didericis-claude
f0d27863c2
Reads the host's Claude OAuth session key from ~/.claude.json at launch and forwards it only to the egress sidecar (never to the agent), placing a placeholder CLAUDE_CODE_OAUTH_TOKEN in the agent env so Claude Code starts without seeing the real credential. Mirrors the existing Codex forward_host_credentials flow (PRD 0029). Adds claude_auth.py to extract and validate the sessionKey, a CLAUDE_HOST_CREDENTIAL_TOKEN_REF constant in egress.py, and updates manifest_agent.py to allow the flag for both 'codex' and 'claude' templates. Also adds a mutual-exclusion check that rejects setting both auth_token and forward_host_credentials together. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
122 lines
4.3 KiB
Markdown
122 lines
4.3 KiB
Markdown
# PRD prd-new: Claude forward_host_credentials
|
|
|
|
- **Status:** Draft
|
|
- **Author:** claude
|
|
- **Created:** 2026-07-01
|
|
- **Issue:** #325
|
|
|
|
## Summary
|
|
|
|
Add `agent_provider.forward_host_credentials: true` support for the
|
|
`claude` template, mirroring the existing Codex flow. When enabled,
|
|
bot-bottle reads the host's Claude OAuth session key from
|
|
`~/.claude.json` at launch, forwards it only to the egress sidecar,
|
|
and injects a placeholder `CLAUDE_CODE_OAUTH_TOKEN` into the agent so
|
|
Claude Code starts without ever seeing the real credential.
|
|
|
|
## Problem
|
|
|
|
Running a Claude agent in a container today requires the operator to
|
|
manually extract a long-lived OAuth token (`claude setup-token`), export
|
|
it as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`, and reference it explicitly in
|
|
the manifest with `agent_provider.auth_token:
|
|
"BOT_BOTTLE_CLAUDE_OAUTH_TOKEN"`. This is a two-step manual ceremony
|
|
that is easy to skip or do incorrectly.
|
|
|
|
The host already stores a valid Claude session in `~/.claude.json` after
|
|
`claude login` or `claude setup-token`. Codex already automates an
|
|
equivalent extraction from `~/.codex/auth.json`. There is no reason
|
|
Claude bottles cannot do the same.
|
|
|
|
## Goals / Success Criteria
|
|
|
|
- A Claude bottle with `forward_host_credentials: true` in the manifest
|
|
uses the host's `~/.claude.json` session key at launch with no
|
|
additional operator steps.
|
|
- The agent container receives only `CLAUDE_CODE_OAUTH_TOKEN=egress-placeholder`
|
|
— never the real token.
|
|
- The real session key lives only in the egress sidecar's environment.
|
|
- Missing, malformed, or expired host Claude auth fails launch with a
|
|
clear operator-facing message.
|
|
- Existing `auth_token` behavior is unchanged.
|
|
- `forward_host_credentials: true` is rejected in the manifest when both
|
|
`auth_token` and `forward_host_credentials` are set, since they serve
|
|
the same purpose.
|
|
|
|
## Non-goals
|
|
|
|
- Refreshing Claude OAuth tokens in the sidecar.
|
|
- Writing a dummy `~/.claude.json` auth state to the agent (unlike the
|
|
Codex flow, Claude Code reads its credential from `CLAUDE_CODE_OAUTH_TOKEN`
|
|
in env, not from an auth file — no guest-side auth marker is needed).
|
|
- Supporting `forward_host_credentials` for providers other than `codex`
|
|
and `claude`.
|
|
|
|
## Design
|
|
|
|
### Manifest schema
|
|
|
|
```yaml
|
|
agent_provider:
|
|
template: claude
|
|
forward_host_credentials: true
|
|
```
|
|
|
|
Rejects in manifest validation when:
|
|
- Template is not `codex` or `claude`.
|
|
- Both `auth_token` and `forward_host_credentials` are set.
|
|
|
|
### Host auth extraction (`contrib/claude/claude_auth.py`)
|
|
|
|
At prepare/launch time, when `forward_host_credentials: true`:
|
|
|
|
1. Resolve `~/.claude.json` (falling back to `$HOME/.claude.json`).
|
|
2. Parse the JSON object.
|
|
3. Require an `oauthAccount` dict.
|
|
4. Require a non-empty `oauthAccount.sessionKey` string.
|
|
5. If `oauthAccount.expiresAt` is present as a number, require it to be
|
|
in the future.
|
|
6. Return only the session key to the launch path.
|
|
|
|
Errors name the missing or invalid condition and point the operator at
|
|
`claude login`, without printing token values.
|
|
|
|
### Egress route
|
|
|
|
When `forward_host_credentials: true`:
|
|
|
|
- Provision the session key in `provisioned_env` under
|
|
`BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN` (new constant in `egress.py`).
|
|
- Set up the `api.anthropic.com` egress route with `auth_scheme: Bearer`
|
|
and `token_ref: BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN`.
|
|
- Set `CLAUDE_CODE_OAUTH_TOKEN=egress-placeholder` in the agent env and
|
|
add it to `hidden_env_names`.
|
|
|
|
No dummy auth file and no `verify` step are needed — Claude Code reads
|
|
the credential from the env var, not from a file.
|
|
|
|
### Constants
|
|
|
|
- `CLAUDE_HOST_CREDENTIAL_TOKEN_REF = "BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN"`
|
|
in `egress.py` (alongside the existing `CODEX_HOST_CREDENTIAL_TOKEN_REF`).
|
|
- `CLAUDE_HOST_CREDENTIAL_HOSTS = ("api.anthropic.com",)` in
|
|
`agent_provider.py` (alongside the existing `CODEX_HOST_CREDENTIAL_HOSTS`).
|
|
|
|
### Data flow
|
|
|
|
```
|
|
Host ~/.claude.json → bot-bottle launch
|
|
│
|
|
├──► egress sidecar env (real token only)
|
|
│
|
|
└──► agent env: CLAUDE_CODE_OAUTH_TOKEN=egress-placeholder
|
|
|
|
Agent → HTTPS to api.anthropic.com (via egress)
|
|
Egress → injects Authorization: Bearer <real token>
|
|
Egress → forwards to api.anthropic.com
|
|
```
|
|
|
|
## Open questions
|
|
|
|
None — the Codex precedent makes the design clear.
|