feat(provider): re-authenticate Claude from within T3 Code#4151
Open
sideeffffect wants to merge 5 commits into
Open
feat(provider): re-authenticate Claude from within T3 Code#4151sideeffffect wants to merge 5 commits into
sideeffffect wants to merge 5 commits into
Conversation
When Claude Code's OAuth token expires mid-turn ("Failed to authenticate.
API Error: 401 OAuth access token has expired. Re-authenticate to
continue.") the only way to recover was to leave T3 Code and run the login
command in an external shell. This adds an in-app re-authentication path.
- contracts: add an optional ServerProviderReauthentication descriptor on
ServerProvider (command / executable / args / label). Additive and
back-compat: legacy producers omit it and consumers hide the action.
- server: the Claude provider advertises "claude setup-token", resolved to
the instance's configured binary, on its installed snapshots so custom
binaries re-authenticate the same executable they run.
- web: the thread error banner (on auth-looking turn failures) and the
provider status banner (when a provider reports "unauthenticated") offer a
"Re-authenticate" action that runs the login command in the thread's
integrated terminal, reusing the proven project-script launcher. The user
completes the interactive OAuth prompt (open URL, paste code) in-app.
Docs (docs/providers/claude.md) and tests (contracts + provider snapshot)
included.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
vouch:unvouched
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
Contributor
ApprovabilityVerdict: Needs human review This PR adds a new user-facing feature: in-app re-authentication for Claude providers via new UI buttons, contract types, and terminal integration. New features introducing new workflows and user-facing behavior warrant human review to ensure the implementation meets design expectations. You can customize Macroscope's approvability policy. Learn more. |
Resolves the Cursor Bugbot / Macroscope review findings on pingdotgg#4151: - Propagate CLAUDE_CONFIG_DIR (High): the re-authentication descriptor now carries an optional `env` map, and the Claude provider fills it with the instance's resolved home (via resolveClaudeHomePath) when a custom home is configured. The web launcher layers it onto the terminal env, so `setup-token` refreshes the correct instance's credentials instead of the default config dir. Adds contract + provider tests. - Pending snapshot exposes re-auth (Medium): makePendingClaudeProvider now attaches the descriptor, so a turn failing before the first status check still offers the recovery action. - Target the failing instance (Medium): the thread error banner resolves the re-auth provider from the thread session's providerInstanceId (the one that produced lastError), not the composer's currently-selected provider. - Tighten auth-error heuristic (Medium): isProviderAuthError now matches credential-specific phrasing instead of bare 401/403/oauth/api-key substrings that also appear in generic tool/HTTP failures. - Shell-quote the command (Low): the login command line is POSIX-quoted so a configured binary path with spaces is not word-split when pasted.
…s the POSIX single-quoting added in the previous commit: it broke && other shells the integrated terminal may use — cmd.exe treats single quotes && as literal (word-splitting a spaced path), and single quotes suppress ~ && expansion in bash/zsh. No single pre-joined string is correct across all of && them, so `command` is now a plain space-join optimized for the common && `claude`/PATH (and unquoted-path) case, with `executable`/`args` exposed && separately for callers needing exact argv.
# Conflicts: # apps/server/src/provider/Layers/ClaudeProvider.ts
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 464b68d. Configure here.
…es && Addresses a Bugbot finding: checkClaudeProviderStatus omitted the && reauthentication descriptor on its installed error/timeout snapshots && (version-probe timeout, non-zero exit, and the installed branch of a && version-probe failure), so the in-app Re-authenticate action was hidden in && exactly the recoverable states where an expired credential is a likely && cause. Attach reauthentication to those installed:true snapshots; the && missing-binary case still omits it (a CLI that isn't installed can't be && re-authenticated). Extends the two existing error-path tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When Claude Code's OAuth token expires, a turn fails with:
Today the only way to recover is to leave T3 Code, open a shell, and run the
Claude login command by hand. There is no way to trigger and finish the
authentication flow from within the app.
What this does
Adds an in-app Re-authenticate action for Claude:
Re-authenticate button.
unauthenticated, the provider status bannershows the same button (previously it only said "Sign in via the CLI to
authenticate again." — a dead end). This generalizes to any provider that
advertises a re-auth command.
Clicking it opens the thread's integrated terminal and runs
claude setup-tokenfor that provider — using the instance's configuredbinary and Claude HOME — so the interactive OAuth prompt (open URL, paste the
authorization code) is completed entirely inside T3 Code. No external shell.
How it works
packages/contracts/src/server.ts): new optionalServerProviderReauthenticationdescriptor (command/executable/args/label) onServerProvider. Additive and back-compat — legacyproducers omit it and consumers simply hide the action.
ClaudeProvider.ts,providerSnapshot.ts): the Claude provideradvertises
claude setup-token(resolved to the configuredbinaryPath) onits installed snapshots, threaded through
buildServerProvider.ProviderStatusBanner,ThreadErrorBanner,ChatView): render theaction and run the command by reusing the existing project-script terminal
launcher (open/reuse a terminal, focus it, write the command). A fresh
terminal is preferred so the OAuth prompt does not collide with an in-flight
shell.
claude setup-tokenwas chosen because it is the supported interactive loginfor the CLI/SDK model T3 Code already uses and produces a fresh long-lived
token.
Tests / checks
pnpm typecheck— clean.pnpm lint— 0 errors, no new warnings.pnpm fmt:check— clean.(
server.test.ts) and the Claude snapshot exposing it(
ProviderRegistry.test.ts). Touched suites pass (contracts 5/5, serverprovider registry 36/36, web ChatView logic 22/22).
Notes / scope
the web UI; mobile is unaffected (it only reads
auth.status).attempted here: Claude Code's local init still succeeds with cached
credentials, so the reliable signal is the runtime 401, which is exactly
where the thread-error-banner button appears. The status-banner button covers
providers that do report
unauthenticated.this environment; the launch reuses the already-shipping project-script path.
Docs:
docs/providers/claude.mdgains a short "My Claude Login Expired"section.
Note
Medium Risk
Touches credential recovery and runs CLI login commands in the integrated terminal, but changes are additive, instance-scoped, and gated by heuristics and provider descriptors rather than altering core auth enforcement.
Overview
Introduces an optional
ServerProviderReauthenticationdescriptor on provider snapshots so clients can launch a provider-specific login command in the integrated terminal.Claude now advertises
claude setup-token(respecting configured binary andCLAUDE_CONFIG_DIRfor custom homes) on installed and pending snapshots, but not when the CLI is missing.ChatViewwires Re-authenticate on the provider status banner (unauthenticated) and thread error banner (narrow auth-error heuristic), targeting the thread session’s provider instance and reusing the project-script terminal launcher with optional env overrides.Contracts, snapshot building, UI banners, and docs/tests are updated for back-compat and the new flow.
Reviewed by Cursor Bugbot for commit 530ad24. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Add in-app Claude re-authentication via
claude setup-tokenin the integrated terminalServerProviderReauthenticationschema to the contracts layer, carrying the command, executable, args, label, and optional env needed to re-authenticate a provider.checkClaudeProviderStatusandmakePendingClaudeProvidernow include a reauthentication descriptor in all Claude provider snapshots except when the CLI binary is missing.ProviderStatusBannerrenders aMacroscope summarized 530ad24.