Function getAuthTokenSource

src/utils/auth.ts:198–270

()

}

export function getAuthTokenSource() {
  // --bare: API-key-only. apiKeyHelper (from --settings) is the only
  // bearer-token-shaped source allowed. OAuth env vars, FD tokens, and
  // keychain are ignored.
  if (isBareMode()) {
    if (getConfiguredApiKeyHelper()) {
      return { source: 'apiKeyHelper' as const, hasToken: true }
    }
    return { source: 'none' as const, hasToken: false }
  }

  if (process.env.ANTHROPIC_AUTH_TOKEN && !isManagedOAuthContext()) {
    return { source: 'ANTHROPIC_AUTH_TOKEN' as const, hasToken: true }
  }

  if (process.env.NCODE_OAUTH_TOKEN) {
    return { source: 'NCODE_OAUTH_TOKEN' as const, hasToken: true }
  }
  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
    return { source: 'CLAUDE_CODE_OAUTH_TOKEN' as const, hasToken: true }
  }

  const sessionAccessToken = getSessionIngressAuthToken()
  if (sessionAccessToken) {
    return {
      source: process.env.CLAUDE_CODE_SESSION_ACCESS_TOKEN
        ? ('CLAUDE_CODE_SESSION_ACCESS_TOKEN' as const)
        : ('CLAUDE_SESSION_INGRESS_TOKEN_FILE' as const),
      hasToken: true,
    }
  }

  // Check for OAuth token from file descriptor (or its CCR disk fallback)
  const oauthTokenFromFd = getOAuthTokenFromFileDescriptor()
  if (oauthTokenFromFd) {
    // getOAuthTokenFromFileDescriptor has a disk fallback for CCR subprocesses
    // that can't inherit the pipe FD. Distinguish by env var presence so the
    // org-mismatch message doesn't tell the user to unset a variable that
    // doesn't exist. Call sites fall through correctly — the new source is
    // !== 'none' (cli/handlers/auth.ts → oauth_token) and not in the
    // isEnvVarToken set (auth.ts:1844 → generic re-login message).
    const oauthTokenFdEnvVar = getOAuthTokenFileDescriptorEnvVarName()
    if (oauthTokenFdEnvVar) {
      return {
        source: oauthTokenFdEnvVar as
          | 'NCODE_OAUTH_TOKEN_FILE_DESCRIPTOR'
          | 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR',
        hasToken: true,
      }
    }
    return {
      source: 'CCR_OAUTH_TOKEN_FILE' as const,
      hasToken: true,
    }
  }

  // Check if apiKeyHelper is configured without executing it
  // This prevents security issues where arbitrary code could execute before trust is established