gitlab-ai-provider 6.9.2 → 6.10.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project will be documented in this file. See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 6.10.0 (2026-07-01)
+
+- Merge branch 'feature-add-claude-sonnet-5' into 'main' ([5294b5e](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/5294b5e))
+- feat(models): add Claude Sonnet 5 model mappings ([85976b4](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/85976b4))
+- chore(skill): add add-gitlab-model skill to automate model onboarding ([6bbfc4d](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/6bbfc4d))
+
+## <small>6.9.3 (2026-06-11)</small>
+
+- Merge branch 'fix/concurrent-auth-token-race' into 'main' ([7306083](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/7306083))
+- fix(auth): prevent concurrent auth failures from token races ([49ed5c7](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/49ed5c7))
+
 ## <small>6.9.2 (2026-06-10)</small>
 
 - Merge branch 'fix/auth-json-api-token-handling' into 'main' ([19a6e58](https://gitlab.com/vglafirov/gitlab-ai-provider/commit/19a6e58))

package/dist/index.d.mts

@@ -6,6 +6,11 @@ interface GitLabAnthropicConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    /**
+     * Optional async hook that resolves once credentials are loaded, awaited
+     * before the synchronous getHeaders() is used for the direct-access request.
+     */
+    ensureApiKey?: () => Promise<void>;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.
      * Should clear cached credentials and re-fetch from auth provider.
@@ -1073,6 +1078,7 @@ interface GitLabOpenAIConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    ensureApiKey?: () => Promise<void>;
     refreshApiKey?: () => Promise<void>;
     openaiModel?: string;
     maxTokens?: number;
@@ -1431,6 +1437,14 @@ declare const DEFAULT_AI_GATEWAY_URL = "https://cloud.gitlab.com";
 interface GitLabDirectAccessConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
+    /**
+     * Optional async hook that resolves once credentials are loaded.
+     * `getHeaders` is synchronous, but the API key is loaded asynchronously; the
+     * client awaits this before building request headers so the first request on
+     * a cold provider doesn't race the lazy key load (which would otherwise throw
+     * "API key is missing" or send an empty Authorization header).
+     */
+    ensureApiKey?: () => Promise<void>;
     fetch?: typeof fetch;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.

package/dist/index.d.ts

@@ -6,6 +6,11 @@ interface GitLabAnthropicConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    /**
+     * Optional async hook that resolves once credentials are loaded, awaited
+     * before the synchronous getHeaders() is used for the direct-access request.
+     */
+    ensureApiKey?: () => Promise<void>;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.
      * Should clear cached credentials and re-fetch from auth provider.
@@ -1073,6 +1078,7 @@ interface GitLabOpenAIConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
     fetch?: typeof fetch;
+    ensureApiKey?: () => Promise<void>;
     refreshApiKey?: () => Promise<void>;
     openaiModel?: string;
     maxTokens?: number;
@@ -1431,6 +1437,14 @@ declare const DEFAULT_AI_GATEWAY_URL = "https://cloud.gitlab.com";
 interface GitLabDirectAccessConfig {
     instanceUrl: string;
     getHeaders: () => Record<string, string>;
+    /**
+     * Optional async hook that resolves once credentials are loaded.
+     * `getHeaders` is synchronous, but the API key is loaded asynchronously; the
+     * client awaits this before building request headers so the first request on
+     * a cold provider doesn't race the lazy key load (which would otherwise throw
+     * "API key is missing" or send an empty Authorization header).
+     */
+    ensureApiKey?: () => Promise<void>;
     fetch?: typeof fetch;
     /**
      * Optional callback to refresh the API key when a 401 error occurs.

package/dist/index.js

@@ -727,6 +727,9 @@ var GitLabDirectAccessClient = class {
     if (this.config.featureFlags && Object.keys(this.config.featureFlags).length > 0) {
       requestBody.feature_flags = this.config.featureFlags;
     }
+    if (this.config.ensureApiKey) {
+      await this.config.ensureApiKey();
+    }
     try {
       const response = await this.fetchFn(url, {
         method: "POST",
@@ -822,6 +825,7 @@ var GitLabAnthropicLanguageModel = class {
     this.directAccessClient = new GitLabDirectAccessClient({
       instanceUrl: config.instanceUrl,
       getHeaders: config.getHeaders,
+      ensureApiKey: config.ensureApiKey,
       refreshApiKey: config.refreshApiKey,
       fetch: config.fetch,
       featureFlags: config.featureFlags,
@@ -1457,6 +1461,7 @@ var MODEL_MAPPINGS = {
   "duo-chat-opus-4-8": { provider: "anthropic", model: "claude-opus-4-8" },
   "duo-chat-opus-4-7": { provider: "anthropic", model: "claude-opus-4-7" },
   "duo-chat-opus-4-6": { provider: "anthropic", model: "claude-opus-4-6" },
+  "duo-chat-sonnet-5": { provider: "anthropic", model: "claude-sonnet-5" },
   "duo-chat-sonnet-4-6": { provider: "anthropic", model: "claude-sonnet-4-6" },
   "duo-chat-opus-4-5": { provider: "anthropic", model: "claude-opus-4-5-20251101" },
   "duo-chat-sonnet-4-5": { provider: "anthropic", model: "claude-sonnet-4-5-20250929" },
@@ -1496,6 +1501,7 @@ var MODEL_MAPPINGS = {
     provider: "workflow",
     model: "anthropic/claude-sonnet-4-5-20250929"
   },
+  "duo-workflow-sonnet-5": { provider: "workflow", model: "claude_sonnet_5" },
   "duo-workflow-sonnet-4-6": { provider: "workflow", model: "claude_sonnet_4_6" },
   "duo-workflow-opus-4-5": {
     provider: "workflow",
@@ -1555,6 +1561,7 @@ var GitLabOpenAILanguageModel = class {
     this.directAccessClient = new GitLabDirectAccessClient({
       instanceUrl: config.instanceUrl,
       getHeaders: config.getHeaders,
+      ensureApiKey: config.ensureApiKey,
       refreshApiKey: config.refreshApiKey,
       fetch: config.fetch,
       featureFlags: config.featureFlags,
@@ -2496,7 +2503,7 @@ var import_node_async_hooks = require("async_hooks");
 var import_isomorphic_ws = __toESM(require("isomorphic-ws"));
 
 // src/version.ts
-var VERSION = true ? "6.9.1" : "0.0.0-dev";
+var VERSION = true ? "6.9.3" : "0.0.0-dev";
 
 // src/gitlab-workflow-client.ts
 var WS_CONNECT_TIMEOUT_MS = 3e4;
@@ -4833,9 +4840,10 @@ var TOKEN_EXPIRY_SKEW_MS = 5 * 60 * 1e3;
 var OAUTH_SCOPES = ["api"];
 
 // src/gitlab-oauth-manager.ts
+var globalInFlightRefreshes = /* @__PURE__ */ new Map();
 var GitLabOAuthManager = class {
   fetch;
-  inFlightRefreshes = /* @__PURE__ */ new Map();
+  inFlightRefreshes = globalInFlightRefreshes;
   constructor(fetchImpl = fetch) {
     this.fetch = fetchImpl;
   }
@@ -5064,6 +5072,39 @@ async function loadOpenCodeAuth(instanceUrl) {
     return void 0;
   }
 }
+var inFlightOAuthRefreshes = /* @__PURE__ */ new Map();
+async function refreshOAuthToken(auth, instanceUrl, clientId) {
+  const existing = inFlightOAuthRefreshes.get(instanceUrl);
+  if (existing) {
+    return existing;
+  }
+  const refreshPromise = (async () => {
+    const oauthManager = new GitLabOAuthManager();
+    const refreshed = await oauthManager.exchangeRefreshToken({
+      instanceUrl,
+      refreshToken: auth.refresh,
+      clientId
+    });
+    const authPath = getOpenCodeAuthPath();
+    const authData = JSON.parse(fs3.readFileSync(authPath, "utf-8"));
+    authData.gitlab = {
+      type: "oauth",
+      refresh: refreshed.refreshToken,
+      access: refreshed.accessToken,
+      expires: refreshed.expiresAt,
+      enterpriseUrl: instanceUrl
+      // Use enterpriseUrl to match auth plugin format
+    };
+    fs3.writeFileSync(authPath, JSON.stringify(authData, null, 2), { mode: 384 });
+    return refreshed.accessToken;
+  })();
+  inFlightOAuthRefreshes.set(instanceUrl, refreshPromise);
+  try {
+    return await refreshPromise;
+  } finally {
+    inFlightOAuthRefreshes.delete(instanceUrl);
+  }
+}
 async function loadApiKey(options, instanceUrl, clientId) {
   if (options.apiKey) {
     return options.apiKey;
@@ -5076,23 +5117,7 @@ async function loadApiKey(options, instanceUrl, clientId) {
     const oauthManager = new GitLabOAuthManager();
     if (oauthManager.needsRefresh(auth.expires)) {
       try {
-        const refreshed = await oauthManager.exchangeRefreshToken({
-          instanceUrl,
-          refreshToken: auth.refresh,
-          clientId
-        });
-        const authPath = getOpenCodeAuthPath();
-        const authData = JSON.parse(fs3.readFileSync(authPath, "utf-8"));
-        authData.gitlab = {
-          type: "oauth",
-          refresh: refreshed.refreshToken,
-          access: refreshed.accessToken,
-          expires: refreshed.expiresAt,
-          enterpriseUrl: instanceUrl
-          // Use enterpriseUrl to match auth plugin format
-        };
-        fs3.writeFileSync(authPath, JSON.stringify(authData, null, 2), { mode: 384 });
-        return refreshed.accessToken;
+        return await refreshOAuthToken(auth, instanceUrl, clientId);
       } catch (error) {
         const refreshErrorMsg = error instanceof Error ? error.message : String(error);
         const envApiKey = process.env[options.environmentVariableName];
@@ -5191,6 +5216,12 @@ function createGitLab(options = {}) {
       `ai-sdk-gitlab/${VERSION}`
     );
   };
+  const ensureApiKey = async () => {
+    try {
+      await getApiKey();
+    } catch {
+    }
+  };
   getApiKey().catch(() => {
   });
   const createAgenticChatModel = (modelId, agenticOptions) => {
@@ -5225,6 +5256,7 @@ function createGitLab(options = {}) {
       provider: `${providerName}.agentic`,
       instanceUrl,
       getHeaders,
+      ensureApiKey,
       refreshApiKey,
       fetch: options.fetch,
       maxTokens: agenticOptions?.maxTokens,