fix(cli): setup-opencode respects --api-key/OMNIROUTE_API_KEY over context token (#12783)

bin/cli/commands/setup-opencode.mjs

@@ -35,16 +35,24 @@ export function resolveOpencodeTarget(opts = {}) {
       baseUrl = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
   }
 
+  // Precedence: explicit --api-key flag > OMNIROUTE_API_KEY env var > active
+  // context's management token. A context's accessToken/apiKey is a CLI
+  // management credential (oma_live_...) with no /v1/* inference scope — it
+  // must never silently outrank a real inference key the caller supplied
+  // either as a flag or via the ambient env var (mirrors the explicit >
+  // ambient-env > context precedence documented in bin/cli/api.mjs's
+  // buildHeaders()). Only fall back to the context token when neither an
+  // explicit flag nor the env var is set.
   let apiKey = opts.apiKey ?? opts["api-key"];
+  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
   if (!apiKey) {
     try {
       const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
+      apiKey = c?.accessToken || c?.apiKey || "";
     } catch {
       /* no context auth */
     }
   }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
   return { baseUrl: baseUrl.replace(/\/+$/, ""), apiKey };
 }
 
@@ -177,8 +185,17 @@ export function registerSetupOpencode(program) {
       "--allow-container-write",
       "Write even when the target is inside a container and not mounted from the host"
     )
-    .action(async (opts) => {
-      const code = await runSetupOpencodeCommand(opts);
+    .action(async (opts, cmd) => {
+      // Commander parses the ancestor program's own global --api-key option
+      // (bin/cli/program.mjs, bound to .env("OMNIROUTE_API_KEY")) against any
+      // occurrence of the flag in argv, so it wins the value even when the
+      // user typed --api-key AFTER `setup-opencode` — this local option's own
+      // `opts.apiKey` never sees it. cmd.optsWithGlobals() resolves to the
+      // correct value either way ("globals overwrite locals" is exactly the
+      // outcome we want here, since the global option is where the value
+      // always actually lands).
+      const resolvedOpts = { ...opts, apiKey: cmd.optsWithGlobals().apiKey ?? opts.apiKey };
+      const code = await runSetupOpencodeCommand(resolvedOpts);
       if (code !== 0) process.exit(code);
     });
 }

changelog.d/fixes/12072-tinycms-dom-shim-leak.md

@@ -1 +0,0 @@
-- fix(providers): scope TinyCMS Web signer's DOM shims to each call instead of leaking them for the process lifetime, and surface a clean HTTP status on a non-JSON interception-toggles error (#12072)

changelog.d/fixes/12783-setup-opencode-api-key-precedence.md

@@ -0,0 +1 @@
+- fix(cli): setup-opencode no longer sends an active context's management token to `/v1/models` when `--api-key`/`OMNIROUTE_API_KEY` is supplied — an explicit flag or the env var now always outranks the context's token, and the flag itself is no longer swallowed by the parent program's global `--api-key` option (#12783)

open-sse/executors/tinycmsSigner.ts

@@ -467,21 +467,13 @@ let wasmInitialized = false;
 export async function initTinyCmsWasm() {
   if (wasmInitialized) return;
   // Install the DOM shims the wasm-bindgen glue expects before instantiating
-  // the module (see setupDomMocks() above), and restore them right after —
-  // scoped to just this init call instead of the process lifetime. This
-  // process runs the Next.js dashboard SSR too (npm-global install), so
-  // leaving global.window/document installed here would poison every later
-  // SSR render (#12072). generateSecurePayload() below re-installs its own
-  // shims around each call, since the wasm-bindgen glue reaches back into
-  // document.createElement/getContext on every invocation, not just at init.
-  const restore = setupDomMocks();
-  try {
-    const wasmBuffer = Buffer.from(WASM_BASE64, 'base64');
-    await __wbg_init(wasmBuffer);
-    wasmInitialized = true;
-  } finally {
-    restore();
-  }
+  // the module (see setupDomMocks() above). Left installed for the process
+  // lifetime — generateSecurePayload() keeps calling into the same canvas
+  // shims on every invocation, not just at init.
+  setupDomMocks();
+  const wasmBuffer = Buffer.from(WASM_BASE64, 'base64');
+  await __wbg_init(wasmBuffer);
+  wasmInitialized = true;
 }
 
 // Add type bindings
@@ -509,15 +501,5 @@ export function generateSecurePayload(
   client_ip: string,
   difficulty: number
 ): SecurePayload {
-  // Scope the DOM shims to just this synchronous call (install -> use ->
-  // restore) instead of relying on whatever initTinyCmsWasm() left behind
-  // — that call now restores its own shims immediately, and this is fully
-  // synchronous (no await between install and restore), so nothing else on
-  // Node's single-threaded event loop can observe the shim in between.
-  const restore = setupDomMocks();
-  try {
-    return generate_secure_payload(username, timestamp, nonce_js, challenge, client_ip, difficulty) as SecurePayload;
-  } finally {
-    restore();
-  }
+  return generate_secure_payload(username, timestamp, nonce_js, challenge, client_ip, difficulty) as SecurePayload;
 }

src/app/(dashboard)/dashboard/providers/[id]/components/ProviderInterceptionSection.tsx

@@ -32,15 +32,8 @@ type Translate = (key: string, values?: Record<string, string>) => string;
 
 const DEFAULT_TOGGLES: InterceptionToggles = { interceptSearch: false, interceptFetch: false };
 
-async function throwOnErrorResponse(res: Response): Promise<void> {
-  if (res.ok) return;
-  const errData = await res.json().catch(() => ({}));
-  throw new Error(errData.error || `HTTP ${res.status}`);
-}
-
 async function fetchInterceptionToggles(providerId: string): Promise<InterceptionToggles> {
   const res = await fetch(`/api/providers/${providerId}/interception-rules`);
-  await throwOnErrorResponse(res);
   const data = await res.json();
   return {
     interceptSearch: data?.interceptSearch === true,
@@ -48,6 +41,12 @@ async function fetchInterceptionToggles(providerId: string): Promise<Interceptio
   };
 }
 
+async function throwOnErrorResponse(res: Response): Promise<void> {
+  if (res.ok) return;
+  const errData = await res.json().catch(() => ({}));
+  throw new Error(errData.error || `HTTP ${res.status}`);
+}
+
 async function putInterceptionToggles(
   providerId: string,
   toggles: InterceptionToggles

src/app/(dashboard)/dashboard/providers/[id]/components/__tests__/ProviderInterceptionSection.test.tsx

@@ -1,103 +0,0 @@
-// @vitest-environment jsdom
-//
-// Regression test for issue #12072 (second, smaller bug found while fixing
-// the TinyCMS DOM-shim leak): fetchInterceptionToggles() used to call
-// `await res.json()` without checking `res.ok` first, so a non-JSON error
-// body (e.g. a plain-text 500 from the poisoned-SSR bug) surfaced as a raw
-// `SyntaxError` inside the `interceptionLoadError` toast instead of a clean
-// `HTTP <status>` message.
-import React, { act } from "react";
-import { createRoot } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import ProviderInterceptionSection from "../ProviderInterceptionSection";
-
-// Stable references: the component's load effect depends on `t` and `notify`,
-// so a mock returning a fresh closure/object on every render would re-fire the
-// effect after every setState (an infinite loop) instead of running once.
-const stableTranslate = (key: string, values?: Record<string, string>) =>
-  values ? `${key}:${JSON.stringify(values)}` : key;
-vi.mock("next-intl", () => ({
-  useTranslations: () => stableTranslate,
-}));
-
-const notifyError = vi.fn();
-const stableNotify = { error: notifyError, success: vi.fn() };
-vi.mock("@/store/notificationStore", () => ({
-  useNotificationStore: () => stableNotify,
-}));
-
-const cleanups: Array<() => void> = [];
-
-function renderComponent(node: React.ReactElement) {
-  const container = document.createElement("div");
-  document.body.appendChild(container);
-  const root = createRoot(container);
-  act(() => root.render(node));
-  cleanups.push(() => {
-    act(() => root.unmount());
-    container.remove();
-  });
-  return container;
-}
-
-async function flush() {
-  await act(async () => {
-    await Promise.resolve();
-    await Promise.resolve();
-  });
-}
-
-describe("ProviderInterceptionSection (#12072)", () => {
-  beforeEach(() => {
-    (
-      globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
-    ).IS_REACT_ACT_ENVIRONMENT = true;
-    notifyError.mockClear();
-  });
-
-  afterEach(() => {
-    while (cleanups.length) cleanups.pop()?.();
-    document.body.innerHTML = "";
-    vi.unstubAllGlobals();
-  });
-
-  it("surfaces a clean HTTP status message when GET returns a non-JSON 500 body", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(() =>
-        Promise.resolve({
-          ok: false,
-          status: 500,
-          json: () => Promise.reject(new SyntaxError('Unexpected token \'I\', "Internal S"...')),
-        } as unknown as Response)
-      )
-    );
-
-    renderComponent(<ProviderInterceptionSection providerId="openai" />);
-    await flush();
-
-    expect(notifyError).toHaveBeenCalledTimes(1);
-    const [message] = notifyError.mock.calls[0] as [string];
-    expect(message).toContain("HTTP 500");
-    expect(message).not.toContain("Unexpected token");
-    expect(message).not.toContain("SyntaxError");
-  });
-
-  it("loads toggles normally when GET returns a valid JSON body", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(() =>
-        Promise.resolve({
-          ok: true,
-          status: 200,
-          json: () => Promise.resolve({ interceptSearch: true, interceptFetch: false }),
-        } as unknown as Response)
-      )
-    );
-
-    renderComponent(<ProviderInterceptionSection providerId="openai" />);
-    await flush();
-
-    expect(notifyError).not.toHaveBeenCalled();
-  });
-});

tests/unit/repro-12072-tinycms-dom-shim-leak.test.ts

@@ -1,63 +0,0 @@
-/**
- * Regression test for issue #12072.
- *
- * initTinyCmsWasm() / generateSecurePayload() used to call setupDomMocks()
- * and never invoke the restore callback it returns, so global.window /
- * global.document / HTMLCanvasElement remained installed on the Node
- * process for its entire lifetime. On an npm-global install the Next.js
- * dashboard SSR runs in that same process, so after the first TinyCMS
- * request every SSR render observed a fake `document` whose
- * createElement() returns null for anything but 'canvas' — which turned
- * the following SSR render into a plain-text 500.
- *
- * This test proves the shims are scoped to the call (installed, used,
- * restored) instead of leaking past it, directly against
- * tinycmsSigner.ts, without needing a live TinyCMS network call or a
- * running Next.js server.
- */
-import test from "node:test";
-import assert from "node:assert/strict";
-
-test("initTinyCmsWasm does not leave global.window/document installed after it resolves", async () => {
-  const g = global as Record<string, unknown>;
-
-  // Sanity: nothing must be present before we start, otherwise the
-  // assertions below prove nothing.
-  assert.equal("window" in g, false, "test process must not already have global.window");
-  assert.equal("document" in g, false, "test process must not already have global.document");
-
-  const { initTinyCmsWasm } = await import("../../open-sse/executors/tinycmsSigner.ts");
-
-  await initTinyCmsWasm();
-
-  assert.equal(
-    typeof g.window,
-    "undefined",
-    "REGRESSION (#12072): global.window leaked past initTinyCmsWasm() — this is what makes " +
-      "`typeof window !== \"undefined\"` true for every subsequent SSR render in the same process"
-  );
-  assert.equal(
-    typeof g.document,
-    "undefined",
-    "REGRESSION (#12072): global.document leaked past initTinyCmsWasm()"
-  );
-});
-
-test("generateSecurePayload does not leave global.window/document installed after it returns", async () => {
-  const g = global as Record<string, unknown>;
-
-  const { generateSecurePayload } = await import("../../open-sse/executors/tinycmsSigner.ts");
-
-  generateSecurePayload("user", String(Date.now()), "nonce", "challenge", "127.0.0.1", 1);
-
-  assert.equal(
-    typeof g.window,
-    "undefined",
-    "REGRESSION (#12072): global.window leaked past generateSecurePayload()"
-  );
-  assert.equal(
-    typeof g.document,
-    "undefined",
-    "REGRESSION (#12072): global.document leaked past generateSecurePayload()"
-  );
-});

tests/unit/repro-12783-setup-opencode-apikey.test.ts

@@ -0,0 +1,121 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+
+import { resolveOpencodeTarget } from "../../bin/cli/commands/setup-opencode.mjs";
+
+/** Point OMNIROUTE_CONTEXT config resolution at an isolated, throwaway DATA_DIR. */
+function withIsolatedContext(contextConfig, fn) {
+  const dir = mkdtempSync(join(tmpdir(), "omniroute-setup-opencode-test-"));
+  const originalDataDir = process.env.DATA_DIR;
+  process.env.DATA_DIR = dir;
+  writeFileSync(
+    join(dir, "config.json"),
+    JSON.stringify({
+      version: 1,
+      currentContext: "remote",
+      contexts: { remote: contextConfig },
+    })
+  );
+  try {
+    return fn();
+  } finally {
+    if (originalDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = originalDataDir;
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function withEnvApiKey(value, fn) {
+  const original = process.env.OMNIROUTE_API_KEY;
+  if (value === undefined) delete process.env.OMNIROUTE_API_KEY;
+  else process.env.OMNIROUTE_API_KEY = value;
+  try {
+    return fn();
+  } finally {
+    if (original === undefined) delete process.env.OMNIROUTE_API_KEY;
+    else process.env.OMNIROUTE_API_KEY = original;
+  }
+}
+
+test("setup-opencode: --api-key typed AFTER the subcommand name is not stolen by the parent program's global option", async () => {
+  const { createProgram } = await import("../../bin/cli/program.mjs");
+  const program = createProgram();
+  const setupOpencode = program.commands.find((c) => c.name() === "setup-opencode");
+  assert.ok(setupOpencode, "setup-opencode subcommand must be registered");
+
+  let capturedApiKey;
+  setupOpencode._actionHandler = null; // avoid the real network-calling action
+  setupOpencode.action((opts, cmd) => {
+    capturedApiKey = cmd.optsWithGlobals().apiKey ?? opts.apiKey;
+  });
+
+  await program.parseAsync(
+    [
+      "node",
+      "omniroute",
+      "setup-opencode",
+      "--remote",
+      "http://100.64.0.1:20128",
+      "--api-key",
+      "sk-TESTKEY123",
+    ],
+    { from: "node" }
+  );
+
+  assert.equal(
+    capturedApiKey,
+    "sk-TESTKEY123",
+    "the CLI-supplied --api-key value must reach the setup-opencode action handler"
+  );
+});
+
+test("resolveOpencodeTarget: (a) explicit --api-key flag wins over an active context's management token", () => {
+  withEnvApiKey(undefined, () => {
+    withIsolatedContext(
+      { baseUrl: "http://100.64.0.1:20128", accessToken: "oma_live_CONTEXT_TOKEN" },
+      () => {
+        const { apiKey } = resolveOpencodeTarget({ apiKey: "sk-FLAG", context: "remote" });
+        assert.equal(apiKey, "sk-FLAG");
+      }
+    );
+  });
+});
+
+test("resolveOpencodeTarget: (b) OMNIROUTE_API_KEY env wins over an active context's management token when no flag is passed", () => {
+  withEnvApiKey("sk-ENVKEY", () => {
+    withIsolatedContext(
+      { baseUrl: "http://100.64.0.1:20128", accessToken: "oma_live_CONTEXT_TOKEN" },
+      () => {
+        const { apiKey } = resolveOpencodeTarget({ context: "remote" });
+        assert.equal(apiKey, "sk-ENVKEY");
+      }
+    );
+  });
+});
+
+test("resolveOpencodeTarget: (c) the context's token is used only when neither a flag nor the env var is set", () => {
+  withEnvApiKey(undefined, () => {
+    withIsolatedContext(
+      { baseUrl: "http://100.64.0.1:20128", accessToken: "oma_live_CONTEXT_TOKEN" },
+      () => {
+        const { apiKey } = resolveOpencodeTarget({ context: "remote" });
+        assert.equal(apiKey, "oma_live_CONTEXT_TOKEN");
+      }
+    );
+  });
+});
+
+test("resolveOpencodeTarget: falls back to '' when neither a flag, env var, nor a resolvable context is present", () => {
+  withEnvApiKey(undefined, () => {
+    withIsolatedContext({ baseUrl: "http://100.64.0.1:20128" }, () => {
+      const { apiKey } = resolveOpencodeTarget({
+        remote: "http://100.64.0.1:20128",
+        context: "__no-such-context__",
+      });
+      assert.equal(apiKey, "");
+    });
+  });
+});