feat: UNCOMPACT_DASHBOARD_URL override and --debug logging for auth flow#568
Merged
greynewell merged 6 commits intomainfrom Mar 9, 2026
Merged
Conversation
…flow Two things needed to debug auth issues against staging: 1. UNCOMPACT_DASHBOARD_URL env var — overrides the dashboard base URL so the CLI auth flow can be pointed at a staging environment without recompiling: UNCOMPACT_DASHBOARD_URL=https://staging.dashboard.example.com uncompact auth login 2. --debug flag wired into authLoginBrowser — logs the full dashboard URL opened, every incoming callback request (with full query string), state comparison result, and key receipt so the exact failure point is visible: uncompact auth login --debug Co-Authored-By: Grey Newell <greyshipscode@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughAdds env overrides for dashboard/API URLs and a new EffectiveCLIAuthURL(); instruments browser-based auth login with debug logs; and adds an optional automatic Claude Code hooks installation flow after saving auth keys (diff preview, prompt, and install). Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant User as User
participant CLI as CLI
participant Browser as Browser/Dashboard
participant CB as CallbackServer
participant Hooks as HooksInstaller
User->>CLI: run `auth login`
CLI->>Browser: open EffectiveCLIAuthURL
Browser-->>CB: user authenticates -> redirect callback
CB->>CLI: deliver callback (state, query)
CLI->>CLI: validate state & save key
CLI->>Hooks: autoInstallHooks() -> find settings & compute diff
Hooks->>User: show diff & prompt to install
User-->>Hooks: confirm install
Hooks->>Hooks: perform install
Hooks-->>CLI: return install result
CLI->>User: print final status / guidance
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
internal/config/config.go (1)
45-52: Consider making the dashboard override the single source of truth.Right now only the browser-login URL respects
UNCOMPACT_DASHBOARD_URL. The same auth flow still falls back to production URLs incmd/auth.goLine 51 and Lines 224-228, so a staging run can quietly bounce back to prod after any browser-login failure. I’d derive the dashboard root, key page, and CLI auth URL from one helper.♻️ Suggested shape
+func EffectiveDashboardURL() string { + if override := strings.TrimSpace(os.Getenv(EnvDashboardURL)); override != "" { + return strings.TrimRight(override, "/") + } + return DashboardURL +} + +func EffectiveDashboardKeyURL() string { + return EffectiveDashboardURL() + "/api-keys/" +} + func EffectiveCLIAuthURL() string { - if override := os.Getenv(EnvDashboardURL); override != "" { - return strings.TrimRight(override, "/") + "/cli-auth/" - } - return DashboardCLIAuthURL + return EffectiveDashboardURL() + "/cli-auth/" }Then switch the
cmd/auth.gocall sites that currently useDashboardKeyURL/DashboardURLto the effective helpers too.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/config/config.go` around lines 45 - 52, The code only uses EffectiveCLIAuthURL() for the CLI auth path but other places still reference DashboardURL and DashboardKeyURL directly, allowing staging runs to fall back to production; add a single-source helper (e.g., EffectiveDashboardRoot() that reads EnvDashboardURL and defaults to DashboardURL) and derive EffectiveCLIAuthURL() and EffectiveDashboardKeyURL() from that root, then replace usages of DashboardURL and DashboardKeyURL in cmd/auth.go with the new effective helpers so all auth-related URLs come from the same override logic.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cmd/auth.go`:
- Around line 140-145: The debug logging currently prints sensitive data (full
URL and state token) via r.URL.String() and gotState; update the logging to
redact secrets before output: parse r.URL.Query(), replace values for sensitive
keys like "key", "state", "token" (or any long-looking API keys) with
"<redacted>" and log the sanitized URL or only the path plus sanitized query
instead of r.URL.String(), and for the state comparison log (where gotState and
state are used) avoid printing raw token values—either mask them (e.g., show
first/last chars) or log only whether they matched; make these changes in the
logFn calls referenced (logFn, r.URL, gotState, state) and apply the same
redaction approach to the other occurrence around lines 182-183.
---
Nitpick comments:
In `@internal/config/config.go`:
- Around line 45-52: The code only uses EffectiveCLIAuthURL() for the CLI auth
path but other places still reference DashboardURL and DashboardKeyURL directly,
allowing staging runs to fall back to production; add a single-source helper
(e.g., EffectiveDashboardRoot() that reads EnvDashboardURL and defaults to
DashboardURL) and derive EffectiveCLIAuthURL() and EffectiveDashboardKeyURL()
from that root, then replace usages of DashboardURL and DashboardKeyURL in
cmd/auth.go with the new effective helpers so all auth-related URLs come from
the same override logic.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7d7483e6-c5f0-4caf-9423-e2786dcbcf99
📒 Files selected for processing (2)
cmd/auth.gointernal/config/config.go
The staging dashboard issues keys that are only valid against the staging API. Without an API URL override, the CLI validates them against production and gets "invalid API key". UNCOMPACT_API_URL lets both overrides be set together for a full staging test: UNCOMPACT_DASHBOARD_URL=https://staging-dashboard.supermodeltools.com \ UNCOMPACT_API_URL=https://staging-api.supermodeltools.com \ uncompact auth login --debug Co-Authored-By: Grey Newell <greyshipscode@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
After successful authentication, automatically offer to install the Claude Code hooks so the entire setup is a single command. Previously users had to run 'uncompact auth login' then 'uncompact install' separately; now auth login handles both steps. If hooks are already installed, confirms silently. If not, shows the diff and prompts for confirmation before writing — matching the behaviour of 'uncompact install' but without requiring a separate command. Co-Authored-By: Grey Newell <greyshipscode@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…or upgrades Previously postinstall ran 'install --yes' then printed a message telling the user to run 'uncompact auth login' separately — two steps. Now: - Fresh install (not authenticated): postinstall runs 'auth login', which handles browser OAuth + hook installation in one flow. npm install -g uncompact is the only command a new user needs to run. - Upgrade (already authenticated): postinstall runs 'install --yes' to ensure hooks are current without re-prompting for auth. Co-Authored-By: Grey Newell <greyshipscode@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Quick Start is now a single command: npm install -g uncompact --foreground-scripts - auth login flow documented as handling both auth and hook installation - Added UNCOMPACT_API_URL and UNCOMPACT_DASHBOARD_URL to env vars table - Updated caching strategy to reflect fast-fail on connection errors - Removed now-redundant separate auth and install steps Co-Authored-By: Grey Newell <greyshipscode@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The callback URL contains key=smsk_... and state=<token> — both secrets. Logging r.URL.String() or raw state values would expose them in CI logs, bug reports, and support tickets. - Callback log now prints only the path and param names (never values) - State mismatch log drops the raw token values entirely - Dashboard URL log shows port only; state is marked <redacted> Co-Authored-By: Grey Newell <greyshipscode@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When the browser freezes after GitHub auth, there was no way to:
Changes
1. `UNCOMPACT_DASHBOARD_URL` env var
Overrides the dashboard base domain used to build the CLI auth URL. No recompile needed for staging tests:
```sh
UNCOMPACT_DASHBOARD_URL=https://staging.dashboard.supermodeltools.com uncompact auth login
```
Implemented in `config.EffectiveCLIAuthURL()` — falls back to the production constant when the env var is not set.
2. `--debug` wired into `authLoginBrowser`
Running `uncompact auth login --debug` now emits:
```
[debug] auth: callback server listening on 127.0.0.1:PORT
[debug] auth: dashboard URL: https://staging.dashboard.../cli-auth/?port=PORT&state=STATE
[debug] auth: callback received: /callback?state=...&key=...
[debug] auth: key received (N chars)
```
If the browser freezes before redirecting back, the callback line never appears — pointing at the dashboard side. If it appears but with a wrong state or error param, it points at a specific mismatch.
How to debug the staging freeze
```sh
UNCOMPACT_DASHBOARD_URL=https://staging.dashboard.supermodeltools.com
uncompact auth login --debug
```
Watch the output:
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Improvements
Documentation