anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #9455] feat(auth): Auto-Relogin via Persistent Browser Sessions #13120

New Issue
Closed
opened 2026-02-16 18:17:59 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:59 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/9455

State: closed
Merged: No

Summary

Automatically refresh expired Anthropic OAuth tokens using persistent browser sessions with Puppeteer + Stealth plugin. This eliminates the need for manual re-authentication when tokens expire overnight.

Closes #9360

Problem

When using Anthropic OAuth (Claude Max subscription), tokens expire after a few hours. The refresh token also expires, causing "Token refresh failed: 400" errors. Users had to manually run opencode auth again each morning.

Solution

This PR adds automatic re-login via headless browser sessions:

  1. One-time setup: User runs opencode auth browser setup which opens a browser window
  2. User logs in: Authenticates with claude.ai (the cookies are saved)
  3. Auto-refresh: When tokens expire, a headless browser automatically:
    • Navigates to the OAuth authorize URL
    • Uses saved cookies to auto-authenticate
    • Clicks "Authorize" button automatically
    • Extracts new tokens and updates the auth store
    • Retries the failed request seamlessly

Features

CLI Commands

  • opencode auth browser setup - Configure browser session for an account
  • opencode auth browser status - Show status of all browser sessions
  • opencode auth browser remove - Remove a browser session

Technical Implementation

  • Puppeteer + Stealth: Uses puppeteer-extra-plugin-stealth to bypass Cloudflare bot detection
  • Auto-install: Puppeteer is automatically installed on first use
  • Isolated profiles: Each OAuth account has its own browser profile (cookies isolated)
  • Profile locking: Prevents concurrent browser operations on same profile
  • Dual callback support: Handles both console.anthropic.com and platform.claude.com OAuth callbacks

Error Handling

  • Detects "Token refresh failed: 400" errors in rotating-fetch.ts
  • Attempts auto-relogin before failing over to next account
  • Shows toast notifications for refresh status
  • Falls back gracefully if browser session is not configured

Files Changed

File Description
auth/browser.ts New - Puppeteer browser session management
auth/rotating-fetch.ts Token refresh error detection + auto-relogin trigger
auth/index.ts Added updateRecord() for token updates
cli/cmd/auth.ts CLI commands for browser session management
server/routes/provider.ts API endpoints for browser sessions
dialog-settings.tsx Desktop UI showing browser session status
package.json Puppeteer as optional dependency

Dependencies

Added as optional dependencies (only installed when needed):

  • puppeteer: ^24.9.0
  • puppeteer-extra: ^3.3.6
  • puppeteer-extra-plugin-stealth: ^2.11.2

Testing

  1. Run opencode auth browser setup and log in
  2. Invalidate token manually or wait for expiration
  3. Send a message - auto-relogin should trigger automatically
  4. Token refreshes seamlessly without user interaction

Screenshots

(Screenshots to be added by @mguttmann)

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/9455 **State:** closed **Merged:** No --- ## Summary Automatically refresh expired Anthropic OAuth tokens using persistent browser sessions with Puppeteer + Stealth plugin. This eliminates the need for manual re-authentication when tokens expire overnight. **Closes #9360** ## Problem When using Anthropic OAuth (Claude Max subscription), tokens expire after a few hours. The refresh token also expires, causing "Token refresh failed: 400" errors. Users had to manually run `opencode auth` again each morning. ## Solution This PR adds automatic re-login via headless browser sessions: 1. **One-time setup**: User runs `opencode auth browser setup` which opens a browser window 2. **User logs in**: Authenticates with claude.ai (the cookies are saved) 3. **Auto-refresh**: When tokens expire, a headless browser automatically: - Navigates to the OAuth authorize URL - Uses saved cookies to auto-authenticate - Clicks "Authorize" button automatically - Extracts new tokens and updates the auth store - Retries the failed request seamlessly ## Features ### CLI Commands - `opencode auth browser setup` - Configure browser session for an account - `opencode auth browser status` - Show status of all browser sessions - `opencode auth browser remove` - Remove a browser session ### Technical Implementation - **Puppeteer + Stealth**: Uses `puppeteer-extra-plugin-stealth` to bypass Cloudflare bot detection - **Auto-install**: Puppeteer is automatically installed on first use - **Isolated profiles**: Each OAuth account has its own browser profile (cookies isolated) - **Profile locking**: Prevents concurrent browser operations on same profile - **Dual callback support**: Handles both `console.anthropic.com` and `platform.claude.com` OAuth callbacks ### Error Handling - Detects "Token refresh failed: 400" errors in `rotating-fetch.ts` - Attempts auto-relogin before failing over to next account - Shows toast notifications for refresh status - Falls back gracefully if browser session is not configured ## Files Changed | File | Description | |------|-------------| | `auth/browser.ts` | New - Puppeteer browser session management | | `auth/rotating-fetch.ts` | Token refresh error detection + auto-relogin trigger | | `auth/index.ts` | Added `updateRecord()` for token updates | | `cli/cmd/auth.ts` | CLI commands for browser session management | | `server/routes/provider.ts` | API endpoints for browser sessions | | `dialog-settings.tsx` | Desktop UI showing browser session status | | `package.json` | Puppeteer as optional dependency | ## Dependencies Added as **optional dependencies** (only installed when needed): - `puppeteer: ^24.9.0` - `puppeteer-extra: ^3.3.6` - `puppeteer-extra-plugin-stealth: ^2.11.2` ## Testing 1. Run `opencode auth browser setup` and log in 2. Invalidate token manually or wait for expiration 3. Send a message - auto-relogin should trigger automatically 4. Token refreshes seamlessly without user interaction ## Screenshots _(Screenshots to be added by @mguttmann)_
yindo added the pull-request label 2026-02-16 18:17:59 -05:00
yindo closed this issue 2026-02-16 18:17:59 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#13120
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?