Support headless relayed launch with CLAUDE_CODE_OAUTH_TOKEN + relayed e2e test - #479
Draft
masonc08 wants to merge 2 commits into
Draft
Support headless relayed launch with CLAUDE_CODE_OAUTH_TOKEN + relayed e2e test#479masonc08 wants to merge 2 commits into
masonc08 wants to merge 2 commits into
Conversation
Relayed launch calls `_ensure_subscription_login`, which shells out to `claude auth login` (a browser flow) when no persisted login is found. In a headless/CI run that hangs. A pre-provisioned OAuth token (`claude setup-token` output, injected via CLAUDE_CODE_OAUTH_TOKEN) is the Authorization credential Claude Code uses directly, so no interactive login applies — return early when it is set, before the auth-status probe. Relayed writes no apiKeyHelper and sets no ANTHROPIC_API_KEY, so this token is the top credential Claude Code resolves. Co-authored-by: Isaac <no-reply@databricks.com>
Exercises the relayed (subscription-relay) claude launch end to end: starts the real loopback refresh proxy as `_launch_relayed` does, writes the relayed provider config, and runs a one-shot `validate_cmd` so a request flows through the credential-swap proxy to the gateway and out to the Anthropic subscription. Gated to stay inert until the infra exists: skips unless CLAUDE_CODE_OAUTH_TOKEN is set (the `claude setup-token` output that supplies the subscription OAuth credential headlessly, per the login guard) and a relayed MPS is discoverable on the workspace. Feeds the proxy the e2e bearer for the swap token, matching the other launch tests. Co-authored-by: Isaac <no-reply@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes the relayed (subscription-relay) claude launch runnable headlessly, and adds an e2e test for it.
1. Login guard (
agents/claude.py)._ensure_subscription_loginshells out toclaude auth login(a browser flow) when no persisted login is found — which hangs an unattended/CI run. WhenCLAUDE_CODE_OAUTH_TOKENis set (theclaude setup-tokenoutput that supplies the subscription OAuth credential headlessly), it is the Authorization credential Claude Code uses directly, so the interactive login doesn't apply. Return early when it's set, before theauth statusprobe. Relayed writes noapiKeyHelperand sets noANTHROPIC_API_KEY, so this token is the top credential Claude Code resolves.2. Relayed e2e test (
tests/test_e2e.py). Exercises the relayed launch end to end: starts the real loopback refresh proxy (as_launch_relayeddoes), writes the relayed provider config, and runs a one-shotvalidate_cmdso a request flows through the credential-swap proxy → gateway → Anthropic subscription. It stays inert until the supporting infra exists — skips unlessCLAUDE_CODE_OAUTH_TOKENis set and a relayed MPS is discoverable on the workspace.Why
Relayed had no live e2e coverage because it couldn't run headless (interactive subscription OAuth).
claude setup-token+CLAUDE_CODE_OAUTH_TOKENcloses that gap; the guard prevents the browser fallback from hanging CI.To activate the e2e test in CI
claude setup-tokenonce (interactive), store the output as aCLAUDE_CODE_OAUTH_TOKENGitHub Actions secret and export it in thee2ejob.Until both land, the test skips — no CI change in behavior.
Testing
TestEnsureSubscriptionLogin(3): token-set skips all CLI shell-out; existing login skips the browser; no-login + no-token runsclaude auth login. Pass.test_agent_claude.py139/139;test_e2e.pycollects (32) and the relayed test skips cleanly. ruff clean.This pull request and its description were written by Isaac.