docs(acp): correct subscription auth for codex-acp and claude-agent-acp - #4623
Open
asatire1 wants to merge 1 commit into
Open
docs(acp): correct subscription auth for codex-acp and claude-agent-acp#4623asatire1 wants to merge 1 commit into
asatire1 wants to merge 1 commit into
Conversation
The Codex section said an OpenAI API key was required, "not a ChatGPT
subscription", and described a 426 WebSocket fallback. That is no longer
how the adapter behaves: codex-acp reuses the Codex CLI's stored login at
~/.codex/auth.json, and reads CODEX_API_KEY/OPENAI_API_KEY only when the
api-key auth method is selected.
The Claude section told operators to export ANTHROPIC_API_KEY, which is
also unnecessary — claude-agent-acp advertises claude-ai-login ("Claude
Subscription") alongside console-login ("Anthropic Console (API usage
billing)"). It does keep its own credential store rather than inheriting
an existing Claude Code login, so the one-time --claudeai command is now
shown explicitly.
Neither claim was true because buzz-acp injects no auth of its own:
AcpClient::spawn uses tokio::process::Command with no env_clear(), so the
adapter's own login applies.
Verified against codex-acp 1.1.9 and claude-agent-acp 0.64.2 by driving
each adapter through initialize -> session/new -> session/prompt with
ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY and CLAUDE_CODE_OAUTH_TOKEN
removed from the child environment. Both completed a turn with
stopReason: end_turn. Also confirmed end-to-end through buzz-acp against a
local relay: the agent replied to an @mention with zero *_API_KEY vars in
the harness process environment.
Signed-off-by: asatire1 <asatire@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
buzz-acpREADME tells operators they need API keys for both Codex and Claude. Neither is true against the current adapters.Codex. The section said
OPENAI_API_KEYwas "required — use an OpenAI API key, not a ChatGPT subscription", and described a426 Upgrade RequiredWebSocket fallback.codex-acp1.1.9 reuses the Codex CLI's stored login at~/.codex/auth.json, and readsCODEX_API_KEY/OPENAI_API_KEYonly when the api-key auth method is selected.Claude. The section said to export
ANTHROPIC_API_KEY.claude-agent-acp0.64.2 advertisesclaude-ai-login("Claude Subscription") alongsideconsole-login("Anthropic Console (API usage billing)"). It does keep its own credential store rather than inheriting an existing Claude Code login, so the one-time--claudeaicommand is now shown explicitly rather than left implicit.Neither claim held because
buzz-acpinjects no auth of its own —AcpClient::spawnusestokio::process::Commandwith noenv_clear(), and gives inherited parent env precedence over anything Buzz sets, so the adapter's own login applies. This is documentation only; no behaviour changes.Testing
initialize→session/new→session/promptwithANTHROPIC_API_KEY,OPENAI_API_KEY,CODEX_API_KEYandCLAUDE_CODE_OAUTH_TOKENremoved from the child environment. Both completed a turn withstopReason: end_turn.buzz-acpagainst a local relay: agent replied to an@mentionin-channel, with zero*_API_KEYvars in the harness process environment (ps eww).codex-acp1.1.9,claude-agent-acp0.64.2.Note on #4611
#4611 proposes launching Claude ACP adapters with an allowlisted environment and a disposable home, which would deliberately stop this credential inheritance. If that lands, the Claude auth note here needs revisiting — happy to fold this into that PR instead if the maintainers prefer.