build: bump openapi-generation to license token validation and wire the license election - #2124

Check if this issue is valid — if so, understand the root cause and fix it. At cmd/lint/lint.go, line 603:

<comment>When lint runs interactively without authentication, `WithGenerationContext` fails and this returns a nil error, so the caller displays an empty generation-warnings tab as if the dry run succeeded. Return the error here; the callers already skip targets whose dry run returns an error.</comment>

<file context>
@@ -589,10 +591,18 @@ func warningsToTabContents(warnings []error) []interactivity.InspectableContent
+		licenseToken, _ := coreauth.GetLicenseTokenFromContext(ctx)
+		commercialCtx, err := coreauth.WithGenerationContext(ctx, generationaccess.GeneratedLicenseCommercial)
+		if err != nil {
+			return nil, nil
+		}
+		ctx = licensetoken.WithToken(commercialCtx, licenseToken)
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At internal/sdkgen/sdkgen.go, line 374:

<comment>When a workspace is downgraded or blocked after tokenless online re-authentication, this branch still treats the preserved old token as sufficient and skips the platform access check. Clear the old token on tokenless re-authentication or retain the access check whenever an SDK is present, so blocked generation cannot proceed.

(Based on your team's feedback about stale offline licenses after downgrade.) </comment>

<file context>
@@ -367,6 +368,12 @@ func evaluateGenerationAccess(ctx context.Context, args *access.GenerationAccess
+	// An offline-license context still carries an SDK client when an API key is
+	// persisted; the license decides generation access there, so the platform
+	// access check (and therefore the network) must not be required.
+	if hasOfflineLicense(ctx) && len(licenseToken) > 0 {
+		return ctx, &access.GenerationAccess{Allowed: true}, licenseToken, nil
+	}
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At internal/run/run.go, line 183:

<comment>When `Workflow.Run` has no workspace context, this preparation performs no explicit AGPL/direct election. Restore the no-workspace AGPL election before target checks so tokenless workflow runs do not enter generation with the wrong licensing context.</comment>

<file context>
@@ -173,25 +175,48 @@ func (w *Workflow) Run(ctx context.Context) error {
-
-	if _, err := core.GetWorkspaceIDFromContext(ctx); err != nil {
-		return generationaccess.WithDirect(ctx), nil //nolint:nilerr // Direct runs do not carry workspace context.
+	ctx, err = ensureTargets(ctx, targetTypes)
+	if err != nil {
+		return ctx, err
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At internal/sdkgen/sdkgen.go, line 407:

<comment>When no license token is issued, `withGenerationContext` still elects the commercial license, so the CLI does not produce the required AGPL fallback and the validator can reject generation. Elect AGPL when `licenseToken` is empty, commercial only when a token is present, and emit the AGPL-3.0-only warning for that branch.</comment>

<file context>
@@ -348,12 +361,54 @@ func Generate(ctx context.Context, opts GenerateOptions) (*GenerationAccess, err
+// commercial; the generator then rejects the generation as unproven rather
+// than silently downgrading the license.
+func withGenerationContext(ctx context.Context, licenseToken []byte) (context.Context, error) {
+	ctx, err := coreauth.WithGenerationContext(ctx, generationaccess.GeneratedLicenseCommercial)
+	if err != nil {
+		return ctx, err
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At cmd/lint/lint.go, line 601:

<comment>When `lint openapi --dry-run` runs without authentication, this branch elects commercial with an empty token. The generator rejects tokenless commercial generation, while `runDryRunGeneration` discards its errors, so unauthenticated lint silently loses target-specific warnings; elect AGPL explicitly when no token is available.</comment>

<file context>
@@ -589,10 +591,18 @@ func warningsToTabContents(warnings []error) []interactivity.InspectableContent
 	if _, ok := generationaccess.StateFromContext(ctx); !ok {
-		ctx = generationaccess.WithDirect(ctx)
+		licenseToken, _ := coreauth.GetLicenseTokenFromContext(ctx)
+		commercialCtx, err := coreauth.WithGenerationContext(ctx, generationaccess.GeneratedLicenseCommercial)
+		if err != nil {
+			return nil, nil
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At internal/auth/auth.go, line 106:

<comment>When an offline-license access check returns 401/403, this fallback passes `force=true`, which opens the browser instead of refreshing through the configured API key. Automatic retries therefore fail in CI and other non-interactive environments; use a non-interactive online refresh path here.</comment>

<file context>
@@ -2,31 +2,157 @@ package auth
+	if err == nil || licenseFromContext(ctx) == nil || !isAuthenticationFailure(err) {
+		return ctx, err
+	}
+	authCtx, err := authenticateWithHint(ctx, true)
+	if err != nil {
+		return authCtx, err
</file context>