connect the opencode credential at sidecar boot

opencode keeps credentials in two unrelated places. The CLI, opencode run and the legacy
/session surface read auth.json. The newer /api surface — the one with steer, queue,
interrupt and a resumable per-session stream — reads its own integration store and knows
nothing about that file.

With none connected it does not fail. It falls back to what needs no credential, the free
tier, and a request for a paid model is never executed: prompt accepted, admitted, prompted,
then no step, no error, no message, forever. That silence cost most of an afternoon and would
cost it again on every new machine — alpha included.

So the sidecar does it, rather than depending on someone having run a curl. Best-effort and
never blocking: turns go through opencode run, which reads auth.json and does not care.

Retried, because /api/health answers before the integration store is ready — the first
version of this shipped without a retry and failed on its very first real boot with a 500,
while the identical request succeeded seconds later. Only 5xx retries; a 4xx means the
request is wrong and repeating it just prints the same complaint six times.

Verified by deleting the credential, restarting, and running sonnet on the new pipeline with
no manual step.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/opencode/index.ts

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { DATA_PATH } from '../../data-path';
 import { createSidecarConnector } from '../connect';
 import { sweepRecordedServe } from './serve-sweep';
+import { connectProviderCredential } from './connect-credential';
 import { createSessionLogStore } from '../claude/session-log';
 import type { SidecarCommand, SidecarEvent } from '../protocol';
 import { runOpenCodeTurn, killOpenCodeTurn, listRunningOpenCodeTurns, stopAllOpenCodeTurns } from './runner';
@@ -132,6 +133,11 @@ if (!(await waitHealthy(baseUrl, HEALTH_TIMEOUT_MS))) {
 }
 console.log(`[opencode] serve healthy on port ${port}`);
 
+// The new /api surface keeps credentials separately from auth.json and would otherwise reach free models
+// only — silently. Best-effort and not awaited for correctness: turns go through `opencode run`, which
+// reads auth.json directly and does not depend on this.
+void connectProviderCredential(baseUrl);
+
 // ── Command handlers ──
 
 type ReplyFn = (msg: SidecarEvent) => void;