Repository navigation
fix(auth): cherry-pick upstream OpenCode password and pairing-code fixes - #342
Merged
Merged
Conversation
…tgg#25230) Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com> Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com> (cherry picked from commit d796063)
) Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com> (cherry picked from commit 7860ee9) Co-authored-by: shuv <shuv1337@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Two upstream auth fixes are missing on fork main (
165d40279). OpenCode sessions ignore the resolved server password, so a configured password never reaches the SDK client. MCP approval also spends a pairing code before the scope check, so a scope rejection burns a code that should still be usable at a lower access level.Change
Cherry-picks onto fork main, in order, with
-x:d796063f78a96c8816196fac3fa5660bebdd99a9— OpenCode authenticates with the resolved server password. Passessettings.serverPasswordinto server connect and usesconnection.serverPasswordon the SDK client.7860ee983d81d287eaf15664ffd92dc6964d92cc— keep pairing codes after a scope rejection.requiredScopesis checked inside the consume UPDATE (and the in-memory grant path), so a rejected code stays unspent.EnvironmentAuth.tsconflicted and was hand-resolved. Fork behavior stays:purpose: "watch"on bootstrap consume, andBootstrapCredentialScopeNotGrantedErrorstill maps toServerAuthScopeNotGrantedError. Upstream's change is added on top:requiredScopesonresolveBootstrapGrant, the reusable-dev-token scope filter,consumeMcpApprovalCodepassingrequiredScopes: mcpClientScopes(access)before the grant is spent, and the updated insufficient-scope message. The post-consume scope check that burned the code is removed.No workflow, release, or desktop update-channel files.
Scope and approval
Phase A only. Lauren approved opening this PR. Do not merge. A full upstream sync is out of scope.
Verification
vp run --filter t3 --filter @t3tools/provider-opencode typecheck— both packages succeeded.vp test run packages/provider-opencode/src/server/adapter.test.ts— 1 file, 35 tests passed, includingopens an authenticated OpenCode sessionfor external and managed servers.vp test run apps/server/src/auth— 14 files, 96 tests passed, includingpreserves a rejected MCP pairing code for exactly one concurrent lower-access retryand the MCP OAuth case that reuses a read-only code after a full-access rejection.Manual checks not run in this environment:
orchestration:read. Approve an MCP client at full access. It should fail with insufficient scope and say the code has not been used. Approve the same code as read-only. That should succeed once; a second use should fail as unknown or already used.OPENCODE_SERVER_PASSWORDfor a managed server). Opening a session should sendAuthorization: Basicfor useropencodeand that password, including when the server URL is external.Grok 4.7, Cursor cloud agent.