fix(auth): opencode desktop server unauthorized bugfix on subagent spawn (#1399)

* fix(auth): opencode desktop server unauthorized bugfix on subagent spawn * refactor(auth): add runtime guard and throw on SDK mismatch - Add JSDoc with SDK API documentation reference - Replace silent failure with explicit Error throw when OPENCODE_SERVER_PASSWORD is set but client structure is incompatible - Add runtime type guard for SDK client structure - Add tests for error cases (missing _client, missing setConfig) - Remove unrelated bun.lock changes Co-authored-by: dan-myles <dan-myles@users.noreply.github.com> --------- Co-authored-by: YeonGyu-Kim <code.yeon.gyu@gmail.com> Co-authored-by: dan-myles <dan-myles@users.noreply.github.com>
2026-02-03 20:07:02 -06:00
parent 6151d1cb5e
commit 2f9004f076
4 changed files with 163 additions and 0 deletions
@@ -0,0 +1,65 @@
+/**
+ * Builds HTTP Basic Auth header from environment variables.
+ *
+ * @returns Basic Auth header string, or undefined if OPENCODE_SERVER_PASSWORD is not set
+ */
+export function getServerBasicAuthHeader(): string | undefined {
+  const password = process.env.OPENCODE_SERVER_PASSWORD
+  if (!password) {
+    return undefined
+  }
+
+  const username = process.env.OPENCODE_SERVER_USERNAME ?? "opencode"
+  const token = Buffer.from(`${username}:${password}`, "utf8").toString("base64")
+
+  return `Basic ${token}`
+}
+
+/**
+ * Injects HTTP Basic Auth header into the OpenCode SDK client.
+ *
+ * This function accesses the SDK's internal `_client.setConfig()` method.
+ * While `_client` has an underscore prefix (suggesting internal use), this is actually
+ * a stable public API from `@hey-api/openapi-ts` generated client:
+ * - `setConfig()` MERGES headers (does not replace existing ones)
+ * - This is the documented way to update client config at runtime
+ *
+ * @see https://github.com/sst/opencode/blob/main/packages/sdk/js/src/gen/client/client.gen.ts
+ * @throws {Error} If OPENCODE_SERVER_PASSWORD is set but client structure is incompatible
+ */
+export function injectServerAuthIntoClient(client: unknown): void {
+  const auth = getServerBasicAuthHeader()
+  if (!auth) {
+    return
+  }
+
+  // Runtime type guard for SDK client structure
+  if (
+    typeof client !== "object" ||
+    client === null ||
+    !("_client" in client) ||
+    typeof (client as { _client: unknown })._client !== "object" ||
+    (client as { _client: unknown })._client === null
+  ) {
+    throw new Error(
+      "[opencode-server-auth] OPENCODE_SERVER_PASSWORD is set but SDK client structure is incompatible. " +
+        "This may indicate an OpenCode SDK version mismatch."
+    )
+  }
+
+  const internal = (client as { _client: { setConfig?: (config: { headers: Record<string, string> }) => void } })
+    ._client
+
+  if (typeof internal.setConfig !== "function") {
+    throw new Error(
+      "[opencode-server-auth] OPENCODE_SERVER_PASSWORD is set but SDK client._client.setConfig is not a function. " +
+        "This may indicate an OpenCode SDK version mismatch."
+    )
+  }
+
+  internal.setConfig({
+    headers: {
+      Authorization: auth,
+    },
+  })
+}