v1.8.0

Changed

• OpenCode's runtime files move out of its config folder (#234). OpenCode 2 watches its config folder for changes, and the plugin rewrote files there while it ran. The account state file (openai-auth-state.json), the vault folder (openai-auth-vault/) and both Codex sessions files now live in the plugin's state folder. By default that is ~/.local/state/cortexkit/openai-auth/opencode/ on Linux and macOS, and %USERPROFILE%\.local\state\cortexkit\openai-auth\opencode\ on Windows; XDG_STATE_HOME, when set, replaces ~/.local/state on every OS. Any other OpenCode config folder gets its own opencode-<hash>/ folder there. The settings file openai-auth.json stays where it is. Pi's files are unchanged.
  • When it moves: at an OpenCode start while no other OpenCode process could still write the old files. A process that starts while the move must wait keeps the old files until it exits, so the simplest way is to close every OpenCode on the machine, then start OpenCode again. Until the move, the plugin keeps using the old files and logs why.
  • How it moves: each file is copied and checked byte for byte before layout.json records the move. Only then does it remove the old copies that still match. An old token or vault file that Windows won't release yet (another program has it open) is left for the next start to remove. A session file that differs, or that can't be removed, is left in place unused, with a warning.
  • When it refuses to start: a malformed or unreadable layout.json, or an old token or vault file that changed or came back after the move. The old copy may hold the only live refresh token, so the message names both files and asks you to keep the one from the most recent sign-in or refresh. If you can't tell which that is, don't guess.
  • Vault mode stays on: if OpenCode was connected to the vault, the move removes the old token but leaves the old enrollment record. An older version, or an OpenCode the move couldn't see, then still reads the machine as connected, so it refuses requests for lack of a token, and never falls back to local accounts. Disconnect on this version removes that record.
  • Paths you set: a state file named by OPENCODE_OPENAI_AUTH_STATE_FILE, and the state and vault files beside a custom OPENCODE_OPENAI_AUTH_FILE, stay where that process says.
  • Downgrading: an older version doesn't find the moved accounts or vault token on its own. Nothing is lost. Close every OpenCode first, then follow Downgrading.

Fixed

• Fewer writes into the watched folder (#234). After the first quota reading, each process now commits quota readings to disk at most about every 30 seconds per file, and doesn't rewrite the vault account list when the merged readings haven't changed. Routing in that process still sees each reading at once. A vault account discovery that finds the list unchanged no longer takes the list's write lock.
• Enrollment status and pool settings are cached (#236). The plugin no longer opens and parses these files many times a second while they are unchanged. On Linux and macOS an unchanged file costs one quick file-status check. Windows keeps the full read so its permission checks still run.
• Fewer writes to the OpenCode 2 sessions file (#234). Deleting a session the file never held no longer rewrites it, a save that would write the same content is skipped, and new sessions are saved together in one write about two seconds after the first. On shutdown, a waiting save runs at once.
• A vault connection that never opens now gives up after 10 seconds, and a later attempt connects again. Before, one stuck attempt could leave a project refusing vault requests until OpenCode restarted (common-auth #8).