ocx opencode: catalog fetch needs admin token but sends data-plane key — always 401 on forwarded endpoints #401

Symptom

ocx opencode (any subcommand that builds the runtime provider config) fails with:

❌ Could not fetch the model catalog from the proxy: opencodex admin token required

Observed on a host where the proxy runs as a forwarded/remote endpoint (Docker container, live.pid === null), client + server on 1.5.8.

Root cause

fetchOpencodeProxyModels() in src/cli/opencode.ts calls GET {proxy}/api/models with header X-OpenCodex-API-Key: <apiKey> where apiKey = opencodeApiKey(config, env) — i.e. OPENCODEX_API_AUTH_TOKEN → service-api-token file → config.apiKeys[0] fallback. But /api/models is a management route: management-auth.ts only accepts a validated admin token (admin-api-token / ocx_admin_*) or GUI session — the service/data-plane token is rejected with 401.

So one credential is used for two trust planes:

• /api/models fetch → needs admin token
• OPENCODEX_OPENCODE_API_KEY baked into the opencode provider block for /v1/* calls → needs service token (admin token is 401 there)

Whichever single token opencodeApiKey returns, one side fails. Verified on a live 1.5.8 proxy:

• X-OpenCodex-API-Key: <service-token> → /api/models = 401
• Authorization: Bearer <admin-token> or X-OpenCodex-API-Key: <admin> → /api/models = 200
• x-opencodex-api-key: <admin-token> → /v1/models = 401 (data plane correctly rejects admin)

Expected

Mirror src/cli/droid.ts, which uses configuredAdminToken() for the management fetch and explicitly keeps it separate from the data-plane credential ("Never substitute a management/admin token for a data-plane credential").

Suggested fix: in fetchOpencodeProxyModels, send the admin token (env OPENCODEX_ADMIN_AUTH_TOKEN or admin-api-token via configuredAdminToken()) on X-OpenCodex-API-Key/Authorization, while OPENCODEX_OPENCODE_API_KEY keeps resolving to the service/api key for the child process.

Repro

1. Run proxy (service token in service-api-token, admin token in admin-api-token).
2. ocx opencode --version or ocx opencode → catalog fetch → 401 opencodex admin token required.