fix: remove --bare flag to restore OAuth login for Claude Pro/Max #32

Merged

dev merged 1 commit from fix/remove-bare-flag into main

2026-04-09 11:56:24 +00:00

dev commented

2026-04-09 11:55:47 +00:00

Owner

Problem

--bare disables OAuth/keychain auth entirely and requires ANTHROPIC_API_KEY, which breaks Claude Pro/Max subscriptions. Even after removing CI=true, users saw "Not logged in" because --bare was still forcing API key mode.

Solution

Remove --bare and --append-system-prompt-file from the runner args.

CLAUDE.md isolation is achieved structurally: workspaces live under ~/.disclaw/workspaces/ (outside the DisClaw repo), so CLAUDE.md walk-up never reaches the DisClaw project CLAUDE.md. No flag needed.

Changes

src/agent/runner.ts: removed --bare and --append-system-prompt-file from args
tests/integration/no-parent-claude-md-leak.test.ts: rewritten to assert --bare is absent and verify correct args (-p, --output-format json) are present
tests/unit/sanitize-env.test.ts: fixed 2 tests that expected CI=true (already removed in PR #29)

Tests

35/35 passing. npm run build && npm test green.

Security checklist

No secrets in diff
No shell: true introduced
sanitizedEnv() still strips Discord tokens from child env

## Problem `--bare` disables OAuth/keychain auth entirely and requires `ANTHROPIC_API_KEY`, which breaks Claude Pro/Max subscriptions. Even after removing `CI=true`, users saw "Not logged in" because `--bare` was still forcing API key mode. ## Solution Remove `--bare` and `--append-system-prompt-file` from the runner args. CLAUDE.md isolation is achieved **structurally**: workspaces live under `~/.disclaw/workspaces/` (outside the DisClaw repo), so CLAUDE.md walk-up never reaches the DisClaw project CLAUDE.md. No flag needed. ## Changes - `src/agent/runner.ts`: removed `--bare` and `--append-system-prompt-file` from args - `tests/integration/no-parent-claude-md-leak.test.ts`: rewritten to assert `--bare` is **absent** and verify correct args (`-p`, `--output-format json`) are present - `tests/unit/sanitize-env.test.ts`: fixed 2 tests that expected `CI=true` (already removed in PR #29) ## Tests 35/35 passing. `npm run build && npm test` green. ## Security checklist - [x] No secrets in diff - [x] No `shell: true` introduced - [x] `sanitizedEnv()` still strips Discord tokens from child env

dev added 1 commit 2026-04-09 11:55:47 +00:00

fix: remove --bare flag to restore OAuth login for Claude Pro/Max

CI / build-and-test (ubuntu-latest) (pull_request) Has been cancelled

Details

CI / build-and-test (windows-latest) (pull_request) Has been cancelled

Details

CI / lint (pull_request) Has been cancelled

Details

aad45b9637

--bare disables OAuth/keychain auth and requires ANTHROPIC_API_KEY,
breaking Claude Pro/Max subscriptions. CLAUDE.md isolation is now
achieved structurally: workspaces live under ~/.disclaw/workspaces/
(outside the repo) so walk-up never reaches DisClaw's CLAUDE.md.

Update integration test to assert --bare is absent and verify correct
args (-p, --output-format json). Fix sanitize-env tests to reflect
CI=true removal (was breaking OAuth headless-mode detection).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>