feat: switch OpenCode Go usage to API

OpenCode Go now reads quota usage with a bearer API key from OpenCode auth.json
Removes the old workspace ID and browser cookie credential flow
Deletes legacy OpenCode Go credential files during upgrade

packages/web/server/lib/quota/credentials/providers.js

@@ -3,12 +3,6 @@ import { deleteQuotaCredential, readQuotaCredential, writeQuotaCredential } from
 const clean = (value) => typeof value === 'string' && !/[\r\n]/.test(value) ? value.trim() : '';
 
 export const normalizers = {
-  'opencode-go': (value) => {
-    const workspaceId = clean(value?.workspaceId);
-    let authCookie = clean(value?.authCookie);
-    if (authCookie.startsWith('auth=')) authCookie = authCookie.slice(5).trim();
-    return workspaceId && authCookie ? { workspaceId, authCookie } : null;
-  },
   'ollama-cloud': (value) => {
     const cookie = clean(value?.cookie);
     return cookie ? { cookie } : null;
@@ -35,7 +29,6 @@ export const writeManagedCredential = (providerId, value) => {
 export const getManagedCredentialStatus = (providerId) => {
   const credential = readManagedCredential(providerId);
   if (!credential) return { configured: false };
-  if (providerId === 'opencode-go') return { configured: true, workspaceId: credential.workspaceId, secretMasked: '••••••••' };
   if (providerId === 'cursor') return { configured: true, hasRefreshToken: Boolean(credential.refreshToken), secretMasked: '••••••••' };
   return { configured: true, secretMasked: '••••••••' };
 };

packages/web/server/lib/quota/credentials/store.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-const MANAGED_QUOTA_PROVIDERS = new Set(['opencode-go', 'ollama-cloud', 'cursor']);
+const MANAGED_QUOTA_PROVIDERS = new Set(['ollama-cloud', 'cursor']);
 
 const credentialsDirectory = () => path.join(
   process.env.OPENCHAMBER_DATA_DIR
@@ -46,3 +46,13 @@ export const deleteQuotaCredential = (providerId) => {
     if (error?.code !== 'ENOENT') throw error;
   }
 };
+
+// OpenCode Go used to store a browser auth cookie here. Its usage API now uses
+// OpenCode's auth.json API key, so remove the obsolete secret without reading it.
+export const deleteLegacyOpenCodeGoCredential = () => {
+  try {
+    fs.unlinkSync(path.join(credentialsDirectory(), 'opencode-go.json'));
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+};

packages/web/server/lib/quota/credentials/store.test.js

@@ -2,7 +2,7 @@ import { afterAll, describe, expect, it } from 'bun:test';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { deleteQuotaCredential, readQuotaCredential, writeQuotaCredential } from './store.js';
+import { deleteLegacyOpenCodeGoCredential, deleteQuotaCredential, readQuotaCredential, writeQuotaCredential } from './store.js';
 
 const previousDataDir = process.env.OPENCHAMBER_DATA_DIR;
 const temporaryDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-quota-store-'));
@@ -17,6 +17,14 @@ describe('quota credential store', () => {
     expect(() => writeQuotaCredential('../escape', {})).toThrow('Unsupported credential provider');
     deleteQuotaCredential('ollama-cloud');
   });
+
+  it('removes the obsolete OpenCode Go credential without parsing it', () => {
+    const legacyPath = path.join(temporaryDirectory, 'quota', 'opencode-go.json');
+    fs.mkdirSync(path.dirname(legacyPath), { recursive: true });
+    fs.writeFileSync(legacyPath, '{not valid json', { mode: 0o600 });
+    deleteLegacyOpenCodeGoCredential();
+    expect(fs.existsSync(legacyPath)).toBe(false);
+  });
 });
 
 afterAll(() => {