Claude "Avoid Keychain prompts" can trigger Keychain prompts

[gmkbenjamin]

Problem

In CodexBar 0.38.0 (94), enabling the Claude provider setting Avoid Keychain prompts can cause repeated macOS Keychain prompts for the Claude credential. Turning the setting off stops the prompts.

That is inverted from the expected behavior and makes the Claude provider noisy for users who explicitly chose the no-prompt path.

Repro

1. Use CodexBar 0.38.0 (94) with the Claude provider configured via Claude OAuth.
2. Open Claude provider settings.
3. Enable Avoid Keychain prompts.
4. Let a background refresh run, or refresh Claude usage manually.
5. Observe a macOS Keychain prompt for the Claude credential.
6. Disable Avoid Keychain prompts.
7. Observe that the prompts stop.

Expected behavior

When Avoid Keychain prompts is enabled, Claude OAuth credential reads should use the non-interactive Keychain policy and fail closed when macOS would require user interaction. The setting should not switch to a read path that can show prompts.

Actual behavior

The setting appears to select the experimental /usr/bin/security CLI reader. That reader shells out to security find-generic-password -w, which can still display macOS Keychain prompts. With the setting disabled, the Security.framework path is used instead, where CodexBar can apply its no-UI policy.

Suggested fix

• Treat stored securityCLIExperimental preferences as legacy and migrate them back to securityFramework.
• Make Avoid Keychain prompts set the Claude OAuth prompt policy to never rather than selecting the experimental CLI reader.
• Keep the Claude Keychain prompt policy control visible as the source of truth.
• Update the setting copy so it describes prompt prevention, not the CLI read strategy.
• Cover the migration, toggle mapping, and provider descriptor behavior with focused tests that do not touch the real Keychain.

Labeling

Suggested labels from docs/ISSUE_LABELING.md:

• bug
• priority:high
• area:auth-keychain
• provider:claude

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed July 4, 2026, 2:17 AM ET / 06:17 UTC.

Summary
Keep open: current main and v0.38.0 still map Claude’s visible no-prompt toggle to the experimental /usr/bin/security reader, and tests/docs preserve that behavior rather than the requested non-interactive prompt policy.

Reproducibility: yes. from source for the core path: enabling the visible toggle selects .securityCLIExperimental, and that reader invokes security find-generic-password -w. I did not run live Keychain validation because repository policy forbids prompt-producing checks unless explicitly requested.

Root-cause cluster
Relationship: canonical
Canonical: #1877
Summary: This issue is the canonical remaining report for the visible Claude no-prompt toggle selecting the experimental security CLI reader; older related items cover overlapping keychain symptoms but not this remaining control mapping.

Members:

• partial_overlap: Claude OAuth keychain: securityCLIExperimental silently overrides promptMode to .always, defeating XARA mitigation #458 - That closed issue fixed prompt-mode fallback behavior around securityCLIExperimental, but current main still keeps the visible no-prompt toggle mapped to the CLI reader.
• adjacent_distinct: CodexBarCLI not in trusted-apps ACL of com.steipete.codexbar.cache items — every CLI invocation triggers a "CodexBar Cache" keychain prompt #679 - That closed issue covered CodexBar-owned cache item ACL prompts, not the Claude Claude Code-credentials reader strategy selected by this toggle.
• partial_overlap: Claude provider: Claude Code-credentials keychain item holds only mcpOAuth entries on Claude Code 2.1.x → ClaudeOAuthCredentialsError + hourly "delegated CLI refresh" opens the default browser #1844 - That issue and its merged PR fixed background delegated refresh/browser-launch behavior for MCP-only keychain state, but did not change this toggle-to-CLI mapping.
• adjacent_distinct: Claude constantly looses token for access #1823 - That open issue tracks broader Claude token loss/storage discovery and delegated refresh failures, while this report has a narrower settings mapping bug.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Next step
Manual maintainer review should decide the auth/keychain migration/default change before an automated fix alters existing Claude credential read behavior.

Security
Needs attention: Needs attention because any fix changes Claude OAuth credential access and the non-interactive Keychain prompt boundary.

Review details

Best possible solution:

Make the visible no-prompt control drive claudeOAuthKeychainPromptMode = .never on the Security.framework reader, migrate legacy securityCLIExperimental preferences back safely, keep the prompt policy visible as the source of truth, and cover the mapping with no-UI tests.

Do we have a high-confidence way to reproduce the issue?

Yes from source for the core path: enabling the visible toggle selects .securityCLIExperimental, and that reader invokes security find-generic-password -w. I did not run live Keychain validation because repository policy forbids prompt-producing checks unless explicitly requested.

Is this the best way to solve the issue?

Yes, the suggested direction is the narrow maintainable fix, but the migration/default behavior needs maintainer approval because it changes Claude OAuth auth/keychain semantics for existing users.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• No live Keychain reproduction was run because AGENTS.md forbids validation that can display macOS Keychain prompts unless explicitly requested.
• The narrow fix is source-clear, but changing the default/migration for Claude OAuth keychain reading affects provider auth and privacy behavior and should get maintainer sign-off.

Codex review notes: model internal, reasoning high; reviewed against f9ee1f8543fa.

Label changes

Label changes:

• add P2: This is a current-release Claude provider auth/keychain bug with clear source evidence and limited blast radius to users enabling the no-prompt path.
• add impact:security: The affected behavior touches OAuth credentials, Keychain access, and the boundary between interactive and non-interactive credential reads.
• add impact:auth-provider: The issue is directly about Claude OAuth credential read strategy and prompt-policy routing.
• add impact:ux-friction: Repeated macOS Keychain prompts create avoidable user-facing friction, but users can proceed by disabling the setting.
• add issue-rating: 🐚 platinum hermit: Current issue advisory state selects this label.
• add clawsweeper:needs-live-repro: Current issue advisory state selects this label.
• add clawsweeper:no-new-fix-pr: Current issue advisory state selects this label.
• add clawsweeper:fix-shape-clear: Current issue advisory state selects this label.
• add clawsweeper:needs-maintainer-review: Current issue advisory state selects this label.
• add clawsweeper:needs-product-decision: Current issue advisory state selects this label.
• add clawsweeper:needs-security-review: Current issue advisory state selects this label.

Label justifications:

• P2: This is a current-release Claude provider auth/keychain bug with clear source evidence and limited blast radius to users enabling the no-prompt path.
• impact:auth-provider: The issue is directly about Claude OAuth credential read strategy and prompt-policy routing.
• impact:security: The affected behavior touches OAuth credentials, Keychain access, and the boundary between interactive and non-interactive credential reads.
• impact:ux-friction: Repeated macOS Keychain prompts create avoidable user-facing friction, but users can proceed by disabling the setting.

Evidence reviewed

Security concerns:

• [medium] Preserve no-UI credential reads — Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials+SecurityCLIReader.swift:271
  The no-prompt setting currently reaches security find-generic-password -w; the repair should fail closed without logging or exposing credential payloads when macOS would require interaction.
  Confidence: 0.83
• [medium] Keep diagnostics redacted
  Follow-up reproduction should use redacted screenshots/logs only and must not ask users to post OAuth tokens, cookie headers, Authorization values, or raw Keychain item values.
  Confidence: 0.86

Acceptance criteria:

• swift test --filter SettingsStoreCoverageTests
• swift test --filter ProviderSettingsDescriptorTests
• swift test --filter ClaudeOAuthCredentialsStorePromptPolicyTests
• make check

What I checked:

• Repository policy read: AGENTS.md was read fully; its guidance against live Keychain/provider probes without explicit request constrained this review to source, tests, docs, GitHub discussion, and history. (AGENTS.md:28, f9ee1f8543fa)
• Current setting maps no-prompt toggle to security CLI: claudeOAuthPromptFreeCredentialsEnabled is true when the read strategy is .securityCLIExperimental, and setting it true writes that strategy. (Sources/CodexBar/SettingsStore+Defaults.swift:419, f9ee1f8543fa)
• Visible Claude toggle still selects that setting: The Claude settings toggle titled Avoid Keychain prompts binds directly to claudeOAuthPromptFreeCredentialsEnabled, and its subtitle says it uses /usr/bin/security. (Sources/CodexBar/Providers/Claude/ClaudeProviderImplementation.swift:73, f9ee1f8543fa)
• Security CLI reader still shells out to keychain CLI: The experimental reader launches /usr/bin/security and builds find-generic-password -s Claude Code-credentials -w arguments, matching the reported prompt-producing path. (Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials+SecurityCLIReader.swift:271, f9ee1f8543fa)
• Prompt policy is not the active control under CLI strategy: ClaudeOAuthKeychainPromptPreference.effectiveMode returns .always when the read strategy is not applicable, and applicability is limited to .securityFramework. (Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthKeychainPromptMode.swift:32, f9ee1f8543fa)
• Tests currently lock in the reported mapping: Settings coverage expects the default read strategy to be securityCLIExperimental and expects the prompt-free credentials toggle to map back to that strategy when enabled. (Tests/CodexBarTests/SettingsStoreCoverageTests.swift:473, f9ee1f8543fa)

Likely related people:

• ratulsarna: Feature history shows the experimental Claude security CLI reader, hidden prompt-policy picker behavior, and prompt-free toggle movement came through this area of work. (role: introduced behavior; confidence: high; commits: dd2d746c973f, b8189b4cf93f, 69f34e8676f4; files: Sources/CodexBar/SettingsStore+Defaults.swift, Sources/CodexBar/Providers/Claude/ClaudeProviderImplementation.swift, Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthKeychainReadStrategy.swift)
• steipete: Current blame on the relevant released files is anchored at v0.38.0, and recent owner comments/commits around Claude OAuth keychain behavior provide current product context. (role: recent area contributor and releaser; confidence: high; commits: 913b1a6412b5, f9ee1f8543fa, 5bb54dfb7993; files: Sources/CodexBar/SettingsStore+Defaults.swift, Sources/CodexBar/Providers/Claude/ClaudeProviderImplementation.swift, Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials.swift)
• Yuxin-Qiao: Merged PR Fix #1844: block background Claude delegated refresh and mcpOAuth-only keychain touch #1848 changed the adjacent security CLI reader and Claude OAuth fail-closed tests, which constrains any follow-up in this prompt-policy area. (role: recent adjacent contributor; confidence: medium; commits: a27c9b094e61; files: Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials+SecurityCLIReader.swift, Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials.swift, Tests/CodexBarTests/ClaudeOAuthCredentialsStoreMCPOnlyGuardTests.swift)
• Zihao-Qi: Recent Claude settings work disabled the prompt-free toggle when global Keychain access is disabled and added descriptor coverage around the same control. (role: adjacent UI contributor; confidence: medium; commits: 9c54acd5d8d8; files: Sources/CodexBar/Providers/Claude/ClaudeProviderImplementation.swift, Tests/CodexBarTests/ProviderSettingsDescriptorTests.swift)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.