fix(shell): address coderabbit oauth review

Author: konard

.github/actions/setup/action.yml

@@ -58,8 +58,25 @@ runs:
     - name: Install dependencies
       shell: bash
       run: |
+        run_bun_install() {
+          local timeout_seconds=$((20 * 60))
+          bun install --frozen-lockfile &
+          local install_pid="$!"
+          (
+            sleep "$timeout_seconds"
+            echo "bun install exceeded 20 minutes; terminating" >&2
+            kill "$install_pid" 2>/dev/null || true
+          ) &
+          local timeout_pid="$!"
+          local status=0
+          wait "$install_pid" || status="$?"
+          kill "$timeout_pid" 2>/dev/null || true
+          wait "$timeout_pid" 2>/dev/null || true
+          return "$status"
+        }
+
         for attempt in 1 2 3; do
-          if bun install --frozen-lockfile; then
+          if run_bun_install; then
             exit 0
           fi
           if [[ "$attempt" == "3" ]]; then

packages/lib/src/shell/claude-oauth-env.ts

@@ -203,21 +203,15 @@ export const runClaudeOauthLoginWithPrompt = (
   cwd: string,
   accountPath: string,
   options: {
-    readonly envToken: string | null
     readonly image: string
     readonly containerPath: string
   }
-): Effect.Effect<string, AuthError | CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> => {
-  if (options.envToken !== null) {
-    return Effect.succeed(options.envToken)
-  }
-
-  return Effect.scoped(
+): Effect.Effect<string, AuthError | CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
+  Effect.scoped(
     Effect.gen(function*(_) {
       const executor = yield* _(CommandExecutor.CommandExecutor)
       const hostPath = yield* _(resolveDockerVolumeHostPath(cwd, accountPath))
       const result = yield* _(runClaudeDockerOauthEffect(cwd, accountPath, hostPath, options, executor))
       return yield* _(resolveClaudeDockerOauthTokenResult(result))
     })
   )
-}

packages/lib/src/usecases/auth-claude-oauth.ts

@@ -12,7 +12,6 @@ import { Effect } from "effect"
 
 import type { AuthClaudeLoginCommand, AuthClaudeLogoutCommand, AuthClaudeStatusCommand } from "../core/domain.js"
 import { defaultTemplateConfig } from "../core/domain.js"
-import { readDockerGitClaudeOauthTokenFromProcessEnv } from "../shell/claude-oauth-env.js"
 import { runDockerAuth, runDockerAuthExitCode } from "../shell/docker-auth.js"
 import type { AuthError } from "../shell/errors.js"
 import { CommandFailedError } from "../shell/errors.js"
@@ -284,7 +283,6 @@ export const authClaudeLogin = (
     runClaudeLoginFlow({
       accountLabel,
       captureToken: runClaudeOauthLoginWithPrompt(cwd, accountPath, {
-        envToken: readDockerGitClaudeOauthTokenFromProcessEnv(),
         image: claudeImageName,
         containerPath: claudeContainerHomeDir
       }),

packages/lib/src/usecases/auth-claude.ts

@@ -227,14 +227,14 @@ describe("authClaudeLogin", () => {
       )
     ).pipe(Effect.provide(NodeContext.layer)))
 
-  it.effect("uses a decoded docker-git OAuth env token without running setup-token", () =>
+  it.effect("ignores docker-git OAuth env token and captures setup-token output", () =>
     withTempDir((root) =>
       withPatchedEnv(
         {
           HOME: root,
           DOCKER_GIT_STATE_AUTO_SYNC: "0",
           DOCKER_GIT_PROJECTS_ROOT: undefined,
-          [dockerGitClaudeOauthTokenEnvKey]: ` ${oauthToken} `
+          [dockerGitClaudeOauthTokenEnvKey]: "ENV_CLAUDE_OAUTH_TOKEN_SHOULD_NOT_WIN"
         },
         Effect.gen(function*(_) {
           const fs = yield* _(FileSystem.FileSystem)
@@ -248,13 +248,14 @@ describe("authClaudeLogin", () => {
               label: null,
               claudeAuthPath
             }).pipe(
-              Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(null, 0, invocations))
+              Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(oauthToken, 0, invocations))
             )
           )
 
           const tokenText = yield* _(fs.readFileString(path.join(claudeAuthPath, "default", ".oauth-token")))
           expect(tokenText.trim()).toBe(oauthToken)
-          expect(invocations.some((invocation) => isSetupToken(invocation.args))).toBe(false)
+          expect(tokenText.trim()).not.toBe("ENV_CLAUDE_OAUTH_TOKEN_SHOULD_NOT_WIN")
+          expect(invocations.some((invocation) => isSetupToken(invocation.args))).toBe(true)
           expect(invocations.some((invocation) => isPingProbe(invocation.args))).toBe(true)
         })
       )