feat(configure): store CoDev Code's gateway key in the agent's auth store - #257
Merged
Conversation
…tore
configureOpenCodeKind wrote the gateway API key inline as
provider.<id>.options.apiKey in ~/.config/codev/codev.json, where it is
trivially copied into other tools. For the codev-code kind the key now
goes into the agent's own credential store
(~/.local/share/codev/auth.json, XDG_DATA_HOME-aware, 0600, atomic
staged write) as { "<provider id>": { type: "api", key } } — the agent's
provider registry merges it back in by id — and the provider block stays
keyless. The credential is written before the config so a failure aborts
rather than leaving a keyless config that 401s. Legacy OpenCode keeps
its inline key: it is being retired and its auth store lives under an
app dir this hub does not manage.
Read-merge-write preserves entries for providers the user connected
inside the agent themselves, and the key auto-refresh (refresh.ts)
rotates the entry in place through the same writer. `codevhub remove`
gains a credential-scrub step that drops only the CoDev-owned ids
(codevProviderIds) from the store, best-effort like the CodeGraph step.
Pairs with codev-code #285, whose startup migration scrubs inline keys
this hub's older releases wrote; version skew is safe in both
directions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Phase 4 of the keyless-gateway-config work (pairs with quickbeard/codev-code#285): the hub stops writing the gateway API key inline into
~/.config/codev/codev.json.configureOpenCodeKind(codev-code kind only): the key now lands in CoDev Code's own credential store —~/.local/share/codev/auth.json(XDG_DATA_HOME-aware), written as{ "<provider id>": { type: "api", key } }with an atomic staged write at 0600 — and theprovider.<id>block is written keyless; the agent's provider registry merges the credential back in by id. The credential write happens before the config write, so a failure aborts instead of leaving a keyless config that 401s on the first chat.refresh.ts→configureCodevCode) rotates the entry in place through the same writer — no change needed there.codevhub removegains a CoDev Code credential scrub step: drops only the CoDev-owned ids (codevProviderIds()— netgate, ai-gateway, legacy aigateway, plus the saved manual-provider id) from the store, leaving user-connected providers. Best-effort (▲ warning on failure), and ordered before the~/.codev-hubwipe so the saved provider id still resolves.Why
Users copy the key straight out of
codev.jsoninto other tools, loading the gateway with non-CoDev traffic. Keeping the credential out of the file people open, copy, and paste into bug reports removes the casual path, and makes key rotation config-free.Version skew
Safe both ways: the registry merge is long-standing agent behavior, so a keyless config + auth entry works on any CoDev Code version; a config written by an older hub still carries an inline key, which codev-code#285's startup migration moves into the auth store on the next launch.
Testing
pnpm fix,pnpm typecheckcleanpnpm test: 76 files, 1431 passed (updated the four tests that pinned the inline key; new describes for the auth-store writer and the remove scrub)pnpm build && node dist/index.js --versionsmoke-tested🤖 Generated with Claude Code