Primary finding
Token reassembly from `claude setup-token` can splice in non-token text and write garbage to CLAUDE_CODE_OAUTH_TOKEN
highbughigh
- dashboard/app/api/auth/route.ts:81-108
The first-line push is `tokenChars.push(trimmed)` without filtering — `trimmed` is the entire first line starting at `sk-ant-oat`, which in real `claude setup-token` output is wrapped inside an ANSI/box-drawing TUI and often contains trailing spaces, box characters, or ANSI escape sequences. Because no regex is applied to the first line, ANSI escape bytes and box-drawing glyphs get concatenated into `token`. The resulting `token` is then written to the GitHub secret as the OAuth token, silently corrupting auth. Worse, since `output.indexOf('sk-ant-oat')` only checks existence, even unrelated occurrences (e.g. inside a help string) get accepted. The handler then returns `ok: true` despite the bogus value.
Recommendation
Strip ANSI escapes first (e.g. `output.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')`), then extract with a strict regex like `/sk-ant-oat[A-Za-z0-9_-]+/` over the cleaned text, possibly joined across line breaks first by removing all whitespace inside the matched run. Validate length/format before calling `gh secret set` and surface an error otherwise.