feat(auth): Auto-Relogin via Persistent Browser Sessions #9455
+5,572
−169
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Non-network errors seen in logs: - AI_APICallError (402 deactivated_workspace) - AI_APICallError (500 server_error) - AI_LoadAPIKeyError / OpenAI API key is missing - ProviderInitError - ConfigInvalidError - ProviderAuthOauthCallbackFailed - NotFoundError - EditBuffer is destroyed
- Add getUsage() to fetch OAuth account status and health - Add fetchAnthropicUsage() to fetch Claude Max rate limits from Anthropic API - Add GET /auth/usage endpoint to expose usage data
- Add DialogAuthUsage component with rate limit visualization - Display Anthropic 5-hour and 7-day limits with progress bars - Show OAuth account status, cooldown state, and request counts - Add button in sidebar to open the dialog
- Add AuthUsageCommand to display rate limit info in terminal - Show account status, cooldown state, and request counts - Display Anthropic rate limits when available
The AI SDK's convertToModelMessages() does not accept 'step-start' as a valid UIMessagePart type. This caused AI_InvalidPromptError during session compaction. - Remove step-start from being added to UIMessage parts - Simplify the filter since step-start is no longer included - Fixes compaction breaking sessions with context overflow
## Summary Implements comprehensive multi-account OAuth support with automatic rate limit rotation, manual account switching, and a new Settings menu for the desktop app. ## Features ### Multi-Account OAuth Rotation (Backend) - Add `Auth.OAuthPool.setActive()` to manually switch active OAuth account - Add `Auth.OAuthPool.snapshot()` returns `activeID` for credential selection - Update `rotating-fetch.ts` to prefer `activeID` while keeping auto-rotation - Update `fetchAnthropicUsage()` to respect `provider.active[namespace]` - Update `getAccounts()` to correctly identify active account ### API Endpoints - Add `POST /auth/active` endpoint to switch active OAuth account - Returns updated `anthropicUsage` for immediate UI updates ### Desktop App - Settings Menu - New `DialogSettings` component with tabbed interface - **Providers Tab**: View connected providers, add new providers with search - **Provider Detail View**: Account list, usage stats, switch functionality - **About Tab**: GitHub, docs, Discord links, keyboard shortcuts - Inline provider search without leaving settings context ### Desktop App - Context Panel - Add Anthropic Rate Limits section in session context panel - Shows 5-hour, weekly (all models), weekly (sonnet) usage bars - Account switch buttons when multiple accounts configured - Only visible when current session uses Anthropic provider ### CLI Enhancements - `opencode auth usage`: Shows individual usage per OAuth account - `opencode auth switch`: Interactive command to switch active account - `opencode auth list`: Shows account count per provider - All provider lists now sorted alphabetically ## Technical Details ### Files Changed - `packages/opencode/src/auth/index.ts`: Core OAuth pool functions - `packages/opencode/src/auth/rotating-fetch.ts`: Credential selection - `packages/opencode/src/server/server.ts`: API endpoint - `packages/opencode/src/cli/cmd/auth.ts`: CLI commands - `packages/app/src/components/dialog-settings.tsx`: New settings UI - `packages/app/src/components/session/session-context-tab.tsx`: Context panel - `packages/app/src/pages/layout.tsx`: Settings button integration ### Auto-Rotation Flow 1. Request uses `activeID` (manually selected or first available) 2. On 429 rate limit → account gets cooldown, moved to back 3. Next request automatically uses next available account 4. Manual switch via UI/CLI updates `provider.active[namespace]` ### Anthropic Usage Stats Currently only Anthropic provides OAuth usage statistics. Other providers show multi-account switching but no usage bars. Contributions welcome for additional provider support.
- Add Auth.OAuthPool.removeRecord() to remove individual OAuth accounts - Add DELETE /auth/account API endpoint for Desktop app - Update CLI 'opencode auth logout' to select specific accounts - Add delete button with confirmation in Desktop Provider settings
…okens - Add browser.ts with Puppeteer-based browser session management - Auto-install puppeteer + stealth plugin to bypass Cloudflare - Store browser profiles per-account for isolated cookie sessions - Detect 'Token refresh failed: 400' errors in rotating-fetch.ts - Auto-click 'Authorize' button on consent screen (headless) - Support both console.anthropic.com and platform.claude.com callbacks - Add CLI commands: opencode auth browser setup/status/remove - Add browser session status to desktop settings UI - Add updateRecord function to OAuthPool for token updates - Add API endpoints for browser session management
8 tasks
Contributor
|
The following comment was made by an LLM, it may be inaccurate: No duplicate PRs found |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Automatically refresh expired Anthropic OAuth tokens using persistent browser sessions with Puppeteer + Stealth plugin. This eliminates the need for manual re-authentication when tokens expire overnight.
Closes #9360
Problem
When using Anthropic OAuth (Claude Max subscription), tokens expire after a few hours. The refresh token also expires, causing "Token refresh failed: 400" errors. Users had to manually run
opencode authagain each morning.Solution
This PR adds automatic re-login via headless browser sessions:
opencode auth browser setupwhich opens a browser windowFeatures
CLI Commands
opencode auth browser setup- Configure browser session for an accountopencode auth browser status- Show status of all browser sessionsopencode auth browser remove- Remove a browser sessionTechnical Implementation
puppeteer-extra-plugin-stealthto bypass Cloudflare bot detectionconsole.anthropic.comandplatform.claude.comOAuth callbacksError Handling
rotating-fetch.tsFiles Changed
auth/browser.tsauth/rotating-fetch.tsauth/index.tsupdateRecord()for token updatescli/cmd/auth.tsserver/routes/provider.tsdialog-settings.tsxpackage.jsonDependencies
Added as optional dependencies (only installed when needed):
puppeteer: ^24.9.0puppeteer-extra: ^3.3.6puppeteer-extra-plugin-stealth: ^2.11.2Testing
opencode auth browser setupand log inScreenshots
(Screenshots to be added by @mguttmann)