Harden Cloud auth and add explicit hosted OpenCode

[sanchitmonga22]

Summary

This is the single follow-up for the hosted account and coding-harness work, stacked on #34 (siddhesh/rcli-coding-harness). The parent PR remains the source for the editor integrations, Anthropic harness, local-model routing, and command registration. This PR builds on those files instead of maintaining a competing implementation.

Included

• Harden browser-approved console authentication with direct libcurl transport, strict console-origin validation, safe bearer/refresh-token handling, and platform-native credential storage.
• Keep compatibility facades for the parent harness/editor integrations while exposing an injectable ConsoleClient for hermetic tests.
• Restore the SDK kit/IDL lock to the 1.1.0 schema used by the published v0.20.31 kit. The parent currently pins 1.2.0 while its CI kit is 1.1.0, which makes the macOS and Windows configure jobs fail before compiling.
• Add explicit rcli opencode --cloud --model <console-model-id> routing. Local rcli opencode remains unchanged; hosted routing is opt-in and never silently sends local models to the cloud.
• Add account, hosted OpenCode, and CLI smoke tests. Test targets explicitly link the parent PR's fetched nlohmann-json dependency.

Review order

1. Merge rcli opencode, console sign-in, and serving a model to an editor #34 into main after its parent harness/editor changes are reviewed.
2. Merge this PR into main.

The separate distribution-hardening PR #49 is intentionally independent and can be reviewed or merged separately.

Validation

• cmake -S . -B build -DRCLI_SDK_KIT=<published kit> -DRCLI_APPLE_MLX_HOST=OFF -DBUILD_TESTING=ON
• cmake --build build -j4
• ctest --test-dir build --output-on-failure (7/7 passed against the locally available v0.20.28 kit; the schema lock and source pin remain v0.20.31/IDL 1.1.0)

Non-goals

• No inference-infra or backend changes.
• No billing implementation.
• No changes to NotSglang.
• No replacement of the parent PR's editor integrations or local harness behavior.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1abe6204-0cfc-4e61-8072-34fdbcae4d97

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sanchitmonga22]

Heads-up on this PR's green tick: no build or test job ran on it.

ci.yml and agents-sync.yml are both scoped to pull_request: branches: [main]. This PR targets siddhesh/rcli-coding-harness, so the only check that reported is CodeRabbit. "CLEAN" here means no checks were configured for this base, not checks passed. That is a side effect of stacking on the harness branch rather than anything wrong with the change — but it should not be read as CI approval.

Running the suite locally instead, against a tree byte-identical to this PR head (32a1396, verified by git tree hash 00b3abea…):

SDK kit

Downloaded the official release kit rather than using the local dist, which is still 0.20.28:

$ gh release download v0.20.31 -R RunanywhereAI/runanywhere-sdks -p "RunAnywhere-cpp-desktop-macos-arm64-*"
$ shasum -a 256 RunAnywhere-cpp-desktop-macos-arm64-v0.20.31.tar.gz
a8da7b6fa4cd361c2331f196cefdd12526dc2ae568d59f8851836f418389ff75   ← matches published .sha256

cmake configured cleanly against it, which settles the earlier concern about the schema pin: cmake/sdk-pin.cmake pins SDK 0.20.31 / IDL 1.1.0 / protoc 35.1, and the official 0.20.31 kit satisfies the EXACT find_package and the IDL SHA lock. The IDL 1.2.0 mismatch that blocked #34's head is resolved on this branch.

Tests

$ ctest --output-on-failure -E "mlx|telemetry_live"
1/5 rcli_unit_tests ........... Passed  0.53s
2/5 rcli_account_tests ........ Passed  0.48s
3/5 rcli_opencode_tests ....... Passed  0.47s
4/5 rcli_account_cli_e2e ...... Passed  1.16s
5/5 rcli_segment_tests ........ Passed  0.54s

100% tests passed, 0 tests failed out of 5

rcli_account_tests, rcli_opencode_tests and rcli_account_cli_e2e are precisely the surfaces this PR changes.

Two suites deliberately excluded, both pre-existing

• rcli_mlx_e2e_tests — the rcli-mlx target needs RCLI_SDK_SWIFT_PATH pointing at a runanywhere-sdks checkout. The local one is 0.20.28, so it cannot satisfy a 0.20.31 build. Unrelated to this PR and already tracked as a release gate.
• rcli_telemetry_live_tests — writes real events into the staging backend; oss-keyless-telemetry.yml deliberately keeps it off pull_request for that reason.

Suggestion

Because CI cannot see this branch, the first real signal arrives only when #34 merges to main. Worth merging #34 first and re-basing this onto main before anyone treats it as verified.