fix(opencodego): honor app source configuration and show actual source

[ArietidsZ]

Summary

• Honor the persisted OpenCode Go source selection when constructing macOS app fetch contexts. Previously, OpenCodeGoProviderImplementation inherited the default .auto mode, so a configured source=api could still try an invalid manual Cookie first.
• Replace the hard-coded web provider header with the configured source before a successful fetch, or the actual source label of the last successful fetch.
• Add isolated regression tests for auto, api, and web routing through ProviderRegistry and ProviderSpec.makeFetchContext(), plus header-label coverage.

Reproduction

1. Configure an OpenCode Go API key, persist source=api (for example, codexbar config set-source --provider opencodego --source api), and select Manual Cookie with an invalid cookie.
2. The CLI command codexbar usage --provider opencodego --source api succeeds, but the macOS app still follows Auto routing and reports OpenCode Go cookie header is invalid.
3. The settings header reads web regardless of the configured or successful source.

After this change, an explicitly configured api source selects only opencodego.api. Explicit web and existing Auto precedence are retained. The header shows the selected/fetched source rather than a fixed web.

Validation

• swiftc -frontend -parse on the modified implementation and new test file: passed with Swift 6.2.1 (Linux).
• git diff --check on the prepared patch: passed.
• The tests are synthetic and do not read real credentials, browser cookies, Keychain, or hit external APIs.
• macOS AppKit/SwiftPM tests and make check were not run here because the available local test runtime is Linux. Suggested macOS check: ./Scripts/test_fast.sh --filter OpenCodeGoAppSourceTests, then make check.

Scope

One app implementation file and one test file. No changes to remote usage parsing, Cookie normalization, token storage, or Auto source strategy ordering.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T06:22:53.294727Z	091565b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR makes the macOS app honor OpenCode Go’s saved source selection and display the configured or last successful source.

Example: OpenCode Go has source=api, a valid API key, and manual cookie value Cookie: invalid.

• Before: The app uses Auto routing, rejects the manual cookie, and displays web.
• After: The app selects only opencodego.api and displays api after a successful fetch.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The focused implementation matches the existing contract, but supplied validation stops at parsing and the required runtime evidence is absent.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: The app can reject a stale manual cookie despite an explicit API source selection, and its settings header always reports web.
Reason: Honoring the existing explicit-source contract restores expected behavior without adding a setting, changing Auto precedence, or expanding the feature.

Merge readiness

⛔ Blocked before merge - 2 items remain

Keep this PR open: it addresses a source-routing defect still present on main with a small, focused change; no introduced correctness defect was found.

Priority: P2
Reviewed head: 702ae14f32b02bb8663c57bd1d1151c8819d4036

Before merge

• Add real behavior proof - The body and comments provide no after-fix run through the macOS app’s changed source-resolution and header paths. Supply screenshots, a recording, or redacted app logs showing saved source=api succeeding with an invalid manual cookie and the header reporting api; redact credentials, IPs, and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

None.

Tests

• Missing end-to-end proof: Supply a macOS app run showing saved api bypassing an invalid manual cookie and displaying the successful source; the new regression tests have not been shown failing on base and passing on head.

Agent review details

How this fits together

The app’s provider implementation supplies the saved source to the shared provider registry, which constructs fetch contexts and selects API, web, or local strategies; successful results supply the displayed source label.

flowchart LR
  A[Saved provider configuration] --> B[App provider implementation]
  B --> C[Provider registry]
  C --> D[Shared fetch pipeline]
  D --> E[API web or local strategy]
  E --> F[Usage store]
  F --> G[Settings source label]

Loading

Technical review

Best possible solution:

Use the existing source-resolution and source-label owners, preserving Auto ordering and selected-account credential isolation.

Do we have a high-confidence way to reproduce the issue?

The current-main source establishes the reported path: saved api is ignored, manual cookies select web first, and invalid manual credentials stop fallback; no runtime reproduction was performed.

Is this the best way to solve the issue?

The patch is the smallest complete source-level repair: it supplies the existing saved mode to the shared resolver and reuses the existing label owner without duplicating routing or credential logic.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6480977b47f6.

Provenance checked

• OpenCode Go settings source label changes intended behavior with a stated reason (31bd481: The provider originally used a fixed web presentation; later API support added another valid source while retaining that label.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Pinned patch: The introduced diff adds sourceMode and defaultSourceLabel overrides and delegates presentation to UsageStore.sourceLabel; it leaves shared strategies and credential handling intact. (Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift:8, 702ae14f32b0)
• Current-main failure path: Main has no OpenCode Go sourceMode override, so ProviderImplementation supplies auto; the descriptor prioritizes web for manual cookies and prevents fallback after their authentication failures. (Sources/CodexBarCore/Providers/OpenCodeGo/OpenCodeGoProviderDescriptor.swift:442, 6480977b47f6)
• Existing source and account contract: The descriptor already supports auto/api/web and preserves explicit choices when resolving selected API-key accounts; the guide documents explicit sources as authoritative, consistent with the owner-authored direction in fix(opencodego): support API-key token accounts #3848. (Sources/CodexBarCore/Providers/OpenCodeGo/OpenCodeGoProviderDescriptor.swift:23, 6480977b47f6)
• Original presentation intent: The original provider addition introduced the fixed web label; later API support in Add OpenCode Go usage API support #2879 made that label incomplete, and this PR explains its replacement. (Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift:9, 31bd4812d227)
• Supplied validation and discussion: The complete body and all three comments contain syntax-parse and diff checks but no after-fix app evidence; the author explicitly states that macOS tests and make check were not run. (702ae14f32b0)
• Repository policy and inspection limits: The full root AGENTS.md applies; no nested AGENTS.md, maintainer-notes directory, or pr-simplify skill was found. Some older blobs are unavailable locally; GitHub commit evidence independently verified the original presentation change. The checkout remained clean. (AGENTS.md:1, 702ae14f32b0)

Likely related people:

• Peter Steinberger: Raw commit 173afc8 adds Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift:32 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 173afc88a417; files: Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift)
• Akshay Prabhu: Raw commit 05a7a44 adds Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift:19 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 05a7a449f0e6; files: Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift)
• Ratul Sarna: Raw commit 31bd481 adds Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift:9 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 31bd4812d227; files: Sources/CodexBar/Providers/OpenCodeGo/OpenCodeGoProviderImplementation.swift)

Labels

Label changes:

• add P2: The defect affects OpenCode Go users with an explicit saved source, particularly API users retaining invalid manual cookies; the change has a limited provider-specific scope.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: The defect affects OpenCode Go users with an explicit saved source, particularly API users retaining invalid manual cookies; the change has a limited provider-specific scope.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide the macOS app evidence described above.
• Run the focused OpenCodeGoAppSourceTests and make check on macOS.
• Demonstrate fresh-install and v0.77.0 upgrade behavior with saved source, cookie preferences, and token accounts preserved.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 18, 2026, 9:14 AM ET / 13:14 UTC.

[steipete]

Merged in 0373cd6, thanks @ArietidsZ! OpenCode Go now follows the source you configure in the app, even with a manual cookie saved, and shows which source actually answered. We kept your routing fix and reused the shared workspace and cookie accessors. It will ship in the next release.