fix: live-probe macOS Keychain auth for Claude Code CLI onboarding (#1199)#1217
Conversation
…racer-Cloud#1199) On macOS, Claude Code stores OAuth credentials in Keychain rather than ~/.claude/.credentials.json. The auth classifier correctly returned None (uncertain) for this case, but the onboarding wizard blocked on any logged_in != True, leaving no path forward for Keychain-authenticated users. Add _probe_keychain_auth() that runs `claude -p ping` with the full inherited environment when on darwin with no API key or credentials file. _classify_claude_code_auth() now accepts an optional binary_path; when provided on macOS it delegates to the live probe, returning a definitive True/False instead of None. _probe_binary() passes the resolved binary through so the wizard gets a real auth result and proceeds without requiring ANTHROPIC_API_KEY or a credentials file on disk.
Greptile SummaryReplaces the previous heuristic auth detection (env var → credentials file → macOS Keychain guess) with a proper Confidence Score: 5/5Safe to merge; all findings are P2 style/consistency nits. No P0 or P1 issues found. The two P2 findings are stale No files require special attention beyond the two minor stale-string nits in claude_code.py. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[detect] --> B[_resolve_binary]
B -->|no binary| C[CLIProbe installed=False]
B -->|binary found| D[_probe_binary]
D --> E[claude --version]
E -->|error / non-zero| F[CLIProbe installed=False]
E -->|exit 0| G[_classify_claude_code_auth binary_path]
G -->|binary_path set| H[_probe_cli_auth]
G -->|no binary_path + API key| I[True: ANTHROPIC_API_KEY]
G -->|no binary_path + creds file| J[True: credentials.json]
G -->|no binary_path + macOS| K[None: Keychain unclear]
G -->|no binary_path + Linux/Win| L[False: not authenticated]
H --> M[claude auth status]
M -->|TimeoutExpired / OSError| N[None: probe failed]
M -->|non-zero exit| O[None: command failed]
M -->|exit 0 + JSON loggedIn=false| P[False: not authenticated]
M -->|exit 0 + JSON loggedIn=true| Q[True: subscription or API key]
M -->|exit 0 + non-JSON| R[True: Claude CLI legacy]
Reviews (4): Last reviewed commit: "fix: return None for timeout and OSError..." | Re-trigger Greptile |
Replace live API ping with `claude auth status` (local, no billed tokens). Parse JSON output to get definitive loggedIn state with email in detail. Fall back to exit-code-only check for older CLI versions. Fix ruff import sort in test file.
…obe_cli_auth _classify_claude_code_auth now calls _probe_cli_auth (claude auth status) as the primary source of truth when a binary is available on any platform. Subscription login takes priority; ANTHROPIC_API_KEY is a fallback only when no binary exists. Detail message reflects actual auth method from CLI JSON output.
|
@greptileai review |
|
@greptileai review |
|
@greptileai review |
|
🌊 Merged. @devankitjuneja is now permanently woven into git history. No take-backs. 😄 👋 Join us on Discord - OpenSRE : hang out, contribute, or hunt for features and issues. Everyone's welcome. |

Fixes #1199
Describe the changes you have made in this PR
_classify_claude_code_auth()now accepts an optionalbinary_path. On macOS with no API key or credentials file, it runs a liveclaude -p pingto get a definitive auth result instead of returningNone. Added 5 tests covering the new probe paths.Demo/Screenshot
Code Understanding and AI Usage
Explain your implementation approach:
Root cause and fix are documented in #1199.
Checklist