Keep relayed launch out of Claude Code gateway login mode - #535
Closed
masonc08 wants to merge 1 commit into
Closed
Conversation
Claude Code 2.1.261+ changed gateway login mode to ignore a claude.ai subscription login and demand a gateway `/login`. ucode's relayed (Claude Max/Enterprise subscription-relay) launch is the only path with no gateway credential -- it relies on Claude Code's own subscription OAuth as the Authorization credential while the loopback proxy swaps in the Databricks token by header. So after the client auto-updated to 2.1.265, relayed sessions loop on `/login`: the OAuth completes on Anthropic's side but gateway login mode never accepts it. The api-key MPS and normal gateway paths are unaffected because they carry an apiKeyHelper. Set CLAUDE_CODE_USE_GATEWAY only for credentialed (non-relayed) launches, and add it to CLAUDE_CONDITIONAL_ENV_KEYS so a value a prior non-relayed launch wrote is pruned when a relayed launch omits it. Requests still route through the gateway via ANTHROPIC_BASE_URL without the flag (per Claude Code's LLM-gateway docs: base-URL-alone keeps the subscription login active). NOT yet validated against a live relayed session on 2.1.265 (needs a subscription box; CLAUDE_CODE_USE_GATEWAY is undocumented, so the exact lever is inferred from the changelog + behavior). Validate before rollout. Co-authored-by: Isaac <no-reply@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Users on Claude Max/Enterprise using ucode relayed MPS report that after Claude Code auto-updated to 2.1.265, the session loops on
/login: OAuth completes on Anthropic's side but the session still insists it needs to log in. A session on the previous version keeps working. (Reported in the AIGW coding-agents thread.)Root cause
Claude Code 2.1.261+ changed gateway login mode to ignore a claude.ai subscription login and demand a gateway
/login. ucode's relayed launch is the only config that mixes:CLAUDE_CODE_USE_GATEWAY=1, set unconditionally inrender_overlay), andapiKeyHelper/API key and relies on Claude Code's own subscription OAuth as theAuthorization, while the loopback proxy swaps the Databricks token in by header.So gateway login mode now rejects the very credential relayed depends on → the loop. The api-key MPS and normal gateway paths are unaffected because they carry an
apiKeyHelper, which matches "only Enterprise/relayed broke."Fix
Set
CLAUDE_CODE_USE_GATEWAYonly for credentialed (non-relayed) launches, and add it toCLAUDE_CONDITIONAL_ENV_KEYSso a value a prior non-relayed launch wrote is pruned when a relayed launch omits it. Requests still route through the gateway viaANTHROPIC_BASE_URLwithout the flag — per Claude Code's LLM-gateway docs, a custom base URL alone (no gateway credential) keeps the subscription login active.Testing
test_relayed_omits_use_gateway(overlay omits the flag + it's not in the managed keys),test_relayed_prunes_stale_use_gateway(a relayed write drops a stale value). Existing non-relayed assertions unchanged. Fulltest_agent_claude.py133/133; ruff clean.CLAUDE_CODE_USE_GATEWAYis undocumented so the exact lever is inferred from the changelog + behavior. Validate before rollout.This pull request and its description were written by Isaac.