From 5473c0a438e4d7518c40e522c1108ae878915847 Mon Sep 17 00:00:00 2001
From: aocai <aocai@aocaideMac-mini.local>
Date: Tue, 10 Mar 2026 17:27:44 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BB=A3=E7=90=86=E7=8E=AF=E5=A2=83?=
 =?UTF-8?q?=E4=B8=8B=20claude=20=E5=AD=90=E8=BF=9B=E7=A8=8B=E9=89=B4?=
 =?UTF-8?q?=E6=9D=83=E5=A4=B1=E8=B4=A5=20(exit=20code=201)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

问题：
CodePilot 从 Dock/Finder 启动时，HTTPS_PROXY/HTTP_PROXY 不在
Electron 进程的 process.env 中，导致 claude 子进程无法出网，
向 Anthropic API 鉴权失败，返回 exit code 1，
表现为 is_error: true / input_tokens: 0。

此问题在使用代理上网的用户（中国大陆等地区）中普遍存在。

修复方案：
1. platform.ts — 新增 getClaudeOAuthTokenFromKeychain()
   从 macOS Keychain 的 "Claude Code-credentials" 条目读取
   OAuth accessToken，作为 ANTHROPIC_AUTH_TOKEN 的兜底来源。
   支持通过 claude auth login（订阅用户）完成鉴权，
   无需在 CodePilot 中单独配置 API Key。

2. claude-client.ts — 无 active provider 且无环境变量 token 时，
   自动从 Keychain 读取 OAuth token 并注入 ANTHROPIC_AUTH_TOKEN，
   确保 claude 子进程获得有效凭证。

复现步骤：
- 安装 Claude Code CLI 并通过 claude auth login 登录（订阅用户）
- 系统依赖代理上网（HTTPS_PROXY 设置在 .zshrc 而非系统偏好设置）
- 从 Dock 启动 CodePilot（非终端启动）
- 在 CodePilot 中发送消息 → 报错 exit code 1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/lib/claude-client.ts | 13 ++++++++++---
 src/lib/platform.ts      | 25 +++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/src/lib/claude-client.ts b/src/lib/claude-client.ts
index 852860d7..08c370ed 100644
--- a/src/lib/claude-client.ts
+++ b/src/lib/claude-client.ts
@@ -20,7 +20,7 @@ import { isImageFile } from '@/types';
 import { registerPendingPermission } from './permission-registry';
 import { registerConversation, unregisterConversation } from './conversation-registry';
 import { getSetting, getActiveProvider, updateSdkSessionId, createPermissionRequest } from './db';
-import { findClaudeBinary, findGitBash, getExpandedPath } from './platform';
+import { findClaudeBinary, findGitBash, getExpandedPath, getClaudeOAuthTokenFromKeychain } from './platform';
 import { notifyPermissionRequest, notifyGeneric } from './telegram-bot';
 import os from 'os';
 import fs from 'fs';
@@ -358,9 +358,16 @@ export function streamClaude(options: ClaudeStreamOptions): ReadableStream<strin
           if (appBaseUrl) {
             sdkEnv.ANTHROPIC_BASE_URL = appBaseUrl;
           }
-          // If neither legacy settings nor env vars provide a key, log a warning
+          // If neither legacy settings nor env vars provide a key,
+          // try to read the OAuth token from macOS Keychain (claude auth login / subscription).
           if (!appToken && !sdkEnv.ANTHROPIC_API_KEY && !sdkEnv.ANTHROPIC_AUTH_TOKEN) {
-            console.warn('[claude-client] No API key found: no active provider, no legacy settings, and no ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN in environment');
+            const keychainToken = getClaudeOAuthTokenFromKeychain();
+            if (keychainToken) {
+              sdkEnv.ANTHROPIC_AUTH_TOKEN = keychainToken;
+              console.log('[claude-client] Using OAuth token from macOS Keychain');
+            } else {
+              console.warn('[claude-client] No API key found: no active provider, no legacy settings, no ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN in environment, and no Keychain token');
+            }
           }
         }
 
diff --git a/src/lib/platform.ts b/src/lib/platform.ts
index 0be9860b..933033c2 100644
--- a/src/lib/platform.ts
+++ b/src/lib/platform.ts
@@ -234,3 +234,28 @@ export function findGitBash(): string | null {
 
   return null;
 }
+
+/**
+ * Read Claude Code's OAuth access token from macOS Keychain.
+ * Claude Code stores credentials under service "Claude Code-credentials",
+ * account = current username, as a JSON blob with shape:
+ *   { claudeAiOauth: { accessToken, refreshToken, expiresAt, ... } }
+ *
+ * Returns the accessToken string, or null if unavailable / not macOS.
+ */
+export function getClaudeOAuthTokenFromKeychain(): string | null {
+  if (process.platform !== 'darwin') return null;
+  try {
+    const raw = execFileSync(
+      '/usr/bin/security',
+      ['find-generic-password', '-a', process.env.USER || os.userInfo().username, '-w', '-s', 'Claude Code-credentials'],
+      { timeout: 3000, stdio: 'pipe' },
+    ).toString().trim();
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    const token = parsed?.claudeAiOauth?.accessToken;
+    return typeof token === 'string' && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}