fix(claude): report unauthenticated Claude instances honestly

[filipef101]

Problem

A Claude provider whose CLI is not logged in reports Authenticated in Settings, then fails every turn with Not logged in · Please run /login.

The snapshot derives auth solely from the Agent SDK initialization result. A logged-out config directory still initializes fine and reports { tokenSource: "none", apiProvider: "firstParty" }. checkClaudeProviderStatus only checks whether capabilities is truthy, so that object takes the status: "ready" / auth: { status: "authenticated" } branch.

This was survivable when every install had one Claude. With provider instances it is not: a second instance points CLAUDE_CONFIG_DIR at a fresh directory that is logged out by construction, so adding one always produces a provider that claims to be authenticated and cannot run a turn.

claude auth status used to be part of this probe and was dropped in #2277 (feat: Multi-Provider support); this restores that signal.

Fix

Ask the CLI, with the instance's own environment:

• claude auth status emits JSON by default; loggedIn: false maps to auth: { status: "unauthenticated" } and status: "error", matching what Codex and Cursor already report.
• The message names that instance's config directory, so the user logs in the failing instance rather than the default one:
  Claude Code is not authenticated for this instance. Run \CLAUDE_CONFIG_DIR=/Users/you/.claude_work claude auth login` and try again.`
• The command exits non-zero because the user is logged out while still printing a well-formed verdict, so the parse is deliberately not gated on the exit code. There is a test for exactly that.
• A CLI too old to answer, or any spawn failure, leaves the previous SDK-derived verdict untouched — the probe swallows defects as well as typed failures.
• When the CLI does report an account, its email and subscription are preferred over the SDK's. With several instances configured, the email is what tells two Claude accounts apart in the provider list.

No contract change. auth.status: "unauthenticated" is an existing value that clients already handle — mobile, for instance, already filters unauthenticated providers out of its model picker, so a logged-out instance stops being offered instead of being offered and failing.

Tests

Five added to ProviderRegistry.test.ts: logged-out reporting, the per-instance login hint, non-zero exit still trusted, older CLI keeping the SDK verdict, and account labelling from the CLI.

vp test run apps/server/src/provider/Layers/ProviderRegistry.test.ts — 48 passed. Typecheck and lint clean.

---

Claude Opus 5 via Claude Code.

---

Note

Medium Risk
Changes provider snapshot auth semantics for multi-instance Claude setups; failures in the new probe are designed to fall back, but logged-out instances that previously appeared healthy will now surface as errors.

Overview
Fixes Claude provider health checks that showed Authenticated for logged-out config dirs (common on extra instances with a separate CLAUDE_CONFIG_DIR) while turns failed with not logged in.

checkClaudeProviderStatus now runs claude auth status in the instance environment (with AUTH_PROBE_TIMEOUT_MS). When loggedIn is false it returns status: error and auth.status: unauthenticated, with a claudeLoginHint that sets CLAUDE_CONFIG_DIR for that instance—quoted paths and PowerShell vs POSIX syntax on Windows.

If the CLI probe is missing, times out, or returns unparseable output, behavior stays on the SDK initialization verdict. When logged in, email and subscription metadata prefer the CLI over the SDK so multiple instances are easier to tell apart. Auth JSON is parsed from stdout even on non-zero exit codes.

Tests in ProviderRegistry.test.ts cover logged-out reporting, per-instance hints, quoting, Windows hints, legacy CLI fallback, CLI account labeling, and non-zero exit trust.

^{Reviewed by Cursor Bugbot for commit bbb3fbe. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Probe claude auth status in ClaudeProvider and report unauthenticated instances honestly

• Adds probeClaudeAuthStatus, which runs claude auth status with a dedicated timeout, parses stdout via parseClaudeAuthStatus, and swallows failures by returning undefined.
• checkClaudeProviderStatus now returns an explicit unauthenticated error with a platform-aware login command targeting the instance's CLAUDE_CONFIG_DIR when the CLI reports logged out; authenticated accounts prefer CLI-provided email, subscription, auth method, and API provider, falling back to SDK capabilities.
• claudeLoginHint and quoteForShell build shell-safe CLAUDE_CONFIG_DIR=... claude auth login hints for POSIX and PowerShell, with correct quoting for paths containing spaces.
• Behavioral Change: provider status flow now always invokes claude auth status (with AUTH_PROBE_TIMEOUT_MS); if the CLI is missing or unparseable, it falls back to prior SDK-based behavior. Generated login hints reference the per-instance config dir, so users with custom CLAUDE_CONFIG_DIR must run the printed command rather than a bare claude auth login.

^{Macroscope summarized bbb3fbe.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 516c89aa-3720-4792-99f5-ade1ad570e4f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR adds a production Claude authentication probe and changes provider status and login guidance, including platform- and instance-specific behavior. An unresolved issue remains for environment-scoped CLAUDE_CONFIG_DIR values, where the displayed login command can target the wrong account directory.

^{You can add or adjust custom eligibility rules. Learn more.}

[filipef101]

Thanks — both real, both fixed in the latest push.

Auth probe timeout. Correct, and it defeated the PR's own purpose: AUTH_PROBE_TIMEOUT_MS (10s) exists in providerSnapshot.ts for exactly this and CodexProvider already uses it, while I had DEFAULT_TIMEOUT_MS (4s). On timeout the probe returns undefined and falls back to the SDK verdict — the false "authenticated" this PR is meant to correct. Now uses the auth budget.

Login hint quoting. Also right, and it applied to Windows twice over. The path is now shell-quoted, and the command is platform-aware — PowerShell has no inline VAR=value command form, so Windows gets \$env:CLAUDE_CONFIG_DIR='…'; claude auth login. Platform comes from HostProcessPlatform rather than process.platform, per the repo's no-global-process-runtime rule, which also made the Windows branch testable.

Two tests added: a config directory containing spaces, and the PowerShell form. 50 passing.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bbb3fbe. Configure here.}

[cursor]

Login hint ignores env config dir

Medium Severity

claudeLoginHint only keys off homePath. When homePath is empty, makeClaudeEnvironment still honors an ambient CLAUDE_CONFIG_DIR from the instance or process environment for the auth probe, but the hint falls back to bare claude auth login. That can send the user to the default config dir while the instance stays logged out against the env-scoped one.

Additional Locations (1)

• apps/server/src/provider/Layers/ClaudeProvider.ts#L1049-L1065

 

^{Reviewed by Cursor Bugbot for commit bbb3fbe. Configure here.}