fix(shell): refresh claude oauth token per cli launch

Author: skulidropek

packages/app/tests/docker-git/entrypoint-auth.test.ts

@@ -28,6 +28,10 @@ describe("renderEntrypoint auth bridge", () => {
       expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GH_TOKEN\" \"$EFFECTIVE_GH_TOKEN\"")
       expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GIT_AUTH_TOKEN\" \"$EFFECTIVE_GITHUB_TOKEN\"")
       expect(entrypoint).toContain("GIT_CREDENTIAL_HELPER_PATH=\"/usr/local/bin/docker-git-credential-helper\"")
+      expect(entrypoint).toContain("CLAUDE_REAL_BIN=\"/usr/local/bin/.docker-git-claude-real\"")
+      expect(entrypoint).toContain("CLAUDE_WRAPPER_BIN=\"/usr/local/bin/claude\"")
+      expect(entrypoint).toContain("cat <<'EOF' > \"$CLAUDE_WRAPPER_BIN\"")
+      expect(entrypoint).toContain("CLAUDE_CONFIG_DIR=\"${CLAUDE_CONFIG_DIR:-$HOME/.claude}\"")
       expect(entrypoint).toContain("token=\"${GITHUB_TOKEN:-}\"")
       expect(entrypoint).toContain("token=\"${GH_TOKEN:-}\"")
       expect(entrypoint).toContain(String.raw`printf "%s\n" "password=$token"`)

packages/docker-git/tests/core/templates.test.ts

@@ -92,6 +92,11 @@ describe("planFiles", () => {
         expect(entrypointSpec.contents).toContain("npm_config_store_dir")
         expect(entrypointSpec.contents).toContain("NPM_CONFIG_CACHE")
         expect(entrypointSpec.contents).toContain("YARN_CACHE_FOLDER")
+        expect(entrypointSpec.contents).toContain("CLAUDE_REAL_BIN=\"/usr/local/bin/.docker-git-claude-real\"")
+        expect(entrypointSpec.contents).toContain("CLAUDE_WRAPPER_BIN=\"/usr/local/bin/claude\"")
+        expect(entrypointSpec.contents).toContain("cat <<'EOF' > \"$CLAUDE_WRAPPER_BIN\"")
+        expect(entrypointSpec.contents).toContain('CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"')
+        expect(entrypointSpec.contents).toContain("unset CLAUDE_CODE_OAUTH_TOKEN || true")
         expect(entrypointSpec.contents).toContain("CLONE_CACHE_ARGS=\"--reference-if-able '$CACHE_REPO_DIR' --dissociate\"")
         expect(entrypointSpec.contents).toContain("[clone-cache] using mirror: $CACHE_REPO_DIR")
         expect(entrypointSpec.contents).toContain("git clone --progress $CLONE_CACHE_ARGS")

packages/lib/src/core/templates-entrypoint/claude.ts

@@ -24,18 +24,56 @@ export CLAUDE_CONFIG_DIR
 mkdir -p "$CLAUDE_CONFIG_DIR" || true
 
 CLAUDE_TOKEN_FILE="$CLAUDE_CONFIG_DIR/.oauth-token"
-CLAUDE_CODE_OAUTH_TOKEN=""
+docker_git_refresh_claude_oauth_token() {
+  local token=""
+  if [[ -f "$CLAUDE_TOKEN_FILE" ]]; then
+    token="$(tr -d '\r\n' < "$CLAUDE_TOKEN_FILE")"
+  fi
+  export CLAUDE_CODE_OAUTH_TOKEN="$token"
+}
+
+docker_git_refresh_claude_oauth_token
+
+CLAUDE_REAL_BIN="/usr/local/bin/.docker-git-claude-real"
+CLAUDE_WRAPPER_BIN="/usr/local/bin/claude"
+if command -v claude >/dev/null 2>&1; then
+  CURRENT_CLAUDE_BIN="$(command -v claude)"
+  if [[ "$CURRENT_CLAUDE_BIN" != "$CLAUDE_REAL_BIN" && ! -f "$CLAUDE_REAL_BIN" ]]; then
+    mv "$CURRENT_CLAUDE_BIN" "$CLAUDE_REAL_BIN"
+  fi
+  if [[ -f "$CLAUDE_REAL_BIN" ]]; then
+    cat <<'EOF' > "$CLAUDE_WRAPPER_BIN"
+#!/usr/bin/env bash
+set -euo pipefail
+
+CLAUDE_REAL_BIN="/usr/local/bin/.docker-git-claude-real"
+CLAUDE_CONFIG_DIR="${"$"}{CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+CLAUDE_TOKEN_FILE="$CLAUDE_CONFIG_DIR/.oauth-token"
+
 if [[ -f "$CLAUDE_TOKEN_FILE" ]]; then
   CLAUDE_CODE_OAUTH_TOKEN="$(tr -d '\r\n' < "$CLAUDE_TOKEN_FILE")"
+  export CLAUDE_CODE_OAUTH_TOKEN
+else
+  unset CLAUDE_CODE_OAUTH_TOKEN || true
+fi
+
+exec "$CLAUDE_REAL_BIN" "$@"
+EOF
+    chmod 0755 "$CLAUDE_WRAPPER_BIN" || true
+  fi
 fi
-export CLAUDE_CODE_OAUTH_TOKEN
 
 CLAUDE_PROFILE="/etc/profile.d/claude-config.sh"
 printf "export CLAUDE_AUTH_LABEL=%q\n" "$CLAUDE_AUTH_LABEL" > "$CLAUDE_PROFILE"
 printf "export CLAUDE_CONFIG_DIR=%q\n" "$CLAUDE_CONFIG_DIR" >> "$CLAUDE_PROFILE"
-if [[ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]]; then
-  printf "export CLAUDE_CODE_OAUTH_TOKEN=%q\n" "$CLAUDE_CODE_OAUTH_TOKEN" >> "$CLAUDE_PROFILE"
+cat <<'EOF' >> "$CLAUDE_PROFILE"
+CLAUDE_TOKEN_FILE="${"$"}{CLAUDE_CONFIG_DIR:-$HOME/.claude}/.oauth-token"
+if [[ -f "$CLAUDE_TOKEN_FILE" ]]; then
+  export CLAUDE_CODE_OAUTH_TOKEN="$(tr -d '\r\n' < "$CLAUDE_TOKEN_FILE")"
+else
+  unset CLAUDE_CODE_OAUTH_TOKEN || true
 fi
+EOF
 chmod 0644 "$CLAUDE_PROFILE" || true
 
 docker_git_upsert_ssh_env "CLAUDE_AUTH_LABEL" "$CLAUDE_AUTH_LABEL"