Skip to content

feat(opencode): support Azure CLI authentication - #45079

Merged
neriousy merged 8 commits into
devfrom
azure-cli-refresh
Aug 27, 2026
Merged

feat(opencode): support Azure CLI authentication#45079
neriousy merged 8 commits into
devfrom
azure-cli-refresh

Conversation

@opencode-agent

@opencode-agent opencode-agent Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Issue for this PR

N/A

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Adds Microsoft Entra ID authentication through an existing Azure CLI session to the Azure provider while preserving the current API-key flow.

  • Uses az login credentials and cached, automatically refreshed bearer tokens with the correct Azure OpenAI and Microsoft Foundry audiences.
  • Discovers successful Azure model deployments, preserves custom deployment names, and exposes multiple deployments of the same underlying model separately.
  • Allows AZURE_RESOURCE_GROUP to bypass subscription-wide account enumeration when the resource group is already known.
  • Keeps configured/catalog models available and logs an actionable warning when deployment discovery is unavailable, so inference-only Azure roles can still use explicitly configured deployments.
  • Supports both current Azure CLI expires_on timestamps and the legacy expiresOn format.
  • Documents tenant/subscription selection, resource-group configuration, control-plane versus inference permissions, and custom deployment mappings.

The authentication and fallback approach follows documented patterns from Claude Code on Microsoft Foundry, the GitHub Copilot SDK Azure managed identity integration, and the AI SDK Azure provider: renewable bearer credentials, explicit deployment names, and no requirement for model-discovery permissions to perform inference.

How did you verify your code works?

  • bun test test/plugin/azure.test.ts test/provider/provider.test.ts --test-name-pattern 'plugin.azure|Azure' — 12 passing tests covering authentication, token audiences, legacy token expiration, direct resource-group lookup, duplicate deployments, discovery fallback, and existing Azure provider behavior.
  • Scoped bun typecheck covering the changed provider/plugin files and Azure tests.
  • bun x prettier --check packages/opencode/src/plugin/azure.ts packages/opencode/src/provider/provider.ts packages/opencode/test/plugin/azure.test.ts packages/web/src/content/docs/providers.mdx
  • git diff --check origin/dev

Screenshots / recordings

N/A

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Requested by: @neriousy (Filip via Slack)

@github-actions github-actions Bot mentioned this pull request Aug 25, 2026
Open
@neriousy
neriousy enabled auto-merge (squash) August 27, 2026 22:23
@neriousy @opencode-agent
fix(opencode): skip Azure discovery without a cached login
ba7ea79 
An installed Azure CLI should not run on every unrelated CLI invocation. Check its local subscription profile before eager resource enumeration, retain manual connection and resource selection for signed-in users, and cover missing, empty, and BOM-prefixed profiles at the plugin factory.
@neriousy
neriousy disabled auto-merge August 27, 2026 23:50
@neriousy
neriousy merged commit 790fb5b into dev Aug 27, 2026
6 of 8 checks passed
@neriousy
neriousy deleted the azure-cli-refresh branch August 27, 2026 23:50
Archipel pushed a commit to Archipel/opencode that referenced this pull request Aug 29, 2026
@opencode-agent @neriousy Thomas Weyn
feat(opencode): support Azure CLI authentication (anomalyco#45079)
d198c91 
Co-authored-by: neriousy <34747899+neriousy@users.noreply.github.com>
@github-actions github-actions Bot mentioned this pull request Aug 31, 2026
Open
1056674754 added a commit to 1056674754/opencode that referenced this pull request Aug 31, 2026
@1056674754 @claude
chore: merge OpenCode v1.18.25-sscity
08c591d 
Upstream v1.18.23 (ef2880f, merged at 2091b86) -> v1.18.25 (cb7d8b2),
41 commits / 224 files. Upstream superseded the v1.18.24 release commit
(57e8055) with 19db518 (sync release versions for v1.18.24) in the
v1.18.25 lineage; merge base is 31c409a (update inference headers).
Staged delta vs pre-merge fork HEAD is identical to the upstream tag-to-tag
diff (224 files, +5428/-1627), confirming a clean adoption.

Functional changes:
- feat(opencode): load supported v2 config in v1 (anomalyco#45421) — new
  config/v2-compat.ts lowers v2 config onto v1 before schema parsing;
  decodeConfig wraps every load/update path. Fork's getFresh/commitFresh
  interface additions in config.ts untouched.
- feat(opencode): support Azure CLI authentication (anomalyco#45079) and fix:
  remove Bun dependency from Azure authentication (anomalyco#45845) —
  plugin/azure.ts grows an az CLI credential chain (+241); provider.ts
  custom Azure loader adds auth.accountId as a resource-name fallback
  (1 line, disjoint from the fork snapshot architecture). New
  test/plugin/azure.test.ts passes in full.
- fix(opencode): compare config snapshots as JSON (anomalyco#45784) — the update
  path re-reads the original file text and merges the patch onto the raw
  parsed record, detecting change via serialized comparison.
- fix(provider): filter unreplayable Bedrock reasoning before caching
  (anomalyco#45769) — transform.ts; verified disjoint from the fork GLM/ZhiPu
  normalization block, which is intact.
- fix(core): recover legacy database migration history (anomalyco#45061).
- fix(ui): restore focus in stacked dialogs (anomalyco#44928); fix(app): drop
  archived sessions from home list right away (anomalyco#44905).
- console/stats/go: zen quota usage breakdown, weekly retention metrics,
  Go comparison chart mobile fix, auth redirect validation, checkout
  rate limit; docs: Qwen3.8 Flash, GLM-5.3-Flash, Grok 4.6.

Conflicts resolved: 29 package.json version bumps (rebranded 1.18.25-sscity),
bun.lock (took upstream, rebranded workspace entries via bun install; only
external dep delta is removal of the console map stack d3-geo/topojson/
world-atlas plus a @types/bun catalog entry). provider.ts and transform.ts
auto-merged; merged files verified to differ from v1.18.25 only by fork
deltas (ProviderSnapshot architecture, deferred snapshot initialization,
GLM normalization, getFresh/commitFresh). Tests: provider 105, transform,
bedrock, config, v2-compat, session retry/llm — 906 pass / 0 fail across
14 files; azure plugin 18 pass; typecheck clean. Pre-existing, not from
this merge: 4 cf-ai-gateway-e2e anthropic-passthrough tests fail
identically on pre-merge fork HEAD with an unchanged ai-gateway-provider
3.2.0 lock entry — environmental drift, left as-is.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@nomaed

nomaed commented Sep 1, 2026

Copy link
Copy Markdown

Folks, looks like this causes OpenCode to start really slow. Azure commands are being called on startup and for me, it takes 10-12 seconds to just load a blank session.

@nomaed nomaed mentioned this pull request Sep 1, 2026
Closed
lacymorrow added a commit to lacymorrow/lash that referenced this pull request Sep 4, 2026
@lacymorrow
merge: bring dev (upstream v1.18.25 via PR #41/#43) into lash — lash …
aa19cdf 
…is the working branch

* dev: (3957 commits)
  docs: add 2026-08-31 sync entry to UPSTREAM_SYNC.md history
  fix(app): backport session rename and tab menu fixes to v1 (anomalyco#46116)
  fix: remove Hy3 Free docs and correct Go chart rendering (anomalyco#46221)
  docs(go): end Hy3 usage promotion (anomalyco#46213)
  chore: update nix node_modules hashes
  feat(console): animate Go usage allowances and bonuses (anomalyco#46055)
  docs(zen): add Ling 3.0 Flash Fin Free (anomalyco#45923)
  docs(go): add Hy4 preview (anomalyco#45904)
  sync release versions for v1.18.25
  test(opencode): use native config path in permission assertion (anomalyco#45849)
  fix(opencode): remove Bun dependency from Azure authentication (anomalyco#45845)
  docs(go): add Qwen3.8 Flash (anomalyco#45836)
  sync release versions for v1.18.24
  fix(opencode): compare config snapshots as JSON (anomalyco#45784)
  feat(opencode): support Azure CLI authentication (anomalyco#45079)
  fix(provider): filter unreplayable Bedrock reasoning before caching (anomalyco#45769)
  chore: generate
  feat(opencode): load supported v2 config in v1 (anomalyco#45421)
  fix(console): improve Go comparison chart on mobile (anomalyco#45044)
  chore: generate
  ...
filipeforattini added a commit to reddb-io/redcode that referenced this pull request Sep 5, 2026
@filipeforattini
feat(opencode): support Azure CLI authentication (anomalyco#45079)
ff24304 
Ported from anomalyco/opencode 790fb5b.

Co-authored-by: neriousy <34747899+neriousy@users.noreply.github.com>

Upstream: 790fb5b
filipeforattini added a commit to reddb-io/redcode that referenced this pull request Sep 5, 2026
@filipeforattini
feat(opencode): support Azure CLI authentication (anomalyco#45079)
077db60 
Ported from anomalyco/opencode 790fb5b.

Co-authored-by: neriousy <34747899+neriousy@users.noreply.github.com>

Upstream: 790fb5b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@neriousy neriousy

Labels

contributor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@nomaed @neriousy