fix(server): scrub inherited Claude session env; desktop-aware update banner - #28
Merged
Merged
Conversation
… banner A Campfire server started from inside a Claude Code session (agent-run terminal, or the desktop app opened from such a shell) inherited the host session's SDK env markers (CLAUDECODE, CLAUDE_CODE_SESSION_ID, CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH, ...). Spawned claude CLIs then expected host-managed OAuth, skipped their keychain credentials, and failed every API call with 401 authentication_failed. The server now strips these runtime markers from its own process.env at bootstrap, preserving deliberate configuration (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_*). The update banner now shows a Download link to the GitHub releases page inside the desktop app instead of CLI update instructions, which only update the npm-installed server, not the app bundle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CLAUDECODE,CLAUDE_CODE_SESSION_ID,CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH, …) from its ownprocess.envat bootstrap. When Campfire was started from inside a Claude Code session, spawnedclaudeCLIs inherited these markers, expected host-managed OAuth, skipped their keychain credentials, and 401'd on every API call. Deliberate config (CLAUDE_CODE_OAUTH_TOKEN,ANTHROPIC_*) survives.the-campfire install/ Update & Restart, which update the npm server rather than the app bundle.Root cause evidence
Protocol recording of the failing session shows
{"subtype":"api_retry","error_status":401,"error":"authentication_failed"}; the sidecar's process env contained the full set of host-session markers; the identical CLI invocation succeeded once the app was relaunched with a clean environment.Testing