Bug: EnvConfigModal shows Default profile as authenticated but 'Use This Account' fails with invalid token error

[johnhenry]

Checklist

• I searched existing issues and this hasn't been reported

Area

Frontend

Operating System

macOS

Version

2.7.2-beta.10 (also affects 2.7.1)

What happened?

The EnvConfigModal (authentication dialog) shows the "Default" profile as authenticated when the user has a valid Claude Code OAuth token in macOS Keychain. However, when clicking "Use This Account", it fails with error: "Selected profile does not have a valid token".

Root Cause

EnvConfigModal.tsx has inconsistent logic for determining if a profile is authenticated:

1. Profile Detection (lines 104-106) marks profiles as authenticated if:

   p.oauthToken || (p.isDefault && p.configDir)

   This shows Default profile with Keychain access as ✓ authenticated in the UI.

2. Token Validation (lines 156-161) when clicking "Use This Account":

   if (\!profile?.oauthToken) {
     setError('Selected profile does not have a valid token');
     return;
   }

   This ONLY accepts profiles with the oauthToken property populated.

3. The Problem: The Keychain token is available in the backend (get_token_from_keychain() works), but is NOT loaded into profile.oauthToken in the frontend when getClaudeProfiles() is called.

Steps to reproduce

1. Have a valid Claude Code OAuth token in macOS Keychain (from claude setup-token)
2. Launch Auto-Claude v2.7.1+ (fresh install with no prior config)
3. Try to use a feature requiring authentication (e.g., Ideation)
4. EnvConfigModal appears showing "Default" profile as authenticated
5. Click "Use This Account" button
6. Error appears: "Selected profile does not have a valid token"

Expected behavior

When getClaudeProfiles() is called for a Default profile with configDir (Keychain access):

• The backend should call get_token_from_keychain() to retrieve the token
• Populate the oauthToken field in the returned profile data
• Frontend can then successfully use the profile when clicking "Use This Account"

Workaround

Users must manually enter the token via "Enter token manually" section.

Proposed Fix

Modify the backend IPC handler for getClaudeProfiles to:

1. Detect when a profile is Default with configDir but no oauthToken
2. Call get_token_from_keychain() (from apps/backend/core/auth.py)
3. Populate the oauthToken field in the profile response

Impact

• Users with valid Keychain tokens cannot authenticate via the UI
• Confusing UX: Shows as "authenticated" but fails when trying to use it
• Affects macOS users exclusively (Keychain is macOS-only)

Related

• Related to original Keychain integration in macOS does not hold token at ~/.config/claude/credentials.json but in keychain #43 (v2.6.0)
• Similar to "I've Installed It" button in GitHub CLI modal does nothing - modal keeps reloading #233 (GitHub CLI modal issue)

Technical Context

Files involved:

• apps/frontend/src/renderer/components/EnvConfigModal.tsx (frontend UI logic)
• apps/backend/core/auth.py (Keychain token retrieval)
• Backend IPC handler for getClaudeProfiles (needs modification)

I'll submit a PR with the fix shortly.

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Related Issues

• macOS does not hold token at ~/.config/claude/credentials.json but in keychain #43
• UsageMonitor passes encrypted token to API, causing "Failed to fetch usage" errors #61
• "I've Installed It" button in GitHub CLI modal does nothing - modal keeps reloading #233

🔗 Related PRs

#7 - feat: Add multi-auth token support and ANTHROPIC_BASE_URL passthrough (CLI only) [merged]
#52 - fix: save Claude OAuth token to active profile during GitHub setup flow [merged]
#53 - V2.5.6 [merged]

👤 Suggested Assignees

• Morriz
• NDOTO-G
• tob-as
• wignerStan
• chip902

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[github-actions]

👋 Thanks for opening your first issue!

A maintainer will triage this soon. In the meantime:

• Make sure you've provided all the requested info
• Join our Discord for faster help

[joelfuller2016]

@openhands-agent Please fix the EnvConfigModal showing Default profile as authenticated but failing with "invalid token" error when clicking "Use This Account".

Issue Summary: The authentication dialog shows the Default profile as authenticated (when Keychain token exists) but clicking "Use This Account" fails with "Selected profile does not have a valid token" error.

Platform: macOS, v2.7.2-beta.10

Root Cause Analysis (from issue):

1. Profile Detection (EnvConfigModal.tsx lines 104-106) marks profiles as authenticated if:

   p.oauthToken || (p.isDefault && p.configDir)

   This shows Default profile with Keychain access as ✓ authenticated.

2. Token Validation (lines 156-161) when clicking "Use This Account":

   if (!profile?.oauthToken) {
     setError('Selected profile does not have a valid token');
     return;
   }

   This ONLY accepts profiles with oauthToken property populated.

3. The Problem: Keychain token is available in backend (get_token_from_keychain() works) but NOT loaded into profile.oauthToken in frontend when getClaudeProfiles() is called.

Investigation Areas:

1. apps/frontend/src/renderer/components/EnvConfigModal.tsx - Frontend UI logic
2. apps/backend/core/auth.py - Keychain token retrieval (get_token_from_keychain())
3. Backend IPC handler for getClaudeProfiles - Needs to populate token

Required Fix:

1. Modify the backend IPC handler for getClaudeProfiles to:

   • Detect when a profile is Default with configDir but no oauthToken
   • Call get_token_from_keychain() from apps/backend/core/auth.py
   • Populate the oauthToken field in the profile response

2. Alternatively, fix frontend to:

   • Fetch Keychain token when Default profile is selected
   • Or make token validation consistent with profile detection logic

Note: PR #366 may already be addressing this - check if it's ready for merge.

Target Branch: develop