fix: Check Claude Code CLI auth before showing warning

[Shironex]

Summary

• Fixed false positive "No Claude authentication configured" warning that appeared even when users have Claude Code CLI installed and authenticated with a subscription
• The Claude Agent SDK can reuse CLI authentication, so the warning was misleading
• Now checks for Claude Code CLI authentication indicators (settings, sessions, credentials) before showing the warning
• Updated warning message to list all three authentication options clearly

Test plan

• Start server without ANTHROPIC_API_KEY but with Claude Code CLI authenticated → should show ✓ Claude Code CLI authentication detected
• Start server without any authentication → should show the updated warning with all 3 options
• Start server with ANTHROPIC_API_KEY set → should show ✓ ANTHROPIC_API_KEY detected

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Enhanced startup authentication detection that checks multiple authentication methods in the background and logs outcomes.
  • Improved warning dialog with clearer, option-based guidance (CLI, API key, or setup wizard) when no authentication is found.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[gemini-code-assist]

Summary of Changes

Hello @Shironex, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the server's authentication detection mechanism to prevent a misleading warning for users leveraging Claude Code CLI. It introduces a comprehensive check for CLI-based authentication, ensuring that the system correctly identifies authenticated environments. Additionally, the user-facing warning message has been improved to offer clearer guidance on all supported authentication methods, enhancing the overall user experience.

Highlights

• False Positive Warning Fix: Resolved an issue where a "No Claude authentication configured" warning was incorrectly displayed even when Claude Code CLI was installed and authenticated.
• CLI Authentication Detection: Implemented logic to proactively check for Claude Code CLI authentication indicators (settings, sessions, credentials) at server startup.
• Enhanced Warning Message: Updated the authentication warning message to clearly list all three available authentication options, including Claude Code CLI, ANTHROPIC_API_KEY, and the setup wizard.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Walkthrough

Startup now performs an asynchronous Claude authentication check: it first checks for ANTHROPIC_API_KEY, and if absent, runs getClaudeAuthIndicators to detect Claude Code CLI; outcomes are logged and an updated warning dialog with configuration options is shown during initialization.

Changes

Cohort / File(s)	Summary
Async Authentication Check apps/server/src/index.ts	Replaces synchronous ANTHROPIC_API_KEY presence check with an async IIFE at startup. Imports getClaudeAuthIndicators from @automaker/platform. Detects Claude Code CLI as fallback, logs results, and updates warning dialog content and option flow.

Sequence Diagram(s)

sequenceDiagram
  participant Server as Server Startup
  participant Platform as `@automaker/platform`
  participant User as UI / Developer

  Server->>Server: read ANTHROPIC_API_KEY
  alt ANTHROPIC_API_KEY present
    Server->>User: log detection & continue
  else no env key
    Server->>Platform: call getClaudeAuthIndicators()
    Platform-->>Server: return indicators (found / not found)
    alt indicators found
      Server->>User: log Claude CLI detected
    else none found
      Server->>User: show warning dialog with options (Claude CLI, Anthropic API key, setup wizard)
    end
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through startup, ears alert and spry,
Sniffed for keys and CLI beneath the sky,
Async I checked while logs softly chimed,
Found a clue or nudged a hint in time,
A little hop to keep auth woes shy.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and accurately describes the main change: adding a check for Claude Code CLI authentication before displaying the authentication warning, which is the primary fix in this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request correctly addresses an issue where a false positive warning for Claude authentication was shown. The new logic properly checks for Claude Code CLI authentication before displaying the warning, which is a significant improvement. The updated warning message is also much clearer and more helpful to the user. The use of an async IIFE is a good choice to perform this check without blocking server startup. I have one suggestion to improve diagnosability by logging potential errors when checking for CLI authentication.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@apps/server/src/index.ts`:
- Around line 130-137: The CLI auth check incorrectly ignores API key auth: in
the block using getClaudeAuthIndicators() update the hasCliAuth computation
(variable hasCliAuth) to consider indicators.credentials.hasApiKey in addition
to indicators.credentials?.hasOAuthToken so API-key authenticated CLIs are
treated as valid; locate the hasCliAuth assignment and include the hasApiKey
condition alongside hasOAuthToken.