/login works in the chat window

Officer authenticates claude with a Claude SUBSCRIPTION over OAuth, and that is a browser round trip: open a URL, authorise, paste a code back. It was the one part of running an agent a browser-only user could not do from the browser — the answer was "open a terminal panel and drive the CLI by hand", which works, and is a strange thing to ask of somebody whose entire session is a web page. It needs no pty. `claude auth login` behaves identically through plain pipes, verified by capturing its raw bytes, so this is an ordinary subprocess with two reads and one write: spawn, read until the URL, wait for the person, write the code to stdin. The parsing is the only non-obvious part. The CLI wraps the URL in an OSC-8 hyperlink escape AND prints it again as visible text, so `https://\S+` returns two URLs concatenated with no separator between them. Stripping the escape wrappers first leaves exactly one. Written against captured bytes rather than against what the terminal appeared to show. Three decisions worth keeping: NOT under /auth. totality.ts exempts that prefix from the permission gate entirely, and correctly — it is where a caller goes to BECOME authenticated. Mounted there, an unauthenticated POST could have started a login as the owner. Verified after moving it: unauthenticated POST /api/claude-auth is 401. On the `chat` grant rather than its own. The pairing is exact: an account that may use the agent must be able to authenticate the agent, and an account that may not has nothing to authenticate. `confined` then carries the rest for free — authorize.ts drops a confined grant for an account with no osUser, which is precisely the account that cannot hold credentials of its own. Nothing Anthropic-shaped is inherited by the child. For the owner those variables point at the local proxy, whose whole job is swapping a shared secret for the owner's bearer token — handing them to a login is how you get a success that authenticates nothing. A member's login runs through setpriv --reset-env as their own Linux user, into their own home, because their turns bill their own subscription and that only holds if the credential is theirs. Pending logins are in memory on purpose: one is worthless once the process holding its PKCE verifier dies, so persisting it would store a row that can only ever be stale. Ten-minute reaper, one per account, and the dialog abandons its own on close so a dismissed dialog does not leave claude parked on a read of stdin. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 20:47:10 +00:00
parent 530e5880e1
commit 8917f36be5
5 changed files with 417 additions and 3 deletions
@@ -0,0 +1,221 @@
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import { spawn } from 'node:child_process';
+import { createRouter } from '../../create-router';
+import { getHomeDir } from '../../data-path';
+import { claudeBinIn } from '../../os-user-claude';
+import { runAsArgv } from '../../os-user';
+
+/*
+  `/login` in the chat composer, doing what it does in a terminal.
+
+  Officer's members and its owner both authenticate `claude` with a Claude SUBSCRIPTION over OAuth, not with
+  an Anthropic API key — see `sidecar/claude/state.ts`. That flow is a browser round trip: the CLI prints a
+  URL, you authorise in claude.com, and you paste a code back. It is the one part of running an agent that
+  a browser-only user could not do from the browser: they had to open a terminal panel and drive the CLI by
+  hand, which works and is exactly the thing this removes.
+
+  It needs no pty. `claude auth login` behaves identically through plain pipes — verified 2026-08-21 by
+  capturing its raw bytes — so this is an ordinary subprocess with two reads and one write:
+
+      spawn ─► read stdout until the URL ─► [person authorises] ─► write the code to stdin ─► exit
+
+  The one non-obvious piece is the parsing. The CLI wraps the URL in an OSC-8 hyperlink escape AND prints it
+  again as visible text, so a naive `https://\S+` match returns two URLs concatenated with no separator.
+  Stripping the escape wrappers first leaves exactly one.
+*/
+
+/** OSC-8 hyperlink: `ESC ] 8 ; ; <uri> BEL` … `ESC ] 8 ; ; BEL`. Both halves go. */
+const OSC8 = /\x1b\]8;;[^\x07\x1b]*(?:\x07|\x1b\\)/g;
+const SGR = /\x1b\[[0-9;]*m/g;
+
+const visibleText = (raw: string): string => raw.replace(OSC8, '').replace(SGR, '');
+
+/** The URL the person has to open, or null while the CLI has not printed it yet. */
+export function extractLoginUrl(raw: string): string | null {
+  const m = visibleText(raw).match(/https:\/\/\S+/);
+  return m ? m[0] : null;
+}
+
+/** The CLI is waiting on stdin. Distinct from "printed a URL" — it prints the URL first. */
+export const awaitingCode = (raw: string): boolean => /Paste code here/i.test(visibleText(raw));
+
+type Pending = {
+  userId: number;
+  child: ChildProcessWithoutNullStreams;
+  url: string;
+  out: string;
+  reaper: ReturnType<typeof setTimeout>;
+};
+
+/*
+  In memory, and deliberately not in Postgres.
+
+  A pending login is worth nothing after the process holding its PKCE verifier dies, so persisting it would
+  store a row that can only ever be stale. A restart losing them is correct: the code in the person's
+  clipboard is already useless, and the honest recovery is to type `/login` again.
+*/
+const pending = new Map<string, Pending>();
+
+/*
+  The authorisation code expires and so does the person's patience. Ten minutes is long enough to find a
+  password manager and short enough that a forgotten tab does not leave a `claude` process parked on a
+  read of stdin for the rest of the week.
+*/
+const TTL_MS = 10 * 60 * 1000;
+
+function abandon(id: string): void {
+  const p = pending.get(id);
+  if (!p) return;
+  clearTimeout(p.reaper);
+  pending.delete(id);
+  try {
+    p.child.kill('SIGTERM');
+  } catch {
+    // Already gone. Nothing to do and nothing worth logging.
+  }
+}
+
+type Who = { id: number; isOwner: boolean; osUser: string | null; email: string };
+
+/**
+ * The login process for one account.
+ *
+ * The owner runs it as themselves, in their real home, so it refreshes the very credentials
+ * `officer-anthropic-proxy` reads. A member runs through `runAsArgv` — `setpriv --reset-env` — as their own
+ * Linux user, writing into their own home, which is the whole point: their turns bill their subscription
+ * rather than the owner's, and that only holds if the credential is theirs.
+ *
+ * Nothing Anthropic-shaped is inherited in either case. For the owner those variables point at the local
+ * proxy, and the proxy exists to swap a shared secret for the owner's bearer token — handing them to a
+ * login is how you get a "success" that authenticates nothing.
+ */
+function spawnLogin(who: Who): ChildProcessWithoutNullStreams {
+  const stripped = { ...process.env };
+  for (const name of [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+    'ANTHROPIC_BASE_URL',
+    'ANTHROPIC_FOUNDRY_API_KEY',
+    '_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL',
+    'CLAUDE_CODE_OAUTH_TOKEN',
+  ])
+    delete stripped[name];
+
+  if (who.isOwner) {
+    return spawn('claude', ['auth', 'login', '--claudeai'], {
+      env: stripped,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }) as ChildProcessWithoutNullStreams;
+  }
+
+  if (!who.osUser) throw new Error('no Linux account: an agent for this member cannot hold its own credentials');
+
+  const home = getHomeDir(who.email);
+  // `env` inside the argv, because `--reset-env` discards anything handed to `setpriv` itself. Only PATH,
+  // and only so `claude` can find `node`; nothing here carries a credential.
+  const [launcher, ...args] = runAsArgv(who.osUser, [claudeBinIn(home), 'auth', 'login', '--claudeai']);
+  if (!launcher) throw new Error('runAsArgv returned an empty argv');
+  return spawn(launcher, args, { cwd: home, stdio: ['pipe', 'pipe', 'pipe'] }) as ChildProcessWithoutNullStreams;
+}
+
+/** Reads until the URL appears, or the process dies, or we run out of patience waiting for it. */
+function urlFrom(child: ChildProcessWithoutNullStreams): Promise<{ url: string; out: string }> {
+  return new Promise((resolve, reject) => {
+    let out = '';
+    // Separate from TTL_MS: this is the CLI failing to start, which shows up as silence rather than an error.
+    const giveUp = setTimeout(
+      () => reject(new Error(`no login URL after 25s. Output so far: ${visibleText(out)}`)),
+      25_000,
+    );
+    const settle = (fn: () => void) => {
+      clearTimeout(giveUp);
+      fn();
+    };
+    const onChunk = (b: Buffer) => {
+      out += b.toString();
+      const url = extractLoginUrl(out);
+      if (url) settle(() => resolve({ url, out }));
+    };
+    child.stdout.on('data', onChunk);
+    // The CLI prints the URL to stdout, but its warnings go to stderr and one of them explains a failure.
+    child.stderr.on('data', (b: Buffer) => {
+      out += b.toString();
+    });
+    child.on('error', (err) => settle(() => reject(err)));
+    child.on('exit', (code) =>
+      settle(() => reject(new Error(`claude auth login exited ${code} before printing a URL: ${visibleText(out)}`))),
+    );
+  });
+}
+
+export const claudeLoginRouter = createRouter();
+
+// POST /auth/claude-login — start one, and hand back the URL to open.
+claudeLoginRouter.post('/', async (ctx) => {
+  const user = ctx.get('user');
+  const who: Who = { id: user.id, isOwner: user.id === 1, osUser: user.osUser ?? null, email: user.email };
+
+  // One at a time per account. A second `/login` while one is open is a person retrying, not a person
+  // wanting two, and two processes racing to write one credentials file is a corrupt file.
+  for (const [id, p] of pending) if (p.userId === who.id) abandon(id);
+
+  let child: ChildProcessWithoutNullStreams;
+  try {
+    child = spawnLogin(who);
+  } catch (err) {
+    return ctx.json({ error: err instanceof Error ? err.message : 'could not start the login' }, 400);
+  }
+
+  try {
+    const { url, out } = await urlFrom(child);
+    const id = crypto.randomUUID();
+    pending.set(id, { userId: who.id, child, url, out, reaper: setTimeout(() => abandon(id), TTL_MS) });
+    // Keep reading, or the pipe fills and the child blocks — and we want its later output for the result.
+    child.stdout.on('data', (b: Buffer) => {
+      const p = pending.get(id);
+      if (p) p.out += b.toString();
+    });
+    return ctx.json({ id, url, expiresInMs: TTL_MS });
+  } catch (err) {
+    try {
+      child.kill('SIGTERM');
+    } catch {
+      // Nothing to clean up.
+    }
+    return ctx.json({ error: err instanceof Error ? err.message : 'the login did not start' }, 502);
+  }
+});
+
+// POST /auth/claude-login/:id/code — hand over what claude.com gave them.
+claudeLoginRouter.post('/:id/code', async (ctx) => {
+  const user = ctx.get('user');
+  const id = ctx.req.param('id');
+  const p = pending.get(id);
+  // Same answer for "expired", "never existed" and "somebody else's": all three are equally not-yours.
+  if (!p || p.userId !== user.id) return ctx.json({ error: 'that login is no longer open — run /login again' }, 404);
+
+  const body = await ctx.req.json().catch(() => ({}) as Record<string, unknown>);
+  const code = typeof body.code === 'string' ? body.code.trim() : '';
+  if (!code) return ctx.json({ error: 'no code' }, 400);
+
+  const finished = new Promise<number | null>((resolve) => p.child.once('exit', (c) => resolve(c)));
+  p.child.stdin.write(`${code}\n`);
+
+  // The exchange is a network round trip on the CLI's side.
+  const exit = await Promise.race([finished, new Promise<'timeout'>((r) => setTimeout(() => r('timeout'), 45_000))]);
+  const tail = visibleText(p.out).slice(-600);
+  abandon(id);
+
+  if (exit === 'timeout') return ctx.json({ ok: false, error: 'the CLI did not finish in 45s', detail: tail }, 504);
+  if (exit !== 0) return ctx.json({ ok: false, error: `claude auth login exited ${exit}`, detail: tail }, 400);
+  return ctx.json({ ok: true, detail: tail });
+});
+
+// DELETE /auth/claude-login/:id — they closed the dialog.
+claudeLoginRouter.delete('/:id', (ctx) => {
+  const user = ctx.get('user');
+  const id = ctx.req.param('id');
+  const p = pending.get(id);
+  if (p && p.userId === user.id) abandon(id);
+  return ctx.json({ ok: true });
+});