feat(auth): implement Claude Code authentication and container session execution #20
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…n execution Add authentication infrastructure for Claude Code CLI: - Add `hjk auth claude` command that runs `claude setup-token` flow - Store OAuth tokens securely in macOS Keychain via new keychain package - Inject CLAUDE_CODE_OAUTH_TOKEN into container sessions Fix session execution to run inside containers: - Wrap session commands with `container exec` to run in VM - Pass environment variables via `-e` flags to container exec - Add agent-specific setup (creates ~/.claude.json for Claude onboarding skip) Closes JMG-17 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jmgilman
force-pushed
the
joshuagilman/jmg-17-implement-hjk-auth-claude-command
branch
from
efb91e7 to
762be08
Compare
Split keychain implementation into platform-specific files: - keychain.go: interface and errors (all platforms) - keychain_darwin.go: macOS Keychain implementation - keychain_other.go: stub returning ErrUnsupportedPlatform This fixes CI failures on Linux where go-keychain is unavailable. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jmgilman
force-pushed
the
joshuagilman/jmg-17-implement-hjk-auth-claude-command
branch
from
762be08 to
a03dbba
Compare
jmgilman
deleted the
joshuagilman/jmg-17-implement-hjk-auth-claude-command
branch
jmgilman
added a commit
that referenced
this pull request
Jan 3, 2026
…n execution Current behavior: N/A - new feature New behavior: Add authentication infrastructure for Claude Code CLI with hjk auth claude command that runs claude setup-token flow. Store OAuth tokens securely in macOS Keychain with cross-platform support. Inject CLAUDE_CODE_OAUTH_TOKEN into container sessions and wrap session commands with container exec to run inside VMs. Add agent-specific setup that creates ~/.claude.json for Claude onboarding skip. Closes: #20
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
hjk auth claudecommand for Claude Code OAuth authenticationcontainer execChanges
Authentication (
internal/auth/,internal/keychain/)authpackage withClaudeProviderthat runsclaude setup-tokenflowkeychainpackage wrapping macOS Keychain viasecurityCLICLI (
internal/cmd/)hjk auth claude- interactive OAuth flow, stores token in Keychainhjk run --agent=claude- retrieves token from Keychain, injects as env varSession Execution (
internal/instance/manager.go)container exec -it -w /workspace -e ENV=val <id> <cmd>-eflags to container execrunAgentSetup()for agent-specific container preparationClaude Headless Support
~/.claude.jsonwithhasCompletedOnboarding: truebefore starting ClaudeTest plan
hjk auth claudeand complete OAuth flowsecurity find-generic-password -s headjack -a claude-oidc-tokenhjk run --agent=claude <branch>and verify Claude starts authenticatedwhoamiinside Claude session shows container user, not host userhjk run <branch>(shell) and verify it works inside containerCloses JMG-17
🤖 Generated with Claude Code