OpenCode Go: /workspace/<id>/go was retired and now 302s to login — quota polling is permanently "opencode: unauthorized"

[Diogenes50]

Summary

OpenCode Go tracking is broken for every user on v2.14.3: opencode.ai has retired the server-rendered /workspace/<id>/go page that OpenCodeClient scrapes. The URL now answers 302 to the login flow for any cookie, and because fetchDashboardHTML maps every 3xx to ErrOpenCodeUnauthorized, the daemon logs an authentication failure forever:

level=ERROR msg="Failed to fetch OpenCode quotas" error="opencode: unauthorized"

The dashboard keeps rendering the last successful snapshot, so it looks alive — only the countdown timers move. In my case polling silently stopped on 2026-09-18 and the card still showed Reset at Sep 19 three days later.

Reproduction

onwatch v2.14.3, Windows amd64, OpenCode Go subscription, valid browser session.

Same UA and cookie handling as internal/api/opencode_client.go:

Request	Cookie	Result
GET /workspace/<wrk_id>/go	auth=Fe26.2**…	302 → https://opencode.ai/console/login
GET /workspace/<wrk_id>/go	valid __Host-console_session	302 → /auth/authorize
GET /workspace/<wrk_id>/go	both	302 → https://opencode.ai/console/login
GET /console/api/go/status + x-org-id: <wrk_id>	valid __Host-console_session	200 with JSON quotas

Two related findings:

1. The console is now a SPA; quota data comes from GET /console/api/go/status, which requires the x-org-id header (without it: 400 {"_tag":"OrgRequired","message":"x-org-id is required"}).
2. Authentication now rides on __Host-console_session, not the auth iron cookie. A stale auth=Fe26.2**… returns 401 on every console API route, so the setting hint ("The auth cookie value required for scraping the dashboard") points users at a cookie that no longer authenticates.

Response shape

{
  "access": {
    "endsAt": "2026-10-13T01:31:34.000Z",
    "meters": {
      "fiveHour": { "startsAt": "...", "resetsAt": "2026-09-22T05:24:12.585Z",
                    "limitMicroCents": "1200000000", "usedMicroCents": "18384251" },
      "week":     { "startsAt": "...", "resetsAt": "2026-09-28T00:00:00.000Z",
                    "limitMicroCents": "3000000000", "usedMicroCents": "767560314" },
      "month":    { "limitMicroCents": "6000000000", "usedMicroCents": "1796934324" }
    }
  }
}

month carries no resetsAt; access.endsAt is the correct substitute. Micro-cent fields are JSON strings.

Patch I am running locally

In internal/api/opencode_client.go:

• added openCodeGoStatusPath = "/console/api/go/status" and fetchGoStatusJSON, which sends the existing openCodeAuthCookieHeader(authCookie) plus x-org-id: <workspaceID> and Accept: application/json;
• added fetchGoStatusQuotas, mapping fiveHour/week/month to the existing five_hour/weekly/monthly quota names with utilization = usedMicroCents / limitMicroCents * 100, ResetsAt from the meter (falling back to access.endsAt);
• FetchSnapshot tries the JSON API first and falls back to the old HTML scrape for anything that is not 401/403/context cancellation, so parseOpenCodeQuotas and its tests stay intact.

Result after restarting the daemon (values match the web console's 2% / 26% / 30%):

level=INFO msg="OpenCode poll complete" plan_name="OpenCode Go" quota_count=3
five_hour 1.53%  resets=2026-09-22T05:24:12Z
weekly   25.59%  resets=2026-09-28T00:00:00Z
monthly  29.95%  resets=2026-10-13T01:31:34Z

Happy to open a PR with that change if the approach looks right. Two design questions:

1. Should the auth_cookie setting accept a full cookie header (it already does, via the auth= prefix check) and should the hint be reworded to say __Host-console_session is what authenticates now?
2. Since the JSON API exposes real currency limits, would you rather store currency-format quotas (OpenCodeQuotaFormatCurrency, micro-cents → USD) instead of the percentages the scrape produced? I kept percentages to avoid changing stored history.

Two smaller things noticed while debugging

• Changing the OpenCode auth cookie in the UI does not affect the running poller — OpenCodeAgent holds the startup cfg, so a daemon restart is required. The settings UI gives no hint of that, and the log line Provider settings updated providers="[global opencode]" suggests the change took effect.
• On Windows the test binary for ./internal/api cannot build at v2.14.3, independent of this change: extra_coverage_test.go:1779 (and 1788, 2362, 3109) reference getCredentialsFilePath, which is not defined for GOOS=windows.

Environment: onwatch v2.14.3 (windows-amd64), Go 1.27.1, Windows 11.

[prakersh]

Thanks for the detailed report, this is high quality. We reproduced the 302 -> /auth/authorize on /workspace/<id>/go and the 401 {"_tag":"Unauthorized"} on /console/api/go/status, and confirmed the /go shell no longer carries rollingUsage, weeklyUsage, or usage-item markup. Your diagnosis is right.

Your two questions: yes to both. __Host-console_session is what authenticates now, so a bare pasted value should go out as __Host-console_session=<value>, a full cookie header verbatim, and the auth= prefix logic dropped. And yes to currency, since utilization stays a percentage and the charts and reset-cycle tracker are unaffected. What does change units: the card fraction line, the logging-history columns, the email/webhook limit field, and absolute notification overrides, which divide by Limit (100 today, so an existing absolute override would silently change meaning). Please call that last one out in the PR description. A short mixed-units window in history is fine.

One change to your patch: drop the HTML fallback instead of keeping it behind the JSON call. If JSON fails transiently and we then hit the retired page, the error becomes "parse failed" rather than the real cause, which is the same misleading-error problem as this issue.

From the captured shape: month has no resetsAt, so use access.endsAt there (worth a comment, it is subscription end, not a window reset), emit only the meters present, pin the micro-cents to USD conversion in a test (1200000000 -> $12.00, i.e. divide by 1e8), and give 400 OrgRequired its own error since it means a bad workspace id, not a bad session.

Direction on your two side findings, if you want any of them:

Live apply. UpdateSettings writes to the DB and never calls ApplyProviderSettingsFromDB, which ReloadProviders does, so the Reload button works and the log line lies. The agent already re-reads the cookie on every poll, so the fix is just to make the write happen, but behind a small RWMutex-guarded accessor: h.config is shared with agent goroutines, and only the opencode and ollama agents hold a live pointer to it. This only covers a running agent: if OpenCode was not configured at startup, no agent is registered and a restart is still needed. So keep the restart hint in app.js for now, we will handle creating the agent lazily.

Stale card. buildOpenCodeCurrent already emits isStale and ageSeconds, and the card ignores them while the Anthropic card renders them. Wire that up, including the fallback branch that sets ageSeconds but not isStale. A true "last poll failed" state is a bigger change, since no agent publishes its last error today.

Windows. getCredentialsFilePath exists only in anthropic_token_unix.go behind //go:build !windows. Add it to anthropic_token_windows.go and reuse it for the three inline credential paths already there, which removes the duplication as well. A second instance you did not hit: root_more_coverage_test.go:183 asserts attr.Setsid under GOOS=windows; move that into a //go:build !windows file beside platform_unix.go. Those getCredentialsFilePath tests also set HOME, which Windows ignores in favour of USERPROFILE, so set both or they will compile and then fail when run. Both slipped through because the full suite only builds on ubuntu (the Windows job tests ./internal/menubar alone), and adding GOOS=windows GOARCH=amd64 go vet ./... to the Test job catches the whole class with no extra runner.

What we would like from you: the JSON-only client, cookie handling, error taxonomy, tests pinning your 1.53 / 25.59 / 29.95 numbers, and the doc updates, including OPENCODE_SETUP.md lines 154-155 (still describe HTML scraping), README.md lines 189 and 366, and .env.example lines 38-41 (still point at the auth cookie). Take any of the above you would like and we will handle the rest.

One caveat: we cannot hit the authenticated endpoint ourselves, so we are taking your captured shape at face value. Please re-run end to end against main after merge. Happy to help or review as you go.

[prakersh]

Thanks again for the diagnosis and the patch, it made this straightforward. This is fixed in v2.14.6. As mentioned on #136, we took the remaining work on our side, so no PR is needed from you.

What shipped (#136 added the key mode, #139 the rest):

• Both modes read /console/api/go/status with x-org-id. The HTML scrape is gone, with no fallback.
• Session mode sends __Host-console_session. A bare value, name=value or a full Cookie header all work, and the old auth cookie gets a hint to paste the new one.
• A service-account key (oc_sk_...) is the alternative, with no cookie to expire.
• Meters are stored in USD (micro-cents / 1e8, pinned in tests), shown as e.g. $3.84 / $30.00. Monthly resets at access.endsAt.
• Absolute notification thresholds for OpenCode are now in dollars. This is documented in OPENCODE_SETUP.md, and the README and .env.example are updated too.
• A missing meter is reported as a parse error rather than shown as 0%.
• Windows: the test build is fixed, and CI now runs the full suite and e2e on Windows.

Still open, tracked as follow-ups: live apply of settings (a restart is still needed), the stale-card indicator, and a separate error for 400 OrgRequired.

We still cannot hit the authenticated endpoint ourselves, so an end-to-end check on 2.14.6 would be much appreciated.