Check harness changes on a host without Docker by running the pinned Claude Code CLI against a local mock API server. Capture request headers and verify behavior using the authentication environment generated by the harness.
中文简介正在准备中。当前显示英语简介。
Verify harness changes end-to-end without docker — drive the real pinned CLI against a header-capturing stub server with the exact env resolve_auth_env() produces.
安装前可以查看交给 AI 代理的指令内容。
The pipeline's real surface is the in-container claude -p process and its
outbound API requests. Without docker, drive the same pinned CLI binary
directly with the env dict the harness would inject via docker -e.
harness/agent_image.py:CLAUDE_CODE_VERSION):
npm install --no-save @anthropic-ai/claude-code@<pin> in a temp dir →
binary at node_modules/@anthropic-ai/claude-code/bin/claude.exe (the
.exe name is the real native-binary entry on Linux too, filled in by the
package's postinstall — not a Windows leftover).invalid_request_error
(non-retryable, so the CLI exits fast; exit=1 is expected).python3 -c "from harness.auth import resolve_auth_env; ..." and dump to
an export-lines file with shlex.quote (values contain newlines —
NEVER pass via env $(...), word-splitting mangles them; source the file).unset ANTHROPIC_CUSTOM_HEADERS (and any
other ambient var not in the resolved dict) before sourcing — a Claude
Code session in this repo injects .claude/settings.json env into shells,
which containers never see.ANTHROPIC_BASE_URL=http://127.0.0.1:<port> CLAUDECODE= IS_SANDBOX=1 timeout 30 <cli> -p hi --model claude-sonnet-4-5 --max-turns 1, then read
the captured JSONL.tests/test_patch.py / tests/test_patch_grade.py need
docker and fail on docker-less hosts — pre-existing, not your change.-e injection leg itself can't be exercised without docker;
it's the same mechanism that carries ANTHROPIC_API_KEY in production..claude/settings.json into a
fresh temp dir and run the host claude from there (with ambient
ANTHROPIC_CUSTOM_HEADERS unset so settings.json is the only source).还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Adapt a C/C++ vulnerability pipeline to another language, target, or detection method. The workflow gathers requirements, proposes file changes for approval, updates the implementation, and validates it against a test target containing known bugs.
中文简介正在准备中。当前显示英语简介。
Hunt for signs of compromise in web and application logs without an initial alert. Establish normal activity, record investigative hypotheses, check source code, and reproduce issues locally before producing incident records and a report.
中文简介正在准备中。当前显示英语简介。
Investigate an alert or suspicious identifier using logs and source code. Assess attack success, measure affected data and users, test the suspected flaw locally, and produce a response plan for human review and execution.
中文简介正在准备中。当前显示英语简介。
Turn security findings into candidate code fixes with review results and summaries. Depending on the input, use independent source review or a pipeline with execution checks, then provide diffs for a person to review and apply.
中文简介正在准备中。当前显示英语简介。
Get started with vulnerability review through a guided practice target, from threat modeling to scanning and triage. Ask questions about the pipeline and receive answers grounded in its documentation and source, with references and a next command.
中文简介正在准备中。当前显示英语简介。
Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.
中文简介正在准备中。当前显示英语简介。