Omar SobhandClaude Opus 5
742724e53c
The base URL took three measurements to find, and the first two were wrong in instructive ways. `api.moonshot.ai/anthropic/v1/messages` EXISTS and speaks the protocol — it answers with Moonshot's own structured error rather than a 404. It also rejects an `sk-kimi-` key, because it belongs to the platform.moonshot.ai account namespace. Two endpoints that both "work" for different accounts is precisely the shape that makes a guessed URL look like a broken key, and it is why this was refused rather than guessed for as long as it was. The Kimi CODE service is the one an `sk-kimi-` key belongs to: `POST https://api.kimi.com/coding/v1/messages` returns a real Anthropic Messages body — `msg_` id, `content` blocks, a `thinking` block with a signature. So `ANTHROPIC_BASE_URL=https://api.kimi.com/coding`, WITHOUT the `/v1`: Claude Code appends `/v1/messages` itself, and `/v1/v1/messages` would 404 in a way that reads as a broken image rather than a bad URL. Two more measured, each otherwise a silent failure at the first turn: `Authorization: Bearer` is accepted (so ANTHROPIC_AUTH_TOKEN is the right injection channel), and a `claude-*` model id is ACCEPTED AND ANSWERED — Kimi maps it onto `kimi-for-coding` exactly as z.ai does, so no ANTHROPIC_MODEL override is needed. Claude Code rather than Moonshot's own `kimi` CLI, deliberately. The mission harness is Claude-Code-shaped throughout: `--agents` JSON roles, the verifier's tool allowlist, the `Stop` hook behind the completion gate, the per-subagent transcripts counted as delegation evidence. `kimi` has none of those flags — its equivalents are TOML files and markdown agent dirs — so using it would mean a second executor with its own untested failure modes. TWO STALE MAPS, caught by the rootfs harness refusing to bless the image: both `fc-build-rootfs.sh` and the node's `required_cli` expected backend `kimi` to contain Moonshot's `kimi` binary. That assumption predates the measurement, and it failed a rootfs that was correct. Both now say `claude` for glm and kimi alike — the binary is the same in all three images; only the endpoint differs. Egress for `kimi` is `api.kimi.com` alone: not moonshot.ai (wrong namespace), not z.ai, not Anthropic. Asserted both ways, like the other two. The image and rootfs are built on tank and the rootfs passes all four checks (boots, git, writable /mission, `claude --version`). 534 tests, clippy clean. Co-Authored-By: Claude Opus 5 <[email protected]>
54 lines
2.8 KiB
Docker
54 lines
2.8 KiB
Docker
# Plan A6, third of three: Claude Code pointed at Kimi.
|
|
#
|
|
# Same shape as `agent-glm` — same CLI, same pinned version, a different
|
|
# endpoint — for the same reason: an independent verifier is only independent if
|
|
# it runs somewhere else, and a third provider costs an env contract rather than
|
|
# a third agent harness.
|
|
#
|
|
# WHY CLAUDE CODE AND NOT `kimi`. Moonshot ship their own CLI
|
|
# (`@moonshot-ai/kimi-code`), and it would be the more native choice — but the
|
|
# whole mission harness is Claude-Code-shaped: `--agents` JSON roles, the
|
|
# `verifier` tool allowlist, the `Stop` hook that backs the completion gate, and
|
|
# the per-subagent transcripts we count as delegation evidence. `kimi` has none
|
|
# of those flags; its equivalents are TOML files and markdown agent dirs. Running
|
|
# it would mean a second executor with its own untested failure modes, so this
|
|
# image uses the Anthropic-compatible mode instead and the harness is unchanged.
|
|
#
|
|
# THE URL IS MEASURED, and the first answer was the wrong one. `api.moonshot.ai/
|
|
# anthropic/v1/messages` exists and speaks the protocol, but it belongs to the
|
|
# platform.moonshot.ai account namespace and rejects an `sk-kimi-` key. The Kimi
|
|
# CODE service is a different host: `POST https://api.kimi.com/coding/v1/messages`
|
|
# returns a real Anthropic Messages body — `msg_` id, `content` blocks, a
|
|
# `thinking` block with a signature.
|
|
#
|
|
# So the base URL is `https://api.kimi.com/coding` and NOT `.../coding/v1`:
|
|
# Claude Code appends `/v1/messages` itself, and the doubled `/v1/v1/messages`
|
|
# is a 404 that would look like a broken image rather than a bad URL.
|
|
#
|
|
# Two more things measured rather than assumed, because each would otherwise be
|
|
# a silent failure at the first turn:
|
|
# - `Authorization: Bearer` is accepted (so ANTHROPIC_AUTH_TOKEN is the right
|
|
# injection channel; `x-api-key` works too, but that is the API-key path a
|
|
# microVM deliberately does not use).
|
|
# - a `claude-*` model id is ACCEPTED and answered, so Kimi maps it onto its
|
|
# own model exactly as z.ai does. No ANTHROPIC_MODEL override is needed.
|
|
FROM clawmates/agent-toolchain:dev
|
|
|
|
ARG CLAUDE_CODE_VERSION=2.1.223
|
|
RUN npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /root/.npm \
|
|
&& claude --version
|
|
|
|
# The endpoint is baked in; the credential is injected per turn by
|
|
# `mission_runtime::microvm_provider_env` from the server's `KIMI_API_KEY`. A VM
|
|
# built from this image therefore cannot be handed an Anthropic subscription
|
|
# token or a z.ai key — the wrong credential has nowhere to go.
|
|
ENV HOME=/root \
|
|
CLAWMATES_AGENT_CLI=claude \
|
|
ANTHROPIC_BASE_URL=https://api.kimi.com/coding
|
|
RUN mkdir -p /root/.claude
|
|
|
|
# No ANTHROPIC_MODEL: measured above, the service maps the `claude-*` id Claude
|
|
# Code sends onto its own model (`kimi-for-coding`, K2.7 Coding, 262k context).
|