/usr/bin/opencode',
       expectedBinaryPath: ownedBinary,
       contract: contractOk,

package/server/lib/opencode/plugins.js

@@ -4,6 +4,8 @@ import path from 'path';
 import {
   AGENT_SCOPE,
   readConfigFile,
+  readConfigLayers,
+  getConfigForPath,
   writeConfig,
 } from './shared.js';
 import { isPathSpec } from './plugin-spec.js';
@@ -74,54 +76,8 @@ function getActiveOpencodeConfigDir() {
   return path.join(os.homedir(), '.config', 'opencode');
 }
 
-function getActiveUserConfigPaths() {
-  const configDir = getActiveOpencodeConfigDir();
-  return [
-    path.join(configDir, 'config.json'),
-    path.join(configDir, 'opencode.json'),
-    path.join(configDir, 'opencode.jsonc'),
-  ];
-}
-
-function getActiveCustomConfigPath() {
-  return process.env.OPENCODE_CONFIG ? path.resolve(process.env.OPENCODE_CONFIG) : null;
-}
-
-function getPrimaryUserConfigPath() {
-  const [defaultPath, ...fallbackPaths] = getActiveUserConfigPaths();
-  for (const userPath of [defaultPath, ...fallbackPaths]) {
-    if (fs.existsSync(userPath)) {
-      return userPath;
-    }
-  }
-  return defaultPath;
-}
-
-function getProjectConfigPath(workingDirectory) {
-  if (!workingDirectory) return null;
-  const candidates = [
-    path.join(workingDirectory, 'opencode.json'),
-    path.join(workingDirectory, 'opencode.jsonc'),
-    path.join(workingDirectory, '.opencode', 'opencode.json'),
-    path.join(workingDirectory, '.opencode', 'opencode.jsonc'),
-  ];
-  return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];
-}
-
 function readPluginConfigLayers(workingDirectory) {
-  const customPath = getActiveCustomConfigPath();
-  const userPath = getPrimaryUserConfigPath();
-  const projectPath = getProjectConfigPath(workingDirectory);
-  return {
-    userConfig: readConfigFile(userPath),
-    projectConfig: readConfigFile(projectPath),
-    customConfig: readConfigFile(customPath),
-    paths: {
-      userPath,
-      projectPath,
-      customPath,
-    },
-  };
+  return readConfigLayers(workingDirectory);
 }
 
 function validateFileName(fileName) {
@@ -144,16 +100,10 @@ function ensureProjectConfigPath(workingDirectory) {
 }
 
 function configSources(layers) {
-  const sources = [];
-  if (layers.paths.customPath) {
-    sources.push({ config: layers.customConfig, filePath: layers.paths.customPath, scope: AGENT_SCOPE.USER });
-  } else {
-    sources.push({ config: layers.userConfig, filePath: layers.paths.userPath, scope: AGENT_SCOPE.USER });
-  }
-  if (layers.paths.projectPath) {
-    sources.push({ config: layers.projectConfig, filePath: layers.paths.projectPath, scope: AGENT_SCOPE.PROJECT });
-  }
-  return sources;
+  return [...layers.documents.filter((layer) => layer.scope !== 'project').reverse(), ...layers.projectLayers.toReversed()].map((layer) => ({
+    config: layer.config, filePath: layer.path,
+    scope: layer.scope === 'project' ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER,
+  }));
 }
 
 function splitScopedValue(value) {
@@ -175,7 +125,9 @@ function getPluginTarget(id, workingDirectory) {
   const { scope, value: spec } = splitScopedValue(decoded.value);
   validateScope(scope);
   const layers = readPluginConfigLayers(workingDirectory);
-  const source = configSources(layers).find((candidate) => candidate.scope === scope);
+  const source = configSources(layers).find((candidate) => candidate.scope === scope
+    && Array.isArray(candidate.config?.plugin)
+    && candidate.config.plugin.some((raw) => parsePluginRaw(raw).spec === spec));
   const plugin = Array.isArray(source?.config?.plugin) ? source.config.plugin : [];
   const index = plugin.findIndex((raw) => parsePluginRaw(raw).spec === spec);
   if (!source || index === -1) {
@@ -281,14 +233,14 @@ function createPluginEntry(entry, workingDirectory) {
     throw codedError(`Plugin "${spec}" already exists`, 'ENTRY_EXISTS');
   }
 
-  let targetPath = getPrimaryUserConfigPath();
+  let targetPath = layers.paths.userPath;
   let config = {};
   if (scope === AGENT_SCOPE.PROJECT) {
     targetPath = ensureProjectConfigPath(workingDirectory);
     config = fs.existsSync(targetPath) ? readConfigFile(targetPath) : {};
   } else {
     targetPath = layers.paths.customPath || layers.paths.userPath;
-    config = layers.paths.customPath ? layers.customConfig : layers.userConfig;
+    config = getConfigForPath(layers, targetPath);
   }
 
   if (!Array.isArray(config.plugin)) {

package/server/lib/opencode/providers.js

@@ -30,8 +30,8 @@ function getProviderSources(providerId, workingDirectory) {
   return {
     sources: {
       auth: { exists: false },
-      user: { exists: userExists, path: paths.userPath },
-      project: { exists: projectExists, path: paths.projectPath || null },
+      user: { exists: userExists, path: layers.userLayers.findLast((layer) => layer.config?.provider?.[providerId] !== undefined || layer.config?.providers?.[providerId] !== undefined)?.path || paths.userPath },
+      project: { exists: projectExists, path: layers.projectLayers.findLast((layer) => layer.config?.provider?.[providerId] !== undefined || layer.config?.providers?.[providerId] !== undefined)?.path || paths.projectPath || null },
       custom: { exists: customExists, path: paths.customPath }
     }
   };
@@ -44,17 +44,20 @@ function removeProviderConfig(providerId, workingDirectory, scope = 'user') {
 
   const layers = readConfigLayers(workingDirectory);
   let targetPath = layers.paths.userPath;
+  const sources = getProviderSources(providerId, workingDirectory).sources;
 
   if (scope === 'project') {
     if (!workingDirectory) {
       throw new Error('Working directory is required for project scope');
     }
-    targetPath = layers.paths.projectPath || targetPath;
+    targetPath = sources.project.path || targetPath;
   } else if (scope === 'custom') {
     if (!layers.paths.customPath) {
       return false;
     }
     targetPath = layers.paths.customPath;
+  } else {
+    targetPath = sources.user.path;
   }
 
   const targetConfig = getConfigForPath(layers, targetPath);

package/server/lib/opencode/proxy.js

@@ -1,4 +1,5 @@
 import { createProxyMiddleware } from 'http-proxy-middleware';
+import { isSensitiveCredentialResponse } from './credential-boundary.js';
 
 import {
   applyForwardProxyResponseHeaders,
@@ -244,6 +245,12 @@ export const resolveSessionTurnAdmissionRequest = (req) => {
 };
 
 export const registerOpenCodeProxy = (app, deps) => {
+  app.use((req, res, next) => {
+    if (isSensitiveCredentialResponse(req.method, req.originalUrl || req.url)) {
+      return res.status(403).json({ code: 'credential_response_refused', error: 'Provider credential values are host-only.' });
+    }
+    return next();
+  });
   const {
     fs,
     os,

package/server/lib/opencode/proxy.test.js

@@ -57,6 +57,19 @@ const mountProxy = () => {
   return app;
 };
 
+describe('credential response boundary', () => {
+  it.each(['/api/credential', '/api/credential/', '/api/%63redential?directory=/repo'])('refuses raw credential list %s before upstream', async (path) => {
+    const fetchSpy = vi.fn();
+    globalThis.fetch = fetchSpy;
+    const response = await request(mountProxy()).get(path).expect(403);
+    expect(response.body.code).toBe('credential_response_refused');
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+  it('refuses credential create replies which echo values', async () => {
+    await request(mountProxy()).post('/api/credential').send({}).expect(403);
+  });
+});
+
 const sseBody = (blocks) => {
   const encoder = new TextEncoder();
   const text = blocks.join('');

package/server/lib/opencode/routes.js

@@ -709,7 +709,7 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
 
       const sources = getProviderSources(providerId, directory);
       const { getProviderAuth } = await getAuthLibrary();
-      const auth = getProviderAuth(providerId);
+      const auth = await getProviderAuth(providerId);
       sources.sources.auth.exists = Boolean(auth);
 
       return res.json({
@@ -753,12 +753,12 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
       let removed = false;
       if (scope === 'auth') {
         const { removeProviderAuth } = await getAuthLibrary();
-        removed = removeProviderAuth(providerId);
+        removed = await removeProviderAuth(providerId);
       } else if (scope === 'user' || scope === 'project' || scope === 'custom') {
         removed = removeProviderConfig(providerId, directory, scope);
       } else if (scope === 'all') {
         const { removeProviderAuth } = await getAuthLibrary();
-        const authRemoved = removeProviderAuth(providerId);
+        const authRemoved = await removeProviderAuth(providerId);
         const userRemoved = removeProviderConfig(providerId, directory, 'user');
         const projectRemoved = directory ? removeProviderConfig(providerId, directory, 'project') : false;
         const customRemoved = removeProviderConfig(providerId, directory, 'custom');
@@ -767,14 +767,14 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
         return res.status(400).json({ error: 'Invalid scope' });
       }
 
-      if (removed) {
+      if (removed && scope !== 'auth') {
         await refreshOpenCodeAfterConfigChange(`provider ${providerId} disconnected (${scope})`);
       }
 
       return res.json({
         success: true,
         removed,
-        requiresReload: removed,
+        requiresReload: removed && scope !== 'auth',
         message: removed ? 'Provider disconnected successfully' : 'Provider was not connected',
         reloadDelayMs: removed ? clientReloadDelayMs : undefined,
       });

package/server/lib/opencode/routes.test.js

@@ -233,39 +233,39 @@ describe('opencode2 upgrade pin (ticket 12)', () => {
   });
 
   it('upgrades a shared service using the owned cache and verifies the running version', async () => {
-    const binary = '/cache/opencode-cli/2.0.14/opencode';
+    const binary = '/cache/opencode-cli/2.0.23/opencode';
     vi.mocked(installPinnedOpenCode2Cli).mockResolvedValueOnce(binary);
-    vi.mocked(readOpenCode2BinaryVersion).mockReturnValueOnce('2.0.14');
-    vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ version: '2.0.14', pid: 42 }))));
+    vi.mocked(readOpenCode2BinaryVersion).mockReturnValueOnce('2.0.23');
+    vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ version: '2.0.23', pid: 42 }))));
     let resolvedBinary = '/usr/local/bin/opencode';
     const restartOpenCode = vi.fn(async () => {});
     const { app } = createUpgradeApp({
       getIsExternalOpenCode: () => true,
       getIsSharedOpenCodeService: () => true,
       getResolvedOpenCodeBinary: () => resolvedBinary,
-      getOpenCodeCliVersion: () => '2.0.14',
+      getOpenCodeCliVersion: () => '2.0.23',
       forceResolvedOpenCodeBinary: (value) => { resolvedBinary = value; },
       restartOpenCode,
       waitForOpenCodeReady: vi.fn(),
       openchamberDataDir: '/cache',
     });
 
-    const response = await request(app).post('/api/opencode/upgrade').send({ target: '2.0.14' }).expect(200);
+    const response = await request(app).post('/api/opencode/upgrade').send({ target: '2.0.23' }).expect(200);
     expect(restartOpenCode).toHaveBeenCalledWith({ binaryPath: binary });
-    expect(response.body).toMatchObject({ success: true, version: '2.0.14', ownership: 'shared-service' });
+    expect(response.body).toMatchObject({ success: true, version: '2.0.23', ownership: 'shared-service' });
   });
 
-  it('discovers the remote release and updates a shared 2.0.16 service to 2.0.18', async () => {
+  it('discovers the remote release and updates a shared 2.0.16 service to 2.0.23', async () => {
     let serveVersion = '2.0.16';
     let binary = '/usr/local/bin/opencode';
-    const installed = '/cache/opencode-cli/2.0.18/opencode';
+    const installed = '/cache/opencode-cli/2.0.23/opencode';
     const fetchMock = vi.fn(async (url) => new Response(JSON.stringify({
-      version: String(url).includes('registry.npmjs.org') ? '2.0.18' : serveVersion,
+      version: String(url).includes('registry.npmjs.org') ? '2.0.23' : serveVersion,
     })));
     vi.stubGlobal('fetch', fetchMock);
-    vi.mocked(readOpenCode2BinaryVersion).mockReturnValue('2.0.18');
+    vi.mocked(readOpenCode2BinaryVersion).mockReturnValue('2.0.23');
     vi.mocked(installPinnedOpenCode2Cli).mockResolvedValueOnce(installed);
-    const restartOpenCode = vi.fn(async () => { serveVersion = '2.0.18'; });
+    const restartOpenCode = vi.fn(async () => { serveVersion = '2.0.23'; });
     const { app } = createUpgradeApp({
       discoverOpenCodeUpdate: createOpenCodeUpdateDiscovery(),
       getIsExternalOpenCode: () => true,
@@ -277,12 +277,12 @@ describe('opencode2 upgrade pin (ticket 12)', () => {
       openchamberDataDir: '/cache',
     });
     const before = await request(app).get('/api/opencode/upgrade-status').expect(200);
-    expect(before.body).toMatchObject({ available: true, serveVersion: '2.0.16', targetVersion: '2.0.18', canManage: true });
+    expect(before.body).toMatchObject({ available: true, serveVersion: '2.0.16', targetVersion: '2.0.23', canManage: true });
     const result = await request(app).post('/api/opencode/upgrade').send({}).expect(200);
-    expect(result.body).toMatchObject({ success: true, restarted: true, version: '2.0.18' });
+    expect(result.body).toMatchObject({ success: true, restarted: true, version: '2.0.23' });
     expect(restartOpenCode).toHaveBeenCalledWith({ binaryPath: installed });
     const after = await request(app).get('/api/opencode/upgrade-status').expect(200);
-    expect(after.body).toMatchObject({ available: false, serveVersion: '2.0.18' });
+    expect(after.body).toMatchObject({ available: false, serveVersion: '2.0.23' });
     expect(fetchMock.mock.calls.filter(([url]) => String(url).includes('registry.npmjs.org'))).toHaveLength(1);
     vi.mocked(readOpenCode2BinaryVersion).mockReset();
   });
@@ -385,7 +385,7 @@ describe('runtime contract routes (ticket 11)', () => {
       ok: true,
       status: 200,
       statusText: 'OK',
-      json: async () => ({ version: '2.0.12', pid: 1 }),
+      json: async () => ({ version: '2.0.20', pid: 1 }),
     })));
     const { app } = createContractApp();
 
@@ -395,7 +395,7 @@ describe('runtime contract routes (ticket 11)', () => {
     expect(health.body.executionAllowed).toBe(true);
 
     const contract = await request(app).get('/api/opencode/contract').expect(200);
-    expect(contract.body.serveVersion).toBe('2.0.12');
+    expect(contract.body.serveVersion).toBe('2.0.20');
     expect(contract.body.capabilities['core.protocol'].available).toBe(true);
   });
 
@@ -439,7 +439,7 @@ describe('GET /api/opencode/health', () => {
         status: 200,
         statusText: 'OK',
         json: async () => ({
-          version: '2.0.12',
+          version: '2.0.20',
           pid: 4242,
           urls: { api: 'http://127.0.0.1:4096' },
           paths: { config: '/tmp/config', data: '/tmp/data' },
@@ -453,7 +453,7 @@ describe('GET /api/opencode/health', () => {
 
     expect(response.body).toMatchObject({
       healthy: true,
-      version: '2.0.12',
+      version: '2.0.20',
       executionAllowed: true,
       protocolCompatible: true,
     });