fix: respect CLAUDE_CODE_OAUTH_TOKEN env authentication check in standalone mode

registry/coder/modules/claude-code/main.test.ts

@@ -433,6 +433,58 @@ EOF`,
     expect(startLog.stdout).toContain("--continue");
   });
 
+  test("standalone-oauth-only-does-not-create-empty-primary-api-key", async () => {
+    const { id, coderEnvVars } = await setup({
+      moduleVariables: {
+        report_tasks: "false",
+        claude_code_oauth_token: "oauth-token-123",
+      },
+    });
+
+    await execModuleScript(id, coderEnvVars);
+
+    const claudeConfig = JSON.parse(
+      await readFileContainer(id, "/home/coder/.claude.json"),
+    );
+
+    expect(claudeConfig.primaryApiKey).toBeUndefined();
+    expect(claudeConfig.hasCompletedOnboarding).toBe(true);
+    expect(
+      claudeConfig.projects["/home/coder/project"]
+        .hasCompletedProjectOnboarding,
+    ).toBe(true);
+  });
+
+  test("standalone-oauth-only-preserves-existing-primary-api-key", async () => {
+    const existingApiKey = "existing-api-key";
+    const { id, coderEnvVars } = await setup({
+      moduleVariables: {
+        report_tasks: "false",
+        claude_code_oauth_token: "oauth-token-123",
+      },
+    });
+
+    await execContainer(id, [
+      "bash",
+      "-c",
+      `cat > /home/coder/.claude.json << 'EOF'
+{"primaryApiKey":"${existingApiKey}","projects":{}}
+EOF`,
+    ]);
+
+    await execModuleScript(id, coderEnvVars);
+
+    const claudeConfig = JSON.parse(
+      await readFileContainer(id, "/home/coder/.claude.json"),
+    );
+
+    expect(claudeConfig.primaryApiKey).toBe(existingApiKey);
+    expect(claudeConfig.hasCompletedOnboarding).toBe(true);
+    expect(
+      claudeConfig.projects["/home/coder/project"].hasTrustDialogAccepted,
+    ).toBe(true);
+  });
+
   test("task-mode-ignores-manual-sessions", async () => {
     const { id } = await setup({
       moduleVariables: {

registry/coder/modules/claude-code/scripts/install.sh

@@ -180,14 +180,14 @@ function setup_claude_configurations() {
 function configure_standalone_mode() {
   echo "Configuring Claude Code for standalone mode..."
 
-  if [ -z "${CLAUDE_API_KEY:-}" ] && [ "$ARG_ENABLE_AIBRIDGE" = "false" ]; then
-    echo "Note: Neither claude_api_key nor enable_aibridge is set, skipping authentication setup"
+  if [ -z "${CLAUDE_API_KEY:-}" ] \
+    && [ -z "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] \
+    && [ "${ARG_ENABLE_AIBRIDGE:-false}" = "false" ]; then
+    echo "Note: No CLAUDE_API_KEY, no CLAUDE_CODE_OAUTH_TOKEN, and AIBridge disabled — skipping authentication setup"
     return
   fi
 
   local claude_config="$HOME/.claude.json"
-  local workdir_normalized
-  workdir_normalized=$(echo "$ARG_WORKDIR" | tr '/' '-')
 
   # Create or update .claude.json with minimal configuration for API key auth
   # This skips the interactive login prompt and onboarding screens
@@ -200,28 +200,28 @@ function configure_standalone_mode() {
         .bypassPermissionsModeAccepted = true |
         .hasAcknowledgedCostThreshold = true |
         .hasCompletedOnboarding = true |
-        .primaryApiKey = $apikey |
         .projects[$workdir].hasCompletedProjectOnboarding = true |
-        .projects[$workdir].hasTrustDialogAccepted = true' \
+        .projects[$workdir].hasTrustDialogAccepted = true |
+        if $apikey != "" then .primaryApiKey = $apikey else . end' \
       "$claude_config" > "${claude_config}.tmp" && mv "${claude_config}.tmp" "$claude_config"
   else
     echo "Creating new Claude configuration at $claude_config"
-    cat > "$claude_config" << EOF
-{
-  "autoUpdaterStatus": "disabled",
-  "autoModeAccepted": true,
-  "bypassPermissionsModeAccepted": true,
-  "hasAcknowledgedCostThreshold": true,
-  "hasCompletedOnboarding": true,
-  "primaryApiKey": "${CLAUDE_API_KEY:-}",
-  "projects": {
-    "$ARG_WORKDIR": {
-      "hasCompletedProjectOnboarding": true,
-      "hasTrustDialogAccepted": true
-    }
-  }
-}
-EOF
+    jq -n --arg workdir "$ARG_WORKDIR" --arg apikey "${CLAUDE_API_KEY:-}" \
+      '{
+        autoUpdaterStatus: "disabled",
+        autoModeAccepted: true,
+        bypassPermissionsModeAccepted: true,
+        hasAcknowledgedCostThreshold: true,
+        hasCompletedOnboarding: true,
+        projects: {
+          ($workdir): {
+            hasCompletedProjectOnboarding: true,
+            hasTrustDialogAccepted: true
+          }
+        }
+      } |
+      if $apikey != "" then . + {primaryApiKey: $apikey} else . end' \
+      > "$claude_config"
   fi
 
   echo "Standalone mode configured successfully"