2.9 KiB
Phase 4: Auth Passthrough - Discussion Log
Audit trail only. Do not use as input to planning, research, or execution agents. Decisions captured in CONTEXT.md — this log preserves the Q&A.
Date: 2026-04-10 Phase: 04-auth-passthrough Mode: discuss Areas discussed: Missing credentials fallback, Audit display, API key + OAuth coexistence, Which credential files
Areas Discussed
Missing credentials fallback
| Question | Options | Selected |
|---|---|---|
| What should happen if ~/.claude/.credentials.json doesn't exist on the host? | Skip silently / Warn in audit / Hard error | Skip silently |
Rationale: No credentials = no subscription access inside sandbox. Claude will prompt to log in. No need to warn or error.
Audit display
| Question | Options | Selected |
|---|---|---|
| Should the credential mount appear in the pre-launch env audit? | Show in audit / Silent | Show in audit |
User input: Requested a broader audit redesign — three sections (env, mounts, network), unified env var list with color + prefix-based categorization. Not just a minimal mount line.
| Question | Options | Selected |
|---|---|---|
| Fold audit redesign into Phase 4 or defer? | Fold into Phase 4 / Phase 4 shows mount only | Fold into Phase 4 |
Rationale: Phase 4 already touches the audit; doing the full redesign avoids a half-done audit screen.
| Question | Options | Selected |
|---|---|---|
| Color scheme for unified env var list? | Green/Yellow/Cyan / Green/Yellow/Magenta / You decide | Green/Yellow/Cyan + accessibility prefixes |
User input: Requested accessibility prefixes alongside colors: [~] sandbox-generated, [>] host allowlisted, [+] user-configured.
| Question | Options | Selected |
|---|---|---|
| Prefix characters? | [S]/[H]/[U] / [~]/[>]/[+] / You decide | [~] / [>] / [+] |
API key + OAuth coexistence
| Question | Options | Selected |
|---|---|---|
| When ANTHROPIC_API_KEY is set, still mount credentials? | Always mount if credentials exist / Skip mount when API key is set | Always mount if credentials exist |
Rationale: Simpler logic. Claude Code handles precedence internally.
Which credential files
| Question | Options | Selected |
|---|---|---|
| Which auth files to mount? | .credentials.json only / Entire ~/.claude / credentials.json + .oauth-token | .credentials.json only |
Rationale: Minimal surface. Other ~/.claude contents belong to Phase 5 (instance isolation).
Corrections Made
None — all selections were user-confirmed choices.
Scope Notes
- Audit redesign (three sections, color + prefix) folded into Phase 4 scope at user request.
- Network section in audit is a placeholder in Phase 4 — Phase 6 makes it dynamic.