Allow API-key Claude auth without OAuth credentials#63
Merged
Conversation
- Detect externally managed Claude auth from API-key environment variables and settings.json apiKeyHelper - Skip local OAuth refresh and credential-file checks when external auth is available - Pass ANTHROPIC_AUTH_TOKEN through Docker sessions and document it in --help This lets API-key based Claude setups start through cco without forcing a local OAuth login path.
- Assert API-key auth skips OAuth refresh preflight work - Assert credential checks are bypassed for API-key and apiKeyHelper configurations - Cover ANTHROPIC_AUTH_TOKEN help text for the new passthrough This locks in API-key based Claude startup behavior without exercising full sandbox launches.
- Add bjq for simple dotted keys and numeric array indexes, using jq first and python3 as a fallback - Route Claude permission settings, additionalDirectories, apiKeyHelper, and OAuth expiry reads through the helper - Keep unsupported jq features out of the helper so Bash callers get a narrow, predictable lookup surface This removes repeated JSON parser snippets while keeping the existing startup preflight behavior focused on simple lookups.
- Assert bjq reads simple dotted keys, optional leading dots, array indexes, and stdin JSON - Cover scalar, object, array, missing path, and unsupported syntax results - Exercise the python3 fallback with jq hidden from PATH This locks in the narrow JSON lookup contract before using it for broader Claude auth settings detection.
- Scan managed, project local, project shared, and user settings for external Claude auth configuration - Treat non-empty apiKeyHelper and settings env auth keys as externally managed authentication - Keep shell-provided Claude and Anthropic auth variables on the fast path This lets cco follow Claude Code's documented settings hierarchy before requiring local OAuth credentials.
- Assert settings env ANTHROPIC_AUTH_TOKEN skips OAuth refresh work - Assert project settings env ANTHROPIC_API_KEY bypasses local credential-file checks - Assert project apiKeyHelper also counts as externally managed Claude auth This locks in the documented settings-based auth paths without invoking Docker-backed sessions.
- Mark literal jq programs as intentional single-quoted strings - Use a local BJQ_OUTPUT override so bjq_type avoids command-assignment ambiguity - Leave the helper behavior unchanged while making shellcheck pass cleanly This keeps the JSON lookup helper lint-clean without broadening its supported query surface.
- Add SC2016 to the startup preflight test suppressions for literal shell snippets - Keep the Docker passthrough assertion unchanged - Preserve the existing test behavior while allowing shellcheck to run cleanly This documents the intentional single-quoted test command instead of leaving shellcheck noisy.
- Normalize bjq empty lookup status so missing keys are handled consistently - Skip managed host settings for Docker auth preflights because they are not mounted into the container - Read settings auth by effective key precedence so blank higher-priority values override lower-priority values This prevents cco from skipping local credential checks when Claude would not actually see usable external auth.
- Assert missing additionalDirectories settings stay silent - Assert Docker preflight ignores host managed settings that are not mounted - Assert higher-priority blank auth settings override lower-priority auth values This locks in the review fixes without requiring Docker-backed execution.
- Add shared helpers to load project .env values and --env values into the current process - Apply those env inputs before Claude credential verification and OAuth refresh checks - Reuse the same helpers in native launch setup so preflight and runtime env handling stay aligned This lets API-key auth supplied through .env or --env skip local OAuth credential checks before startup.
- Assert .env-provided ANTHROPIC_API_KEY bypasses local Claude credential checks - Assert --env-provided ANTHROPIC_API_KEY also bypasses local credential checks - Keep the coverage in startup preflights without invoking Docker-backed sessions This prevents preflight regressions for API-key auth supplied through cco's own env surfaces.
- Validate JSON with jq before running the path lookup program - Return parse status for invalid JSON instead of collapsing jq status 4 to missing key - Preserve the existing missing-parser warning text expected by callers This keeps invalid Claude settings files warning correctly across jq versions and platforms.
- Include bjq helper functions in the additionalDirectories extracted loader harness - Assert invalid JSON remains a parse failure for the jq-backed helper path - Assert the python fallback keeps the same invalid JSON behavior This makes the parser-selection tests exercise the real helper code and protects the Linux invalid-settings warning path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & Why
Allow
ccoto start with API-key-based Claude auth without requiring OAuth credentials present on the host.Changes
settings.jsonfor external Claude auth (ANTHROPIC_API_KEY,ANTHROPIC_AUTH_TOKEN,apiKeyHelper). Skip local OAuth refresh and credential-file checks when external auth is found.bjq— a thin wrapper for simple dotted-key and array-index JSON reads (usesjqfirst,python3fallback), replacing repeated inline snippets..envand--envvalues into the preflight process so.env-supplied API keys work the same as shell exports.bjqbehavior intests/test_startup_preflights.sh.Validation
Startup preflight tests cover:
ANTHROPIC_API_KEY/apiKeyHelperskips OAuth refresh--env-supplied API key bypasses local credential checksbjqreads for scalar, object, array, missing path, and stdin JSONFollow-up