fix(claude): keep CLAUDE_CODE_OAUTH_TOKEN in the spawned agent env - #587
Open
thereisnotime wants to merge 1 commit into
Open
fix(claude): keep CLAUDE_CODE_OAUTH_TOKEN in the spawned agent env#587thereisnotime wants to merge 1 commit into
thereisnotime wants to merge 1 commit into
Conversation
The adapter strips CLAUDE_* variables so the spawned `claude` doesn't think it's running under an SDK harness and fall onto the org-scoped auth path. The allowlist already carves out the vars the child genuinely needs (Vertex, Bedrock, model, API key, max turns), but it misses CLAUDE_CODE_OAUTH_TOKEN. That one is a credential, not a harness marker. It's what `claude setup-token` writes and it's the normal way to pass subscription auth. Dropping it means an agent that can only authenticate with an API key or with credentials already on disk, so a container or a headless host has no way in at all: there's no interactive login to fall back on and no file to read. Added it to the allowlist. Also pulled the set and the loop out into sanitizeClaudeEnv() at module scope so the behaviour is testable, with no change to what gets stripped otherwise. Tests cover the harness markers still being removed, the existing allowlist entries surviving, the OAuth token surviving, unrelated vars being untouched, and the input not being mutated.
|
@thereisnotime is attempting to deploy a commit to the Raphael's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The claude adapter strips
CLAUDE_*variables so the spawnedclaudedoes not think it is running under an SDK harness and fall onto the org-scoped auth path. That is correct, but the allowlist missesCLAUDE_CODE_OAUTH_TOKEN.It is a credential, not a harness marker. It is what
claude setup-tokenwrites, and it is the normal way to pass subscription auth. With it stripped, a spawned agent can only authenticate via an API key or credentials already on disk. On a headless host or in a container there is neither: no interactive login to fall back on, and no credentials file.The allowlist already carves out exactly this category (
CLAUDE_API_KEY, Vertex, Bedrock), so this looks like an omission rather than intent. Grepping the repo, the name does not appear anywhere else.Repro
export CLAUDE_CODE_OAUTH_TOKEN=... agn create x --type claude agn upThe agent starts unauthenticated. The variable is gone from its environment.
Changes
CLAUDE_CODE_OAUTH_TOKENtoCLAUDE_ENV_KEEP.sanitizeClaudeEnv()at module scope so the behaviour is testable. No change to what gets stripped otherwise.test/claude-env.test.js: harness markers still stripped, existing allowlist entries preserved, OAuth token preserved, unrelated vars untouched, input not mutated.Testing
node --testinpackages/agent-connector: 5 new tests pass, 43 adjacent tests still pass.