feat(model): sign in through a Claude Code cloud network secret by AnnatarHe · Pull Request #331 · shelltime/cli

AnnatarHe · 2026-10-22T13:41:43Z

Summary

Claude Code cloud environments can now keep the ShellTime token as a network secret. Anthropic's agent proxy then adds Authorization: CLI <token> to requests for api.shelltime.xyz after they leave the VM, so the token is never on disk or in the session's environment.

model.ProxyInjectedToken (proxy-injected) is the placeholder token such an environment signs in with. It follows Anthropic's own convention: cloud sessions read GITHUB_TOKEN as proxy-injected for the GitHub proxy. With it, setCLIAuthorization sends no Authorization header, so the proxy's header is the only one the server reads, whether the proxy replaces a header or appends one. SendHTTPRequestJSON and the shelltime q stream both go through it.
Every config.Token == "" gate keeps working unchanged, because the placeholder isn't empty.
shelltime doctor says the token is a network secret instead of printing a masked placeholder. A rejected token now points at the secret instead of shelltime auth. A 404 "user not found", which is what a request without a token gets, reads as "No token reached the server".
Documented in CLAUDE.md and docs/CONFIG.md.

cloud.bash in shelltime/installation writes the placeholder, and that PR needs this change released first.

Test plan

go test ./...
New TestSetCLIAuthorization checks the placeholder sends no header, on both the JSON and SSE paths, and that real tokens are unchanged.
New TestDoctorCheckAccount_ProxyInjectedToken
Smoke test in a real cloud session with the placeholder and no secret: shelltime doctor went through the agent proxy and reported "No token reached the server" with the network-secret fix.

Generated by Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}

A cloud environment can keep the ShellTime token as a network secret: the agent proxy adds Authorization: CLI <token> to requests for api.shelltime.xyz outside the VM. With the placeholder token proxy-injected the CLI sends no Authorization header, so the proxy's is the only one, and shelltime doctor says the token is a network secret and names a missing one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VF4QMGS5ymib7ntoJAhbUB

chatgpt-codex-connector · 2026-10-22T13:41:48Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-22T13:41:46.528013Z We couldn’t complete this review. Comment `@codex review` to try again.	`970b3ea`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-22T13:41:50Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

codecov · 2026-10-22T13:42:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	`86.25% <100.00%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
commands/doctor_checks.go	`95.21% <100.00%> (+0.06%)`	⬆️
model/ai_service.go	`90.24% <100.00%> (ø)`
model/aicode_cloud_session.go	`100.00% <100.00%> (ø)`
model/api.base.go	`92.20% <100.00%> (ø)`

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-10-22T13:43:01Z

⏱️ `shelltime track` performance

✅ No significant change in shelltime track latency

Comparing main @ 5d8553c → #331 @ 970b3ea. Each scenario execs the binary the way the shell hooks do; values are the median of 10 interleaved rounds. Lower is better.

Scenario	base	head	Δ	p
`Startup/floor`	155 µs ±10%	158 µs ±14%	~	0.280	A/A
`Startup/version`	1.78 ms ±15%	1.86 ms ±15%	~	0.315	✅
`Track/daemon/pre`	2.06 ms ±9%	2.13 ms ±15%	~	0.353	✅
`Track/daemon/post`	1.92 ms ±17%	2.03 ms ±12%	~	0.579	✅
`Track/direct/pre`	1.96 ms ±10%	1.91 ms ±10%	~	0.579	✅
`Track/direct/post`	3.66 ms ±16%	3.72 ms ±17%	~	0.631	✅
`Track/direct/post-sync`	4.66 ms ±36%	4.81 ms ±15%	~	1.000	✅

Binary size: 19.2 MiB → 19.2 MiB (+0.0%).

CPU, tail latency and memory

Per exec, base → head (Δ when significant).

Scenario	p95 wall	user CPU	sys CPU	peak RSS
`Startup/floor`	169 µs → 185 µs	137 µs → 138 µs	3 µs → 4 µs	9.2 MiB → 9.1 MiB
`Startup/version`	2.08 ms → 2.25 ms	1.36 ms → 1.52 ms	485 µs → 426 µs	15.6 MiB → 15.6 MiB
`Track/daemon/pre`	2.40 ms → 2.65 ms	1.52 ms → 1.54 ms	506 µs → 548 µs	16.5 MiB → 16.5 MiB
`Track/daemon/post`	2.35 ms → 2.30 ms	1.52 ms → 1.46 ms	526 µs → 528 µs	16.4 MiB → 16.4 MiB
`Track/direct/pre`	2.24 ms → 2.15 ms	1.51 ms → 1.46 ms	471 µs → 547 µs	16.4 MiB → 16.4 MiB
`Track/direct/post`	4.10 ms → 4.11 ms	2.74 ms → 2.69 ms	1.21 ms → 1.28 ms	17.6 MiB → 17.6 MiB
`Track/direct/post-sync`	5.93 ms → 5.65 ms	3.41 ms → 3.59 ms	1.73 ms → 1.56 ms	19.5 MiB → 19.5 MiB (+0.29%)

benchstat

goos: linux
goarch: amd64
pkg: github.com/malamtime/cli/perf
cpu: AMD EPYC
                         │     base     │                head                 │
                         │    sec/op    │    sec/op     vs base               │
Startup/floor-2            154.9µ ± 10%   158.2µ ± 14%       ~ (p=0.280 n=10)
Startup/version-2          1.784m ± 15%   1.858m ± 15%       ~ (p=0.315 n=10)
Track/daemon/pre-2         2.059m ±  9%   2.129m ± 15%       ~ (p=0.353 n=10)
Track/daemon/post-2        1.920m ± 17%   2.034m ± 12%       ~ (p=0.579 n=10)
Track/direct/pre-2         1.960m ± 10%   1.911m ± 10%       ~ (p=0.579 n=10)
Track/direct/post-2        3.663m ± 16%   3.724m ± 17%       ~ (p=0.631 n=10)
Track/direct/post-sync-2   4.655m ± 36%   4.813m ± 15%       ~ (p=1.000 n=10)
geomean                    1.672m         1.715m        +2.56%

                         │     base     │                head                 │
                         │  p50-sec/op  │  p50-sec/op   vs base               │
Startup/floor-2            150.5µ ±  9%   151.7µ ± 16%       ~ (p=0.529 n=10)
Startup/version-2          1.751m ± 13%   1.773m ± 15%       ~ (p=0.739 n=10)
Track/daemon/pre-2         2.011m ± 10%   2.015m ± 20%       ~ (p=0.529 n=10)
Track/daemon/post-2        1.879m ± 16%   1.961m ± 11%       ~ (p=0.912 n=10)
Track/direct/pre-2         1.890m ± 11%   1.869m ± 13%       ~ (p=0.796 n=10)
Track/direct/post-2        3.573m ± 16%   3.660m ± 17%       ~ (p=0.684 n=10)
Track/direct/post-sync-2   4.550m ± 33%   4.693m ± 15%       ~ (p=0.971 n=10)
geomean                    1.630m         1.656m        +1.57%

                         │     base     │                head                 │
                         │  p95-sec/op  │  p95-sec/op   vs base               │
Startup/floor-2            169.1µ ±  8%   184.9µ ± 26%       ~ (p=0.165 n=10)
Startup/version-2          2.076m ± 12%   2.248m ± 28%       ~ (p=0.579 n=10)
Track/daemon/pre-2         2.398m ± 17%   2.648m ± 23%       ~ (p=0.315 n=10)
Track/daemon/post-2        2.347m ± 17%   2.303m ± 28%       ~ (p=0.631 n=10)
Track/direct/pre-2         2.243m ± 18%   2.148m ± 13%       ~ (p=0.631 n=10)
Track/direct/post-2        4.100m ± 19%   4.109m ± 25%       ~ (p=0.529 n=10)
Track/direct/post-sync-2   5.930m ± 44%   5.654m ± 23%       ~ (p=0.579 n=10)
geomean                    1.951m         1.997m        +2.31%

                         │     base     │                head                 │
                         │  peak-rss-B  │  peak-rss-B   vs base               │
Startup/floor-2            9.182Mi ± 1%   9.128Mi ± 1%       ~ (p=0.181 n=10)
Startup/version-2          15.60Mi ± 0%   15.61Mi ± 0%       ~ (p=0.225 n=10)
Track/daemon/pre-2         16.51Mi ± 0%   16.52Mi ± 0%       ~ (p=0.127 n=10)
Track/daemon/post-2        16.39Mi ± 0%   16.39Mi ± 0%       ~ (p=0.926 n=10)
Track/direct/pre-2         16.39Mi ± 0%   16.38Mi ± 0%       ~ (p=0.427 n=10)
Track/direct/post-2        17.61Mi ± 0%   17.62Mi ± 0%       ~ (p=0.239 n=10)
Track/direct/post-sync-2   19.48Mi ± 1%   19.54Mi ± 0%  +0.29% (p=0.023 n=10)
geomean                    15.53Mi        15.53Mi       -0.03%

                         │     base     │                head                 │
                         │  sys-sec/op  │  sys-sec/op   vs base               │
Startup/floor-2            3.000µ ± 45%   4.025µ ± 60%       ~ (p=0.436 n=10)
Startup/version-2          484.5µ ± 32%   426.0µ ± 33%       ~ (p=0.280 n=10)
Track/daemon/pre-2         506.2µ ± 43%   547.9µ ± 52%       ~ (p=0.218 n=10)
Track/daemon/post-2        526.5µ ± 31%   527.6µ ± 57%       ~ (p=0.393 n=10)
Track/direct/pre-2         471.1µ ± 36%   546.6µ ± 26%       ~ (p=0.579 n=10)
Track/direct/post-2        1.213m ± 41%   1.282m ± 22%       ~ (p=0.912 n=10)
Track/direct/post-sync-2   1.732m ± 19%   1.562m ± 24%       ~ (p=0.190 n=10)
geomean                    325.0µ         341.6µ        +5.08%

                         │     base     │                head                 │
                         │ user-sec/op  │ user-sec/op   vs base               │
Startup/floor-2            136.7µ ± 11%   137.8µ ± 16%       ~ (p=0.481 n=10)
Startup/version-2          1.361m ±  8%   1.517m ±  9%       ~ (p=0.052 n=10)
Track/daemon/pre-2         1.515m ± 15%   1.538m ± 17%       ~ (p=0.684 n=10)
Track/daemon/post-2        1.521m ± 10%   1.461m ± 10%       ~ (p=0.280 n=10)
Track/direct/pre-2         1.508m ± 13%   1.463m ±  6%       ~ (p=0.165 n=10)
Track/direct/post-2        2.742m ± 12%   2.691m ± 17%       ~ (p=0.684 n=10)
Track/direct/post-sync-2   3.413m ± 32%   3.594m ± 15%       ~ (p=0.529 n=10)
geomean                    1.293m         1.311m        +1.35%

_{Δ compares medians; ~ means no significant difference (Mann-Whitney U, p ≥ 0.05). A scenario is flagged when it is more than 10% and more than 250µs slower with p < 0.05. Startup/floor runs true, not shelltime: it is an A/A check of runner noise. Runner: linux/amd64, AMD EPYC. go1.27.1, 10 rounds × 100 execs per scenario and binary.}

shelltime · 2026-10-22T13:44:59Z

☁️ Claude Code cloud · Move Shelltime cloud auth guidance to network secrets

Reviewed Claude Code network-secret authentication and updated the English and Chinese cloud-session tracking guides to recommend it for Shelltime.

💰 Cost	🔢 Tokens	⏱️ Duration	🧠 Model	💬 Prompts	✏️ Lines
$6.82	17M	16m (16m active)	`claude-opus-5-5`	1	+101 / −66

_{17M tokens: 652 input · 73.3K output · 16.7M cache read · 251.8K cache write}

📝 AI summary

Reviewed the Claude Code cloud-environments documentation, focusing on network secrets as a safer replacement for exposing SHELLTIME_TOKEN directly in the agent environment. The session established setup guidance for configuring Shelltime authentication through Claude Code’s network controls and clarified how this approach protects the credential while allowing outbound tracing requests.

Updated the latest blog documentation in both languages: /home/user/web/content/blogs/track-claude-code-cloud-sessions/en.mdx and /home/user/web/content/blogs/track-claude-code-cloud-sessions/zh.mdx. The edits aligned the Shelltime cloud-session tracing instructions with the network-secret workflow. No CLI or installation-script files were ultimately modified during this session.

View this session on ShellTime →

_{Updated 2026-10-23 13:42 UTC by ShellTime · totals for the whole session so far · the session page is visible to its owner}

AnnatarHe merged commit c816342 into main Oct 22, 2026
5 checks passed

AnnatarHe deleted the claude/admiring-ride-o9tv78 branch October 22, 2026 13:51

github-actions Bot mentioned this pull request Oct 22, 2026

chore(main): release 0.1.95 #329

Merged

Navigation Menu

Repository navigation

feat(model): sign in through a Claude Code cloud network secret - #331

feat(model): sign in through a Claude Code cloud network secret#331
AnnatarHe merged 1 commit into
mainfrom
claude/admiring-ride-o9tv78

AnnatarHe commented Oct 22, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

codecov Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

shelltime Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

AnnatarHe commented Oct 22, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

codecov Bot commented Oct 22, 2026

Codecov Report

Uh oh!

github-actions Bot commented Oct 22, 2026

⏱️ shelltime track performance

Uh oh!

shelltime Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

☁️ Claude Code cloud · Move Shelltime cloud auth guidance to network secrets

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AnnatarHe commented Oct 22, 2026 •

edited by blacksmith-sh Bot

Loading

⏱️ `shelltime track` performance

shelltime Bot commented Oct 22, 2026 •

edited

Loading