From 766a27d51fce8bd8138663921025db4bbae864bc Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Thu, 13 Aug 2026 00:43:35 -0400 Subject: [PATCH 1/2] fix(claude): detect keychain authentication --- claude/SKILL.md.tmpl | 8 +++++++- test/gen-skill-docs.test.ts | 3 +++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/claude/SKILL.md.tmpl b/claude/SKILL.md.tmpl index 94552cbe4e..9572dcbfaa 100644 --- a/claude/SKILL.md.tmpl +++ b/claude/SKILL.md.tmpl @@ -45,13 +45,19 @@ If `NOT_FOUND`, stop and tell the user: Check auth: ```bash -if [ -f "$HOME/.claude/.credentials.json" ] || [ -n "${ANTHROPIC_API_KEY:-}" ]; then +if "$CLAUDE_BIN" auth status --text >/dev/null 2>&1; then + echo "AUTH_FOUND" +elif [ -f "$HOME/.claude/.credentials.json" ] || [ -n "${ANTHROPIC_API_KEY:-}" ]; then echo "AUTH_FOUND" else echo "AUTH_MISSING" fi ``` +`claude auth status` detects Claude Code logins stored in the macOS Keychain. +The file and environment checks are fallbacks for older Claude CLI versions and +API-key-based setups. + If `AUTH_MISSING`, stop and tell the user: "No Claude authentication found. Run `claude` interactively to log in, or export `ANTHROPIC_API_KEY`, then re-run this skill." diff --git a/test/gen-skill-docs.test.ts b/test/gen-skill-docs.test.ts index 3174164bd9..c3fb89fd2d 100644 --- a/test/gen-skill-docs.test.ts +++ b/test/gen-skill-docs.test.ts @@ -1776,6 +1776,8 @@ describe('Codex generation (--host codex)', () => { test('Codex output includes Claude outside-voice skill with read-only boundary', () => { const content = fs.readFileSync(path.join(AGENTS_DIR, 'gstack-claude', 'SKILL.md'), 'utf-8'); expect(content).toContain('claude -p'); + expect(content).toContain('"$CLAUDE_BIN" auth status --text'); + expect(content).toContain('detects Claude Code logins stored in the macOS Keychain'); expect(content).toContain('mktemp /tmp/gstack-claude-prompt-'); expect(content).toContain('mktemp /tmp/gstack-claude-diff-'); expect(content).not.toContain('/tmp/gstack-claude-diff-$$'); @@ -2200,6 +2202,7 @@ describe('Parameterized host smoke tests', () => { expect(fs.existsSync(skillMd)).toBe(true); const content = fs.readFileSync(skillMd, 'utf-8'); expect(content).toContain('claude -p'); + expect(content).toContain('"$CLAUDE_BIN" auth status --text'); expect(content).toContain('--disable-slash-commands'); expect(content).toContain('--allowedTools Read,Grep,Glob'); expect(content).toContain('--disallowedTools Bash,Edit,Write'); From 2f622c5aea0d948b5bb7ce4fd30cd23841a21711 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Thu, 13 Aug 2026 00:52:03 -0400 Subject: [PATCH 2/2] chore: release 1.62.0.1 --- CHANGELOG.md | 34 ++++++++++++++++++++++++++++++++++ VERSION | 2 +- package.json | 2 +- 3 files changed, 36 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b817fc9332..35ac78400b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,39 @@ # Changelog +## [1.62.0.1] - 2026-08-13 + +## **Claude reviews now recognize macOS Keychain logins.** +## **Authenticated users no longer get a false setup error from the outside-voice skill.** + +The Claude outside-voice skill previously decided whether a user was signed in by looking only for `~/.claude/.credentials.json` or `ANTHROPIC_API_KEY`. Current Claude Code installations can keep a Claude.ai login in the macOS Keychain without creating that file, so the skill could stop with “No Claude authentication found” even while `claude -p` worked normally. + +The preflight now asks the installed Claude CLI directly with `claude auth status --text`. That makes Claude Code itself the source of truth for secure-store sessions. The existing credential-file and API-key checks remain as fallbacks, preserving compatibility with older CLI versions and non-interactive API-key setups. The status probe is quiet and does not print account or credential data. + +### The numbers that matter + +| What | Before | After | +|------|--------|-------| +| Supported Keychain-backed Claude sessions | rejected | accepted | +| Existing auth fallbacks retained | 2 | 2 | +| External host renderings protected by the regression test | 0 | 9 | +| Credential or account details emitted by the probe | 0 | 0 | + +### What this means for you + +If `claude` is already logged in on macOS, Claude review commands launched from another supported coding host can use that session without requiring a duplicate API key or plaintext credential file. Run `/gstack-upgrade` to pick up the updated generated skill. + +### Itemized changes + +#### Fixed + +- `claude/SKILL.md.tmpl`: use `claude auth status --text` before the legacy file and environment heuristics, covering credentials stored in the macOS Keychain while remaining backward compatible. +- `test/gen-skill-docs.test.ts`: pin the CLI-native auth probe in the Codex output and all external-host renderings, plus assert that the generated instructions explain the Keychain behavior. + +#### For contributors + +- The change stays in the source template rather than a generated host copy, so future regeneration and gstack upgrades preserve it automatically. +- The public diff was scanned with `gstack-redact`; no credentials, account identifiers, machine paths, or organization-specific details were found. + ## [1.62.0.0] - 2026-08-12 ## **Plan reviews stop asking what to review when you're in plan mode.** diff --git a/VERSION b/VERSION index 1042f0adfa..1a09618c5c 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.62.0.0 +1.62.0.1 diff --git a/package.json b/package.json index db5d2a5d06..957ccbcb2f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.62.0.0", + "version": "1.62.0.1", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module",