Repository navigation
fix: apply OAuth transforms to stateless generation - #288
peeyush-ciridae wants to merge 1 commit into
Conversation
🦋 Changeset detectedLatest commit: 042534f The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WalkthroughThe plugin now reuses its session HTTP request and response transforms for stateless generation when Priority: ➖ Normal Estimated code review effort: Merge Risk: 🔵 Low · up to Other providers incur unnecessary request-processing overhead. The change is mergeable with owner awareness, though scoping both hooks before merge would avoid that overhead. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to Credential and destination checks are preserved, but independent stateless requests can share recovery state. Host-side request processing and cleanup after registration failure remain unverified. Retained concerns
Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (2 skipped: 2 unsupported.)
Comment |
 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Repository YAML (base), Organization UI (inherited)
- Review profile: CHILL
- Plan: Advanced
- Run ID:
677d0865-2c5f-4689-b57b-263dea363e8a
📒 Files selected for processing (4)
.changeset/stateless-oauth-hooks.mdREADME.mdsrc/index.tssrc/tests/index.test.ts
Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.
| await generateHook.call( | ||
| ctx.generate, | ||
| 'http.request', | ||
| transformHttpRequest, |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win
Scope both generation hooks to Anthropic.
When another native provider generates text, these unscoped registrations make OpenCode enter its HTTP hook path even though transformHttpRequest and transformHttpResponse return for that provider. The host converts the request and buffers its body in that path. Pass { providerID: INTEGRATION_ID } to both generateHook.call registrations so other providers keep the no-hook path. (github.com)
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| response: new Response('data: {"type":"message_stop"}\n\n', { | ||
| headers: { 'content-type': 'text/event-stream' }, | ||
| }), | ||
| } | ||
| await hooks.get('http.response')!(response) | ||
| expect(await response.response.text()).toBe( | ||
| 'data: {"type":"message_stop"}\n\n', |
There was a problem hiding this comment.
The new stateless test passes even if the response callback does nothing: its message_stop body stays unchanged either way. This leaves tool-name restoration untested on the new path. Add a tool to the request, return its rewritten name in a tool_use response, and assert that the callback restores the original name.
Knowledge Base Used: Request transformation
Problem
Haiku 5.5 succeeds in OpenCode sessions but fails through stateless
ctx.generate.textbecause that path skips the session HTTP hooks. With the same OAuth token and prompt, the untransformed provider request returned 429Error; the transformed request returned 200. Haiku 4.5 accepted both.Change
Reuse the existing request and response transforms for generation HTTP hooks when the host exposes them. Retain compatibility with older V2 hosts and keep session recovery keys unchanged. No credentials or provider-specific guards are weakened.
Requires OpenCode's hook API in anomalyco/opencode#53990 for stateless support. This plugin change is safe to release before that API: older hosts keep their existing session behavior.
Verification
bun run check: build, types, lint, formatting, and all 440 tests passed./api/experimental/generatereturnedOKfor Haiku 5.5 and Haiku 4.5 using OAuth. Installed configuration unchanged.