warpdotdev/warp · error

--claude-auth-secret is only valid with --harness claude.

Error message

--claude-auth-secret is only valid with --harness claude.

What it means

Produced by RunCloudArgs::validate_auth_secrets (crates/warp_cli/src/agent.rs:678, surfaced at mod.rs:327): `--claude-auth-secret <NAME>` names a Warp-managed secret that is resolved server-side and injected into the agent container, and it is only meaningful for the claude harness. Because `--harness` defaults to Harness::Oz, supplying the secret without explicitly setting `--harness claude` fails fast with this message before any cloud launch starts.

Source

Thrown at app/src/ai/agent_sdk/mod.rs:327

            Ok(())
        }
        AgentCommand::RunCloud(args) => {
            if args.environment.environment.is_some()
                && !FeatureFlag::CloudEnvironments.is_enabled()
            {
                return Err(anyhow::anyhow!("unexpected argument '--environment' found"));
            }
            if args.conversation.is_some() && !FeatureFlag::CloudConversations.is_enabled() {
                return Err(anyhow::anyhow!(
                    "unexpected argument '--conversation' found"
                ));
            }
            if args.harness != Harness::Oz && !FeatureFlag::AgentHarness.is_enabled() {
                return Err(anyhow::anyhow!("unexpected argument '--harness' found"));
            }
            if let Err(msg) = args.validate_auth_secrets() {
                return Err(anyhow::anyhow!(msg));
            }
            if args.runner.is_some() && !FeatureFlag::CloudRunners.is_enabled() {
                return Err(anyhow::anyhow!("unexpected argument '--runner' found"));
            }
            ambient::run_ambient_agent(ctx, args)
        }
        AgentCommand::Profile(sub) => profiles::run(ctx, global_options, sub),
        AgentCommand::List(args) => {
            agent_management::list_agents(ctx, global_options.output_format, args)
        }
        AgentCommand::Get(args) => {
            agent_management::get_agent(ctx, global_options.output_format, args)
        }
        AgentCommand::Create(args) => {
            agent_management::create_agent(ctx, global_options.output_format, args)
        }
        AgentCommand::Update(args) => {
            agent_management::update_agent(ctx, global_options.output_format, args)

View on GitHub (pinned to e72fd7aacb)

Solutions

  1. Add `--harness claude` to the same invocation
  2. If you meant a different harness, use the matching secret flag (e.g. --codex-auth-secret with --harness codex) or none
  3. Create the secret first if needed: `oz secret create claude api-key <NAME>`

Example fix

# before
$ oz agent run-cloud --claude-auth-secret my-key "task"
Error: --claude-auth-secret is only valid with --harness claude.

# after
$ oz agent run-cloud --harness claude --claude-auth-secret my-key "task"
Defensive patterns

Strategy: validation

Validate before calling

// Same rule as RunCloudArgs::validate_auth_secrets, run before launch:
let ok = (args.claude_auth_secret.is_none() || args.harness == Harness::Claude)
    && (args.codex_auth_secret.is_none() || args.harness == Harness::Codex);
anyhow::ensure!(ok, "auth-secret flags must match --harness claude|codex");

Type guard

pub fn auth_secret_args_valid(args: &RunCloudArgs) -> bool {
    (args.claude_auth_secret.is_none() || args.harness == Harness::Claude)
        && (args.codex_auth_secret.is_none() || args.harness == Harness::Codex)
}

Try / catch

match run_agent(ctx, opts, cmd) {
    Err(e) if e.to_string().starts_with("--claude-auth-secret") => {
        // re-invoke with --harness claude added
    }
    result => result?,
}

Prevention

When it happens

Trigger: Running `agent run-cloud --claude-auth-secret NAME ...` without `--harness claude`. Any harness value other than exactly `claude` (including the oz default) triggers it. The check is pure argument pairing - the secret's existence is validated later, server-side.

Common situations: Copy-pasting a secret name into an existing run-cloud invocation and forgetting the harness flag; assuming the secret implies the harness; renaming/rotating secrets after the pairing rule was introduced.

Related errors

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/1d98540b5c120a18. Report an issue: GitHub.