@openchambery/web 2.0.0-beta.8 → 2.0.0

package/server/lib/opencode/lifecycle.test.js

@@ -10,6 +10,8 @@ vi.mock('node:child_process', () => ({
 
 const { createOpenCodeLifecycleRuntime } = await import('./lifecycle.js');
 const { createOpenCodeNetworkRuntime } = await import('./network-runtime.js');
+const { resolveOpenCodeEnvConfig } = await import('./env-config.js');
+const { RUNTIME_CONTRACT_MIN_VERIFIED } = await import('./runtime-contract.js');
 
 const originalOpencodeBinary = process.env.OPENCODE_BINARY;
 const originalPath = process.env.PATH;
@@ -106,6 +108,7 @@ const createRuntime = (overrides = {}, stateRef = null) => {
     getManagedOpenCodeShellEnvSnapshot: vi.fn(() => ({
       PATH: '/home/user/.bun/bin:/usr/local/bin:/usr/bin',
       SHELL_ONLY: 'yes',
+      OPENCODE_PASSWORD: 'shell-v2-password',
       OPENCODE_SERVER_PASSWORD: 'shell-password',
     })),
     ...overrides,
@@ -160,6 +163,28 @@ const startListeningChild = () => {
 };
 
 describe('OpenCode lifecycle', () => {
+  it.each(['http://example.test:80', 'https://example.test:443', 'http://[::1]:80'])('attaches explicit default-port host %s without spawning', async (host) => {
+    const config = resolveOpenCodeEnvConfig({ env: { OPENCODE_HOST: host, OPENCODE_PORT: '9999' } });
+    const stateRef = {};
+    const runtime = createRuntime({
+      env: {
+        ENV_CONFIGURED_OPENCODE_PORT: config.configuredOpenCodePort,
+        ENV_CONFIGURED_OPENCODE_HOST: config.configuredOpenCodeHost,
+        ENV_EFFECTIVE_PORT: config.effectivePort,
+        ENV_CONFIGURED_OPENCODE_HOSTNAME: '127.0.0.1',
+        ENV_SKIP_OPENCODE_START: true,
+      },
+      buildOpenCodeUrl: (route) => new URL(route, config.configuredOpenCodeHost.origin).href,
+    }, stateRef);
+    const fetchMock = stubOpenCodeFetch({ health: { ...DEFAULT_V2_HEALTH, version: '2.0.23' } });
+    await runtime.bootstrapOpenCodeAtStartup();
+    await runtime.waitForOpenCodeReady(1000, 1);
+    expect(stateRef.current.isExternalOpenCode).toBe(true);
+    expect(stateRef.current.openCodePort).toBe(config.effectivePort);
+    expect(fetchMock.mock.calls.some(([url]) => String(url) === `${config.configuredOpenCodeHost.origin}/api/info`)).toBe(true);
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
   it('launches managed OpenCode with the managed PATH', async () => {
     delete process.env.OPENCODE_BINARY;
     const child = createMockChild();
@@ -179,6 +204,7 @@ describe('OpenCode lifecycle', () => {
     expect(options.env.PATH).toBe('/home/user/.bun/bin:/usr/local/bin:/usr/bin');
     expect(options.env.SHELL_ONLY).toBe('yes');
     expect(options.env.OPENCODE_SERVER_PASSWORD).toBe('password');
+    expect(options.env.OPENCODE_PASSWORD).toBe('password');
 
     await server.close();
   });
@@ -847,7 +873,7 @@ describe('OpenCode lifecycle', () => {
     stateRef.current.runtimeContract = {
       executionAllowed: true,
       phase: 'ready',
-      serveVersion: '2.0.12',
+      serveVersion: RUNTIME_CONTRACT_MIN_VERIFIED,
       instanceGeneration: 1,
     };
 
@@ -861,7 +887,7 @@ describe('OpenCode lifecycle', () => {
     runtime.refreshRuntimeContractFromProbe(
       {
         ok: true,
-        version: '2.0.12',
+        version: RUNTIME_CONTRACT_MIN_VERIFIED,
         authenticated: true,
         healthOk: true,
       },
@@ -875,7 +901,7 @@ describe('OpenCode lifecycle', () => {
     runtime.refreshRuntimeContractFromProbe(
       {
         ok: true,
-        version: '2.0.12',
+        version: RUNTIME_CONTRACT_MIN_VERIFIED,
         authenticated: true,
         healthOk: true,
       },
@@ -884,7 +910,7 @@ describe('OpenCode lifecycle', () => {
     );
     expect(stateRef.current.runtimeContract.executionAllowed).toBe(true);
     expect(stateRef.current.runtimeContract.instanceGeneration).toBe(2);
-    expect(stateRef.current.runtimeContract.serveVersion).toBe('2.0.12');
+    expect(stateRef.current.runtimeContract.serveVersion).toBe(RUNTIME_CONTRACT_MIN_VERIFIED);
   });
 
   it('does not mark external skip-start ready before version and migration admit', async () => {

package/server/lib/opencode/location-release.d.ts

@@ -0,0 +1,8 @@
+import type { OpenCodeClient } from '@opencode/client';
+
+export type LocationReleaseResult = { state: 'released' | 'timeout' | 'failed' | 'unavailable' };
+export function releaseDeletedWorktreeLocation(input: {
+  getClient: () => OpenCodeClient | null;
+  directory: string;
+  timeoutMs?: number;
+}): Promise<LocationReleaseResult>;

package/server/lib/opencode/location-release.js

@@ -0,0 +1,32 @@
+/**
+ * Explicit worktree deletion only. An eviction acknowledgement detaches cached
+ * services; it does not prove that borrowers have released every OS handle.
+ * Never use this operation for automatic navigation cleanup on a shared serve.
+ *
+ * @param {{ getClient: () => import('@opencode/client').OpenCodeClient | null, directory: string, timeoutMs?: number }} input
+ * @returns {Promise<{ state: 'released' | 'timeout' | 'failed' | 'unavailable' }>}
+ */
+export async function releaseDeletedWorktreeLocation({ getClient, directory, timeoutMs = 2000 }) {
+  const controller = new AbortController();
+  let timer;
+  try {
+    if (!directory || !directory.trim()) return { state: 'unavailable' };
+    const client = getClient();
+    if (!client) return { state: 'unavailable' };
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve({ state: 'timeout' });
+      }, timeoutMs);
+    });
+    const request = Promise.resolve().then(() => client.debug.location.evict(
+      { location: { directory } },
+      { signal: controller.signal },
+    )).then(() => ({ state: 'released' }), () => ({ state: controller.signal.aborted ? 'timeout' : 'failed' }));
+    return await Promise.race([request, deadline]);
+  } catch {
+    return { state: 'failed' };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/server/lib/opencode/location-release.test.js

@@ -0,0 +1,43 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { OpenCode } from '@opencode/client';
+import { releaseDeletedWorktreeLocation } from './location-release.js';
+
+afterEach(() => vi.useRealTimers());
+
+describe('explicit worktree location release', () => {
+  it('uses the official SDK exact target, current origin and auth', async () => {
+    const requests = [];
+    let origin = 'https://old.invalid';
+    const getClient = () => OpenCode.make({ baseUrl: origin, headers: { Authorization: 'test-auth' }, fetch: async (input, init) => {
+      requests.push(new Request(input, init));
+      return new Response(null, { status: 204 });
+    } });
+    origin = 'https://current.invalid';
+    expect(await releaseDeletedWorktreeLocation({ getClient, directory: '/repo/work tree' })).toEqual({ state: 'released' });
+    expect(requests).toHaveLength(1);
+    const url = new URL(requests[0].url);
+    expect(url.origin + url.pathname).toBe('https://current.invalid/api/debug/location');
+    expect(url.searchParams.get('location[directory]')).toBe('/repo/work tree');
+    expect(requests[0].method).toBe('DELETE');
+    expect(requests[0].headers.get('Authorization')).toBe('test-auth');
+  });
+
+  it('reports failure without claiming successful disposal', async () => {
+    const getClient = () => ({ debug: { location: { evict: async () => { throw new Error('unavailable'); } } } });
+    expect(await releaseDeletedWorktreeLocation({ getClient, directory: '/repo' })).toEqual({ state: 'failed' });
+    expect(await releaseDeletedWorktreeLocation({ getClient: () => null, directory: '/repo' })).toEqual({ state: 'unavailable' });
+  });
+
+  it('bounds even a transport that ignores abort and never settles', async () => {
+    vi.useFakeTimers();
+    let signal;
+    const getClient = () => ({ debug: { location: { evict: (_input, options) => {
+      signal = options.signal;
+      return new Promise(() => {});
+    } } } });
+    const result = releaseDeletedWorktreeLocation({ getClient, directory: '/repo', timeoutMs: 50 });
+    await vi.advanceTimersByTimeAsync(50);
+    expect(await result).toEqual({ state: 'timeout' });
+    expect(signal.aborted).toBe(true);
+  });
+});

package/server/lib/opencode/mcp.js

@@ -29,7 +29,7 @@ function validateMcpName(name) {
  */
 function resolveMcpScopeFromPath(layers, sourcePath) {
   if (!sourcePath) return null;
-  return sourcePath === layers.paths.projectPath ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
+  return layers.projectLayers.some((layer) => layer.path === sourcePath) ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
 }
 
 function ensureProjectMcpConfigPath(workingDirectory) {

package/server/lib/opencode/opencode2-pin.js

@@ -1,5 +1,6 @@
 // Pinned desktop/runtime opencode2. Upgrade and prepare must not fall back to 1.18.x.
-export const PINNED_OPENCODE2_VERSION = '2.0.12';
+export const PINNED_OPENCODE2_VERSION = '2.0.23';
+export const MINIMUM_OPENCODE2_VERSION = '2.0.20';
 
 // Global npm/bun package that installs the opencode v2 binary (not 1.x opencode-ai).
 export const OPENCODE2_NPM_PACKAGE = '@opencode/cli';

package/server/lib/opencode/owned-runtime-upgrade.test.js

@@ -86,15 +86,15 @@ describe('owned runtime upgrade (ticket 12)', () => {
 
   it('verifies running serve identity before upgrade success', () => {
     const contractOk = evaluateRuntimeContract({
-      serveVersion: '2.0.14',
+      serveVersion: '2.0.23',
       reachable: true,
       authenticated: true,
       healthOk: true,
       migrationAdmitTranscript: true,
     });
     expect(evaluateOwnedUpgradeResult({
-      targetVersion: '2.0.14',
-      serveVersion: '2.0.14',
+      targetVersion: '2.0.23',
+      serveVersion: '2.0.23',
       binaryPath: ownedBinary,
       expectedBinaryPath: ownedBinary,
       contract: contractOk,
@@ -116,8 +116,8 @@ describe('owned runtime upgrade (ticket 12)', () => {
     });
 
     expect(evaluateOwnedUpgradeResult({
-      targetVersion: '2.0.14',
-      serveVersion: '2.0.14',
+      targetVersion: '2.0.23',
+      serveVersion: '2.0.23',
       binaryPath: '/usr/bin/opencode',
       expectedBinaryPath: ownedBinary,
       contract: contractOk,

package/server/lib/opencode/plugin-routes.test.js

@@ -1,4 +1,5 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, mock, test } from 'bun:test';
+import { vi } from 'vitest';
 import express from 'express';
 import fs from 'fs';
 import os from 'os';
@@ -67,7 +68,8 @@ describe('opencode plugin routes', () => {
   beforeAll(async () => {
     rootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-plugin-routes-'));
     userConfigPath = path.join(rootDir, 'user-opencode.json');
-    process.env.OPENCODE_CONFIG = userConfigPath;
+    vi.stubEnv('OPENCODE_CONFIG', userConfigPath);
+    vi.stubEnv('OPENCODE_CONFIG_DIR', path.join(rootDir, 'global-config'));
     plugins = await import('./plugins.js');
   });
 
@@ -91,7 +93,7 @@ describe('opencode plugin routes', () => {
 
   afterAll(() => {
     fs.rmSync(rootDir, { recursive: true, force: true });
-    delete process.env.OPENCODE_CONFIG;
+    vi.unstubAllEnvs();
   });
 
   test('GET /api/config/plugins empty returns entries and files arrays', async () => {

package/server/lib/opencode/plugins.js

@@ -4,6 +4,8 @@ import path from 'path';
 import {
   AGENT_SCOPE,
   readConfigFile,
+  readConfigLayers,
+  getConfigForPath,
   writeConfig,
 } from './shared.js';
 import { isPathSpec } from './plugin-spec.js';
@@ -74,54 +76,8 @@ function getActiveOpencodeConfigDir() {
   return path.join(os.homedir(), '.config', 'opencode');
 }
 
-function getActiveUserConfigPaths() {
-  const configDir = getActiveOpencodeConfigDir();
-  return [
-    path.join(configDir, 'config.json'),
-    path.join(configDir, 'opencode.json'),
-    path.join(configDir, 'opencode.jsonc'),
-  ];
-}
-
-function getActiveCustomConfigPath() {
-  return process.env.OPENCODE_CONFIG ? path.resolve(process.env.OPENCODE_CONFIG) : null;
-}
-
-function getPrimaryUserConfigPath() {
-  const [defaultPath, ...fallbackPaths] = getActiveUserConfigPaths();
-  for (const userPath of [defaultPath, ...fallbackPaths]) {
-    if (fs.existsSync(userPath)) {
-      return userPath;
-    }
-  }
-  return defaultPath;
-}
-
-function getProjectConfigPath(workingDirectory) {
-  if (!workingDirectory) return null;
-  const candidates = [
-    path.join(workingDirectory, 'opencode.json'),
-    path.join(workingDirectory, 'opencode.jsonc'),
-    path.join(workingDirectory, '.opencode', 'opencode.json'),
-    path.join(workingDirectory, '.opencode', 'opencode.jsonc'),
-  ];
-  return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];
-}
-
 function readPluginConfigLayers(workingDirectory) {
-  const customPath = getActiveCustomConfigPath();
-  const userPath = getPrimaryUserConfigPath();
-  const projectPath = getProjectConfigPath(workingDirectory);
-  return {
-    userConfig: readConfigFile(userPath),
-    projectConfig: readConfigFile(projectPath),
-    customConfig: readConfigFile(customPath),
-    paths: {
-      userPath,
-      projectPath,
-      customPath,
-    },
-  };
+  return readConfigLayers(workingDirectory);
 }
 
 function validateFileName(fileName) {
@@ -144,16 +100,10 @@ function ensureProjectConfigPath(workingDirectory) {
 }
 
 function configSources(layers) {
-  const sources = [];
-  if (layers.paths.customPath) {
-    sources.push({ config: layers.customConfig, filePath: layers.paths.customPath, scope: AGENT_SCOPE.USER });
-  } else {
-    sources.push({ config: layers.userConfig, filePath: layers.paths.userPath, scope: AGENT_SCOPE.USER });
-  }
-  if (layers.paths.projectPath) {
-    sources.push({ config: layers.projectConfig, filePath: layers.paths.projectPath, scope: AGENT_SCOPE.PROJECT });
-  }
-  return sources;
+  return [...layers.documents.filter((layer) => layer.scope !== 'project').reverse(), ...layers.projectLayers.toReversed()].map((layer) => ({
+    config: layer.config, filePath: layer.path,
+    scope: layer.scope === 'project' ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER,
+  }));
 }
 
 function splitScopedValue(value) {
@@ -175,7 +125,9 @@ function getPluginTarget(id, workingDirectory) {
   const { scope, value: spec } = splitScopedValue(decoded.value);
   validateScope(scope);
   const layers = readPluginConfigLayers(workingDirectory);
-  const source = configSources(layers).find((candidate) => candidate.scope === scope);
+  const source = configSources(layers).find((candidate) => candidate.scope === scope
+    && Array.isArray(candidate.config?.plugin)
+    && candidate.config.plugin.some((raw) => parsePluginRaw(raw).spec === spec));
   const plugin = Array.isArray(source?.config?.plugin) ? source.config.plugin : [];
   const index = plugin.findIndex((raw) => parsePluginRaw(raw).spec === spec);
   if (!source || index === -1) {
@@ -281,14 +233,14 @@ function createPluginEntry(entry, workingDirectory) {
     throw codedError(`Plugin "${spec}" already exists`, 'ENTRY_EXISTS');
   }
 
-  let targetPath = getPrimaryUserConfigPath();
+  let targetPath = layers.paths.userPath;
   let config = {};
   if (scope === AGENT_SCOPE.PROJECT) {
     targetPath = ensureProjectConfigPath(workingDirectory);
     config = fs.existsSync(targetPath) ? readConfigFile(targetPath) : {};
   } else {
     targetPath = layers.paths.customPath || layers.paths.userPath;
-    config = layers.paths.customPath ? layers.customConfig : layers.userConfig;
+    config = getConfigForPath(layers, targetPath);
   }
 
   if (!Array.isArray(config.plugin)) {

package/server/lib/opencode/plugins.test.js

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'bun:test';
+import { vi } from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -30,19 +31,20 @@ describe('opencode plugins data layer', () => {
   beforeAll(async () => {
     rootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-plugins-'));
     userConfigPath = path.join(rootDir, 'user-opencode.json');
-    process.env.OPENCODE_CONFIG = userConfigPath;
+    vi.stubEnv('OPENCODE_CONFIG', userConfigPath);
+    vi.stubEnv('OPENCODE_CONFIG_DIR', path.join(rootDir, 'global-config'));
     plugins = await import('./plugins.js');
   });
 
   beforeEach(() => {
-    process.env.OPENCODE_CONFIG = userConfigPath;
+    vi.stubEnv('OPENCODE_CONFIG', userConfigPath);
     projectDir = fs.mkdtempSync(path.join(rootDir, 'project-'));
     fs.rmSync(userConfigPath, { force: true });
   });
 
   afterAll(() => {
     fs.rmSync(rootDir, { recursive: true, force: true });
-    delete process.env.OPENCODE_CONFIG;
+    vi.unstubAllEnvs();
   });
 
   test('parses raw plugin entries', () => {

package/server/lib/opencode/providers.js

@@ -30,8 +30,8 @@ function getProviderSources(providerId, workingDirectory) {
   return {
     sources: {
       auth: { exists: false },
-      user: { exists: userExists, path: paths.userPath },
-      project: { exists: projectExists, path: paths.projectPath || null },
+      user: { exists: userExists, path: layers.userLayers.findLast((layer) => layer.config?.provider?.[providerId] !== undefined || layer.config?.providers?.[providerId] !== undefined)?.path || paths.userPath },
+      project: { exists: projectExists, path: layers.projectLayers.findLast((layer) => layer.config?.provider?.[providerId] !== undefined || layer.config?.providers?.[providerId] !== undefined)?.path || paths.projectPath || null },
       custom: { exists: customExists, path: paths.customPath }
     }
   };
@@ -44,17 +44,20 @@ function removeProviderConfig(providerId, workingDirectory, scope = 'user') {
 
   const layers = readConfigLayers(workingDirectory);
   let targetPath = layers.paths.userPath;
+  const sources = getProviderSources(providerId, workingDirectory).sources;
 
   if (scope === 'project') {
     if (!workingDirectory) {
       throw new Error('Working directory is required for project scope');
     }
-    targetPath = layers.paths.projectPath || targetPath;
+    targetPath = sources.project.path || targetPath;
   } else if (scope === 'custom') {
     if (!layers.paths.customPath) {
       return false;
     }
     targetPath = layers.paths.customPath;
+  } else {
+    targetPath = sources.user.path;
   }
 
   const targetConfig = getConfigForPath(layers, targetPath);

package/server/lib/opencode/proxy.js

@@ -1,4 +1,5 @@
 import { createProxyMiddleware } from 'http-proxy-middleware';
+import { isSensitiveCredentialResponse } from './credential-boundary.js';
 
 import {
   applyForwardProxyResponseHeaders,
@@ -244,6 +245,12 @@ export const resolveSessionTurnAdmissionRequest = (req) => {
 };
 
 export const registerOpenCodeProxy = (app, deps) => {
+  app.use((req, res, next) => {
+    if (isSensitiveCredentialResponse(req.method, req.originalUrl || req.url)) {
+      return res.status(403).json({ code: 'credential_response_refused', error: 'Provider credential values are host-only.' });
+    }
+    return next();
+  });
   const {
     fs,
     os,

package/server/lib/opencode/proxy.test.js

@@ -57,6 +57,19 @@ const mountProxy = () => {
   return app;
 };
 
+describe('credential response boundary', () => {
+  it.each(['/api/credential', '/api/credential/', '/api/%63redential?directory=/repo'])('refuses raw credential list %s before upstream', async (path) => {
+    const fetchSpy = vi.fn();
+    globalThis.fetch = fetchSpy;
+    const response = await request(mountProxy()).get(path).expect(403);
+    expect(response.body.code).toBe('credential_response_refused');
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+  it('refuses credential create replies which echo values', async () => {
+    await request(mountProxy()).post('/api/credential').send({}).expect(403);
+  });
+});
+
 const sseBody = (blocks) => {
   const encoder = new TextEncoder();
   const text = blocks.join('');

package/server/lib/opencode/remote-upgrade.integration.test.js

@@ -0,0 +1,66 @@
+import { expect, test } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import net from 'node:net';
+import { createOpenCodeUpdateDiscovery } from './update-discovery.js';
+import { installPinnedOpenCode2Cli } from './ensure-cli.js';
+import { createSharedOpenCodeService } from './shared-service.js';
+import { registerOpenCodeRoutes } from './routes.js';
+
+// Downloads real official binaries; never touches the user's shared service.
+test.skipIf(process.env.OPENCHAMBER_TEST_REMOTE_UPGRADE !== '1')('remote discovery upgrades an isolated shared service and verifies its running version', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'opencode-upgrade-'));
+  const env = {
+    PATH: process.env.PATH, HOME: root, TMPDIR: os.tmpdir(),
+    XDG_CONFIG_HOME: path.join(root, 'config'), XDG_DATA_HOME: path.join(root, 'data'),
+    XDG_STATE_HOME: path.join(root, 'state'), XDG_CACHE_HOME: path.join(root, 'cache'),
+    OPENCODE_CONFIG_DIR: path.join(root, 'config', 'opencode'), OPENCODE_DISABLE_MODELS_FETCH: '1',
+  };
+  await fs.mkdir(env.OPENCODE_CONFIG_DIR, { recursive: true });
+  const listener = net.createServer();
+  await new Promise((resolve) => listener.listen(0, '127.0.0.1', resolve));
+  const port = listener.address().port;
+  await new Promise((resolve) => listener.close(resolve));
+  await fs.writeFile(path.join(env.OPENCODE_CONFIG_DIR, 'service.json'), JSON.stringify({ hostname: '127.0.0.1', port }));
+  const service = createSharedOpenCodeService({ envLike: env, spawnImpl: (command, args, options) => spawn(command, args, { ...options, cwd: root }) });
+  let binary;
+  let registration;
+  try {
+    const target = await createOpenCodeUpdateDiscovery()();
+    expect(target).not.toBe('2.0.16');
+    binary = await installPinnedOpenCode2Cli({ version: '2.0.16', dataDir: root });
+    await service.start({ binary, env });
+    registration = await service.readRegistration();
+    expect(registration.version).toBe('2.0.16');
+    const app = express();
+    app.use(express.json());
+    registerOpenCodeRoutes(app, {
+      getIsExternalOpenCode: () => true, getIsSharedOpenCodeService: () => true,
+      getResolvedOpenCodeBinary: () => binary, getResolvedOpenCodeBinarySource: () => 'installed',
+      readSettingsFromDiskMigrated: async () => ({}),
+      getOpenCodeResolutionSnapshot: async () => ({ source: 'installed', resolved: binary }),
+      buildOpenCodeUrl: (pathname) => `${registration.origin}${pathname}`,
+      getOpenCodeAuthHeaders: () => ({ Authorization: `Basic ${Buffer.from(`opencode:${registration.password}`).toString('base64')}` }),
+      forceResolvedOpenCodeBinary: (value) => { binary = value; },
+      restartOpenCode: async ({ binaryPath }) => {
+        await service.start({ binary: binaryPath, env, replace: true });
+        registration = await service.readRegistration();
+      },
+      openchamberDataDir: root,
+    });
+    const before = await request(app).get('/api/opencode/upgrade-status').expect(200);
+    expect(before.body).toMatchObject({ available: true, targetVersion: target });
+    const upgrade = await request(app).post('/api/opencode/upgrade').send({ target }).expect(200);
+    expect(upgrade.body).toMatchObject({ success: true, restarted: true, version: target });
+    const after = await request(app).get('/api/opencode/upgrade-status').expect(200);
+    expect(after.body).toMatchObject({ available: false, serveVersion: target });
+  } finally {
+    if (binary) await promisify(execFile)(binary, ['service', 'stop'], { env, cwd: root, timeout: 20_000, windowsHide: true });
+    await fs.rm(root, { recursive: true, force: true });
+  }
+}, 180_000);

package/server/lib/opencode/routes.js

@@ -1,7 +1,6 @@
 import { createProjectIdFromPath } from '../projects/project-id.js';
 import { projectBootstrapSettingsResponse } from './settings-helpers.js';
 import {
-  PINNED_OPENCODE2_VERSION,
   evaluateOpenCodeHealthBody,
   isOpenCode1xVersion,
   resolveOpenCode2UpgradeTarget,
@@ -13,6 +12,7 @@ import {
 } from './ensure-cli.js';
 import { registerUpgradeScreenRoutes } from './upgrade-screen.js';
 import { evaluateRuntimeContract } from './runtime-contract.js';
+import { createOpenCodeUpdateDiscovery } from './update-discovery.js';
 import {
   buildUpgradeStatusSnapshot,
   classifyRuntimeOwnership,
@@ -54,6 +54,7 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
     getResolvedOpenCodeBinarySource = () => null,
     getActiveSessionCount = () => 0,
     openchamberDataDir = null,
+    discoverOpenCodeUpdate = createOpenCodeUpdateDiscovery(),
   } = dependencies;
 
   const upgradeOperation = createUpgradeOperationState();
@@ -156,12 +157,13 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
   const buildUpgradeStatus = async () => {
     const ownership = await resolveOwnershipContext();
     const contract = await buildLiveContract();
+    const targetVersion = await discoverOpenCodeUpdate();
     const activeCount = typeof getActiveSessionCount === 'function' ? Number(getActiveSessionCount()) || 0 : 0;
     return buildUpgradeStatusSnapshot({
       ownership,
       serveVersion: contract.serveVersion,
       cliVersion: contract.cliVersion,
-      targetVersion: PINNED_OPENCODE2_VERSION,
+      targetVersion,
       contract,
       operation: upgradeOperation.getState(),
       hasActiveTasks: activeCount > 0,
@@ -342,7 +344,7 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
           errorCode: 'OPENCODE_UPGRADE_1X_REFUSED',
         });
       }
-      const target = resolveOpenCode2UpgradeTarget(rawTarget);
+      const target = resolveOpenCode2UpgradeTarget(rawTarget ?? (await buildUpgradeStatus()).targetVersion);
       const confirmActive = req.body?.confirmActiveTasks === true || req.body?.force === true;
       const activeCount = typeof getActiveSessionCount === 'function' ? Number(getActiveSessionCount()) || 0 : 0;
       if (activeCount > 0 && !confirmActive) {
@@ -707,7 +709,7 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
 
       const sources = getProviderSources(providerId, directory);
       const { getProviderAuth } = await getAuthLibrary();
-      const auth = getProviderAuth(providerId);
+      const auth = await getProviderAuth(providerId);
       sources.sources.auth.exists = Boolean(auth);
 
       return res.json({
@@ -751,12 +753,12 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
       let removed = false;
       if (scope === 'auth') {
         const { removeProviderAuth } = await getAuthLibrary();
-        removed = removeProviderAuth(providerId);
+        removed = await removeProviderAuth(providerId);
       } else if (scope === 'user' || scope === 'project' || scope === 'custom') {
         removed = removeProviderConfig(providerId, directory, scope);
       } else if (scope === 'all') {
         const { removeProviderAuth } = await getAuthLibrary();
-        const authRemoved = removeProviderAuth(providerId);
+        const authRemoved = await removeProviderAuth(providerId);
         const userRemoved = removeProviderConfig(providerId, directory, 'user');
         const projectRemoved = directory ? removeProviderConfig(providerId, directory, 'project') : false;
         const customRemoved = removeProviderConfig(providerId, directory, 'custom');
@@ -765,14 +767,14 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
         return res.status(400).json({ error: 'Invalid scope' });
       }
 
-      if (removed) {
+      if (removed && scope !== 'auth') {
         await refreshOpenCodeAfterConfigChange(`provider ${providerId} disconnected (${scope})`);
       }
 
       return res.json({
         success: true,
         removed,
-        requiresReload: removed,
+        requiresReload: removed && scope !== 'auth',
         message: removed ? 'Provider disconnected successfully' : 'Provider was not connected',
         reloadDelayMs: removed ? clientReloadDelayMs : undefined,
       });