Credential portability: take/push provider creds between client and hub over SSH #782

Important

Problem

Provider credentials live only where opencode first resolved them — normally the hub. A machine that has only ever been a fleet client has none locally, so Go Standalone lands on a providerless chat. This is exactly what happened on 2026-09-03 (baseten key existed hub-side only; fixed by a manual copy).

Approach

A pair of commands — "take my credentials to go" and "push my credentials to the hub" — that copy opencode's provider-auth files between client and hub over the existing SSH tunnel path, gated by a confirmation that names exactly which providers will move. Keys transit only over SSH; they never pass through chat, the HTTP API, or any agent-visible channel.

Approaches Considered

• SSH-tunnel file copy, human-gated (chosen) — uses infrastructure the fleet already trusts; explicit, inspectable, bidirectional.
• Env-based key injection into the standalone spawn from a hub-fetched secret — avoids files at rest on the client but needs a live hub to leave, and Go Standalone must work when the hub is down.
• Agent-mediated copy (paste keys in chat) — rejected outright: keys must never be agent-visible.

Scope

In: pull (hub → client) and push (client → hub) directions; a provider manifest shown for confirmation; merge semantics for the destination auth files (add/refresh providers, never silently drop existing ones); a clear "already present, skipped" report.
Out: rotating or generating keys; storing keys anywhere new beyond opencode's own config locations; the onboarding credential scanner's behavior; syncing arbitrary env/config beyond provider auth.

Assumptions / Open Qs

• Assumed the SSH path used by the managed tunnels is reusable for a file transfer by the extension (same host, same key) — verify during implementation; if the tunnel is forward-only, fall back to the same SSH config's native transport.
• Open: whether the hub copy should happen while the hub server is running (file-consistency question) — dev to pick a safe moment (e.g. copy is read-only hub-side, so running is fine).