pydantic-claude-code 0.6.0__tar.gz → 0.6.2__tar.gz

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/.github/workflows/ci.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         include:
           - os: macos-latest
             python-version: "3.14"

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pydantic-claude-code
-Version: 0.6.0
+Version: 0.6.2
 Summary: Use your Claude Code subscription from a Pydantic AI Agent or CLAI2, with full tool support
 Project-URL: Repository, https://github.com/mpfaffenberger/pydantic-ai-claude-code
 Project-URL: Homepage, https://pypi.org/project/pydantic-claude-code/
@@ -10,14 +10,16 @@ License-File: LICENSE
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Requires-Python: <3.15,>=3.11
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: <3.15,>=3.10
 Requires-Dist: keyring<26,>=23
 Requires-Dist: pydantic-ai-slim[anthropic]<3,>=2.31.0
 Provides-Extra: clai2
-Requires-Dist: pydantic-clai2>0.52.0; extra == 'clai2'
+Requires-Dist: pydantic-clai2>=0.53.0; extra == 'clai2'
 Provides-Extra: dev
 Requires-Dist: pyright>=1.1.400; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.1; extra == 'dev'
@@ -65,7 +67,7 @@ One line installs the latest release of the plugin, and running it again updates
 curl -fsSL https://raw.githubusercontent.com/mpfaffenberger/pydantic-ai-claude-code/main/install.sh | sh
 ```
 
-To pin a release, pass its tag (`... | sh -s -- v0.6.0`), or pass `main` for
+To pin a release, pass its tag (`... | sh -s -- v0.6.2`), or pass `main` for
 unreleased changes. The script downloads that version of this repo and copies the `src/pydantic_ai_claude_code` folder into CLAI2's
 plugins folder as `claude_code`, replacing any older copy. Nothing to
 `pip install`: everything the plugin imports (`pydantic-ai` with Anthropic
@@ -94,26 +96,31 @@ one-liner to update. Being offline is silent. Set `CLAUDE_CODE_NO_UPDATE_CHECK=1
 to turn the check off.
 
 **CLAI2 version:** the plugin is a class-based CLAI2 `Plugin`
-([pydantic/pydantic-ai#9493](https://github.com/pydantic/pydantic-ai/pull/9493),
-merged), so it needs a CLAI2 built from pydantic-ai `main` at or after that
-commit; no `pydantic-clai2` release has it yet (0.52.0 is the latest). Plugin
-0.5.0 was the last `activate(host)` plugin, for CLAI2 `main` before #9493. Until
-a release is out, run CLAI2 from pydantic-ai's `main`:
+([pydantic/pydantic-ai#9493](https://github.com/pydantic/pydantic-ai/pull/9493)),
+which needs `pydantic-clai2` 0.53.0 or later, on Python 3.10 to 3.14. Run it
+without installing anything:
 
 ```bash
-git clone https://github.com/pydantic/pydantic-ai
-cd pydantic-ai
-uv run clai2
+uvx --from pydantic-clai2 clai2
 ```
 
+(The PyPI package is `pydantic-clai2`; plain `uvx clai2` looks for a package
+named `clai2`, which does not exist.) Plugin 0.5.0 was the last `activate(host)`
+plugin, for CLAI2 `main` before #9493.
+
 Or install it as a package instead, into CLAI2's environment, and point CLAI2
 at it: `uv tool install pydantic-clai2 --with pydantic-claude-code`, then
 `/plugins add claude_code pydantic_ai_claude_code`.
 
+
 ### Sign in
 
 Run `/login claude`. Your browser opens Claude's sign-in page, and CLAI2
-prints the URL in case it doesn't. Or open the settings menu with `/claude_code`
+prints the URL in case it doesn't. On a machine whose browser can't reach CLAI2
+(over SSH, or a remote box), open that URL on any machine and sign in. The
+browser then ends on a `http://localhost:.../callback?code=...` page that fails
+to load; copy that whole address and paste it at CLAI2's prompt, then press
+Enter. CLAI2 counts the characters instead of echoing the code. Or open the settings menu with `/claude_code`
 (or `C` on the plugin in `/plugins`), choose **Sign-in**, and press Enter.
 
 ### Pick a model
@@ -305,7 +312,7 @@ uv run pytest
 
 To release, bump `version` in `pyproject.toml` and `__version__` in
 `src/pydantic_ai_claude_code/__init__.py` (a test checks they match), merge, and
-push a matching tag (`git tag v0.6.0 && git push origin v0.6.0`). The `Publish` workflow tests,
+push a matching tag (`git tag v0.6.2 && git push origin v0.6.2`). The `Publish` workflow tests,
 builds, and uploads it to PyPI with the `PYPI_API_TOKEN` repository secret.
 
 The tests never touch your real keychain or token file. They run against a

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/README.md

@@ -38,7 +38,7 @@ One line installs the latest release of the plugin, and running it again updates
 curl -fsSL https://raw.githubusercontent.com/mpfaffenberger/pydantic-ai-claude-code/main/install.sh | sh
 ```
 
-To pin a release, pass its tag (`... | sh -s -- v0.6.0`), or pass `main` for
+To pin a release, pass its tag (`... | sh -s -- v0.6.2`), or pass `main` for
 unreleased changes. The script downloads that version of this repo and copies the `src/pydantic_ai_claude_code` folder into CLAI2's
 plugins folder as `claude_code`, replacing any older copy. Nothing to
 `pip install`: everything the plugin imports (`pydantic-ai` with Anthropic
@@ -67,26 +67,31 @@ one-liner to update. Being offline is silent. Set `CLAUDE_CODE_NO_UPDATE_CHECK=1
 to turn the check off.
 
 **CLAI2 version:** the plugin is a class-based CLAI2 `Plugin`
-([pydantic/pydantic-ai#9493](https://github.com/pydantic/pydantic-ai/pull/9493),
-merged), so it needs a CLAI2 built from pydantic-ai `main` at or after that
-commit; no `pydantic-clai2` release has it yet (0.52.0 is the latest). Plugin
-0.5.0 was the last `activate(host)` plugin, for CLAI2 `main` before #9493. Until
-a release is out, run CLAI2 from pydantic-ai's `main`:
+([pydantic/pydantic-ai#9493](https://github.com/pydantic/pydantic-ai/pull/9493)),
+which needs `pydantic-clai2` 0.53.0 or later, on Python 3.10 to 3.14. Run it
+without installing anything:
 
 ```bash
-git clone https://github.com/pydantic/pydantic-ai
-cd pydantic-ai
-uv run clai2
+uvx --from pydantic-clai2 clai2
 ```
 
+(The PyPI package is `pydantic-clai2`; plain `uvx clai2` looks for a package
+named `clai2`, which does not exist.) Plugin 0.5.0 was the last `activate(host)`
+plugin, for CLAI2 `main` before #9493.
+
 Or install it as a package instead, into CLAI2's environment, and point CLAI2
 at it: `uv tool install pydantic-clai2 --with pydantic-claude-code`, then
 `/plugins add claude_code pydantic_ai_claude_code`.
 
+
 ### Sign in
 
 Run `/login claude`. Your browser opens Claude's sign-in page, and CLAI2
-prints the URL in case it doesn't. Or open the settings menu with `/claude_code`
+prints the URL in case it doesn't. On a machine whose browser can't reach CLAI2
+(over SSH, or a remote box), open that URL on any machine and sign in. The
+browser then ends on a `http://localhost:.../callback?code=...` page that fails
+to load; copy that whole address and paste it at CLAI2's prompt, then press
+Enter. CLAI2 counts the characters instead of echoing the code. Or open the settings menu with `/claude_code`
 (or `C` on the plugin in `/plugins`), choose **Sign-in**, and press Enter.
 
 ### Pick a model
@@ -278,7 +283,7 @@ uv run pytest
 
 To release, bump `version` in `pyproject.toml` and `__version__` in
 `src/pydantic_ai_claude_code/__init__.py` (a test checks they match), merge, and
-push a matching tag (`git tag v0.6.0 && git push origin v0.6.0`). The `Publish` workflow tests,
+push a matching tag (`git tag v0.6.2 && git push origin v0.6.2`). The `Publish` workflow tests,
 builds, and uploads it to PyPI with the `PYPI_API_TOKEN` repository secret.
 
 The tests never touch your real keychain or token file. They run against a

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/install.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Install or update the Claude Code plugin for CLAI2, at the latest release (pass a tag such as v0.6.0, or main):
+# Install or update the Claude Code plugin for CLAI2, at the latest release (pass a tag such as v0.6.2, or main):
 #   curl -fsSL https://raw.githubusercontent.com/mpfaffenberger/pydantic-ai-claude-code/main/install.sh | sh
 set -eu
 
@@ -7,7 +7,7 @@ ref="${1:-}"
 if [ -z "$ref" ]; then
     version=$(curl -fsSL https://pypi.org/pypi/pydantic-claude-code/json | grep -o '"version": *"[^"]*"' | head -n 1 | cut -d '"' -f 4)
     if [ -z "$version" ]; then
-        echo "Could not look up the latest release on PyPI. Pass a tag (sh -s -- v0.6.0) or main." >&2
+        echo "Could not look up the latest release on PyPI. Pass a tag (sh -s -- v0.6.2) or main." >&2
         exit 1
     fi
     ref="v$version"

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pydantic-claude-code"
-version = "0.6.0"
+version = "0.6.2"
 description = "Use your Claude Code subscription from a Pydantic AI Agent or CLAI2, with full tool support"
 readme = "README.md"
-requires-python = ">=3.11,<3.15"
+requires-python = ">=3.10,<3.15"
 dependencies = [
     "keyring>=23,<26",
     "pydantic-ai-slim[anthropic]>=2.31.0,<3",
@@ -16,9 +16,11 @@ license = { text = "MIT" }
 authors = [{ name = "Michael Pfaffenberger" }]
 classifiers = [
     "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
 ]
@@ -32,11 +34,11 @@ packages = ["src/pydantic_ai_claude_code"]
 
 [tool.ruff]
 line-length = 120
-target-version = "py311"
+target-version = "py310"
 
 [tool.pyright]
 include = ["src"]
-pythonVersion = "3.11"
+pythonVersion = "3.10"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
@@ -45,9 +47,9 @@ addopts = "-q"
 
 [project.optional-dependencies]
 # Only for installing the plugin as a package; the usual install copies the package folder into CLAI2's
-# plugins folder. Either way it needs the class-based `Plugin` API, which 0.52.0 lacks:
+# plugins folder. Either way it needs the class-based `Plugin` API, first released in 0.53.0:
 # https://github.com/pydantic/pydantic-ai/pull/9493.
-clai2 = ["pydantic-clai2>0.52.0"]
+clai2 = ["pydantic-clai2>=0.53.0"]
 dev = [
     "pytest>=8.3.4",
     "pytest-asyncio>=0.23.1",
@@ -55,12 +57,3 @@ dev = [
     "pyright>=1.1.400",
 ]
 
-# Until a pydantic-clai2 release includes pydantic/pydantic-ai#9493 (class-based `Plugin`s, which also carry #9558's
-# `PluginLogin.models` and `ModelProvider.settings_from`), develop and test the plugin against #9493's merge commit on
-# main. CLAI2 pins Pydantic AI and the harness to its own build, so all four come from the same commit. Remove this
-# table once a release has it.
-[tool.uv.sources]
-pydantic-clai2 = { git = "https://github.com/pydantic/pydantic-ai", rev = "e4e0da04f0c698c5837cc7099711eebaff3f46c3", subdirectory = "src/pydantic_clai2" }
-pydantic-ai-harness = { git = "https://github.com/pydantic/pydantic-ai", rev = "e4e0da04f0c698c5837cc7099711eebaff3f46c3", subdirectory = "src/pydantic_ai_harness" }
-pydantic-ai-slim = { git = "https://github.com/pydantic/pydantic-ai", rev = "e4e0da04f0c698c5837cc7099711eebaff3f46c3", subdirectory = "pydantic_ai_slim" }
-pydantic-graph = { git = "https://github.com/pydantic/pydantic-ai", rev = "e4e0da04f0c698c5837cc7099711eebaff3f46c3", subdirectory = "pydantic_graph" }

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/src/pydantic_ai_claude_code/__init__.py

@@ -26,7 +26,7 @@ from .model import ClaudeCodeModel
 from .provider import ClaudeCodeProvider
 from .storage import ClaudeCodeTokenStore, KeyringTokenStore, default_auth_path, default_store
 
-__version__ = "0.6.0"
+__version__ = "0.6.2"
 """Matches `version` in pyproject.toml (a test checks), so a copied folder knows its release."""
 
 

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/src/pydantic_ai_claude_code/clai2.py

@@ -14,17 +14,20 @@ Plugin settings, which are plaintext SQLite, hold only the storage choice.
 from __future__ import annotations
 
 import asyncio
+import sys
 from collections.abc import Callable, Sequence
-from typing import get_args
+from typing import IO, get_args
 
 from pydantic import BaseModel, ConfigDict, Field, ValidationError
 from pydantic_ai.exceptions import UserError
 from pydantic_clai2.commands import Command
+from termflow.tui.terminal import raw_mode
 from pydantic_clai2.plugins import ModelProvider, Plugin, PluginHost, PluginLogin, SessionEnd, SessionStart, TurnEnd
+from pydantic_clai2.ui.menus.menu_worker import menu_key, run_worker
 from pydantic_clai2.ui.menus.field_menu import TERMINAL, FieldMenu, FieldRow, Runners, first_error, run_flow_async
 
 from . import __version__, config, updates
-from .flow import login
+from .flow import login, parse_pasteback
 from .model import ClaudeCodeModel
 from .provider import ClaudeCodeProvider
 from .storage import Backend, ClaudeCodeTokenStore, TokenStore, default_store
@@ -164,12 +167,55 @@ def status(source: ClaudeCodeConfig) -> str:
 
 
 async def sign_in(source: ClaudeCodeConfig, show_url: Callable[[str], None]) -> str:
-    """Sign in through the browser and save the tokens to the chosen store."""
-    await login(store=source.store(), on_url=show_url)
+    """Sign in through the browser, or a pasted redirect address, and save the tokens to the chosen store."""
+    await login(store=source.store(), on_url=show_url, read_pasteback=lambda: run_worker(read_pasted_url))
     first = config.MODELS[0]
     return f"Signed in to Claude Code. Choose a model in /add_model > {PREFIX}, or run /model {PREFIX}:{first}."
 
 
+PASTE_PROMPT = "Or paste the address your browser ended on, then Enter (Esc cancels): "
+
+
+def read_pasted_url(keys: Callable[[], str] = menu_key, output: IO[str] = sys.stdout) -> str | None:
+    """Read a pasted redirect address on one line, under the printed sign-in URL; `None` on Esc.
+
+    The address carries the authorization code, so it is counted, not echoed: a long URL would also wrap
+    and break the one-line redraw. `keys` is `run_worker`'s `menu_key`, which turns into `ctrl-c` when the
+    browser's callback wins and `login` cancels this read.
+    """
+    chars: list[str] = []
+    note = ""
+
+    def draw() -> None:
+        shown = note or (f"[{len(chars)} characters]" if chars else "")
+        output.write(f"\r\x1b[K{PASTE_PROMPT}{shown}")
+        output.flush()
+
+    with raw_mode():
+        draw()
+        while True:
+            key = keys()
+            if key in ("escape", "ctrl-c"):
+                output.write("\r\n")
+                return None
+            if key == "enter":
+                if parse_pasteback("".join(chars)) is not None:
+                    output.write("\r\n")
+                    return "".join(chars)
+                note = "no authorization code in that; paste the whole address"
+            elif key == "backspace":
+                chars[-1:] = []
+                note = ""
+            elif key == "ctrl-u":
+                chars, note = [], ""
+            elif len(key) == 1 and key.isprintable():
+                chars.append(key)
+                note = ""
+            else:
+                continue
+            draw()
+
+
 def sign_out(source: ClaudeCodeConfig) -> str:
     """Forget the stored tokens; runs with `claude-code:` models then ask to sign in again."""
     source.store().delete()
@@ -207,7 +253,8 @@ class ClaudeCodePlugin(Plugin[ClaudeCodeSettings]):
 
     def _show_url(self, url: str) -> None:
         self.host.console.print(
-            f"Opening your browser to sign in to Claude Code. If it does not open, visit:\n{url}",
+            "Opening your browser to sign in to Claude Code. If it does not open, or this machine's browser "
+            f"cannot reach it (SSH, a remote box), open this anywhere and sign in:\n{url}",
             markup=False,
             soft_wrap=True,
         )

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/src/pydantic_ai_claude_code/config.py

@@ -42,7 +42,6 @@ REDIRECT_HOST = "http://localhost"
 REDIRECT_PATH = "callback"
 CALLBACK_PORT_RANGE = (8765, 8795)
 CALLBACK_TIMEOUT = 180
-PASTEBACK_SCHEMES = ("claude://",)
 
 # Request headers that must accompany Claude Code subscription tokens. `anthropic-beta` is
 # appended (never replaced) by the auth layer so feature betas set by pydantic-ai survive.

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/src/pydantic_ai_claude_code/credentials.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import time
-from datetime import UTC, datetime
+from datetime import datetime, timezone
 
 from pydantic import BaseModel, SecretStr
 
@@ -59,7 +59,7 @@ class ClaudeCodeCredentials(BaseModel):
         expires_at = None
         if expires_in := root.get("expires_in"):
             if isinstance(expires_in, (int, float)) and not isinstance(expires_in, bool):
-                expires_at = datetime.fromtimestamp(time.time() + float(expires_in), tz=UTC)
+                expires_at = datetime.fromtimestamp(time.time() + float(expires_in), tz=timezone.utc)
         return cls(
             access_token=SecretStr(access_token),
             refresh_token=SecretStr(refresh_token),

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/src/pydantic_ai_claude_code/flow.py

@@ -1,8 +1,8 @@
 """Authorization-code PKCE flow for Claude Code credentials.
 
 The browser flow hosts a short-lived localhost callback server, the same shape as
-the Codex provider's `_REDIRECT_URI`. Both the `claude://` pasteback scheme and a
-plain localhost redirect are supported.
+the Codex provider's `_REDIRECT_URI`. When the browser cannot reach it (SSH, a remote
+box), the user can paste the address the browser ended on instead: see `read_pasteback`.
 """
 
 from __future__ import annotations
@@ -13,7 +13,7 @@ import hashlib
 import secrets
 import threading
 import webbrowser
-from collections.abc import Callable
+from collections.abc import Awaitable, Callable
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlencode
 
@@ -124,20 +124,20 @@ def _token_headers() -> dict[str, str]:
 
 
 def parse_pasteback(raw: str) -> tuple[str, str] | None:
-    """Parse a `claude://oauth/callback?...` paste back into `(code, state)`.
+    """Parse what the user pasted into `(code, state)`; `None` when it holds no authorization code.
 
-    Returns `None` when the input isn't a pasteback URL.
+    Accepts the address the browser ended on (`http://localhost:PORT/callback?code=...&state=...`, or
+    `claude://...`), just its query string, or the `code#state` form Anthropic's code page shows.
     """
-    if not raw.startswith(config.PASTEBACK_SCHEMES):
+    text = raw.strip()
+    if "?" in text or text.startswith("code="):
+        params = parse_qs(text.partition("?")[2] if "?" in text else text)
+        code, state = params.get("code", [""])[0], params.get("state", [""])[0]
+    elif "#" in text:
+        code, _, state = text.partition("#")
+    else:
         return None
-    try:
-        query = raw.partition("?")[2]
-        params = parse_qs(query)
-    except ValueError:
-        return None
-    code = params.get("code", [""])[0]
-    state = params.get("state", [""])[0]
-    if not code:
+    if not code or any(char.isspace() for char in code + state):
         return None
     return code, state
 
@@ -182,7 +182,10 @@ def _print_url(url: str) -> None:
 
 
 async def login(
-    *, store: TokenStore | None = None, on_url: Callable[[str], None] = _print_url
+    *,
+    store: TokenStore | None = None,
+    on_url: Callable[[str], None] = _print_url,
+    read_pasteback: Callable[[], Awaitable[str | None]] | None = None,
 ) -> ClaudeCodeCredentials:
     """Run the full OAuth flow and persist the minted credentials.
 
@@ -191,6 +194,10 @@ async def login(
     Args:
         store: The token store to write to. Defaults to the standard store.
         on_url: Shows the authorization URL, in case the browser does not open. Prints it by default.
+        read_pasteback: Reads the address the browser ended on, for a browser that cannot reach this
+            machine's localhost callback (SSH, a remote box). Returns `None` to cancel. Runs alongside
+            the callback, which cancels it when the browser gets through first. Without it the
+            callback is the only way in, and it times out.
 
     Returns:
         The credentials that were persisted.
@@ -198,6 +205,9 @@ async def login(
     if store is None:
         store = default_store()
     server = start_login_callback_server()
+    timeout = None if read_pasteback is not None else config.CALLBACK_TIMEOUT
+    callback = asyncio.ensure_future(asyncio.to_thread(server.received.wait, timeout))
+    paste = asyncio.ensure_future(read_pasteback()) if read_pasteback is not None else None
     try:
         redirect_uri = f"{config.REDIRECT_HOST}:{server.server_address[1]}/{config.REDIRECT_PATH}"
         flow = ClaudeCodeOAuthFlow(redirect_uri=redirect_uri)
@@ -206,9 +216,13 @@ async def login(
         # Launch the browser off the event path: on some macOS setups `webbrowser.open`
         # hangs until the UI settles, which would starve the callback wait below.
         threading.Thread(target=_open_browser, args=(url,), daemon=True).start()
-        if not await asyncio.to_thread(server.received.wait, config.CALLBACK_TIMEOUT):
+        await asyncio.wait({callback} if paste is None else {callback, paste}, return_when=asyncio.FIRST_COMPLETED)
+        if server.query is not None:
+            code, state = _parse_callback_query(server.query)
+        elif paste is not None and paste.done():
+            code, state = _pasted(paste.result())
+        else:
             raise UserError("Claude Code OAuth callback timed out.")
-        code, state = _parse_callback_query(server.query)
         if state and state != flow.state:
             raise UserError("Claude Code OAuth state mismatch; the redirect may be a replay.")
         if not code:
@@ -217,12 +231,24 @@ async def login(
     finally:
         server.shutdown()
         server.server_close()
-        # Release the waiting thread at once when the login was cancelled.
+        # Release the waiting thread at once when the login was cancelled or a paste won.
         server.received.set()
+        if paste is not None and not paste.done():
+            paste.cancel()
+        await asyncio.gather(callback, *(() if paste is None else (paste,)), return_exceptions=True)
     store.save(credentials)
     return credentials
 
 
+def _pasted(text: str | None) -> tuple[str, str]:
+    if text is None:
+        raise UserError("Claude Code sign-in cancelled.")
+    parsed = parse_pasteback(text)
+    if parsed is None:
+        raise UserError("That paste has no authorization code; copy the whole address your browser ended on.")
+    return parsed
+
+
 def _open_browser(url: str) -> None:
     try:
         webbrowser.open(url)

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/tests/test_clai2.py

@@ -36,6 +36,7 @@ from pydantic_ai_claude_code.clai2 import (
     ClaudeCodePlugin,
     ClaudeCodeSettings,
     configure,
+    read_pasted_url,
     token_store,
 )
 from pydantic_ai_claude_code.credentials import ClaudeCodeCredentials
@@ -71,13 +72,17 @@ async def run(loaded: LoadedPlugin[None], *args: str) -> str:
     return await cast(Awaitable[str], result)
 
 
-async def fake_login(*, store: TokenStore, on_url: Callable[[str], None]) -> ClaudeCodeCredentials:
+async def fake_login(
+    *, store: TokenStore, on_url: Callable[[str], None], read_pasteback: Callable[[], Awaitable[str | None]]
+) -> ClaudeCodeCredentials:
     on_url(URL)
     store.save(CREDS)
     return CREDS
 
 
-async def failing_login(*, store: TokenStore, on_url: Callable[[str], None]) -> ClaudeCodeCredentials:
+async def failing_login(
+    *, store: TokenStore, on_url: Callable[[str], None], read_pasteback: Callable[[], Awaitable[str | None]]
+) -> ClaudeCodeCredentials:
     raise UserError("Claude Code OAuth callback timed out.")
 
 
@@ -287,7 +292,7 @@ def test_rows_show_state_validate_and_reset() -> None:
 
 PACKAGE = Path(pydantic_ai_claude_code.__file__).parent
 # What CLAI2 itself installs, so a copied folder can import it: see pydantic-clai2's dependencies.
-CLAI2_PROVIDES = {"anthropic", "httpx2", "keyring", "pydantic", "pydantic_ai", "pydantic_clai2"}
+CLAI2_PROVIDES = {"anthropic", "httpx2", "keyring", "pydantic", "pydantic_ai", "pydantic_clai2", "termflow"}
 
 
 @pytest.mark.parametrize("module", sorted(PACKAGE.glob("*.py")), ids=lambda path: path.name)
@@ -345,3 +350,47 @@ async def test_clai2_runs_the_package_folder_as_a_drop_in(
     }
     assert drop_in in loaded, "the turn ran on the copied folder"
     assert "You are Claude Code" in str(messages_stub.received.get("system"))
+
+
+PASTED = "http://localhost:8765/callback?code=abc&state=xyz"
+
+
+def typing(*keys: str) -> Callable[[], str]:
+    remaining = iter(keys)
+    return lambda: next(remaining)
+
+
+def test_a_pasted_address_is_counted_not_echoed_and_returned_on_enter() -> None:
+    shown = io.StringIO()
+    assert read_pasted_url(typing("", *PASTED, "tab", "enter"), shown) == PASTED
+    assert "code=abc" not in shown.getvalue(), "the authorization code never reaches the screen"
+    assert f"[{len(PASTED)} characters]" in shown.getvalue()
+
+
+def test_a_paste_without_a_code_is_refused_and_can_be_fixed() -> None:
+    shown = io.StringIO()
+    keys = typing(*"nope", "enter", "ctrl-u", *"x", "backspace", *PASTED, "enter")
+    assert read_pasted_url(keys, shown) == PASTED
+    assert "no authorization code in that" in shown.getvalue()
+
+
+@pytest.mark.parametrize("key", ["escape", "ctrl-c"])
+def test_escape_or_a_winning_callback_ends_the_read(key: str) -> None:
+    assert read_pasted_url(typing(*"abc", key), io.StringIO()) is None
+
+
+async def test_sign_in_offers_the_paste_reader_to_login(monkeypatch: pytest.MonkeyPatch) -> None:
+    offered: list[str | None] = []
+
+    async def pasting_login(
+        *, store: TokenStore, on_url: Callable[[str], None], read_pasteback: Callable[[], Awaitable[str | None]]
+    ) -> ClaudeCodeCredentials:
+        offered.append(await read_pasteback())
+        store.save(CREDS)
+        return CREDS
+
+    monkeypatch.setattr(clai2, "login", pasting_login)
+    monkeypatch.setattr(clai2, "read_pasted_url", lambda: PASTED)
+    source = ClaudeCodeConfig(ClaudeCodeSettings(), lambda settings: None)
+    assert (await clai2.sign_in(source, print)).startswith("Signed in to Claude Code.")
+    assert offered == [PASTED]

{pydantic_claude_code-0.6.0 → pydantic_claude_code-0.6.2}/tests/test_flow.py

@@ -139,7 +139,78 @@ async def test_login_rejects_a_mismatched_state(token_stub, monkeypatch) -> None
     assert store.saved is None
 
 
-def test_parse_pasteback() -> None:
-    assert parse_pasteback("claude://oauth/callback?code=abc&state=xyz") == ("abc", "xyz")
-    assert parse_pasteback("https://example.com/callback?code=nope") is None
-    assert parse_pasteback("claude://oauth/callback") is None  # missing code
+@pytest.mark.parametrize(
+    ("pasted", "parsed"),
+    [
+        ("http://localhost:8765/callback?code=abc&state=xyz", ("abc", "xyz")),
+        ("  claude://oauth/callback?code=abc&state=xyz\n", ("abc", "xyz")),
+        ("code=abc&state=xyz", ("abc", "xyz")),
+        ("abc#xyz", ("abc", "xyz")),
+        ("http://localhost:8765/callback?state=xyz", None),
+        ("claude://oauth/callback", None),
+        ("", None),
+        ("two words", None),
+    ],
+)
+def test_parse_pasteback(pasted: str, parsed: tuple[str, str] | None) -> None:
+    assert parse_pasteback(pasted) == parsed
+
+
+def _paste_from(url: str, *, state: str | None = None) -> str:
+    """What a browser on another machine ends on: the localhost redirect, which it could not load."""
+    query = parse_qs(urlsplit(url).query)
+    return f"{query['redirect_uri'][0]}?code=pasted-code&state={state or query['state'][0]}"
+
+
+async def test_login_takes_a_pasted_address_when_the_callback_never_comes(token_stub, monkeypatch) -> None:
+    monkeypatch.setattr(flow, "_open_browser", lambda url: None)
+    shown: list[str] = []
+
+    async def paste() -> str:
+        await asyncio.sleep(0)
+        return _paste_from(shown[0])
+
+    store = _MemoryStore()
+    credentials = await flow.login(store=store, on_url=shown.append, read_pasteback=paste)
+    assert store.saved == credentials
+    assert token_stub.last_body["code"] == "pasted-code"
+    assert token_stub.last_body["redirect_uri"] == parse_qs(urlsplit(shown[0]).query)["redirect_uri"][0]
+
+
+async def test_login_cancels_the_paste_read_when_the_browser_gets_through(token_stub, monkeypatch) -> None:
+    monkeypatch.setattr(flow, "_open_browser", lambda url: None)
+    cancelled = asyncio.Event()
+
+    async def wait_for_paste() -> str | None:
+        try:
+            await asyncio.Event().wait()
+        except asyncio.CancelledError:
+            cancelled.set()
+            raise
+        return None  # pragma: no cover
+
+    await flow.login(store=_MemoryStore(), on_url=_visit_redirect_later, read_pasteback=wait_for_paste)
+    assert cancelled.is_set()
+    assert token_stub.last_body["code"] == "the-code"
+
+
+@pytest.mark.parametrize(
+    ("pasted", "error"),
+    [
+        (None, "sign-in cancelled"),
+        ("not a url", "no authorization code"),
+        ("forged", "state mismatch"),
+    ],
+)
+async def test_login_rejects_a_cancelled_empty_or_forged_paste(token_stub, monkeypatch, pasted, error) -> None:
+    monkeypatch.setattr(flow, "_open_browser", lambda url: None)
+    shown: list[str] = []
+
+    async def paste() -> str | None:
+        await asyncio.sleep(0)
+        return _paste_from(shown[0], state="forged") if pasted == "forged" else pasted
+
+    store = _MemoryStore()
+    with pytest.raises(UserError, match=error):
+        await flow.login(store=store, on_url=shown.append, read_pasteback=paste)
+    assert store.saved is None