48 lines
1.8 KiB
Markdown
48 lines
1.8 KiB
Markdown
# Authentication
|
|
|
|
**Status:** Implemented · **Code:** `Scripts/auth.js`, `Scripts/cli.js`
|
|
|
|
The extension never implements an OAuth flow and never sees credentials. It
|
|
drives Claude Code's own commands.
|
|
|
|
> **Policy constraint.** Anthropic's Agent SDK terms state that third-party
|
|
> developers may not offer claude.ai login in their products. Delegating to
|
|
> `claude auth login` is the compliant path *and* the robust one — credentials
|
|
> land where Claude Code expects them. Do not reimplement the PKCE flow here.
|
|
|
|
## Status
|
|
|
|
`claude auth status --json` →
|
|
|
|
```json
|
|
{"loggedIn":true,"authMethod":"claude.ai","apiProvider":"firstParty",
|
|
"email":"…","orgId":"…","orgName":"…","subscriptionType":"pro"}
|
|
```
|
|
|
|
`describe(state)` renders the sidebar's one-liner ("you@example.com · Pro").
|
|
|
|
## Sign-in
|
|
|
|
`claude auth login [--claudeai | --console]` is spawned with piped stdio. The
|
|
extension scans stdout/stderr for an authorization URL, opens it with
|
|
`nova.openURL`, then prompts for the code and writes it to the child's stdin.
|
|
If no URL appears within 20s the attempt is abandoned with a message pointing at
|
|
the terminal.
|
|
|
|
`signInViaTerminal()` is the fallback for SSO or device prompts: it writes a
|
|
`sign-in-to-claude.command` script to global storage, `chmod +x`, and `open`s it
|
|
so a real terminal runs `claude auth login`.
|
|
|
|
## API key alternative
|
|
|
|
Stored with `nova.credentials` (service `unsupervised.claudenova`, account
|
|
`ANTHROPIC_API_KEY`) and injected into the spawned process environment by
|
|
`cli.environment()`, where it takes precedence over the signed-in account.
|
|
|
|
## Gotchas
|
|
|
|
- `cli.environment()` reads the keychain on every spawn. Cheap, but it means
|
|
keychain failures must be non-fatal — they are logged and ignored.
|
|
- Nova's task environment can be sparse; `environment()` fills in a default
|
|
`PATH` and `HOME` so the CLI can find its own tooling.
|