Environment variables, authentication improvements, and critical security fix

[lroolle]

Summary

Major enhancements to Claude Code YOLO with critical security fixes:

• SECURITY FIX: Stop modifying permissions on user-mounted volumes
• Consolidate auth to --auth-with METHOD pattern (claude, api-key, bedrock, vertex)
• Add flexible volume mounting via -v flag in claude-yolo
• GitHub CLI authentication support via GH_TOKEN environment variable
• Enhanced environment variable passthrough and timezone detection
• Better error handling and container management

Critical Security Fix

Problem: The script was running chmod -R 755 on ALL user-mounted directories, including .ssh, corrupting SSH private key permissions and breaking authentication.

Solution:

• Removed dangerous permission modifications on user volumes
• Users now control their own mount permissions
• Only essential Claude directories get permission changes
• Prevents SSH key corruption and other security issues

Other Improvements

• Authentication: New --auth-with parameter replaces scattered auth flags
• Volume mounting: Added -v support to claude-yolo for custom mounts
• GitHub CLI: Added GH_TOKEN environment variable passthrough for container auth
• Environment: Auto-detect timezone, better proxy translation
• Container tools: Enhanced inspection shortcuts (--inspect, --ps)
• Documentation: Comprehensive dev logs and usage examples

Breaking Changes

• Users must set appropriate permissions on mounted volumes themselves
• No automatic permission changes on user-provided mounts

Test plan

• Test all auth methods: claude, api-key, bedrock, vertex
• Verify volume mounting with -v flag preserves permissions
• Test GitHub CLI auth with GH_TOKEN environment variable
• Confirm SSH keys remain secure when mounted
• Check environment variable passthrough
• Test container shortcuts (--inspect, --ps)

[cursor]

Bug: Argument Parsing Infinite Loop

The parse_args() function is missing shift statements for the --inspect and --ps options, causing an infinite loop in the argument parsing. Additionally, the --ps option calls list_containers() but fails to exit, leading to the script incorrectly proceeding to exec "$CLAUDE_SH" --yolo after listing containers.

claude-yolo#L83-L89

https://github.com/lroolle/claude-code-yolo/blob/8dada53c831ec6992ae7e2cdea1e67a81bee37d0/claude-yolo#L83-L89

Fix in Cursor

---

Bug: Script Argument Handling Inconsistency

The main script's case statement duplicates argument handling already present in the parse_args function, leading to inconsistent behavior:

• --inspect and --ps are handled directly, causing other arguments (e.g., -v) to be silently ignored when combined.
• --help is processed twice.

claude-yolo#L122-L137

https://github.com/lroolle/claude-code-yolo/blob/8dada53c831ec6992ae7e2cdea1e67a81bee37d0/claude-yolo#L122-L137

Fix in Cursor

---

BugBot free trial expires on July 22, 2025
You have used $0.00 of your $10.00 spend limit so far. Manage your spend limit in the Cursor dashboard.

Was this report helpful? Give feedback by reacting with 👍 or 👎