anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-21 17:56:33 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #13850] fix: bump GitLab provider and auth plugin for mid-session token refresh #14843

New Issue
Closed
opened 2026-02-16 18:19:35 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:19:35 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/13850

State: closed
Merged: Yes

Summary

Bumps GitLab packages to pick up the fix for OAuth token expiry during mid-session usage:

  • @gitlab/gitlab-ai-provider: 3.5.0 → 3.5.1
  • @gitlab/opencode-gitlab-auth: 1.3.3 → 1.3.3

Problem

When a GitLab OAuth token expires mid-session (after 2 hours), the AI provider attempts to refresh it. Three bugs prevented this from working:

  1. Stale closure: refreshApiKey() re-used the original options.apiKey from the closure, bypassing the refresh logic entirely
  2. auth.json key mismatch: The provider wrote refreshed tokens under the URL key (https://gitlab.com) while the auth plugin reads from the gitlab key
  3. Client ID mismatch: The provider used the VS Code extension's OAuth client ID for refresh, but GitLab requires the same client ID that created the original token

Fix

@gitlab/gitlab-ai-provider@3.5.1 (provider-side):

  • refreshApiKey() now passes apiKey: undefined to bypass the stale closure
  • loadApiKey() writes refreshed tokens to authData.gitlab with enterpriseUrl (matching the auth plugin's format)
  • Uses OPENCODE_GITLAB_AUTH_CLIENT_ID for token refresh (matching the auth plugin's client ID)
  • writeFileSync uses { mode: 0o600 } for auth.json

@gitlab/opencode-gitlab-auth@1.3.3 (auth plugin-side):

  • loader() now returns clientId alongside apiKey and instanceUrl, so the provider can use the correct OAuth client ID for mid-session refresh

Related: https://github.com/sst/opencode/issues/9711

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/13850 **State:** closed **Merged:** Yes --- ## Summary Bumps GitLab packages to pick up the fix for OAuth token expiry during mid-session usage: - `@gitlab/gitlab-ai-provider`: 3.5.0 → 3.5.1 - `@gitlab/opencode-gitlab-auth`: 1.3.3 → 1.3.3 ## Problem When a GitLab OAuth token expires mid-session (after 2 hours), the AI provider attempts to refresh it. Three bugs prevented this from working: 1. **Stale closure**: `refreshApiKey()` re-used the original `options.apiKey` from the closure, bypassing the refresh logic entirely 2. **auth.json key mismatch**: The provider wrote refreshed tokens under the URL key (`https://gitlab.com`) while the auth plugin reads from the `gitlab` key 3. **Client ID mismatch**: The provider used the VS Code extension's OAuth client ID for refresh, but GitLab requires the same client ID that created the original token ## Fix **`@gitlab/gitlab-ai-provider@3.5.1`** (provider-side): - `refreshApiKey()` now passes `apiKey: undefined` to bypass the stale closure - `loadApiKey()` writes refreshed tokens to `authData.gitlab` with `enterpriseUrl` (matching the auth plugin's format) - Uses `OPENCODE_GITLAB_AUTH_CLIENT_ID` for token refresh (matching the auth plugin's client ID) - `writeFileSync` uses `{ mode: 0o600 }` for auth.json **`@gitlab/opencode-gitlab-auth@1.3.3`** (auth plugin-side): - `loader()` now returns `clientId` alongside `apiKey` and `instanceUrl`, so the provider can use the correct OAuth client ID for mid-session refresh Related: https://github.com/sst/opencode/issues/9711
yindo added the pull-request label 2026-02-16 18:19:35 -05:00
yindo closed this issue 2026-02-16 18:19:35 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#14843
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?