What problem does it solve? NanoClaw routes all Anthropic API credentials through the OneCLI agent vault with an HTTPS proxy and certificates. Users who prefer simple .env-based credential management need a way to opt out of that gateway and supply their API key or OAuth token directly to the container. ## Core Features & Use Cases - Native .env Credential Injection: Reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, or CLAUDE_CODE_OAUTH_TOKEN from .env and threads them into the container as Docker -e environment variables that the Claude Agent SDK reads natively. - Flag-Gated Opt-Out: All logic is gated behind NANOCLAW_NATIVE_CREDENTIALS=true; when unset, the OneCLI gateway path is completely untouched. - Tested Integration: Ships a behavior test driving the real .env read and a wiring test asserting the one-line reach-in exists in buildContainerArgs. - Use Case: A user with a Claude Pro/Max subscription runs claude setup-token, stores the token in .env, and the container agent authenticates directly against the Anthropic API without configuring the OneCLI vault. ## Quick Start Ask the AI to apply the use-native-credential-proxy skill so NanoClaw reads your Anthropic credential from .env instead of the OneCLI gateway, then restart the service.