anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #5742] auth v2 core #11561

New Issue
Closed
opened 2026-02-16 18:16:24 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:16:24 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/5742

State: closed
Merged: No

Context: #5748.

Summary

This PR is the foundational "auth v2" refactor: encrypted-at-rest credentials + multi-account OAuth subscriptions, and a fetch-level rotation/refresh engine so OpenCode can retry within the same user request when a subscription is throttled or expires.

Why: the current auth path is single-credential and makes pooling/rotation/refresh brittle. Auth v2 makes subscription pools and API-key mode coexist cleanly while keeping the integration point provider-agnostic.

What changed

  • Encrypted vault for credentials (AES-256-GCM) with atomic writes + lockfile coordination; key is loaded from OPENCODE_VAULT_KEY or generated locally.
  • Multi-record credential store (supports multiple accounts per provider/namespace) + idempotent migration from legacy files.
  • Provider auth registry/adapters (Anthropic/OpenAI/Google/Copilot/Qwen/Cursor) to unify OAuth flows and apply auth headers.
  • Fetch middleware that:
    • rotates on 429 (Retry-After-aware) and retries in the same request
    • refreshes on 401/403 where supported
    • persists pool ordering + cooldowns across runs
  • MCP OAuth state moved into the credential store.
  • Tests for vault/store and rotation behavior; see specs/provider-auth-v2.md for the RFC/architecture.

How to test

  • opencode auth login → add OAuth creds; opencode auth list should show records.
  • Trigger a 429/auth_expired scenario and verify it rotates to the next credential and retries.
  • Run: bun test packages/opencode/test/credentials and bun test packages/opencode/test/inference/rotating-fetch.test.ts

Follow-ups

  • UI + rotation stats: #5743
  • Opt-in model discovery: #5744
  • Vault key management commands: #5745
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/5742 **State:** closed **Merged:** No --- Context: #5748. ## Summary This PR is the foundational "auth v2" refactor: encrypted-at-rest credentials + multi-account OAuth subscriptions, and a fetch-level rotation/refresh engine so OpenCode can retry within the same user request when a subscription is throttled or expires. Why: the current auth path is single-credential and makes pooling/rotation/refresh brittle. Auth v2 makes subscription pools and API-key mode coexist cleanly while keeping the integration point provider-agnostic. ## What changed - Encrypted vault for credentials (AES-256-GCM) with atomic writes + lockfile coordination; key is loaded from `OPENCODE_VAULT_KEY` or generated locally. - Multi-record credential store (supports multiple accounts per provider/namespace) + idempotent migration from legacy files. - Provider auth registry/adapters (Anthropic/OpenAI/Google/Copilot/Qwen/Cursor) to unify OAuth flows and apply auth headers. - Fetch middleware that: - rotates on `429` (Retry-After-aware) and retries in the same request - refreshes on `401/403` where supported - persists pool ordering + cooldowns across runs - MCP OAuth state moved into the credential store. - Tests for vault/store and rotation behavior; see `specs/provider-auth-v2.md` for the RFC/architecture. ## How to test - `opencode auth login` → add OAuth creds; `opencode auth list` should show records. - Trigger a `429`/`auth_expired` scenario and verify it rotates to the next credential and retries. - Run: `bun test packages/opencode/test/credentials` and `bun test packages/opencode/test/inference/rotating-fetch.test.ts` ## Follow-ups - UI + rotation stats: #5743 - Opt-in model discovery: #5744 - Vault key management commands: #5745
yindo added the pull-request label 2026-02-16 18:16:24 -05:00
yindo closed this issue 2026-02-16 18:16:25 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#11561
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?