feat: proxy claude api calls to secure auth token#849

Merged

lpcox merged 29 commits intomainfrom

claude/summarize-firewall-proxying

Feb 14, 2026

Commits on Feb 14, 2026

Initial plan
Claude
committed
docs: create comprehensive authentication architecture guide

Claude
and
lpcox
committed
docs: link to authentication architecture guide

Claude
and
lpcox
committed
docs: clarify that Codex/OpenAI uses same credential isolation as Claude

Claude
and
lpcox
committed
fix: exclude OpenAI/Codex keys from agent when api-proxy enabled

Claude
and
lpcox
committed
fix: enable api-proxy for smoke-codex workflow
Claude
committed
feat: add api-proxy health checks for credential isolation
Claude
committed
fix: restore API keys to workflow env for AWF CLI
Claude
committed
feat: add claude code api key helper for credential isolation

Claude
and
claude
committed
feat: add logging to api key helper and api-proxy for observability

Claude
and
lpcox
committed
fix: add CLAUDE_CODE_API_KEY_HELPER env var for helper detection

Claude
and
lpcox
committed
fix: unset HTTP_PROXY for claude to use api-proxy as gateway

Claude
and
lpcox
committed
feat(logs): add api-proxy log persistence and preservation
Claude
committed
fix: add claude code api key helper validation and ttl config

Claude
and
lpcox
committed
fix: make claude code api key helper validation conditional

Claude
and
claude
committed
feat: add post-step to display final claude code config

Claude
and
lpcox
committed
fix: set CLAUDE_CODE_API_KEY_HELPER env var for credential isolation (#851)

Claude
and
lpcox
authored
fix: change claude code config path to ~/.claude.json

Claude
and
lpcox
committed
fix: create ~/.claude.json with apiKeyHelper before claude starts

Claude
and
lpcox
committed
fix: mount ~/.claude.json for chroot mode accessibility

Claude
and
lpcox
committed
fix: handle empty ~/.claude.json created by docker-manager

Claude
and
lpcox
committed
fix: use 0o666 mode for ~/.claude.json to fix permissions (#852)

Claude
and
lpcox
authored
fix: use 666 permissions for ~/.claude.json to allow host user writes

Claude
and
lpcox
committed
fix(ci): add api-proxy logs to smoke-claude artifacts

Claude
and
lpcox
committed
feat: add ANTHROPIC_AUTH_TOKEN placeholder to agent environment

Claude
and
lpcox
committed
fix: restore CODEX_API_KEY env var passing for codex agent compatibility

Claude
and
lpcox
committed
fix: disable CODEX_API_KEY health check for direct credential passing

Claude
and
lpcox
committed
fix: disable OPENAI_BASE_URL for codex agent (temporary)

Claude
and
lpcox
committed
docs: update OPENAI_BASE_URL to include /v1 path suffix

Claude
and
lpcox
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: proxy claude api calls to secure auth token#849

feat: proxy claude api calls to secure auth token#849
lpcox merged 29 commits intomainfrom
claude/summarize-firewall-proxying

Commits on Feb 14, 2026

Initial plan

docs: create comprehensive authentication architecture guide

docs: link to authentication architecture guide

docs: clarify that Codex/OpenAI uses same credential isolation as Claude

fix: exclude OpenAI/Codex keys from agent when api-proxy enabled

fix: enable api-proxy for smoke-codex workflow

feat: add api-proxy health checks for credential isolation

fix: restore API keys to workflow env for AWF CLI

feat: add claude code api key helper for credential isolation

feat: add logging to api key helper and api-proxy for observability

fix: add CLAUDE_CODE_API_KEY_HELPER env var for helper detection

fix: unset HTTP_PROXY for claude to use api-proxy as gateway

feat(logs): add api-proxy log persistence and preservation

fix: add claude code api key helper validation and ttl config

fix: make claude code api key helper validation conditional

feat: add post-step to display final claude code config

fix: set CLAUDE_CODE_API_KEY_HELPER env var for credential isolation (#851)

fix: change claude code config path to ~/.claude.json

fix: create ~/.claude.json with apiKeyHelper before claude starts

fix: mount ~/.claude.json for chroot mode accessibility

fix: handle empty ~/.claude.json created by docker-manager

fix: use 0o666 mode for ~/.claude.json to fix permissions (#852)

fix: use 666 permissions for ~/.claude.json to allow host user writes

fix(ci): add api-proxy logs to smoke-claude artifacts

feat: add ANTHROPIC_AUTH_TOKEN placeholder to agent environment

fix: restore CODEX_API_KEY env var passing for codex agent compatibility

fix: disable CODEX_API_KEY health check for direct credential passing

fix: disable OPENAI_BASE_URL for codex agent (temporary)

docs: update OPENAI_BASE_URL to include /v1 path suffix

Comments