fix(opencode): serialize concurrent auth.json writes

[CreatorGhost]

Port of upstream anomalyco/opencode#36362.

Wraps Auth.set/Auth.remove read-modify-write cycles in a single-permit semaphore so concurrent OAuth refreshes cannot interleave and drop credentials from auth.json.

Verified: bun test test/auth/auth.test.ts (5 pass, includes new concurrency regression test) and bun typecheck from packages/opencode. Applied cleanly.

Summary by CodeRabbit

• Bug Fixes

  • Prevented concurrent authentication updates from overwriting one another.
  • Ensured provider credentials remain intact when multiple authentication changes occur at the same time.

• Tests

  • Added coverage verifying that simultaneous updates for multiple providers are preserved correctly.

[coderabbitai]

Warning

Review limit reached

@CreatorGhost, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0ac99bbf-8372-41d6-a831-d7af64660c70

📥 Commits

Reviewing files that changed from the base of the PR and between 613d93c and 8a3ba4b.

📒 Files selected for processing (1)

• packages/opencode/test/auth/auth.test.ts

📝 Walkthrough

Walkthrough

The auth layer now serializes concurrent auth.json mutations with a semaphore. A test verifies that simultaneous provider updates preserve all normalized entries.

Changes

Auth mutation safety

Layer / File(s)	Summary
Serialize auth.json mutations packages/opencode/src/auth/index.ts, packages/opencode/test/auth/auth.test.ts	Auth.set and Auth.remove perform their read-modify-write sequences under a one-permit semaphore, and concurrent provider updates are tested for preservation.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the change and verification, but it omits the required template sections like issue link, change type, screenshots, and checklist.	Add the missing template sections: issue reference, change type checkbox, full PR summary, verification details, screenshots if relevant, and checklist items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: serializing concurrent auth.json writes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch auth-write-serialize

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CreatorGhost]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

---

Your plan includes PR reviews subject to rate limits. More reviews will be available in 42 minutes.

[CreatorGhost]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

🧹 Nitpick comments (1)

packages/opencode/test/auth/auth.test.ts (1)

77-91: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Cover concurrent set/remove interaction.

The production change locks both mutations, but this regression only protects set/set. Add a mixed-operation test so removing the lock from Auth.remove cannot regress unnoticed.

Proposed additional coverage

+  it.instance("set and remove are safe under concurrent calls", () =>
+    Effect.gen(function* () {
+      const auth = yield* Auth.Service
+      yield* auth.set("anthropic", { type: "api", key: "k1" })
+
+      yield* Effect.all(
+        [
+          auth.set("openai", { type: "api", key: "k2" }),
+          auth.remove("anthropic"),
+        ],
+        { concurrency: "unbounded" },
+      )
+
+      const data = yield* auth.all()
+      expect(Object.keys(data)).toEqual(["openai"])
+    }),
+  )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/opencode/test/auth/auth.test.ts` around lines 77 - 91, Add a
concurrent mixed-operation test alongside “set is safe under concurrent calls”
that invokes Auth.Service set and remove operations together, then verifies the
final auth data reflects the expected serialized outcome. Ensure the test would
fail if Auth.remove no longer uses the shared mutation lock.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/opencode/test/auth/auth.test.ts`:
- Around line 77-91: Add a concurrent mixed-operation test alongside “set is
safe under concurrent calls” that invokes Auth.Service set and remove operations
together, then verifies the final auth data reflects the expected serialized
outcome. Ensure the test would fail if Auth.remove no longer uses the shared
mutation lock.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 430da695-432d-470c-abaf-d278d35d3b41

📥 Commits

Reviewing files that changed from the base of the PR and between 67e2bd4 and 613d93c.

📒 Files selected for processing (2)

• packages/opencode/src/auth/index.ts
• packages/opencode/test/auth/auth.test.ts

[CreatorGhost]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.