Fix OpenCode dashboard links

[akshayprabhu200]

Summary

• send the OpenCode and OpenCode Go dashboard actions to the official https://opencode.ai/auth entry point instead of the public homepage
• use the auth entry point as OpenCode Go's fallback when no workspace is configured
• preserve the existing workspace-specific /workspace/<id>/go deep link
• add descriptor and URL-helper regression coverage

Why

The provider descriptors and the OpenCode Go fallback used the bare https://opencode.ai URL, which opens the product homepage rather than the account flow. OpenCode's official provider documentation directs both Zen and Go users to https://opencode.ai/auth.

When CodexBar already knows an OpenCode Go workspace, it still opens that workspace's Go dashboard directly. This change only fixes the generic fallback.

Behavior proof

• Before: both provider descriptors and the unscoped OpenCode Go helper resolved to https://opencode.ai.
• After: both descriptors and the unscoped helper resolve to https://opencode.ai/auth.
• A clean logged-out browser navigation to /auth reached OpenCode's authorization service.
• The existing configured-workspace case remains https://opencode.ai/workspace/wrk_abc123/go.

Inspectable after-fix production-code trace (official swift:6.3.3-noble image, digest
sha256:66520bcba471018a34fd54ba09be97ba4abebd950a96ff5cb8c2bf50a2d33259):

LIVE_PROOF opencode.generic=https://opencode.ai/auth
LIVE_PROOF opencodego.unscoped=https://opencode.ai/auth
LIVE_PROOF opencodego.scoped=https://opencode.ai/workspace/wrk_REDACTED/go
✔ Test run with 1 test in 1 suite passed after 0.002 seconds.

This trace calls OpenCodeProviderDescriptor.descriptor.metadata.dashboardURL and
OpenCodeGoUsageFetcher.dashboardURL(workspaceID:) directly. The scoped workspace ID
is deliberately fictitious; no cookies, credentials, or account data were read or printed.
The temporary trace-only harness was deleted after the run and is not part of this PR.

Official reference: OpenCode provider documentation.

Existing issue / PR search

No matching issue or PR was found. The closest prior work was #667, which fixed the configured workspace deep link and was landed separately on main; this patch preserves that behavior and fixes the remaining no-workspace fallback.

Validation

• make format
• git diff --check
• make check portable checks and SwiftFormat passed; local SwiftLint could not load SourceKit because this machine has Apple Swift 5.10, while current CodexBar requires Swift 6.2+
• focused swift test was likewise blocked locally by the Swift 5.10 toolchain
• exact-head full CI run 30529938152 passed: lint, Linux x64, Linux ARM64, musl, both macOS shards, and the aggregate gate

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 30, 2026, 11:51 AM ET / 15:51 UTC.

ClawSweeper review

What this changes

Updates generic OpenCode and OpenCode Go dashboard links to OpenCode’s /auth entry point, retains the configured workspace-specific OpenCode Go link, and adds focused regression coverage.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This PR is still necessary and appears correct: it fixes the generic OpenCode and OpenCode Go dashboard fallback without changing the existing workspace-specific OpenCode Go route. The supplied redacted production-code trace is sufficient real-behavior proof; wait for the current-head workflow to finish before merging.

Priority: P3
Reviewed head: 98eb24a288140ce2d7a99f4aba1b60c64563cba6

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, low-risk correction with direct production-path proof and targeted regression coverage.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The PR includes redacted after-fix output from the production descriptor and URL-helper paths, plus a logged-out /auth navigation check; no account data or credentials are exposed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR includes redacted after-fix output from the production descriptor and URL-helper paths, plus a logged-out /auth navigation check; no account data or credentials are exposed.
Evidence reviewed	5 items	Focused production change: The PR changes both OpenCode provider descriptors from the product homepage to https://opencode.ai/auth, matching the requested generic dashboard destination. Workspace fallback preserved: The OpenCode Go helper still constructs /workspace/<id>/go for a normalized workspace ID and changes only the no-workspace fallback to the auth entry point. Regression coverage: The branch updates the no-workspace URL expectation and adds descriptor-level assertions for both generic OpenCode dashboard links.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar provider descriptors supply metadata used by the menu-bar dashboard action. For OpenCode Go, the usage fetcher selects a workspace-specific billing link when a workspace is known and otherwise supplies a generic account-entry fallback.

flowchart LR
    A[Menu bar dashboard action] --> B[Provider metadata]
    B --> C[OpenCode dashboard link]
    A --> D[OpenCode Go URL helper]
    D --> E{Workspace configured?}
    E -->|Yes| F[Workspace Go dashboard]
    E -->|No| G[OpenCode auth entry point]

Loading

Before merge

• Resolve merge risk (P1) - The current head is mergeable but reported as unstable, with Linux and macOS workflow jobs still queued or in progress; merge only after the final current-head required checks succeed.
• Complete next step (P2) - No repair lane is needed because no actionable patch defect was found; this needs ordinary maintainer review once the current-head checks are final.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production destinations	3 URL paths changed	Two provider metadata links and one unscoped Go fallback now target the account-entry route while the configured-workspace path remains intact.
Regression scope	2 test surfaces updated	Descriptor metadata and no-workspace URL selection both have focused coverage.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Retain the /auth fallback for generic dashboard actions and the existing workspace-specific Go deep link, then merge after the current-head workflow completes successfully.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the /auth fallback for generic dashboard actions and the existing workspace-specific Go deep link, then merge after the current-head workflow completes successfully.

Do we have a high-confidence way to reproduce the issue?

Yes. The old behavior is directly identifiable from the pre-change URL constants and the PR provides a focused after-fix trace for generic, unscoped, and configured-workspace cases.

Is this the best way to solve the issue?

Yes. Updating only the generic fallback and descriptor URLs is the narrowest maintainable fix because it preserves the existing configured-workspace Go dashboard behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8ef86077e70a.

Labels

Label justifications:

• P3: This is a small dashboard-navigation correction with limited blast radius and a preserved workspace-specific path.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR includes redacted after-fix output from the production descriptor and URL-helper paths, plus a logged-out /auth navigation check; no account data or credentials are exposed.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR includes redacted after-fix output from the production descriptor and URL-helper paths, plus a logged-out /auth navigation check; no account data or credentials are exposed.

Evidence

What I checked:

• Focused production change: The PR changes both OpenCode provider descriptors from the product homepage to https://opencode.ai/auth, matching the requested generic dashboard destination. (Sources/CodexBarCore/Providers/OpenCode/OpenCodeProviderDescriptor.swift, 98eb24a28814)
• Workspace fallback preserved: The OpenCode Go helper still constructs /workspace/<id>/go for a normalized workspace ID and changes only the no-workspace fallback to the auth entry point. (Sources/CodexBarCore/Providers/OpenCodeGo/OpenCodeGoUsageFetcher.swift, 98eb24a28814)
• Regression coverage: The branch updates the no-workspace URL expectation and adds descriptor-level assertions for both generic OpenCode dashboard links. (Tests/CodexBarTests/OpenCodeProviderDescriptorTests.swift, 98eb24a28814)
• After-fix real behavior proof: The PR body includes a redacted trace from the production descriptor and URL-helper paths showing generic OpenCode and unscoped OpenCode Go resolve to /auth, while a fictitious configured workspace remains scoped. (98eb24a28814)
• Related prior work is distinct: The earlier closed PR at Fix OpenCode Go Usage Dashboard link to open workspace-specific URL #667 concerned constructing a configured workspace-specific Go URL; this PR preserves that behavior and fixes the separate unscoped fallback. (Sources/CodexBarCore/Providers/OpenCodeGo/OpenCodeGoUsageFetcher.swift, 98eb24a28814)

Likely related people:

• steipete: Repository ownership and the affected core provider-routing surface make this the most likely maintainer routing point; the available review context does not expose enough current-main blame history to attribute the path more narrowly. (role: likely follow-up owner; confidence: low; files: Sources/CodexBarCore/Providers/OpenCode/OpenCodeProviderDescriptor.swift, Sources/CodexBarCore/Providers/OpenCodeGo/OpenCodeGoUsageFetcher.swift)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the queued and in-progress current-head workflow jobs to complete successfully before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-07-30T08:18:18.605Z sha 98eb24a :: needs real behavior proof before merge. :: none
• reviewed 2026-07-30T08:28:56.896Z sha 98eb24a :: needs real behavior proof before merge. :: none
• reviewed 2026-07-30T08:52:57.737Z sha 98eb24a :: needs maintainer review before merge. :: none
• reviewed 2026-07-30T09:18:30.333Z sha 98eb24a :: needs maintainer review before merge. :: none
• reviewed 2026-07-30T09:55:29.711Z sha 98eb24a :: needs maintainer review before merge. :: none

[akshayprabhu200]

@clawsweeper re-review

The PR body now includes a redacted, inspectable after-fix production-code trace for the generic OpenCode, unscoped OpenCode Go, and configured-workspace routes. The temporary trace harness was deleted and was never committed or pushed.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30528311933
• Updated: 2026-07-30T08:51:53.061Z