env OPENCODE_API_KEY prioritizes over the stored api key

Signed-off-by: weizhoublue <weizhou.lan@daocloud.io>

Author: weizhoublue

.github/workflows/welan-release.yml .github/workflows/a-welan-release.yml.github/workflows/welan-release.yml renamed to .github/workflows/a-welan-release.yml

@@ -1,4 +1,4 @@
-name: welan release
+name: a welan release
 
 # Fork patch author: only contiguous commits at the tip of origin/welan authored by this
 # name are cherry-picked onto the upstream release tag.
@@ -20,7 +20,7 @@ on:
         type: string
 
 concurrency:
-  group: welan-release
+  group: ${{ github.workflow }}
   cancel-in-progress: false
 
 permissions:
@@ -30,6 +30,7 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
   GH_TOKEN: ${{ secrets.WELAN_PAT }}
   WELAN_PATCH_AUTHOR: weizhoublue
+  BRANCH_NAME: welan
 
 jobs:
   release:
@@ -77,43 +78,54 @@ jobs:
 
       - name: Fetch branches and tags
         run: |
-          git fetch origin welan:refs/remotes/origin/welan --tags
+          git fetch origin "$BRANCH_NAME:refs/remotes/origin/$BRANCH_NAME" --tags
           git fetch upstream "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
           git rev-parse --verify "refs/tags/$RELEASE_TAG^{commit}" >/dev/null
 
-      - name: Prepare welan from upstream tag
+      - name: Prepare branch from upstream tag
         run: |
-          git checkout -B welan "$RELEASE_TAG"
+          git checkout -B "$BRANCH_NAME" "$RELEASE_TAG"
 
-      - name: Cherry-pick welan author patches
+      - name: Cherry-pick author patches
         id: patches
         continue-on-error: true
         run: |
-          patch_commits=()
-          ref="origin/welan"
-
+          # Walk the first-parent chain to find the upstream boundary: the first
+          # commit NOT authored by WELAN_PATCH_AUTHOR. Merge commits count as
+          # authored by whoever merged them, so this correctly stops at the
+          # upstream base even when the tip is a merge commit.
+          base_ref="origin/$BRANCH_NAME"
           while true; do
-            author="$(git log -1 --format='%an' "$ref")"
+            author="$(git log -1 --format='%an' "$base_ref")"
             if [[ "$author" != *"$WELAN_PATCH_AUTHOR"* ]]; then
               break
             fi
-
-            patch_commits=("$ref" "${patch_commits[@]}")
-
-            if ! git rev-parse "${ref}^" >/dev/null 2>&1; then
+            if ! git rev-parse "${base_ref}^" >/dev/null 2>&1; then
               break
             fi
-            ref="${ref}^"
+            base_ref="${base_ref}^"
           done
 
+          if [[ "$(git rev-parse "$base_ref")" == "$(git rev-parse "origin/$BRANCH_NAME")" ]]; then
+            echo "::error::No commits authored by $WELAN_PATCH_AUTHOR found at the tip of origin/$BRANCH_NAME"
+            exit 1
+          fi
+
+          # Collect all non-merge commits in the weizhoublue range (oldest first).
+          # --no-merges skips merge bookkeeping commits and instead surfaces the
+          # real patch commits from any merged branches, making each entry safely
+          # cherry-pickable without needing -m.
+          mapfile -t patch_commits < <(
+            git log --no-merges --reverse --format='%H' "${base_ref}..origin/$BRANCH_NAME"
+          )
+
           if [ "${#patch_commits[@]}" -eq 0 ]; then
-            echo "::error::No commits authored by $WELAN_PATCH_AUTHOR found at the tip of origin/welan"
+            echo "::error::No non-merge commits found between $base_ref and origin/$BRANCH_NAME"
             exit 1
           fi
 
-          echo "Cherry-picking ${#patch_commits[@]} commit(s) from origin/welan (author: $WELAN_PATCH_AUTHOR)"
-          for commit in "${patch_commits[@]}"; do
-            sha="$(git rev-parse "$commit")"
+          echo "Cherry-picking ${#patch_commits[@]} commit(s) from origin/$BRANCH_NAME (author: $WELAN_PATCH_AUTHOR)"
+          for sha in "${patch_commits[@]}"; do
             subject="$(git log -1 --format='%s' "$sha")"
             echo "Cherry-picking $sha $subject"
             git cherry-pick "$sha"
@@ -124,15 +136,15 @@ jobs:
         run: |
           conflicted_files="$(git diff --name-only --diff-filter=U || true)"
           upstream_tag="$(git rev-parse "$RELEASE_TAG")"
-          origin_welan="$(git rev-parse origin/welan)"
+          origin_branch="$(git rev-parse "origin/$BRANCH_NAME")"
           current_head="$(git rev-parse HEAD)"
 
-          echo "::error::welan release $RELEASE_TAG hit a cherry-pick conflict"
+          echo "::error::$BRANCH_NAME release $RELEASE_TAG hit a cherry-pick conflict"
           echo "Version: $RELEASE_TAG"
           echo "Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           echo "Upstream tag: $RELEASE_TAG"
           echo "Upstream tag SHA: ${upstream_tag}"
-          echo "origin/welan: ${origin_welan}"
+          echo "origin/$BRANCH_NAME: ${origin_branch}"
           echo "Current HEAD during conflict: ${current_head}"
           echo "Patch author: $WELAN_PATCH_AUTHOR"
           echo
@@ -195,12 +207,17 @@ jobs:
         env:
           OPENCODE_EXPERIMENTAL_DISABLE_FILEWATCHER: "false"
 
+      - name: Run env key priority tests
+        working-directory: packages/opencode
+        timeout-minutes: 5
+        run: bun test --timeout 60000 test/provider/provider-env-key-priority.test.ts
+
       - name: Build CLI binaries
         run: OPENCODE_VERSION="$BUILD_VERSION" ./packages/opencode/script/build.ts
 
       - name: Stage release binaries
         run: |
-          asset_dir="/tmp/welan-release-assets"
+          asset_dir="/tmp/$BRANCH_NAME-release-assets"
           rm -rf "$asset_dir"
           mkdir -p "$asset_dir"
 
@@ -210,8 +227,8 @@ jobs:
 
           ls -lh "$asset_dir"
 
-      - name: Push rebased welan
-        run: git push origin HEAD:welan --force-with-lease
+      - name: Push rebased branch
+        run: git push origin "HEAD:$BRANCH_NAME" --force-with-lease
 
       - name: Push release archive branch
         run: |
@@ -224,21 +241,15 @@ jobs:
           tag="$RELEASE_TAG"
           target="$(git rev-parse HEAD)"
 
-          if gh release view "$tag" --repo "${{ github.repository }}" >/dev/null 2>&1; then
-            gh release delete "$tag" --repo "${{ github.repository }}" --yes
-          fi
-
-          if git ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null 2>&1; then
-            git push origin ":refs/tags/$tag"
-          fi
+          gh release delete "$tag" --repo "${{ github.repository }}" --yes 2>/dev/null || true
 
           git tag -f "$tag" "$target"
-          git push origin "refs/tags/$tag"
+          git push origin "refs/tags/$tag" --force
 
           gh release create "$tag" \
-            /tmp/welan-release-assets/opencode-darwin-arm64 \
-            /tmp/welan-release-assets/opencode-linux-arm64 \
-            /tmp/welan-release-assets/opencode-linux-x64 \
+            "$asset_dir/opencode-darwin-arm64" \
+            "$asset_dir/opencode-linux-arm64" \
+            "$asset_dir/opencode-linux-x64" \
             --repo "${{ github.repository }}" \
             --target "$target" \
             --title "$tag" \

.github/workflows/test-linux.yml

@@ -0,0 +1,41 @@
+name: welan-test-pr
+
+on:
+  push:
+    branches: [welan]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+
+jobs:
+  test:
+    name: unit (linux)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - uses: ./.github/actions/setup-bun
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "bot@opencode.ai"
+          git config --global user.name "opencode"
+
+      - name: Run opencode tests
+        working-directory: packages/opencode
+        timeout-minutes: 20
+        run: |
+          find test \( -name '*.test.ts' -o -name '*.test.tsx' \) ! -name 'run-process*.test.ts' -print0 \
+            | xargs -0 bun test --timeout 60000
+          bun test --timeout 60000 --max-concurrency=1 test/cli/run/run-process-limit.test.ts
+          bun test --timeout 60000 --max-concurrency=1 test/cli/run/run-process.test.ts \
+            --test-name-pattern='exits 0 and writes|prints each|prints reasoning|unknown stream|format json|rejects requested|attach mode|SIGINT'
+        env:
+          GITHUB_ACTIONS: "false"

docs/superpowers/plans/2026-07-07-env-api-key-priority.md

@@ -0,0 +1,144 @@
+# Env Var API Key Priority Over Stored Key Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make environment variable API keys (e.g. `OPENCODE_API_KEY`) take precedence over API keys stored via the interactive UI, so users can switch keys at launch time without touching stored configuration.
+
+**Architecture:** In the provider loading sequence inside `provider.ts`, the `// load apikeys` section currently runs after `// load env` and overwrites whatever env var key was loaded. The fix adds a 2-line guard: before merging a stored API key into a provider, check whether that provider's env vars already provided a key. If so, skip the stored key.
+
+**Tech Stack:** TypeScript, Effect, Bun test runner
+
+## Global Constraints
+
+- Run tests from `packages/opencode`, never from repo root
+- Use `bun test` (not `bun run test`) to run tests
+- Use `bun typecheck` (not `tsc`) for type checking
+- Do not move or restructure code blocks — only add the guard inside the existing loop
+
+---
+
+### Task 1: Write the failing test
+
+**Files:**
+- Modify: `packages/opencode/test/provider/provider.test.ts` (append at end of file)
+
+**Interfaces:**
+- Consumes: `Auth.Service` (already imported as `import { Auth } from "@/auth"`), `set` helper (already defined at line 36), `Global` from `@opencode-ai/core/global`, `Filesystem` from `@/util/filesystem`
+- Produces: test case `"env var takes precedence over stored API key"`
+
+- [ ] **Step 1: Append the new test to the test file**
+
+Open `packages/opencode/test/provider/provider.test.ts` and append at the very end:
+
+```typescript
+it.instance("env var takes precedence over stored API key", () =>
+  Effect.gen(function* () {
+    // Set a stored API key for anthropic
+    const auth = yield* Auth.Service
+    yield* auth.set("anthropic", { type: "api", key: "stored-key" })
+
+    // Set an env var key — this should win
+    yield* set("ANTHROPIC_API_KEY", "env-key")
+
+    const providers = yield* list
+    const anthropic = providers[ProviderV2.ID.anthropic]
+    expect(anthropic).toBeDefined()
+    // The loaded key should be the env var, not the stored key
+    expect(anthropic.key).toBe("env-key")
+  }),
+)
+```
+
+- [ ] **Step 2: Run the test to verify it fails**
+
+```bash
+cd packages/opencode && bun test test/provider/provider.test.ts --test-name-pattern "env var takes precedence over stored API key"
+```
+
+Expected: test **FAILS** — currently `anthropic.key` will be `"stored-key"` (stored key wins over env).
+
+---
+
+### Task 2: Implement the fix
+
+**Files:**
+- Modify: `packages/opencode/src/provider/provider.ts:1501-1512`
+
+**Interfaces:**
+- Consumes: `database` (already in scope — the provider registry with `env` arrays), `envs` (already in scope — loaded env vars map)
+- Produces: modified `// load apikeys` loop that skips stored keys when env var is already providing a key
+
+- [ ] **Step 1: Locate the `// load apikeys` loop**
+
+In `packages/opencode/src/provider/provider.ts`, find this block (around line 1501):
+
+```typescript
+        // load apikeys
+        const auths = yield* auth.all().pipe(Effect.orDie)
+        for (const [id, provider] of Object.entries(auths)) {
+          const providerID = ProviderV2.ID.make(id)
+          if (disabled.has(providerID)) continue
+          if (provider.type === "api") {
+            mergeProvider(providerID, {
+              source: "api",
+              key: provider.key,
+            })
+          }
+        }
+```
+
+- [ ] **Step 2: Add the env-priority guard**
+
+Replace only the inner `if (provider.type === "api")` block:
+
+```typescript
+        // load apikeys
+        const auths = yield* auth.all().pipe(Effect.orDie)
+        for (const [id, provider] of Object.entries(auths)) {
+          const providerID = ProviderV2.ID.make(id)
+          if (disabled.has(providerID)) continue
+          if (provider.type === "api") {
+            const envKey = database[providerID]?.env.map((item) => envs[item]).find(Boolean)
+            if (envKey) continue
+            mergeProvider(providerID, {
+              source: "api",
+              key: provider.key,
+            })
+          }
+        }
+```
+
+The two new lines are:
+1. `const envKey = database[providerID]?.env.map((item) => envs[item]).find(Boolean)` — reuse the same env-var lookup already used in `// load env`
+2. `if (envKey) continue` — skip stored key when env var is present
+
+- [ ] **Step 3: Run type check**
+
+```bash
+cd packages/opencode && bun typecheck
+```
+
+Expected: no errors.
+
+- [ ] **Step 4: Run the new test to verify it passes**
+
+```bash
+cd packages/opencode && bun test test/provider/provider.test.ts --test-name-pattern "env var takes precedence over stored API key"
+```
+
+Expected: **PASS**
+
+- [ ] **Step 5: Run the full provider test suite to check for regressions**
+
+```bash
+cd packages/opencode && bun test test/provider/provider.test.ts
+```
+
+Expected: all existing tests **PASS**.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add packages/opencode/src/provider/provider.ts packages/opencode/test/provider/provider.test.ts
+git commit -m "fix(core): env var api key takes precedence over stored key"
+```