agentradar-cli 0.1.5 → 0.1.7

package/README.md

@@ -19,4 +19,4 @@ There is a `--trust` flag for unattended runners, where a launch prompt would ha
 
 The skill command installs only the package-bundled `agentradar-vendor` markdown skill at `.claude/skills/agentradar-vendor/SKILL.md` in the current project. It does not fetch or require access to the private AgentRadar repository.
 
-Claude authentication stays separate. Preferred: use interactive `/login` with the vendor's claude.ai account. A `CLAUDE_CODE_OAUTH_TOKEN` may be stored in the private runner env file when non-interactive Claude authentication is required; the supervisor stages it into a mode-`0600` runtime file before launch. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set.
+Claude authentication stays separate. On macOS, the runner reuses the vendor's existing Claude Code OAuth login by extracting only `claudeAiOauth.accessToken` from the `Claude Code-credentials` Keychain item into a mode-`0600` runtime file; it never copies the credential profile into the isolated config. An explicit `CLAUDE_CODE_OAUTH_TOKEN` in the private runner env remains supported and takes precedence. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set.

package/dist/setup.js

@@ -205,7 +205,7 @@ export async function setupVendorAgent(deps = {}) {
             : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
-        log("Claude Code will use your existing /login session. ANTHROPIC_API_KEY is prohibited; a securely stored CLAUDE_CODE_OAUTH_TOKEN is also supported.");
+        log("On macOS the runner uses your existing Claude Code Keychain OAuth credential; an explicit CLAUDE_CODE_OAUTH_TOKEN is also supported. ANTHROPIC_API_KEY is prohibited.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -51,10 +51,10 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-# CLAUDE_CODE_OAUTH_TOKEN is OPTIONAL. If SET → claude uses the setup-token (bills "API Usage",
-# subject to the org spend cap). If UNSET → claude falls through to SUBSCRIPTION OAuth (keychain login,
-# a one-time `/login`) → draws on the Max plan's included usage. Either way it's claude.ai auth only —
-# ANTHROPIC_API_KEY is still hard-refused below (never a pay-as-you-go key).
+# CLAUDE_CODE_OAUTH_TOKEN is an OPTIONAL explicit override. When unset on macOS, section 2b extracts
+# claudeAiOauth.accessToken from Claude Code's existing Keychain credential into the same private-file
+# handoff. With neither source, Claude uses its normal interactive auth path. ANTHROPIC_API_KEY remains
+# hard-refused below.
 : "${CLAUDE_CODE_OAUTH_TOKEN:=}"
 : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
@@ -135,16 +135,26 @@ _BEARER_FILE="${_SECRETS_DIR}/awp_bearer"
 ( umask 077; printf '%s' "${AWP_BEARER}" > "${_BEARER_FILE}" )
 AWP_BEARER_FILE="${_BEARER_FILE}"
 unset AWP_BEARER   # drop from the supervisor's exported env → feeder no longer inherits it; ps eww clean
-# OAuth setup-token: same treatment. `set -a; . ENV_FILE` EXPORTS CLAUDE_CODE_OAUTH_TOKEN into the
-# supervisor env, from which the feeder (spawned WITHOUT env -i) would inherit it → ps eww leak. So when
-# it's set, stage it to a 0600 file and UNSET the raw var here (mirror of the bearer). ensure_agent then
-# passes ONLY AR_OAUTH_TOKEN_FILE (the path) on the scrubbed env -i line, and the sh wrapper reads it into
-# claude's env just before exec. When UNSET (subscription-login mode) _OAUTH_TOKEN_FILE stays empty → the
-# claude launch is a pure no-op and falls through to subscription OAuth (no API-billing regression).
-_OAUTH_TOKEN_FILE=""
+# OAuth token: same treatment. An explicit CLAUDE_CODE_OAUTH_TOKEN still wins. Otherwise, on macOS,
+# Claude Code stores a JSON credential in the "Claude Code-credentials" Keychain item; the env contract
+# needs only its claudeAiOauth.accessToken scalar, not that whole JSON copied into .credentials.json.
+# Pipe Keychain → plutil → a 0600 file so the token never appears in logs, argv, or this supervisor's env.
+_OAUTH_TOKEN_FILE="${_SECRETS_DIR}/oauth_token"
 if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
-  _OAUTH_TOKEN_FILE="${_SECRETS_DIR}/oauth_token"
   ( umask 077; printf '%s' "${CLAUDE_CODE_OAUTH_TOKEN}" > "${_OAUTH_TOKEN_FILE}" )
+elif [ "$(uname -s)" = "Darwin" ] && [ -x /usr/bin/security ] && [ -x /usr/bin/plutil ]; then
+  _OAUTH_TOKEN_TMP="${_OAUTH_TOKEN_FILE}.$$"
+  if ( umask 077; /usr/bin/security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null \
+      | /usr/bin/plutil -extract claudeAiOauth.accessToken raw -o "${_OAUTH_TOKEN_TMP}" - 2>/dev/null ) \
+      && [ -s "${_OAUTH_TOKEN_TMP}" ]; then
+    mv "${_OAUTH_TOKEN_TMP}" "${_OAUTH_TOKEN_FILE}"
+    log "loaded Claude Code OAuth credential from macOS Keychain"
+  else
+    rm -f "${_OAUTH_TOKEN_TMP}"
+    _OAUTH_TOKEN_FILE=""
+  fi
+else
+  _OAUTH_TOKEN_FILE=""
 fi
 unset CLAUDE_CODE_OAUTH_TOKEN   # out of the supervisor+feeder env (ps eww); staged to the 0600 file above
 # Vendor MCP-tool creds (#166): the agent's OWN tool API keys (WEBFLOW_TOKEN, PERPLEXITY_API_KEY, …) were
@@ -238,12 +248,10 @@ ensure_agent() {
   # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
   # shellcheck disable=SC2086
   _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
-  # OAuth setup-token (#152): the token was already staged to a 0600 file + UNSET from this env in section
-  # 2b (so it's off both the supervisor+feeder env / ps eww). Here we only pass AR_OAUTH_TOKEN_FILE (a PATH,
-  # not the secret) on the env -i line — so the token is NOT in the `env`/claude argv (`ps aux`) either. The
-  # wrapper below reads the file into CLAUDE_CODE_OAUTH_TOKEN just before exec'ing claude. When it was UNSET
-  # (subscription-login mode) _OAUTH_TOKEN_FILE is empty → we pass NOTHING token-related and the wrapper's
-  # read is a no-op → claude falls through to subscription OAuth exactly as before. bash 3.2-safe array form.
+  # OAuth (#152): section 2b staged either the explicit token or the macOS Keychain accessToken into a
+  # 0600 file and kept the value out of the supervisor+feeder env. Here we pass only that file PATH through
+  # env -i; the wrapper reads CLAUDE_CODE_OAUTH_TOKEN immediately before exec'ing Claude. If neither source
+  # exists, _OAUTH_TOKEN_FILE is empty and Claude falls back to its normal interactive auth path.
   _oauth_env=()
   [ -n "${_OAUTH_TOKEN_FILE}" ] && _oauth_env=( AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" )
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
@@ -307,8 +315,8 @@ log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
 # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
 # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
 AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" \
-  node "${FEEDER_JS}" &
+  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
+  AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" node "${FEEDER_JS}" &
 FEEDER_PID=$!
 log "feeder pid ${FEEDER_PID}"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {