gitlab-ai-provider 6.9.1 → 6.9.3

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file. See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## <small>6.9.3 (2026-06-11)</small>
+
+- Merge branch 'fix/concurrent-auth-token-race' into 'main' ([7306083](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/7306083))
+- fix(auth): prevent concurrent auth failures from token races ([49ed5c7](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/49ed5c7))
+
+## <small>6.9.2 (2026-06-10)</small>
+
+- Merge branch 'fix/auth-json-api-token-handling' into 'main' ([19a6e58](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/19a6e58))
+- fix(auth): use PAT and enterpriseUrl-less OAuth tokens from auth.json ([6feeb58](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/6feeb58))
+
 ## <small>6.9.1 (2026-06-10)</small>
 
 - Merge branch 'fix-security-review-hardening' into 'main' ([81e627b](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/81e627b))

package/dist/index.d.mts

@@ -6,6 +6,11 @@ interface GitLabAnthropicConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    /**
+     * Optional async hook that resolves once credentials are loaded, awaited
+     * before the synchronous getHeaders() is used for the direct-access request.
+     */
+    ensureApiKey?: () => Promise<void>;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.
      * Should clear cached credentials and re-fetch from auth provider.
@@ -1073,6 +1078,7 @@ interface GitLabOpenAIConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    ensureApiKey?: () => Promise<void>;
     refreshApiKey?: () => Promise<void>;
     openaiModel?: string;
     maxTokens?: number;
@@ -1431,6 +1437,14 @@ declare const DEFAULT_AI_GATEWAY_URL = "https://cloud.gitlab.com";
 interface GitLabDirectAccessConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
+    /**
+     * Optional async hook that resolves once credentials are loaded.
+     * `getHeaders` is synchronous, but the API key is loaded asynchronously; the
+     * client awaits this before building request headers so the first request on
+     * a cold provider doesn't race the lazy key load (which would otherwise throw
+     * "API key is missing" or send an empty Authorization header).
+     */
+    ensureApiKey?: () => Promise<void>;
     fetch?: typeof fetch;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.

package/dist/index.d.ts

@@ -6,6 +6,11 @@ interface GitLabAnthropicConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    /**
+     * Optional async hook that resolves once credentials are loaded, awaited
+     * before the synchronous getHeaders() is used for the direct-access request.
+     */
+    ensureApiKey?: () => Promise<void>;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.
      * Should clear cached credentials and re-fetch from auth provider.
@@ -1073,6 +1078,7 @@ interface GitLabOpenAIConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    ensureApiKey?: () => Promise<void>;
     refreshApiKey?: () => Promise<void>;
     openaiModel?: string;
     maxTokens?: number;
@@ -1431,6 +1437,14 @@ declare const DEFAULT_AI_GATEWAY_URL = "https://cloud.gitlab.com";
 interface GitLabDirectAccessConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
+    /**
+     * Optional async hook that resolves once credentials are loaded.
+     * `getHeaders` is synchronous, but the API key is loaded asynchronously; the
+     * client awaits this before building request headers so the first request on
+     * a cold provider doesn't race the lazy key load (which would otherwise throw
+     * "API key is missing" or send an empty Authorization header).
+     */
+    ensureApiKey?: () => Promise<void>;
     fetch?: typeof fetch;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.

package/dist/index.js

@@ -727,6 +727,9 @@ var GitLabDirectAccessClient = class {
     if (this.config.featureFlags && Object.keys(this.config.featureFlags).length > 0) {
       requestBody.feature_flags = this.config.featureFlags;
     }
+    if (this.config.ensureApiKey) {
+      await this.config.ensureApiKey();
+    }
     try {
       const response = await this.fetchFn(url, {
         method: "POST",
@@ -822,6 +825,7 @@ var GitLabAnthropicLanguageModel = class {
     this.directAccessClient = new GitLabDirectAccessClient({
       instanceUrl: config.instanceUrl,
       getHeaders: config.getHeaders,
+      ensureApiKey: config.ensureApiKey,
       refreshApiKey: config.refreshApiKey,
       fetch: config.fetch,
       featureFlags: config.featureFlags,
@@ -1555,6 +1559,7 @@ var GitLabOpenAILanguageModel = class {
     this.directAccessClient = new GitLabDirectAccessClient({
       instanceUrl: config.instanceUrl,
       getHeaders: config.getHeaders,
+      ensureApiKey: config.ensureApiKey,
       refreshApiKey: config.refreshApiKey,
       fetch: config.fetch,
       featureFlags: config.featureFlags,
@@ -2496,7 +2501,7 @@ var import_node_async_hooks = require("async_hooks");
 var import_isomorphic_ws = __toESM(require("isomorphic-ws"));
 
 // src/version.ts
-var VERSION = true ? "6.9.0" : "0.0.0-dev";
+var VERSION = true ? "6.9.2" : "0.0.0-dev";
 
 // src/gitlab-workflow-client.ts
 var WS_CONNECT_TIMEOUT_MS = 3e4;
@@ -4833,9 +4838,10 @@ var TOKEN_EXPIRY_SKEW_MS = 5 * 60 * 1e3;
 var OAUTH_SCOPES = ["api"];
 
 // src/gitlab-oauth-manager.ts
+var globalInFlightRefreshes = /* @__PURE__ */ new Map();
 var GitLabOAuthManager = class {
   fetch;
-  inFlightRefreshes = /* @__PURE__ */ new Map();
+  inFlightRefreshes = globalInFlightRefreshes;
   constructor(fetchImpl = fetch) {
     this.fetch = fetchImpl;
   }
@@ -5048,12 +5054,15 @@ async function loadOpenCodeAuth(instanceUrl) {
     }
     const authData = JSON.parse(fs3.readFileSync(authPath, "utf-8"));
     const normalizedUrl = instanceUrl.replace(/\/$/, "");
-    if (authData.gitlab?.type === "oauth") {
-      const gitlabAuth = authData.gitlab;
-      const normalizedEnterpriseUrl = typeof gitlabAuth.enterpriseUrl === "string" ? gitlabAuth.enterpriseUrl.replace(/\/$/, "") : gitlabAuth.enterpriseUrl;
-      if (normalizedEnterpriseUrl === normalizedUrl) {
+    const gitlabAuth = authData.gitlab;
+    if (gitlabAuth?.type === "oauth") {
+      const normalizedEnterpriseUrl = typeof gitlabAuth.enterpriseUrl === "string" ? gitlabAuth.enterpriseUrl.replace(/\/$/, "") : void 0;
+      const matchesInstance = normalizedEnterpriseUrl === normalizedUrl || normalizedEnterpriseUrl === void 0 && normalizedUrl === GITLAB_COM_URL;
+      if (matchesInstance) {
         return gitlabAuth;
       }
+    } else if (gitlabAuth?.type === "api" && typeof gitlabAuth.key === "string") {
+      return gitlabAuth;
     }
     const auth = authData[normalizedUrl] || authData[`${normalizedUrl}/`];
     return auth;
@@ -5061,32 +5070,52 @@ async function loadOpenCodeAuth(instanceUrl) {
     return void 0;
   }
 }
+var inFlightOAuthRefreshes = /* @__PURE__ */ new Map();
+async function refreshOAuthToken(auth, instanceUrl, clientId) {
+  const existing = inFlightOAuthRefreshes.get(instanceUrl);
+  if (existing) {
+    return existing;
+  }
+  const refreshPromise = (async () => {
+    const oauthManager = new GitLabOAuthManager();
+    const refreshed = await oauthManager.exchangeRefreshToken({
+      instanceUrl,
+      refreshToken: auth.refresh,
+      clientId
+    });
+    const authPath = getOpenCodeAuthPath();
+    const authData = JSON.parse(fs3.readFileSync(authPath, "utf-8"));
+    authData.gitlab = {
+      type: "oauth",
+      refresh: refreshed.refreshToken,
+      access: refreshed.accessToken,
+      expires: refreshed.expiresAt,
+      enterpriseUrl: instanceUrl
+      // Use enterpriseUrl to match auth plugin format
+    };
+    fs3.writeFileSync(authPath, JSON.stringify(authData, null, 2), { mode: 384 });
+    return refreshed.accessToken;
+  })();
+  inFlightOAuthRefreshes.set(instanceUrl, refreshPromise);
+  try {
+    return await refreshPromise;
+  } finally {
+    inFlightOAuthRefreshes.delete(instanceUrl);
+  }
+}
 async function loadApiKey(options, instanceUrl, clientId) {
   if (options.apiKey) {
     return options.apiKey;
   }
   const auth = await loadOpenCodeAuth(instanceUrl);
+  if (auth?.type === "api") {
+    return auth.key;
+  }
   if (auth?.type === "oauth") {
     const oauthManager = new GitLabOAuthManager();
     if (oauthManager.needsRefresh(auth.expires)) {
       try {
-        const refreshed = await oauthManager.exchangeRefreshToken({
-          instanceUrl,
-          refreshToken: auth.refresh,
-          clientId
-        });
-        const authPath = getOpenCodeAuthPath();
-        const authData = JSON.parse(fs3.readFileSync(authPath, "utf-8"));
-        authData.gitlab = {
-          type: "oauth",
-          refresh: refreshed.refreshToken,
-          access: refreshed.accessToken,
-          expires: refreshed.expiresAt,
-          enterpriseUrl: instanceUrl
-          // Use enterpriseUrl to match auth plugin format
-        };
-        fs3.writeFileSync(authPath, JSON.stringify(authData, null, 2), { mode: 384 });
-        return refreshed.accessToken;
+        return await refreshOAuthToken(auth, instanceUrl, clientId);
       } catch (error) {
         const refreshErrorMsg = error instanceof Error ? error.message : String(error);
         const envApiKey = process.env[options.environmentVariableName];
@@ -5185,6 +5214,12 @@ function createGitLab(options = {}) {
       `ai-sdk-gitlab/${VERSION}`
     );
   };
+  const ensureApiKey = async () => {
+    try {
+      await getApiKey();
+    } catch {
+    }
+  };
   getApiKey().catch(() => {
   });
   const createAgenticChatModel = (modelId, agenticOptions) => {
@@ -5219,6 +5254,7 @@ function createGitLab(options = {}) {
       provider: `${providerName}.agentic`,
       instanceUrl,
       getHeaders,
+      ensureApiKey,
       refreshApiKey,
       fetch: options.fetch,
       maxTokens: agenticOptions?.maxTokens,