{"record":{"id":"1d98540b5c120a18","repo":"warpdotdev/warp","slug":"claude-auth-secret-is-only-valid-with-harness","errorCode":null,"errorMessage":"--claude-auth-secret is only valid with --harness claude.","messagePattern":"--claude-auth-secret is only valid with --harness claude\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/mod.rs","lineNumber":327,"sourceCode":"\n            Ok(())\n        }\n        AgentCommand::RunCloud(args) => {\n            if args.environment.environment.is_some()\n                && !FeatureFlag::CloudEnvironments.is_enabled()\n            {\n                return Err(anyhow::anyhow!(\"unexpected argument '--environment' found\"));\n            }\n            if args.conversation.is_some() && !FeatureFlag::CloudConversations.is_enabled() {\n                return Err(anyhow::anyhow!(\n                    \"unexpected argument '--conversation' found\"\n                ));\n            }\n            if args.harness != Harness::Oz && !FeatureFlag::AgentHarness.is_enabled() {\n                return Err(anyhow::anyhow!(\"unexpected argument '--harness' found\"));\n            }\n            if let Err(msg) = args.validate_auth_secrets() {\n                return Err(anyhow::anyhow!(msg));\n            }\n            if args.runner.is_some() && !FeatureFlag::CloudRunners.is_enabled() {\n                return Err(anyhow::anyhow!(\"unexpected argument '--runner' found\"));\n            }\n            ambient::run_ambient_agent(ctx, args)\n        }\n        AgentCommand::Profile(sub) => profiles::run(ctx, global_options, sub),\n        AgentCommand::List(args) => {\n            agent_management::list_agents(ctx, global_options.output_format, args)\n        }\n        AgentCommand::Get(args) => {\n            agent_management::get_agent(ctx, global_options.output_format, args)\n        }\n        AgentCommand::Create(args) => {\n            agent_management::create_agent(ctx, global_options.output_format, args)\n        }\n        AgentCommand::Update(args) => {\n            agent_management::update_agent(ctx, global_options.output_format, args)","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/mod.rs#L309-L345","documentation":"Produced by RunCloudArgs::validate_auth_secrets (crates/warp_cli/src/agent.rs:678, surfaced at mod.rs:327): `--claude-auth-secret <NAME>` names a Warp-managed secret that is resolved server-side and injected into the agent container, and it is only meaningful for the claude harness. Because `--harness` defaults to Harness::Oz, supplying the secret without explicitly setting `--harness claude` fails fast with this message before any cloud launch starts.","triggerScenarios":"Running `agent run-cloud --claude-auth-secret NAME ...` without `--harness claude`. Any harness value other than exactly `claude` (including the oz default) triggers it. The check is pure argument pairing - the secret's existence is validated later, server-side.","commonSituations":"Copy-pasting a secret name into an existing run-cloud invocation and forgetting the harness flag; assuming the secret implies the harness; renaming/rotating secrets after the pairing rule was introduced.","solutions":["Add `--harness claude` to the same invocation","If you meant a different harness, use the matching secret flag (e.g. --codex-auth-secret with --harness codex) or none","Create the secret first if needed: `oz secret create claude api-key <NAME>`"],"exampleFix":"# before\n$ oz agent run-cloud --claude-auth-secret my-key \"task\"\nError: --claude-auth-secret is only valid with --harness claude.\n\n# after\n$ oz agent run-cloud --harness claude --claude-auth-secret my-key \"task\"","handlingStrategy":"validation","validationCode":"// Same rule as RunCloudArgs::validate_auth_secrets, run before launch:\nlet ok = (args.claude_auth_secret.is_none() || args.harness == Harness::Claude)\n    && (args.codex_auth_secret.is_none() || args.harness == Harness::Codex);\nanyhow::ensure!(ok, \"auth-secret flags must match --harness claude|codex\");","typeGuard":"pub fn auth_secret_args_valid(args: &RunCloudArgs) -> bool {\n    (args.claude_auth_secret.is_none() || args.harness == Harness::Claude)\n        && (args.codex_auth_secret.is_none() || args.harness == Harness::Codex)\n}","tryCatchPattern":"match run_agent(ctx, opts, cmd) {\n    Err(e) if e.to_string().starts_with(\"--claude-auth-secret\") => {\n        // re-invoke with --harness claude added\n    }\n    result => result?,\n}","preventionTips":["Always emit --harness and its secret flag together from templates","Remember --harness defaults to oz; a bare secret flag always fails","Validate arg pairing client-side (validate_auth_secrets) before spawning the agent"],"tags":["cli","argument-validation","secrets","agent-harness","rust"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}