{"id":"94c07738-7417-48cf-9d4d-cf28f22114b2","slug":"edotau-claude-code","kind":"skill","name":"claude-code","summary":"","owner":"edotau","repoUrl":"https://github.com/edotau/claude-code","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-09-16T05:16:05.000Z","addedAt":"2026-10-22T03:39:12.738Z","logoUrl":"https://avatars.githubusercontent.com/u/11465271?u=663d7043ab2da9aeade2a83b7316b9a89c1777f9&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools"],"tags":[],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-22T20:04:11.357Z","sample":false,"url":"https://conduits.dev/tools/edotau-claude-code","language":"Go","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# claude-code\n\nA minimal harness for [Claude Code](https://docs.anthropic.com/en/docs/claude-code). This repo **is** `~/.claude`:\none Go binary, `claude-code`, plus the agents, commands, rules, skills and Workflow scripts every session loads.\n\nWhat it adds to a stock install:\n\n- **Provider registry** — Anthropic, Claude/ChatGPT/Copilot subscriptions, OpenAI, Gemini, Nvidia, Ollama or any\n  gateway; tier slots (opus/sonnet/haiku/fable) map to model ids per provider.\n- **Loopback router** — OpenAI-dialect translation, per-tier provider mixing, failover on 429/5xx.\n- **Agent runners** — one-shot tasks on Claude, Codex, Gemini, OpenCode or Copilot (`ask`), interactive CLIs (`run`).\n- **Hooks, memory, status line** — a Bash safety gate, a per-repo memory bank, format-on-stop, context checkpoint.\n\nEvery verb takes `--help`; `claude-code describe` maps the whole harness.\n\n## Install\n\n```bash\ngit clone https://github.com/edotau/claude-code ~/.claude\ncd ~/.claude\nmake install                  # build, link vendor CLIs into bin/, render settings.json, add linters (DEV_TOOLS=0 skips)\nclaude-code doctor            # check binaries, providers, credentials, router\n```\n\n- `make bootstrap` — fresh box: Go toolchain (no sudo), install, bash completion, then `claude-code configure`\n  (`CHECK=1` runs `configure --check` instead; `TAILSCALE=1` adds tailscale).\n- `claude-code install --dry-run` previews; foreign hooks in `settings.json` are kept, with a timestamped backup.\n- A missing vendor CLI is reported, never downloaded; `install --tools=<name>` installs it.\n- `bin/<vendor>` is the real, unrouted CLI. Routed launches go through `claude-code <vendor>`.\n\n![claude-code help menu](docs/images/cli-menu.svg)\n\n```bash\nclaude-code opus        # Claude Code with opus as the main model (also sonnet | haiku | fable)\nclaude-code codex       # a vendor CLI through the registry (also gemini | opencode | copilot)\nclaude-code ollama      # Claude Code on that registered provider\nclaude-code --resume    # a leading flag passes to claude, on the session provider\n```\n\n## Setup\n\n```bash\nclaude-code configure                 # interactive menu: providers, logins/keys, models, agents; Submit seals keys\nclaude-code configure models          # one section (provider|models|agents|router|github|remote|browser|claude|doctor)\nclaude-code configure claude          # per-machine settings overrides; team defaults stay in the template\nclaude-code configure --check         # report only; exit 1 if anything is unset\nclaude-code configure --reset [--out f|--check|--dry-run]   # render settings + vendor configs\nclaude-code configure --restore [--agent a,b]       # restore vendor configs from backup\nclaude-code theme vscode [--check|--dry-run]             # merge VS Code settings + keybindings\n```\n\n- `configure` reuses what already exists (env, vault, vendor logins) and prompts only for what is missing.\n- **Claude subscription** keeps Remote Control; **API key** pays per token. For headless runs on a Max plan,\n  `configure` mints `claude setup-token` into the vault as `CLAUDE_CODE_OAUTH_TOKEN`.\n- Vendor configs are merged, never replaced: `~/.codex/config.toml`, `~/.gemini/antigravity-cli/settings.json`,\n  Codex/Copilot hooks. Keys are referenced by env var, exported only by a routed launch. opencode's own\n  `~/.config/opencode/` is never written (its model/MCP/theme come from a tracked overlay, `OPENCODE_CONFIG` /\n  `OPENCODE_TUI_CONFIG`, injected at launch — `internal/vendors/template/`).\n- On a terminal, `configure --reset` prompts before overwriting hand-edited lines it would otherwise lose; a\n  non-interactive run (launch, `configure`, `make install`) writes and warns instead. Each overwrite keeps 5\n  timestamped backups; `configure --restore` steps a vendor file back one version at a time.\n- From a worktree, render only that checkout:\n  `CLAUDE_CONFIG_DIR=\"$PWD\" claude-code configure --reset --out \"$PWD/settings.json\"`\n  (vendor homes are skipped unless `--vendors`).\n\n### Setup modes: adopt, nuke, workspace\n\n```bash\ngit clone https://github.com/edotau/claude-code ~/.claude.stage      # ~/.claude already exists: stage the clone,\nmake -C ~/.claude.stage adopt                                         # then adopt it (backs up collisions) + bootstrap\nclaude-code install --setup nuke [--apply] [--keep-memory]            # archive untracked content, then remove\nclaude-code install --setup workspace init|link|status                # scope a project's own .claude/\n```\n\n## Providers\n\nBuilt-ins live in `internal/providers/defaults.json`. `claude-code vault edit` overlays them **by name** (an entry\nreplaces the built-in; `null` removes it).\n\n```jsonc\n\"providers\": {\n  \"default\": \"gateway\",\n  \"fallback\": [\"gateway\", \"anthropic\"],         // 429/5xx ladder (implies the router)\n  \"providers\": {\n    \"gateway\": {\n      \"kind\": \"anthropic\",                       // dialect base_url speaks\n      \"base_url\": \"https://llm.example.com\",\n      \"routes\": {\"openai\": \"/v1\"},               // extra dialects on the same gateway\n      \"auth\": {\"type\": \"bearer\", \"env\": \"GATEWAY_API_KEY\"},\n      \"models\": {\"opus\": \"claude-opus-5\", \"sonnet\": \"claude-sonnet-5\", \"haiku\": \"gpt-5-nano\"},\n      \"one_m\": true                              // adds [1m] to Claude ids\n    },\n    \"ollama\": null\n  }\n}\n```\n\n| Field | Meaning |\n| --- | --- |\n| `kind` | `anthropic` · `openai` · `responses` · `gemini` |\n| `auth.type` | `x-api-key` · `bearer` · `none` · `passthrough` (subscription OAuth; `auth.login` names the vendor CLI) |\n| `models` | slot → model id |\n| `headers` | sent on every upstream request |\n\n```bash\nclaude-code configure provider --list [name]        # providers, credential state, fallback ladder\nclaude-code switch gateway                          # pin the session provider\nclaude-code models --pin haiku=openai:gpt-5-nano    # pin a slot; provider:model crosses providers\nclaude-code models --unpin | --live --provider p    # clear pins | list what upstream serves\nclaude-code --provider gateway --model claude-sonnet-5   # this launch only\n```\n\nPrecedence: `--provider` → `HARNESS_PROVIDER` → registry `default`. Slot: `HARNESS_<SLOT>_MODEL` → `HARNESS_MODEL` →\nthe provider's `models`. Process env beats vault pins.\n\n### Vault: `claude-code vault list|edit`\n\n`state/vault.db` holds pins, custom launch env, provider/vendor overlays and `key_command` as one JSON document, plus\nsealed secrets. `vault edit` opens it in `$EDITOR` and saves atomically; secrets never appear in it.\n\n```jsonc\n{\n  \"pins\": {\"HARNESS_PROVIDER\": \"anthropic\", \"HARNESS_HAIKU_MODEL\": \"openai:gpt-5-nano\"},\n  \"env\": {\"MY_PROJECT_ROOT\": \"/home/me/work\", \"SOME_API_TOKEN\": \"@secret\"},   // @secret = vault secret of that name\n  \"providers\": {\"default\": \"gateway\"},\n  \"vendors\": {\"vendors\": {\"codex\": {\"permission\": {\"approvalPolicy\": \"on-failure\"}}}},\n  \"vault\": {\"key_command\": \"\"}\n}\n```\n\n## Credentials\n\nFirst non-empty source wins:\n\n1. **Process env** — `auth.env`\n2. **Vault** — `claude-code vault set <KEY>` (AES-256-GCM)\n3. **`auth.file`**\n4. **`auth.command`** — prints the credential; cached `auth.ttl` seconds (default 300), re-run on 401\n\n```json\n\"auth\": {\"type\": \"bearer\", \"command\": \"op read op://Private/gateway/credential\", \"ttl\": 3600}\n```\n\n`claude-code token --provider <p>` is the `apiKeyHelper` Claude Code calls, so no key lands in `settings.json`.\n\n```bash\nclaude-code vault set [KEY]            # bare on a terminal = guided dialog\nclaude-code vault get KEY... [--export]\nclaude-code vault import keys.env      # then delete the plaintext file\nclaude-code vault get KEY... | ssh box claude-code vault import - --yes\nclaude-code configure provider --list  # credential sources; never prints values\nclaude-code doctor --scan|--git|--secrets   # leak audits; never print values\n```\n\nDatabricks: only `u2m` and `pat` credentials are stored, sealed in the vault, plus the u2m access token cached as\n`PROVIDER_<ID>_ACCESS_TOKEN`. `oauth-m2m` tokens are minted per use and never stored; the SP client secret stays sealed.\n\n`claude-code databricks mint <id> [--copy] [--clear-after 30s] [--dry-run]` prints the auth type, length and expiry,\nnever the token. `--copy` puts it on the clipboard and clears it after 30s; on WSL the copy stays out of Win+V history.\n\n`claude-code configure` → databricks: Login / Paste PAT / Mint now / Copy token / Apply to agents.\n`configure databricks --check` gives the same information without the TUI.\n\nClipboard gaps: macOS clipboard managers and Universal Clipboard can keep a copy; a killed clear process leaves the\ntoken; headless Linux has no clipboard.\n\n### The vault key\n\n32 random bytes, resolved in order: `HARNESS_VAULT_KEY` → OS keyring (service `claude-code`) → `key_command` (a JSON\nargv run without a shell). No key file is written. Headless boxes set `HARNESS_VAULT_KEY` or `key_command`.\n`HARNESS_VAULT_KEY` is scrubbed from vendor CLI children. `vault rotate-secret` re-seals and keeps old keys.\n\n## Routing\n\n`claude` launches **direct** when the provider speaks `anthropic`, every slot stays on it, and no `fallback` is set.\nOtherwise it goes through the **loopback router** (`127.0.0.1:18765`, started on demand), which:\n\n1. requires a per-install client secret and a loopback `Host`;\n2. resolves `model` (`id` or `provider:model`) and strips `[1m]`;\n3. passes `anthropic` routes through; translates Messages ⇄ chat-completions for `openai` routes (streaming, tools);\n4. refreshes the credential and replays once on 401/403;\n5. fails over along `fallback` on 429/5xx/connect error before the first byte;\n6. on a hard-quota 429 demotes opus → sonnet → haiku and skips the dead model for 30 minutes.\n\nProvider hostnames resolving into the local network are refused (a literal IP or `localhost` in `base_url` is allowed).\nThe router disables Remote Control, so a subscription session stays direct under a `fallback` ladder; a\ncross-provider slot or `--router` still routes it.\n\n```bash\nclaude-code router start|status|stop\nclaude-code router serve --port 18765   # foreground\nclaude-code --router                    # force the router for one launch\n```\n\n## Tailscale\n\n```bash\nclaude-code network tailscale [--machines|--connect|--key [--save]|--exit-node on|off|approve]\n```\n\n`status`/`machines`/`connect` use the installed CLI. `key` and `exit-node --approve` need\n`TAILSCALE_OAUTH_CLIENT_ID`/`_SECRET` (preferred) or `TAILSCALE_API_KEY` in the vault. `make tailscale-cli` installs it.\n\n`claude-code network vscode [--port N] [--stop] [--status] [--no-tailscale] [--funnel]` runs\n`code serve-web` as a detached daemon and maps it onto the tailnet (or the public internet with\n`--funnel`), printing a token-gated URL and a terminal QR code for your phone.\n\n## Worktrees and agent views\n\n```bash\nclaude-code worktree list|create <name>|clean <name>|clean-all   # ~/worktrees/<repo>/*; never forces a removal\nclaude-code agents tree [--watch]          # sessions → subagents → workflows, with vendor legs and fallbacks\nclaude-code agents tree --running          # only what runs now, machine-wide: sessions, subagents, dispatch jobs\nclaude-code agents reap [--dry-run]        # mark lost dispatch jobs `error`, drop dead agent-inflight markers\nclaude-code network view <agentId> [--follow]  # one agent's snapshot or live events\nclaude-code network page [--addr ip:port]           # dashboard over loopback or the tailnet\nclaude-code dispatch --host <h> --agent <a> \"<task>\"   # detached agent TUI on another box (tmux)\nclaude-code network browser [--setup --browser edge]      # browser control paths; Claude in Chrome install\nclaude-code network websearch --query q           # Tavily one-shot (bare = stdio MCP server)\n```\n\n## Agents\n\n```bash\nclaude-code agents                                     # runners and availability\nclaude-code ask --agent codex \"Review this branch.\"    # one-shot; --format json, --tools, --effort\nclaude-code ask --log | --retry <id>                   # recent dispatches; replay one\nclaude-code opencode --provider ollama --model qwen3-coder   # interactive; -- forces passthrough\nclaude-code codex review --adversarial --base main     # per-vendor verbs; claude-code codex -h lists them\nclaude-code gemini bridge --dirs internal \"<task>\"     # one 1M-context sweep via agy\nclaude-code agents sync [--dry-run|--check]            # project agents/ + CLAUDE.md into every vendor\nclaude-code usage --days 7                             # subagent token usage\n```\n\n- Without `--tools`, runners are read-only. Gemini runs only on `agy` and its Google sign-in.\n- `gemini bridge` inlines tracked files only and always skips `.env*`, `state/`, keys.\n- `agents sync` renders under `state/projections/<vendor>/`, installs into `~/.codex`, `~/.copilot`, `~/.gemini`,\n  `~/.config/opencode`, and links `skills/` into `~/.agents/skills`. No AGENTS.md lives at this root (Claude Code would\n  load it as a second CLAUDE.md).\n- In-session fan-out: `agents/` subagents and `workflows/` scripts — see `rules/workflow/master-workflow.md`.\n\n## Hooks\n\nDeclared in `internal/hookspec/hookspec.go`, implemented in `internal/hooks/`. To add one: implement, register a\n`Spec`, `make install`.\n\n| Hook | Event | Does |\n| --- | --- | --- |\n| `bash-guard` | PreToolUse Bash | Blocks destructive commands (`rm -rf /`, force-push main, `curl \\| sh`, git resets in `~/.claude`); routes noisy output through rtk |\n| `docs-placement` | PreToolUse Write/Edit | Blocks new `.md` at a repo root or ignored `docs/`; enforces the plan template |\n| `agent-effort` | PreToolUse Agent | Fills an unset subagent model (low → haiku, else sonnet); logs the decision; appends up to 3 memory recall pointers to the spawn prompt |\n| `agent-routed` | SubagentStart | Records the subagent's actual launch model against `agent-effort`'s decision log |\n| `workflow-lint` | PreToolUse Workflow | Pins unpinned inline agents to sonnet |\n| `agent-inflight*` | Pre/PostToolUse Agent | Caps concurrent dispatches at 8 |\n| `subagent-stop` | SubagentStop | Retires the stopping subagent's inflight slot |\n| `plan-mirror` / `save-plan` | PostToolUse | Dated plan copies under `plans/`; files the approved plan |\n| `context-checkpoint` | Stop | At ≥85% context, pauses once for a handoff |\n| `stop-format` | Stop | Formats files edited this turn |\n| `session-start` | SessionStart | Injects the memory catalog and this repo's active context |\n| `memory-recall` | UserPromptSubmit | Injects up to 3 matching memory blocks |\n| `wsl-path-normalize` | UserPromptSubmit | Maps pasted Windows paths to `/mnt/…` |\n| `session-harvest[-end]` / `pre-compact` | Stop / SessionEnd / PreCompact | Saves the session into the memory bank |\n| `access-trace` | PostToolUse Read | Logs bank reads for `memory review` |\n| `worktree-create` / `-remove` | Worktree* | Under `~/worktrees/<repo>/`; refuses dirty removals |\n\n## Memory bank\n\nOne store, `~/.claude/memory/`: a local-only git repo (every settle commits, never pushed).\n\n```text\nmemory/\n  index.md       generated catalog — never hand-edit\n  home/          cross-repo bank\n  claude-code/   the harness's own bank\n  <repo>/        per repo, keyed by origin remote basename; .origin records identity\n```\n\nEach bank dir holds Claude Code's native memory (`MEMORY.md` + topic files) and six typed files: `projectContext`,\n`activeContext`, `progress`, `decisionLog`, `conventions`, `sessionHistory`. `MEMORY.md`'s\n`<!-- bank:begin -->…<!-- bank:end -->` region is generated; lines outside it are never touched.\n`~/.claude/projects/<slug>/memory` is a symlink into the store.\n\nA session gets the catalog plus this repo's active context and progress; the rest loads on demand. Settles rotate\n`sessionHistory` past 30 entries into `archive/`. `memory dream` consolidates daily in the background.\n\n```bash\nclaude-code memory recall [--repo R|--all] <terms>    # BM25 search; public verb\nclaude-code memory init|review|promote|remember|update|dream   # public verbs\nclaude-code memory path|index|show <id>|digest|timeline|fmt|watch   # private plumbing\nclaude-code memory archive [--split N --apply|--dupes]  # keep MEMORY.md small\nclaude-code memory alias                             # fold a second checkout\n```\n\n`claude-code memory init` enriches a bank; `claude-code memory update` saves manually.\n\n## Housekeeping\n\n```bash\nclaude-code clean [--list|--dry-run] [--target projections|sessions]   # sweep caches, run dirs, backups\nclaude-code history snapshot|log|diff     # shadow history of config (never secrets)\nclaude-code doctor --audit [--days 7]     # provider switches, pins, secret sets, guard blocks, failovers\nclaude-code network mcp                    # MCP health, scope drift, inline secrets\nclaude-code theme [--preview] | apply     # statusline palette; whole look across tools\n```\n\n## Status line\n\n`claude-code theme statusline [--style gradient|powerline|capsule|minimal|dashboard]` shows model, provider, router,\ncontext %, tokens, duration and git state, plus the 5h/weekly rate limits (`5h:N% 7d:N%`);\n`segments.agents` adds `N ◉` agents running (main thread + subagents + this session's dispatch legs), and\n`gradientEase` (<1) reaches the ramp's end sooner.\nConfig: `~/.claude/state/statusline/config.json`.\n\n## Layout\n\n```text\ncmd/claude-code/     main\ninternal/            cli (verb table) · providers · router · translate · launch · vendors · agent · hooks · memory …\nagents/ commands/ rules/ skills/ workflows/   loaded by Claude Code\nstate/vault.db       pins, env, overlays, sealed secrets (untracked)\nmemory/              the memory store (its own local git repo)\n.memory-cache/       harness backups (*.bak-*), shadow config history, vendor caches (untracked)\nplans/               implementation plans (untracked)\ndocs/templates/      index of every embedded (`//go:embed`) template, with rendered examples\n```\n\n## Command reference\n\nRows `CLAUDE.md` points here for.\n\n| To… | Run |\n| --- | --- |\n| Set up a box end to end | `claude-code configure [section] [--agent a] [--check]` · `make bootstrap` |\n| Adopt, wipe or scope a `.claude/` | `claude-code install --setup adopt\\|nuke\\|workspace` |\n| Sync VS Code settings | `claude-code theme vscode [--check\\|--dry-run]` |\n| Bash tab completion | `claude-code completion --install` |\n| Add a gateway provider | `claude-code vault edit` → `providers.providers` |\n| Edit pins, env, overlays | `claude-code vault list\\|edit\\|rotate-secret` |\n| OpenCode reasoning effort | TUI `ctrl+t` · `opencode run --variant high` · `claude-code ask --effort high` |\n| Project agents into vendors | `claude-code agents sync [--vendor v] [--dry-run\\|--check]` |\n| Run an agent on another tailnet box | `claude-code dispatch --host <h> --agent <a> \"<task>\"` · `--list --status` |\n| Watch agents from a phone | `claude-code network page [--addr ip:port]` |\n| Subagent status and legs | `claude-code agents tree [--watch\\|--running]` · `agents reap` · `claude-code network view <id>` |\n| Browsers Claude in Chrome can drive | `claude-code network browser` · `network browser --setup --browser <b>` |\n| Audit what acted | `claude-code doctor --audit` |\n| Config history | `claude-code history snapshot\\|log\\|diff` · memory: `git -C ~/.claude/memory log` |\n| Theme | `claude-code theme [--preview] [<palette>]` · `theme apply` |\n| Keep MEMORY.md small | `claude-code memory archive [--split 20 --apply]` |\n| Lint a workflow script | `claude-code workflow lint` · `workflow skeleton <pattern>` |\n| Tailnet | `claude-code network tailscale [--machines\\|--connect\\|--key\\|--exit-node on\\|off\\|approve]` |\n| VS Code on your phone | `claude-code network vscode [--stop\\|--status] [--funnel]` |\n\n## Development\n\n```bash\ngo test ./internal/<pkg>   # while developing — only what you touched\nmake lint                  # fmt, vet, shell, yaml, markdown (CHECK=1 reports only)\nmake lint-deep             # golangci-lint, uncapped\nmake test                  # full gate, once before pushing (= make audit = CI)\n```\n\n- `git push` runs the same gate via `.githooks/pre-push`; `--no-verify` bypasses it.\n- `settings.json` is generated: edit `internal/settings/template/`, then `make install`. Template keys reset\n  on every install; permission lists are unioned, so a removed rule must also be deleted from `settings.json` by hand.\n"}