fix(core): persist rotated org credentials

packages/core/src/plugin/provider/opencode.ts

@@ -28,6 +28,7 @@ const Token = Schema.Struct({
   access_token: Schema.String,
   refresh_token: Schema.String,
   expires_in: Schema.Number,
+  org_id: Schema.optional(Schema.NullOr(Schema.String)),
 })
 const TokenPending = Schema.Struct({ error: Schema.String })
 const DeviceToken = Schema.Union([Token, TokenPending])
@@ -62,20 +63,32 @@ function oauth(http: HttpClient.HttpClient) {
           callback: poll(http, server, device.device_code, Duration.seconds(device.interval)),
         }
       }),
-    refresh: (credential) =>
+    refresh: (current) =>
       Effect.gen(function* () {
-        const server = typeof credential.metadata?.server === "string" ? credential.metadata.server : defaultServer
+        const server = typeof current.metadata?.server === "string" ? current.metadata.server : defaultServer
         const token = yield* post(
           http,
           `${server}/auth/device/token`,
-          { grant_type: "refresh_token", refresh_token: credential.refresh, client_id: clientID },
+          { grant_type: "refresh_token", refresh_token: current.refresh, client_id: clientID },
           Token,
         )
+        // Persist rotated tokens without depending on discovery requests.
         return {
-          ...credential,
+          ...current,
           access: token.access_token,
           refresh: token.refresh_token,
           expires: Date.now() + token.expires_in * 1000,
+          metadata:
+            token.org_id == null
+              ? current.metadata
+              : {
+                  ...current.metadata,
+                  orgID: token.org_id,
+                  orgName:
+                    current.metadata?.orgID === token.org_id && typeof current.metadata.orgName === "string"
+                      ? current.metadata.orgName
+                      : token.org_id,
+                },
         }
       }),
     label: (credential) => (typeof credential.metadata?.orgName === "string" ? credential.metadata.orgName : undefined),
@@ -300,7 +313,13 @@ function credential(http: HttpClient.HttpClient, server: string, token: typeof T
       ],
       { concurrency: 2 },
     )
-    const org = orgs.toSorted((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id))[0]
+    const org =
+      token.org_id == null
+        ? orgs.toSorted((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id))[0]
+        : orgs.find((org) => org.id === token.org_id)
+    if (token.org_id != null && !org) {
+      return yield* Effect.fail(new Error(`OpenCode organization not found: ${token.org_id}`))
+    }
     return Credential.OAuth.make({
       type: "oauth" as const,
       methodID,

packages/core/test/plugin/provider-opencode.test.ts

@@ -21,6 +21,47 @@ const addPlugin = Effect.fn(function* () {
   yield* OpencodePlugin.effect(host)
 })
 
+function consoleServer(orgID: string | null | undefined, unavailable = false) {
+  const config: { authorization: string | null; orgID: string | null }[] = []
+  const requests: string[] = []
+  const server = Bun.serve({
+    port: 0,
+    fetch: (request) => {
+      const path = new URL(request.url).pathname
+      requests.push(path)
+      if (path === "/auth/device/code") {
+        return Response.json({
+          device_code: "device",
+          user_code: "user",
+          verification_uri_complete: "/device?user_code=user",
+          expires_in: 60,
+          interval: 0,
+        })
+      }
+      if (path === "/auth/device/token") {
+        return Response.json({ access_token: "access", refresh_token: "refresh", expires_in: 600, org_id: orgID })
+      }
+      if (unavailable && (path === "/api/user" || path === "/api/orgs")) {
+        return new Response("Unavailable", { status: 503 })
+      }
+      if (path === "/api/user") return Response.json({ id: "user", email: "user@example.com" })
+      if (path === "/api/orgs") {
+        return Response.json([
+          { id: "org-z", name: "Zebra" },
+          { id: "org-a", name: "Alpha" },
+        ])
+      }
+      if (path === "/api/config") {
+        config.push({ authorization: request.headers.get("authorization"), orgID: request.headers.get("x-org-id") })
+        if (orgID === "org-missing") return new Response("Forbidden", { status: 403 })
+        return Response.json({ config: {} })
+      }
+      return new Response("Not found", { status: 404 })
+    },
+  })
+  return { server, config, requests }
+}
+
 function required<T>(value: T | undefined): T {
   if (value === undefined) throw new Error("Expected value")
   return value
@@ -157,6 +198,119 @@ describe("OpencodePlugin", () => {
     ),
   )
 
+  for (const orgID of ["org-z", undefined, null, "org-missing"]) {
+    it.live(`uses the device token organization during authorization: ${orgID}`, () =>
+      Effect.acquireUseRelease(
+        Effect.sync(() => consoleServer(orgID)),
+        ({ server, config }) =>
+          Effect.gen(function* () {
+            yield* addPlugin()
+            const integrations = yield* Integration.Service
+            const credentials = yield* Credential.Service
+            const integrationID = Integration.ID.make("opencode")
+            const attempt = yield* integrations.oauth.connect({
+              integrationID,
+              methodID: Integration.MethodID.make("device"),
+              answer: { server: server.url.origin },
+            })
+            const status = yield* eventually(
+              integrations.oauth.status({ integrationID, attemptID: attempt.attemptID }),
+              (status) => status.status !== "pending",
+            )
+            if (orgID === "org-missing") {
+              expect(status).toMatchObject({
+                status: "failed",
+                message: "OpenCode organization not found: org-missing",
+              })
+              expect(yield* credentials.list(integrationID)).toEqual([])
+              expect(config).toEqual([])
+              return
+            }
+            expect(status.status).toBe("complete")
+            expect((yield* credentials.list(integrationID))[0]).toMatchObject({
+              label: orgID === "org-z" ? "Zebra" : "Alpha",
+              value: {
+                type: "oauth",
+                access: "access",
+                refresh: "refresh",
+                metadata: {
+                  server: server.url.origin,
+                  accountID: "user",
+                  email: "user@example.com",
+                  orgID: orgID ?? "org-a",
+                  orgName: orgID === "org-z" ? "Zebra" : "Alpha",
+                },
+              },
+            })
+            yield* eventually(
+              Effect.sync(() => config.length),
+              (count) => count > 0,
+            )
+            expect(config).toEqual([{ authorization: "Bearer access", orgID: orgID ?? "org-a" }])
+          }),
+        ({ server }) => Effect.promise(() => server.stop(true)),
+      ),
+    )
+  }
+
+  for (const scenario of [
+    { orgID: "org-z" },
+    { orgID: undefined },
+    { orgID: null },
+    { orgID: "org-missing" },
+    { orgID: "org-z", unavailable: true },
+    { orgID: "org-a", unavailable: true },
+  ]) {
+    it.live(
+      `persists rotated credentials for ${scenario.orgID}${scenario.unavailable ? " with discovery unavailable" : ""}`,
+      () =>
+        Effect.acquireUseRelease(
+          Effect.sync(() => consoleServer(scenario.orgID, scenario.unavailable)),
+          ({ server, config, requests }) =>
+            Effect.gen(function* () {
+              const credentials = yield* Credential.Service
+              const initial = yield* credentials.create({
+                integrationID: Integration.ID.make("opencode"),
+                label: "Custom label",
+                value: Credential.OAuth.make({
+                  type: "oauth",
+                  methodID: Integration.MethodID.make("device"),
+                  access: "expired-access",
+                  refresh: "old-refresh",
+                  expires: 0,
+                  metadata: { server: server.url.origin, orgID: "org-a", orgName: "Alpha", custom: "preserved" },
+                }),
+              })
+              yield* addPlugin()
+              const stored = required(yield* credentials.get(initial.id))
+              expect(stored).toMatchObject({
+                label: "Custom label",
+                value: {
+                  access: "access",
+                  refresh: "refresh",
+                  metadata: {
+                    server: server.url.origin,
+                    orgID: scenario.orgID ?? "org-a",
+                    orgName: scenario.orgID === "org-a" ? "Alpha" : (scenario.orgID ?? "Alpha"),
+                    custom: "preserved",
+                  },
+                },
+              })
+              if (stored.value.type !== "oauth") throw new Error("Expected OAuth credential")
+              expect(stored.value.expires).toBeGreaterThan(Date.now())
+              if (scenario.orgID == null) expect(stored.value.metadata).toEqual(initial.value.metadata)
+              expect(config).toEqual([{ authorization: "Bearer access", orgID: scenario.orgID ?? "org-a" }])
+              const integrations = yield* Integration.Service
+              expect(
+                yield* integrations.connection.resolve({ type: "credential", id: initial.id, label: initial.label }),
+              ).toEqual(stored.value)
+              expect(requests).toEqual(["/auth/device/token", "/api/config"])
+            }),
+          ({ server }) => Effect.promise(() => server.stop(true)),
+        ),
+    )
+  }
+
   it.effect("rejects non-HTTP OpenCode servers", () =>
     Effect.gen(function* () {
       yield* addPlugin()