@openchambery/web 2.1.7 → 2.1.8-beta.3

package/dist/index.html

@@ -552,7 +552,7 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-DSY3-ZQZ.js"></script>
+    <script type="module" crossorigin src="/assets/main-B3grbXe8.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-C8w0nlKy.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-3ad3yzM7.js">
@@ -572,7 +572,7 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-bN5IYQau.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-CqpbN2lM.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-GAVzvQGc.js">
     <link rel="stylesheet" crossorigin href="/assets/src-C9BNQK0O.css">
   </head>
   <body class="h-full bg-background text-foreground">

package/dist/mini-chat.html

@@ -74,7 +74,7 @@
       }
     </style>
 
-    <script type="module" crossorigin src="/assets/miniChat-B43ASec3.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-ChSEmnwp.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-C8w0nlKy.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-3ad3yzM7.js">
@@ -94,7 +94,7 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-bN5IYQau.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-CqpbN2lM.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-GAVzvQGc.js">
     <link rel="stylesheet" crossorigin href="/assets/src-C9BNQK0O.css">
   </head>
   <body class="h-full bg-background text-foreground">

package/dist/mobile.html

@@ -63,7 +63,7 @@
       })();
     </script>
 
-    <script type="module" crossorigin src="/assets/mobile-DloCio4f.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-CrKlS4SH.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-C8w0nlKy.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-3ad3yzM7.js">
@@ -83,7 +83,7 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-bN5IYQau.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-CqpbN2lM.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-GAVzvQGc.js">
     <link rel="stylesheet" crossorigin href="/assets/src-C9BNQK0O.css">
   </head>
   <body class="h-full bg-background text-foreground">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "2.1.7",
+  "version": "2.1.8-beta.3",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/lib/config-sync/DOCUMENTATION.md

@@ -17,17 +17,19 @@ Own the direction-agnostic OpenCode config sync contract: allowlist planning on
 | `local-backup.js` | Local (pull destination) generational backup + tar extract |
 | `tar.js` | `collectLocalTarBuffer` (buffered) |
 | `engine.js` | `applyConfigSyncPlan` orchestration for **push** (prepare → putTar* → finalize) |
+| `credentials.js` | V2 credential API transfer, validation, account merge and in-memory rollback |
+| `magpie.js` | Host-local Magpie discovery, verified CLI provisioning, native backup/restore |
 | `target-id.js` | `ssh:<instanceId>` namespace helper |
 
 ## Contract shape
 
-- **SyncTarget**: `{ id, kind, capabilities: { posixShell, tarExtract, authFileWrite } }`
+- **SyncTarget**: `{ id, kind, capabilities: { posixShell, tarExtract, providerCredentialsWrite } }`
 - **TargetExecutor**: `{ probe(plan), prepare(plan, { syncRunId }), putTar({ kind, payload }), finalize(plan, { syncRunId }) }`
   - `payload`: `Buffer | Uint8Array` — all executors currently buffer; reintroduce streaming only when a transport needs it.
-- **Plan** (source-computed): `{ direction: 'push' | 'pull', syncRunId?, sourceTargetId?, targetId?, files, directories, agentsRoot, authFile, deletes, totalBytes, selections? }`
-- **Selections**: `{ fileGroups: boolean[], singleFiles: boolean[], directories: boolean[], agentsRoot: boolean, authFile: boolean }`
+- **Plan** (source-computed): `{ direction: 'push' | 'pull', syncRunId?, sourceTargetId?, targetId?, files, directories, agentsRoot, providerCredentials, deletes, totalBytes, selections? }`
+- **Selections**: `{ fileGroups: boolean[], singleFiles: boolean[], directories: boolean[], agentsRoot: boolean, providerCredentials: boolean, magpie?: boolean }`
   - Preview and apply must share one selections snapshot so the confirmed scope cannot drift.
-  - `authFile` defaults unchecked like an opt-in ordinary selection; once checked it syncs the same way as other allowlisted files (no extra grant).
+  - `providerCredentials` is the selection/metadata key; the UI calls it **Provider keys**. It defaults unchecked and contains only `{ bytes }`, never credential values or a filesystem path. The protocol has no legacy credential-file fields, aliases, archive kinds, probe markers or backup roots.
 
 ## Direction flow
 
@@ -45,11 +47,12 @@ Switching direction in the wizard **must** discard the previous preview and re-c
   at every depth, including followed symlinks, matching the inventory walk. Keep
   these exclusions in `OPENCODE_CONFIG_SYNC_TAR_EXCLUDES`; bypassing the shared
   archive builder can silently transfer dependency trees omitted by the preview.
-- Managed SSH readiness is gated by `posixShell` (and `tarExtract` / `authFileWrite` as needed).
+- Managed SSH readiness is gated by `posixShell` (and `tarExtract` / `providerCredentialsWrite` as needed).
 - Prepare (remote or local) writes generational backups under `<backupRoot>/<syncRunId>/` and prunes older than `OPENCODE_CONFIG_SYNC_BACKUP_GENERATIONS`. Failed runs keep their scene until pruned.
 - Finalize confirms the run's backup directory exists.
 - Run records (Electron `sync-run-store`) persist `direction` alongside `syncRunId` / summary; they are not stored in `settings.json`.
-- **`auth.json` sync:** treated like any other selected allowlist item. Default selection leaves it unchecked; when selected, push/pull transfer it under the dedicated auth backup directory with no separate credential grant.
+- **Provider keys:** read/write the active OpenCode service through the official V2 credential SDK. API keys and OAuth accounts retain IDs, labels, metadata and active selection. Matching IDs are replaced; other destination accounts remain. No `auth.json`, database copying, environment-key discovery, or credential backups on disk. Failed imports attempt in-memory rollback and report incomplete rollback explicitly. Already-applied config/skill files remain when credentials fail; retry is idempotent for credentials. Process termination cannot guarantee rollback.
+- Credential API failures reject rather than becoming empty inventory. Empty successful inventory is `null`. Preview/run records contain metadata only. Transfer envelopes are versioned `opencode-credentials-v1`; only the current protocol is supported.
 
 ## HTTP receive protocol (direct / later relay)
 
@@ -59,15 +62,34 @@ Routes under `/api/openchamber/config-sync/*` (global `/api` auth gate: session
 |--------|------|------|
 | POST | `/probe` | Inventory + existence vs plan |
 | POST | `/prepare` | Generational local backup + deletes; one inflight `syncRunId` |
-| PUT | `/put/:kind?syncRunId=` | Stream tar.gz (`config` \| `agents` \| `auth`) |
-| GET | `/download/:kind` | Stream tar.gz for pull source |
+| PUT | `/put/:kind?syncRunId=` | tar.gz for `config` / `agents`; versioned credential JSON bytes for selected `credentials` |
+| GET | `/download/:kind` | Matching binary payload; `credentials` is never cached |
+| GET | `/credentials/inventory` | Current-service credential byte count, without secrets |
+| PUT | `/credentials` | Bounded credential import for local pull and SSH-forwarded transfer |
+| GET | `/magpie/inventory` | `{ magpie: { available, installed } }`, metadata only; never installs |
+| PUT | `/magpie` | Native Magpie restore for local pull and SSH-forwarded transfer; installs missing CLI |
 | POST | `/finalize` | Confirm backup generation + success receipt |
 | POST | `/abort` | Clear inflight |
 
-`auth` put/download follows the same selection/plan rules as other kinds. Concurrent prepare → `sync_in_progress`.
+`credentials` put requires a selected plan; finalize rejects a missing credential transfer. Concurrent prepare → `sync_in_progress`; credential imports are separately serialized by rejection. Credential routes use the existing global authenticated API gate and sanitize upstream errors.
 
 ## Composition
 
-- Electron SSH: `TargetExecutor` push + inventory/tar pull.
+- Electron SSH: `TargetExecutor` push + inventory/tar pull for files; credentials use authenticated HTTP through the established SSH forward.
 - Electron direct hosts: `direct-config-sync.mjs` calls these HTTP routes.
-- **Relay hosts (ticket 06):** UI opens an E2EE tunnel (`packages/ui/src/lib/relay/relay-config-sync.ts`) and calls the same HTTP routes via `tunnel.fetch`. Target id is `relay:<serverId>` (signing-key fingerprint). Preview/apply refresh candidates and refuse on `serverId` mismatch (`relay_identity_changed`) with no fallback identity. Auth remains the global `/api` bearer gate; selected `auth.json` transfers without a separate credential grant.
+- **Relay hosts (ticket 06):** UI opens an E2EE tunnel (`packages/ui/src/lib/relay/relay-config-sync.ts`) and calls the same HTTP routes via `tunnel.fetch`. Target id is `relay:<serverId>` (signing-key fingerprint). Preview/apply refresh candidates and refuse on `serverId` mismatch (`relay_identity_changed`) with no fallback identity. Only explicit sync transports carry credential payloads; ordinary provider UI never receives them.
+- Desktop local credential operations go through the local host HTTP routes, resolving its URL/token at call time. This also works when the active backend is an OTA module distinct from installer-owned config-sync code. Web/mobile hosts can receive through the same server; initiating the two-instance wizard remains desktop-only, including for VS Code.
+
+## Magpie discovery and transfer
+
+The existing sync wizard discovers Magpie on the **source** for every preview. A push uses the local host's inventory; a pull uses the selected remote host's inventory (HTTP through the SSH forward, direct, or E2EE Relay). `magpieAvailable` survives selection filtering. The optional `magpie` plan entry is `{ bytes: 0 }` when selected: backup size is unknown until export, not counted as a zero-byte archive. Switching direction clears the Magpie selection and discovers the new source. A selected source disappearing is a failure, never an empty successful sync. This is discovery during the existing explicit sync flow, not a background file watcher.
+
+Discovery checks `MAGPIE_BINARY`, PATH, the user's `.local/bin`, macOS application bundles and Homebrew paths, the standard Windows user installation path, then OpenChamber's managed executable. Symlinks resolve before locating portable data. Installed config honors absolute `XDG_CONFIG_HOME`, otherwise `~/.config/magpie`; portable config follows `.portable` / adjacent `data`, including the macOS app parent and an applicable AppImage directory. A shared Applications/home/download directory's `data` is not adopted over installed config. Providers, settings, profiles, library or plugin config files make the source available even without a CLI. Metadata does not expose paths or secrets. Read errors fail discovery.
+
+Selecting Magpie uses its native `backup` / `restore` with configuration, API keys, profiles, agent models, library and portable plugin declarations. Subscription OAuth and plugin sign-ins are excluded by Magpie itself; the option says so. This does not modify Magpie or copy its login databases. Native provider/group restore merges by ID and does not propagate deletions; settings and library follow Magpie's own restore semantics, retaining machine-local settings. This is a full native bundle, not a provider-only restore.
+
+Missing executables are installed only during selected export/import (including a config-only source), never in preview. The host selects the official pure CLI asset for macOS/Linux/Windows x64/arm64 from `https://usemagpie.ai/api/latest`, verifies SHA-256, checks `--version`, then atomically publishes it under `<OPENCHAMBER_DATA_DIR>/tools/magpie/` (default `~/.config/openchamber`). Existing desktop clients and CLIs are reused. Installation is process-local single-flight, needs no global PATH change or desktop environment, and fails explicitly for unsupported platforms or unverifiable downloads.
+
+The `magpie` transfer kind is a bounded, versioned `magpie-sync-v1` binary JSON envelope carrying an encrypted native backup and a random per-transfer passphrase. Both travel only through the authenticated sync transport; Relay adds its existing E2EE. Passphrases go to child stdin, never argv, run logs or disk. Private temporary directories hold only native encrypted backups and are removed on success/failure. Raw child output is kept local and sanitized before reporting. A zero exit with excluded sign-ins or unavailable agent settings is successful restore with `magpieWarnings` (`sign_in_required`, `agent_settings_skipped`), not a failed transfer. Receipts carry these codes through SSH/direct/Relay and desktop IPC to a localized completion warning. Provider/API-key, plugin-install or library-application failures remain errors with a sanitized reason. CLI failure can leave some native configuration applied; already-applied OpenCode files remain too. Retrying can complete the merge; this is not an atomic cross-application rollback.
+
+`/put/magpie` requires a selected prepared plan and finalize requires its receipt. Standalone `/magpie` is the corresponding authenticated host operation for SSH and local pull. Both use one host-local import/export lock. Desktop main only moves bytes and resolves the local host at call time; the web host owns process execution and installation, including under backend OTA. Web/mobile hosts can receive this operation; the initiating wizard remains desktop-only. No credential values enter previews or sync-run summaries.

package/server/lib/config-sync/config-sync.test.js

@@ -92,8 +92,8 @@ describe('config-sync contract', () => {
     await fsp.writeFile(path.join(configDir, 'AGENTS.md'), 'hi\n');
     await fsp.writeFile(path.join(configDir, 'skills', 'a.md'), 'a\n');
 
-    const full = planOpenCodeConfigSync(home, { direction: SYNC_DIRECTION_PUSH, includeAuthFile: false });
-    const selections = buildDefaultSyncSelections({ includeAuthFile: false });
+    const full = planOpenCodeConfigSync(home, { direction: SYNC_DIRECTION_PUSH, includeProviderCredentials: false });
+    const selections = buildDefaultSyncSelections({ includeProviderCredentials: false });
     selections.fileGroups = selections.fileGroups.map((_, index) => index === 0);
     selections.singleFiles = selections.singleFiles.map(() => false);
     selections.directories = selections.directories.map((__, index) => index === 2); // skills
@@ -103,20 +103,20 @@ describe('config-sync contract', () => {
     expect(filtered.files.map((entry) => entry.path)).toEqual(['opencode.jsonc']);
     expect(filtered.directories.map((entry) => entry.path)).toEqual(['skills']);
     expect(filtered.agentsRoot).toBeNull();
-    expect(filtered.authFile).toBeNull();
+    expect(filtered.providerCredentials).toBeNull();
 
     const inventoryPlan = planOpenCodeConfigSyncFromInventory({
       files: [{ path: 'opencode.jsonc', bytes: 3 }],
       directories: [{ path: 'skills', fileCount: 1, bytes: 2 }],
       agentsRoot: null,
-      authFile: { bytes: 9 },
+      providerCredentials: { bytes: 9 },
     }, {
       direction: SYNC_DIRECTION_PULL,
-      selections: { ...selections, authFile: true },
-      includeAuthFile: true,
+      selections: { ...selections, providerCredentials: true },
+      includeProviderCredentials: true,
     });
     expect(inventoryPlan.direction).toBe('pull');
-    expect(inventoryPlan.authFile).toEqual({ bytes: 9 });
+    expect(inventoryPlan.providerCredentials).toEqual({ bytes: 9 });
     expect(inventoryPlan.files.map((entry) => entry.path)).toEqual(['opencode.jsonc']);
   });
 });
@@ -132,7 +132,7 @@ describe('local pull destination backups', () => {
       directories: [],
       deletes: ['config.json', 'opencode.json'],
       agentsRoot: null,
-      authFile: null,
+      providerCredentials: null,
     };
 
     await prepareLocalSyncDestination(home, plan, { syncRunId: 'pull-01', generations: 2 });
@@ -206,7 +206,7 @@ describe('remote inventory script', () => {
       await fsp.writeFile(path.join(skill, '.venv-asc', 'lib', 'binary.so'), 'x'.repeat(4096));
       await fsp.writeFile(path.join(skill, 'SKILL.md'), 'keep');
     }
-    const local = planOpenCodeConfigSync(home, { includeAuthFile: false });
+    const local = planOpenCodeConfigSync(home, { includeProviderCredentials: false });
     expect(local.agentsRoot).toEqual({ fileCount: 1, bytes: 4 });
     expect(local.directories.find((entry) => entry.path === 'skills')).toMatchObject({ fileCount: 1, bytes: 4 });
     const stdout = execFileSync('sh', ['-c', buildRemoteSyncInventoryScript()], {
@@ -241,7 +241,7 @@ describe('remote inventory script', () => {
     expect(files).toContain('AGENTS.md');
     const directories = inventory.directories.map((entry) => entry.path);
     expect(directories).toContain('agents');
-    expect(inventory.authFile).toEqual({ bytes: 3 });
+    expect(inventory).not.toHaveProperty('providerCredentials');
     for (const entry of inventory.files) {
       expect(typeof entry.path).toBe('string');
       expect(typeof entry.bytes).toBe('number');
@@ -263,6 +263,6 @@ describe('remote inventory script', () => {
     expect(inventory.files).toEqual([]);
     expect(inventory.directories).toEqual([]);
     expect(inventory.agentsRoot).toBeNull();
-    expect(inventory.authFile).toBeNull();
+    expect(inventory).not.toHaveProperty('providerCredentials');
   });
 });

package/server/lib/config-sync/constants.js

@@ -21,11 +21,8 @@ export const OPENCODE_CONFIG_SYNC_ALLOWLIST = {
 export const OPENCODE_CONFIG_SYNC_BACKUP_DIR = '.openchamber.sync-backup';
 /** Backup root for `$HOME/.agents` (outside `~/.agents` so rm -rf does not eat it). */
 export const OPENCODE_AGENTS_SYNC_BACKUP_DIR = '.openchamber.sync-backup-agents';
-/** Backup root for provider `auth.json` (outside `~/.local/share`). */
-export const OPENCODE_AUTH_SYNC_BACKUP_DIR = '.openchamber.sync-backup-auth';
 
 export const OPENCODE_AGENTS_ROOT_PROBE_MARKER = '__AGENTS_ROOT__';
-export const OPENCODE_AUTH_FILE_PROBE_MARKER = '__AUTH_FILE__';
 
 export const OPENCODE_CONFIG_SYNC_MAX_BYTES = 512 * 1024 * 1024;
 export const OPENCODE_CONFIG_SYNC_MAX_FILES = 20000;

package/server/lib/config-sync/contract.js

@@ -8,7 +8,7 @@ import {
  * @typedef {{
  *   posixShell: boolean,
  *   tarExtract: boolean,
- *   authFileWrite: boolean,
+ *   providerCredentialsWrite: boolean,
  *   ocHttp?: boolean,
  * }} SyncTargetCapabilities
  *
@@ -21,7 +21,7 @@ import {
  * @typedef {{
  *   remoteExisting: string[],
  *   remoteAgentsRootExists: boolean,
- *   remoteAuthFileExists: boolean,
+ *   remoteProviderCredentialsExists: boolean,
  * }} SyncProbeResult
  *
  * Payload for putTar. Callers always hand a fully buffered archive
@@ -31,7 +31,7 @@ import {
  * @typedef {{
  *   probe: (plan: object) => Promise<SyncProbeResult>,
  *   prepare: (plan: object, ctx: { syncRunId: string }) => Promise<void>,
- *   putTar: (args: { kind: 'config' | 'agents' | 'auth', payload: SyncTarPayload }) => Promise<void>,
+ *   putTar: (args: { kind: 'config' | 'agents' | 'credentials' | 'magpie', payload: SyncTarPayload }) => Promise<void>,
  *   finalize: (plan: object, ctx: { syncRunId: string }) => Promise<{ ok: true }>,
  * }} TargetExecutor
  */
@@ -39,34 +39,34 @@ import {
 export const EMPTY_SYNC_CAPABILITIES = Object.freeze({
   posixShell: false,
   tarExtract: false,
-  authFileWrite: false,
+  providerCredentialsWrite: false,
   ocHttp: false,
 });
 
 export const MANAGED_SSH_SYNC_CAPABILITIES = Object.freeze({
   posixShell: true,
   tarExtract: true,
-  authFileWrite: true,
+  providerCredentialsWrite: true,
   ocHttp: false,
 });
 
 export const DIRECT_HOST_SYNC_CAPABILITIES = Object.freeze({
   posixShell: false,
   tarExtract: false,
-  authFileWrite: true,
+  providerCredentialsWrite: true,
   ocHttp: true,
 });
 
 export const RELAY_HOST_SYNC_CAPABILITIES = Object.freeze({
   posixShell: false,
   tarExtract: false,
-  authFileWrite: true,
+  providerCredentialsWrite: true,
   ocHttp: true,
 });
 
 /**
  * Build a namespaced SyncTarget for an SSH instance.
- * Managed remotes expose posixShell/tarExtract/authFileWrite; others expose none
+ * Managed remotes expose posixShell/tarExtract/providerCredentialsWrite; others expose none
  * (semantic equivalent of the former mode==='managed' hard gate).
  *
  * @param {string} instanceId

package/server/lib/config-sync/credentials.js

@@ -0,0 +1,101 @@
+import { isDeepStrictEqual } from 'node:util';
+import { currentClient } from '../opencode/auth.js';
+
+const invalid = () => new Error('Invalid provider credentials sync payload');
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+function validate(entries) {
+  if (!Array.isArray(entries)) throw invalid();
+  const ids = new Set();
+  const active = new Set();
+  for (const entry of entries) {
+    if (!record(entry) || typeof entry.id !== 'string' || !entry.id || ids.has(entry.id)
+      || typeof entry.integrationID !== 'string' || !entry.integrationID
+      || typeof entry.label !== 'string' || typeof entry.active !== 'boolean' || !record(entry.value)) throw invalid();
+    ids.add(entry.id);
+    if (entry.active && active.has(entry.integrationID)) throw invalid();
+    if (entry.active) active.add(entry.integrationID);
+    const value = entry.value;
+    if (value.type === 'key') {
+      if (typeof value.key !== 'string') throw invalid();
+    } else if (value.type === 'oauth') {
+      if (typeof value.methodID !== 'string' || typeof value.access !== 'string'
+        || typeof value.refresh !== 'string' || !Number.isInteger(value.expires) || value.expires < 0) throw invalid();
+    } else if (value.type === 'external') {
+      if (typeof value.methodID !== 'string') throw invalid();
+    } else throw invalid();
+    if (value.metadata !== undefined && !record(value.metadata)) throw invalid();
+  }
+  return entries;
+}
+
+// Keep secrets in memory. Preview and run records receive only byte counts.
+export function createCredentialSync(resolveClient = currentClient) {
+  let importing = false;
+  const request = () => ({ signal: AbortSignal.timeout(15000) });
+  const read = async (client) => validate(await client.credential.list(request()));
+  const encode = (entries) => Buffer.from(JSON.stringify({ format: 'opencode-credentials-v1', entries }));
+  return {
+    async inventory() {
+      try {
+        const entries = await read(resolveClient());
+        return entries.length ? { bytes: encode(entries).byteLength } : null;
+      } catch { throw new Error('Unable to read provider credentials'); }
+    },
+    async download() {
+      try { return encode(await read(resolveClient())); }
+      catch { throw new Error('Unable to read provider credentials'); }
+    },
+    async import(payload) {
+      if (importing) throw new Error('Provider credentials sync already in progress');
+      importing = true;
+      try {
+        let entries;
+        try {
+          const decoded = JSON.parse(Buffer.from(payload).toString('utf8'));
+          if (decoded.format !== 'opencode-credentials-v1') throw invalid();
+          entries = validate(decoded.entries);
+        } catch { throw invalid(); }
+        const client = resolveClient();
+        let before;
+        try { before = await read(client); }
+        catch { throw new Error('Unable to read destination provider credentials'); }
+        const touched = [];
+        const create = (entry) => client.credential.create({
+          id: entry.id, integrationID: entry.integrationID, label: entry.label,
+          value: entry.value, activate: false,
+        }, request());
+        try {
+          for (const entry of entries) {
+            const previous = before.find((item) => item.id === entry.id);
+            if (previous && previous.integrationID !== entry.integrationID) throw invalid();
+            if (previous && previous.label === entry.label && isDeepStrictEqual(previous.value, entry.value)) continue;
+            touched.push({ entry, previous });
+            if (previous) await client.credential.remove({ credentialID: entry.id }, request());
+            await create(entry);
+          }
+          for (const entry of entries.filter((item) => item.active)) {
+            await client.credential.activate({ credentialID: entry.id }, request());
+          }
+        } catch {
+          let restored = true;
+          for (const { entry, previous } of touched.reverse()) {
+            try {
+              const current = await read(client);
+              if (current.some((item) => item.id === entry.id)) await client.credential.remove({ credentialID: entry.id }, request());
+              if (previous) await create(previous);
+            } catch { restored = false; }
+          }
+          for (const entry of before.filter((item) => item.active && entries.some((source) => source.integrationID === item.integrationID))) {
+            try { await client.credential.activate({ credentialID: entry.id }, request()); }
+            catch { restored = false; }
+          }
+          throw new Error(restored
+            ? 'Provider credentials sync failed; previous credentials restored'
+            : 'Provider credentials sync failed; rollback incomplete. Retry the sync.');
+        }
+        return { ok: true };
+      } finally { importing = false; }
+    },
+  };
+}

package/server/lib/config-sync/credentials.test.js

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest';
+import { OpenCode } from '@opencode/client';
+import { createCredentialSync } from './credentials.js';
+
+const key = (id, integrationID = 'openai', active = true) => ({
+  id, integrationID, label: id, active, value: { type: 'key', key: `fixture-${id}` },
+});
+
+// Exercise the installed SDK's real HTTP serialization, not a second SDK shape.
+function service(initial = []) {
+  let entries = structuredClone(initial);
+  let failCreate = false;
+  let failList = false;
+  const client = OpenCode.make({ baseUrl: 'http://credentials.invalid', fetch: async (input, init) => {
+    const req = new Request(input, init);
+    const pathname = new URL(req.url).pathname;
+    const parts = pathname.split('/');
+    const id = parts[3];
+    if (req.method === 'GET') {
+      if (failList) return new Response('fixture-private-upstream-error', { status: 500 });
+      return Response.json({ data: entries });
+    }
+    if (req.method === 'DELETE') {
+      entries = entries.filter((entry) => entry.id !== id);
+      return new Response(null, { status: 204 });
+    }
+    if (pathname.endsWith('/activate')) {
+      const selected = entries.find((entry) => entry.id === id);
+      for (const entry of entries) if (entry.integrationID === selected.integrationID) entry.active = entry.id === id;
+      return new Response(null, { status: 204 });
+    }
+    const body = await req.json();
+    expect(body.integrationID).toBeTypeOf('string');
+    expect(body.value).toBeTruthy();
+    if (failCreate) {
+      failCreate = false;
+      return new Response('fixture-private-upstream-error', { status: 400 });
+    }
+    if (entries.some((entry) => entry.id === body.id)) return new Response(null, { status: 409 });
+    const { activate, ...value } = body;
+    const entry = { ...value, active: activate || !entries.some((item) => item.integrationID === body.integrationID && item.active) };
+    entries.push(entry);
+    return Response.json({ data: entry });
+  } });
+  return {
+    sync: createCredentialSync(() => client),
+    entries: () => structuredClone(entries),
+    failNextCreate: () => { failCreate = true; },
+    failReads: () => { failList = true; },
+  };
+}
+
+describe('provider credential sync', () => {
+  it('round-trips keys, OAuth accounts, metadata and active selection without deleting destination accounts', async () => {
+    const oauth = { ...key('oauth'), value: {
+      type: 'oauth', methodID: 'oauth', access: 'fixture-access', refresh: 'fixture-refresh', expires: 1000,
+      metadata: { accountID: 'fixture-account' },
+    } };
+    const source = service([key('key', 'openai', false), oauth]);
+    const other = key('other', 'anthropic');
+    const destination = service([other]);
+    const payload = await source.sync.download();
+    expect(await source.sync.inventory()).toEqual({ bytes: payload.byteLength });
+    expect(JSON.stringify(await source.sync.inventory())).not.toContain('fixture-');
+    await destination.sync.import(payload);
+    expect(destination.entries()).toEqual([other, key('key', 'openai', false), oauth]);
+    await destination.sync.import(payload);
+    expect(destination.entries()).toHaveLength(3);
+  });
+
+  it('updates matching IDs and rolls back failed replacement without leaking upstream errors', async () => {
+    const original = key('same');
+    const updated = { ...original, value: { type: 'key', key: 'fixture-updated' } };
+    const source = service([updated]);
+    const target = service([original, key('other', 'anthropic')]);
+    target.failNextCreate();
+    await expect(target.sync.import(await source.sync.download())).rejects.toThrow('previous credentials restored');
+    expect(target.entries()).toContainEqual(original);
+    expect(target.entries()).toContainEqual(key('other', 'anthropic'));
+    await target.sync.import(await source.sync.download());
+    expect(target.entries()).toContainEqual(updated);
+  });
+
+  it('rejects legacy archives and malformed input before changing destination state', async () => {
+    const target = service([key('existing')]);
+    for (const payload of ['legacy tar', '{"openai":{"key":"fixture"}}', JSON.stringify({ format: 'opencode-credentials-v1', entries: [{}] })]) {
+      await expect(target.sync.import(Buffer.from(payload))).rejects.toThrow('Invalid provider credentials');
+      expect(target.entries()).toEqual([key('existing')]);
+    }
+  });
+
+  it('does not turn unavailable credentials into empty inventory', async () => {
+    const source = service();
+    expect(await source.sync.inventory()).toBeNull();
+    source.failReads();
+    await expect(source.sync.inventory()).rejects.toThrow('Unable to read provider credentials');
+  });
+});

package/server/lib/config-sync/engine.js

@@ -13,6 +13,8 @@ import { collectLocalTarBuffer } from './tar.js';
  *   syncRunId: string,
  *   sourceHomedir: string,
  *   collectTar?: typeof collectLocalTarBuffer,
+ *   collectCredentials?: () => Promise<Buffer>,
+ *   collectMagpie?: () => Promise<Buffer>,
  * }} args
  */
 export const applyConfigSyncPlan = async ({
@@ -21,6 +23,8 @@ export const applyConfigSyncPlan = async ({
   syncRunId,
   sourceHomedir,
   collectTar = collectLocalTarBuffer,
+  collectCredentials,
+  collectMagpie,
 }) => {
   assertPlanDirection(plan);
   const home = String(sourceHomedir || '');
@@ -31,9 +35,9 @@ export const applyConfigSyncPlan = async ({
   ];
   const hasConfigPayload = tarEntries.length > 0;
   const hasAgentsPayload = Boolean(plan.agentsRoot);
-  const hasAuthPayload = Boolean(plan.authFile);
+  const hasCredentialPayload = Boolean(plan.providerCredentials);
 
-  if (!hasConfigPayload && !hasAgentsPayload && !hasAuthPayload) {
+  if (!hasConfigPayload && !hasAgentsPayload && !hasCredentialPayload && !plan.magpie) {
     // Nothing to upload — preserve the historical short-circuit (no remote prepare).
     return {
       ok: true,
@@ -42,7 +46,7 @@ export const applyConfigSyncPlan = async ({
       deletes: plan.deletes.length,
       totalBytes: plan.totalBytes,
       agentsRoot: null,
-      authFile: null,
+      providerCredentials: null,
       plan,
     };
   }
@@ -54,10 +58,10 @@ export const applyConfigSyncPlan = async ({
   const agentsTarBuffer = hasAgentsPayload
     ? await collectTar(['-h', '-czf', '-', '-C', home, '.agents'], { windowsHide })
     : null;
-  const authShareDir = path.join(home, '.local', 'share', 'opencode');
-  const authTarBuffer = hasAuthPayload
-    ? await collectTar(['-h', '-czf', '-', '-C', authShareDir, 'auth.json'], { windowsHide })
+  const credentialPayload = hasCredentialPayload
+    ? await collectCredentials()
     : null;
+  const magpiePayload = plan.magpie ? await collectMagpie() : null;
 
   await executor.prepare(plan, { syncRunId });
 
@@ -67,12 +71,13 @@ export const applyConfigSyncPlan = async ({
   if (agentsTarBuffer) {
     await executor.putTar({ kind: 'agents', payload: agentsTarBuffer });
   }
-  if (authTarBuffer) {
-    // Only auth.json — never the rest of ~/.local/share/opencode (session DBs live there).
-    await executor.putTar({ kind: 'auth', payload: authTarBuffer });
+  if (credentialPayload) {
+    // Versioned credential payload; never a database or filesystem archive.
+    await executor.putTar({ kind: 'credentials', payload: credentialPayload });
   }
+  if (magpiePayload) await executor.putTar({ kind: 'magpie', payload: magpiePayload });
 
-  await executor.finalize(plan, { syncRunId });
+  const receipt = await executor.finalize(plan, { syncRunId });
 
   return {
     ok: true,
@@ -81,8 +86,9 @@ export const applyConfigSyncPlan = async ({
     deletes: plan.deletes.length,
     totalBytes: plan.totalBytes,
     agentsRoot: plan.agentsRoot ? { fileCount: plan.agentsRoot.fileCount } : null,
-    authFile: plan.authFile ? { bytes: plan.authFile.bytes } : null,
+    providerCredentials: plan.providerCredentials ? { bytes: plan.providerCredentials.bytes } : null,
     plan,
+    ...(receipt?.magpieWarnings?.length ? { magpieWarnings: receipt.magpieWarnings } : {}),
   };
 };
 

package/server/lib/config-sync/index.js

@@ -2,9 +2,7 @@ export {
   OPENCODE_CONFIG_SYNC_ALLOWLIST,
   OPENCODE_CONFIG_SYNC_BACKUP_DIR,
   OPENCODE_AGENTS_SYNC_BACKUP_DIR,
-  OPENCODE_AUTH_SYNC_BACKUP_DIR,
   OPENCODE_AGENTS_ROOT_PROBE_MARKER,
-  OPENCODE_AUTH_FILE_PROBE_MARKER,
   OPENCODE_CONFIG_SYNC_MAX_BYTES,
   OPENCODE_CONFIG_SYNC_MAX_FILES,
   OPENCODE_CONFIG_SYNC_BACKUP_GENERATIONS,
@@ -42,7 +40,6 @@ export {
   buildRemoteSyncInventoryScript,
   buildRemoteConfigTarScript,
   buildRemoteAgentsTarScript,
-  buildRemoteAuthTarScript,
   sanitizeSyncRunIdForPath,
   shellQuote,
 } from './scripts.js';

package/server/lib/config-sync/local-backup.js

@@ -5,7 +5,6 @@ import { spawn } from 'node:child_process';
 
 import {
   OPENCODE_AGENTS_SYNC_BACKUP_DIR,
-  OPENCODE_AUTH_SYNC_BACKUP_DIR,
   OPENCODE_CONFIG_SYNC_ALLOWLIST,
   OPENCODE_CONFIG_SYNC_BACKUP_DIR,
   OPENCODE_CONFIG_SYNC_BACKUP_GENERATIONS,
@@ -108,18 +107,6 @@ export const prepareLocalSyncDestination = async (homedir, plan, options) => {
     await fsp.rm(path.join(home, '.agents'), { recursive: true, force: true });
   }
 
-  if (plan?.authFile) {
-    const authBackupRoot = path.join(home, OPENCODE_AUTH_SYNC_BACKUP_DIR);
-    const authRun = path.join(authBackupRoot, syncRunId);
-    await fsp.rm(authRun, { recursive: true, force: true });
-    await fsp.mkdir(authRun, { recursive: true });
-    await pruneGenerations(authBackupRoot, syncRunId, generations);
-    await copyPathIfExists(
-      path.join(home, '.local', 'share', 'opencode', 'auth.json'),
-      path.join(authRun, 'auth.json'),
-    );
-  }
-
   return { runBackup };
 };