fix: recover from expired enterprise auth on remote config load (#31661)

packages/opencode/src/cli/cmd/providers.ts

@@ -1,3 +1,4 @@
+import type { Argv } from "yargs"
 import { Auth } from "../../auth"
 import { cmd } from "./cmd"
 import { CliError, effectCmd, fail } from "../effect-cmd"
@@ -298,7 +299,9 @@ export const ProvidersListCommand = effectCmd({
 export const ProvidersLoginCommand = effectCmd({
   command: "login [url]",
   describe: "log in to a provider",
-  builder: (yargs) =>
+  // URL login skips instance bootstrap, which would load remote config with the stale token and crash before re-auth.
+  instance: (args) => !args.url,
+  builder: (yargs: Argv) =>
     yargs
       .positional("url", {
         describe: "opencode auth provider",

packages/opencode/src/cli/error.ts

@@ -94,6 +94,18 @@ export function FormatError(input: unknown): string | undefined {
     return stringField(configFrontmatter, "message") ?? ""
   }
 
+  // ConfigRemoteAuthError: { url: string, remote: string }
+  const remoteAuth = configData(input, "ConfigRemoteAuthError")
+  if (remoteAuth) {
+    const url = stringField(remoteAuth, "url")
+    const remote = stringField(remoteAuth, "remote")
+    return [
+      `Failed to load remote config${remote ? ` from ${remote}` : ""}: the server returned a login page instead of JSON.`,
+      `Authentication is missing or has expired (the endpoint is likely behind an SSO or identity-aware proxy).`,
+      ...(url ? [`Run \`opencode auth login ${url}\` to re-authenticate.`] : []),
+    ].join("\n")
+  }
+
   // ConfigInvalidError: { path?: string, message?: string, issues?: Array<{ message: string, path: string[] }> }
   const configInvalid = configData(input, "ConfigInvalidError")
   if (configInvalid) {