Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Showing 1 changed file with 68 additions and 22 deletions.
| @@ -15,14 +15,17 @@ go build -o codey ./cmd/codey | ||
| 15 | 15 | ./codey -C /path/to/repo -p "why does TestFoo fail?" # one prompt |
| 16 | 16 | ``` |
| 17 | 17 | |
| 18 | - If you are logged into Claude Code, that is all the setup there is: Codey | |
| 19 | - borrows the OAuth credential from `~/.claude/.credentials.json` when nothing | |
| 20 | - else supplied one. Otherwise, or to use a different account: | |
| 18 | + Codey needs a credential, and the ordinary one is an Anthropic API key, which | |
| 19 | + you create at | |
| 20 | + [console.anthropic.com/settings/keys](https://console.anthropic.com/settings/keys): | |
| 21 | 21 | |
| 22 | 22 | ```bash |
| 23 | 23 | export ANTHROPIC_API_KEY=sk-ant-... |
| 24 | 24 | ``` |
| 25 | 25 | |
| 26 | + Started with nothing at all, Codey stops and says how to get one rather than | |
| 27 | + failing on the first request. | |
| 28 | + | |
| 26 | 29 | A different endpoint — a gateway, a proxy, a local server speaking the Messages |
| 27 | 30 | API: |
| 28 | 31 | |
| @@ -38,13 +41,28 @@ what [the setup wizard](#setup) writes on a first run. `-auth-token` sends | ||
| 38 | 41 | stderr, because your prompt and every file the agent reads go wherever that URL |
| 39 | 42 | points. |
| 40 | 43 | |
| 41 | - The Claude Code login is the last resort, tried only when no flag and no | |
| 42 | - environment variable supplied a credential, and only against Anthropic's own | |
| 44 | + On your own machine, if you are logged into Claude Code, Codey can borrow the | |
| 45 | + OAuth credential Claude Code keeps in `~/.claude/.credentials.json` instead of | |
| 46 | + needing a key. It does this only when asked: `-claude-code-auth` for one run, or | |
| 47 | + `"claude_code_auth": "on"` in [the config](#setup) — which the setup wizard and | |
| 48 | + `/settings` both offer — for every run. Be aware of what that is: the | |
| 49 | + credential is issued to Claude Code, and using it from another client is | |
| 50 | + outside Anthropic's terms for it, which API keys and gateway tokens do not | |
| 51 | + carry. That is why it is off until you turn it on, and why it is not something | |
| 52 | + to set up on a machine other people use. | |
| 53 | + | |
| 54 | + Even when asked for, it is the last resort. It is tried only when no flag and | |
| 55 | + no environment variable supplied a credential, and only against Anthropic's own | |
| 43 | 56 | endpoint — a credential found on disk is not one you chose to send, so it is |
| 44 | 57 | never forwarded to a `-base-url` you pointed Codey at. `-no-claude-code-auth` |
| 45 | - skips it entirely. Note that the credential is issued to Claude Code; using it | |
| 46 | - from another client is outside Anthropic's terms for it, which API keys and | |
| 47 | - gateway tokens do not carry. | |
| 58 | + refuses it for one run, whatever `-claude-code-auth` and the config say. | |
| 59 | + | |
| 60 | + Earlier builds borrowed the login silently whenever nothing else was set. If | |
| 61 | + you relied on that, the first start after upgrading asks once, on the terminal, | |
| 62 | + whether to keep doing so, and saves the answer as `claude_code_auth` — yes or | |
| 63 | + no, so it is not asked again. A `-p` run, a pipe, and `codey models` have | |
| 64 | + nobody to ask, so they just report that there is no credential and how to get | |
| 65 | + one. | |
| 48 | 66 | |
| 49 | 67 | On macOS Claude Code keeps this in the Keychain rather than a file, so there is |
| 50 | 68 | nothing to borrow there. An expired access token is refreshed automatically; the |
| @@ -55,7 +73,7 @@ would break your Claude Code login. | ||
| 55 | 73 | Useful flags: `-model`, `-effort low|medium|high|xhigh|max`, `-max-turns`, |
| 56 | 74 | `-resume latest`, `-no-stream`, `-no-cache`, `-no-auto-compact`, `-v`, `-yolo`, |
| 57 | 75 | `-no-tui`, `-no-skills`, `-no-agents`, `-no-web`, `-no-hooks`, |
| 58 | - `-no-diagnostics`, `-no-mcp`, `-no-claude-code-auth`. | |
| 76 | + `-no-diagnostics`, `-no-mcp`, `-claude-code-auth`, `-no-claude-code-auth`. | |
| 59 | 77 | |
| 60 | 78 | ### Flags and thresholds |
| 61 | 79 | |
| @@ -758,8 +776,9 @@ agents at once. `-p` and `-no-tui` runs are not offered the tools at all, and | ||
| 758 | 776 | |
| 759 | 777 | The first run on a terminal opens a full-screen wizard instead of the chat: the |
| 760 | 778 | mark assembles, the name lights up, and it asks five questions one at a time, |
| 761 | - plus the two that are only sometimes there — the Claude skills question on a | |
| 762 | - machine that has some, and the herdr one on a machine that has | |
| 779 | + plus the three that are only sometimes there — the Claude Code login question | |
| 780 | + where there is no API key and Claude Code is logged in, the Claude skills | |
| 781 | + question on a machine that has some, and the herdr one on a machine that has | |
| 763 | 782 | [herdr](#herdr). |
| 764 | 783 | "First run" means the config file does not say `"setup": "done"` — the marker |
| 765 | 784 | the wizard stamps when the last question is answered — rather than that no file |
| @@ -789,13 +808,22 @@ still gets asked the ones it is missing. | ||
| 789 | 808 | | Approvals | ask before every mutating call, or accept them all | |
| 790 | 809 | | Web search | `none`, Claude's hosted search, or a command on this machine | |
| 791 | 810 | | Theme | `ember` `mint` `iris` `mono` | |
| 811 | + | Claude Code login | no, or borrow it when no key is set — asked only where no key or token was given, the endpoint is Anthropic's, and Claude Code is logged in | | |
| 792 | 812 | | Claude skills | leave them alone, use them in place, or copy them once — asked only where there are some | |
| 793 | 813 | | herdr skill | install it, or not — asked only where herdr is | |
| 794 | 814 | |
| 795 | - The last two are the steps that are sometimes not there. The rail knows how | |
| 815 | + The last three are the steps that are sometimes not there. The rail knows how | |
| 796 | 816 | many questions this run is actually asking rather than how many the build has, |
| 797 | - so a machine with neither gets a five-node rail with no gaps in it, and | |
| 798 | - `step 6 of 7` on a machine with both counts the questions you are being asked. | |
| 817 | + so a machine with none of them gets a five-node rail with no gaps in it, and | |
| 818 | + `step 7 of 8` on a machine with all three counts the questions you are being | |
| 819 | + asked. The Claude Code login question opens on no, and both answers carry the | |
| 820 | + same sentence about the terms: the login is issued to Claude Code, and using it | |
| 821 | + from another client is outside Anthropic's terms for it — so it is a choice | |
| 822 | + for your own machine, described [under Quick start](#quick-start). Someone with | |
| 823 | + an API key set is not asked at all, because there is nothing for them to | |
| 824 | + decide. The answer is `claude_code_auth`; changing it mid-session says it takes | |
| 825 | + effect on the next start, because the client was built, credential and all, | |
| 826 | + before the wizard opened. | |
| 799 | 827 | The herdr answer is also the one that is not a preference: it is an act, |
| 800 | 828 | carried out once, so nothing about it is written to the config. It appears when |
| 801 | 829 | `HERDR_ENV=1` or `herdr` is on `PATH`. What it installs, and what happens when |
| @@ -829,12 +857,19 @@ honoured): | ||
| 829 | 857 | "search_command": "ddgs text -q {{query}} -m {{count}} -nc", |
| 830 | 858 | "claude_skills": "use", |
| 831 | 859 | "diagnostics": "on", |
| 860 | + "claude_code_auth": "off", | |
| 832 | 861 | "theme": "ember", |
| 833 | 862 | "auto_compact": "on", |
| 834 | 863 | "setup": "done" |
| 835 | 864 | } |
| 836 | 865 | ``` |
| 837 | 866 | |
| 867 | + `claude_code_auth` is `"on"` or `"off"`, and a missing key — or any other word | |
| 868 | + — means off: the Claude Code login is borrowed only on an explicit `"on"`, or | |
| 869 | + for one run with `-claude-code-auth`, and `-no-claude-code-auth` beats both. | |
| 870 | + A missing key is also how Codey knows it has never asked, which is what the | |
| 871 | + one-time question for someone upgrading reads. | |
| 872 | + | |
| 838 | 873 | `auto_compact` is the one key neither the wizard nor `/settings` offers a row |
| 839 | 874 | for — set it by hand, or pass `-no-auto-compact` for a single run. |
| 840 | 875 | `diagnostics` is the one `/settings` has a row for and the wizard does not |
| @@ -906,13 +941,14 @@ in place, applied as you move. | ||
| 906 | 941 | |
| 907 | 942 | ``` |
| 908 | 943 | Settings ↑↓ row · ←→ change · esc done |
| 909 | - ❯ Model Opus 5 $5 / $25 per Mtok | |
| 910 | - Effort high default | |
| 911 | - Approvals Ask me first recommended | |
| 912 | - Web search No web access default | |
| 913 | - Diagnostics On default | |
| 914 | - Claude skills Leave them alone default | |
| 915 | - Theme ember | |
| 944 | + ❯ Model Opus 5 $5 / $25 per Mtok | |
| 945 | + Effort high default | |
| 946 | + Approvals Ask me first recommended | |
| 947 | + Web search No web access default | |
| 948 | + Diagnostics On default | |
| 949 | + Claude Code login No, I'll use an API key default | |
| 950 | + Claude skills Leave them alone default | |
| 951 | + Theme ember | |
| 916 | 952 | claude-opus-5 · enter to pick from anthropic |
| 917 | 953 | saved to ~/.config/codey/config.json |
| 918 | 954 | ``` |
| @@ -929,6 +965,13 @@ level the other does not use. The model row is the exception: its choices come | ||
| 929 | 965 | from the endpoint rather than from this build, so `enter` hands over to the |
| 930 | 966 | `/model` picker and lands back here once you have chosen. |
| 931 | 967 | |
| 968 | + The Claude Code login row is there whether or not the wizard asked, so the | |
| 969 | + opt-in [described under Quick start](#quick-start) can be turned on or back off | |
| 970 | + without rerunning setup. Like web search, diagnostics and Claude's skills, it | |
| 971 | + is decided when the session starts, so a change says it takes effect on the | |
| 972 | + next start rather than pretending to swap the credential under a conversation | |
| 973 | + already in progress. | |
| 974 | + | |
| 932 | 975 | What the panel shows is the *session*, not the file — `/effort`, `shift+tab` |
| 933 | 976 | and `-yolo` all change a setting without the file hearing about it, and a panel |
| 934 | 977 | that disagreed with the status bar two lines below it would be worse than |
| @@ -1403,7 +1446,10 @@ instead of adding one. | ||
| 1403 | 1446 | Two invocations exist only for that provider card: `codey --version`, and |
| 1404 | 1447 | `codey models`, which prints whether there is a credential and what the |
| 1405 | 1448 | endpoint serves. Both are shaped for the regular expressions on the other end |
| 1406 | - rather than for a person. | |
| 1449 | + rather than for a person. The probe follows the same opt-in as everything else: | |
| 1450 | + a Claude Code login counts as logged in only when the config says | |
| 1451 | + `"claude_code_auth": "on"` — the probe is run with no flags, so | |
| 1452 | + `-claude-code-auth` in the launch arguments reaches the agent but not the card. | |
| 1407 | 1453 | |
| 1408 | 1454 | `docs/superpowers/specs/2026-09-19-t3code-provider-design.md` is the research |
| 1409 | 1455 | this is built on: what every T3 Code provider requires of a binary, and why the |