fix(test): isolate claude auth e2e token injection

Author: konard

scripts/e2e/auth-claude-login.sh

@@ -12,8 +12,10 @@ ROOT="$(mktemp -d "$ROOT_BASE/auth-claude-login.XXXXXX")"
 chmod 0700 "$ROOT"
 KEEP="${KEEP:-0}"
 COMPOSE_OVERRIDE_FILE="$ROOT/docker-compose.auth-claude-login.yml"
+DOCKER_WRAPPER_DIR="$ROOT/docker-wrapper"
+DOCKER_WRAPPER_FILE="$DOCKER_WRAPPER_DIR/docker"
 LOGIN_TIMEOUT_SECONDS="${DOCKER_GIT_E2E_AUTH_CLAUDE_LOGIN_TIMEOUT_SECONDS:-900}"
-OAUTH_TOKEN_MARKER="docker-git-e2e-oauth-token-marker"
+OAUTH_TOKEN_MARKER="sk-ant-oat01-docker-git-e2e-oauth-token-marker"
 
 export DOCKER_GIT_PROJECTS_ROOT="$ROOT"
 export DOCKER_GIT_STATE_AUTO_SYNC=0
@@ -22,11 +24,59 @@ export DOCKER_GIT_PROJECTS_ROOT_VOLUME="docker-git-e2e-auth-claude-$RUN_ID-proje
 export DOCKER_GIT_CONTROLLER_COMPOSE_EXTRA_FILE="$COMPOSE_OVERRIDE_FILE"
 export COMPOSE_PROJECT_NAME="docker-git"
 
+mkdir -p "$DOCKER_WRAPPER_DIR"
+cat > "$DOCKER_WRAPPER_FILE" <<'BASH'
+#!/usr/bin/env bash
+set -euo pipefail
+
+REAL_DOCKER="/usr/bin/docker"
+CLAUDE_AUTH_IMAGE="docker-git-auth-claude:latest"
+args=("$@")
+image_index=-1
+
+for index in "${!args[@]}"; do
+  if [[ "${args[$index]}" == "$CLAUDE_AUTH_IMAGE" ]]; then
+    image_index="$index"
+  fi
+done
+
+if [[ "$image_index" -ge 0 ]]; then
+  first_command_arg="${args[$((image_index + 1))]:-}"
+  second_command_arg="${args[$((image_index + 2))]:-}"
+
+  if [[ "$first_command_arg" == "setup-token" ]]; then
+    : "${DOCKER_GIT_E2E_CLAUDE_SETUP_TOKEN_MARKER:?missing synthetic Claude OAuth token marker}"
+    cat <<TOKEN
+Welcome to Claude Code
+
+ ✓ Long-lived authentication token created successfully!
+
+ Your OAuth token (valid for 1 year):
+
+ ${DOCKER_GIT_E2E_CLAUDE_SETUP_TOKEN_MARKER}
+
+ Store this token securely. You won't be able to see it again.
+TOKEN
+    exit 0
+  fi
+
+  if [[ "$first_command_arg" == "-p" && "$second_command_arg" == "ping" ]]; then
+    echo "synthetic Claude API probe failure" >&2
+    exit 7
+  fi
+fi
+
+exec "$REAL_DOCKER" "$@"
+BASH
+chmod 0755 "$DOCKER_WRAPPER_FILE"
+
 cat > "$COMPOSE_OVERRIDE_FILE" <<YAML
 services:
   api:
     environment:
-      DOCKER_GIT_CLAUDE_OAUTH_TOKEN: ${OAUTH_TOKEN_MARKER}
+      DOCKER_GIT_E2E_CLAUDE_SETUP_TOKEN_MARKER: ${OAUTH_TOKEN_MARKER}
+    volumes:
+      - ${DOCKER_WRAPPER_FILE}:/usr/local/bin/docker:ro
 YAML
 
 LOG_FILE="/tmp/docker-git-auth-claude-login-$RUN_ID.log"