kohen: claude-key — Claude Code on the API key when the login is what failed

2026-10-15 21:08Z: the daemon's proactive OAuth refresh failed (no
incident at Anthropic; most likely a cross-process race on the
single-use refresh token), the credential was dropped, and every
session on the VM showed "Login expired · Please run /login" until a
browser login took at 23:50Z — two "Login interrupted" first. The gate
was off; the fallback of 4acd56c4 could not help, because it is the
same OAuth credential.

scripts/claude-key starts Claude Code on the Anthropic API key from
~/.config/shorashim/upstream_keys (read at launch, never written),
direct to Anthropic whatever settings.json says. Proven:
`claude-key auth status` → authMethod api_key, apiKeySource
ANTHROPIC_API_KEY; a -p run from a directory with a dead gate armed in
project settings answered. KOHEN.md: the login recovery (claude-key,
`claude auth login` from the shell, `auth status --text`).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/claude-key

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Start Claude Code on the Anthropic API KEY instead of the subscription's
+# OAuth token — the second leg of the fallback (KOHEN "Claude Code behind
+# the gate — fallback"). For when /login fails or the OAuth refresh died
+# (2026-10-15 21:08Z: the daemon's proactive refresh failed, every session
+# on the VM showed "Login expired", and the browser flow took three tries
+# from a remote shell).
+#
+# Billing: the API console account (pay per token), not the Max plan.
+# The key is read from the upstream keys file at launch and never written
+# anywhere. Direct to Anthropic, whatever settings.json says.
+KEY=$(awk '$1=="anthropic"{print $2}' "$HOME/.config/shorashim/upstream_keys")
+[ -n "$KEY" ] || { echo "no 'anthropic <key>' line in ~/.config/shorashim/upstream_keys" >&2; exit 1; }
+export ANTHROPIC_API_KEY="$KEY"
+unset ANTHROPIC_BASE_URL ANTHROPIC_CUSTOM_HEADERS
+exec claude --settings '{"env":{"ANTHROPIC_BASE_URL":"https://api.anthropic.com","ANTHROPIC_CUSTOM_HEADERS":""}}' "$@"