# Mac RMM Authentication Fix

**Problem**: On macOS, the Phase 0 bootstrap code in `/rmm` using `--data-binary @-` with heredoc frequently failed with empty tokens, causing wasted API calls and jq parse errors.

**Root cause**: Heredoc with `--data-binary @-` and JSON interpolation doesn't work reliably on macOS bash/curl combinations. The pattern works on Linux/Windows Git Bash but fails on Mac.

**Solution**: Created `.claude/scripts/rmm-auth.sh` helper script that:
1. Resolves all paths from `identity.json` (vault_path, claudetools_root)
2. Uses `jq -n --arg` to build JSON payload safely (no heredoc)
3. Handles all error cases explicitly
4. Outputs exports for `eval` to set $TOKEN, $RMM, $REPO_ROOT

**Usage** (cross-platform, Mac-tested):
```bash
eval "$(bash .claude/scripts/rmm-auth.sh)"
# Sets: $TOKEN, $RMM, $REPO_ROOT
```

**Updated**: `.claude/commands/rmm.md` Phase 0 section now recommends the helper script as the primary method, with manual method as reference only.

**Impact**: Eliminates wasted tokens from repeated auth failures on Mac. Single-call authentication that works consistently.

**Date fixed**: 2026-06-08
**Tested on**: macOS (Mikes-MacBook-Air, arm64)