feat(plugin): fall back to OpenCode-stored /connect credentials for plugin auth

[HarelMil]

Summary

The plugin's own health-check and /v1/models discovery fetches only ever read options.apiKey or the LITELLM_API_KEY / LITELLM_MASTER_KEY env vars, so a key stored via OpenCode's /connect command was invisible to them — a key-only proxy failed the health check with a 401 and silently skipped discovery. This PR makes the plugin fall back to that stored credential and writes the resolved key back into the provider options so real chat completions authenticate too. Closes #8.

Type of change

• 🐛 Bug fix (non-breaking)
• ✨ New feature (non-breaking)
• 💥 Breaking change
• 📝 Documentation only
• 🔧 Internal / refactor

Checklist

• npm run typecheck passes
• No new runtime dependencies (or justified in this PR description)
• README updated if public API or behavior changed
• CHANGELOG.md updated under ## [Unreleased]
• Commit messages follow Conventional Commits

How was this tested?

Tested against a live remote LiteLLM deployment configured with a master key (no options.apiKey / env var set, credential added via OpenCode /connect only). OpenCode version: 1.18.16. LiteLLM version: N/A (remote deployment).

Representative log line:

[opencode-litellm] Discovered 97 models for provider "litellm" from https://redacted-endpoint (79 added, 17 non-chat hidden)

Screenshots / logs (optional)

[opencode-litellm] Discovered 97 models for provider "litellm" from https://redacted-endpoint (79 added, 17 non-chat hidden)

Summary by CodeRabbit

• New Features

  • Added OpenCode /connect credential support as a fallback for authentication.
  • Authenticated health checks, model discovery, and completion requests now use stored credentials when no configured or environment key is available.

• Documentation

  • Updated authentication guidance to explain OpenCode credential setup and fallback behavior.
  • Added the change to the unreleased changelog.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e3c7ec35-ce12-4909-acc8-1baeeeb7671e

📥 Commits

Reviewing files that changed from the base of the PR and between a588826 and 062ee16.

📒 Files selected for processing (4)

• CHANGELOG.md
• README.md
• src/plugin/index.ts
• src/utils/opencode-auth.ts

🚧 Files skipped from review as they are similar to previous changes (4)

• README.md
• CHANGELOG.md
• src/utils/opencode-auth.ts
• src/plugin/index.ts

---

📝 Walkthrough

Walkthrough

The plugin now uses OpenCode’s stored auth.json credential as a fallback for LiteLLM health checks, model discovery, and completions. Configured keys take precedence, followed by environment variables and stored credentials.

Changes

LiteLLM credential fallback

Layer / File(s)	Summary
OpenCode auth-file lookup src/utils/opencode-auth.ts	Loads and caches OpenCode credentials, resolves non-empty API keys by provider ID, handles invalid or unavailable files, and provides a test cache reset.
Plugin resolution and documentation src/plugin/index.ts, README.md, CHANGELOG.md	Uses configured, environment, then stored credentials for provider options. Documents the /connect workflow and fallback behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant LiteLLMDiscovery
  participant Plugin
  participant OpenCodeAuthJson
  participant LiteLLMAPI
  LiteLLMDiscovery->>Plugin: initialize provider options
  Plugin->>OpenCodeAuthJson: read stored credential when needed
  OpenCodeAuthJson-->>Plugin: return provider API key
  Plugin->>LiteLLMAPI: send authenticated health-check or discovery request

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: plugin authentication falls back to credentials stored by OpenCode's /connect command.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 247: Update the OpenCode `/connect` table row in README.md to add the
missing trailing pipe delimiter, preserving the existing row content.

In `@src/plugin/index.ts`:
- Around line 224-232: Normalize blank credentials to unavailable values before
precedence selection. In src/plugin/index.ts lines 224-232, update the
environment credential handling around envKey so blank LITELLM_API_KEY and
LITELLM_MASTER_KEY values do not override lower-priority credentials. In
src/utils/opencode-auth.ts lines 68-74, update the type: "api" key handling so a
blank stored key is treated as unavailable; preserve fallback to the next valid
credential in both sites.
- Around line 227-229: Correct the custom-provider authentication description:
in src/plugin/index.ts lines 227-229, qualify or remove the claim that OpenCode
automatically injects auth.json credentials; in README.md line 249, state that
the plugin applies the stored key to its custom-provider flow; and in
CHANGELOG.md lines 54-60, document that the fix enables authenticated discovery
and authenticated custom-provider completions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 54571db0-d002-41d2-b9ed-8f55237fdc84

📥 Commits

Reviewing files that changed from the base of the PR and between f7a20e0 and a588826.

📒 Files selected for processing (4)

• CHANGELOG.md
• README.md
• src/plugin/index.ts
• src/utils/opencode-auth.ts

[HarelMil]

@yuseferi would appreciate your review :)