Fix Claude plugin auth compatibility across custom OAuth and keychain setups#331
Fix Claude plugin auth compatibility across custom OAuth and keychain setups#331robinebers wants to merge 2 commits intomainfrom
Conversation
🤖 Augment PR SummarySummary: This PR improves Claude plugin authentication compatibility across custom config locations and multiple OAuth environments, and strengthens host-side redaction/logging around those auth flows. Changes:
Technical Notes: Live usage fetch is skipped for “inference-only” env-injected tokens, but 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| accessToken = refreshed | ||
| } else { | ||
| ctx.host.log.warn("proactive refresh failed, trying with existing token") | ||
| const homePath = getClaudeHomeOverride(ctx) |
There was a problem hiding this comment.
homePath is taken directly from CLAUDE_CONFIG_DIR and passed through to ccusage, but the Rust ccusage wrapper sets the env var without ~ expansion (unlike host.fs.* paths). If a user sets CLAUDE_CONFIG_DIR=~/.claude-custom, credential reads may work while ccusage queries silently point at a non-existent directory.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| let old = std::env::var(name).ok(); | ||
| let _restore = RestoreEnvVar { name, old }; | ||
| // SAFETY: this test restores the previous value in `Drop`. | ||
| unsafe { std::env::set_var(name, "openusage-test-user") }; |
There was a problem hiding this comment.
This test mutates the process-wide USER env var and assumes env changes are “serialized”, but Rust tests run in parallel by default so this can be flaky and/or leak into other tests. If any other test reads USER concurrently, results can become nondeterministic.
Severity: low
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
1 participant
Summary
ccusage, and include theuser:file_uploadscopeTesting
Note
Medium Risk
Touches OAuth credential discovery/refresh and macOS keychain read/write behavior, which can break authentication or usage reporting across environments if misconfigured. Adds broader env passthrough and more logging/redaction logic, increasing configuration surface area but with regression tests to reduce risk.
Overview
Improves the Claude plugin’s auth compatibility by supporting
CLAUDE_CONFIG_DIRfor credential file lookup andccusagehome overrides, env-injected access tokens viaCLAUDE_CODE_OAUTH_TOKEN(treated as inference-only and skips live/api/oauth/usage), and expanded refresh scopes to includeuser:file_upload.Adds flexible OAuth routing for local/staging/custom endpoints and client ID overrides, and namespaces keychain service names with an OAuth suffix to avoid collisions. On the Rust side, expands the host env allowlist for these Claude variables, fixes macOS keychain access to always target the current account (and logs hits/misses), and strengthens redaction to cover additional IDs and filesystem paths (including redacting
app_data_dirandccusagerunner paths).Written by Cursor Bugbot for commit cc1d180. This will update automatically on new commits. Configure here.
Summary by cubic
Fixes Claude plugin auth across custom config dirs and custom/staging/local OAuth, with account-scoped keychain and broader redaction. Adds env token support, includes the
user:file_uploadscope, and skips live usage when tokens lackuser:profile.New Features
CLAUDE_CONFIG_DIR; pass and expand home path to ccusage.CLAUDE_CODE_OAUTH_TOKENfor inference-only sessions; skip live usage when missinguser:profile.user:file_uploadin OAuth refresh scope.Bug Fixes
CLAUDE_CONFIG_DIR,USE_LOCAL_OAUTH,CLAUDE_LOCAL_OAUTH_API_BASE,CLAUDE_CODE_OAUTH_CLIENT_ID); sensitive values redacted.app_data_dirand ccusage paths masked as [PATH].Written for commit cc1d180. Summary will update on new commits.