Repository navigation
fix(server): mirror personal API keys into OpenCode v2 - #6465
Merged
Merged
Conversation
The bundled OpenCode v1 answers GET /provider with Provider.Info: no top-level npm or api, the package and endpoint live on each model, and models describe capabilities. The v2 mirror read the models.dev shape, so every key added in AI Providers (OpenRouter, OpenAI, Anthropic) was skipped and never reached the chat model picker. Behind localProviderMirror (off), the mirror translates Provider.Info, keeps the trusted-origin check, never takes a key, baseURL or header from the catalog, and reports every provider it does not mirror with a reason (policy, oauth, unsupported, metadata, credentials) in a new skippedProviders status field. Independently of the rollout, "Only models you provide" now applies to the v2 mirror the same way v1 applies enabled_providers: personal providers, local or configured, never reach v2 when the organization allows only its own. Both engines share one rule. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
On the new engine, Settings › AI Providers reads the server's skipped list instead of assuming every key on this device works: a provider the organization does not allow keeps its row with a lock and "<organization> manages AI providers", and a sign-in the new engine cannot use yet reads "Not available on the new engine yet". A skipped provider never shows Ready to use. Older servers and the rollout switched off keep today's rows. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
AI Providers lists providers from OpenCode v1, which caches them per folder. On v2 the app no longer disposes v1 after saving a key, so a new key stayed invisible in AI Providers until a restart. With the localProviderMirror rollout, the server rebuilds v1's provider state for the folder right after it mirrors the change into v2, never while v1 is running work. Provider sign-in callbacks now trigger the same mirror. The rollout is read from Den on every mirror with a short wait; a slow or unreachable Den falls back to the answer last verified for the sign-in, and cloud provider sync re-checks it so turning the rollout off applies without a restart. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
A signed-in Acme owner on v2 saves an OpenRouter key: with the rollout off the engine drops it and the picker says OpenRouter isn't connected; with it on, AI Providers reads Ready to use and the picker lists its models. A ChatGPT sign-in reads Not available on the new engine yet, and once Acme allows only its own providers OpenRouter leaves the picker while its row stays with a lock. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Adds the author and internal docs link the registry now requires, with screenshots of the picker and AI Providers states from the proof run. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
benjaminshafii
changed the title
benjaminshafii
had a problem deploying
to
pr-internal-specs
October 24, 2026 01:21 — with 
GitHub Actions
Error
GitHub Actions
Error
Contributor
![diff-warden[bot]](https://avatars.githubusercontent.com/u/118544361?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of 491183238ca0ed1422b51f27407bf59a95b73b20 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
Contributor
Warden: approvedNo high or medium security findings and no confidentiality findings. Reviewed |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this about?
On OpenCode v2, API keys added in AI Providers (OpenRouter, OpenAI, Anthropic) reach the chat model picker, and AI Providers says when v2 can't use a provider.
What problem does it solve?
Personal keys never reached v2. Fixing only that would let any auth.json key reach v2 even when the organization allows only its own providers.
What was the situation before?
After saving an OpenRouter key, AI Providers listed nothing and the picker said "OpenRouter isn't connected in this workspace". A ChatGPT sign-in looked connected but was missing from chat.
How is this implemented?
opencode-v2-local-auth.tstranslates v1's Provider.Info to the shape the mirror reads. Keys come only from auth.json; catalog keys,baseURLand headers are dropped; the trusted-origin check stays. Skips are reported asskippedProviders: [{id, reason}].organization-provider-gate.tsis the one rule for v1enabled_providersand the v2 mirror, independent of the flag.ProviderStatusgains alockedtone.localProviderMirror(cloud and self-hosted, off). Off keeps today's mirror.What else changed?
Release note
With "Only models you provide", providers added on a computer no longer reach the new engine's model picker, matching the classic engine.
Evidence
evals/proofs/v2-local-provider-mirror.proof.test.ts— before: the engine skips the saved key; after: Ready to use, OpenRouter in the picker, sign-in "Not available on the new engine yet", blocked row locked. Fails on dev at step 2.Follow-up: ENG-888 (share with team, ask an admin, OAuth on v2).
Design: P1, P4, P5, C5, P10