fix: inherit shell environment for Claude Code CLI authentication #8323
Conversation
- Added extendEnv: true to execa options to inherit shell environment variables - Added shell: true to ensure proper environment variable expansion - This ensures ANTHROPIC_API_KEY and other auth tokens are available to Claude CLI - Added tests to verify environment variable inheritance Fixes #8322
dosubot
bot
added
size:M
![roomote[bot]](https://avatars.githubusercontent.com/in/1546624?s=60&v=4){kind=small}
| // shell: true - Ensures proper environment variable expansion for authentication tokens | ||
| // Without these, Claude CLI fails with "Invalid API key" even when properly authenticated | ||
| extendEnv: true, | ||
| shell: true, |
There was a problem hiding this comment.
P1 (High) — Enabling shell: true here can introduce shell injection and quoting issues because arguments include user-provided content (e.g., --system-prompt from the UI). It can also behave differently across platforms (cmd.exe vs bash). Environment inheritance does not require a shell. Suggest avoiding a shell and, if tilde or $VAR expansion is desired for a user-supplied binary path, normalize it in code instead of relying on the shell.
| shell: true, | |
| shell: false, |
| // extendEnv: true - Inherits parent process environment variables including ANTHROPIC_API_KEY | ||
| // shell: true - Ensures proper environment variable expansion for authentication tokens | ||
| // Without these, Claude CLI fails with "Invalid API key" even when properly authenticated | ||
| extendEnv: true, |
There was a problem hiding this comment.
P2 (Medium) — extendEnv: true is redundant here. You already provide env: { ...process.env, ... } and execa defaults extendEnv to true. Consider removing this to reduce confusion and keep the contract behavioral (inherit parent env via env spread) rather than configuration-based.
| expect(execaOptions.extendEnv).toBe(true) | ||
|
|
||
| // Should use shell to ensure proper environment variable expansion | ||
| expect(execaOptions.shell).toBe(true) |
There was a problem hiding this comment.
P2 (Medium) — This test asserts implementation detail (shell: true) rather than behavior. Prefer asserting that the child process receives the needed secrets from the environment (e.g., ANTHROPIC_API_KEY). This will keep the test robust if we later remove shell for security.
| expect(execaOptions.shell).toBe(true) | |
| expect(execaOptions.env.ANTHROPIC_API_KEY).toBe("test-api-key-12345") |
hannesrudolph
added
the
Issue/PR - Triage
|
When is it going live? I purchased a subscription to use it with roo, and it stays idle for a week already |
Description
This PR attempts to address Issue #8322 where the Claude Code provider fails with "Invalid API key" despite having a properly authenticated Claude CLI.
Problem
The Claude Code provider was unable to access environment variables (particularly ANTHROPIC_API_KEY) from the user's shell environment when spawning the Claude CLI process. This caused authentication failures even when the CLI worked perfectly when called directly from the terminal.
Solution
Added two critical options to the execa call when spawning the Claude CLI process:
extendEnv: true- Ensures the child process inherits parent environment variablesshell: true- Enables proper environment variable expansionThese changes allow the Claude CLI subprocess to access authentication tokens that are set in the parent process environment.
Changes
src/integrations/claude-code/run.tsto add environment inheritance optionsTesting
Impact
This fix enables users with Claude CLI subscription tokens to use the Claude Code provider without needing to configure an Anthropic API key separately in Roo Code.
Fixes #8322
Feedback and guidance are welcome!
Important
Fixes environment variable inheritance for Claude Code CLI authentication by modifying
execaoptions inrun.ts.run.tsby settingextendEnv: trueandshell: trueinexecacall.run.spec.tsto verify environment variable inheritance and correct setting ofCLAUDE_CODE_MAX_OUTPUT_TOKENS.run.tsexplaining the necessity ofextendEnvandshelloptions for authentication.This description was created by
for a4b0bc0. You can customize this summary. It will automatically update as commits are pushed.