fix(shell): isolate claude oauth env boundary

Author: konard

packages/lib/src/shell/claude-oauth-env.ts

@@ -0,0 +1,17 @@
+import {
+  dockerGitClaudeOauthTokenEnvKey,
+  readClaudeOauthTokenFromEnv
+} from "@prover-coder-ai/docker-git-auth-oauth/claude-oauth-token"
+
+// CHANGE: read the Docker Git Claude OAuth token only at the shell boundary
+// WHY: usecases and shared runners should receive decoded boundary values explicitly
+// QUOTE(ТЗ): "Исправь CI/CD и все правки от Rabbit Coder."
+// REF: PR-440-CodeRabbit-env-boundary
+// SOURCE: n/a
+// FORMAT THEOREM: forall env: token(env) = Some(t) -> process_token() = Some(t)
+// PURITY: SHELL
+// EFFECT: reads process.env
+// INVARIANT: only a normalized non-empty DOCKER_GIT_CLAUDE_OAUTH_TOKEN crosses into the login flow
+// COMPLEXITY: O(1)
+export const readDockerGitClaudeOauthTokenFromProcessEnv = (): string | null =>
+  readClaudeOauthTokenFromEnv(process.env, [dockerGitClaudeOauthTokenEnvKey])

packages/lib/src/usecases/auth-claude-oauth.ts

@@ -9,12 +9,10 @@ import {
   runClaudeDockerOauth
 } from "@prover-coder-ai/docker-git-auth-oauth/claude-docker-oauth"
 import {
-  dockerGitClaudeOauthTokenEnvKey,
   extractClaudeOauthToken,
   flushClaudeOauthTokenRedactionState,
   initialClaudeOauthTokenRedactionState,
-  redactClaudeOauthTokenChunk,
-  readClaudeOauthTokenFromEnv
+  redactClaudeOauthTokenChunk
 } from "@prover-coder-ai/docker-git-auth-oauth/claude-oauth-token"
 import { Effect, pipe } from "effect"
 import * as Fiber from "effect/Fiber"
@@ -205,13 +203,13 @@ export const runClaudeOauthLoginWithPrompt = (
   cwd: string,
   accountPath: string,
   options: {
+    readonly envToken: string | null
     readonly image: string
     readonly containerPath: string
   }
 ): Effect.Effect<string, AuthError | CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> => {
-  const envToken = readClaudeOauthTokenFromEnv(process.env, [dockerGitClaudeOauthTokenEnvKey])
-  if (envToken !== null) {
-    return Effect.succeed(envToken)
+  if (options.envToken !== null) {
+    return Effect.succeed(options.envToken)
   }
 
   return Effect.scoped(

packages/lib/src/usecases/auth-claude.ts

@@ -12,6 +12,7 @@ import { Effect } from "effect"
 
 import type { AuthClaudeLoginCommand, AuthClaudeLogoutCommand, AuthClaudeStatusCommand } from "../core/domain.js"
 import { defaultTemplateConfig } from "../core/domain.js"
+import { readDockerGitClaudeOauthTokenFromProcessEnv } from "../shell/claude-oauth-env.js"
 import { runDockerAuth, runDockerAuthExitCode } from "../shell/docker-auth.js"
 import type { AuthError } from "../shell/errors.js"
 import { CommandFailedError } from "../shell/errors.js"
@@ -283,6 +284,7 @@ export const authClaudeLogin = (
     runClaudeLoginFlow({
       accountLabel,
       captureToken: runClaudeOauthLoginWithPrompt(cwd, accountPath, {
+        envToken: readDockerGitClaudeOauthTokenFromProcessEnv(),
         image: claudeImageName,
         containerPath: claudeContainerHomeDir
       }),

packages/lib/tests/usecases/auth-claude-login.test.ts

@@ -3,7 +3,10 @@ import * as CommandExecutor from "@effect/platform/CommandExecutor"
 import * as FileSystem from "@effect/platform/FileSystem"
 import * as Path from "@effect/platform/Path"
 import { NodeContext } from "@effect/platform-node"
-import { claudeOauthTokenFileMode } from "@prover-coder-ai/docker-git-auth-oauth/claude-oauth-token"
+import {
+  claudeOauthTokenFileMode,
+  dockerGitClaudeOauthTokenEnvKey
+} from "@prover-coder-ai/docker-git-auth-oauth/claude-oauth-token"
 import { describe, expect, it } from "@effect/vitest"
 import { Effect, Logger } from "effect"
 import * as Inspectable from "effect/Inspectable"
@@ -46,13 +49,15 @@ const isPingProbe = (args: ReadonlyArray<string>): boolean => args.includes("-p"
 // REF: issue-439
 const makeFakeExecutor = (
   token: string | null,
-  pingExitCode: number
+  pingExitCode: number,
+  invocations: Array<{ readonly command: string; readonly args: ReadonlyArray<string> }> = []
 ): CommandExecutor.CommandExecutor => {
   const start = (command: Command.Command): Effect.Effect<CommandExecutor.Process, never> =>
     Effect.sync(() => {
       const flattened = Command.flatten(command)
       const invocation = flattened[flattened.length - 1]!
       const args = invocation.args
+      invocations.push({ command: invocation.command, args })
 
       const stdoutText = isSetupToken(args)
         ? token === null
@@ -192,7 +197,12 @@ describe("authClaudeLogin", () => {
   it.effect("persists the OAuth token even when the post-login API probe fails", () =>
     withTempDir((root) =>
       withPatchedEnv(
-        { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
+        {
+          HOME: root,
+          DOCKER_GIT_STATE_AUTO_SYNC: "0",
+          DOCKER_GIT_PROJECTS_ROOT: undefined,
+          [dockerGitClaudeOauthTokenEnvKey]: undefined
+        },
         Effect.gen(function*(_) {
           const { logs, tokenText } = yield* _(runLoginAndReadToken(root, 7))
           expect(tokenText.trim()).toBe(oauthToken)
@@ -204,18 +214,61 @@ describe("authClaudeLogin", () => {
   it.effect("persists the OAuth token when the post-login API probe succeeds", () =>
     withTempDir((root) =>
       withPatchedEnv(
-        { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
+        {
+          HOME: root,
+          DOCKER_GIT_STATE_AUTO_SYNC: "0",
+          DOCKER_GIT_PROJECTS_ROOT: undefined,
+          [dockerGitClaudeOauthTokenEnvKey]: undefined
+        },
         Effect.gen(function*(_) {
           const { tokenText } = yield* _(runLoginAndReadToken(root, 0))
           expect(tokenText.trim()).toBe(oauthToken)
         })
       )
     ).pipe(Effect.provide(NodeContext.layer)))
 
+  it.effect("uses a decoded docker-git OAuth env token without running setup-token", () =>
+    withTempDir((root) =>
+      withPatchedEnv(
+        {
+          HOME: root,
+          DOCKER_GIT_STATE_AUTO_SYNC: "0",
+          DOCKER_GIT_PROJECTS_ROOT: undefined,
+          [dockerGitClaudeOauthTokenEnvKey]: ` ${oauthToken} `
+        },
+        Effect.gen(function*(_) {
+          const fs = yield* _(FileSystem.FileSystem)
+          const path = yield* _(Path.Path)
+          const invocations: Array<{ readonly command: string; readonly args: ReadonlyArray<string> }> = []
+          const claudeAuthPath = path.join(root, ".docker-git/.orch/auth/claude")
+
+          yield* _(
+            authClaudeLogin({
+              _tag: "AuthClaudeLogin",
+              label: null,
+              claudeAuthPath
+            }).pipe(
+              Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(null, 0, invocations))
+            )
+          )
+
+          const tokenText = yield* _(fs.readFileString(path.join(claudeAuthPath, "default", ".oauth-token")))
+          expect(tokenText.trim()).toBe(oauthToken)
+          expect(invocations.some((invocation) => isSetupToken(invocation.args))).toBe(false)
+          expect(invocations.some((invocation) => isPingProbe(invocation.args))).toBe(true)
+        })
+      )
+    ).pipe(Effect.provide(NodeContext.layer)))
+
   it.effect("replaces an existing token symlink without writing the secret to the symlink target", () =>
     withTempDir((root) =>
       withPatchedEnv(
-        { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
+        {
+          HOME: root,
+          DOCKER_GIT_STATE_AUTO_SYNC: "0",
+          DOCKER_GIT_PROJECTS_ROOT: undefined,
+          [dockerGitClaudeOauthTokenEnvKey]: undefined
+        },
         Effect.gen(function*(_) {
           const fs = yield* _(FileSystem.FileSystem)
           const path = yield* _(Path.Path)
@@ -266,7 +319,12 @@ describe("authClaudeLogin", () => {
   it.effect("fails when setup-token completes without a captured OAuth token", () =>
     withTempDir((root) =>
       withPatchedEnv(
-        { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
+        {
+          HOME: root,
+          DOCKER_GIT_STATE_AUTO_SYNC: "0",
+          DOCKER_GIT_PROJECTS_ROOT: undefined,
+          [dockerGitClaudeOauthTokenEnvKey]: undefined
+        },
         Effect.gen(function*(_) {
           yield* _(runLoginWithoutCapturedToken(root))
         })