Offline session login

frontend/src/utils/generate-github-auth-url.ts

@@ -2,14 +2,26 @@
  * Generates a URL to redirect to for GitHub OAuth
  * @param clientId The GitHub OAuth client ID
  * @param requestUrl The URL of the request
+ * @param offline True for offline session, defaults to false
  * @returns The URL to redirect to for GitHub OAuth
  */
-export const generateGitHubAuthUrl = (clientId: string, requestUrl: URL) => {
-  const redirectUri = `${requestUrl.origin}/oauth/keycloak/callback`;
+export const generateGitHubAuthUrl = (
+  clientId: string,
+  requestUrl: URL,
+  offline: boolean = false,
+) => {
+  const redirectUri = offline
+    ? `${requestUrl.origin}/oauth/keycloak/offline/callback`
+    : `${requestUrl.origin}/oauth/keycloak/callback`;
+
   const authUrl = requestUrl.hostname
     .replace(/(^|\.)staging\.all-hands\.dev$/, "$1auth.staging.all-hands.dev")
     .replace(/(^|\.)app\.all-hands\.dev$/, "auth.app.all-hands.dev")
     .replace(/(^|\.)localhost$/, "auth.staging.all-hands.dev");
-  const scope = "openid email profile offline_access";
+
+  const scope = offline
+    ? "openid email profile offline_access"
+    : "openid email profile";
+
   return `https://${authUrl}/realms/allhands/protocol/openid-connect/auth?client_id=github&response_type=code&redirect_uri=${encodeURIComponent(redirectUri)}&scope=${encodeURIComponent(scope)}`;
 };

openhands/integrations/github/github_service.py

@@ -26,8 +26,10 @@ def __init__(
         user_id: str | None = None,
         idp_token: SecretStr | None = None,
         token: SecretStr | None = None,
+        external_token_manager: bool = False,
     ):
         self.user_id = user_id
+        self.external_token_manager = external_token_manager
 
         if token:
             self.token = token

openhands/runtime/base.py

@@ -221,7 +221,9 @@ async def _handle_action(self, event: Action) -> None:
         try:
             if isinstance(event, CmdRunAction):
                 if self.github_user_id and '$GITHUB_TOKEN' in event.command:
-                    gh_client = GithubServiceImpl(user_id=self.github_user_id)
+                    gh_client = GithubServiceImpl(
+                        user_id=self.github_user_id, external_token_manager=True
+                    )
                     token = await gh_client.get_latest_provider_token()
                     if token:
                         export_cmd = CmdRunAction(