Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions src/integrations/claude-code/__tests__/run.spec.ts
Original file line number Diff line number Diff line change
Expand Up @@ -518,4 +518,61 @@ describe("runClaudeCode", () => {
// Should throw ClaudeCodeNotFoundError, not generic exit code error
await expect(generator.next()).rejects.toThrow(/errors\.claudeCode\.notFound/)
})

test("should inherit environment variables for authentication", async () => {
const { runClaudeCode } = await import("../run")

// Set a test environment variable
process.env.ANTHROPIC_API_KEY = "test-api-key-12345"

const options = {
systemPrompt: "You are a helpful assistant",
messages: [{ role: "user" as const, content: "Hello" }],
}

const generator = runClaudeCode(options)

// Consume at least one item to trigger process spawn
await generator.next()

// Clean up the generator
await generator.return(undefined)

// Verify execa was called with proper environment options
const [, , execaOptions] = mockExeca.mock.calls[0]

// Should have extendEnv set to true to inherit environment
expect(execaOptions.extendEnv).toBe(true)

// Should use shell to ensure proper environment variable expansion
expect(execaOptions.shell).toBe(true)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 (Medium) — This test asserts implementation detail (shell: true) rather than behavior. Prefer asserting that the child process receives the needed secrets from the environment (e.g., ANTHROPIC_API_KEY). This will keep the test robust if we later remove shell for security.

Suggested change
expect(execaOptions.shell).toBe(true)
expect(execaOptions.env.ANTHROPIC_API_KEY).toBe("test-api-key-12345")


// Should still include process.env
expect(execaOptions.env).toBeDefined()

// Clean up
delete process.env.ANTHROPIC_API_KEY
})

test("should pass CLAUDE_CODE_MAX_OUTPUT_TOKENS in environment", async () => {
const { runClaudeCode } = await import("../run")

const options = {
systemPrompt: "You are a helpful assistant",
messages: [{ role: "user" as const, content: "Hello" }],
maxOutputTokens: 32000,
}

const generator = runClaudeCode(options)

// Consume at least one item to trigger process spawn
await generator.next()

// Clean up the generator
await generator.return(undefined)

// Verify the environment variable was set correctly
const [, , execaOptions] = mockExeca.mock.calls[0]
expect(execaOptions.env.CLAUDE_CODE_MAX_OUTPUT_TOKENS).toBe("32000")
})
})
6 changes: 6 additions & 0 deletions src/integrations/claude-code/run.ts
Original file line number Diff line number Diff line change
Expand Up @@ -191,6 +191,12 @@ function runProcess({
process.env.CLAUDE_CODE_MAX_OUTPUT_TOKENS ||
CLAUDE_CODE_DEFAULT_MAX_OUTPUT_TOKENS.toString(),
},
// IMPORTANT: These options are critical for Claude CLI authentication
// extendEnv: true - Inherits parent process environment variables including ANTHROPIC_API_KEY
// shell: true - Ensures proper environment variable expansion for authentication tokens
// Without these, Claude CLI fails with "Invalid API key" even when properly authenticated
extendEnv: true,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 (Medium) — extendEnv: true is redundant here. You already provide env: { ...process.env, ... } and execa defaults extendEnv to true. Consider removing this to reduce confusion and keep the contract behavioral (inherit parent env via env spread) rather than configuration-based.

shell: true,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 (High) — Enabling shell: true here can introduce shell injection and quoting issues because arguments include user-provided content (e.g., --system-prompt from the UI). It can also behave differently across platforms (cmd.exe vs bash). Environment inheritance does not require a shell. Suggest avoiding a shell and, if tilde or $VAR expansion is desired for a user-supplied binary path, normalize it in code instead of relying on the shell.

Suggested change
shell: true,
shell: false,

cwd,
maxBuffer: 1024 * 1024 * 1000,
timeout: CLAUDE_CODE_TIMEOUT,
Expand Down
Loading