fix(opencode): fail open on empty token output, guard missing output.headers (review)

Addresses two Copilot review comments on #197:

- fetchToken() returned stdout.trim() unconditionally. If `ucode
  auth-token` ever exits 0 with empty/whitespace-only stdout, the
  plugin would cache and send Authorization: Bearer <empty>,
  clobbering a possibly-still-valid bootstrap token for the full TTL
  window instead of failing open. Empty output now throws, so the
  hook's catch block fails open as intended.

- The chat.headers hook assumed output.headers always exists. If
  opencode ever invokes the hook without a pre-populated headers
  object, the assignment would throw -- caught silently by the
  existing try/catch, but the refresh would never apply. Defensively
  initialize output.headers before writing to it.

Both are proven by new Node-executed runtime tests (matching the
class of test that caught the input.provider?.id bug): each new test
was verified to fail against the pre-fix code and pass against the
fix, not just pass trivially.

Author: jesco39

src/ucode/agents/opencode.py

@@ -222,7 +222,14 @@ def render_auth_plugin(workspace: str, profile: str | None, provider_ids: list[s
 async function fetchToken() {{
   const [cmd, ...args] = UCODE_AUTH_TOKEN_ARGV;
   const {{ stdout }} = await execFileAsync(cmd, args);
-  return stdout.trim();
+  const token = stdout.trim();
+  if (!token) {{
+    // `ucode auth-token` exited 0 but printed nothing usable -- treat as a
+    // failure so the caller's catch block fails open to the static
+    // bootstrap token instead of caching/sending an empty bearer.
+    throw new Error("ucode auth-token returned empty output");
+  }}
+  return token;
 }}
 
 async function getToken() {{
@@ -259,6 +266,11 @@ def render_auth_plugin(workspace: str, profile: str | None, provider_ids: list[s
     }}
     try {{
       const token = await getToken();
+      // Defensive: ensure `output.headers` exists even if this opencode
+      // version ever invokes the hook without a pre-populated headers
+      // object, so the header still gets set rather than throwing (which
+      // would be caught below and silently no-op the refresh).
+      output.headers = output.headers || {{}};
       output.headers["Authorization"] = "Bearer " + token;
     }} catch (err) {{
       console.error("[ucode] failed to refresh Databricks token:", err);

tests/test_agent_opencode.py

@@ -519,7 +519,13 @@ class TestRenderAuthPluginRuntimeBehavior:
     type surface and an isolated end-to-end run against opencode 1.17.10
     (#190 follow-up). Skips if `node` isn't on PATH."""
 
-    def _run_plugin(self, tmp_path, provider_id: str | None, fake_token: str = "fresh-token-xyz"):
+    def _run_plugin(
+        self,
+        tmp_path,
+        provider_id: str | None,
+        fake_token: str | None = "fresh-token-xyz",
+        headers_preset: bool = True,
+    ):
         import shutil
         import subprocess
 
@@ -528,10 +534,11 @@ def _run_plugin(self, tmp_path, provider_id: str | None, fake_token: str = "fres
             pytest.skip("`node` is not installed")
 
         fake_ucode = tmp_path / "fake_ucode.py"
-        fake_ucode.write_text(
-            "#!/usr/bin/env python3\nimport sys\nprint(sys.argv[-1] if False else "
-            f"{fake_token!r})\n"
-        )
+        # `fake_token=None` simulates `ucode auth-token` exiting 0 but
+        # printing nothing (or only whitespace) -- a successful subprocess
+        # with unusable output.
+        print_stmt = f"print({fake_token!r})" if fake_token is not None else 'print("   ")'
+        fake_ucode.write_text(f"#!/usr/bin/env python3\n{print_stmt}\n")
         fake_ucode.chmod(0o755)
 
         with patch(
@@ -544,12 +551,17 @@ def _run_plugin(self, tmp_path, provider_id: str | None, fake_token: str = "fres
         plugin_path.write_text(js)
 
         provider_literal = f"{{ id: {provider_id!r} }}" if provider_id else "undefined"
+        output_literal = (
+            '{ headers: { Authorization: "Bearer STALE-BOOTSTRAP-TOKEN" } }'
+            if headers_preset
+            else "{}"
+        )
         harness = tmp_path / "harness.mjs"
         harness.write_text(f"""
 import {{ UcodeDatabricksAuth }} from {str(plugin_path.as_posix())!r};
 
 const hooks = await UcodeDatabricksAuth({{}});
-const output = {{ headers: {{ Authorization: "Bearer STALE-BOOTSTRAP-TOKEN" }} }};
+const output = {output_literal};
 const input = {{
   sessionID: "ses_test",
   agent: "build",
@@ -558,7 +570,7 @@ def _run_plugin(self, tmp_path, provider_id: str | None, fake_token: str = "fres
   message: {{}},
 }};
 await hooks["chat.headers"](input, output);
-console.log(JSON.stringify(output.headers));
+console.log(JSON.stringify(output.headers ?? null));
 """)
 
         result = subprocess.run(
@@ -589,6 +601,28 @@ def test_missing_provider_leaves_static_header_untouched(self, tmp_path):
         headers = json.loads(result.stdout.strip().splitlines()[-1])
         assert headers["Authorization"] == "Bearer STALE-BOOTSTRAP-TOKEN"
 
+    def test_empty_token_output_fails_open_instead_of_setting_empty_bearer(self, tmp_path):
+        # `ucode auth-token` exiting 0 with empty/whitespace-only stdout must
+        # not be treated as a successful fetch -- otherwise the hook would
+        # cache and send `Authorization: Bearer ` (empty), clobbering a
+        # possibly-still-valid bootstrap token for the full TTL window.
+        result = self._run_plugin(tmp_path, provider_id="databricks-anthropic", fake_token=None)
+        assert result.returncode == 0, result.stderr
+        headers = json.loads(result.stdout.strip().splitlines()[-1])
+        assert headers["Authorization"] == "Bearer STALE-BOOTSTRAP-TOKEN"
+
+    def test_initializes_missing_output_headers_instead_of_throwing(self, tmp_path):
+        # If opencode ever invokes the hook with no pre-populated
+        # `output.headers`, the hook must still set Authorization rather
+        # than throwing (which the try/catch would otherwise silently
+        # swallow, no-opping the refresh).
+        result = self._run_plugin(
+            tmp_path, provider_id="databricks-anthropic", headers_preset=False
+        )
+        assert result.returncode == 0, result.stderr
+        headers = json.loads(result.stdout.strip().splitlines()[-1])
+        assert headers["Authorization"] == "Bearer fresh-token-xyz"
+
 
 class TestWriteAuthPlugin:
     def test_writes_plugin_file_containing_hook(self, tmp_path, monkeypatch):