### Preflight Checklist - [x] I have searched existing issues. This was reported twice before, and both reports were closed as inactive without a reply: #77450 and #87145. - [x] This is a single bug report. - [ ] I am using the latest version of Claude Code. I'm on 2.1.280, the newest version my desktop app has installed. The changelogs for 2.1.281 and 2.1.282 don't mention this. ### What's Wrong? The security-guidance plugin never runs its model reviews for us. The end-of-turn review and the

[BUG] security-guidance never runs its model reviews for subscription sign-ins (re-report of #77450 and #87145)

Status Open

Reported on v2.1.280

Maintainer reply ✓ Yes — 7487

Workaround ✓ Mentioned in description ↑

Activity 3 comments · opened Sep 24, 2026

💡 Likely answer: A maintainer (7487, contributor) responded on this thread — see the highlighted reply below.

Preflight Checklist

[x] I have searched existing issues. This was reported twice before, and both reports were closed as inactive without a reply: #77450 and #87145.
[x] This is a single bug report.
[ ] I am using the latest version of Claude Code. I'm on 2.1.280, the newest version my desktop app has installed. The changelogs for 2.1.281 and 2.1.282 don't mention this.

What's Wrong?

The security-guidance plugin never runs its model reviews for us. The end-of-turn review and the commit review are skipped every time, and the only trace is a line in ~/.claude/security/log.txt. The per-edit pattern check does run, so the plugin looks installed and healthy while its main layers are off.

Since the plugin first ran on my laptop on 23 September, its log shows 159 end-of-turn reviews (Stop and SubagentStop) and 13 commit reviews skipped, all for the same reason. Not one review has run.

Nothing turns the reviews off on purpose: ENABLE_CODE_SECURITY_REVIEW isn't set anywhere. The gate in hooks/llm.py looks for ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN in the hook's environment and finds neither. We sign in with a Team plan subscription through the Claude desktop app, so there's no API key, and the sign-in token doesn't reach the hook. It isn't in the Bash tool's environment either: I checked the variable names, and the only ANTHROPIC_ one is ANTHROPIC_BASE_URL. CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH is set, which suggests the desktop app keeps the sign-in to itself.

The plugin's own code expects otherwise. A comment in hooks/llm.py says "Claude Code passes this for /login users" about ANTHROPIC_AUTH_TOKEN. The troubleshooting section of the security-guidance docs says the reviews skip when a session has no Anthropic authentication, but these sessions are signed in and working normally.

What Should Happen?

Ideally, the model reviews run for people signed in with a subscription, the way the plugin's code expects. If handing the sign-in token to hook scripts isn't something you want, maybe the reviews could go through Claude Code itself instead.

If that can't happen soon, it would help a lot if the plugin said so once in the session, with the reason, rather than only in its log. The docs could also say that the model reviews need an API key or a cloud provider for now.

We'd rather not work around it by putting an API key on every laptop.

Error Messages/Logs

From ~/.claude/security/log.txt, timestamps trimmed:

Processing: hook_event=Stop, tool=
Stop hook: LLM review disabled or no API credentials
...
Commit review: detected git commit in command
Commit review: LLM review disabled or no API credentials

Counts for 23 and 24 September: 159 "Stop hook: LLM review disabled or no API credentials", 13 "Commit review: LLM review disabled or no API credentials", and no review that ran.

Steps to Reproduce

Sign in to the Claude desktop app with a Team plan account, with no API key set anywhere.
Have the security-guidance plugin enabled. Mine is version 2.0.8, synced from claude.ai.
In a Code tab session inside a git repository, ask Claude to change a file and let the turn end. Optionally, ask it to commit.
Open ~/.claude/security/log.txt. Every turn end and every commit logs "LLM review disabled or no API credentials", and no review runs.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.280 (Claude Code), bundled with the Claude desktop app 2.7032.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other: the Claude desktop app's Code tab

Additional Information

The two earlier reports describe the same behaviour: #77450 on macOS (2.1.209) and #87145 on Windows 11 (2.1.228, signed in with /login). So it doesn't seem limited to the desktop app or to one operating system. My laptop runs Windows 11 Pro, build 26200, the same build as #87145.

We'd like to turn this plugin on for our whole team as one of our security layers. Today everyone would get the pattern check and none of the reviews, while the plugin looks fully on.

View original on GitHub ↗

3 Comments

7487 contributor · 19 days ago

I confirmed the reported skip against current public source (main 7779afb): hooks/llm.py sets HAS_API_CREDENTIALS only from the API key, hook-visible OAuth token, or third-party provider flags. Both the Stop and commit review paths return early when that value is false. A working subscription sign-in alone therefore does not establish that either model review ran.

I prepared a small public-source mitigation: a once-per-session UserPromptSubmit notice when model review is enabled but no supported credentials are visible, plus README clarification and a regression test. In an isolated Git repo, the real hook warned on the first prompt and stayed quiet on the second; both invocations exited successfully. This does not enable subscription-authenticated reviews or reproduce the reporter's Windows Team session; that still needs a product/auth-path fix.

This repository currently limits PR creation to collaborators. Would a maintainer or collaborator be open to submitting this mitigation with author attribution to @7487? I can provide the ready patch and test. I will keep the full authentication fix separate.

khughitt · 17 days ago

The reverse case, for anyone landing here: when ANTHROPIC_API_KEY is present in the environment, the reviews do run, but they authenticate with the key rather than the subscription sign-in, with nothing that says so.

In security-guidance 2.0.8, _agentic_spawn_env() in hooks/llm.py blanks ANTHROPIC_AUTH_TOKEN for the inner CLI whenever ANTHROPIC_API_KEY is set ("API key present → blank the OAuth token so API-key auth wins"). So a subscription user who happens to export an API key for other tools gets every Stop, SubagentStop and commit review sent through that key. The README's "A working API path (subscription, API key, or 3P provider config)" doesn't say which one wins when both exist.

For scale, on one workstation (Claude Code 2.1.278–2.1.283, Linux, subscription sign-in plus an exported API key): 1,335 reviewer sessions in about seven weeks, which comes to roughly $550 at Opus 4.7 list prices, estimated from the token usage in the reviewers' transcripts. I did not check the billing side.

Whatever the fix for the subscription-only case here, it would help if the plugin said which credential a review used (the once-per-session notice proposed above could name it), or preferred the subscription sign-in when both are available.

7487 contributor · 17 days ago

@khughitt Thanks for documenting the reverse case. I checked current main: the direct review tries ANTHROPIC_API_KEY first when it is set, with a hook-visible OAuth token used only after an API-key HTTP 401; the agentic child explicitly clears ANTHROPIC_AUTH_TOKEN when an API key is present. Third-party provider routing is a separate path.

I expanded the mitigation proposed above to show a once-per-session notice for both cases: model reviews skipped because the hook sees no credentials, or reviews preferring an API key when one is set. The API-key notice says usage may be billed separately; it does not claim a request succeeded or that a charge occurred. The README now explains the priority and gateway exception. Six focused tests and two-invocation real-hook checks passed in an isolated copy of current public source; I have not tested a live subscription/Desktop session or checked billing.

The patch and tests are ready. PR creation here is restricted to collaborators, so I can provide the diff directly in this issue or through a channel a maintainer prefers. I did not find a SubagentStop registration in this plugin's hooks.json, so I am not counting that event as a verified review trigger.