Repository navigation
Fix Claude Keychain credential selection - #31
Merged
Merged
Conversation
readClaudeCredentials() runs, with no account specified:
security find-generic-password -s "Claude Code-credentials" -w
More than one Keychain item can share that service name. Attaching an MCP
server in an OpenCode session writes a second item under it, with
acct="unknown", holding only mcpOAuth. `security` returns the first match, so
the bridge can read that item, find no claudeAiOauth, and have getClaudeTokens
return null.
It then falls through to opencode's own OAuth entry, and when that entry is
stale the user sees "Token refresh failed (400): invalid_grant" on every new
session while their actual Claude credential is valid the entire time. Neither
re-authenticating nor `claude login` fixes it, because neither touches the item
being read.
Observed on a machine carrying both items:
unscoped lookup -> acct="unknown", keys ["mcpOAuth"]
scoped to the account -> keys ["claudeAiOauth", "mcpOAuth"]
Three changes:
- Look the item up scoped to userInfo().username first, then fall back to the
historical unscoped lookup, so anyone whose item lives under a different
account name keeps working exactly as before.
- Select on content rather than on match order. A returned item that carries no
claudeAiOauth is not the credential, whichever account it belongs to. The
selection is a pure exported function so it can be tested without a Keychain.
- When the Keychain produced matches but none carried claudeAiOauth, fall
through to ~/.claude/.credentials.json instead of returning that item. The
old code returned it, which made the file fallback below it unreachable.
Also switches to execFileSync with an argument array. The account name is
user-controlled and should not be interpolated into a shell command line, and
the array form removes the need for the embedded 2>/dev/null redirection.
Adds four unit tests for the selection logic; there was no keychain coverage.
Verified: full suite 114 pass / 0 fail. On a machine with both items,
readClaudeCredentials() returns the mcpOAuth-only item before this change and
the real credential after it.
Signed-off-by: Mike Hiltz <mike@ildan.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
claudeAiOauthexecFileSyncto avoid shell command interpolationSupersedes #30 after rebasing its reviewed change onto #19. Fixes #29.
Verification