smoido/claude-mode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Quote the apiKeyHelper path, and say why the helper failed

Browse Source 
apiKeyHelper is a shell command line, not a path, so the raw value written
into settings.json was split at the first space. A Windows profile named
"Mohammed Ahmed" produced an attempt to run C:\Users\Mohammed, surfacing as
"your apiKeyHelper script is failing" with nothing to go on. Quote the value
when it contains anything a shell cares about, and leave it bare otherwise so
no existing settings.json churns on the next switch. The POSIX port had the
same bug against a /Users/First Last home; shlex.quote has exactly the wanted
"leave ordinary paths alone" behaviour.

doctor could not see any of this. It quoted the path itself before running it,
so it exercised a command line Claude Code never uses and passed while the
real one failed. It now reads the string out of settings.json, reports it when
it is not what a switch would write, and runs that string through a shell.

The helper itself exited 1 in silence on four distinct faults - no state, no
preset, no key, undecryptable key - collapsing them into one indistinguishable
message. Each now names itself on stderr, which is what /status displays. The
DPAPI case says what it actually means: a key stored by a different Windows
account than the one Claude Code runs as. Success paths stay silent, so stdout
still carries the key and nothing else.

Also make install.ps1 survive a Restricted execution policy: piped through
iex it is not subject to the policy, but invoking the installed script for the
key prompt is, which is where a fresh install died. Set Process scope for the
install, offer to set CurrentUser to RemoteSigned, and clear the
mark-of-the-web that Expand-Archive can leave on the extracted scripts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
smoido
2026-09-04 00:49:50 +03:00
co-authored by Claude Opus 5
parent b32651fe00
commit b60c00450c
8 changed files with 188 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
linux/claude-key-helper.sh
+8 -2
View File
@@ -8,6 +8,12 @@
set -u
# Claude Code surfaces a failing helper as "your apiKeyHelper script is failing"
# and shows this stream under /status. Exiting 1 in silence turns several
# distinct faults into one indistinguishable message, so every failure path says
# which it was. Success paths stay silent - stdout carries the key and nothing else.
fail() { printf 'claude-key-helper: %s\n' "$*" >&2; exit 1; }
CM_ROOT="${CM_ROOT:-$HOME/.claude-mode}"
# shellcheck source=/dev/null
. "$CM_ROOT/bin/cm-vault.sh"
@@ -26,7 +32,7 @@ preset_name="$("$PY" "$JSON" get "$state" preset 2>/dev/null)"
[ -n "$preset_name" ] || exit 0
preset="$CM_ROOT/presets/$preset_name.json"
[ -f "$preset" ] || exit 1
[ -f "$preset" ] || fail "state.json names preset '$preset_name' but $preset does not exist. Run: claude-mode presets"
auth_mode="$("$PY" "$JSON" get "$preset" auth.mode 2>/dev/null)"
[ -z "$auth_mode" ] && auth_mode="vault"
@@ -35,4 +41,4 @@ auth_mode="$("$PY" "$JSON" get "$preset" auth.mode 2>/dev/null)"
key_ref="$("$PY" "$JSON" get "$preset" auth.keyRef 2>/dev/null)"
[ -n "$key_ref" ] || key_ref="openrouter"
cm_vault_get "$key_ref" || exit 1
cm_vault_get "$key_ref" || fail "no key readable for ref '$key_ref' from $(cm_vault_backend_label 2>/dev/null || echo 'the vault'). Run: claude-mode set-key $key_ref"