opencode_cli: OPENCODE_DISABLE_DEFAULT_PLUGINS breaks OAuth logins (ChatGPT, Copilot)

从 skillspector/providers/_agent_cli.py 中的 _prepare_opencode_env 开始，那里设置了 OPENCODE_DISABLE_DEFAULT_PLUGINS。删除该条目，同时保留 OPENCODE_PURE。然后更新 _prepare_opencode_env 现有的测试，断言该变量不存在。完成的标准是测试通过，并且 issue 中的复现脚本在 OAuth 登录时返回 pong。报告者已表示愿意提交 PR，因此开始之前请先检查是否已有 PR。

Summary

With the opencode_cli provider, an OpenCode login that uses OAuth (ChatGPT Plus/Pro via opencode auth login → OpenAI, also GitHub Copilot, GitLab, …) cannot be used: every call fails with

{"type":"error",...,"error":{"name":"UnknownError","data":{"message":"Unexpected server error. Check server logs for details."}}}

The cause is OPENCODE_DISABLE_DEFAULT_PLUGINS=1 in _prepare_opencode_env. In OpenCode 1.18.33 that flag skips all internal plugins, and the OAuth logins are implemented as internal plugins. The docstring of _prepare_opencode_env states the intent the flag defeats: "The real OpenCode authentication store remains available so this CLI provider can use the user's existing login." For API-key logins it works; for OAuth logins the stored token is never attached.

Reproduction

OpenCode 1.18.33, logged in with ChatGPT (opencode auth login → OpenAI → ChatGPT Plus/Pro). SkillSpector main (3c8e4b9). The script uses SkillSpector's own _build_opencode_argv and _prepare_opencode_env and only toggles the one variable:

import os, shutil, subprocess, tempfile
from skillspector.providers import _agent_cli as a

argv = a._build_opencode_argv(shutil.which("opencode"), "openai/gpt-6-luna")
for drop in (False, True):
    root = tempfile.mkdtemp()
    env = a._prepare_opencode_env(dict(os.environ), root, argv)
    if drop:
        env.pop("OPENCODE_DISABLE_DEFAULT_PLUGINS")
    p = subprocess.run(argv, input="Reply with the single word: pong", env=env,
                       capture_output=True, text=True, encoding="utf-8")
    print(drop, p.returncode, "pong" in (p.stdout + p.stderr).lower())

Result:

`OPENCODE_DISABLE_DEFAULT_PLUGINS`	exit	answer
`1` (as today)	1	`Unexpected server error`
unset	0	`pong`

Every other variable of the sandbox stays as it is.

What the flag disables (OpenCode 1.18.33)

packages/opencode/src/plugin/index.ts at tag v1.18.33:

for (const plugin of flags.disableDefaultPlugins ? [] : internalPlugins(flags)) {

internalPlugins() returns CodexAuthPlugin, CopilotAuthPlugin, ModalPlugin, GitlabAuthPlugin, PoeAuthPlugin, CloudflareWorkersAuthPlugin, CloudflareAIGatewayAuthPlugin, AzureAuthPlugin, DigitalOceanAuthPlugin, SnowflakeCortexAuthPlugin, XaiAuthPlugin, CerebrasPlugin. None of them registers a tool hook; they only provide auth and the chat.headers / chat.params request hooks for their provider. External plugins stay off independently through --pure / OPENCODE_PURE=1 (flags.pure ? [] : cfg.plugin_origins), and tool access stays denied by the per-invocation deny-all agent and OPENCODE_PERMISSION.

So the flag adds no tool isolation, but it breaks OAuth-based logins.

Proposed fix

Drop OPENCODE_DISABLE_DEFAULT_PLUGINS from the sandbox env and pin the reasoning in the test (assert it is absent, keep the OPENCODE_PURE assertion). I can open a PR.

opencode_cli: OPENCODE_DISABLE_DEFAULT_PLUGINS breaks OAuth logins (ChatGPT, Copilot)

评估

调研方向

描述

Summary

Reproduction

What the flag disables (OpenCode 1.18.33)

Proposed fix

环境准备

从这里开始

NVIDIA/SkillSpector 的其他 Issue

相似的 Issue

opencode_cli: OPENCODE_DISABLE_DEFAULT_PLUGINS breaks OAuth logins (ChatGPT, Copilot)

哪里不对？

评估

调研方向

描述

Summary

Reproduction

What the flag disables (OpenCode 1.18.33)

Proposed fix

环境准备

从这里开始

NVIDIA/SkillSpector 的其他 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

相似的 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

把新 issue 发到你的邮箱