fix(env): live process.env reads + late-env detection for env-key providers

.gitignore

@@ -30,3 +30,6 @@ UPCOMING_CHANGELOG.md
 logs/
 *.bun-build
 tsconfig.tsbuildinfo
+
+# Sisyphus orchestrator state (local only)
+.sisyphus/

packages/opencode/src/config/config.ts

@@ -513,7 +513,8 @@ export const layer = Layer.effect(
         for (const [key, value] of Object.entries(auth)) {
           if (value.type === "wellknown") {
             const url = key.replace(/\/+$/, "")
-            process.env[value.key] = value.token
+            // TODO(multi-instance): see env/index.ts docstring.
+            yield* env.set(value.key, value.token)
             log.debug("fetching remote config", { url: `${url}/.well-known/opencode` })
             const response = yield* Effect.promise(() => fetch(`${url}/.well-known/opencode`))
             if (!response.ok) {
@@ -647,7 +648,7 @@ export const layer = Layer.effect(
               { concurrency: 2 },
             )
             if (Option.isSome(tokenOpt)) {
-              process.env["OPENCODE_CONSOLE_TOKEN"] = tokenOpt.value
+              // TODO(multi-instance): see env/index.ts docstring.
               yield* env.set("OPENCODE_CONSOLE_TOKEN", tokenOpt.value)
             }
 

packages/opencode/src/env/index.ts

@@ -1,6 +1,10 @@
 import { Context, Effect, Layer } from "effect"
-import { InstanceState } from "@/effect/instance-state"
 
+/**
+ * Effect-aware wrapper around `process.env`. Reads are live (no snapshot);
+ * `set`/`remove` mutate `process.env` directly. Writes are process-wide —
+ * call sites that persist auth-derived values are marked `TODO(multi-instance)`.
+ */
 type State = Record<string, string | undefined>
 
 export interface Interface {
@@ -12,23 +16,21 @@ export interface Interface {
 
 export class Service extends Context.Service<Service, Interface>()("@opencode/Env") {}
 
-export const layer = Layer.effect(
+export const layer = Layer.succeed(
   Service,
-  Effect.gen(function* () {
-    const state = yield* InstanceState.make<State>(Effect.fn("Env.state")(() => Effect.succeed({ ...process.env })))
-
-    const get = Effect.fn("Env.get")((key: string) => InstanceState.use(state, (env) => env[key]))
-    const all = Effect.fn("Env.all")(() => InstanceState.get(state))
-    const set = Effect.fn("Env.set")(function* (key: string, value: string) {
-      const env = yield* InstanceState.get(state)
-      env[key] = value
-    })
-    const remove = Effect.fn("Env.remove")(function* (key: string) {
-      const env = yield* InstanceState.get(state)
-      delete env[key]
-    })
-
-    return Service.of({ get, all, set, remove })
+  Service.of({
+    get: (key: string) => Effect.sync(() => process.env[key]),
+    all: () => Effect.sync(() => ({ ...process.env })),
+    set: Effect.fn("Env.set")((key: string, value: string) =>
+      Effect.sync(() => {
+        process.env[key] = value
+      }),
+    ),
+    remove: Effect.fn("Env.remove")((key: string) =>
+      Effect.sync(() => {
+        delete process.env[key]
+      }),
+    ),
   }),
 )
 

packages/opencode/src/provider/overlay.ts

@@ -0,0 +1,93 @@
+import { Hash } from "@opencode-ai/core/util/hash"
+
+import type { ProviderID } from "@/provider/schema"
+import type { Provider } from "@/provider/provider"
+
+interface OverlayState {
+  cachedProviders: Record<ProviderID, Provider.Info>
+  cleanedDatabase: Readonly<Record<ProviderID, Provider.Info>>
+}
+
+/**
+ * Pure single-provider env-overlay step. See `overlay.test.ts` for the
+ * exhaustive precedence table.
+ */
+export function resolveEnvOverlay(
+  cached: Provider.Info | undefined,
+  candidate: Provider.Info,
+  apiKey: string | undefined,
+): Provider.Info | undefined {
+  if (!apiKey) {
+    if (cached?.source === "env") return undefined
+    return cached
+  }
+  if (cached && cached.source !== "env") {
+    if (!cached.key && candidate.env.length === 1) return { ...cached, key: apiKey }
+    return cached
+  }
+  // Multi-env candidate: cached.key has no single source of truth, preserve it.
+  const nextKey = candidate.env.length === 1 ? apiKey : cached?.key
+  if (cached && cached.key === nextKey) return cached
+  if (cached) return { ...cached, key: nextKey }
+  return { ...candidate, source: "env", key: nextKey }
+}
+
+export function currentProviders(
+  s: OverlayState,
+  envs: Record<string, string | undefined>,
+): Record<ProviderID, Provider.Info> {
+  const result: Record<ProviderID, Provider.Info> = { ...s.cachedProviders }
+  for (const [id, info] of Object.entries(s.cleanedDatabase)) {
+    const providerID = id as ProviderID
+    // Empty/whitespace env values count as absent. Non-blank values are
+    // passed through verbatim — trimming a real key would be silently wrong.
+    const apiKey = info.env.map((k) => envs[k]).find(isNonBlank)
+    const next = resolveEnvOverlay(result[providerID], info, apiKey)
+    if (next) result[providerID] = next
+    else delete result[providerID]
+  }
+  return result
+}
+
+export function isNonBlank(v: string | undefined): v is string {
+  return typeof v === "string" && v.trim() !== ""
+}
+
+// JSON.stringify drops functions silently and throws on BigInt. Tag both so
+// distinct closures (e.g. AWS `coalesceProvider`) and BigInt values produce
+// stable, distinct hashes. Anonymous arrows collide on `__fn:anon` — that is
+// intentional: the per-call `fetch` wrapper built in `resolveSDK` would
+// otherwise bust the SDK cache on every invocation.
+//
+// CAVEAT: same-named closures from unrelated callers (e.g. a third-party
+// plugin storing a `coalesceProvider` in `provider.options`) collide and may
+// silently serve a stale SDK. Plugin authors must keep stateful closures out
+// of `provider.options` outside the per-call `fetch` convention.
+//
+// UNSUPPORTED INPUT TYPES (silent collisions or throws — do not place these
+// in `provider.options`):
+//   - `Map`, `Set`, `WeakMap`, `WeakSet` — `JSON.stringify` returns `"{}"`,
+//     so two distinct instances collide on the same hash.
+//   - `RegExp` — also serializes to `"{}"`, same collision.
+//   - `Symbol` — silently dropped by `JSON.stringify` (becomes `undefined`).
+//   - Circular references — `JSON.stringify` throws `TypeError`, propagated
+//     as a defect through `getLanguage`/`resolveSDK`.
+//   - `Buffer` / `Uint8Array` — serialized as `{0:n,1:n,...}`; large but
+//     distinct, so correct but inefficient.
+//   - `Date`, `URL` — handled correctly via their `toJSON()` (ISO string,
+//     `href`).
+//
+// TODO(hash): swap for `effect/Hash` + `Equal.equals` with WeakMap-tracked
+// function identity to fix the named-collision risk and the unsupported
+// types above.
+export function hashIdentity(parts: Record<string, unknown>): string {
+  return Hash.fast(
+    JSON.stringify(parts, (_key, value) => {
+      if (typeof value === "function") return `__fn:${value.name || "anon"}`
+      if (typeof value === "bigint") return `${value.toString()}n`
+      return value
+    }),
+  )
+}
+
+export * as ProviderOverlay from "./overlay"