fix(opencode): keep saved Go credentials in main-owned storage

Co-authored-by: kespineira <kespineira@users.noreply.github.com>
Co-authored-by: kevimux <kevimux@users.noreply.github.com>

src/main/credentials/api-key-file-unreadable-error.ts

@@ -0,0 +1,2 @@
+/** A transient read failure; the saved key may be fine, so callers must not ask to re-enter it. */
+export class ApiKeyFileUnreadableError extends Error {}

src/main/credentials/encrypted-api-key-file-store.ts

@@ -0,0 +1,177 @@
+import { safeStorage } from 'electron'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import {
+  hardenExistingSecureFile,
+  isUnreadableError,
+  writeSecureFile
+} from '../../shared/secure-file'
+import type { SecretAtRestProtection } from '../../shared/secret-at-rest-protection'
+import { ApiKeyFileUnreadableError } from './api-key-file-unreadable-error'
+
+type EncryptedApiKeyFileStore = {
+  protection: () => SecretAtRestProtection | null
+  has: () => boolean
+  save: (key: string) => void
+  read: () => string | null
+  clear: () => void
+}
+
+export function createEncryptedApiKeyFileStore({
+  fileName,
+  envelopePrefix,
+  providerLabel,
+  logScope
+}: {
+  fileName: string
+  envelopePrefix: string
+  providerLabel: string
+  logScope: string
+}): EncryptedApiKeyFileStore {
+  let cachedApiKey: string | null = null
+  let warnedStatusHardenFailure = false
+
+  type ApiKeyEnvelope = {
+    kind: 'encrypted' | 'plaintext'
+    payload: Buffer
+  }
+
+  function getOrcaDir(): string {
+    return join(homedir(), '.orca')
+  }
+
+  function getApiKeyPath(): string {
+    return join(getOrcaDir(), fileName)
+  }
+
+  function encodeApiKeyEnvelope(kind: ApiKeyEnvelope['kind'], payload: Buffer): string {
+    return `${envelopePrefix}${kind}:${payload.toString('base64')}`
+  }
+
+  function decodeApiKeyEnvelope(raw: Buffer): ApiKeyEnvelope {
+    const text = raw.toString('utf8')
+    if (!text.startsWith(envelopePrefix)) {
+      throw new Error(`${providerLabel} API key could not be decrypted`)
+    }
+    const rest = text.slice(envelopePrefix.length)
+    const separator = rest.indexOf(':')
+    if (separator === -1) {
+      throw new Error(`${providerLabel} API key could not be decrypted`)
+    }
+    const kind = rest.slice(0, separator)
+    if (kind !== 'encrypted' && kind !== 'plaintext') {
+      throw new Error(`${providerLabel} API key could not be decrypted`)
+    }
+    return {
+      kind,
+      payload: Buffer.from(rest.slice(separator + 1), 'base64')
+    }
+  }
+
+  function readEnvelope(envelope: ApiKeyEnvelope): string {
+    if (envelope.kind === 'plaintext') {
+      return envelope.payload.toString('utf8')
+    }
+    if (!safeStorage.isEncryptionAvailable()) {
+      throw new Error(`${providerLabel} API key could not be decrypted`)
+    }
+    return safeStorage.decryptString(envelope.payload)
+  }
+
+  function has(): boolean {
+    const keyPath = getApiKeyPath()
+    if (!existsSync(keyPath)) {
+      return false
+    }
+    try {
+      hardenExistingSecureFile(keyPath)
+    } catch (error) {
+      if (!warnedStatusHardenFailure) {
+        warnedStatusHardenFailure = true
+        console.warn(
+          `[${logScope}] Failed to harden ${providerLabel} API key file while checking status`,
+          error
+        )
+      }
+    }
+    return true
+  }
+
+  function protection(): SecretAtRestProtection | null {
+    const path = getApiKeyPath()
+    if (!existsSync(path)) {
+      return null
+    }
+    try {
+      return decodeApiKeyEnvelope(readFileSync(path)).kind === 'plaintext' ? 'plaintext' : 'sealed'
+    } catch {
+      return null
+    }
+  }
+
+  function save(key: string): void {
+    const trimmed = key.trim()
+    if (!trimmed) {
+      throw new Error(`${providerLabel} API key is required`)
+    }
+    if (safeStorage.isEncryptionAvailable()) {
+      writeSecureFile(
+        getApiKeyPath(),
+        encodeApiKeyEnvelope('encrypted', safeStorage.encryptString(trimmed)),
+        { durable: true }
+      )
+      cachedApiKey = trimmed
+      return
+    }
+    console.warn(
+      `[${logScope}] safeStorage encryption unavailable — storing ${providerLabel} API key in plaintext`
+    )
+    writeSecureFile(
+      getApiKeyPath(),
+      encodeApiKeyEnvelope('plaintext', Buffer.from(trimmed, 'utf8')),
+      { durable: true }
+    )
+    cachedApiKey = trimmed
+  }
+
+  function read(): string | null {
+    if (cachedApiKey !== null) {
+      return cachedApiKey
+    }
+    const keyPath = getApiKeyPath()
+    if (!existsSync(keyPath)) {
+      return null
+    }
+    // Why: permission failures must not be reported as decryption failures.
+    try {
+      hardenExistingSecureFile(keyPath)
+    } catch (error) {
+      console.warn(
+        `[${logScope}] Failed to harden ${providerLabel} API key file while reading`,
+        error
+      )
+    }
+    let raw: Buffer | null = null
+    try {
+      raw = readFileSync(keyPath)
+      const envelope = decodeApiKeyEnvelope(raw)
+      cachedApiKey = readEnvelope(envelope)
+      return cachedApiKey
+    } catch (error) {
+      if (raw === null && isUnreadableError(error)) {
+        console.warn(`[${logScope}] failed to read API key file`, error)
+        throw new ApiKeyFileUnreadableError(`${providerLabel} API key file could not be read`)
+      }
+      console.error(`[${logScope}] failed to decode/decrypt API key`, error)
+      throw new Error(`${providerLabel} API key could not be decrypted`)
+    }
+  }
+
+  function clear(): void {
+    cachedApiKey = null
+    rmSync(getApiKeyPath(), { force: true })
+  }
+
+  return { has, save, read, clear, protection }
+}

src/main/ipc/credential-change-rate-limit-refresh.test.ts

@@ -0,0 +1,40 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createEmptyRateLimitState } from '../../shared/rate-limit-state-factory'
+import { refreshAfterCredentialChange } from './credential-change-rate-limit-refresh'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('refreshAfterCredentialChange', () => {
+  it('does nothing without a rate-limit service', () => {
+    const invalidate = vi.fn()
+    refreshAfterCredentialChange(null, invalidate, '[test] refresh failed:')
+    expect(invalidate).not.toHaveBeenCalled()
+  })
+
+  it('invalidates before refreshing', () => {
+    const order: string[] = []
+    const service = {
+      refresh: vi.fn(async () => {
+        order.push('refresh')
+        return createEmptyRateLimitState()
+      })
+    }
+    refreshAfterCredentialChange(service, () => order.push('invalidate'), '[test] refresh failed:')
+    expect(order).toEqual(['invalidate', 'refresh'])
+  })
+
+  it('logs a failed background refresh with the caller message', async () => {
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const failure = new Error('network down')
+    const service = {
+      refresh: vi.fn(async () => {
+        throw failure
+      })
+    }
+
+    refreshAfterCredentialChange(service, () => {}, '[test] refresh failed:')
+    await vi.waitFor(() => expect(error).toHaveBeenCalledWith('[test] refresh failed:', failure))
+  })
+})

src/main/ipc/credential-change-rate-limit-refresh.ts

@@ -0,0 +1,19 @@
+import type { RateLimitService } from '../rate-limits/service'
+
+/**
+ * Drops a provider's stale usage, then refreshes in the background.
+ * Why fire-and-forget: callers return the persisted credential status immediately; a failed refresh only logs.
+ */
+export function refreshAfterCredentialChange<T extends Pick<RateLimitService, 'refresh'>>(
+  rateLimits: T | null,
+  invalidate: (rateLimits: T) => void,
+  failureLogMessage: string
+): void {
+  if (!rateLimits) {
+    return
+  }
+  invalidate(rateLimits)
+  void rateLimits.refresh().catch((error: unknown) => {
+    console.error(failureLogMessage, error)
+  })
+}

src/main/ipc/minimax-credentials.ts

@@ -12,6 +12,7 @@ import {
   saveMiniMaxApiKey
 } from '../minimax/minimax-api-key-store'
 import { clearMiniMaxSessionCookieJar } from '../rate-limits/minimax/minimax-request-context'
+import { refreshAfterCredentialChange } from './credential-change-rate-limit-refresh'
 import type { RateLimitService } from '../rate-limits/service'
 import type { SecretAtRestProtection } from '../../shared/secret-at-rest-protection'
 
@@ -36,16 +37,15 @@ function getMiniMaxCredentialsStatus(): MiniMaxCredentialsStatus {
   }
 }
 
-// Why: fire-and-forget — callers get the persisted credential status immediately;
-// the rate-limit refresh runs in the background and only logs on failure.
 function refreshAfterMiniMaxCredentialChange(
   rateLimits: RateLimitService | null,
   action: 'save' | 'clear'
 ): void {
-  rateLimits?.invalidateMiniMaxCredentialState()
-  void rateLimits?.refresh().catch((error: unknown) => {
-    console.error(`[minimax] failed to trigger rate-limit refresh after ${action}:`, error)
-  })
+  refreshAfterCredentialChange(
+    rateLimits,
+    (service) => service.invalidateMiniMaxCredentialState(),
+    `[minimax] failed to trigger rate-limit refresh after ${action}:`
+  )
 }
 
 export function registerMiniMaxCredentialsHandlers(rateLimits: RateLimitService | null): void {

src/main/ipc/opencode-go-credentials.test.ts

@@ -0,0 +1,87 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createEmptyRateLimitState } from '../../shared/rate-limit-state-factory'
+import { registerOpenCodeGoCredentialsHandlers } from './opencode-go-credentials'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, key?: unknown) => unknown>(),
+  has: vi.fn(() => false),
+  save: vi.fn(),
+  clear: vi.fn()
+}))
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, key?: unknown) => unknown) => {
+      mocks.handlers.set(channel, handler)
+    }
+  }
+}))
+vi.mock('../opencode/opencode-go-api-key-store', () => ({
+  hasOpenCodeGoApiKey: mocks.has,
+  saveOpenCodeGoApiKey: mocks.save,
+  clearOpenCodeGoApiKey: mocks.clear
+}))
+
+function invoke(action: string, value?: unknown): unknown {
+  const handler = mocks.handlers.get(`opencodeGoCredentials:${action}`)
+  if (!handler) {
+    throw new Error('Missing credential handler')
+  }
+  return handler({}, value)
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.handlers.clear()
+})
+
+describe('OpenCode Go write-only credentials', () => {
+  it('returns only boolean status and provides no key reader', () => {
+    registerOpenCodeGoCredentialsHandlers(null)
+    mocks.has.mockReturnValue(true)
+    expect(invoke('getStatus')).toEqual({ apiKeyConfigured: true })
+    expect([...mocks.handlers.keys()]).toEqual([
+      'opencodeGoCredentials:getStatus',
+      'opencodeGoCredentials:saveApiKey',
+      'opencodeGoCredentials:clearApiKey'
+    ])
+  })
+
+  it.each(['saveApiKey', 'clearApiKey'])('invalidates before refreshing on %s', (action) => {
+    const invalidate = vi.fn()
+    const refresh = vi.fn(async () => {
+      expect(invalidate).toHaveBeenCalledOnce()
+      return createEmptyRateLimitState()
+    })
+    registerOpenCodeGoCredentialsHandlers({
+      invalidateOpenCodeGoCredentialState: invalidate,
+      refresh
+    })
+    mocks.has.mockReturnValue(action === 'saveApiKey')
+    expect(invoke(action, 'fake-key')).toEqual({ apiKeyConfigured: action === 'saveApiKey' })
+    expect(action === 'saveApiKey' ? mocks.save : mocks.clear).toHaveBeenCalledOnce()
+    expect(refresh).toHaveBeenCalledOnce()
+    // Why: only clearing the saved key may hide the chip; another key source can still exist after a save.
+    expect(invalidate).toHaveBeenCalledWith({ apiKeyCleared: action === 'clearApiKey' })
+  })
+
+  it.each([null, undefined, 42, {}])('rejects a non-string key', (key) => {
+    registerOpenCodeGoCredentialsHandlers(null)
+    expect(() => invoke('saveApiKey', key)).toThrow('OpenCode Go API key must be a string')
+    expect(mocks.save).not.toHaveBeenCalled()
+  })
+
+  it('does not refresh after a failed save', () => {
+    const invalidate = vi.fn()
+    const refresh = vi.fn()
+    registerOpenCodeGoCredentialsHandlers({
+      invalidateOpenCodeGoCredentialState: invalidate,
+      refresh
+    })
+    mocks.save.mockImplementation(() => {
+      throw new Error('Could not save credential')
+    })
+    expect(() => invoke('saveApiKey', 'fake-key')).toThrow('Could not save credential')
+    expect(invalidate).not.toHaveBeenCalled()
+    expect(refresh).not.toHaveBeenCalled()
+  })
+})

src/main/ipc/opencode-go-credentials.ts

@@ -0,0 +1,47 @@
+import { ipcMain } from 'electron'
+import {
+  clearOpenCodeGoApiKey,
+  hasOpenCodeGoApiKey,
+  saveOpenCodeGoApiKey
+} from '../opencode/opencode-go-api-key-store'
+import type { RateLimitService } from '../rate-limits/service'
+import { refreshAfterCredentialChange } from './credential-change-rate-limit-refresh'
+
+type CredentialRateLimits = Pick<
+  RateLimitService,
+  'invalidateOpenCodeGoCredentialState' | 'refresh'
+>
+
+function getOpenCodeGoCredentialsStatus(): { apiKeyConfigured: boolean } {
+  return { apiKeyConfigured: hasOpenCodeGoApiKey() }
+}
+
+function refreshAfterOpenCodeGoCredentialChange(
+  rateLimits: CredentialRateLimits | null,
+  apiKeyCleared: boolean
+): void {
+  refreshAfterCredentialChange(
+    rateLimits,
+    (service) => service.invalidateOpenCodeGoCredentialState({ apiKeyCleared }),
+    '[opencode-go] failed to refresh usage after a credential change:'
+  )
+}
+
+export function registerOpenCodeGoCredentialsHandlers(
+  rateLimits: CredentialRateLimits | null
+): void {
+  ipcMain.handle('opencodeGoCredentials:getStatus', () => getOpenCodeGoCredentialsStatus())
+  ipcMain.handle('opencodeGoCredentials:saveApiKey', (_event, key: unknown) => {
+    if (typeof key !== 'string') {
+      throw new Error('OpenCode Go API key must be a string')
+    }
+    saveOpenCodeGoApiKey(key)
+    refreshAfterOpenCodeGoCredentialChange(rateLimits, false)
+    return getOpenCodeGoCredentialsStatus()
+  })
+  ipcMain.handle('opencodeGoCredentials:clearApiKey', () => {
+    clearOpenCodeGoApiKey()
+    refreshAfterOpenCodeGoCredentialChange(rateLimits, true)
+    return getOpenCodeGoCredentialsStatus()
+  })
+}

src/main/ipc/register-core-handlers/register-core-handlers.test.ts

@@ -35,6 +35,7 @@ const {
   registerCodexAccountHandlersMock,
   registerAgentHookHandlersMock,
   registerClaudeAccountHandlersMock,
+  registerOpenCodeGoCredentialsHandlersMock,
   registerMiniMaxCredentialsHandlersMock,
   registerGrokAccountHandlersMock,
   registerCursorAccountHandlersMock,
@@ -102,6 +103,7 @@ const {
   registerCodexAccountHandlersMock: vi.fn(),
   registerAgentHookHandlersMock: vi.fn(),
   registerClaudeAccountHandlersMock: vi.fn(),
+  registerOpenCodeGoCredentialsHandlersMock: vi.fn(),
   registerMiniMaxCredentialsHandlersMock: vi.fn(),
   registerGrokAccountHandlersMock: vi.fn(),
   registerCursorAccountHandlersMock: vi.fn(),
@@ -332,6 +334,10 @@ vi.mock('../claude-accounts', () => ({
   registerClaudeAccountHandlers: registerClaudeAccountHandlersMock
 }))
 
+vi.mock('../opencode-go-credentials', () => ({
+  registerOpenCodeGoCredentialsHandlers: registerOpenCodeGoCredentialsHandlersMock
+}))
+
 vi.mock('../minimax-credentials', () => ({
   registerMiniMaxCredentialsHandlers: registerMiniMaxCredentialsHandlersMock
 }))
@@ -440,6 +446,7 @@ describe('registerCoreHandlers', () => {
     registerCodexAccountHandlersMock.mockReset()
     registerAgentHookHandlersMock.mockReset()
     registerClaudeAccountHandlersMock.mockReset()
+    registerOpenCodeGoCredentialsHandlersMock.mockReset()
     registerMiniMaxCredentialsHandlersMock.mockReset()
     registerClipboardHandlersMock.mockReset()
     setTrustedClipboardRendererWebContentsIdMock.mockReset()
@@ -539,6 +546,7 @@ describe('registerCoreHandlers', () => {
     )
     expect(registerPetHandlersMock).toHaveBeenCalled()
     expect(registerClaudeAccountHandlersMock).toHaveBeenCalledWith(claudeAccounts)
+    expect(registerOpenCodeGoCredentialsHandlersMock).toHaveBeenCalledWith(rateLimits)
     expect(registerMiniMaxCredentialsHandlersMock).toHaveBeenCalledWith(rateLimits)
     expect(registerGrokAccountHandlersMock).toHaveBeenCalled()
     expect(registerCursorAccountHandlersMock).toHaveBeenCalled()

src/main/ipc/register-core-handlers/register-core-handlers.ts

@@ -61,6 +61,7 @@ import { registerAgentHookHandlers } from '../agent-hooks'
 import { registerCodexConfigSyncHandlers } from '../codex-config-sync'
 import { getPtyIdForPaneKey } from '../pty'
 import { registerClaudeAccountHandlers } from '../claude-accounts'
+import { registerOpenCodeGoCredentialsHandlers } from '../opencode-go-credentials'
 import { registerMiniMaxCredentialsHandlers } from '../minimax-credentials'
 import { registerGrokAccountHandlers } from '../grok-accounts'
 import { registerCursorAccountHandlers } from '../cursor-accounts'
@@ -150,6 +151,7 @@ export function registerCoreHandlers(
   registerAgentHookHandlers(runtime, { getPtyIdForPaneKey })
   registerCodexConfigSyncHandlers(codexAccounts.runtimeHomeService)
   registerClaudeAccountHandlers(claudeAccounts)
+  registerOpenCodeGoCredentialsHandlers(rateLimits)
   registerMiniMaxCredentialsHandlers(rateLimits)
   registerGrokAccountHandlers()
   registerCursorAccountHandlers()

src/main/minimax/minimax-api-key-store.test.ts

@@ -36,6 +36,8 @@ vi.mock('node:path', () => ({
 
 vi.mock('../../shared/secure-file', () => ({
   hardenExistingSecureFile: hardenExistingSecureFileMock,
+  isUnreadableError: (error: unknown) =>
+    error instanceof Error && 'code' in error && error.code === 'EBUSY',
   writeSecureFile: writeSecureFileMock
 }))
 
@@ -102,7 +104,8 @@ describe('minimax-api-key-store', () => {
     expect(safeStorageMock.encryptString).toHaveBeenCalledWith('sk-test-1234567890')
     expect(writeSecureFileMock).toHaveBeenCalledWith(
       storePath,
-      envelope('encrypted', 'sk-test-1234567890')
+      envelope('encrypted', 'sk-test-1234567890'),
+      { durable: true }
     )
   })
 
@@ -114,7 +117,8 @@ describe('minimax-api-key-store', () => {
     store.saveMiniMaxApiKey('sk-test-1234567890')
     expect(writeSecureFileMock).toHaveBeenCalledWith(
       storePath,
-      envelope('plaintext', 'sk-test-1234567890')
+      envelope('plaintext', 'sk-test-1234567890'),
+      { durable: true }
     )
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('safeStorage encryption unavailable'))
     warn.mockRestore()
@@ -211,6 +215,23 @@ describe('minimax-api-key-store', () => {
     expect(() => store.readMiniMaxApiKey()).toThrow(/could not be decrypted/)
   })
 
+  it('reports a transient read failure as unreadable, not undecryptable, and retries next read', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const error = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    existsSyncMock.mockReturnValue(true)
+    readFileSyncMock.mockImplementationOnce(() => {
+      throw Object.assign(new Error('resource busy'), { code: 'EBUSY' })
+    })
+    readFileSyncMock.mockReturnValueOnce(Buffer.from(envelope('encrypted', 'encrypted-payload')))
+    safeStorageMock.decryptString.mockReturnValueOnce('sk-after-retry')
+    const store = await loadStore()
+    expect(() => store.readMiniMaxApiKey()).toThrow('MiniMax API key file could not be read')
+    expect(error).not.toHaveBeenCalled()
+    expect(store.readMiniMaxApiKey()).toBe('sk-after-retry')
+    warn.mockRestore()
+    error.mockRestore()
+  })
+
   it('clears the cached key and removes the file', async () => {
     existsSyncMock.mockReturnValueOnce(true)
     readFileSyncMock.mockReturnValueOnce(Buffer.from(envelope('encrypted', 'encrypted-payload')))

src/main/minimax/minimax-api-key-store.ts

@@ -1,147 +1,14 @@
-import { safeStorage } from 'electron'
-import { existsSync, readFileSync, rmSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { hardenExistingSecureFile, writeSecureFile } from '../../shared/secure-file'
-import type { SecretAtRestProtection } from '../../shared/secret-at-rest-protection'
+import { createEncryptedApiKeyFileStore } from '../credentials/encrypted-api-key-file-store'
 
-const MINIMAX_API_KEY_FILE = 'minimax-api-key.enc'
-const API_KEY_ENVELOPE_PREFIX = 'orca-minimax-api-key:v1:'
-let cachedMiniMaxApiKey: string | null = null
-let warnedMiniMaxApiKeyStatusHardenFailure = false
+const store = createEncryptedApiKeyFileStore({
+  fileName: 'minimax-api-key.enc',
+  envelopePrefix: 'orca-minimax-api-key:v1:',
+  providerLabel: 'MiniMax',
+  logScope: 'minimax'
+})
 
-type MiniMaxApiKeyEnvelope = {
-  kind: 'encrypted' | 'plaintext'
-  payload: Buffer
-}
-
-function getOrcaDir(): string {
-  return join(homedir(), '.orca')
-}
-
-function getMiniMaxApiKeyPath(): string {
-  return join(getOrcaDir(), MINIMAX_API_KEY_FILE)
-}
-
-function encodeApiKeyEnvelope(kind: MiniMaxApiKeyEnvelope['kind'], payload: Buffer): string {
-  return `${API_KEY_ENVELOPE_PREFIX}${kind}:${payload.toString('base64')}`
-}
-
-function decodeApiKeyEnvelope(raw: Buffer): MiniMaxApiKeyEnvelope {
-  const text = raw.toString('utf8')
-  if (!text.startsWith(API_KEY_ENVELOPE_PREFIX)) {
-    throw new Error('MiniMax API key could not be decrypted')
-  }
-  const rest = text.slice(API_KEY_ENVELOPE_PREFIX.length)
-  const separator = rest.indexOf(':')
-  if (separator === -1) {
-    throw new Error('MiniMax API key could not be decrypted')
-  }
-  const kind = rest.slice(0, separator)
-  if (kind !== 'encrypted' && kind !== 'plaintext') {
-    throw new Error('MiniMax API key could not be decrypted')
-  }
-  return {
-    kind,
-    payload: Buffer.from(rest.slice(separator + 1), 'base64')
-  }
-}
-
-function readEnvelope(envelope: MiniMaxApiKeyEnvelope): string {
-  if (envelope.kind === 'plaintext') {
-    return envelope.payload.toString('utf8')
-  }
-  if (!safeStorage.isEncryptionAvailable()) {
-    throw new Error('MiniMax API key could not be decrypted')
-  }
-  return safeStorage.decryptString(envelope.payload)
-}
-
-export function hasMiniMaxApiKey(): boolean {
-  const keyPath = getMiniMaxApiKeyPath()
-  if (!existsSync(keyPath)) {
-    return false
-  }
-  try {
-    hardenExistingSecureFile(keyPath)
-  } catch (error) {
-    if (!warnedMiniMaxApiKeyStatusHardenFailure) {
-      warnedMiniMaxApiKeyStatusHardenFailure = true
-      console.warn('[minimax] Failed to harden MiniMax API key file while checking status', error)
-    }
-  }
-  return true
-}
-
-/**
- * How the stored key is protected, or null when none is stored.
- *
- * Reads the envelope kind only — no decrypt, so this cannot trigger a keychain prompt
- * and is safe to call from a status handler.
- */
-export function getMiniMaxApiKeyProtection(): SecretAtRestProtection | null {
-  const keyPath = getMiniMaxApiKeyPath()
-  if (!existsSync(keyPath)) {
-    return null
-  }
-  try {
-    return decodeApiKeyEnvelope(readFileSync(keyPath)).kind === 'plaintext' ? 'plaintext' : 'sealed'
-  } catch {
-    // An undecodable envelope is a decrypt-time error to report, not a protection claim.
-    return null
-  }
-}
-
-export function saveMiniMaxApiKey(key: string): void {
-  const trimmed = key.trim()
-  if (!trimmed) {
-    throw new Error('MiniMax API key is required')
-  }
-  if (safeStorage.isEncryptionAvailable()) {
-    writeSecureFile(
-      getMiniMaxApiKeyPath(),
-      encodeApiKeyEnvelope('encrypted', safeStorage.encryptString(trimmed))
-    )
-    cachedMiniMaxApiKey = trimmed
-    return
-  }
-  console.warn(
-    '[minimax] safeStorage encryption unavailable — storing MiniMax API key in plaintext'
-  )
-  writeSecureFile(
-    getMiniMaxApiKeyPath(),
-    encodeApiKeyEnvelope('plaintext', Buffer.from(trimmed, 'utf8'))
-  )
-  cachedMiniMaxApiKey = trimmed
-}
-
-export function readMiniMaxApiKey(): string | null {
-  if (cachedMiniMaxApiKey !== null) {
-    return cachedMiniMaxApiKey
-  }
-  const keyPath = getMiniMaxApiKeyPath()
-  if (!existsSync(keyPath)) {
-    return null
-  }
-  // Why: keep hardening out of the decode/decrypt try below so a chmod/ACL
-  // failure isn't misreported as a decrypt failure (matches hasMiniMaxApiKey).
-  try {
-    hardenExistingSecureFile(keyPath)
-  } catch (error) {
-    console.warn('[minimax] Failed to harden MiniMax API key file while reading', error)
-  }
-  try {
-    const raw = readFileSync(keyPath)
-    const envelope = decodeApiKeyEnvelope(raw)
-    cachedMiniMaxApiKey = readEnvelope(envelope)
-    return cachedMiniMaxApiKey
-  } catch (error) {
-    console.error('[minimax] failed to decode/decrypt API key', error)
-    throw new Error('MiniMax API key could not be decrypted')
-  }
-}
-
-export function clearMiniMaxApiKey(): void {
-  cachedMiniMaxApiKey = null
-  rmSync(getMiniMaxApiKeyPath(), { force: true })
-}
+export const hasMiniMaxApiKey = store.has
+export const getMiniMaxApiKeyProtection = store.protection
+export const saveMiniMaxApiKey = store.save
+export const readMiniMaxApiKey = store.read
+export const clearMiniMaxApiKey = store.clear

src/main/opencode/opencode-go-api-key-store.test.ts

@@ -0,0 +1,99 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as NodeFs from 'node:fs'
+import type * as NodeOs from 'node:os'
+import { join } from 'node:path'
+
+const home = vi.hoisted(() => {
+  const state: { directory: string; readError: Error | null } = { directory: '', readError: null }
+  return state
+})
+vi.mock('node:os', async (importOriginal) => ({
+  ...(await importOriginal<typeof NodeOs>()),
+  homedir: () => home.directory
+}))
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFs>()
+  return {
+    ...actual,
+    readFileSync: (...args: Parameters<typeof actual.readFileSync>) => {
+      if (home.readError) {
+        throw home.readError
+      }
+      return actual.readFileSync(...args)
+    }
+  }
+})
+vi.mock('electron', () => ({
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (key: string) => Buffer.from(`encrypted:${key}`),
+    decryptString: (bytes: Buffer) => bytes.toString().slice('encrypted:'.length)
+  }
+}))
+
+beforeEach(() => {
+  home.readError = null
+  home.directory = mkdtempSync(join(tmpdir(), 'orca-go-key-store-'))
+  vi.resetModules()
+})
+afterEach(() => rmSync(home.directory, { recursive: true, force: true }))
+
+describe('OpenCode Go main-owned API key file', () => {
+  it('persists a versioned encrypted envelope, reads it after restart, and clears it', async () => {
+    const store = await import('./opencode-go-api-key-store')
+    expect(store.hasOpenCodeGoApiKey()).toBe(false)
+    store.saveOpenCodeGoApiKey(' fake-key ')
+    expect(store.hasOpenCodeGoApiKey()).toBe(true)
+    const path = join(home.directory, '.orca', 'opencode-go-api-key.enc')
+    expect(readFileSync(path, 'utf8')).toBe(
+      `orca-opencode-go-api-key:v1:encrypted:${Buffer.from('encrypted:fake-key').toString('base64')}`
+    )
+    vi.resetModules()
+    const restarted = await import('./opencode-go-api-key-store')
+    expect(restarted.readOpenCodeGoApiKey()).toBe('fake-key')
+    restarted.clearOpenCodeGoApiKey()
+    expect(restarted.hasOpenCodeGoApiKey()).toBe(false)
+    expect(restarted.readOpenCodeGoApiKey()).toBeNull()
+  })
+
+  it('keeps the MiniMax cache and file independent', async () => {
+    const go = await import('./opencode-go-api-key-store')
+    const miniMax = await import('../minimax/minimax-api-key-store')
+    go.saveOpenCodeGoApiKey('fake-go')
+    miniMax.saveMiniMaxApiKey('fake-minimax')
+    expect(go.readOpenCodeGoApiKey()).toBe('fake-go')
+    expect(miniMax.readMiniMaxApiKey()).toBe('fake-minimax')
+    go.clearOpenCodeGoApiKey()
+    expect(miniMax.hasMiniMaxApiKey()).toBe(true)
+    expect(miniMax.readMiniMaxApiKey()).toBe('fake-minimax')
+  })
+
+  it('rejects empty keys and malformed envelopes without returning the key', async () => {
+    const store = await import('./opencode-go-api-key-store')
+    expect(() => store.saveOpenCodeGoApiKey(' ')).toThrow('required')
+    store.saveOpenCodeGoApiKey('fake-key')
+    writeFileSync(join(home.directory, '.orca', 'opencode-go-api-key.enc'), 'fake-invalid-envelope')
+    vi.resetModules()
+    const restarted = await import('./opencode-go-api-key-store')
+    expect(() => restarted.readOpenCodeGoApiKey()).toThrow(
+      'OpenCode Go API key could not be decrypted'
+    )
+  })
+
+  it('throws a distinct unreadable error for a transient read failure', async () => {
+    const store = await import('./opencode-go-api-key-store')
+    store.saveOpenCodeGoApiKey('fake-key')
+    vi.resetModules()
+    const restarted = await import('./opencode-go-api-key-store')
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    home.readError = Object.assign(new Error('resource busy'), { code: 'EBUSY' })
+
+    expect(() => restarted.readOpenCodeGoApiKey()).toThrow(
+      'OpenCode Go API key file could not be read'
+    )
+    home.readError = null
+    expect(restarted.readOpenCodeGoApiKey()).toBe('fake-key')
+  })
+})

src/main/opencode/opencode-go-api-key-store.ts

@@ -0,0 +1,13 @@
+import { createEncryptedApiKeyFileStore } from '../credentials/encrypted-api-key-file-store'
+
+const store = createEncryptedApiKeyFileStore({
+  fileName: 'opencode-go-api-key.enc',
+  envelopePrefix: 'orca-opencode-go-api-key:v1:',
+  providerLabel: 'OpenCode Go',
+  logScope: 'opencode-go'
+})
+
+export const hasOpenCodeGoApiKey = store.has
+export const saveOpenCodeGoApiKey = store.save
+export const readOpenCodeGoApiKey = store.read
+export const clearOpenCodeGoApiKey = store.clear

src/main/persistence/applying-settings/settings-update.ts

@@ -60,9 +60,6 @@ export function updateSettings(
   if ('opencodeSessionCookie' in updates && !updates.opencodeSessionCookie) {
     operations.removeRetainedBlob(PROTECTED_SECRET_SLOT.opencodeSessionCookie)
   }
-  if ('opencodeGoApiKey' in updates && !updates.opencodeGoApiKey) {
-    operations.removeRetainedBlob(PROTECTED_SECRET_SLOT.opencodeGoApiKey)
-  }
   if ('httpProxyUrl' in updates && !updates.httpProxyUrl) {
     operations.removeRetainedBlob(PROTECTED_SECRET_SLOT.httpProxyUrl)
   }

src/main/persistence/applying-settings/terminal-settings-migrations.ts

@@ -60,6 +60,8 @@ type RetiredGlobalSettings = {
   terminalScrollbackBytes?: unknown
   enableGitHubAttribution?: unknown
   showAgentsSidebar?: unknown
+  // Why: #22551 kept this key in settings; it now lives in a main-owned store and must never ride along.
+  opencodeGoApiKey?: unknown
 }
 
 export function stripRetiredGlobalSettings(
@@ -69,11 +71,13 @@ export function stripRetiredGlobalSettings(
     terminalScrollbackBytes: _legacyScrollbackBytes,
     enableGitHubAttribution: _legacyGitHubAttribution,
     showAgentsSidebar: _legacyShowAgentsSidebar,
+    opencodeGoApiKey: _legacyOpenCodeGoApiKey,
     ...rest
   } = (settings ?? {}) as Partial<GlobalSettings> & RetiredGlobalSettings
   void _legacyScrollbackBytes
   void _legacyGitHubAttribution
   void _legacyShowAgentsSidebar
+  void _legacyOpenCodeGoApiKey
   return rest
 }
 

src/main/persistence/leasing-ssh-ptys/secret-validation.ts

@@ -6,13 +6,6 @@ export function isLegacyOpenCodeSessionCookie(value: string): boolean {
   )
 }
 
-// OpenCode Go keys are opaque bearer tokens; the console issues `sk-`
-// (legacy) and `oc_sk_` (new console) prefixes.
-export function isLegacyOpenCodeGoApiKey(value: string): boolean {
-  const trimmed = value.trim()
-  return /^(?:oc_)?sk[-_][A-Za-z0-9._-]+$/.test(trimmed)
-}
-
 export function isLegacySshPtyOwnerLease(value: string): boolean {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)
 }

src/main/persistence/loading-store/legacy-opencode-go-api-key-migration.test.ts

@@ -0,0 +1,200 @@
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+
+const secretStore = vi.hoisted(() => ({
+  isEncryptionAvailable: vi.fn(() => true),
+  encryptString: vi.fn((value: string) => Buffer.from(`enc:${value}`)),
+  decryptString: vi.fn((value: Buffer) => value.toString().slice(4))
+}))
+
+vi.mock('../../../shared/secret-store', () => ({ getSecretStore: () => secretStore }))
+
+const { ProtectedSecretPersistence } = await import('../../protected-secret-persistence')
+const {
+  LEGACY_OPENCODE_GO_API_KEY_SLOT,
+  migrateLegacyOpenCodeGoApiKey,
+  retainLegacyOpenCodeGoApiKey
+} = await import('./legacy-opencode-go-api-key-migration')
+
+const SEALED = Buffer.from('enc:fake-legacy-key').toString('base64')
+
+function memoryStore(initial: string | null = null): {
+  has: () => boolean
+  read: () => string | null
+  save: Mock<(key: string) => void>
+  value: () => string | null
+} {
+  let saved = initial
+  return {
+    has: () => saved !== null,
+    read: () => saved,
+    save: vi.fn((key: string) => {
+      saved = key
+    }),
+    value: () => saved
+  }
+}
+
+function parked(value: unknown = SEALED): InstanceType<typeof ProtectedSecretPersistence> {
+  const secrets = new ProtectedSecretPersistence()
+  retainLegacyOpenCodeGoApiKey({ opencodeGoApiKey: value }, secrets)
+  return secrets
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  secretStore.isEncryptionAvailable.mockReturnValue(true)
+  secretStore.decryptString.mockImplementation((value: Buffer) => value.toString().slice(4))
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('retainLegacyOpenCodeGoApiKey', () => {
+  it('drops the field from settings and parks the ciphertext without decrypting it', () => {
+    const settings: Record<string, unknown> = { opencodeGoApiKey: SEALED, other: 1 }
+    const secrets = new ProtectedSecretPersistence()
+
+    retainLegacyOpenCodeGoApiKey(settings, secrets)
+
+    expect(settings).toEqual({ other: 1 })
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBe(SEALED)
+    expect(secretStore.decryptString).not.toHaveBeenCalled()
+  })
+
+  it('seals a #22551 plaintext key before parking it, and migration still recovers it', () => {
+    const secrets = parked('sk-fake-plaintext-key')
+
+    const blob = secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)
+    expect(blob).toBe(Buffer.from('enc:sk-fake-plaintext-key').toString('base64'))
+    const store = memoryStore()
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(true)
+    expect(store.value()).toBe('sk-fake-plaintext-key')
+  })
+
+  it('parks a plaintext key verbatim while encryption is unavailable', () => {
+    secretStore.isEncryptionAvailable.mockReturnValue(false)
+    const secrets = parked('sk-fake-plaintext-key')
+
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBe('sk-fake-plaintext-key')
+    expect(secretStore.encryptString).not.toHaveBeenCalled()
+  })
+
+  it('ignores settings without the field and drops malformed values', () => {
+    const secrets = new ProtectedSecretPersistence()
+    retainLegacyOpenCodeGoApiKey({ other: 1 }, secrets)
+    retainLegacyOpenCodeGoApiKey(undefined, secrets)
+    const malformed: Record<string, unknown> = { opencodeGoApiKey: { nested: 'fake' } }
+    retainLegacyOpenCodeGoApiKey(malformed, secrets)
+
+    expect(malformed).toEqual({})
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBeNull()
+  })
+})
+
+describe('migrateLegacyOpenCodeGoApiKey', () => {
+  it('saves the key into an empty store, then releases the legacy value', () => {
+    const secrets = parked()
+    const store = memoryStore()
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(true)
+    expect(store.value()).toBe('fake-legacy-key')
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBeNull()
+  })
+
+  it('is idempotent: a second run has nothing left to move', () => {
+    const secrets = parked()
+    const store = memoryStore()
+
+    migrateLegacyOpenCodeGoApiKey(secrets, store)
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(false)
+    expect(store.save).toHaveBeenCalledOnce()
+  })
+
+  it('never overwrites a readable key already saved in the store, and releases the legacy value', () => {
+    const secrets = parked()
+    const store = memoryStore('fake-current-key')
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(true)
+    expect(store.save).not.toHaveBeenCalled()
+    expect(store.value()).toBe('fake-current-key')
+    expect(secretStore.decryptString).not.toHaveBeenCalled()
+    expect(console.warn).toHaveBeenCalledWith(
+      '[opencode-go] Kept the existing saved API key and dropped the one from settings.'
+    )
+  })
+
+  it('keeps the legacy value when the existing store file cannot be read by this build', () => {
+    const secrets = parked()
+    const store = {
+      ...memoryStore('fake-other-build-key'),
+      read: () => {
+        throw new Error('OpenCode Go API key could not be decrypted')
+      }
+    }
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(false)
+    expect(store.save).not.toHaveBeenCalled()
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBe(SEALED)
+  })
+
+  it('keeps the ciphertext while safeStorage is unavailable so a later startup retries', () => {
+    const secrets = parked()
+    const store = memoryStore()
+    secretStore.isEncryptionAvailable.mockReturnValue(false)
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(false)
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBe(SEALED)
+
+    secretStore.isEncryptionAvailable.mockReturnValue(true)
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(true)
+    expect(store.value()).toBe('fake-legacy-key')
+  })
+
+  it('keeps the ciphertext after a definitive decrypt failure', () => {
+    const secrets = parked()
+    const store = memoryStore()
+    secretStore.decryptString.mockImplementation(() => {
+      throw new Error('bad key')
+    })
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(false)
+    expect(store.save).not.toHaveBeenCalled()
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBe(SEALED)
+  })
+
+  it('moves a plaintext key #22551 accepted when it failed to decrypt', () => {
+    secretStore.isEncryptionAvailable.mockReturnValue(false)
+    const secrets = parked('sk-fake-plaintext-key')
+    secretStore.isEncryptionAvailable.mockReturnValue(true)
+    const store = memoryStore()
+    secretStore.decryptString.mockImplementation(() => {
+      throw new Error('not ciphertext')
+    })
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(true)
+    expect(store.value()).toBe('sk-fake-plaintext-key')
+  })
+
+  it('keeps the ciphertext when the store cannot save, without logging the key', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const secrets = parked()
+    const store = {
+      has: () => false,
+      read: () => null,
+      save: () => {
+        throw new Error('disk full')
+      }
+    }
+
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, store)).toBe(false)
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBe(SEALED)
+    expect(JSON.stringify(warn.mock.calls)).not.toContain('fake-legacy-key')
+
+    const working = memoryStore()
+    expect(migrateLegacyOpenCodeGoApiKey(secrets, working)).toBe(true)
+    expect(working.value()).toBe('fake-legacy-key')
+    expect(secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)).toBeNull()
+  })
+})

src/main/persistence/loading-store/legacy-opencode-go-api-key-migration.ts

@@ -0,0 +1,100 @@
+import type { ProtectedSecretPersistence } from '../../protected-secret-persistence'
+
+// Why a private slot: #22551 sealed the key under this name; only this migration still reads it.
+export const LEGACY_OPENCODE_GO_API_KEY_SLOT = 'settings.opencodeGoApiKey'
+
+type LegacyOpenCodeGoApiKeySecrets = Pick<
+  ProtectedSecretPersistence,
+  'decryptWithStatus' | 'removeRetainedBlob' | 'retainSealed' | 'sealedBlob'
+>
+
+export type OpenCodeGoApiKeyTarget = {
+  has: () => boolean
+  /** Throws when the saved key cannot be read or decrypted by this build. */
+  read: () => string | null
+  save: (key: string) => void
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+// #22551 accepted a plaintext `sk-`/`oc_sk_` value that failed to decrypt; keep honoring it.
+function isLegacyPlaintextOpenCodeGoApiKey(value: string): boolean {
+  return /^(?:oc_)?sk[-_][A-Za-z0-9._-]+$/.test(value.trim())
+}
+
+/**
+ * Moves the #22551 settings value out of settings and parks its ciphertext undecrypted, so every
+ * Store consumer (orcad included) writes it back until the desktop migration gives it a new home.
+ */
+export function retainLegacyOpenCodeGoApiKey(
+  settings: unknown,
+  secrets: Pick<ProtectedSecretPersistence, 'encrypt' | 'retainSealed'>
+): void {
+  if (!isRecord(settings) || !('opencodeGoApiKey' in settings)) {
+    return
+  }
+  const sealed = settings.opencodeGoApiKey
+  // Why: in-memory settings reach the renderer and remote settings.get; the key must not ride along.
+  delete settings.opencodeGoApiKey
+  if (typeof sealed !== 'string' || !sealed) {
+    return
+  }
+  if (!isLegacyPlaintextOpenCodeGoApiKey(sealed)) {
+    secrets.retainSealed(LEGACY_OPENCODE_GO_API_KEY_SLOT, sealed)
+    return
+  }
+  // Why: orcad-only profiles never migrate, so seal it now; without encryption #22551 kept it plaintext too.
+  const encrypted = secrets.encrypt(LEGACY_OPENCODE_GO_API_KEY_SLOT, sealed)
+  secrets.retainSealed(
+    LEGACY_OPENCODE_GO_API_KEY_SLOT,
+    encrypted.degraded ? sealed : encrypted.blob
+  )
+}
+
+/**
+ * Saves the parked key into the main-owned store; a key already saved there wins.
+ * @returns True once the legacy value is released and may be dropped from disk.
+ */
+export function migrateLegacyOpenCodeGoApiKey(
+  secrets: LegacyOpenCodeGoApiKeySecrets,
+  target: OpenCodeGoApiKeyTarget
+): boolean {
+  const sealed = secrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)
+  if (!sealed) {
+    return false
+  }
+  try {
+    // Why: a file another app identity sealed is unreadable here; read throws and keeps the legacy key.
+    const existing = target.has() ? target.read() : null
+    if (existing === null) {
+      const decrypted = secrets.decryptWithStatus(
+        LEGACY_OPENCODE_GO_API_KEY_SLOT,
+        sealed,
+        isLegacyPlaintextOpenCodeGoApiKey
+      )
+      // Why keep a definitive failure too: a restored keychain can still open the inert ciphertext, while dropping it is irreversible.
+      if (decrypted.status === 'unavailable' || !decrypted.plaintext) {
+        secrets.retainSealed(LEGACY_OPENCODE_GO_API_KEY_SLOT, sealed)
+        return false
+      }
+      const key = decrypted.plaintext.trim()
+      if (key) {
+        target.save(key)
+      }
+    } else {
+      // Why: the store is machine-wide, so another profile's key can win; leave a trace of the drop.
+      console.warn(
+        '[opencode-go] Kept the existing saved API key and dropped the one from settings.'
+      )
+    }
+  } catch {
+    // Why: startup must not fail on a disk or keychain error; the next startup retries.
+    secrets.retainSealed(LEGACY_OPENCODE_GO_API_KEY_SLOT, sealed)
+    console.warn('[opencode-go] Could not migrate the saved API key out of settings.')
+    return false
+  }
+  secrets.removeRetainedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)
+  return true
+}

src/main/persistence/loading-store/loaded-state-parsing.ts

@@ -14,11 +14,11 @@ import {
   sshPtyOwnerLeaseSecretSlot
 } from '../../protected-secret-persistence'
 import {
-  isLegacyOpenCodeGoApiKey,
   isLegacyOpenCodeSessionCookie,
   isLegacySshPtyOwnerLease
 } from '../leasing-ssh-ptys/secret-validation'
 import { readGithubCacheSnapshot } from './user-data-path'
+import { retainLegacyOpenCodeGoApiKey } from './legacy-opencode-go-api-key-migration'
 import {
   gcStaleWorktreeMeta,
   normalizeWorktreeLinkedItemMetadata
@@ -113,13 +113,7 @@ export class LoadedStateParsingOperations {
             isLegacyOpenCodeSessionCookie
           )
         }
-        if (parsed.settings?.opencodeGoApiKey) {
-          parsed.settings.opencodeGoApiKey = this.runtime.protectedSecrets.decrypt(
-            PROTECTED_SECRET_SLOT.opencodeGoApiKey,
-            parsed.settings.opencodeGoApiKey,
-            isLegacyOpenCodeGoApiKey
-          )
-        }
+        retainLegacyOpenCodeGoApiKey(parsed.settings, this.runtime.protectedSecrets)
         if (parsed.settings?.httpProxyUrl) {
           const decryptedProxy = this.runtime.protectedSecrets.decryptWithStatus(
             PROTECTED_SECRET_SLOT.httpProxyUrl,

src/main/persistence/loading-store/state-serialization-secret-handling.ts

@@ -12,6 +12,7 @@ import {
   type ProtectedSecretRetentionUpdate
 } from '../../protected-secret-persistence'
 import { stripRetiredGlobalSettings } from '../applying-settings/terminal-settings-migrations'
+import { LEGACY_OPENCODE_GO_API_KEY_SLOT } from './legacy-opencode-go-api-key-migration'
 import { omitDefaultWorktreeMetaFieldsInMap } from '../../../shared/worktree/meta-persisted-defaults'
 import { projectWorktreeMetaByIdentityOntoLocators } from './worktree-meta-alias-projection'
 import { withoutRedundantPartitionGlobals } from '../../../shared/workspace-session-host-field-ownership'
@@ -260,10 +261,9 @@ export class StateSerializationSecretHandlingOperations {
         PROTECTED_SECRET_SLOT.opencodeSessionCookie,
         this.runtime.state.settings.opencodeSessionCookie
       ),
-      opencodeGoApiKey: encrypt(
-        PROTECTED_SECRET_SLOT.opencodeGoApiKey,
-        this.runtime.state.settings.opencodeGoApiKey ?? ''
-      ),
+      ...(this.runtime.protectedSecrets.sealedBlob(LEGACY_OPENCODE_GO_API_KEY_SLOT)
+        ? { opencodeGoApiKey: encrypt(LEGACY_OPENCODE_GO_API_KEY_SLOT, '') }
+        : {}),
       httpProxyUrl: encrypt(
         PROTECTED_SECRET_SLOT.httpProxyUrl,
         this.runtime.state.settings.httpProxyUrl ?? ''

src/main/persistence/loading-store/state-write-round-trip.test.ts

@@ -1,7 +1,8 @@
 import {
   closeTestStores,
   createSqliteTestStore,
-  readPersistedStateJson
+  readPersistedStateJson,
+  writePersistedStateJson
 } from '../../persistence-test-harness'
 /**
  * The write path now hands the file a Buffer it built in one pass instead of a string it rebuilt
@@ -10,6 +11,7 @@ import {
  * against (a mis-sliced segment, a re-encoded payload, a dropped sentinel) is invisible until
  * something reads the bytes back.
  */
+import { getSecretStore } from '../../../shared/secret-store'
 import { mkdtempSync, realpathSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -77,6 +79,68 @@ function session(activeTabId: string): WorkspaceSessionState {
 }
 
 describe('persisted state survives a save/load round trip', () => {
+  it('keeps a #22551 settings-slot OpenCode Go key on disk until its new owner has it', () => {
+    const dataFile = join(
+      realpathSync(mkdtempSync(join(tmpdir(), 'orca-legacy-opencode-go-key-'))),
+      'state.json'
+    )
+    const first = openStore(dataFile)
+    first.updateSettings({ opencodeWorkspaceId: 'wrk_test' })
+    first.flush()
+    const persisted = JSON.parse(readPersistedStateJson(dataFile))
+    // Sealed exactly as #22551's protected-secret slot wrote it.
+    const sealed = getSecretStore().encryptString('fake-legacy-key').toString('base64')
+    persisted.settings.opencodeGoApiKey = sealed
+    writePersistedStateJson(dataFile, JSON.stringify(persisted))
+    const onDiskKey = (): unknown =>
+      JSON.parse(readPersistedStateJson(dataFile)).settings.opencodeGoApiKey
+
+    // orcad-style consumer: loads and flushes the profile but never runs the migration.
+    const daemon = createSqliteTestStore(Store, { dataFile })
+    stores.push(daemon)
+    expect(daemon.getSettings()).not.toHaveProperty('opencodeGoApiKey')
+    daemon.updateSettings({ opencodeWorkspaceId: 'wrk_daemon' })
+    daemon.flush()
+    expect(onDiskKey()).toBe(sealed)
+    expect(readPersistedStateJson(dataFile)).not.toContain('fake-legacy-key')
+
+    const loaded = openStore(dataFile)
+    expect(loaded.getSettings().opencodeWorkspaceId).toBe('wrk_daemon')
+    expect(loaded.getSettings()).not.toHaveProperty('opencodeGoApiKey')
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    loaded.migrateLegacyOpenCodeGoApiKey({
+      has: () => false,
+      read: () => null,
+      save: () => {
+        throw new Error('disk full')
+      }
+    })
+    loaded.flush()
+    expect(onDiskKey()).toBe(sealed)
+
+    // Why: an older paired client can still send the retired field; it must not be stored.
+    const updates = { opencodeGoApiKey: 'fake-remote-key', opencodeWorkspaceId: 'wrk_next' }
+    expect(loaded.updateSettings(updates)).not.toHaveProperty('opencodeGoApiKey')
+    loaded.flush()
+    expect(onDiskKey()).toBe(sealed)
+
+    const saved: string[] = []
+    loaded.migrateLegacyOpenCodeGoApiKey({
+      has: () => saved.length > 0,
+      read: () => saved[0] ?? null,
+      save: (key) => saved.push(key)
+    })
+    loaded.migrateLegacyOpenCodeGoApiKey({
+      has: () => saved.length > 0,
+      read: () => saved[0] ?? null,
+      save: (key) => saved.push(key)
+    })
+    expect(saved).toEqual(['fake-legacy-key'])
+    loaded.flush()
+    expect(readPersistedStateJson(dataFile)).not.toContain('opencodeGoApiKey')
+    expect(openStore(dataFile).getSettings()).not.toHaveProperty('opencodeGoApiKey')
+  })
+
   it('reloads settings, secrets and both session partitions unchanged', () => {
     const dataFile = join(
       realpathSync(mkdtempSync(join(tmpdir(), 'orca-store-round-trip-'))),

src/main/persistence/loading-store/store.ts

@@ -17,6 +17,10 @@ import {
 } from './store-domain-composition'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import { scheduleSave } from './write-scheduling'
+import {
+  migrateLegacyOpenCodeGoApiKey,
+  type OpenCodeGoApiKeyTarget
+} from './legacy-opencode-go-api-key-migration'
 import { enqueuePrimaryStateOperation, writeToDiskAsync } from './primary-state-writes'
 import type { ProfileStateDatabaseQuarantine } from '../profile-state/profile-state-database-quarantine'
 import { writeVersionedProfileStateExport } from '../profile-state/legacy-json/profile-state-versioned-export'
@@ -151,6 +155,13 @@ export class Store {
     }
   }
 
+  /** Moves the #22551 settings-slot OpenCode Go key into `target`; it stays on disk until that succeeds. */
+  migrateLegacyOpenCodeGoApiKey(target: OpenCodeGoApiKeyTarget): void {
+    if (migrateLegacyOpenCodeGoApiKey(this.runtime.protectedSecrets, target)) {
+      scheduleSave(this.domains.scheduling)
+    }
+  }
+
   getProfileStorageDirectory(): string {
     return dirname(this.runtime.dataFile)
   }

src/main/protected-secret-persistence.ts

@@ -2,7 +2,6 @@ import { getSecretStore } from '../shared/secret-store'
 
 export const PROTECTED_SECRET_SLOT = {
   opencodeSessionCookie: 'settings.opencodeSessionCookie',
-  opencodeGoApiKey: 'settings.opencodeGoApiKey',
   httpProxyUrl: 'settings.httpProxyUrl',
   browserKagiSessionLink: 'ui.browserKagiSessionLink'
 } as const
@@ -49,6 +48,17 @@ export class ProtectedSecretPersistence {
     this.pendingEncryption.delete(slot)
   }
 
+  /** Parks ciphertext without allowing an earlier pending write to replace it. */
+  retainSealed(slot: string, blob: string): void {
+    this.removeRetainedBlob(slot)
+    this.retainedBlobs.set(slot, blob)
+    this.sealedSlots.add(slot)
+  }
+
+  sealedBlob(slot: string): string | null {
+    return this.sealedSlots.has(slot) ? (this.retainedBlobs.get(slot) ?? null) : null
+  }
+
   isSealed(slot: string, value: string): boolean {
     return this.sealedSlots.has(slot) && this.retainedBlobs.get(slot) === value
   }

src/main/rate-limits/opencode-go-api-key-source.test.ts

@@ -107,7 +107,7 @@ describe('resolveOpenCodeGoApiKey', () => {
     })
   })
 
-  it('falls back to the key OpenCode 1.x saved on /connect', async () => {
+  it('falls back to the key OpenCode 1.x saved on /connect when the table is empty', async () => {
     writeAuthFile({
       anthropic: { type: 'oauth', refresh: 'r', access: 'a', expires: 1 },
       'opencode-go': { type: 'api', key: AUTH_FILE_KEY }
@@ -139,6 +139,34 @@ describe('resolveOpenCodeGoApiKey', () => {
     })
   })
 
+  it('prefers the credential table over a stale auth.json, since OpenCode 2 stops writing the file', async () => {
+    process.env.OPENCODE_API_KEY = ENVIRONMENT_KEY
+    writeAuthFile({ 'opencode-go': { type: 'api', key: AUTH_FILE_KEY } })
+    const { path } = writeCredentialDatabase([
+      { value: JSON.stringify({ type: 'key', key: DATABASE_KEY }), active: 1, created: 1 }
+    ])
+    process.env.OPENCODE_DB = path
+
+    await expect(resolveOpenCodeGoApiKey({})).resolves.toEqual({
+      status: 'found',
+      key: DATABASE_KEY,
+      tier: 'opencode-credential-database'
+    })
+  })
+
+  it('keeps the settings override above the credential table', async () => {
+    const { path } = writeCredentialDatabase([
+      { value: JSON.stringify({ type: 'key', key: DATABASE_KEY }), active: 1, created: 1 }
+    ])
+    process.env.OPENCODE_DB = path
+
+    await expect(resolveOpenCodeGoApiKey({ settingsOverride: SETTINGS_KEY })).resolves.toEqual({
+      status: 'found',
+      key: SETTINGS_KEY,
+      tier: 'settings'
+    })
+  })
+
   it('reports missing when no tier holds a key', async () => {
     writeAuthFile({ 'opencode-go': { type: 'oauth', refresh: 'r', access: 'a', expires: 1 } })
 

src/main/rate-limits/opencode-go-api-key-source.ts

@@ -160,13 +160,13 @@ export async function readOpenCodeCredentialDatabaseGoKey(): Promise<string | nu
  * Resolve the OpenCode Go API key in the documented precedence order.
  *
  * Settings override, then whatever OpenCode itself stored on `/connect` —
- * `auth.json`, then the `credential` table — then `OPENCODE_API_KEY`. Both
- * stores are probed on every version: 1.18.x creates the `credential` table too,
- * so its presence is not a 2.x marker, and a 2.x install that never ran the
- * legacy import has no `auth.json` at all.
+ * the `credential` table, then `auth.json` — then `OPENCODE_API_KEY`. The table
+ * wins because OpenCode 2 imports `auth.json` once and never writes it again,
+ * so a key re-connected on 2.x would otherwise be shadowed by a stale file; on
+ * 1.x the table exists but stays empty, so `auth.json` still decides there.
  * The stored key outranks the env var because OpenCode applies it after env,
  * and the env var is shared with the Zen provider.
- * @param input.settingsOverride - The key a user pasted into Orca's settings.
+ * @param input.settingsOverride - The key a user saved in Orca's settings.
  * @param input.environment - Process environment to read; injectable for tests.
  * @returns The first key found and the tier it came from, or `missing`.
  */
@@ -179,14 +179,14 @@ export async function resolveOpenCodeGoApiKey(input: {
   if (override) {
     return { status: 'found', key: override, tier: 'settings' }
   }
-  const fromAuthFile = readOpenCodeAuthFileGoKey(environment)
-  if (fromAuthFile) {
-    return { status: 'found', key: fromAuthFile, tier: 'opencode-auth-file' }
-  }
   const fromDatabase = await readOpenCodeCredentialDatabaseGoKey()
   if (fromDatabase) {
     return { status: 'found', key: fromDatabase, tier: 'opencode-credential-database' }
   }
+  const fromAuthFile = readOpenCodeAuthFileGoKey(environment)
+  if (fromAuthFile) {
+    return { status: 'found', key: fromAuthFile, tier: 'opencode-auth-file' }
+  }
   const fromEnvironment = trimmedKey(environment[OPENCODE_API_KEY_ENV])
   if (fromEnvironment) {
     return { status: 'found', key: fromEnvironment, tier: 'environment' }

src/main/rate-limits/service-opencode-go-credentials.test.ts

@@ -0,0 +1,195 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProviderRateLimits } from '../../shared/rate-limit-types'
+import { RateLimitService } from './service'
+import { fetchClaudeRateLimits } from './claude-fetcher'
+import { fetchCodexRateLimits } from './codex-fetcher'
+import { fetchOpenCodeGoUsage } from './opencode-go-usage-source-selection'
+import { ApiKeyFileUnreadableError } from '../credentials/api-key-file-unreadable-error'
+import {
+  deferred,
+  flushMicrotasks,
+  okProvider,
+  resetRateLimitProviderMocks,
+  unavailableProvider
+} from './rate-limit-service-test-harness'
+
+vi.mock('./claude-fetcher', () => ({
+  fetchClaudeRateLimits: vi.fn(),
+  fetchManagedAccountUsage: vi.fn()
+}))
+
+vi.mock('./codex-fetcher', () => ({
+  consumeCodexRateLimitResetCredit: vi.fn(),
+  fetchCodexRateLimits: vi.fn()
+}))
+
+vi.mock('./gemini-usage-fetcher', () => ({
+  fetchGeminiRateLimits: vi.fn()
+}))
+
+vi.mock('./kimi-fetcher', () => ({
+  fetchKimiRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-fetcher', () => ({ fetchCursorRateLimits: vi.fn() }))
+vi.mock('./cursor-auth', () => ({ readCursorAuthSession: vi.fn() }))
+vi.mock('./zcode-usage-fetcher', () => ({ fetchZcodeRateLimits: vi.fn() }))
+vi.mock('./antigravity-usage-fetcher', () => ({ fetchAntigravityRateLimits: vi.fn() }))
+
+vi.mock('./opencode-go-usage-source-selection', () => ({
+  fetchOpenCodeGoUsage: vi.fn()
+}))
+
+vi.mock('./minimax/minimax-fetcher', () => ({
+  fetchMiniMaxRateLimits: vi.fn()
+}))
+
+vi.mock('./grok-fetcher', () => ({
+  fetchGrokRateLimits: vi.fn()
+}))
+
+vi.mock('./grok-auth', () => ({
+  readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
+}))
+
+vi.mock('../minimax/minimax-cookie-store', () => ({
+  hasMiniMaxSessionCookie: vi.fn(() => false)
+}))
+
+const DECRYPT_ERROR =
+  'OpenCode Go API key could not be decrypted. Re-enter or clear the key in Settings.'
+
+function serviceWithCookie(apiKeyResolver: () => string | null): RateLimitService {
+  const service = new RateLimitService()
+  service.setOpenCodeGoConfigResolver(
+    () => ({ sessionCookie: 'auth=fake-cookie', workspaceIdOverride: '' }),
+    apiKeyResolver
+  )
+  return service
+}
+
+function undecryptableKey(): string | null {
+  throw new Error('OpenCode Go API key could not be decrypted')
+}
+
+describe('OpenCode Go credential state', () => {
+  beforeEach(() => {
+    resetRateLimitProviderMocks()
+    vi.mocked(fetchClaudeRateLimits).mockResolvedValue(okProvider('claude', 0))
+    vi.mocked(fetchCodexRateLimits).mockResolvedValue(okProvider('codex', 0))
+  })
+
+  it('treats an undecryptable saved key as absent so the cookie still produces usage', async () => {
+    const service = serviceWithCookie(undecryptableKey)
+    vi.mocked(fetchOpenCodeGoUsage).mockResolvedValueOnce(okProvider('opencode-go', 40))
+
+    await service.refresh()
+
+    expect(fetchOpenCodeGoUsage).toHaveBeenCalledWith(
+      expect.objectContaining({ settingsApiKey: '', cookie: 'auth=fake-cookie' })
+    )
+    const state = service.getState()
+    expect(state.opencodeGo?.status).toBe('ok')
+    expect(state.opencodeGo?.error).toBeNull()
+  })
+
+  it('shows the decrypt error only when no other source produced usage', async () => {
+    const service = serviceWithCookie(undecryptableKey)
+    vi.mocked(fetchOpenCodeGoUsage).mockImplementationOnce(async (input) => {
+      input.onApiKeyResolved?.({ status: 'missing' })
+      return unavailableProvider('opencode-go', 'No OpenCode Go API key or session cookie')
+    })
+
+    await service.refresh()
+
+    const state = service.getState()
+    expect(state.opencodeGo?.status).toBe('error')
+    expect(state.opencodeGo?.error).toBe(DECRYPT_ERROR)
+    // Why: the bar must stay visible to surface how to fix the saved key.
+    expect(state.opencodeGoApiKeyConfigured).toBe(true)
+  })
+
+  it('skips a transiently unreadable saved key without blaming it, keeping the bar visible', async () => {
+    const service = serviceWithCookie(() => {
+      throw new ApiKeyFileUnreadableError('OpenCode Go API key file could not be read')
+    })
+    vi.mocked(fetchOpenCodeGoUsage).mockImplementationOnce(async (input) => {
+      input.onApiKeyResolved?.({ status: 'missing' })
+      return unavailableProvider('opencode-go', 'No OpenCode Go API key or session cookie')
+    })
+
+    await service.refresh()
+
+    expect(fetchOpenCodeGoUsage).toHaveBeenCalledWith(
+      expect.objectContaining({ settingsApiKey: '', cookie: 'auth=fake-cookie' })
+    )
+    const state = service.getState()
+    expect(state.opencodeGo?.status).toBe('unavailable')
+    expect(state.opencodeGo?.error).not.toBe(DECRYPT_ERROR)
+    expect(state.opencodeGoApiKeyConfigured).toBe(true)
+  })
+
+  it('keeps a real cookie error instead of the decrypt error', async () => {
+    const service = serviceWithCookie(undecryptableKey)
+    vi.mocked(fetchOpenCodeGoUsage).mockResolvedValueOnce({
+      ...unavailableProvider('opencode-go', 'OpenCode session cookie expired'),
+      status: 'error'
+    })
+
+    await service.refresh()
+
+    const state = service.getState()
+    expect(state.opencodeGo?.status).toBe('error')
+    expect(state.opencodeGo?.error).toBe('OpenCode session cookie expired')
+  })
+
+  it('keeps the chip visible across a cookie change while a key source exists', async () => {
+    const service = serviceWithCookie(() => null)
+    vi.mocked(fetchOpenCodeGoUsage).mockImplementation(async (input) => {
+      input.onApiKeyResolved?.({ status: 'found', key: 'fake-env-key', tier: 'environment' })
+      return okProvider('opencode-go', 10)
+    })
+    await service.refresh()
+    expect(service.getState().opencodeGoApiKeyConfigured).toBe(true)
+
+    service.invalidateOpenCodeGoCredentialState()
+
+    expect(service.getState().opencodeGo?.status).toBe('fetching')
+    expect(service.getState().opencodeGoApiKeyConfigured).toBe(true)
+
+    service.invalidateOpenCodeGoCredentialState({ apiKeyCleared: true })
+    expect(service.getState().opencodeGoApiKeyConfigured).toBe(false)
+  })
+
+  it('passes the saved key to the fetch as the settings override', async () => {
+    const service = serviceWithCookie(() => 'fake-saved-key')
+
+    await service.refresh()
+
+    expect(fetchOpenCodeGoUsage).toHaveBeenCalledWith(
+      expect.objectContaining({ settingsApiKey: 'fake-saved-key' })
+    )
+  })
+
+  it('drops an in-flight result fetched with a credential that was since replaced', async () => {
+    const service = serviceWithCookie(() => 'fake-old-key')
+    const pending = deferred<ProviderRateLimits>()
+    let resolvedWithOldKey: (() => void) | undefined
+    vi.mocked(fetchOpenCodeGoUsage).mockImplementationOnce((input) => {
+      resolvedWithOldKey = () =>
+        input.onApiKeyResolved?.({ status: 'found', key: 'fake-old-key', tier: 'settings' })
+      return pending.promise
+    })
+
+    const refresh = service.refresh()
+    await flushMicrotasks()
+    service.invalidateOpenCodeGoCredentialState()
+    resolvedWithOldKey?.()
+    pending.resolve(okProvider('opencode-go', 90))
+    await refresh
+
+    const state = service.getState()
+    expect(state.opencodeGo?.session?.usedPercent).not.toBe(90)
+    expect(state.opencodeGoApiKeyConfigured).toBe(false)
+  })
+})

src/main/rate-limits/service-refresh-orchestration.test.ts

@@ -431,8 +431,7 @@ describe('RateLimitService', () => {
     const service = new RateLimitService()
     service.setOpenCodeGoConfigResolver(() => ({
       sessionCookie: 'session=abc123',
-      workspaceIdOverride: '',
-      apiKey: ''
+      workspaceIdOverride: ''
     }))
     const networkProxySettings = {
       httpProxyUrl: 'http://proxy.example:8080',
@@ -562,8 +561,7 @@ describe('RateLimitService', () => {
     const service = new RateLimitService()
     service.setOpenCodeGoConfigResolver(() => ({
       sessionCookie: '',
-      workspaceIdOverride: '',
-      apiKey: ''
+      workspaceIdOverride: ''
     }))
 
     vi.mocked(fetchClaudeRateLimits).mockRejectedValueOnce(new Error('claude down'))
@@ -587,8 +585,7 @@ describe('RateLimitService', () => {
     let cookie = 'session=valid'
     service.setOpenCodeGoConfigResolver(() => ({
       sessionCookie: cookie,
-      workspaceIdOverride: '',
-      apiKey: ''
+      workspaceIdOverride: ''
     }))
 
     // 1. Success fetch
@@ -624,8 +621,7 @@ describe('RateLimitService', () => {
     let workspaceId = 'wrk_A'
     service.setOpenCodeGoConfigResolver(() => ({
       sessionCookie: 'session=valid',
-      workspaceIdOverride: workspaceId,
-      apiKey: ''
+      workspaceIdOverride: workspaceId
     }))
 
     // 1. Success fetch for Workspace A

src/main/rate-limits/service/service-account-refresh.ts

@@ -29,6 +29,19 @@ export abstract class RateLimitServiceAccountRefresh extends RateLimitServiceIna
     return this.getState()
   }
 
+  invalidateOpenCodeGoCredentialState(options: { apiKeyCleared?: boolean } = {}): void {
+    this.opencodeFetchGeneration += 1
+    // Why: a key from env, OpenCode's DB or auth.json survives a cookie change; only clearing the saved key hides the chip.
+    if (options.apiKeyCleared) {
+      this.openCodeGoApiKeyConfigured = false
+    }
+    // Why: a credential change must discard the snapshot and any result still in flight.
+    this.updateState({
+      ...this.state,
+      opencodeGo: this.withFetchingStatus(null, 'opencode-go')
+    })
+  }
+
   invalidateMiniMaxCredentialState(): void {
     this.minimaxFetchGeneration += 1
     // Why: saving/forgetting the cookie can race an in-flight fetch; clear the visible snapshot before any old-cookie result returns.

src/main/rate-limits/service/service-configuration.ts

@@ -40,8 +40,12 @@ export abstract class RateLimitServiceConfiguration extends RateLimitServiceAcco
     this.claudeFetchTarget = normalizeClaudeAccountSelectionTarget(target)
   }
 
-  setOpenCodeGoConfigResolver(resolver: () => OpenCodeGoRateLimitConfig): void {
+  setOpenCodeGoConfigResolver(
+    resolver: () => OpenCodeGoRateLimitConfig,
+    apiKeyResolver?: () => string | null
+  ): void {
     this.openCodeGoConfigResolver = resolver
+    this.openCodeGoApiKeyResolver = apiKeyResolver ?? null
   }
 
   setMiniMaxConfigResolver(resolver: () => MiniMaxRateLimitConfig): void {

src/main/rate-limits/service/service-fetch-targets.ts

@@ -6,6 +6,7 @@ import {
   type ClaudeRuntimeAuthPreparation,
   type CodexAccountSelectionTarget,
   type MiniMaxResolvedConfig,
+  type OpenCodeGoResolvedConfig,
   type NormalizedCodexAccountSelectionTarget,
   type NormalizedClaudeAccountSelectionTarget,
   type ProviderRateLimits,
@@ -13,6 +14,7 @@ import {
   toErrorMessage
 } from './service-types'
 import type { CodexRateLimitResetOutcome } from '../../../shared/rate-limit-types'
+import { ApiKeyFileUnreadableError } from '../../credentials/api-key-file-unreadable-error'
 
 const CODEX_RESET_REFRESH_RETRIES = 3
 const CODEX_RESET_REFRESH_DELAY_MS = 250
@@ -187,6 +189,34 @@ export abstract class RateLimitServiceFetchTargets extends RateLimitServiceResul
     return process.platform !== 'win32'
   }
 
+  protected resolveOpenCodeGoConfig(): OpenCodeGoResolvedConfig {
+    const config = this.openCodeGoConfigResolver?.() ?? {
+      sessionCookie: '',
+      workspaceIdOverride: ''
+    }
+    try {
+      return {
+        ...config,
+        apiKey: this.openCodeGoApiKeyResolver?.() ?? '',
+        apiKeyError: null,
+        apiKeyReadSkipped: false
+      }
+    } catch (error) {
+      // Why: a transient read failure says nothing about the key, so skip it this cycle without blaming it.
+      if (error instanceof ApiKeyFileUnreadableError) {
+        return { ...config, apiKey: '', apiKeyError: null, apiKeyReadSkipped: true }
+      }
+      // Why: an unreadable saved key is treated as absent so the cookie and OpenCode's own key still run.
+      return {
+        ...config,
+        apiKey: '',
+        apiKeyError:
+          'OpenCode Go API key could not be decrypted. Re-enter or clear the key in Settings.',
+        apiKeyReadSkipped: false
+      }
+    }
+  }
+
   protected resolveMiniMaxConfig(): MiniMaxResolvedConfig {
     try {
       return {

src/main/rate-limits/service/service-full-cycle-preparation.ts

@@ -80,10 +80,12 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
       ? null
       : this.getCodexProvenance(codexTarget, codexHomePath)
     const codexGeneration = this.codexFetchGeneration
-    const openCodeGoConfig = this.openCodeGoConfigResolver?.()
-    const cookie = openCodeGoConfig?.sessionCookie ?? ''
-    const workspaceIdOverride = openCodeGoConfig?.workspaceIdOverride ?? ''
-    const openCodeGoApiKey = openCodeGoConfig?.apiKey ?? ''
+    const openCodeGoConfig = this.resolveOpenCodeGoConfig()
+    const cookie = openCodeGoConfig.sessionCookie
+    const workspaceIdOverride = openCodeGoConfig.workspaceIdOverride
+    const openCodeGoApiKey = openCodeGoConfig.apiKey
+    const openCodeGoApiKeyError = openCodeGoConfig.apiKeyError
+    const openCodeGoApiKeyReadSkipped = openCodeGoConfig.apiKeyReadSkipped
     const miniMaxConfigResult = this.resolveMiniMaxConfig()
     const miniMaxCookie = miniMaxConfigResult.config.sessionCookie
     const miniMaxGroupId = miniMaxConfigResult.config.groupId
@@ -100,7 +102,7 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
     const apiKeyFingerprint = openCodeGoApiKey
       ? createHash('sha256').update(openCodeGoApiKey).digest('hex')
       : ''
-    const currentConfigHash = `${cookie}|${workspaceIdOverride}|${apiKeyFingerprint}`
+    const currentConfigHash = `${cookie}|${workspaceIdOverride}|${apiKeyFingerprint}|${openCodeGoApiKeyError ?? ''}`
     const opencodeConfigChanged = currentConfigHash !== this.lastOpencodeConfigHash
     if (opencodeConfigChanged) {
       this.lastOpencodeConfigHash = currentConfigHash
@@ -201,7 +203,15 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
           // Why here: the key can also come from the environment or OpenCode's
           // own store, so presence is only known once the fetch resolves it.
           onApiKeyResolved: (resolution) => {
-            this.openCodeGoApiKeyConfigured = resolution.status === 'found'
+            // Why: a credential change mid-fetch bumps the generation; its stale presence must not win.
+            if (opencodeGeneration !== this.opencodeFetchGeneration) {
+              return
+            }
+            // An undecryptable or briefly unreadable saved key still counts, so the bar stays up.
+            this.openCodeGoApiKeyConfigured =
+              resolution.status === 'found' ||
+              openCodeGoApiKeyError !== null ||
+              openCodeGoApiKeyReadSkipped
           },
           cookie,
           workspaceIdOverride: workspaceIdOverride || undefined,
@@ -223,6 +233,18 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
     if (signal.aborted) {
       return null
     }
+    // Why: the decrypt error only replaces a result with no usage and no diagnosis of its own; a real cookie error stays visible.
+    if (
+      openCodeGoApiKeyError &&
+      opencodeGoResult.status === 'fulfilled' &&
+      opencodeGoResult.value.status === 'unavailable'
+    ) {
+      opencodeGoResult.value = {
+        ...opencodeGoResult.value,
+        error: openCodeGoApiKeyError,
+        status: 'error'
+      }
+    }
     return {
       claudeTarget,
       claudeGeneration,

src/main/rate-limits/service/service-state.ts

@@ -99,6 +99,7 @@ export abstract class RateLimitServiceState {
     wslDistro: null
   }
   protected openCodeGoConfigResolver: (() => OpenCodeGoRateLimitConfig) | null = null
+  protected openCodeGoApiKeyResolver: (() => string | null) | null = null
   protected miniMaxConfigResolver: (() => MiniMaxRateLimitConfig) | null = null
   protected geminiCliOAuthEnabledResolver: GeminiCliOAuthEnabledResolver | null = null
   protected inactiveClaudeAccountsResolver: (() => InactiveClaudeAccountInfo[]) | null = null

src/main/rate-limits/service/service-types.ts

@@ -44,8 +44,15 @@ export type ClaudeAuthPreparationResolver = (
 export type OpenCodeGoRateLimitConfig = {
   sessionCookie: string
   workspaceIdOverride: string
-  /** Explicit Orca override; empty means fall back to env and OpenCode's own store. */
+}
+
+export type OpenCodeGoResolvedConfig = OpenCodeGoRateLimitConfig & {
+  /** Explicit Orca override; empty means fall back to OpenCode's own store and env. */
   apiKey: string
+  /** Set when the saved override exists but cannot be decrypted. */
+  apiKeyError: string | null
+  /** Set when the saved override exists but a transient read failure skipped it this cycle. */
+  apiKeyReadSkipped: boolean
 }
 
 export type MiniMaxRateLimitConfig = {

src/main/startup/main-process-account-services.ts

@@ -15,6 +15,11 @@ import { getInitialClaudeRateLimitTarget } from '../rate-limits/claude-rate-limi
 import { getKimiRuntimeTarget, resolveKimiHome } from '../kimi/kimi-runtime-home'
 import { readMiniMaxSessionCookie } from '../minimax/minimax-cookie-store'
 import { readMiniMaxApiKey } from '../minimax/minimax-api-key-store'
+import {
+  hasOpenCodeGoApiKey,
+  readOpenCodeGoApiKey,
+  saveOpenCodeGoApiKey
+} from '../opencode/opencode-go-api-key-store'
 import { createAccountRuntimeTargetSettingsSync } from '../rate-limits/account-runtime-target-sync'
 import { normalizeCodexRuntimeSelection } from '../codex-accounts/runtime-selection'
 import { normalizeClaudeRuntimeSelection } from '../claude-accounts/runtime-selection'
@@ -87,6 +92,15 @@ export function initializeMainProcessAccountServices(): void {
     void syncAccountRuntimeTargets(updates, settings).catch((error) =>
       console.warn('[rate-limits] Failed to apply account runtime target:', error)
     )
+    if ('opencodeSessionCookie' in updates || 'opencodeWorkspaceId' in updates) {
+      state.rateLimits?.invalidateOpenCodeGoCredentialState()
+      void state.rateLimits?.refresh().catch((error: unknown) => {
+        console.warn(
+          '[rate-limits] Failed to refresh OpenCode Go usage after a settings change:',
+          error
+        )
+      })
+    }
     // Why: these three pick the MiniMax host and quota bucket, so a stale snapshot from the
     // previous endpoint would otherwise sit in the status bar until the next poll.
     if (
@@ -110,14 +124,18 @@ export function initializeMainProcessAccountServices(): void {
   agentHookServer.setClaudeStatusLineListener((event) => {
     state.rateLimits!.ingestLiveClaudeRateLimits(event)
   })
+  store.migrateLegacyOpenCodeGoApiKey({
+    has: hasOpenCodeGoApiKey,
+    read: readOpenCodeGoApiKey,
+    save: saveOpenCodeGoApiKey
+  })
   state.rateLimits.setOpenCodeGoConfigResolver(() => {
     const settings = store.getSettings()
     return {
       sessionCookie: settings.opencodeSessionCookie,
-      workspaceIdOverride: settings.opencodeWorkspaceId,
-      apiKey: settings.opencodeGoApiKey
+      workspaceIdOverride: settings.opencodeWorkspaceId
     }
-  })
+  }, readOpenCodeGoApiKey)
   state.rateLimits.setMiniMaxConfigResolver(() => {
     const settings = store.getSettings()
     const apiKey = readMiniMaxApiKey() ?? ''

src/preload/api-types.ts

@@ -141,6 +141,11 @@ export type PreloadApi = {
   runtime: RuntimeApi['runtime']
   runtimeEnvironments: RuntimeApi['runtimeEnvironments']
   rateLimits: RateLimitsApi
+  opencodeGoCredentials: {
+    getStatus: () => Promise<{ apiKeyConfigured: boolean }>
+    saveApiKey: (key: string) => Promise<{ apiKeyConfigured: boolean }>
+    clearApiKey: () => Promise<{ apiKeyConfigured: boolean }>
+  }
   minimaxCredentials: MinimaxCredentialsApi
   grokAccounts: GrokAccountsApi
   cursorAccounts: CursorAccountsApi

src/preload/api/opencode-go-credentials-bridge.ts

@@ -0,0 +1,11 @@
+import { ipcRenderer } from 'electron'
+import type { PreloadApi } from '../api-types'
+
+export const opencodeGoCredentialsApi = {
+  getStatus: (): Promise<{ apiKeyConfigured: boolean }> =>
+    ipcRenderer.invoke('opencodeGoCredentials:getStatus'),
+  saveApiKey: (key: string): Promise<{ apiKeyConfigured: boolean }> =>
+    ipcRenderer.invoke('opencodeGoCredentials:saveApiKey', key),
+  clearApiKey: (): Promise<{ apiKeyConfigured: boolean }> =>
+    ipcRenderer.invoke('opencodeGoCredentials:clearApiKey')
+} satisfies PreloadApi['opencodeGoCredentials']

src/preload/index.ts

@@ -75,6 +75,7 @@ import { nativeChatApi } from './api/native-chat-bridge'
 import { runtimeApi } from './api/runtime-bridge'
 import { runtimeEnvironmentsApi } from './api/runtime-environments-bridge'
 import { rateLimitsApi } from './api/rate-limits-bridge'
+import { opencodeGoCredentialsApi } from './api/opencode-go-credentials-bridge'
 import { minimaxCredentialsApi } from './api/minimax-credentials-bridge'
 import { grokAccountsApi } from './api/grok-accounts-bridge'
 import { cursorAccountsApi } from './api/cursor-accounts-bridge'
@@ -174,6 +175,7 @@ const api = {
   runtime: runtimeApi,
   runtimeEnvironments: runtimeEnvironmentsApi,
   rateLimits: rateLimitsApi,
+  opencodeGoCredentials: opencodeGoCredentialsApi,
   minimaxCredentials: minimaxCredentialsApi,
   grokAccounts: grokAccountsApi,
   cursorAccounts: cursorAccountsApi,

src/preload/opencode-go-credentials.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it, vi } from 'vitest'
+import { opencodeGoCredentialsApi } from './api/opencode-go-credentials-bridge'
+
+const invoke = vi.hoisted(() => vi.fn(async () => ({ apiKeyConfigured: true })))
+vi.mock('electron', () => ({ ipcRenderer: { invoke } }))
+
+describe('OpenCode Go credential bridge', () => {
+  it('exposes only status and write operations', async () => {
+    expect(await opencodeGoCredentialsApi.getStatus()).toEqual({ apiKeyConfigured: true })
+    await opencodeGoCredentialsApi.saveApiKey('fake-key')
+    await opencodeGoCredentialsApi.clearApiKey()
+    expect(invoke.mock.calls).toEqual([
+      ['opencodeGoCredentials:getStatus'],
+      ['opencodeGoCredentials:saveApiKey', 'fake-key'],
+      ['opencodeGoCredentials:clearApiKey']
+    ])
+    expect(Object.keys(opencodeGoCredentialsApi)).toEqual([
+      'getStatus',
+      'saveApiKey',
+      'clearApiKey'
+    ])
+  })
+})

src/renderer/src/components/settings/accounts-pane-opencode-credentials.test.ts

@@ -0,0 +1,47 @@
+// @vitest-environment happy-dom
+import { createElement } from 'react'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OpenCodeGoCredentials } from './accounts-pane-opencode-credentials'
+
+vi.mock('../../store', () => ({
+  useAppStore: (selector: (state: { settingsSearchQuery: string }) => unknown) =>
+    selector({ settingsSearchQuery: '' })
+}))
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
+
+describe('OpenCode Go credentials setting', () => {
+  it('shows saved status without reading a key, saves a draft, and clears it', async () => {
+    const getStatus = vi.fn(async () => ({ apiKeyConfigured: true }))
+    const saveApiKey = vi.fn(async () => ({ apiKeyConfigured: true }))
+    const clearApiKey = vi.fn(async () => ({ apiKeyConfigured: false }))
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: {
+        opencodeGoCredentials: { getStatus, saveApiKey, clearApiKey }
+      }
+    })
+    const onSaved = vi.fn()
+    render(createElement(OpenCodeGoCredentials, { onSaved }))
+    await screen.findByText('Saved')
+    const input = screen.getByLabelText('OpenCode Go API key')
+    expect(input).toBeInstanceOf(HTMLInputElement)
+    if (!(input instanceof HTMLInputElement)) {
+      throw new Error('Missing credential input')
+    }
+    expect(input.value).toBe('')
+    fireEvent.change(input, { target: { value: 'fake-new-key' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Replace' }))
+    await waitFor(() => expect(saveApiKey).toHaveBeenCalledWith('fake-new-key'))
+    await waitFor(() => expect(input.value).toBe(''))
+    fireEvent.click(screen.getByRole('button', { name: 'Clear' }))
+    await screen.findByText('Not saved')
+    expect(clearApiKey).toHaveBeenCalledOnce()
+    expect(onSaved).toHaveBeenCalledTimes(2)
+    expect(screen.queryByRole('button', { name: 'Clear' })).toBeNull()
+  })
+})

src/renderer/src/components/settings/accounts-pane-opencode-credentials.tsx

@@ -0,0 +1,113 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+import { Input } from '../ui/input'
+import { Label } from '../ui/label'
+import { SearchableSetting } from './SearchableSetting'
+
+export function OpenCodeGoCredentials({ onSaved }: { onSaved: () => void }): React.JSX.Element {
+  const [draft, setDraft] = useState('')
+  const [configured, setConfigured] = useState(false)
+  const [busy, setBusy] = useState(false)
+  useEffect(() => {
+    let active = true
+    void window.api.opencodeGoCredentials.getStatus().then(
+      (status) => {
+        if (active) {
+          setConfigured(status.apiKeyConfigured)
+        }
+      },
+      () => console.error('Failed to load OpenCode Go credential status')
+    )
+    return () => {
+      active = false
+    }
+  }, [])
+
+  const updateCredential = async (clear: boolean): Promise<void> => {
+    setBusy(true)
+    try {
+      const status = clear
+        ? await window.api.opencodeGoCredentials.clearApiKey()
+        : await window.api.opencodeGoCredentials.saveApiKey(draft.trim())
+      setConfigured(status.apiKeyConfigured)
+      setDraft('')
+      onSaved()
+    } catch {
+      toast.error(translate('sessionHistory.settings.saveError', 'Could not save. Try again.'))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <SearchableSetting
+      title={translate(
+        'auto.components.settings.AccountsPane.opencodeGo.apiKey.title',
+        'OpenCode Go API Key'
+      )}
+      description={translate(
+        'auto.components.settings.AccountsPane.opencodeGo.apiKey.description',
+        'Optional override. Orca otherwise uses the key OpenCode saved when you ran /connect, then OPENCODE_API_KEY.'
+      )}
+      keywords={['opencode', 'go', 'api', 'key', 'connect', 'rate limit', 'status bar']}
+      className="space-y-2"
+    >
+      <div className="flex items-center gap-2">
+        <Label htmlFor="opencode-go-api-key">
+          {translate(
+            'auto.components.settings.AccountsPane.opencodeGo.apiKey.label',
+            'OpenCode Go API key'
+          )}
+        </Label>
+        <Badge variant={configured ? 'secondary' : 'outline'}>
+          {configured
+            ? translate('auto.components.settings.AccountsPane.73ea15f24b', 'Saved')
+            : translate('auto.components.settings.AccountsPane.23afe8f226', 'Not saved')}
+        </Badge>
+      </div>
+      <div className="flex gap-2">
+        <Input
+          id="opencode-go-api-key"
+          type="password"
+          value={draft}
+          disabled={busy}
+          onChange={(event) => setDraft(event.target.value)}
+          placeholder={translate(
+            'auto.components.settings.AccountsPane.opencodeGo.apiKey.placeholder',
+            'Leave blank to use the key saved by /connect or OPENCODE_API_KEY'
+          )}
+          spellCheck={false}
+          className="flex-1"
+        />
+        <Button
+          size="xs"
+          disabled={busy || !draft.trim()}
+          onClick={() => void updateCredential(false)}
+        >
+          {configured
+            ? translate('auto.components.settings.AccountsPane.f38b9cc4bd', 'Replace')
+            : translate('auto.components.settings.AccountsPane.590a3130f9', 'Save')}
+        </Button>
+        {configured && (
+          <Button
+            variant="ghost"
+            size="xs"
+            disabled={busy}
+            onClick={() => void updateCredential(true)}
+          >
+            {translate('auto.components.settings.AccountsPane.b398b834c9', 'Clear')}
+          </Button>
+        )}
+      </div>
+      <p className="text-xs text-muted-foreground">
+        {translate(
+          'auto.components.settings.AccountsPane.opencodeGo.apiKey.help',
+          'Used for OpenCode Go usage in the status bar. The session cookie below is only needed for legacy console (OpenCode Black) accounts.'
+        )}
+      </p>
+    </SearchableSetting>
+  )
+}

src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx

@@ -5,6 +5,7 @@ import { Switch } from '../ui/switch'
 import { GeminiIcon, OpenCodeGoIcon } from '../status-bar/icons'
 import { SearchableSetting } from './SearchableSetting'
 import type { AccountsPaneSectionModel } from './accounts-pane-types'
+import { OpenCodeGoCredentials } from './accounts-pane-opencode-credentials'
 import { DebouncedSettingsTextInput } from './DebouncedSettingsTextInput'
 
 export function renderGeminiAccountsSection(model: AccountsPaneSectionModel): React.JSX.Element {
@@ -95,58 +96,7 @@ export function renderOpenCodeAccountsSection(model: AccountsPaneSectionModel):
         </p>
       </div>
 
-      <SearchableSetting
-        title={translate(
-          'auto.components.settings.AccountsPane.opencodeGo.apiKey.title',
-          'OpenCode Go API Key'
-        )}
-        description={translate(
-          'auto.components.settings.AccountsPane.opencodeGo.apiKey.description',
-          'Optional override. Orca otherwise uses the key OpenCode saved when you ran /connect, then OPENCODE_API_KEY.'
-        )}
-        keywords={['opencode', 'go', 'api', 'key', 'connect', 'rate limit', 'status bar']}
-        className="space-y-2"
-      >
-        <Label>
-          {translate(
-            'auto.components.settings.AccountsPane.opencodeGo.apiKey.label',
-            'OpenCode Go API key'
-          )}
-        </Label>
-        <div className="flex gap-2">
-          <DebouncedSettingsTextInput
-            type="password"
-            value={settings.opencodeGoApiKey}
-            onEdit={() => recordOpenCodeSettingEdit('apiKey')}
-            commit={(opencodeGoApiKey) => updateSettings({ opencodeGoApiKey })}
-            placeholder={translate(
-              'auto.components.settings.AccountsPane.opencodeGo.apiKey.placeholder',
-              'Leave blank to use the key saved by /connect or OPENCODE_API_KEY'
-            )}
-            spellCheck={false}
-            className="flex-1 text-xs"
-          />
-          {settings.opencodeGoApiKey && (
-            <Button
-              variant="ghost"
-              size="xs"
-              onClick={() => {
-                recordFeatureInteraction('usage-tracking')
-                updateSettings({ opencodeGoApiKey: '' })
-              }}
-              className="h-7 shrink-0 text-xs text-muted-foreground hover:text-foreground"
-            >
-              {translate('auto.components.settings.AccountsPane.b398b834c9', 'Clear')}
-            </Button>
-          )}
-        </div>
-        <p className="text-xs text-muted-foreground">
-          {translate(
-            'auto.components.settings.AccountsPane.opencodeGo.apiKey.help',
-            'Used for OpenCode Go usage in the status bar. The session cookie below is only needed for legacy console (OpenCode Black) accounts.'
-          )}
-        </p>
-      </SearchableSetting>
+      <OpenCodeGoCredentials onSaved={() => recordOpenCodeSettingEdit('apiKey')} />
 
       <SearchableSetting
         title={translate(

src/renderer/src/web/preload-api/web-agent-accounts-api.ts

@@ -45,6 +45,16 @@ export function createCursorAccountsApi(): NonNullable<Partial<PreloadApi>['curs
   }
 }
 
+export function createOpenCodeGoCredentialsApi(): PreloadApi['opencodeGoCredentials'] {
+  const notConfigured = { apiKeyConfigured: false }
+  return {
+    getStatus: () => Promise.resolve(notConfigured),
+    saveApiKey: () =>
+      Promise.reject(new Error('OpenCode Go key storage is only available in the desktop app.')),
+    clearApiKey: () => Promise.resolve(notConfigured)
+  }
+}
+
 export function createGrokAccountsApi(): NonNullable<Partial<PreloadApi>['grokAccounts']> {
   const unsigned = {
     signedIn: false,

src/renderer/src/web/web-preload-api-agent-providers.test.ts

@@ -155,6 +155,17 @@ describe('web MiniMax preload API', () => {
     vi.unstubAllGlobals()
   })
 
+  it('keeps OpenCode Go credential operations local to the desktop', async () => {
+    const { api } = await installApi('Linux')
+    await expect(api.opencodeGoCredentials.getStatus()).resolves.toEqual({
+      apiKeyConfigured: false
+    })
+    await expect(api.opencodeGoCredentials.saveApiKey('fake-key')).rejects.toThrow(/desktop app/i)
+    await expect(api.opencodeGoCredentials.clearApiKey()).resolves.toEqual({
+      apiKeyConfigured: false
+    })
+  })
+
   it('exposes desktop-only MiniMax credential reads as unconfigured and rejects saves', async () => {
     const { api } = await installApi('Linux')
 

src/renderer/src/web/web-preload-api-composition.test.ts

@@ -53,6 +53,7 @@ describe('web preload API composition', () => {
       'preflight',
       'notifications',
       'rateLimits',
+      'opencodeGoCredentials',
       'minimaxCredentials',
       'grokAccounts',
       'cursorAccounts',

src/renderer/src/web/web-preload-api.ts

@@ -6,6 +6,7 @@ import {
   createCodexAccountsApi,
   createCursorAccountsApi,
   createGrokAccountsApi,
+  createOpenCodeGoCredentialsApi,
   createMiniMaxCredentialsApi
 } from './preload-api/web-agent-accounts-api'
 import { createWebAgentStatusApi } from './preload-api/web-agent-status-api'
@@ -106,6 +107,7 @@ function createWebPreloadApi(): Partial<PreloadApi> {
     preflight: createPreflightApi(),
     notifications: createNotificationsApi(),
     rateLimits: createRateLimitsApi(),
+    opencodeGoCredentials: createOpenCodeGoCredentialsApi(),
     minimaxCredentials: createMiniMaxCredentialsApi(),
     grokAccounts: createGrokAccountsApi(),
     cursorAccounts: createCursorAccountsApi(),

src/shared/default-global-settings.ts

@@ -211,7 +211,6 @@ export function buildDefaultSettings(args: {
     defaultLinearTeamSelection: null,
     opencodeSessionCookie: '',
     opencodeWorkspaceId: '',
-    opencodeGoApiKey: '',
     minimaxGroupId: '',
     minimaxUsageModels: 'general',
     minimaxEndpoint: 'overseas',

src/shared/global-settings-types.ts

@@ -392,8 +392,6 @@ export type GlobalSettings = {
   opencodeSessionCookie: string
   /** Optional OpenCode Go workspace ID override; when set, skips the workspaces lookup and fetches usage directly. */
   opencodeWorkspaceId: string
-  /** Optional OpenCode Go API key override. Takes precedence over OpenCode's own stored key and OPENCODE_API_KEY. Stored encrypted. */
-  opencodeGoApiKey: string
   /** Optional MiniMax group id. When empty, the usage fetcher extracts minimax_group_id_v2 from the cookie. */
   minimaxGroupId: string
   /** Comma-separated MiniMax model names to show in the status bar usage window. */