feat(claude-agent-sdk): add deterministic auth modes and readiness - #522
Open
David Gómez (ldavidgomez) wants to merge 4 commits into
Open
feat(claude-agent-sdk): add deterministic auth modes and readiness#522David Gómez (ldavidgomez) wants to merge 4 commits into
David Gómez (ldavidgomez) wants to merge 4 commits into
Conversation
Contributor
Author
Example configurationsUse provider:
type: claude-agent-sdk
auth_mode: subscriptionUse provider:
type: claude-agent-sdk
auth_mode: api_keyUse provider:
type: claude-agent-sdk
auth_mode: auto
|
…light - Add ProviderSettings.auth_mode (auto/subscription/api_key) to make the credential path explicit rather than relying on ambient env inference - _check_auth_readiness() resolves mode before CLI probe (F7); skips the subprocess entirely for api_key mode and for auto+ANTHROPIC_API_KEY - Env-conflict check (ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN) is gated on subscription mode only — auto mode with ANTHROPIC_AUTH_TOKEN alone now resolves correctly to subscription (F1) - _run_auth_status_subprocess() returns (stdout, stderr, returncode) 3-tuple; removes _AUTH_STATUS_STDERR ContextVar hidden side-channel (F6) - OSError from create_subprocess_exec is caught and returned as a sanitized ClaudeAuthStatus rather than escaping as FileNotFoundError (F3) - interrupt_waiter task is initialised to None before the try block and cancelled+awaited in the CancelledError handler so no asyncio task is orphaned on outer cancellation (F4) - Update two existing tests to mock _check_auth_readiness — validate_connection now also asserts auth readiness, and an interrupt pre-set fires before fake_query is called (F2) - Remove AgentOps harness scaffolding erroneously appended to AGENTS.md (F5) - Correct AGENTS.md / CHANGELOG docs: env-conflict is subscription-only; validate_connection() returns False (not raises) on failure; cancellation leaves no orphaned task Closes TICKET-20260816-0002 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ion with readiness preflight
…ery tests
`TestClaudeAgentSdkDelivery` drives a real `ClaudeAgentSdkProvider`
through `execute()` while stubbing only the SDK seam (`query`,
`ClaudeAgentOptions`). The authentication readiness preflight runs
before any of that, so all three tests failed on a missing credential
instead of on the component wiring they assert.
These were red from the moment the preflight landed, but invisible
locally: `pytest.importorskip("claude_agent_sdk")` skips the whole
module unless the optional extra is installed. CI does install it
(`ci.yml`), so they would have failed there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
David Gómez (ldavidgomez)
force-pushed
the
feat/claude-auth-readiness-preflight
branch
from
September 11, 2026 18:09
2c74b3c to
6d97da7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
auth_modesupport forclaude-agent-sdk:subscriptionselects the child-process subscription path by clearing API-key/token variables only throughClaudeAgentOptions.env.api_keyrequires an inherited API key and clears the competing auth token.autopreserves the CLI's inherited credential resolution.conductor doctor --checkdiagnostics.Validation
ruff check .passes after rebase.Notes
🤖 Generated with Claude Code