[pacocartones]

Summary

• A proxy assigned to an opencode / opencode-go connection in Proxy Management is pinned by the chat handler as the ambient proxy context before the executor runs. OpencodeExecutor only reads per-account proxies from providerSpecificData.accountProxies; an API-key connection has none, so it keeps its single default account and takes the single-account fast path, which wrapped the upstream dispatch in runWithDirectFetchContext(). That direct sentinel makes patchedFetch bypass the ambient context and hit native fetch, so the assigned proxy was discarded and the request egressed from the host IP (403 This model is not available in your country on geoblocked hosts).
• The fast path now applies the direct pin only when no ambient proxy context exists (new hasAmbientProxyContext() in open-sse/utils/proxyFetch.ts); when the handler already pinned a proxy, the dispatch runs inside it. The rotation loop's nested runWithProxyContext(account.proxy, ...) already inherits the ambient context for a null account proxy and is unchanged; the new test pins both paths.

Related Issues

• Closes fix(providers): OpencodeExecutor bypasses global proxy assignments and forces direct connection (proxy: null) #11894

Validation

• Change type: provider
• Focused tests and category gates from the golden path: tests/unit/11894-opencode-ambient-proxy-context.test.ts (RED on the base, GREEN with the fix; mutation-checked) plus 13 neighbouring executor/proxy files (151/151); npm run typecheck:core 0; npm run check:open-sse-typecheck OK; npm run check:changelog-integrity OK
• npm run lint — repository-wide eslint exit 0 (run with --pass-on-unpruned-suppressions; the literal command reports only pre-existing unused global suppressions on this base)
• Reconciled with the current active release base release/v3.8.51@158647618; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube is temporarily opt-in while the private project has no quota; it is not a PR gate.

Tests Added Or Updated

• tests/unit/11894-opencode-ambient-proxy-context.test.ts (new): single-account fast path and multi-account rotation path under an ambient proxy, asserting the upstream fetch resolves source: "context" on the ambient proxy port.

Coverage Notes

• open-sse/executors/opencode.ts fast path and open-sse/utils/proxyFetch.ts hasAmbientProxyContext() are covered by the new test; no coverage moved down.

Reviewer Notes

• The issue thread points at opencode.ts:590; that call already inherits the ambient context (runWithProxyContext falls back to the current store when proxyConfig is null). The clobber is the runWithDirectFetchContext wrapper on the single-account fast path. The direct pin is kept for connections with no assignment so env-proxy, TLS-fingerprint and direct-timeout behaviour there is unchanged.
• No behaviour change for connections that configure per-account proxies (accountProxies); they never enter the fast path.

Co-authored-by: @LeonMAG