Repository navigation
fix(platform): read the credential of the session's CLAUDE_CONFIG_DIR - #211
Open
cavalcanticampos wants to merge 1 commit into
Open
cavalcanticampos wants to merge 1 commit into
cavalcanticampos wants to merge 1 commit into
Conversation
Claude Code keeps one credential per config dir: on Linux/Windows at $CLAUDE_CONFIG_DIR/.credentials.json, on macOS in the Keychain item "Claude Code-credentials-<first 8 hex of sha256(CLAUDE_CONFIG_DIR)>" (unsuffixed when CLAUDE_CONFIG_DIR is unset). cship always read the default one, so in a second-account session `account` showed the first account and `usage_limits` fetched the first account's usage. get_oauth_token now resolves the config dir and keychain service name the same way Claude Code does. Fixes stephenleo#194. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #194. Also covers the multi-account point in #210 (the
usage_limitsOAuth fetch used the first account's token in a second-account session).What a user gets
With several accounts, each in its own
CLAUDE_CONFIG_DIR,cship.accountand theusage_limitsOAuth fallback now follow the account the session actually runs as, instead of always reading the default~/.claudecredential.The change
get_oauth_tokennow resolves the credential the way Claude Code stores it:CLAUDE_CONFIG_DIRunset (or empty)CLAUDE_CONFIG_DIR=/path~/.claude/.credentials.json/path/.credentials.jsonsecret-toolfallback, macOS KeychainClaude Code-credentialsClaude Code-credentials-<hash>~/.claude/.credentials.json/path/.credentials.json<hash>is the first 8 hex chars of SHA-256 of theCLAUDE_CONFIG_DIRvalue as given. I took this from Claude Code itself (2.1.322), which builds the service name as`Claude Code${OAUTH_FILE_SUFFIX}-credentials${configDirSet ? "-" + sha256(configDir).hex().substring(0, 8) : ""}`and stores the plaintext file atjoin(configDir, ".credentials.json"). An emptyCLAUDE_CONFIG_DIRis treated as unset, as Claude Code does.src/platform.rs:claude_config_dir()(env →home_dir()/.claude) andkeychain_service_name(), used by the macOS, Linux and Windows paths.CLAUDE_HOMEkeeps working for the default dir.Cargo.toml: addssha2 = "0.10"(pure Rust) for the hash. It is a normal dependency rather than macOS-only so the naming is unit-tested on the Linux CI.docs/faq.md: a short note on multi-account lookup.How I verified it
cargo fmt --check,cargo clippy -- -D warnings,cargo test(533 + 77 pass),cargo build --release: all pass on Linux (WSL2).1e91dd84/d20442b7for two paths, values computed with Node'scrypto.createHash("sha256")exactly as Claude Code does; config-dir resolution prefersCLAUDE_CONFIG_DIR, falls back to~/.claude, treats empty as unset. They are pure functions, so no test mutates process env.ringneeds a C toolchain per target), so I rancargo clippy --all-targets -D warningsonplatform.rsalone in a scratch crate foraarch64-apple-darwin,x86_64-pc-windows-gnuandx86_64-unknown-linux-gnu: clean on all three.cship explain: withCLAUDE_CONFIG_DIRpointing at an empty dir,mainstill reports "credential present" (it reads~/.claude), this branch reports "no Claude Code credential found"; with a dir holding its own.credentials.json, this branch uses that one.Not exercised: a real macOS Keychain with two accounts (I'm on Linux). The service name matches Claude Code's derivation and is covered by the tests above.
🤖 Generated with Claude Code