fix(auth): extract only token characters per line during claude setup-token reassembly#194
Merged
aaronjmars merged 1 commit intoMay 20, 2026
Conversation
…-token reassembly The prior loop pushed line.trim() unconditionally for the first line, which included any trailing terminal prose, spaces, or ANSI sequences that appeared after the token text on that line. Those bytes were then concatenated into the stored CLAUDE_CODE_OAUTH_TOKEN, writing a malformed credential to the GitHub secret. Fix: apply the same /^[A-Za-z0-9_\-]+/ extraction to every line (including the first). The regex anchors at the start of the trimmed line and stops at the first non-token character, so only the token alphabet is ever appended. Add a post-loop guard that returns a 400 if the assembled value does not start with "sk-ant-oat", making extraction failures explicit instead of silently storing garbage. Ref: AntFleet bench receipt AntFleet#25 (comment) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Triage: ACCEPTED — clean against the contribution rubric (scope ✓ / format ✓ / originality ✓ / size ✓). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes H5 from the AntFleet bench run — receipt: AntFleet#25 (comment)
What was wrong
claude setup-tokenoutput is captured as a string and sliced fromsk-ant-oatonward. The reassembly loop then pushedline.trim()unconditionally for the first line, without restricting to token characters. If the terminal output included trailing prose after the token (e.g.sk-ant-oat01-abc… (valid for 30 days)) the whole trimmed string — including the non-token suffix — was appended, and subsequent continuation lines were concatenated on top of it. The result stored inCLAUDE_CODE_OAUTH_TOKENwas garbage.Continuation lines used
/^[A-Za-z0-9_\-]+$/correctly, but the first line had no such guard.Fix
Apply the same leading-match extraction (
/^[A-Za-z0-9_\-]+/) to every line including the first. The regex takes only the token-alphabet prefix of the trimmed line and stops at the first foreign character — so prose, ANSI escapes, and spaces after the token are never included. A post-loop guard returns HTTP 400 if the assembled value doesn't start withsk-ant-oat, making extraction failures explicit instead of silently storing a malformed credential.