@runuai/host 0.8.35 → 0.8.36

package/lib/engine-accounts.ts

@@ -0,0 +1,538 @@
+/**
+ * Engine accounts (ADR-076) — multiple credentials per engine kind, selected
+ * by ENV at each `docker exec`, rotated automatically with rate-limit failover.
+ *
+ * An account resolves to a small env map merged into the agent's exec:
+ *   - Claude (env account):        CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY.
+ *   - Codex (config-dir account):  CODEX_HOME=<per-account container dir>.
+ *   - OpenCode (config-dir account): OPENCODE_DATA_DIR=<per-account container dir>.
+ *
+ * `accounts(kind) = [synthesized default] + [DB extras]`. The DEFAULT is the
+ * legacy single slot (`.env.local` var, or `~/.codex` / `~/.local/share/opencode`
+ * dir) — so with zero extras behavior is identical to before and `available()`
+ * is unchanged. EXTRA accounts live in `host_engine_accounts`, sealed with the
+ * host master key (env kind) or as an isolated host dir (config-dir kind).
+ *
+ * Isolation invariants (ADR-015/024) are preserved: accounts never leave the
+ * host, the operator's live dirs are never bind-mounted (extras are per-task
+ * writable copies), and every `docker cp` is followed by `chown -R node:node`.
+ *
+ * Rotation state (cooldown / last-used) is in-memory only; a host restart
+ * clears cooldowns (a restarted host retries every account, which is correct —
+ * caps reset over time).
+ */
+
+import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { eq } from "drizzle-orm";
+
+import { getDb, schema } from "./db";
+import { dockerCli } from "./docker-exec";
+import { openAesGcm, sealAesGcm } from "./secrets";
+import { newId } from "./ulid";
+
+const EXEC_TIMEOUT_MS = 15_000;
+
+/** Engine kinds that participate in the account model. Other kinds resolve to
+ *  no accounts (the orchestrator then injects no account env — old behavior). */
+export type AccountAuthKind = "env" | "config-dir";
+
+interface KindDescriptor {
+  authKind: AccountAuthKind;
+  /** Default (legacy-slot) host dir for config-dir kinds. */
+  defaultHostDir?: (owner: string) => string;
+  /** Default (legacy-slot) container dir for config-dir kinds. */
+  defaultContainerDir?: string;
+  /** Env var that selects a config-dir account's dir in-container. */
+  selectVar?: string;
+  /** Per-account container dir prefix for config-dir extras. */
+  containerDirPrefix?: string;
+  /** Per-account host dir builder for config-dir extras. */
+  extraHostDir?: (owner: string, id: string) => string;
+}
+
+const KINDS: Record<string, KindDescriptor> = {
+  claude: { authKind: "env" },
+  codex: {
+    authKind: "config-dir",
+    defaultHostDir: (owner) => join(owner, ".codex"),
+    defaultContainerDir: "/home/node/.codex",
+    selectVar: "CODEX_HOME",
+    containerDirPrefix: "/home/node/.codex-acct-",
+    extraHostDir: (owner, id) => join(owner, `.codex-acct-${id}`),
+  },
+  opencode: {
+    authKind: "config-dir",
+    defaultHostDir: (owner) => join(owner, ".local", "share", "opencode"),
+    defaultContainerDir: "/home/node/.local/share/opencode",
+    selectVar: "OPENCODE_DATA_DIR",
+    containerDirPrefix: "/home/node/.local/share/opencode-acct-",
+    extraHostDir: (owner, id) => join(owner, ".local", "share", `opencode-acct-${id}`),
+  },
+};
+
+/** Public (secret-free) account descriptor for the host UI. */
+export interface EngineAccountInfo {
+  id: string;
+  kind: string;
+  label: string;
+  authKind: AccountAuthKind;
+  isDefault: boolean;
+}
+
+/** A fully-resolved account, ready to inject / provision (host-trusted; the
+ *  execEnv holds decrypted secrets — never log it). */
+export interface ResolvedEngineAccount {
+  id: string;
+  kind: string;
+  label: string;
+  isDefault: boolean;
+  authKind: AccountAuthKind;
+  /** Env merged into the agent's docker exec. Empty for the default env
+   *  account (the ambient `.env.local` credential is account #1). */
+  execEnv: Record<string, string>;
+  /** config-dir accounts only: host dir to copy + container dir target. */
+  configDir?: { hostDir: string; containerDir: string };
+}
+
+// ---------------------------------------------------------------------------
+// Seams (tests inject).
+// ---------------------------------------------------------------------------
+
+export interface AccountSeams {
+  ownerHome: () => string;
+  procEnv: NodeJS.ProcessEnv;
+  fileExists: (p: string) => boolean;
+}
+
+function defaultSeams(): AccountSeams {
+  return {
+    ownerHome: () => process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    procEnv: process.env,
+    fileExists: existsSync,
+  };
+}
+
+function withDefaults(seams: Partial<AccountSeams>): AccountSeams {
+  return { ...defaultSeams(), ...seams };
+}
+
+// ---------------------------------------------------------------------------
+// Sealing (same pack format as host-env.ts).
+// ---------------------------------------------------------------------------
+
+function packSecret(value: string): string {
+  const sealed = sealAesGcm(value);
+  return `${sealed.ct.toString("base64")}.${sealed.nonce.toString("base64")}`;
+}
+
+function unpackSecret(enc: string): string {
+  const dot = enc.indexOf(".");
+  if (dot === -1) throw new Error("malformed secret_enc");
+  const ct = Buffer.from(enc.slice(0, dot), "base64");
+  const nonce = Buffer.from(enc.slice(dot + 1), "base64");
+  return openAesGcm(ct, nonce);
+}
+
+// ---------------------------------------------------------------------------
+// Resolution.
+// ---------------------------------------------------------------------------
+
+/** Whether the kind's DEFAULT (legacy) credential is present on this host. */
+function defaultAvailable(kind: string, s: AccountSeams): boolean {
+  const d = KINDS[kind];
+  if (!d) return false;
+  if (kind === "claude") {
+    return Boolean(
+      s.procEnv.CLAUDE_CODE_OAUTH_TOKEN ||
+        s.procEnv.ANTHROPIC_API_KEY ||
+        s.procEnv.ANTHROPIC_AUTH_TOKEN,
+    );
+  }
+  if (d.authKind === "config-dir" && d.defaultHostDir) {
+    return s.fileExists(join(d.defaultHostDir(s.ownerHome()), "auth.json"));
+  }
+  return false;
+}
+
+function synthesizeDefault(
+  kind: string,
+  s: AccountSeams,
+): ResolvedEngineAccount | null {
+  const d = KINDS[kind];
+  if (!d || !defaultAvailable(kind, s)) return null;
+  if (d.authKind === "env") {
+    // Ambient: the token in .env.local/process.env is forwarded via passEnv,
+    // so the default account injects nothing.
+    return {
+      id: `default:${kind}`,
+      kind,
+      label: "Default",
+      isDefault: true,
+      authKind: "env",
+      execEnv: {},
+    };
+  }
+  const containerDir = d.defaultContainerDir as string;
+  return {
+    id: `default:${kind}`,
+    kind,
+    label: "Default",
+    isDefault: true,
+    authKind: "config-dir",
+    execEnv: d.selectVar ? { [d.selectVar]: containerDir } : {},
+    configDir: {
+      hostDir: (d.defaultHostDir as (o: string) => string)(s.ownerHome()),
+      containerDir,
+    },
+  };
+}
+
+/** DB extras for a kind, resolved into injectable form. */
+function resolveExtras(kind: string, s: AccountSeams): ResolvedEngineAccount[] {
+  const d = KINDS[kind];
+  if (!d) return [];
+  const rows = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .all()
+    .filter((r) => r.kind === kind);
+  const out: ResolvedEngineAccount[] = [];
+  for (const row of rows) {
+    if (row.authKind === "env") {
+      let execEnv: Record<string, string> = {};
+      try {
+        execEnv = row.secretEnc
+          ? (JSON.parse(unpackSecret(row.secretEnc)) as Record<string, string>)
+          : {};
+      } catch (err) {
+        console.warn(
+          `[engine-accounts] skipping ${kind}/${row.id}: decrypt failed (${
+            err instanceof Error ? err.message : String(err)
+          })`,
+        );
+        continue;
+      }
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "env",
+        execEnv,
+      });
+    } else if (row.authKind === "config-dir" && row.configDir && d.selectVar) {
+      const containerDir = `${d.containerDirPrefix}${row.id}`;
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "config-dir",
+        execEnv: { [d.selectVar]: containerDir },
+        configDir: { hostDir: row.configDir, containerDir },
+      });
+    }
+  }
+  return out;
+}
+
+/** All accounts for a kind: [default if present] + [DB extras]. */
+export function resolveEngineAccounts(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+): ResolvedEngineAccount[] {
+  const s = withDefaults(seams);
+  const accounts: ResolvedEngineAccount[] = [];
+  const def = synthesizeDefault(kind, s);
+  if (def) accounts.push(def);
+  accounts.push(...resolveExtras(kind, s));
+  return accounts;
+}
+
+/** Public account list for the host UI (no secrets). */
+export function listEngineAccounts(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+): EngineAccountInfo[] {
+  return resolveEngineAccounts(kind, seams).map((a) => ({
+    id: a.id,
+    kind: a.kind,
+    label: a.label,
+    authKind: a.authKind,
+    isDefault: a.isDefault,
+  }));
+}
+
+/** How many accounts a kind has right now (default + extras). */
+export function engineAccountCount(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+): number {
+  return resolveEngineAccounts(kind, seams).length;
+}
+
+// ---------------------------------------------------------------------------
+// Rotation state (in-memory) + selection.
+// ---------------------------------------------------------------------------
+
+interface RotationState {
+  cooldownUntil: number;
+  lastUsedAt: number;
+}
+
+const rotationState = new Map<string, RotationState>();
+
+/** Default cooldown when the engine gives no reset hint. */
+export const DEFAULT_COOLDOWN_MS = 15 * 60_000;
+
+function state(id: string): RotationState {
+  let st = rotationState.get(id);
+  if (!st) {
+    st = { cooldownUntil: 0, lastUsedAt: 0 };
+    rotationState.set(id, st);
+  }
+  return st;
+}
+
+/** Put an account on cooldown (rate-limited). */
+export function cooldownEngineAccount(
+  id: string,
+  ms: number = DEFAULT_COOLDOWN_MS,
+  now: number = Date.now(),
+): void {
+  state(id).cooldownUntil = now + ms;
+}
+
+/** Record that an account was just used (least-recently-used ordering). */
+export function noteEngineAccountUsed(id: string, now: number = Date.now()): void {
+  state(id).lastUsedAt = now;
+}
+
+/**
+ * Pure selection over a resolved list: least-recently-used account not in
+ * `exclude` and not cooling. Falls back to the least-recently-used cooling
+ * account if ALL are cooling (better to try a capped account than stall).
+ * Returns null only when the list (minus exclusions) is empty.
+ */
+export function selectAccount(
+  accounts: ResolvedEngineAccount[],
+  opts: { exclude?: Set<string>; now?: number } = {},
+): ResolvedEngineAccount | null {
+  const now = opts.now ?? Date.now();
+  const exclude = opts.exclude ?? new Set<string>();
+  const candidates = accounts.filter((a) => !exclude.has(a.id));
+  if (candidates.length === 0) return null;
+  const lru = (a: ResolvedEngineAccount): number => state(a.id).lastUsedAt;
+  const healthy = candidates.filter((a) => state(a.id).cooldownUntil <= now);
+  const pool = healthy.length > 0 ? healthy : candidates;
+  return pool.reduce((best, a) => (lru(a) < lru(best) ? a : best), pool[0]!);
+}
+
+/** Pick an account for a kind (default + extras), applying rotation state. */
+export function pickEngineAccount(
+  kind: string,
+  opts: { exclude?: Set<string>; seams?: Partial<AccountSeams>; now?: number } = {},
+): ResolvedEngineAccount | null {
+  const accounts = resolveEngineAccounts(kind, opts.seams ?? {});
+  return selectAccount(accounts, { exclude: opts.exclude, now: opts.now });
+}
+
+/** Test hook: clear in-memory rotation state. */
+export function resetRotationState(): void {
+  rotationState.clear();
+}
+
+// ---------------------------------------------------------------------------
+// Provisioning (extra config-dir accounts) — copied into per-account container
+// dirs at session start, since task-up.sh (bash) can't read the sealed DB.
+// ---------------------------------------------------------------------------
+
+async function copyDirInto(
+  hostDir: string,
+  containerDir: string,
+  container: string,
+): Promise<void> {
+  const must = async (args: string[], step: string): Promise<void> => {
+    const res = await dockerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
+    if (res.status !== 0) {
+      const detail = res.stderr.trim().slice(0, 200);
+      throw new Error(
+        `${step} failed (${res.status === null ? "docker timeout" : `exit ${res.status}`})` +
+          (detail ? `: ${detail}` : ""),
+      );
+    }
+  };
+  await must(
+    ["exec", "-u", "root", container, "mkdir", "-p", containerDir],
+    `mkdir ${containerDir}`,
+  );
+  // Copy the dir CONTENTS (trailing /.) into the target dir.
+  await must(["cp", `${hostDir}/.`, `${container}:${containerDir}`], "docker cp account dir");
+  await must(
+    ["exec", "-u", "root", container, "chown", "-R", "node:node", containerDir],
+    `chown -R node:node ${containerDir}`,
+  );
+}
+
+/**
+ * Copy every EXTRA config-dir account (for the given kinds) into its per-account
+ * container dir + chown. The DEFAULT account is copied by task-up.sh, so it is
+ * skipped here. Best-effort per account — a failure is logged (no secrets) and
+ * that account simply won't authenticate in this container.
+ */
+export async function provisionEngineAccounts(
+  container: string,
+  kinds: Iterable<string>,
+  seams: Partial<AccountSeams> = {},
+): Promise<void> {
+  const s = withDefaults(seams);
+  const seen = new Set<string>();
+  for (const kind of kinds) {
+    if (seen.has(kind)) continue;
+    seen.add(kind);
+    for (const account of resolveEngineAccounts(kind, s)) {
+      if (account.isDefault || !account.configDir) continue;
+      if (!s.fileExists(account.configDir.hostDir)) continue;
+      try {
+        await copyDirInto(
+          account.configDir.hostDir,
+          account.configDir.containerDir,
+          container,
+        );
+      } catch (err) {
+        console.error(
+          `[engine-accounts] provision ${kind}/${account.id} into ${container}: ` +
+            `${err instanceof Error ? err.message : err} — this account won't authenticate in the task`,
+        );
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Mutations (host UI).
+// ---------------------------------------------------------------------------
+
+export interface AddAccountResult {
+  ok: boolean;
+  message: string;
+  id?: string;
+}
+
+/**
+ * Register an EXTRA account for a kind by pasting a token / API key (ADR-076).
+ * Claude accepts a `setup-token` token or an `sk-ant-…` key; Codex accepts an
+ * OpenAI API key (written into an isolated `~/.codex-acct-<id>/auth.json`).
+ */
+export function addEngineAccount(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  seams: Partial<AccountSeams> = {},
+): AddAccountResult {
+  const s = withDefaults(seams);
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  const secret = (creds.token ?? creds.apiKey ?? "").trim();
+  if (!secret) return { ok: false, message: "Paste a token or API key." };
+  if (/\s/.test(secret) || secret.length < 12) {
+    return { ok: false, message: "That doesn't look like a token. Paste just the value." };
+  }
+
+  const id = newId();
+  const now = Date.now();
+
+  if (kind === "claude") {
+    const envVar = secret.startsWith("sk-ant-api")
+      ? "ANTHROPIC_API_KEY"
+      : "CLAUDE_CODE_OAUTH_TOKEN";
+    getDb()
+      .insert(schema.engineAccounts)
+      .values({
+        id,
+        kind,
+        label: trimmedLabel,
+        authKind: "env",
+        secretEnc: packSecret(JSON.stringify({ [envVar]: secret })),
+        configDir: null,
+        createdAt: now,
+      })
+      .run();
+    return { ok: true, message: `Added Claude account "${trimmedLabel}".`, id };
+  }
+
+  if (kind === "codex") {
+    const d = KINDS.codex as KindDescriptor;
+    const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
+      s.ownerHome(),
+      id,
+    );
+    try {
+      const file = join(hostDir, "auth.json");
+      mkdirSync(hostDir, { recursive: true });
+      writeFileSync(file, `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n`, {
+        mode: 0o600,
+      });
+      try {
+        chmodSync(file, 0o600);
+      } catch {
+        /* best effort */
+      }
+    } catch (err) {
+      return {
+        ok: false,
+        message: `Could not write the account config: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      };
+    }
+    getDb()
+      .insert(schema.engineAccounts)
+      .values({
+        id,
+        kind,
+        label: trimmedLabel,
+        authKind: "config-dir",
+        secretEnc: null,
+        configDir: hostDir,
+        createdAt: now,
+      })
+      .run();
+    return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
+  }
+
+  return {
+    ok: false,
+    message: `Adding a second ${kind} account isn't supported yet — connect the primary account from the Engines panel.`,
+  };
+}
+
+/** Remove an EXTRA account (idempotent). The synthesized default can't be
+ *  removed here (use the engine disconnect flow for the legacy slot). The
+ *  isolated host config dir of a config-dir account is deleted too. */
+export function removeEngineAccount(id: string): { ok: boolean; message: string } {
+  if (id.startsWith("default:")) {
+    return {
+      ok: false,
+      message: "The default account is managed from the engine's Connect/Disconnect.",
+    };
+  }
+  const row = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .where(eq(schema.engineAccounts.id, id))
+    .get();
+  if (!row) return { ok: true, message: "Account already removed." };
+  getDb().delete(schema.engineAccounts).where(eq(schema.engineAccounts.id, id)).run();
+  if (row.authKind === "config-dir" && row.configDir) {
+    try {
+      rmSync(row.configDir, { recursive: true, force: true });
+    } catch {
+      /* best effort — the DB row is gone, which is what matters */
+    }
+  }
+  return { ok: true, message: `Removed "${row.label}".` };
+}

package/lib/engines.ts

@@ -73,8 +73,21 @@ import { dirname, join } from "node:path";
 
 import { env } from "./env";
 
-export type EngineKind = "claude" | "codex" | "kimi" | "grok" | "cursor";
-export type EngineAuthMode = "token-command" | "login-command" | "api-key";
+export type EngineKind =
+  | "claude"
+  | "codex"
+  | "kimi"
+  | "grok"
+  | "cursor"
+  | "opencode";
+export type EngineAuthMode =
+  | "token-command"
+  | "login-command"
+  | "api-key"
+  // The owner signs in with the engine's OWN interactive CLI in their terminal
+  // (e.g. `opencode auth login` — an arrow-key TUI we can't drive from the
+  // fire-and-log connect panel), and we just detect the credential it writes.
+  | "external-login";
 
 /** One entry of the engine catalog the UI's "Add engine" panel renders. */
 export interface EngineCatalogEntry {
@@ -94,6 +107,11 @@ export interface EngineCatalogEntry {
    * when the CLI is missing (null = nothing to install, e.g. Cursor).
    */
   installHint: string | null;
+  /**
+   * The command the owner runs in their OWN terminal to sign in
+   * (external-login mode only; null otherwise).
+   */
+  loginCmd: string | null;
 }
 
 interface EngineDescriptor {
@@ -104,6 +122,8 @@ interface EngineDescriptor {
   /** Pasted-API-key alternative (absent = login/token only, e.g. kimi). */
   apiKeyHint?: string;
   apiKeyUrl?: string;
+  /** external-login: the CLI command the owner runs in their terminal. */
+  loginCmd?: string;
 }
 
 /** Static descriptor table — the single source of truth for engine metadata. */
@@ -143,10 +163,28 @@ const DESCRIPTORS: Record<EngineKind, EngineDescriptor> = {
     notes: "Paste a Cursor API key. Requires Cursor Pro.",
     getKeyUrl: "https://cursor.com/dashboard?tab=integrations",
   },
+  opencode: {
+    label: "OpenCode",
+    // `opencode auth login` is an interactive arrow-key TUI (provider picker →
+    // per-provider auth) — it can't be driven from the fire-and-log connect
+    // panel, so the owner runs it in their own terminal and we detect the
+    // auth.json it writes.
+    authMode: "external-login",
+    loginCmd: "opencode auth login",
+    notes:
+      "Sign in from your terminal with `opencode auth login` (an interactive picker), then check the connection here. Activates after the next image rebuild.",
+  },
 };
 
 /** Display order (matches the cloud picker's ordering intent). */
-const ORDER: EngineKind[] = ["claude", "codex", "kimi", "grok", "cursor"];
+const ORDER: EngineKind[] = [
+  "claude",
+  "codex",
+  "kimi",
+  "grok",
+  "cursor",
+  "opencode",
+];
 
 // ---------------------------------------------------------------------------
 // Injectable seams.
@@ -318,6 +356,7 @@ export function engineCatalog(): EngineCatalogEntry[] {
       apiKeyUrl: d.apiKeyUrl ?? null,
       installHint:
         kind === "codex" ? CODEX_INSTALL_HINT : (INSTALLERS[kind] ?? null),
+      loginCmd: d.loginCmd ?? null,
     };
   });
 }
@@ -343,6 +382,7 @@ export function engineStatuses(
     kimi: detect("kimi", s),
     grok: detect("grok", s),
     cursor: detect("cursor", s),
+    opencode: detect("opencode", s),
   };
 }
 
@@ -360,7 +400,8 @@ export function isEngineKind(value: unknown): value is EngineKind {
     value === "codex" ||
     value === "kimi" ||
     value === "grok" ||
-    value === "cursor"
+    value === "cursor" ||
+    value === "opencode"
   );
 }
 
@@ -399,6 +440,20 @@ export async function connectEngine(
     return saveApiKey(kind, d, opts.apiKey ?? "", s);
   }
 
+  // external-login (OpenCode): the owner ran the engine's own interactive CLI
+  // in their terminal — we never spawn it. "Connect" just re-detects the
+  // credential that login wrote.
+  if (d.authMode === "external-login") {
+    return detect(kind, s)
+      ? { ok: true, message: `${d.label} connected.` }
+      : {
+          ok: false,
+          message: d.loginCmd
+            ? `Not signed in yet. Run \`${d.loginCmd}\` in your terminal, then check again.`
+            : `${d.label} isn't signed in yet.`,
+        };
+  }
+
   if (d.authMode === "token-command") {
     // Manual paste fallback — accept a token (or API key) without spawning.
     if (opts.pastedToken !== undefined) {
@@ -533,6 +588,7 @@ const INSTALLERS: Partial<Record<EngineKind, string>> = {
   claude: "curl -fsSL https://claude.ai/install.sh | bash",
   kimi: "curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash",
   grok: "curl -fsSL https://x.ai/cli/install.sh | bash",
+  opencode: "curl -fsSL https://opencode.ai/install | bash",
 };
 
 const CODEX_INSTALL_HINT = "brew install codex — or: npm i -g @openai/codex";
@@ -784,6 +840,7 @@ function detect(kind: EngineKind, s: EngineSeams): boolean {
       return existsSync(configPath(kind, s)) || envOrFileHas("XAI_API_KEY", s);
     case "codex":
     case "kimi":
+    case "opencode":
       return existsSync(configPath(kind, s));
   }
 }
@@ -806,6 +863,9 @@ function configPath(kind: EngineKind, s: EngineSeams): string {
   if (kind === "kimi") {
     return join(home, ".kimi-code", "credentials", "kimi-code.json");
   }
+  if (kind === "opencode") {
+    return join(home, ".local", "share", "opencode", "auth.json");
+  }
   return join(home, ".grok", "auth.json");
 }
 
@@ -840,6 +900,11 @@ function candidateBins(kind: EngineKind, s: EngineSeams): string[] {
       );
     case "grok":
       return [join(home, ".grok", "bin"), ...common].map((d) => join(d, "grok"));
+    case "opencode":
+      // opencode.ai/install lands the binary in ~/.opencode/bin.
+      return [join(home, ".opencode", "bin"), ...common].map((d) =>
+        join(d, "opencode"),
+      );
     case "cursor":
       return []; // api-key mode — never spawned
   }