Migrate Claude harness from builtin to container-script provisioning by ptone · Pull Request #279 · GoogleCloudPlatform/scion

ptone · 2026-05-31T17:43:05Z

Summary

Migrate the Claude harness from the compiled-in builtin provisioner to the extensible container-script model, matching what OpenCode and Codex already use
Add provision.py for Claude that handles auth resolution, API key pre-approval, project path setup, and MCP server translation
Add comprehensive parity tests and Python integration tests

What changed

pkg/harness/claude/embeds/config.yaml: Changed provisioner.type from builtin to container-script and added MCP capabilities block.

pkg/harness/claude/embeds/provision.py (new): Container-side provisioner script handling:

Auth resolution with Claude's 4-way precedence (API key → OAuth token → auth-file → Vertex AI)
API key pre-approval fingerprint in .claude.json (mirrors ClaudeCode.ApplyAuthSettings)
Project workspace path setup in .claude.json (mirrors ClaudeCode.provisionClaudeJSON)
MCP server translation using scion_harness.apply_mcp_servers_simple()
Auth env var overlay output for the runtime

pkg/harness/claude_parity_test.go (new): 11 tests covering:

Seed/embed verification (TestClaudeEmbedsSeedRootSupportFiles)
Activate-script idempotency (TestClaudeActivateScriptIsIdempotent)
ContainerScriptHarness vs ClaudeCode parity (TestClaudeContainerScriptHarnessParity)
Bundle staging and reconciliation
Python script integration: happy path, no-creds, API key approval, Vertex AI, MCP

What remains (tracked in #100)

Gemini harness: Still on builtin; needs its own provision.py (follow-up PR)
Retire builtin path: Once all harnesses migrate, remove newBuiltin() from resolve.go and the compiled provisioning methods

The compiled ClaudeCode harness is intentionally kept as a fallback for existing installations that haven't upgraded their harness-config.

Test plan

All 11 new parity/integration tests pass
All existing Claude tests still pass (no regressions)
All other harness tests pass (OpenCode, Codex, Gemini parity tests)
go vet ./pkg/harness/... clean
go build ./... succeeds

gemini-code-assist

Code Review

This pull request transitions the Claude Code harness provisioner to a container-script model, introducing a container-side Python script (provision.py) to handle configuration, MCP server translation, and authentication resolution. It also adds extensive parity and integration tests in Go. The review feedback highlights a critical issue in the Python script's auto-detection logic for Vertex AI, where requiring a local Application Default Credentials (ADC) file prevents successful authentication in GCP environments that use metadata-server-based service accounts.

gemini-code-assist · 2026-05-31T17:44:39Z

+        return "oauth-token", "CLAUDE_CODE_OAUTH_TOKEN"
+    if has_authfile:
+        return "auth-file", ""
+    if has_adc and has_gcp_project and has_gcp_region:


In GCP environments (such as GKE, Cloud Run, or Compute Engine), containers often authenticate using the VM or Pod's attached service account via the GCP metadata server (assign mode). In these cases, no local Application Default Credentials (ADC) file is mounted, meaning has_adc will be False.

Since has_adc is required in the current auto-detect block, auto-detection of vertex-ai will fail even if GOOGLE_CLOUD_PROJECT and GOOGLE_CLOUD_REGION are correctly set, raising an unexpected ValueError and blocking provisioning.

Removing the has_adc requirement from the auto-detect fallback allows the GCP SDK/Vertex AI client to seamlessly fall back to the metadata server as expected.

Suggested change

if has_adc and has_gcp_project and has_gcp_region:

if has_gcp_project and has_gcp_region:

ptone · 2026-06-27T17:04:03Z

/gemini review

gemini-code-assist

Code Review

This pull request migrates the Claude harness from the compiled-in builtin provisioner to the container-script provisioning model. This includes updating config.yaml to use container-script, introducing a new container-side provision.py script to handle auth resolution, workspace setup, and MCP server translation, and adding extensive parity tests in claude_parity_test.go. The feedback suggests improving the robustness of provision.py by ensuring only dictionary values are used as templates when updating project paths, and wrapping the inline MCP config file write in a try-except block to prevent non-fatal errors from crashing the script.

gemini-code-assist · 2026-06-27T17:05:18Z

+    for v in projects.values():
+        project_settings = v
+        break


If projects contains non-dictionary values, project_settings could be resolved to a non-dict type, which might cause issues when writing .claude.json. We should ensure that we only grab a dictionary value as the template.

Suggested change

for v in projects.values():

project_settings = v

break

for v in projects.values():

if isinstance(v, dict):

project_settings = v

break

gemini-code-assist · 2026-06-27T17:05:18Z

+                native[key] = value
+        mcp_block[name] = native
+    cfg["mcpServers"] = mcp_block
+    _write_json(claude_json_path, cfg)


In the inline fallback path for MCP server configuration, _write_json is called without a try-except block. If writing to .claude.json fails (e.g., due to permission issues or disk full), it will crash the entire provisioner script. Since MCP failures are intended to be non-fatal warnings, we should wrap this write in a try-except block to match the behavior of the scion_harness path.

Suggested change

_write_json(claude_json_path, cfg)

try:

_write_json(claude_json_path, cfg)

except OSError as exc:

print(f"claude provision: mcp merge failed: {exc}", file=sys.stderr)

return 0

Move the Claude harness from the compiled-in builtin provisioner to the extensible container-script model, matching what OpenCode and Codex already use. This is the first concrete step in retiring the builtin provisioner path (refs #100). The container-side provision.py handles: - Auth resolution with Claude's 4-way precedence (API key → OAuth token → auth-file → Vertex AI) - API key pre-approval fingerprint in .claude.json - Project workspace path setup in .claude.json - MCP server translation via scion_harness helper - Auth env var overlay output for the runtime The compiled ClaudeCode harness is kept intact as a fallback for existing installations that haven't upgraded their harness-config. Includes parity tests and Python integration tests that verify the script produces identical outputs to the compiled harness.

Address review feedback: remove the has_adc requirement from the Vertex AI auto-detect path in provision.py. In GCP environments (GKE, Cloud Run, Compute Engine), containers authenticate via the metadata server using attached service accounts — no local ADC file is mounted. The GCP SDK handles this fallback natively, so requiring project + region is sufficient for auto-detection. Add TestClaudeProvisionScript_Integration_VertexAI_NoADC to verify the fix works for GCP service account environments.

Add no-auth/drop-to-shell check before auth method selection so provision.py gracefully skips auth resolution when no credentials are staged and the harness declares no_auth.behavior. Matches the codex provision.py pattern. Also removes unused has_adc variable and documents the inline MCP fallback's global-only scope as intentional.

gemini-code-assist Bot reviewed May 31, 2026

View reviewed changes

ptone mentioned this pull request May 31, 2026

Migrate Claude harness from builtin to container-script provisioning ptone/scion#109

Closed

5 tasks

ptone force-pushed the scion/cleanup-container-script-provisioning branch from b31f758 to b1c13ac Compare June 27, 2026 14:12

gemini-code-assist Bot reviewed Jun 27, 2026

View reviewed changes

ptone force-pushed the scion/cleanup-container-script-provisioning branch from a60ee42 to ea522d8 Compare June 29, 2026 07:23

ptone and others added 4 commits June 29, 2026 16:00

Add project log entry for Claude container-script migration

d25ef5e

ptone force-pushed the scion/cleanup-container-script-provisioning branch from ea522d8 to 67f4037 Compare June 29, 2026 16:00

ptone merged commit 666333f into GoogleCloudPlatform:main Jun 30, 2026
8 of 9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Migrate Claude harness from builtin to container-script provisioning#279

Migrate Claude harness from builtin to container-script provisioning#279
ptone merged 4 commits into
GoogleCloudPlatform:mainfrom
ptone:scion/cleanup-container-script-provisioning

ptone commented May 31, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 31, 2026

Uh oh!

ptone commented Jun 27, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 27, 2026

Uh oh!

gemini-code-assist Bot Jun 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	if has_adc and has_gcp_project and has_gcp_region:
	if has_gcp_project and has_gcp_region:

-    _write_json(claude_json_path, cfg)
+    try:
+        _write_json(claude_json_path, cfg)
+    except OSError as exc:
+        print(f"claude provision: mcp merge failed: {exc}", file=sys.stderr)
+        return 0

Uh oh!

Conversation

ptone commented May 31, 2026

Summary

What changed

What remains (tracked in #100)

Test plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

ptone commented Jun 27, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant