test(claude): verify docker-backed auth login

Author: skulidropek

.github/workflows/check.yml

@@ -249,6 +249,26 @@ jobs:
       - name: Login context notice
         run: bash scripts/e2e/login-context.sh
 
+  e2e-auth-claude-login:
+    name: E2E (Claude auth login)
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      DOCKER_GIT_CONTROLLER_BUILD_SKILLER: "0"
+      DOCKER_GIT_E2E_REUSE_WORKSPACE_INSTALL: "1"
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+      - name: Install dependencies
+        uses: ./.github/actions/setup
+      - name: Free Docker disk
+        uses: ./.github/actions/free-docker-disk
+      - name: Docker info
+        run: docker version && docker compose version
+      - name: Claude auth login warning path
+        run: bash scripts/e2e/auth-claude-login.sh
+
   e2e-runtime-volumes-ssh:
     name: E2E (Runtime volumes + SSH)
     runs-on: ubuntu-latest

docker-compose.yml

@@ -27,6 +27,7 @@ services:
       DOCKER_GIT_EXCHANGE_AGENT_COMMAND: ${DOCKER_GIT_EXCHANGE_AGENT_COMMAND:-}
       DOCKER_GIT_EXCHANGE_AGENT_TIMEOUT_MS: ${DOCKER_GIT_EXCHANGE_AGENT_TIMEOUT_MS:-3600000}
       DOCKER_GIT_OUTBOX_POLLING_INTERVAL_MS: ${DOCKER_GIT_OUTBOX_POLLING_INTERVAL_MS:-5000}
+      DOCKER_GIT_CLAUDE_OAUTH_TOKEN: ${DOCKER_GIT_CLAUDE_OAUTH_TOKEN:-}
     ports:
       - "${DOCKER_GIT_API_BIND_HOST:-127.0.0.1}:${DOCKER_GIT_API_PORT:-3334}:${DOCKER_GIT_API_PORT:-3334}"
     dns:

packages/lib/src/usecases/auth-claude.ts

@@ -279,6 +279,7 @@ export const authClaudeLogin = (
         yield* _(
           Effect.logWarning(
             `Claude OAuth token saved (${accountLabel}), but the API probe failed (exit=${probeExitCode}). ` +
+              `Login is complete because the token was captured and persisted; live Claude API access is not yet verified. ` +
               `The token may need a moment to activate, or there was a transient network issue. ` +
               `Verify later with 'docker-git auth claude status'.`
           )

packages/lib/tests/usecases/auth-claude-login.test.ts

@@ -29,14 +29,22 @@ const setupTokenOutput = (token: string): string =>
     " Store this token securely. You won't be able to see it again."
   ].join("\n")
 
+const setupTokenOutputWithoutToken = (): string =>
+  [
+    "Welcome to Claude Code",
+    "",
+    " OAuth flow finished without printing a long-lived token.",
+    ""
+  ].join("\n")
+
 const isSetupToken = (args: ReadonlyArray<string>): boolean => args.includes("setup-token")
 const isPingProbe = (args: ReadonlyArray<string>): boolean => args.includes("-p") && args.includes("ping")
 
 // CHANGE: fake docker executor that captures a setup-token and lets the ping probe fail
 // WHY: reproduce issue-439 where a successful OAuth login was discarded by a failing probe
 // REF: issue-439
 const makeFakeExecutor = (
-  token: string,
+  token: string | null,
   pingExitCode: number
 ): CommandExecutor.CommandExecutor => {
   const start = (command: Command.Command): Effect.Effect<CommandExecutor.Process, never> =>
@@ -45,7 +53,11 @@ const makeFakeExecutor = (
       const invocation = flattened[flattened.length - 1]!
       const args = invocation.args
 
-      const stdoutText = isSetupToken(args) ? setupTokenOutput(token) : ""
+      const stdoutText = isSetupToken(args)
+        ? token === null
+          ? setupTokenOutputWithoutToken()
+          : setupTokenOutput(token)
+        : ""
       const exitCode = isPingProbe(args) ? pingExitCode : 0
       const stdout = stdoutText.length === 0 ? Stream.empty : Stream.succeed(encode(stdoutText))
 
@@ -136,6 +148,34 @@ const runLoginAndReadToken = (
     return yield* _(fs.readFileString(path.join(claudeAuthPath, "default", ".oauth-token")))
   })
 
+const runLoginWithoutCapturedToken = (
+  root: string
+): Effect.Effect<void, unknown, FileSystem.FileSystem | Path.Path> =>
+  Effect.gen(function*(_) {
+    const fs = yield* _(FileSystem.FileSystem)
+    const path = yield* _(Path.Path)
+    const claudeAuthPath = path.join(root, ".docker-git/.orch/auth/claude")
+    const tokenPath = path.join(claudeAuthPath, "default", ".oauth-token")
+
+    const error = yield* _(
+      authClaudeLogin({
+        _tag: "AuthClaudeLogin",
+        label: null,
+        claudeAuthPath
+      }).pipe(
+        Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(null, 0)),
+        Effect.flip
+      )
+    )
+
+    expect(error._tag).toBe("AuthError")
+    if (error._tag === "AuthError") {
+      expect(error.message).toContain("without a captured token")
+    }
+    const hasTokenFile = yield* _(fs.exists(tokenPath))
+    expect(hasTokenFile).toBe(false)
+  })
+
 describe("authClaudeLogin", () => {
   // Regression for issue-439: a non-zero probe exit must not discard a created token.
   it.effect("persists the OAuth token even when the post-login API probe fails", () =>
@@ -159,4 +199,14 @@ describe("authClaudeLogin", () => {
         })
       )
     ).pipe(Effect.provide(NodeContext.layer)))
+
+  it.effect("fails when setup-token completes without a captured OAuth token", () =>
+    withTempDir((root) =>
+      withPatchedEnv(
+        { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
+        Effect.gen(function*(_) {
+          yield* _(runLoginWithoutCapturedToken(root))
+        })
+      )
+    ).pipe(Effect.provide(NodeContext.layer)))
 })

scripts/e2e/_lib.sh

@@ -42,6 +42,7 @@ exec sudo -n env \
   "DOCKER_GIT_PROJECTS_ROOT_VOLUME=${DOCKER_GIT_PROJECTS_ROOT_VOLUME:-}" \
   "DOCKER_GIT_PROJECT_DOCKER_HOST=${DOCKER_GIT_PROJECT_DOCKER_HOST:-}" \
   "DOCKER_GIT_PROJECT_SSH_BIND_HOST=${DOCKER_GIT_PROJECT_SSH_BIND_HOST:-}" \
+  "DOCKER_GIT_CLAUDE_OAUTH_TOKEN=${DOCKER_GIT_CLAUDE_OAUTH_TOKEN:-}" \
   "UBUNTU_APT_MIRROR=${UBUNTU_APT_MIRROR:-}" \
   docker "$@"
 EOF

scripts/e2e/auth-claude-login.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RUN_ID="$(date +%s)-$RANDOM"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+source "$REPO_ROOT/scripts/e2e/_lib.sh"
+
+ROOT_BASE="${DOCKER_GIT_E2E_ROOT_BASE:-/tmp/docker-git-e2e-root}"
+mkdir -p "$ROOT_BASE"
+ROOT="$(mktemp -d "$ROOT_BASE/auth-claude-login.XXXXXX")"
+chmod 0777 "$ROOT"
+KEEP="${KEEP:-0}"
+
+export DOCKER_GIT_PROJECTS_ROOT="$ROOT"
+export DOCKER_GIT_STATE_AUTO_SYNC=0
+export DOCKER_GIT_API_CONTAINER_NAME="docker-git-e2e-auth-claude-$RUN_ID-api"
+export DOCKER_GIT_PROJECTS_ROOT_VOLUME="docker-git-e2e-auth-claude-$RUN_ID-projects"
+export COMPOSE_PROJECT_NAME="docker-git-e2e-auth-claude-$RUN_ID"
+export DOCKER_GIT_CLAUDE_OAUTH_TOKEN="${DOCKER_GIT_CLAUDE_OAUTH_TOKEN:-sk-ant-oat01-DOCKER-GIT-E2E-FAKE-TOKEN-000000000000}"
+
+LOG_FILE="/tmp/docker-git-auth-claude-login-$RUN_ID.log"
+
+fail() {
+  echo "e2e/auth-claude-login: $*" >&2
+  exit 1
+}
+
+on_error() {
+  local line="$1"
+  echo "e2e/auth-claude-login: failed at line $line" >&2
+  docker ps -a --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}' | head -n 80 || true
+  docker logs "$DOCKER_GIT_API_CONTAINER_NAME" --tail 200 || true
+  (cd "$REPO_ROOT" && docker compose ps) || true
+  (cd "$REPO_ROOT" && docker compose logs --no-color --tail 200) || true
+}
+
+cleanup() {
+  (cd "$REPO_ROOT" && docker compose down -v --remove-orphans) >/dev/null 2>&1 || true
+  if [[ "$KEEP" == "1" ]]; then
+    echo "e2e/auth-claude-login: KEEP=1 set; preserving temp dir: $ROOT" >&2
+    echo "e2e/auth-claude-login: log file: $LOG_FILE" >&2
+    return
+  fi
+  rm -rf "$ROOT" >/dev/null 2>&1 || true
+  rm -f "$LOG_FILE" >/dev/null 2>&1 || true
+}
+
+trap 'on_error $LINENO' ERR
+trap cleanup EXIT
+
+command -v timeout >/dev/null 2>&1 || fail "missing 'timeout' command"
+
+dg_ensure_docker "$ROOT/.e2e-bin"
+dg_prepare_docker_git_cli "$REPO_ROOT" "$ROOT/.e2e-bin"
+
+set +e
+timeout 180s bash -lc 'cd "$1" && bun packages/app/dist/src/docker-git/main.js auth claude login' bash "$REPO_ROOT" \
+  >"$LOG_FILE" 2>&1
+login_exit=$?
+set -e
+
+if [[ "$login_exit" -ne 0 ]]; then
+  cat "$LOG_FILE" >&2 || true
+  fail "docker-git auth claude login failed (exit: $login_exit)"
+fi
+
+grep -Fq -- "Claude OAuth token saved" "$LOG_FILE" \
+  || fail "expected saved-token warning in auth claude login output"
+
+grep -Fq -- "live Claude API access is not yet verified" "$LOG_FILE" \
+  || fail "expected diagnostic API probe warning in auth claude login output"
+
+docker exec "$DOCKER_GIT_API_CONTAINER_NAME" \
+  test -s "$ROOT/.orch/auth/claude/default/.oauth-token" \
+  || fail "expected persisted Claude OAuth token in controller state"
+
+echo "e2e/auth-claude-login: docker-backed Claude login warning path verified" >&2

scripts/e2e/run-all.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 cases=("$@")
 if [[ "${#cases[@]}" -eq 0 ]]; then
-  cases=("local-package-cli" "browser-command" "clone-cache" "login-context" "runtime-volumes-ssh" "clone-auto-open-ssh" "opencode-autoconnect")
+  cases=("local-package-cli" "browser-command" "clone-cache" "login-context" "auth-claude-login" "runtime-volumes-ssh" "clone-auto-open-ssh" "opencode-autoconnect")
 fi
 
 for case_name in "${cases[@]}"; do