core: add Control token refresh and account retrieval

Enables automatic token refresh for authenticated Control accounts by implementing a unique active account constraint and refresh token flow. The database schema now enforces a single active Control account at a time, and tokens are automatically refreshed when expired.

packages/opencode/src/config/config.ts

@@ -31,6 +31,7 @@ import { Event } from "../server/event"
 import { PackageRegistry } from "@/bun/registry"
 import { proxied } from "@/util/proxied"
 import { iife } from "@/util/iife"
+import { Control } from "@/control"
 
 export namespace Config {
   const ModelId = z.string().meta({ $ref: "https://models.dev/model-schema.json#/$defs/Model" })
@@ -53,7 +54,7 @@ export namespace Config {
   const managedConfigDir = process.env.OPENCODE_TEST_MANAGED_CONFIG_DIR || getManagedConfigDir()
 
   // Custom merge function that concatenates array fields instead of replacing them
-  function mergeConfigConcatArrays(target: Info, source: Info): Info {
+  function merge(target: Info, source: Info): Info {
     const merged = mergeDeep(target, source)
     if (target.plugin && source.plugin) {
       merged.plugin = Array.from(new Set([...target.plugin, ...source.plugin]))
@@ -88,20 +89,21 @@ export namespace Config {
         const remoteConfig = wellknown.config ?? {}
         // Add $schema to prevent load() from trying to write back to a non-existent file
         if (!remoteConfig.$schema) remoteConfig.$schema = "https://opencode.ai/config.json"
-        result = mergeConfigConcatArrays(
-          result,
-          await load(JSON.stringify(remoteConfig), `${key}/.well-known/opencode`),
-        )
+        result = merge(result, await load(JSON.stringify(remoteConfig), `${key}/.well-known/opencode`))
         log.debug("loaded remote config from well-known", { url: key })
       }
     }
 
+    const token = await Control.token()
+    if (token) {
+    }
+
     // Global user config overrides remote config.
-    result = mergeConfigConcatArrays(result, await global())
+    result = merge(result, await global())
 
     // Custom config path overrides global config.
     if (Flag.OPENCODE_CONFIG) {
-      result = mergeConfigConcatArrays(result, await loadFile(Flag.OPENCODE_CONFIG))
+      result = merge(result, await loadFile(Flag.OPENCODE_CONFIG))
       log.debug("loaded custom config", { path: Flag.OPENCODE_CONFIG })
     }
 
@@ -110,7 +112,7 @@ export namespace Config {
       for (const file of ["opencode.jsonc", "opencode.json"]) {
         const found = await Filesystem.findUp(file, Instance.directory, Instance.worktree)
         for (const resolved of found.toReversed()) {
-          result = mergeConfigConcatArrays(result, await loadFile(resolved))
+          result = merge(result, await loadFile(resolved))
         }
       }
     }
@@ -153,7 +155,7 @@ export namespace Config {
       if (dir.endsWith(".opencode") || dir === Flag.OPENCODE_CONFIG_DIR) {
         for (const file of ["opencode.jsonc", "opencode.json"]) {
           log.debug(`loading config from ${path.join(dir, file)}`)
-          result = mergeConfigConcatArrays(result, await loadFile(path.join(dir, file)))
+          result = merge(result, await loadFile(path.join(dir, file)))
           // to satisfy the type checker
           result.agent ??= {}
           result.mode ??= {}
@@ -179,7 +181,7 @@ export namespace Config {
     // Use a path within Instance.directory so relative {file:} paths resolve correctly.
     // The filename "OPENCODE_CONFIG_CONTENT" appears in error messages for clarity.
     if (Flag.OPENCODE_CONFIG_CONTENT) {
-      result = mergeConfigConcatArrays(
+      result = merge(
         result,
         await load(Flag.OPENCODE_CONFIG_CONTENT, path.join(Instance.directory, "OPENCODE_CONFIG_CONTENT")),
       )
@@ -192,7 +194,7 @@ export namespace Config {
     // This way it only loads config file and not skills/plugins/commands
     if (existsSync(managedConfigDir)) {
       for (const file of ["opencode.jsonc", "opencode.json"]) {
-        result = mergeConfigConcatArrays(result, await loadFile(path.join(managedConfigDir, file)))
+        result = merge(result, await loadFile(path.join(managedConfigDir, file)))
       }
     }
 

packages/opencode/src/control/control.sql.ts

@@ -1,4 +1,5 @@
-import { sqliteTable, text, integer, primaryKey } from "drizzle-orm/sqlite-core"
+import { sqliteTable, text, integer, primaryKey, uniqueIndex } from "drizzle-orm/sqlite-core"
+import { eq } from "drizzle-orm"
 import { Timestamps } from "@/storage/schema.sql"
 
 export const ControlAccountTable = sqliteTable(
@@ -7,12 +8,15 @@ export const ControlAccountTable = sqliteTable(
     email: text().notNull(),
     url: text().notNull(),
     access_token: text().notNull(),
-    refresh_token: text(),
+    refresh_token: text().notNull(),
     token_expiry: integer(),
     active: integer({ mode: "boolean" })
       .notNull()
       .$default(() => false),
     ...Timestamps,
   },
-  (table) => [primaryKey({ columns: [table.email, table.url] })],
+  (table) => [
+    primaryKey({ columns: [table.email, table.url] }),
+    uniqueIndex("control_account_active_idx").on(table.email).where(eq(table.active, true)),
+  ],
 )

packages/opencode/src/control/index.ts

@@ -1,3 +1,67 @@
+import { eq, and } from "drizzle-orm"
+import { Database } from "@/storage/db"
+import { ControlAccountTable } from "./control.sql"
+import z from "zod"
+
 export * from "./control.sql"
 
-export namespace Control {}
+export namespace Control {
+  export const Account = z.object({
+    email: z.string(),
+    url: z.string(),
+  })
+  export type Account = z.infer<typeof Account>
+
+  function fromRow(row: (typeof ControlAccountTable)["$inferSelect"]): Account {
+    return {
+      email: row.email,
+      url: row.url,
+    }
+  }
+
+  export function account(): Account | undefined {
+    const row = Database.use((db) =>
+      db.select().from(ControlAccountTable).where(eq(ControlAccountTable.active, true)).get(),
+    )
+    return row ? fromRow(row) : undefined
+  }
+
+  export async function token(): Promise<string | undefined> {
+    const row = Database.use((db) =>
+      db.select().from(ControlAccountTable).where(eq(ControlAccountTable.active, true)).get(),
+    )
+    if (!row) return undefined
+    if (row.token_expiry && row.token_expiry > Date.now()) return row.access_token
+
+    const res = await fetch(`${row.url}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: row.refresh_token,
+      }).toString(),
+    })
+
+    if (!res.ok) return
+
+    const json = (await res.json()) as {
+      access_token: string
+      refresh_token?: string
+      expires_in?: number
+    }
+
+    Database.use((db) =>
+      db
+        .update(ControlAccountTable)
+        .set({
+          access_token: json.access_token,
+          refresh_token: json.refresh_token ?? row.refresh_token,
+          token_expiry: json.expires_in ? Date.now() + json.expires_in * 1000 : undefined,
+        })
+        .where(and(eq(ControlAccountTable.email, row.email), eq(ControlAccountTable.url, row.url)))
+        .run(),
+    )
+
+    return json.access_token
+  }
+}

packages/opencode/src/storage/db.ts

@@ -13,6 +13,7 @@ import path from "path"
 import { readFileSync, readdirSync } from "fs"
 import fs from "fs/promises"
 import { Instance } from "@/project/instance"
+import * as schema from "./schema"
 
 declare const OPENCODE_MIGRATIONS: { sql: string; timestamp: number }[] | undefined
 
@@ -26,9 +27,10 @@ export const NotFoundError = NamedError.create(
 const log = Log.create({ service: "db" })
 
 export namespace Database {
-  export type Transaction = SQLiteTransaction<"sync", void, Record<string, never>, Record<string, never>>
+  type Schema = typeof schema
+  export type Transaction = SQLiteTransaction<"sync", void, Schema, Schema>
 
-  type Client = SQLiteBunDatabase
+  type Client = SQLiteBunDatabase<Schema>
 
   type Journal = { sql: string; timestamp: number }[]
 
@@ -75,7 +77,7 @@ export namespace Database {
     sqlite.run("PRAGMA cache_size = -64000")
     sqlite.run("PRAGMA foreign_keys = ON")
 
-    const db = drizzle({ client: sqlite })
+    const db = drizzle({ client: sqlite, schema })
 
     // Apply schema migrations
     const entries =

packages/opencode/src/storage/schema.ts

@@ -0,0 +1,4 @@
+export { ControlAccountTable } from "../control/control.sql"
+export { SessionTable, MessageTable, PartTable, TodoTable, PermissionTable } from "../session/session.sql"
+export { SessionShareTable } from "../share/share.sql"
+export { ProjectTable } from "../project/project.sql"