flue-subs

Reference projects for running Flue against subscription credentials we already pay for, instead of metered provider API keys.

Flue is the Agent Harness Framework built on Pi. Out of the box, its hosted providers expect API-key auth such as ANTHROPIC_API_KEY or OPENAI_API_KEY. Claude Max and ChatGPT Pro/Codex subscriptions are different: they are browser-login OAuth credentials, not API keys.

This repo shows three working patterns:

flue-subs/
  README.md
  docs/             # research notes behind these patterns
  flue-claude-max/  # Flue -> meridian local proxy -> Claude Max
  flue-cliproxy/    # Flue -> CLIProxyAPI gateway -> ChatGPT Codex (+ Zen, effort forks)
  flue-codex-pro/   # Flue -> Pi OAuth credential -> OpenAI Codex

All three projects include:

• a minimal hello-world smoke agent,
• a generic support-triage agent and triage-support-ticket workflow,
• repeatable npm install, npm run typecheck, npm run build, and npm run smoke commands,
• local-only credential handling, with no subscription tokens checked into the repo.

Pick A Project

Project	Use when	Model prefix	Auth source
flue-claude-max/	You want Claude models through a Claude Max subscription	anthropic/...	meridian profile in ~/.config/meridian/profiles.json
flue-codex-pro/	You want GPT/Codex models through ChatGPT Pro/Codex	openai-codex/...	Pi credential in ~/.pi/agent/auth.json
flue-cliproxy/	You want one local gateway serving Codex plus open-weights models, with proxy-forced max effort	cliproxy/...	CLIProxyAPI client key in /usr/local/etc/cliproxyapi.conf

Claude Max Path

flue-claude-max uses meridian. meridian runs a local Anthropic-compatible server on http://127.0.0.1:3456, backed by your Claude Max browser login.

Flue must be pointed at that local server in code:

registerProvider('anthropic', {
  baseUrl: process.env.ANTHROPIC_BASE_URL ?? 'http://127.0.0.1:3456',
  apiKey: process.env.ANTHROPIC_API_KEY ?? 'x',
});

The key is a placeholder. meridian authenticates with its OAuth profile, not with the value passed by Flue.

Basic run:

cd flue-claude-max
npm install
meridian profile add max   # interactive, once
meridian                   # keep this running
npm run smoke

Expected model path: anthropic/claude-opus-4-8.

Codex Path

flue-codex-pro uses Pi's openai-codex credential. Pi stores the OAuth credential in ~/.pi/agent/auth.json; the Flue app reads it, refreshes it when needed, and registers the provider before each request.

registerProvider('openai-codex', {
  apiKey: await resolveCodexAccessToken(),
});

Basic run:

cd flue-codex-pro
npm install
pi                         # then run /login, interactive, once
npm run smoke

Expected model path: openai-codex/gpt-5.5.

CLIProxyAPI Path

flue-cliproxy uses CLIProxyAPI, a local gateway on http://127.0.0.1:8317 that fronts a ChatGPT Pro/Codex OAuth login behind OpenAI-compatible endpoints — plus whatever else its config serves (-xhigh/ -max effort-fork aliases, OpenCode Zen open-weights models).

cliproxy is not a Flue catalog provider, so the registration supplies the wire protocol and endpoint; the key is the gateway's own client key, not a vendor key:

registerProvider('cliproxy', {
  api: 'openai-completions',
  baseUrl: process.env.CLIPROXY_BASE_URL ?? 'http://127.0.0.1:8317/v1',
  apiKey: process.env.CLIPROXY_API_KEY,
});

Every model on the gateway's /v1/models becomes cliproxy/<id>. The -max forks are the only route to reasoning.effort: max — Flue's own thinking levels top out at xhigh.

Basic run:

cd flue-cliproxy
npm install
brew services start cliproxyapi   # keep this running
CLIProxyAPI -codex-login          # interactive, once
cp .env.example .env              # then paste the gateway client key (one-liner inside)
npm run smoke

Expected model path: cliproxy/gpt-5.5. Full findings: docs/research-cliproxyapi.md.

Support Workflow

All three projects include the same neutral workflow:

npx flue run triage-support-ticket --target node --input '{}'

That workflow is intentionally generic. It proves that a normal Flue workflow can run through the subscription-backed provider without including any company-specific data.

Validation

Run these in each subproject:

npm install
npm run typecheck
npm run build
npm run smoke

For Claude, meridian must be running before npm run smoke. For CLIProxyAPI, the cliproxyapi brew service must be running.

Security Notes

• Do not commit ~/.pi/agent/auth.json.
• Do not commit ~/.config/meridian/profiles.json.
• Do not commit .env files (flue-cliproxy/.env holds the CLIProxyAPI client key).
• Treat ~/.cli-proxy-api/ (CLIProxyAPI's stored OAuth tokens) as credentials.
• These examples are for local reference. Add your own HTTP auth before exposing a Flue server beyond localhost.

See the subproject READMEs for setup details and troubleshooting.