fix(sse): stop infinite account-fallback loop on no-auth providers (#3061) (#3062)

No-auth / keyless providers (opencode, opencode-zen) returned synthetic
"noauth" credentials BEFORE honoring excludeConnectionIds, so the chat
account-fallback loop re-selected the same synthetic connection forever on
a persistent upstream error (e.g. the opencode public endpoint answering
401 "Model X is not supported"). The synthetic id has no DB row, so
markAccountUnavailable could not persist a cooldown to brake it — each
iteration wrote key-health + request logs immediately, growing the DB until
the disk filled (see @paraflu's "failure #320" trace in discussion #3038).

Honor the exclusion set in both synthetic-credential paths
(getProviderCredentials NOAUTH_PROVIDERS block + opencode-zen keyless
fallback): once "noauth" is already excluded, return null so the handler
stops after a single attempt. The happy path (nothing excluded -> synthetic
noauth) is preserved, so keyless access still works.

Closes #3061.

Tests (TDD): tests/unit/auth-noauth-fallback-loop-3061.test.ts — the two
exclusion cases failed before the fix and pass after; two happy-path guards
ensure first-selection synthetic noauth still resolves.

src/sse/services/auth.ts

@@ -696,6 +696,14 @@ async function selectSessionAffinityConnection(
   return connection;
 }
 
+/**
+ * Sentinel connection id used for the synthetic credentials of no-auth /
+ * keyless providers (opencode / opencode-zen). It is NOT a real DB row, so it
+ * cannot carry cooldown state — the account-fallback loop must be able to
+ * exclude it (#3061), otherwise it gets re-selected forever.
+ */
+const SYNTHETIC_NOAUTH_CONNECTION_ID = "noauth";
+
 function normalizeExcludedConnectionIds(
   excludeConnectionId: string | null,
   extraExcludedConnectionIds: string[] | null | undefined
@@ -831,6 +839,19 @@ export async function getProviderCredentials(
       WEB_COOKIE_PROVIDERS as Record<string, { noAuth?: boolean } | undefined>,
     ];
     if (providerMaps.some((map) => map[resolvedId]?.noAuth)) {
+      // #3061: there is only one synthetic "noauth" connection for a no-auth
+      // provider. If the caller already tried and excluded it (account-fallback
+      // after a persistent upstream error), do NOT hand it back — that would let
+      // the chat fallback loop re-select "noauth" forever (no real DB row → no
+      // cooldown to brake it), writing logs every iteration until the disk fills.
+      // Returning null here lets the handler stop after a single attempt.
+      const excludedForNoAuth = normalizeExcludedConnectionIds(
+        excludeConnectionId,
+        options.excludeConnectionIds
+      );
+      if (excludedForNoAuth.has(SYNTHETIC_NOAUTH_CONNECTION_ID)) {
+        return null;
+      }
       return {
         apiKey: null,
         accessToken: null,
@@ -839,7 +860,7 @@ export async function getProviderCredentials(
         projectId: null,
         copilotToken: null,
         providerSpecificData: {},
-        connectionId: "noauth",
+        connectionId: SYNTHETIC_NOAUTH_CONNECTION_ID,
         testStatus: "active",
         lastError: null,
         lastErrorType: null,
@@ -953,6 +974,12 @@ export async function getProviderCredentials(
       // OpenCode free model. A configured, active key is still selected above; a
       // rate-limited/terminal key returns its own signal before reaching here.
       if (resolvedId === "opencode-zen") {
+        // #3061: same loop guard as the NOAUTH_PROVIDERS path above — once the
+        // single synthetic "noauth" connection has been excluded by the chat
+        // fallback loop, return null instead of re-handing it back forever.
+        if (excludedConnectionIds.has(SYNTHETIC_NOAUTH_CONNECTION_ID)) {
+          return null;
+        }
         return {
           apiKey: null,
           accessToken: null,
@@ -961,7 +988,7 @@ export async function getProviderCredentials(
           projectId: null,
           copilotToken: null,
           providerSpecificData: {},
-          connectionId: "noauth",
+          connectionId: SYNTHETIC_NOAUTH_CONNECTION_ID,
           testStatus: "active",
           lastError: null,
           lastErrorType: null,