Skip to content

fix(opencode-go): fetch models unconditionally — the /models endpoint is public #437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
navedmerchant merged 4 commits into from
Jun 19, 2026
Merged

fix(opencode-go): fetch models unconditionally — the /models endpoint is public #437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
95d0fca
fix(opencode-go): fetch models unconditionally — the /models endpoint…
proyectoauraorg Jun 1, 2026
e06e845
test: update ClineProvider.spec.ts assertions for unconditional openc…
proyectoauraorg Jun 2, 2026
a3683a5
Merge branch 'main' into fix/172-opencode-go-models-no-auth
navedmerchant Jun 19, 2026
4a5684a
add refresh button and update coverage
navedmerchant Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions src/core/webview/__tests__/ClineProvider.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2580,6 +2580,8 @@ describe("ClineProvider - Router Models", () => {
apiKey: "litellm-key",
baseUrl: "http://localhost:4000",
})
// Opencode Go's /models endpoint is public, so it is fetched like the other no-auth routers.
expect(getModels).toHaveBeenCalledWith(expect.objectContaining({ provider: "opencode-go" }))

// Verify response was sent
expect(mockPostMessage).toHaveBeenCalledWith({
Expand All @@ -2595,7 +2597,7 @@ describe("ClineProvider - Router Models", () => {
lmstudio: {},
poe: {},
deepseek: {},
"opencode-go": {},
"opencode-go": mockModels,
},
values: undefined,
})
Expand Down Expand Up @@ -2627,6 +2629,7 @@ describe("ClineProvider - Router Models", () => {
.mockResolvedValueOnce(mockModels) // vercel-ai-gateway success
.mockResolvedValueOnce(mockModels) // zoo-gateway success
.mockRejectedValueOnce(new Error("LiteLLM connection failed")) // litellm fail
.mockResolvedValueOnce(mockModels) // opencode-go (public endpoint)

await messageHandler({ type: "requestRouterModels" })

Expand All @@ -2644,7 +2647,7 @@ describe("ClineProvider - Router Models", () => {
litellm: {},
poe: {},
deepseek: {},
"opencode-go": {},
"opencode-go": mockModels,
},
values: undefined,
})
Expand Down Expand Up @@ -2741,7 +2744,7 @@ describe("ClineProvider - Router Models", () => {
lmstudio: {},
poe: {},
deepseek: {},
"opencode-go": {},
"opencode-go": mockModels,
},
values: undefined,
})
Expand Down
38 changes: 35 additions & 3 deletions src/core/webview/__tests__/webviewMessageHandler.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,6 +366,8 @@ describe("webviewMessageHandler - requestRouterModels", () => {
apiKey: "litellm-key",
baseUrl: "http://localhost:4000",
})
// Opencode Go's /models endpoint is public, so it is fetched like the other no-auth routers.
expect(mockGetModels).toHaveBeenCalledWith(expect.objectContaining({ provider: "opencode-go" }))

// Verify response was sent
expect(mockClineProvider.postMessageToWebview).toHaveBeenCalledWith({
Expand All @@ -381,12 +383,41 @@ describe("webviewMessageHandler - requestRouterModels", () => {
lmstudio: {},
poe: {},
deepseek: {},
"opencode-go": {},
"opencode-go": mockModels,
},
values: undefined,
})
})

it("fetches Opencode Go models without an API key (public /models endpoint, regression for empty picker)", async () => {
mockClineProvider.getState = vi.fn().mockResolvedValue({
apiConfiguration: {
openRouterApiKey: "openrouter-key",
// Deliberately no opencodeGoApiKey — the endpoint is public.
},
})

const mockModels: ModelRecord = {
"glm-5.1": {
maxTokens: 4096,
contextWindow: 8192,
supportsPromptCache: false,
description: "GLM 5.1",
},
}
mockGetModels.mockResolvedValue(mockModels)

await webviewMessageHandler(mockClineProvider, { type: "requestRouterModels" })

// Must be fetched despite no configured key, forwarding apiKey: undefined.
expect(mockGetModels).toHaveBeenCalledWith({ provider: "opencode-go", apiKey: undefined })

const routerModelsCall = (mockClineProvider.postMessageToWebview as any).mock.calls.find(
([msg]: [{ type: string }]) => msg.type === "routerModels",
)
expect(routerModelsCall?.[0].routerModels["opencode-go"]).toEqual(mockModels)
})

it("handles LiteLLM models with values from message when config is missing", async () => {
mockClineProvider.getState = vi.fn().mockResolvedValue({
apiConfiguration: {
Expand Down Expand Up @@ -469,7 +500,7 @@ describe("webviewMessageHandler - requestRouterModels", () => {
lmstudio: {},
poe: {},
deepseek: {},
"opencode-go": {},
"opencode-go": mockModels,
},
values: undefined,
})
Expand All @@ -493,6 +524,7 @@ describe("webviewMessageHandler - requestRouterModels", () => {
.mockResolvedValueOnce(mockModels) // vercel-ai-gateway
.mockResolvedValueOnce(mockModels) // zoo-gateway
.mockRejectedValueOnce(new Error("LiteLLM connection failed")) // litellm
.mockResolvedValueOnce(mockModels) // opencode-go

await webviewMessageHandler(mockClineProvider, {
type: "requestRouterModels",
Expand Down Expand Up @@ -527,7 +559,7 @@ describe("webviewMessageHandler - requestRouterModels", () => {
lmstudio: {},
poe: {},
deepseek: {},
"opencode-go": {},
"opencode-go": mockModels,
},
values: undefined,
})
Expand Down
23 changes: 13 additions & 10 deletions src/core/webview/webviewMessageHandler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1034,20 +1034,23 @@ export const webviewMessageHandler = async (
})
}

// Opencode Go is conditional on apiKey (its /models endpoint requires auth)
// Opencode Go's /models endpoint is public — it returns the full model list with no
// Authorization header — so it's fetched unconditionally like openrouter/vercel-ai-gateway
// above. Gating it behind a key meant the picker stayed empty (and fell back to the default
// model) whenever the key wasn't yet in apiConfiguration at fetch time. The key is still
// forwarded when present.
const opencodeGoApiKey = message?.values?.opencodeGoApiKey ?? apiConfiguration.opencodeGoApiKey

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Wrap the variable declaration in a block to fix scoping issue.

The const opencodeGoApiKey declaration inside the switch case should be wrapped in curly braces to prevent potential scoping conflicts with other switch clauses.

🔧 Proposed fix 
-			const opencodeGoApiKey = message?.values?.opencodeGoApiKey ?? apiConfiguration.opencodeGoApiKey
-
-			// Refresh the cache when a new key is explicitly provided (e.g. the Refresh Models button).
-			if (message?.values?.opencodeGoApiKey) {
-				await flushModels({ provider: "opencode-go", apiKey: opencodeGoApiKey }, true)
-			}
-
-			candidates.push({
-				key: "opencode-go",
-				options: { provider: "opencode-go", apiKey: opencodeGoApiKey },
-			})
+			{
+				const opencodeGoApiKey = message?.values?.opencodeGoApiKey ?? apiConfiguration.opencodeGoApiKey
+
+				// Refresh the cache when a new key is explicitly provided (e.g. the Refresh Models button).
+				if (message?.values?.opencodeGoApiKey) {
+					await flushModels({ provider: "opencode-go", apiKey: opencodeGoApiKey }, true)
+				}
+
+				candidates.push({
+					key: "opencode-go",
+					options: { provider: "opencode-go", apiKey: opencodeGoApiKey },
+				})
+			}

As per coding guidelines, Biome flagged: "Other switch clauses can erroneously access this declaration. Wrap the declaration in a block to restrict its access to the switch clause."

🧰 Tools
🪛 Biome (2.4.16)

[error] 1021-1021: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/core/webview/webviewMessageHandler.ts` at line 1021, The const
declaration for opencodeGoApiKey inside the switch case has function-level
scoping risk; wrap that switch case's body in a block (add { } around the case's
statements) so opencodeGoApiKey is block-scoped and cannot be accessed by other
switch clauses—locate the switch in webviewMessageHandler.ts where
opencodeGoApiKey is assigned and enclose the case's statements in a local block.


if (opencodeGoApiKey) {
if (message?.values?.opencodeGoApiKey) {
await flushModels({ provider: "opencode-go", apiKey: opencodeGoApiKey }, true)
}

candidates.push({
key: "opencode-go",
options: { provider: "opencode-go", apiKey: opencodeGoApiKey },
})
// Refresh the cache when a new key is explicitly provided (e.g. the Refresh Models button).
if (message?.values?.opencodeGoApiKey) {
await flushModels({ provider: "opencode-go", apiKey: opencodeGoApiKey }, true)
}

candidates.push({
key: "opencode-go",
options: { provider: "opencode-go", apiKey: opencodeGoApiKey },
})

// Apply single provider filter if specified
const modelFetchPromises = providerFilter
? candidates.filter(({ key }) => key === providerFilter)
Expand Down
72 changes: 71 additions & 1 deletion webview-ui/src/components/settings/providers/OpenCodeGo.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,20 @@
import { useCallback } from "react"
import { useCallback, useState, useEffect, useRef } from "react"
import { VSCodeTextField } from "@vscode/webview-ui-toolkit/react"

import {
type ProviderSettings,
type OrganizationAllowList,
type RouterModels,
type ExtensionMessage,
opencodeGoDefaultModelId,
} from "@roo-code/types"

import type { RouterName } from "@roo/api"

import { vscode } from "@src/utils/vscode"
import { useAppTranslation } from "@src/i18n/TranslationContext"
import { VSCodeButtonLink } from "@src/components/common/VSCodeButtonLink"
import { Button } from "@src/components/ui"

import { inputEventTransform } from "../transforms"
import { ModelPicker } from "../ModelPicker"
Expand All @@ -32,6 +37,34 @@ export const OpenCodeGo = ({
simplifySettings,
}: OpenCodeGoProps) => {
const { t } = useAppTranslation()
const [refreshStatus, setRefreshStatus] = useState<"idle" | "loading" | "success" | "error">("idle")
const [refreshError, setRefreshError] = useState<string | undefined>()
const errorJustReceived = useRef(false)

useEffect(() => {
const handleMessage = (event: MessageEvent<ExtensionMessage>) => {
const message = event.data
if (message.type === "singleRouterModelFetchResponse" && !message.success) {
const providerName = message.values?.provider as RouterName
if (providerName === "opencode-go") {
errorJustReceived.current = true
setRefreshStatus("error")
setRefreshError(message.error)
}
} else if (message.type === "routerModels") {
if (refreshStatus === "loading") {
if (!errorJustReceived.current) {
setRefreshStatus("success")
}
}
Comment on lines +54 to +59

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Gate success state to Opencode-Go responses only.

While loading, any routerModels message sets success. Since this listener is on the shared window bus, unrelated provider responses can incorrectly mark the Opencode-Go refresh as successful. Check message.values?.provider === "opencode-go" before setting "success".

Suggested fix 
-			} else if (message.type === "routerModels") {
+			} else if (message.type === "routerModels") {
+				const providerName = message.values?.provider
 				if (refreshStatus === "loading") {
-					if (!errorJustReceived.current) {
+					if (providerName === "opencode-go" && !errorJustReceived.current) {
 						setRefreshStatus("success")
 					}
 				}
 			}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
} else if (message.type === "routerModels") {
if (refreshStatus === "loading") {
if (!errorJustReceived.current) {
setRefreshStatus("success")
}
}
} else if (message.type === "routerModels") {
const providerName = message.values?.provider
if (refreshStatus === "loading") {
if (providerName === "opencode-go" && !errorJustReceived.current) {
setRefreshStatus("success")
}
}
}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@webview-ui/src/components/settings/providers/OpenCodeGo.tsx` around lines 54
- 59, The code sets refreshStatus to "success" whenever a "routerModels" message
is received while loading, but since this listener is on a shared window bus,
other providers' messages can incorrectly trigger success for Opencode-Go. Add
an additional condition to check that message.values?.provider === "opencode-go"
in the else if block where message.type === "routerModels" before calling
setRefreshStatus("success") to ensure only actual Opencode-Go responses mark the
refresh as successful.

}
}

window.addEventListener("message", handleMessage)
return () => {
window.removeEventListener("message", handleMessage)
}
}, [refreshStatus])

const handleInputChange = useCallback(
<K extends keyof ProviderSettings, E>(
Expand All @@ -44,6 +77,16 @@ export const OpenCodeGo = ({
[setApiConfigurationField],
)

const handleRefreshModels = useCallback(() => {
errorJustReceived.current = false
setRefreshStatus("loading")
setRefreshError(undefined)
vscode.postMessage({
type: "requestRouterModels",
values: { provider: "opencode-go", refresh: true, opencodeGoApiKey: apiConfiguration.opencodeGoApiKey },
})
}, [apiConfiguration.opencodeGoApiKey])

return (
<>
<VSCodeTextField
Expand All @@ -62,6 +105,33 @@ export const OpenCodeGo = ({
{t("settings:providers.getOpencodeGoApiKey")}
</VSCodeButtonLink>
)}
<Button
variant="outline"
onClick={handleRefreshModels}
disabled={refreshStatus === "loading"}
className="w-full">
<div className="flex items-center gap-2">
{refreshStatus === "loading" ? (
<span className="codicon codicon-loading codicon-modifier-spin" />
) : (
<span className="codicon codicon-refresh" />
)}
{t("settings:providers.refreshModels.label")}
</div>
</Button>
{refreshStatus === "loading" && (
<div className="text-sm text-vscode-descriptionForeground">
{t("settings:providers.refreshModels.loading")}
</div>
)}
{refreshStatus === "success" && (
<div className="text-sm text-vscode-foreground">{t("settings:providers.refreshModels.success")}</div>
)}
{refreshStatus === "error" && (
<div className="text-sm text-vscode-errorForeground">
{refreshError || t("settings:providers.refreshModels.error")}
</div>
)}
<ModelPicker
apiConfiguration={apiConfiguration}
setApiConfigurationField={setApiConfigurationField}
Expand Down
Loading
Loading