One read of Claude Code CLIclaude-code-20261023T140701Z
3 pages moved out of 228 read.
Pages moved
3
significant first
Pages read
228
in this capture
Captured
14:07 UTC
Corpus hash
a3d9202424c9
corpus-hash
What this read moved
1-3 of 3cloud-environments Changed · +8 / -6 lines
### Add a setup script
from line 58
5858* **Add an environment**: select **New environment** at the bottom of the menu to open the **New environment** dialog. Fill in the form and select **Add environment**. Your new session then uses the environment you added.
5959* **Edit an environment**: find its row under **Cloud**. If **Cloud** is a single row, select it to open the list. If your environment isn't listed under **Cloud**, select the **More** row under that heading. Hover over the environment's row and select the settings icon that appears on its right to open its dialog.
6060
61The dialog includes the name, network access level, environment variables, and setup script. To store a key that sessions use without seeing it, see [Add network secrets](#add-network-secrets).
61When you add an environment or edit one of your own, select the dialog's [**Network access**](#network-access), [**Setup script**](#add-a-setup-script), or [**Environment variables**](#set-environment-variables) row to open that setting. After your last change, save with **Add environment** for a new environment or **Save changes** for an existing one. To store a key that sessions use without seeing it, see [Add network secrets](#add-network-secrets).
6262
6363### Set environment variables
6464
from line 96
9696These requirements decide whether you can add a secret and whether the agent proxy can use it once added:
9797
9898* **Role**: on Pro, Max, and Team plans, you can add and delete secrets on your own environments whatever your role. On Team and Enterprise, Owners hold an organization admin role in your claude.ai organization and Admins don't, which changes what you see in these cases:
99 * **Your own environment on Enterprise**: with an organization admin role, you add and delete secrets. Without it, the **Network secrets** section lists the secrets under the note "Only an organization admin can add or delete network secrets", with no **Add secret** or delete button. Ask an Owner to add the secret to a [shared environment](#organization-shared-environments), then run your sessions there
99 * **Your own environment on Enterprise**: with an organization admin role, you add and delete secrets. Without it, the **Network secrets** row opens the secrets list with the note "Only an organization admin can add or delete network secrets" and no **Add secret** or delete button. Ask an Owner to add the secret to a [shared environment](#organization-shared-environments), then run your sessions there
100100 * **A shared environment**: Owners [add and delete its secrets](#add-a-credential) from admin settings. Without an organization admin role, ask an Owner to add the secret, because the environment's dialog has no **Network secrets** section
101101 * **Your own environment on Team**: without an organization admin role, **Add secret** opens a [shorter form](#add-a-secret-without-the-role) that takes one host
102102* **Environment type**: an Anthropic-hosted cloud environment that already exists. A [self-hosted environment](/docs/en/self-hosted-environments) doesn't have network secrets
from line 107
107107
108108You add secrets one at a time, and you can't edit a secret after you add it. To change a secret's hosts or value, delete it and add it again.
109109
110To add a secret to a [shared environment](#organization-shared-environments), open it for editing from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then continue step 1 from the **Network secrets** section. If you're on a Team plan and don't hold an [organization admin role](#requirements), follow step 1 on your own environment, then [fill in the shorter form](#add-a-secret-without-the-role).
110To add a secret to a [shared environment](#organization-shared-environments), open it for editing from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then continue from step 2 in its **Network secrets** section. If you're on a Team plan and don't hold an [organization admin role](#requirements), follow step 1 on your own environment, then [fill in the shorter form](#add-a-secret-without-the-role).
111111
112112**1. Open the environment's network secrets**
113113
114[Open the environment for editing](#configure-your-environment) at [claude.ai/code](https://claude.ai/code). In the **Edit cloud environment** dialog, find the **Network secrets** section. You see the secrets already on the environment, each with the hosts it applies to.
114[Open the environment for editing](#configure-your-environment) at [claude.ai/code](https://claude.ai/code). In the **Edit cloud environment** dialog, select the **Network secrets** row. You see the secrets already on the environment, each with the hosts it applies to.
115115
116116**2. Add the secret**
117117
from line 131
131131
132132#### Add a secret on a Team plan without an organization admin role
133133
134If you're on a Team plan and don't hold an [organization admin role](#requirements), the **Add secret** form takes one secret for one host. Select **Add secret** in your environment's [**Network secrets** section](#add-a-credential), fill in these fields, then select the form's **Add secret** button:
134If you're on a Team plan and don't hold an [organization admin role](#requirements), the **Add secret** form takes one secret for one host. Select your environment's [**Network secrets** row](#add-a-credential) and then **Add secret**. Fill in these fields and select the form's **Add secret** button:
135135
136136* **Host**: the one host that gets the secret, such as `api.example.com`. The form doesn't accept a `*.` wildcard
137137* **Name**: an optional label for the secret
from line 426
426426
427427Scripts run as root on Ubuntu 24.04, so `apt install` and most language package managers work.
428428
429To add a setup script, open the environment settings dialog and enter your script in the **Setup script** field.
429### Add a setup script
430
431To add a setup script to your own environment, you can type or paste it, or load a text file such as `setup.sh`. [Add or edit the environment](#configure-your-environment) and select the **Setup script** row. Enter the script in the box that opens, or select **Choose file** to replace the box's contents with the text of a file up to 64 KB. Then select **Add environment** or **Save changes**.
430432
431433This example installs [ShellCheck](https://www.shellcheck.net/), which isn't pre-installed.
432434
self-hosted-environments-configuration Changed · +6 / -5 lines
from line 58
5858
5959The child's stdin is the runner's control channel. Token rotations and session-end signals arrive on it. The runner also opens a pipe on file descriptor 3 and reads the child's activity signals from it to drive idle and startup timeouts. A plain `exec "$CLAUDE_RUNNER_CLAUDE_BIN" "$@"` preserves both automatically.
6060
61If your wrapper backgrounds the child with a bare `&`, it severs the child's stdin. The session looks healthy until the initial OAuth token's roughly 30-minute lifetime expires, and then every API call that uses the token fails with `401 authentication_error`. If your wrapper must background the child, for example to keep a teardown trap alive, save stdin on file descriptor 4 or higher and re-attach it explicitly:
61If your wrapper backgrounds the child with a bare `&`, it severs the child's stdin. The session looks healthy until the initial OAuth token's roughly 30-minute lifetime expires, and then every API call that uses the token fails with `401 authentication_error`. If your wrapper must background the child, for example to keep a teardown trap alive, save stdin on file descriptor 9 and re-attach it explicitly:
6262
6363```bash theme={null}
64exec 4<&0
65"$CLAUDE_RUNNER_CLAUDE_BIN" "$@" <&4 4<&- &
64exec 9<&0 # the runner uses 3, and from v2.1.309 reserves 4 and 5
65"$CLAUDE_RUNNER_CLAUDE_BIN" "$@" <&9 9<&- &
6666CHILD=$!
6767trap 'teardown' EXIT
6868wait "$CHILD"
from line 71
7171You can redirect the child's stdout. Keep file descriptor 3 and stderr attached to the runner:
7272
7373* **File descriptor 3**: carries the child's activity signals to the runner. Don't close it or reuse it in the wrapper.
74* **File descriptors 4 and 5**: runners on Claude Code v2.1.309 or later reserve them for the child. Don't close or reuse them in the wrapper. If your wrapper uses either, for example to save stdin, move that use to a descriptor from 6 to 9, which earlier versions leave free too.
7475* **stderr**: when the wrapper or the child exits non-zero, the runner posts the last lines of stderr to the session and prints them in its own log. The session's user sees those lines, so don't print secrets to stderr, and remove `set -x` before you deploy the wrapper. If you redirect stderr, sessions still run, but the runner reports a failure with the exit code alone.
7576
7677### Pass the system prompt flags through
security-guidance Changed · +1 / -1 lines
from line 165
165165
166166The [per-edit pattern check](#on-each-file-edit) makes no model call and adds no cost. The [end-of-turn](#at-the-end-of-each-turn) and [commit](#on-each-commit-or-push-claude-makes) reviews each spend additional model usage that counts toward your [usage](/docs/en/costs.md) like any other Claude request. The commit review is agentic and may take several model turns per commit. Expect roughly one review call per turn that changes files and one deeper review per commit, both subject to the caps above.
167167
168Both model-backed reviews use Claude Opus 4.7 by default. Set `SECURITY_REVIEW_MODEL` to choose a different model for the end-of-turn review and `SG_AGENTIC_MODEL` for the commit review.
168By default, both reviews run on a Claude Opus model. Set `SECURITY_REVIEW_MODEL` to choose a different model for the end-of-turn review and `SG_AGENTIC_MODEL` for the commit review.
169169
170170The plugin is available on all plans.
171171