[Zorato]

Problem

The resolver only checks opencode-go. If OpenCode stores the API key under the Console integration (opencode), the plugin cannot find it.

Changes

• Check opencode after opencode-go in the database and legacy auth.json.
• Skip entries marked as OAuth credentials, including entries inside legacy arrays.
• Preserve environment-variable precedence, database-before-file precedence, and active-row selection.
• Document the lookup order and add credential tests.

This PR does not change sidebar rendering, polling, or pace indicators.

Verification

• npm test: 19 tests pass.
• npm run typecheck: passes for production sources.
• Tests use isolated temporary stores, including SQLite fixtures.
• Mutation checks confirm that tests fail without the Console fallback or OAuth exclusion.

The tests do not use live credentials or call the usage endpoint.

[PentSec]

Thanks, the ordering and the tests are solid. One note before I merge this, so we do not "fix" the OAuth case the wrong way.

Skipping type: "oauth" is the right default. I verified locally that GET /zen/go/v1/usage returns 200 with the active opencode OAuth access token, so those tokens are usable, but they can also be stale. Returning one without checking would turn a working auth.json key into credential rejected. Covering that case needs a probe or a fallback on 401, not a naive allowance, so I will track it as a follow-up. Happy to review it if you want to take it.

One small change so this does not conflict with #5 and #6: use bun test --preload @opentui/solid/preload tests for the test script, placed after typecheck.

[Zorato]

Resolved the conflict, pls check.