Use Native Credential Proxy

This skill adds a native, .env-based credential path for the container agent — an explicit opt-out of the OneCLI gateway. With it enabled, NanoClaw reads the Anthropic credential straight from .env and threads it into the container as standard environment variables, which the Claude Agent SDK reads natively. No OneCLI vault, no HTTPS proxy, no certificates.

Credential-home inversion — read this first. NanoClaw's default is that credentials live in the OneCLI agent vault and are injected per request, never threaded into the container via -e. This skill deliberately inverts that: the credential lives in .env on the host and is passed into the container's environment. That inversion is the entire point of this skill (simple .env credentials without OneCLI). Use it only if you accept that tradeoff; everywhere else in NanoClaw, env-threaded credentials are an anti-pattern.

The skill is additive: it ships its proxy logic and tests in this folder, copies them into src/, and makes a single one-line reach-in at the container-spawn seam (gated by an env flag). It does not remove or rewrite the OneCLI gateway — when the flag is unset, the gateway path is exactly as it was, and the native proxy is a no-op.

How it works

• src/native-credential-proxy.ts exports nativeCredentialEnvArgs(). It reads ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN / CLAUDE_CODE_OAUTH_TOKEN (and optional ANTHROPIC_BASE_URL) from .env via core's readEnvFile, and returns the Docker -e VAR=value arguments.
• All gating lives inside that function: it returns an empty array unless NANOCLAW_NATIVE_CREDENTIALS=true. So the reach-in in core is a single unconditional args.push(...nativeCredentialEnvArgs()).
• The seam is buildContainerArgs in src/container-runner.ts, right after the TZ env line — the same place container env vars are assembled, just before the OneCLI gateway is applied. With the flag on, the direct credential env vars take precedence in the container; with it off, nothing changes.

Phase 1: Pre-flight

Check if already applied