Regression: lint openapi fails without initialized generation access state in v1.793.0

[vxio]

Summary

speakeasy lint openapi fails before validating any local OpenAPI document in CLI v1.793.0. The same command succeeds in v1.792.0.

The failure says the internal generation access state was not initialized. Local linting is documented and implemented as an unauthenticated operation, but the ordinary validation path appears not to select direct access after the migration to openapi-generation-next.

Minimal reproduction

Create repro.yaml:

openapi: 3.0.3
info:
  title: Reproduction
  version: 1.0.0
paths: {}

Run:

speakeasy lint openapi \
  --non-interactive \
  --ruleset speakeasy-generation \
  --schema repro.yaml

Actual behavior

The command exits with status 1 before producing validation results:

Linting OpenAPI document...
generation access state is required; use generation-context/access.WithDirect or WithAuthenticated

Expected behavior

The local document is linted without requiring authentication, matching v1.792.0 behavior.

Regression range

• v1.792.0: succeeds without authentication
• v1.793.0: fails with the access-state error

Reproduced on macOS arm64 and Ubuntu in GitHub Actions. speakeasy openapi lint and the command aliases use the same failing path. No documented flag or environment variable appears to select direct access.

Suspected cause

The regression appears related to commit 6626149, which routes CLI generation through openapi-generation-next and introduces generation-context/access.

The ordinary lint path calls validation.ValidateOpenAPI without first adding an access state to the context. By contrast, the later dry-run diagnostics path explicitly uses generationaccess.WithDirect, but ordinary validation fails before reaching it.

Relevant public source paths in v1.793.0:

• cmd/lint/lint.go: lintOpenapi calls validation.ValidateOpenAPI with the existing context.
• internal/validation/openapi.go: validation enters the generator without initializing access state.
• cmd/lint/lint.go: the dry-run generation path explicitly selects direct access.

A likely fix is to initialize direct access at the unauthenticated lint boundary before ordinary validation, consistent with the existing dry-run and workflow paths:

ctx = generationaccess.WithDirect(ctx)

Current workaround

Use v1.792.0 or temporarily skip this lint operation. Authentication and command aliases do not provide a reliable invocation-side workaround for v1.793.0.