Summary

opensre onboard fails to complete Claude Code CLI provider setup on macOS when the user is authenticated via macOS Keychain (after claude login). The wizard incorrectly treats uncertain auth state as a failure and offers no path to proceed.

Expected vs actual behavior

Expected: When claude binary is installed and functional (verified by successful claude -p invocation), onboarding should proceed regardless of whether ANTHROPIC_API_KEY or ~/.claude/.credentials.json is present.

Actual: Wizard prints "ANTHROPIC_API_KEY not set and ~/.claude/.credentials.json absent; macOS may use Keychain — auth state unclear" and loops on a recovery menu with only two options: "Re-detect after logging in" or "Pick a different LLM provider". No way to proceed even though claude -p works perfectly.

Steps to reproduce

1. On macOS, run claude login and authenticate via browser (OAuth — no API key)
2. Verify claude -p "ping" works (exit 0)
3. Run opensre onboard → Advanced → Local machine
4. Select "Anthropic Claude Code CLI" as LLM provider
5. Wizard loops on auth failure menu with no way to continue

Root cause (code)

• _classify_claude_code_auth() in app/integrations/llm_cli/claude_code.py:64–68 correctly returns (None, ...) for macOS Keychain case — uncertain, not definitively unauthenticated
• _run_cli_llm_onboarding() in app/cli/wizard/flow.py:1648 checks probe.logged_in is not True, which catches both False and None — both hit the same blocking recovery menu
• Wizard never attempts a live claude -p invocation to verify Keychain auth

Can you reproduce it consistently?

Yes

How often does it occur?

Every time (on macOS with Keychain-based Claude Code auth)

Operating system

macOS

Logs and error output

ANTHROPIC_API_KEY not set and ~/.claude/.credentials.json absent; macOS may use Keychain — auth state unclear, invocation will verify.
? Could not verify Anthropic Claude Code CLI login. What next? Re-detect after logging in
ANTHROPIC_API_KEY not set and ~/.claude/.credentials.json absent; macOS may use Keychain — auth state unclear, invocation will verify.
? Could not verify Anthropic Claude Code CLI login. What next? Pick a different LLM provider

Additional context

Verified that claude -p "reply with just: ok" exits 0 with correct output in the same environment where onboarding fails — confirming Keychain auth is valid and the block is a false negative.