Run provider sign-in inside settings with auto-captured setup token - #108
Merged
Conversation
Provider auth no longer jumps to a chat-thread terminal. A new providerAuth.* RPC family drives ephemeral server-side PTY sessions (ProviderAuthSessions): the command is derived server-side from the instance config, nothing is persisted to disk, and the settings page hosts the whole flow in an inline panel with a collapsible terminal. For claude setup-token, the server captures the printed token, saves it as the sensitive CLAUDE_CODE_OAUTH_TOKEN instance variable, and masks it before fanout so the browser never receives it. The setup-token PTY is spawned 512 columns wide and never resized: the CLI hard-wraps at PTY width, and a wrapped token was previously captured truncated with its tail leaking past the mask. Capture is decoupled from output flushing and only accepts a terminated match. Auth PTYs strip CLAUDE_CODE_OAUTH_TOKEN/ANTHROPIC_* so stale credentials cannot no-op an interactive sign-in. Command builders move to @threadlines/shared/providerAuthCommands, shared by server and web. The old jump-to-chat runner and its terminal-store plumbing are removed, and the account section renders status chips with an inline action instead of a detached button.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
vouch:trusted
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Omit<> flattened the ProviderAuthEvent union in the flow-logic test helper; distribute it over the variants instead. The failure never surfaced locally because vp served a stale typecheck cache hit. Parse the pasted CLAUDE_CODE_OAUTH_TOKEN=... assignment without a regex: the \s*=\s*(.+)$ pattern backtracks polynomially on adversarial whitespace (CodeQL js/polynomial-redos).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Provider sign-in (
codex login,claude auth login,claude setup-token) now runs entirely inside Settings → Providers. Clicking Sign in no longer teleports the user into their last chat thread's terminal drawer.providerAuth.*RPC family (start/write/resize/stop/subscribe) routed inws.ts, driving a newProviderAuthSessionsservice: one ephemeral PTY per provider instance, command derived server-side from instance config, no scrollback persisted to disk (chat-thread terminals persist history; auth output contains credentials).ProviderConnectFlowpanel: status chips with an inline action (quiet "Sign in again" when healthy, solid "Reconnect" when signed out), plain-language status line, last-output-line preview, and a Show-details interactive terminal that auto-expands when the CLI waits for input (~15s) or fails, and closes on success. Server replays command/output/status on subscribe, so a running flow survives tab switches and remounts.CLAUDE_CODE_OAUTH_TOKENinstance variable through the normal settings path, and masks it before fanout — the raw token never reaches the browser. Manual paste stays as a fallback and the field remains write-only.CLAUDE_CODE_OAUTH_TOKEN/ANTHROPIC_*so a stale credential can't turn the interactive sign-in into a no-op.@threadlines/shared/providerAuthCommands(shared by server spawn + web copy-fallback). The jump-to-chat runner and its terminal-store plumbing are removed.Wrap-truncation fix (found in live testing)
The CLI hard-wraps output at PTY width; a ~103-char token wrapped at 100 cols was captured truncated (a dead credential) with its tail leaking past the mask. The setup-token PTY now spawns 512 columns wide and ignores resize, so the token can never wrap (xterm still soft-wraps the display); capture is decoupled from output flushing and only accepts a match confirmed complete. A regression test replays the wrapped-token scenario.
Testing
vp fmt,vp lint,vp run typecheckcleanProviderAuthSessionsbehaviour tests (fake PTY): chunk-split capture + masking, wrap regression, exit-code handling, per-instance session replacement; fullserver.testsuite greenSettingsPanelsbrowser test for the in-settings sign-in path; fulltest:browsersuite green (355)