Leads with the no-setup case, and says plainly why the credential is never sent to a non-default endpoint and what its terms are. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Showing 1 changed file with 22 additions and 2 deletions.
| @@ -9,13 +9,20 @@ The code is the byproduct. The deliverable is [METRICS.md](METRICS.md). | ||
| 9 | 9 | ## Quick start |
| 10 | 10 | |
| 11 | 11 | ```bash |
| 12 | - export ANTHROPIC_API_KEY=sk-ant-... | |
| 13 | 12 | go build -o harness ./cmd/harness |
| 14 | 13 | |
| 15 | 14 | ./harness -C /path/to/a/throwaway/clone # full-screen TUI |
| 16 | 15 | ./harness -C /path/to/repo -p "why does TestFoo fail?" # one prompt |
| 17 | 16 | ``` |
| 18 | 17 | |
| 18 | + If you are logged into Claude Code, that is all the setup there is: the harness | |
| 19 | + borrows the OAuth credential from `~/.claude/.credentials.json` when nothing | |
| 20 | + else supplied one. Otherwise, or to use a different account: | |
| 21 | + | |
| 22 | + ```bash | |
| 23 | + export ANTHROPIC_API_KEY=sk-ant-... | |
| 24 | + ``` | |
| 25 | + | |
| 19 | 26 | A different endpoint — a gateway, a proxy, a local server speaking the Messages |
| 20 | 27 | API: |
| 21 | 28 | |
| @@ -29,8 +36,21 @@ which is what OAuth tokens and most gateways want; `-api-key` sends | ||
| 29 | 36 | `x-api-key`. A non-default endpoint announces itself on stderr, because your |
| 30 | 37 | prompt and every file the agent reads go wherever that URL points. |
| 31 | 38 | |
| 39 | + The Claude Code login is the last resort, tried only when no flag and no | |
| 40 | + environment variable supplied a credential, and only against Anthropic's own | |
| 41 | + endpoint — a credential found on disk is not one you chose to send, so it is | |
| 42 | + never forwarded to a `-base-url` you pointed the harness at. `-no-claude-code-auth` | |
| 43 | + skips it entirely. Note that the credential is issued to Claude Code; using it | |
| 44 | + from another client is outside Anthropic's terms for it, which API keys and | |
| 45 | + gateway tokens do not carry. | |
| 46 | + | |
| 47 | + On macOS Claude Code keeps this in the Keychain rather than a file, so there is | |
| 48 | + nothing to borrow there. An expired access token is not refreshed — run `claude` | |
| 49 | + and the harness picks up the new one. | |
| 50 | + | |
| 32 | 51 | Useful flags: `-model`, `-effort low|medium|high|xhigh|max`, `-max-turns`, |
| 33 | - `-resume latest`, `-no-stream`, `-no-cache`, `-v`, `-yolo`, `-no-tui`, `-no-skills`. | |
| 52 | + `-resume latest`, `-no-stream`, `-no-cache`, `-v`, `-yolo`, `-no-tui`, `-no-skills`, | |
| 53 | + `-no-claude-code-auth`. | |
| 34 | 54 | |
| 35 | 55 | ## The TUI |
| 36 | 56 | |