Accept CLAUDE_CODE_OAUTH_TOKEN for the PR visual recap claude backend - #2764
Accept CLAUDE_CODE_OAUTH_TOKEN for the PR visual recap claude backend#2764busbyk wants to merge 3 commits into
Conversation
…de backend Reusable workflows can only receive secrets declared in their workflow_call contract, so callers had no way to bill recaps to a Claude subscription even though the Claude Code CLI already honors CLAUDE_CODE_OAUTH_TOKEN. Declare the token as an optional secret, give the gate a presence-only signal for it so the claude backend passes on either credential, and pass it into both Claude Code invocations. Empty passthrough values are unset before the CLI runs so an unconfigured secret is not mistaken for the chosen auth path.
…docs The reusable workflow now accepts CLAUDE_CODE_OAUTH_TOKEN, so the copy and fork workflows, the caller template recap setup writes, and the gate twin the CLI evaluates all need the same alternative or they disagree about what a working repo looks like — recap doctor would report ANTHROPIC_API_KEY missing on a repo whose recaps run fine. recapRequiredSecrets now returns interchangeable secret names rather than one name per backend, so setup pushes whichever credential is available locally and doctor accepts either, warning only when both are configured.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Visual recap — skippedThe visual recap job did not run for this pull request. This is informational only and does not block the PR. Recap skipped for |
![builder-io-integration[bot]](https://avatars.githubusercontent.com/in/353721?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…t shape The core CLI re-exports @agent-native/recap-cli, and its spec still asserted the flat string[] result and the old claude-backend gate message. Update both and cover the OAuth-only gate path in the suite that actually gates CI.
There was a problem hiding this comment.
Builder reviewed your changes — looks good ✅
Review Details
Incremental Code Review Summary
The latest commit updates the previously flagged core recap assertions and gate expectations to the new RecapSecretRequirement[] shape, so both prior review threads were verified as fixed and resolved. The OAuth credential is now consistently declared and propagated through the reusable, fork, copy, and generated caller workflows; the gate accepts either credential, empty secret values are removed before Claude Code runs, and setup/doctor/redaction behavior remains coherent. The added recap-cli tests pass, and the second independent review found no additional confirmed defects.
Risk level: High, because the change affects CI authentication and secret handling. No new actionable findings were identified in this incremental review.
🧪 Browser testing: Skipped — PR only modifies workflows, CLI/backend logic, tests, and documentation; there is no user-facing UI impact.
1 participant
Fixes #2741.
Summary
CLAUDE_CODE_OAUTH_TOKENin the reusable workflow'sworkflow_callsecrets, accept it in the gate as an alternative toANTHROPIC_API_KEY, and pass it into both Claude Code invocationsrecap setup/recap doctorpr-visual-recap.mdxand the ten locale copiesValidation
PLAN_RECAP_TOKENandCLAUDE_CODE_OAUTH_TOKEN, with noANTHROPIC_API_KEYin the secrets block. The gate loggedVisual recap will run (claude)., the Opus agent step ran 783s authenticated by the subscription token, and the recap published: https://plan.agent-native.com/recaps/recap-8c80f6aa71f447f6pnpm guardspassed all 47 checkspnpm --filter @agent-native/recap-cli typecheckpassedpnpm --filter @agent-native/recap-cli testpassed 10/10, including new gate cases for OAuth-only and for neither credential configuredpnpm fmt:checkcleanactionlinton the three recap workflows: no new findings versusmainCallers should set exactly one credential — with both configured the billing path is whichever the CLI prefers, so the secrets contract, the docs, and
recap doctorall say so. A secret a caller leaves unset still reaches the step as an empty env var, so both invocation steps drop empty values before running the CLI.recapRequiredSecretsnow returns interchangeable secret names rather than one name per backend; that is the breaking change behind the@agent-native/recap-climinor bump. NWACus/web is ready to switch its caller to the subscription token once this merges.