Claude Code runner fails with a subscription token: wrong env var and --bare

[strelov1]

Problem

Even with #6487 fixed on the API-client side, the runner path still cannot use a Claude Code OAuth token. Two independent causes:

1. Wrong env var. The integration hands its credential to runners as ANTHROPIC_API_KEY regardless of the credential kind, so an OAuth token arrives in the wrong variable and the CLI rejects it with Invalid API key. The variable should be chosen from the credential type, mirroring how the API client picks its auth header.

2. --bare blocks the subscription login. run.js always passes --bare, whose documented behavior includes skipping keychain reads — the same path Claude Code uses to authenticate a subscription token. The run then fails with Not logged in · Please run /login. Reproduced outside SuperPlane: identical arguments succeed without the flag and fail with it.

Expected

A Claude Code component configured with a subscription token runs and bills against the subscription. --bare is omitted when a subscription token is present and kept otherwise, where its isolation costs nothing.

Notes

Depends on #6487. Related: #6204 (Claude components failing without a clear error) — same class of opaque failure.

Affected: pkg/integrations/claude/integration_secrets.go, pkg/components/runner/claude/run.js.

[v1b3m]

Hi, I'm working on this — both causes are confirmed (the integration always resolves the credential as ANTHROPIC_API_KEY, and run.js always passes --bare, which skips the keychain reads subscription auth needs). I'll open a PR shortly.

[strelov1]

Already have a fix ready for this: strelov1#1 (tested end-to-end against a real subscription token, including a full Run Claude Code workflow — also covers #6487 in the same PR).

Noticed #6500 was opened against this issue in the meantime — left a note there. Will open a PR against this repo once a maintainer confirms interest in this approach.