fix(sse): stop infinite account-fallback loop on no-auth providers (#3061) (#3062)

No-auth / keyless providers (opencode, opencode-zen) returned synthetic
"noauth" credentials BEFORE honoring excludeConnectionIds, so the chat
account-fallback loop re-selected the same synthetic connection forever on
a persistent upstream error (e.g. the opencode public endpoint answering
401 "Model X is not supported"). The synthetic id has no DB row, so
markAccountUnavailable could not persist a cooldown to brake it — each
iteration wrote key-health + request logs immediately, growing the DB until
the disk filled (see @paraflu's "failure #320" trace in discussion #3038).

Honor the exclusion set in both synthetic-credential paths
(getProviderCredentials NOAUTH_PROVIDERS block + opencode-zen keyless
fallback): once "noauth" is already excluded, return null so the handler
stops after a single attempt. The happy path (nothing excluded -> synthetic
noauth) is preserved, so keyless access still works.

Closes #3061.

Tests (TDD): tests/unit/auth-noauth-fallback-loop-3061.test.ts — the two
exclusion cases failed before the fix and pass after; two happy-path guards
ensure first-selection synthetic noauth still resolves.

src/sse/services/auth.ts

@@ -696,6 +696,14 @@ async function selectSessionAffinityConnection(
   return connection;
 }
 
+/**
+ * Sentinel connection id used for the synthetic credentials of no-auth /
+ * keyless providers (opencode / opencode-zen). It is NOT a real DB row, so it
+ * cannot carry cooldown state — the account-fallback loop must be able to
+ * exclude it (#3061), otherwise it gets re-selected forever.
+ */
+const SYNTHETIC_NOAUTH_CONNECTION_ID = "noauth";
+
 function normalizeExcludedConnectionIds(
   excludeConnectionId: string | null,
   extraExcludedConnectionIds: string[] | null | undefined
@@ -831,6 +839,19 @@ export async function getProviderCredentials(
       WEB_COOKIE_PROVIDERS as Record<string, { noAuth?: boolean } | undefined>,
     ];
     if (providerMaps.some((map) => map[resolvedId]?.noAuth)) {
+      // #3061: there is only one synthetic "noauth" connection for a no-auth
+      // provider. If the caller already tried and excluded it (account-fallback
+      // after a persistent upstream error), do NOT hand it back — that would let
+      // the chat fallback loop re-select "noauth" forever (no real DB row → no
+      // cooldown to brake it), writing logs every iteration until the disk fills.
+      // Returning null here lets the handler stop after a single attempt.
+      const excludedForNoAuth = normalizeExcludedConnectionIds(
+        excludeConnectionId,
+        options.excludeConnectionIds
+      );
+      if (excludedForNoAuth.has(SYNTHETIC_NOAUTH_CONNECTION_ID)) {
+        return null;
+      }
       return {
         apiKey: null,
         accessToken: null,
@@ -839,7 +860,7 @@ export async function getProviderCredentials(
         projectId: null,
         copilotToken: null,
         providerSpecificData: {},
-        connectionId: "noauth",
+        connectionId: SYNTHETIC_NOAUTH_CONNECTION_ID,
         testStatus: "active",
         lastError: null,
         lastErrorType: null,
@@ -953,6 +974,12 @@ export async function getProviderCredentials(
       // OpenCode free model. A configured, active key is still selected above; a
       // rate-limited/terminal key returns its own signal before reaching here.
       if (resolvedId === "opencode-zen") {
+        // #3061: same loop guard as the NOAUTH_PROVIDERS path above — once the
+        // single synthetic "noauth" connection has been excluded by the chat
+        // fallback loop, return null instead of re-handing it back forever.
+        if (excludedConnectionIds.has(SYNTHETIC_NOAUTH_CONNECTION_ID)) {
+          return null;
+        }
         return {
           apiKey: null,
           accessToken: null,
@@ -961,7 +988,7 @@ export async function getProviderCredentials(
           projectId: null,
           copilotToken: null,
           providerSpecificData: {},
-          connectionId: "noauth",
+          connectionId: SYNTHETIC_NOAUTH_CONNECTION_ID,
           testStatus: "active",
           lastError: null,
           lastErrorType: null,

tests/unit/auth-noauth-fallback-loop-3061.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Issue #3061 — No-auth providers (opencode / opencode-zen) infinite
+ * account-fallback loop on a persistent upstream error → unbounded DB growth /
+ * disk exhaustion.
+ *
+ * For a no-auth provider, getProviderCredentials early-returns synthetic
+ * credentials with connectionId "noauth" BEFORE honoring the exclusion set
+ * (src/sse/services/auth.ts: the NOAUTH_PROVIDERS block and the opencode-zen
+ * keyless fallback). So when the chat fallback loop marks the failed "noauth"
+ * connection and excludes it, the selector hands "noauth" right back → it loops
+ * forever, writing key-health + request logs every iteration until the disk
+ * fills (see @paraflu's "failure #320" trace in discussion #3038).
+ *
+ * Loop-breaking invariant under test: once "noauth" is in excludeConnectionIds,
+ * the selector MUST return null (no remaining candidate) so the chat handler
+ * stops after a single attempt instead of re-selecting the same synthetic
+ * connection. The happy-path (nothing excluded → synthetic noauth) must stay
+ * intact so keyless access still works.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-noauth-loop-3061-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { getProviderCredentials } = await import("../../src/sse/services/auth.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// ── Happy path preserved: first selection (nothing excluded) still works ──
+
+test("#3061 opencode no-auth: first selection returns synthetic noauth (happy path preserved)", async () => {
+  const creds = await getProviderCredentials("opencode", null, null, "minimax-m2.5-free");
+  assert.ok(creds, "opencode must resolve to synthetic no-auth credentials on first selection");
+  assert.equal((creds as { connectionId?: string }).connectionId, "noauth");
+  assert.equal((creds as { apiKey?: unknown }).apiKey, null);
+});
+
+test("#3061 opencode-zen no-auth: first selection returns synthetic noauth (happy path preserved)", async () => {
+  const creds = await getProviderCredentials("opencode-zen");
+  assert.ok(creds, "opencode-zen must resolve to synthetic no-auth credentials on first selection");
+  assert.equal((creds as { connectionId?: string }).connectionId, "noauth");
+});
+
+// ── The fix: once "noauth" is excluded, selection MUST stop (return null) ──
+
+test("#3061 opencode no-auth: excluding 'noauth' returns null (breaks the fallback loop)", async () => {
+  const creds = await getProviderCredentials("opencode", null, null, "minimax-m2.5-free", {
+    excludeConnectionIds: ["noauth"],
+  });
+  assert.equal(
+    creds,
+    null,
+    "after the synthetic noauth connection failed and was excluded, the selector must return " +
+      "null instead of handing back 'noauth' (which would loop forever and fill the disk)"
+  );
+});
+
+test("#3061 opencode-zen no-auth: excluding 'noauth' returns null (breaks the fallback loop)", async () => {
+  const creds = await getProviderCredentials("opencode-zen", null, null, null, {
+    excludeConnectionIds: ["noauth"],
+  });
+  assert.equal(
+    creds,
+    null,
+    "excluded synthetic noauth must not be re-selected for the opencode-zen keyless path"
+  );
+});