feat(opencode): add external browser OAuth for snowflake cortex provider by santigc6 · Pull Request #31700 · anomalyco/opencode

santigc6 · 2026-06-10T14:29:10Z

Issue for this PR

Type of change

Bug fix
New feature
Refactor / code improvement
Documentation

What does this PR do?

As mentioned in the pull request #29901 by @davidfierro and me, I have developed a "/connect" Snowflake cortex provider external-browser OAuth.

It is included:

PKCE + state.
Local loopback callback capture.
Automatic token exchange and storage.

Added support for Snowflake bearer tokens (not only PAT), including:

OAuth access tokens.
JWT.
PAT (compatible with the feat(core): add Snowflake Cortex provider #29901 pull request).

Fixed Snowflake OAuth compatibility issues:

Callback uses loopback root path with dynamic local port.
Valid Snowflake scope handling (refresh_token, optional role scope)

Updated Snowflake provider/runtime handling and docs.

How did you verify your code works?

I have run bun typecheck in packages/opencode after the change.
I have manually e2e validated the "/connect" using the new "Login with Snowflake (External Browser)" in "Snowflake Cortex", confirming all the developed code works as expected and the models are reachable and work.

Screenshots / recordings

Checklist

I have tested my changes locally
I have not included unrelated changes in this PR

github-actions · 2026-06-10T14:30:45Z

Thanks for updating your PR! It now meets our contributing guidelines. 👍

santigc6 · 2026-06-10T16:49:43Z

hi, @kameshsampath, in case you are checking with your team, just wanted you to update that it is already implemented.

kameshsampath · 2026-06-11T05:25:39Z

hi, @kameshsampath, in case you are checking with your team, just wanted you to update that it is already implemented.

thanks for doing this 🙏🏽 . Wondering how that will flow when the user does not have SSO configured instead use https://docs.snowflake.com/en/user-guide/oauth-local-applications if it works that would be awesome. Not sure I have time to check that right away but if I get to know something will share.

santigc6 · 2026-06-11T05:37:04Z

hi, @kameshsampath, in case you are checking with your team, just wanted you to update that it is already implemented.
thanks for doing this 🙏🏽 . Wondering how that will flow when the user does not have SSO configured instead use https://docs.snowflake.com/en/user-guide/oauth-local-applications if it works that would be awesome. Not sure I have time to check that right away but if I get to know something will share.

Hi, thanks for raising that.

Good point on the non-SSO flow using the local OAuth option.

If you get a chance to try it and run into any issues, feel free to share details here. Always happy to take a closer look or help troubleshoot.

Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com>

kameshsampath · 2026-06-11T13:13:14Z

hi, @kameshsampath, in case you are checking with your team, just wanted you to update that it is already implemented.
thanks for doing this 🙏🏽 . Wondering how that will flow when the user does not have SSO configured instead use https://docs.snowflake.com/en/user-guide/oauth-local-applications if it works that would be awesome. Not sure I have time to check that right away but if I get to know something will share.
Hi, thanks for raising that.
Good point on the non-SSO flow using the local OAuth option.
If you get a chance to try it and run into any issues, feel free to share details here. Always happy to take a closer look or help troubleshoot.

Here's the comment to post on PR 31700:

Hi @santigc6 ,

I tested it locally against SNOWFLAKE$LOCAL_APPLICATION and it works perfectly.

I made a docs-only follow-up commit on my fork that I'd like to include in this PR:

What it changes (packages/web/src/content/docs/providers.mdx):

Promotes Browser OAuth as the recommended method (over PAT), matching the DigitalOcean OAuth-first pattern in the docs
Fixes a bug where the account identifier prompt was shown twice (steps 3 and 5 both asked for it)
Adds a note that SNOWFLAKE$LOCAL_APPLICATION is still rolling out with a SQL check and link to the Snowflake OAuth for local applications docs
Clarifies that the SNOWFLAKE_CORTEX_TOKEN env var accepts PAT/JWT only — browser OAuth requires /connect

To pull it in:

# Fetch from my fork
git fetch git@github.com:kameshsampath/opencode.git feat/snowflake-bearer-oauth-auth
# Cherry-pick the single docs commit
git cherry-pick 8807b0e5e

That's one clean commit on top of yours — no conflicts expected since it only touches the Snowflake Cortex section of providers.mdx. Happy to iterate if you'd like any wording changes!

- Restructure Snowflake Cortex section with Browser OAuth as the recommended path and Manual bearer token as the alternative - Fix duplicate account-identifier prompt bug (was shown twice) - Add SNOWFLAKE$LOCAL_APPLICATION availability note with SQL check and link to https://docs.snowflake.com/en/user-guide/oauth-local-applications - Clarify env var slot accepts PAT/JWT only, not browser OAuth flow .... Generated with [Cortex Code](https://docs.snowflake.com/en/user-guide/cortex-code/cortex-code) Co-Authored-By: Cortex Code <noreply@snowflake.com>

santigc6 · 2026-06-11T15:05:13Z

** kameshsampath**

Thanks @kameshsampath! I cherry-picked your commit, tested it locally and pushed it to the PR. Appreciate it so much!

santigc6 · 2026-06-11T15:14:12Z

hi @rekram1-node, I saw that you reviewed @kameshsampath 's [pull request] (#29901) to include snowflake cortex codex provider. Could you please review this one to merge it? Thanks in advance.

sfc-gh-ksampath · 2026-06-11T15:22:22Z

@santigc6 - if possible shall I comment one tiny change to the PR, instead of plain "Paste bearer token manually" does it make sense to call it "Paste PAT or bearer token manually" ?

rekram1-node · 2026-06-11T16:40:16Z

hey yeah ill review this one too ty

Lots of activity here, given there are 2 snowflake employees in this pr chat ill wait till convo is settled before merging

…r token manually'

santigc6 · 2026-06-11T17:04:16Z

@santigc6 - if possible shall I comment one tiny change to the PR, instead of plain "Paste bearer token manually" does it make sense to call it "Paste PAT or bearer token manually" ?

Hi @sfc-gh-ksampath, I have just renamed the "Paste bearer token manually" option to "Paste PAT or bearer token manually" to make it clearer. Appreciate the contribution!

santigc6 · 2026-06-11T17:08:09Z

@kameshsampath @sfc-gh-ksampath thank you very much for the contributions, do you feel we are ready to merge?

kameshsampath · 2026-06-12T01:50:40Z

sorry @rekram1-node and @santigc6 - both the id's kameshsampath (personal) and sfc-gh-ksampath(official) are mine 🤣 . I am all good with the changes.

rekram1-node · 2026-06-12T01:53:22Z

oh lmao haha sounds good!

rekram1-node · 2026-06-12T03:23:52Z

/review

…token source tracking

santigc6 · 2026-06-12T07:40:58Z

hi @rekram1-node, just fixed the comments and validated everything works again. Regarding the test I saw the unit (Windows) test had some failures regarding timeouts that I am not sure are related to this pr. Can you confirm?

… docs (#4) * fix(app): fade overflowing titlebar tabs (anomalyco#32082) * chore: generate * fix(app): expand terminal resize gutter hitbox (anomalyco#32169) * feat(app): bring v2 visibility settings to web (anomalyco#32174) * fix(opencode): recover expired MCP sessions (anomalyco#32088) * chore: update nix node_modules hashes * feat(opencode): add external browser OAuth for snowflake cortex provider (anomalyco#31700) Co-authored-by: santiago.gonzalezcarvajcentenera <santiago.gonzalezcarvajcentenera@colaborador.elcorteingles.es> Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com> Co-authored-by: Kamesh Sampath <kamesh.sampath@hotmail.com> Co-authored-by: Cortex Code <noreply@snowflake.com> * chore: generate * docs(verify): note subtask side-effects; add frontmatter table + http-recorder guidance * feat(core): add opt-in EventV2 event log and decision.recorded event --------- Co-authored-by: Luke Parker <10430890+Hona@users.noreply.github.com> Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com> Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> Co-authored-by: santigc6 <santigc6@users.noreply.github.com> Co-authored-by: santiago.gonzalezcarvajcentenera <santiago.gonzalezcarvajcentenera@colaborador.elcorteingles.es> Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com> Co-authored-by: Kamesh Sampath <kamesh.sampath@hotmail.com> Co-authored-by: Cortex Code <noreply@snowflake.com> Co-authored-by: Claude <noreply@anthropic.com>

…der (anomalyco#31700) Co-authored-by: santiago.gonzalezcarvajcentenera <santiago.gonzalezcarvajcentenera@colaborador.elcorteingles.es> Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com> Co-authored-by: Kamesh Sampath <kamesh.sampath@hotmail.com> Co-authored-by: Cortex Code <noreply@snowflake.com>

…der (#31700) Co-authored-by: santiago.gonzalezcarvajcentenera <santiago.gonzalezcarvajcentenera@colaborador.elcorteingles.es> Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com> Co-authored-by: Kamesh Sampath <kamesh.sampath@hotmail.com> Co-authored-by: Cortex Code <noreply@snowflake.com>

…der (anomalyco#31700) Co-authored-by: santiago.gonzalezcarvajcentenera <santiago.gonzalezcarvajcentenera@colaborador.elcorteingles.es> Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com> Co-authored-by: Kamesh Sampath <kamesh.sampath@hotmail.com> Co-authored-by: Cortex Code <noreply@snowflake.com>

github-actionsBot added needs:compliance This means the issue will auto-close after 2 hours. and removed needs:compliance This means the issue will auto-close after 2 hours. labels Jun 10, 2026

github-actionsBot mentioned this pull request Jun 10, 2026
feat(opencode): add Snowflake Cortex SSO (external browser) authentication #31703
Closed
3 tasks

santigc6 force-pushed the feat/snowflake-bearer-oauth-auth branch 3 times, most recently from 4341ac8 to 2426390Compare June 10, 2026 18:51

feat(opencode): add Snowflake bearer OAuth support with refresh handling
7902c83
Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com>

santigc6 force-pushed the feat/snowflake-bearer-oauth-auth branch from 6b4986e to 7902c83Compare June 11, 2026 05:47

refactor: rename 'Paste bearer token manually' to 'Paste PAT or beare…
303c01a
…r token manually'

github-actionsBot reviewed Jun 12, 2026
View reviewed changes

Comment threadpackages/opencode/src/plugin/snowflake-cortex.ts

github-actionsBot reviewed Jun 12, 2026
View reviewed changes

Comment threadpackages/opencode/src/plugin/snowflake-cortex.ts

github-actionsBot reviewed Jun 12, 2026
View reviewed changes

Comment threadpackages/opencode/src/provider/provider.ts

This was referenced Jun 12, 2026
📊 AI CLI 工具社区动态日报 2026-06-12 litang9/big_model_radar#50
Open
📊 AI CLI 工具社区动态日报 2026-06-12 hehongtao88/big_model_radar#16
Open

fix: address PR review comments - trim account, CSRF guard ordering, …
fa3a583
…token source tracking

rekram1-node merged commit 3f17453 into anomalyco:devJun 13, 2026
8 checks passed

Uh oh!

Conversation

santigc6 commented Jun 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue for this PR

Type of change

What does this PR do?

How did you verify your code works?

Screenshots / recordings

Checklist

Uh oh!

github-actionsBot commented Jun 10, 2026

Uh oh!

santigc6 commented Jun 10, 2026

Uh oh!

kameshsampath commented Jun 11, 2026

Uh oh!

santigc6 commented Jun 11, 2026

Uh oh!

kameshsampath commented Jun 11, 2026

Uh oh!

santigc6 commented Jun 11, 2026

Uh oh!

santigc6 commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sfc-gh-ksampath commented Jun 11, 2026

Uh oh!

rekram1-node commented Jun 11, 2026

Uh oh!

santigc6 commented Jun 11, 2026

Uh oh!

santigc6 commented Jun 11, 2026

Uh oh!

kameshsampath commented Jun 12, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rekram1-node commented Jun 12, 2026

Uh oh!

rekram1-node commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

santigc6 commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

santigc6 commented Jun 10, 2026•
edited
Loading

santigc6 commented Jun 11, 2026•
edited
Loading

kameshsampath commented Jun 12, 2026•
edited
Loading