Drop Claude auth token helper support

- Require `claude auth login` for Claude setup
- Remove helper-command settings, contracts, and picker logic
- Update related error and setup copy

Author: BunsDev

apps/server/src/doctor.ts

@@ -87,9 +87,7 @@ const doctorProgram = Effect.gen(function* () {
     console.log("No providers are ready. Set up at least one provider to start coding:");
     console.log("");
     console.log("  Codex:  npm install -g @openai/codex && codex login");
-    console.log(
-      "  Claude Code: npm install -g @anthropic-ai/claude-code && claude auth login (or set ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN)",
-    );
+    console.log("  Claude Code: npm install -g @anthropic-ai/claude-code && claude auth login");
     console.log("  Copilot: npm install -g @github/copilot && copilot login");
   } else if (readyCount === statuses.length) {
     console.log("All providers are ready.");

apps/web/src/appSettings.test.ts

@@ -26,7 +26,6 @@ describe("AppSettingsSchema", () => {
     expect(settings.showNotificationDetails).toBe(false);
     expect(settings.includeDiagnosticsTipsInCopy).toBe(false);
     expect(settings.browserPreviewStartPageUrl).toBe("");
-    expect(settings.claudeAuthTokenHelperCommand).toBe("");
   });
 
   it("defaults sidebar appearance controls", () => {
@@ -64,11 +63,10 @@ describe("AppSettingsSchema", () => {
 });
 
 describe("getProviderStartOptions", () => {
-  it("includes the Claude auth token helper command when configured", () => {
+  it("includes the Claude binary path when configured", () => {
     expect(
       getProviderStartOptions({
-        claudeBinaryPath: "",
-        claudeAuthTokenHelperCommand: "op read op://shared/anthropic/token --no-newline",
+        claudeBinaryPath: "/usr/local/bin/claude",
         codexBinaryPath: "",
         codexHomePath: "",
         copilotBinaryPath: "",
@@ -78,7 +76,7 @@ describe("getProviderStartOptions", () => {
       }),
     ).toEqual({
       claudeAgent: {
-        authTokenHelperCommand: "op read op://shared/anthropic/token --no-newline",
+        binaryPath: "/usr/local/bin/claude",
       },
     });
   });

apps/web/src/appSettings.ts

@@ -91,9 +91,6 @@ export const AppSettingsSchema = Schema.Struct({
   claudeBinaryPath: Schema.String.check(Schema.isMaxLength(4096)).pipe(withDefaults(() => "")),
   copilotBinaryPath: Schema.String.check(Schema.isMaxLength(4096)).pipe(withDefaults(() => "")),
   copilotConfigDir: Schema.String.check(Schema.isMaxLength(4096)).pipe(withDefaults(() => "")),
-  claudeAuthTokenHelperCommand: Schema.String.check(Schema.isMaxLength(4096)).pipe(
-    withDefaults(() => ""),
-  ),
   codexBinaryPath: Schema.String.check(Schema.isMaxLength(4096)).pipe(withDefaults(() => "")),
   codexHomePath: Schema.String.check(Schema.isMaxLength(4096)).pipe(withDefaults(() => "")),
   backgroundImageUrl: Schema.String.check(Schema.isMaxLength(4096)).pipe(withDefaults(() => "")),
@@ -265,7 +262,6 @@ function normalizeAppSettings(settings: AppSettings): AppSettings {
     ...settings,
     backgroundImageUrl: settings.backgroundImageUrl.trim(),
     browserPreviewStartPageUrl: settings.browserPreviewStartPageUrl.trim(),
-    claudeAuthTokenHelperCommand: settings.claudeAuthTokenHelperCommand.trim(),
     backgroundImageOpacity: clampBackgroundOpacity(settings.backgroundImageOpacity),
     sidebarOpacity: clampOpacity(settings.sidebarOpacity),
     sidebarProjectRowHeight: clampSidebarProjectRowHeight(settings.sidebarProjectRowHeight),
@@ -389,7 +385,6 @@ export function getProviderStartOptions(
     | "claudeBinaryPath"
     | "copilotBinaryPath"
     | "copilotConfigDir"
-    | "claudeAuthTokenHelperCommand"
     | "codexBinaryPath"
     | "codexHomePath"
     | "openclawGatewayUrl"
@@ -405,13 +400,10 @@ export function getProviderStartOptions(
           },
         }
       : {}),
-    ...(settings.claudeBinaryPath || settings.claudeAuthTokenHelperCommand
+    ...(settings.claudeBinaryPath
       ? {
           claudeAgent: {
             ...(settings.claudeBinaryPath ? { binaryPath: settings.claudeBinaryPath } : {}),
-            ...(settings.claudeAuthTokenHelperCommand
-              ? { authTokenHelperCommand: settings.claudeAuthTokenHelperCommand }
-              : {}),
           },
         }
       : {}),

apps/web/src/components/ChatView.tsx

@@ -867,9 +867,8 @@ export default function ChatView({ threadId, onMinimize }: ChatViewProps) {
       getSelectableThreadProviders({
         statuses: providerStatuses,
         openclawGatewayUrl: settings.openclawGatewayUrl,
-        claudeAuthTokenHelperCommand: settings.claudeAuthTokenHelperCommand,
       }),
-    [providerStatuses, settings.claudeAuthTokenHelperCommand, settings.openclawGatewayUrl],
+    [providerStatuses, settings.openclawGatewayUrl],
   );
   const hasThreadStarted = Boolean(
     activeThread &&

apps/web/src/components/chat/ProviderSetupCard.tsx

@@ -27,9 +27,9 @@ const PROVIDER_CONFIG = {
   },
   claudeAgent: {
     installCmd: "npm install -g @anthropic-ai/claude-code",
-    authCmd: "set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN",
+    authCmd: "claude auth login",
     verifyCmd: "claude auth status",
-    note: "You can also configure a Claude auth token helper command or one-click secret-manager preset in Settings.",
+    note: "Claude Code must be installed and signed in through the CLI before it can be used.",
   },
   copilot: {
     installCmd: "npm install -g @github/copilot",

apps/web/src/components/chat/threadError.test.ts

@@ -48,7 +48,7 @@ describe("humanizeThreadError", () => {
     ).toBe(true);
     expect(
       isAuthenticationThreadError(
-        "Claude is not configured with a supported Anthropic credential. Set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN and try again.",
+        "Claude Code must be authenticated with `claude auth login` before starting a session. API key and auth token credentials are not supported.",
       ),
     ).toBe(true);
   });
@@ -81,11 +81,9 @@ describe("humanizeThreadError", () => {
     ).toContain("Troubleshooting:");
     expect(
       buildThreadErrorDiagnosticsCopy(
-        "Claude Code is signed in with OAuth, which is not supported here. Set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN and try again.",
+        "Claude Code must be authenticated with `claude auth login` before starting a session. API key and auth token credentials are not supported.",
         { includeTips: true },
       ),
-    ).toContain(
-      "Set `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` in the runtime environment and retry the turn.",
-    );
+    ).toContain("Run `claude auth login` and retry the turn.");
   });
 });

apps/web/src/components/chat/threadError.ts

@@ -38,7 +38,7 @@ function extractWorktreeDetail(error: string): string | null {
 function getProviderLoginCommand(error: string): string | null {
   const lower = error.toLowerCase();
   if (lower.includes("claude")) {
-    return "`ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN`";
+    return "`claude auth login`";
   }
   if (lower.includes("codex")) {
     return "`codex login`";

apps/web/src/lib/providerAvailability.test.ts

@@ -49,16 +49,6 @@ describe("providerAvailability", () => {
     ).toBe(false);
   });
 
-  it("allows Claude when a local auth token helper is configured", () => {
-    expect(
-      isProviderReadyForThreadSelection({
-        provider: "claudeAgent",
-        statuses: [makeStatus("claudeAgent", { status: "error", authStatus: "unauthenticated" })],
-        claudeAuthTokenHelperCommand: "op read op://shared/anthropic/token --no-newline",
-      }),
-    ).toBe(true);
-  });
-
   it("treats configured OpenClaw as selectable even when server auth state is unknown", () => {
     expect(
       isProviderReadyForThreadSelection({
@@ -77,9 +67,8 @@ describe("providerAvailability", () => {
           makeStatus("codex"),
           makeStatus("claudeAgent", { status: "error", authStatus: "unauthenticated" }),
         ],
-        claudeAuthTokenHelperCommand: "op read op://shared/anthropic/token --no-newline",
       }),
-    ).toEqual(["codex", "claudeAgent", "openclaw"]);
+    ).toEqual(["codex", "openclaw"]);
   });
 
   it("falls back to the first selectable provider when the preferred one is unavailable", () => {

apps/web/src/lib/providerAvailability.ts

@@ -31,7 +31,6 @@ export function isProviderReadyForThreadSelection(input: {
   provider: ProviderKind;
   statuses: ReadonlyArray<ServerProviderStatus>;
   openclawGatewayUrl?: string | null | undefined;
-  claudeAuthTokenHelperCommand?: string | null | undefined;
 }): boolean {
   const status = getProviderStatusByKind(input.statuses, input.provider);
 
@@ -46,30 +45,19 @@ export function isProviderReadyForThreadSelection(input: {
     return false;
   }
 
-  if (
-    input.provider === "claudeAgent" &&
-    (input.claudeAuthTokenHelperCommand ?? "").trim().length > 0 &&
-    status.available &&
-    (status.authStatus ?? status.auth?.status) === "unauthenticated"
-  ) {
-    return true;
-  }
-
   const authStatus = status.authStatus ?? status.auth?.status;
   return Boolean(status.available && status.status === "ready" && authStatus !== "unauthenticated");
 }
 
 export function getSelectableThreadProviders(input: {
   statuses: ReadonlyArray<ServerProviderStatus>;
   openclawGatewayUrl?: string | null | undefined;
-  claudeAuthTokenHelperCommand?: string | null | undefined;
 }): ProviderKind[] {
   return THREAD_PROVIDER_ORDER.filter((provider) =>
     isProviderReadyForThreadSelection({
       provider,
       statuses: input.statuses,
       openclawGatewayUrl: input.openclawGatewayUrl,
-      claudeAuthTokenHelperCommand: input.claudeAuthTokenHelperCommand,
     }),
   );
 }