Azure CLI account discovery blocks every startup for signed-in users #46658

Description

OpenCode synchronously enumerates Azure Cognitive Services accounts during every startup when:

• Azure CLI is installed.
• Azure CLI has a cached login.
• AZURE_RESOURCE_NAME and AZURE_RESOURCE_GROUP are unset.

This delays startup even when the user does not use the Azure provider.

OpenCode version

1.18.25

Environment

• macOS, Apple Silicon
• Azure CLI 2.88.0 installed with Homebrew
• No external plugins (--pure)

Steps to reproduce

1. Install Azure CLI and run az login.
2. Ensure AZURE_RESOURCE_NAME and AZURE_RESOURCE_GROUP are unset.
3. Start OpenCode:

opencode --pure --log-level DEBUG -c

4. Compare it with:

OPENCODE_DISABLE_DEFAULT_PLUGINS=1 opencode --pure --log-level DEBUG -c

Observed behavior

Normal startup takes approximately 6 to 8 seconds. Disabling built-in plugins makes startup substantially faster.

The Azure command called by OpenCode takes several seconds:

az cognitiveservices account list --output none --only-show-errors
real 4.59s

Azure CLI debug timing isolates the delay:

Command ran in 2.838 seconds (init: 0.097, invoke: 2.742)

Additional measurements:

az account show:                         0.63s
az account get-access-token:             0.70s
Equivalent Azure REST request:           2.54s
DNS and TLS to management.azure.com:     0.06s
Cognitive Services accounts returned:    0

This shows that the delay is the remote subscription-wide Azure Resource Manager enumeration, not Azure CLI initialization, authentication, DNS, TLS, or response size.

Root cause

AzureAuthPlugin() awaits account enumeration before returning its hooks:

https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/azure.ts#L52-L67

The plugin is part of the built-in plugin list:

https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/index.ts#L67-L85

As a result, an unrelated OpenCode startup waits for an Azure control-plane request solely because a cached Azure login exists.

Expected behavior

Built-in plugin initialization should not make Azure control-plane requests.

Azure account discovery should run only when the user selects Microsoft Entra ID authentication for Azure under /connect. Manual resource entry should remain available when discovery fails or is unavailable.

A regression test should verify that AzureAuthPlugin() does not invoke Azure CLI during initialization.

Workarounds

Any of these avoid the eager account-list command:

AZURE_RESOURCE_NAME=unused opencode
AZURE_RESOURCE_GROUP=unused opencode
OPENCODE_DISABLE_DEFAULT_PLUGINS=1 opencode

The first two affect Azure provider configuration. The last one disables every built-in authentication plugin, so none is an appropriate general solution.

Related work

• feat(opencode): support Azure CLI authentication #45079 introduced Azure CLI authentication and eager resource enumeration.
• [FEATURE]: Azure AI Foundry Microsoft Entra (OAuth) authentication #21658 requested Microsoft Entra authentication through Azure CLI.