docs(cloud-agents): add multi-harness pages (Warp Agent, Claude Code, Codex)

src/content/docs/agent-platform/cli-agents/claude-code.mdx

@@ -13,6 +13,10 @@ Warp auto-detects Claude Code when you run it, giving you access to rich input c
 
 For installation, authentication, project configuration, and productivity tips, see the [How to set up Claude Code](/guides/external-tools/how-to-set-up-claude-code/) guide.
 
+:::note
+Claude Code is also available as a harness in Oz for cloud orchestration. See [Claude Code with Oz](/agent-platform/cloud-agents/harnesses/claude-code/).
+:::
+
 ## Setting up notifications
 
 Warp supports agent notifications for Claude Code through a plugin. Once installed, Warp surfaces in-app and desktop alerts when Claude Code needs your input — such as command approval, code review, or error intervention.
@@ -67,6 +71,7 @@ Claude Code supports the full set of Warp's agent integration features:
 
 ## Related pages
 
+* [Claude Code with Oz](/agent-platform/cloud-agents/harnesses/claude-code/) — Claude Code as a cloud harness in Oz
 * [How to set up Claude Code](/guides/external-tools/how-to-set-up-claude-code/) — step-by-step setup guide
 * [Claude Code in Warp](https://warp.dev/agents/claude-code) — product overview
 * [Third-Party CLI Agents Overview](/agent-platform/cli-agents/overview/)

src/content/docs/agent-platform/cli-agents/codex.mdx

@@ -13,6 +13,10 @@ Warp auto-detects Codex when you run it, giving you access to rich input control
 
 For installation, authentication, project configuration, and productivity tips, see the [How to set up Codex CLI](/guides/external-tools/how-to-set-up-codex-cli/) guide.
 
+:::note
+Codex is also available as a harness in Oz for cloud orchestration. See [Codex with Oz](/agent-platform/cloud-agents/harnesses/codex/).
+:::
+
 ## Setting up notifications
 
 Codex supports native notifications that Warp surfaces as in-app and desktop alerts — such as when Codex completes a task, encounters an error, or needs your input.
@@ -42,6 +46,7 @@ Codex supports the full set of Warp's agent integration features:
 
 ## Related pages
 
+* [Codex with Oz](/agent-platform/cloud-agents/harnesses/codex/) — Codex as a cloud harness in Oz
 * [How to set up Codex CLI](/guides/external-tools/how-to-set-up-codex-cli/) — step-by-step setup guide
 * [Codex in Warp](https://warp.dev/agents/codex) — product overview
 * [Third-Party CLI Agents Overview](/agent-platform/cli-agents/overview/)

src/content/docs/agent-platform/cli-agents/overview.mdx

@@ -11,6 +11,10 @@ Warp auto-detects supported CLI agents and enhances them with IDE-level features
 
 This feature set is also known as **universal agent support**.
 
+:::note
+Claude Code and Codex are also supported as harnesses in Oz for cloud orchestration. See [Harnesses in Oz](/agent-platform/cloud-agents/harnesses/).
+:::
+
 ## Supported agents
 
 Warp currently supports the following CLI coding agents:

src/content/docs/agent-platform/cloud-agents/harnesses/authentication.mdx

@@ -0,0 +1,138 @@
+---
+title: Connecting Claude and Codex credentials
+description: >-
+  Store Anthropic or OpenAI credentials as Warp-managed secrets so Oz can
+  authenticate Claude Code and Codex cloud runs against the provider.
+sidebar:
+  label: "Authentication"
+---
+
+This page walks through the one-time setup that connects your team's Anthropic or OpenAI credentials to Oz so cloud runs of [Claude Code](/agent-platform/cloud-agents/harnesses/claude-code/) and [Codex](/agent-platform/cloud-agents/harnesses/codex/) can authenticate.
+
+Oz stores credentials as **Warp-managed secrets** (see [Cloud agent secrets](/agent-platform/cloud-agents/secrets/) for the full secrets model) and uses the one you pick on a run to authenticate the harness with the provider. Secret values are write-once: you can rotate or delete them, but you can't read the value back after creation.
+
+:::note
+[Bring Your Own Key (BYOK)](/support-and-community/plans-and-billing/bring-your-own-api-key/) configured in the Warp desktop app applies to local agent runs only. Cloud runs of Claude Code and Codex always use Warp-managed secrets.
+:::
+
+## Prerequisites
+
+* **A Warp team** - Harness auth secrets are typically scoped to a team so everyone on the team can launch authenticated runs. Personal secrets work for individual users. See [Teams](/knowledge-and-collaboration/teams/) for setting up a team.
+* **An Anthropic credential** - For Claude Code: an Anthropic API key from the [Anthropic Console](https://console.anthropic.com/), or Bedrock credentials (API key, or AWS access key) for Bedrock-routed inference.
+* **An OpenAI API key** - For Codex: an API key from the [OpenAI dashboard](https://platform.openai.com/api-keys).
+* **The Oz CLI installed** - Required for CLI-based secret creation. See [Oz CLI](/reference/cli/) for installation.
+
+## Connecting Claude Code credentials
+
+Claude Code supports three Anthropic credential types: a direct API key, a Bedrock API key, or Bedrock AWS access keys. Pick the one that matches how your team consumes Anthropic models.
+
+### Create the secret in the Oz web app
+
+Use the Oz web app when you want a guided form that handles every Anthropic credential variant.
+
+1. **Open managed secrets in the Oz web app.** Sign in to the Oz web app at [oz.warp.dev](https://oz.warp.dev) and navigate to managed secrets in the sidebar. You'll see all secrets your team has stored.
+2. **Create a new secret.** Click **New secret**, then choose the credential type that matches your provider — **Anthropic API key**, **Anthropic Bedrock API key**, or **Anthropic Bedrock access key**.
+3. **Fill in the value fields.** Enter a name (for example, `ANTHROPIC_API_KEY`), an optional description, and the credential value(s) the form asks for. For Bedrock variants, include the AWS region.
+4. **Choose the scope.** Select **Team** so the secret is available to all teammates' Claude Code runs. Use **Personal** if the credential is tied to an individual account.
+5. **Save the secret.** Click **Save**. Warp stores the value encrypted and shows the secret in the list with its name, scope, and last-updated timestamp.
+
+**Expected outcome.** The new secret appears in the Oz web app's managed secrets list. It will be selectable on the new run and new schedule panes when **Claude Code** is the chosen harness.
+
+### Create the secret with the Oz CLI
+
+Use the Oz CLI when you're already in the terminal or want to script setup.
+
+The Oz CLI ships dedicated subcommands for each Anthropic credential type. Each subcommand reads the secret value securely from standard input or `--value-file`.
+
+```bash
+# Direct Anthropic API key (team scope)
+oz secret create anthropic api-key --team ANTHROPIC_API_KEY
+
+# Bedrock API key (team scope) — prompts for the bearer token and AWS region
+oz secret create anthropic bedrock-api-key --team ANTHROPIC_BEDROCK_KEY
+
+# Bedrock access keys (team scope) — prompts for access key id, secret access key,
+# optional session token, and region
+oz secret create anthropic bedrock-access-key --team ANTHROPIC_BEDROCK_ACCESS
+```
+
+Add `--description "..."` to record rotation notes or owner info. Replace `--team` with `--personal` to make the secret available only to your own runs.
+
+**Expected outcome.** `oz secret list` shows the new secret with the matching Anthropic credential type. The value is never displayed.
+
+### Use the secret on a Claude Code run
+
+Once the secret is stored, point a Claude Code run at it:
+
+* **Warp app** - In Cloud Mode, choose **Claude Code** in the harness dropdown. Warp prompts for a Claude Code auth secret if your team has more than one available.
+* **Oz web app** - On the new run or new schedule pane, choose **Claude Code** in the **Harness** field. A **Claude Code auth secret** dropdown appears below it; choose the secret you just created.
+* **Oz CLI** - Pass `--claude-auth-secret NAME` to `oz agent run-cloud --harness claude`.
+* **API and SDK** - Set the Claude Code auth-secret field on the agent config to the secret's name. See the [API reference](/reference/api-and-sdk/) for the exact field name.
+
+## Connecting Codex credentials
+
+Codex needs an OpenAI API key. Storing the key follows the same pattern as Claude Code, but uses a different secret type.
+
+### Create the secret in the Oz web app
+
+1. **Open managed secrets in the Oz web app** at [oz.warp.dev](https://oz.warp.dev).
+2. **Create a new secret.** Click **New secret**, then choose **OpenAI API key**.
+3. **Fill in the value fields.** Enter a name (for example, `OPENAI_API_KEY`), an optional description, and the API key value. If your team uses a regional or proxy endpoint, set the optional base URL field.
+4. **Choose the scope.** Select **Team** so all teammates' Codex runs can pick it up. Use **Personal** for individual-only use.
+5. **Save the secret.** Warp stores the value encrypted; the new secret appears in the list.
+
+**Expected outcome.** The new OpenAI API key secret appears in the managed secrets list. It will be selectable on the new run and new schedule panes when **Codex** is the chosen harness.
+
+:::note
+Codex secret creation from the Oz CLI is a fast-follow. For now, use the Oz web app to store OpenAI credentials.
+:::
+
+### Use the secret on a Codex run
+
+Once the secret is stored, point a Codex run at it:
+
+* **Warp app** - In Cloud Mode, choose **Codex** in the harness dropdown. Warp prompts for a Codex auth secret if your team has more than one available.
+* **Oz web app** - On the new run or new schedule pane, choose **Codex** in the **Harness** field. A **Codex auth secret** dropdown appears below it; choose the secret you just created.
+* **Oz CLI** - Pass `--harness codex` to `oz agent run-cloud` along with the matching auth-secret flag for your OpenAI secret.
+* **API and SDK** - Set the Codex auth-secret field on the agent config to the secret's name. See the [API reference](/reference/api-and-sdk/) for the exact field name.
+
+## Managing harness auth secrets
+
+Auth secrets follow the same management commands as any other Warp-managed secret. See [Cloud agent secrets](/agent-platform/cloud-agents/secrets/) for the full reference. Common tasks:
+
+```bash
+# List secrets you can see
+oz secret list
+
+# Rotate a secret value (prompts for the new value)
+oz secret update --team --value ANTHROPIC_API_KEY
+
+# Update the description
+oz secret update --team --description "Rotated 2026-05-12; owned by platform team" ANTHROPIC_API_KEY
+
+# Delete a secret (irreversible)
+oz secret delete --team ANTHROPIC_API_KEY
+```
+
+:::caution
+Deleting an auth secret breaks any scheduled or integration-triggered run that references it by name. Update the schedules and integrations to point at a new secret first.
+:::
+
+## Troubleshooting
+
+**Claude Code or Codex run fails with an authentication error.**\
+Confirm the run was started with a harness auth secret selected. From the Oz web app's run detail pane, the **Harness auth secret** field shows which secret (if any) was used. Re-launch the run with the correct secret selected, or create one if your team doesn't have one yet.
+
+**The harness auth secret dropdown is empty.**\
+The dropdown only lists secrets whose type matches the selected harness — Anthropic types for Claude Code, OpenAI for Codex. If you stored the credential as a raw value, recreate it using the typed flow above.
+
+**The selected harness is disabled.**\
+Your team admin has disabled the harness for your workspace. Contact your admin or pick a different harness for the run.
+
+## Related pages
+
+* [Claude Code with Oz](/agent-platform/cloud-agents/harnesses/claude-code/) — Claude Code as a cloud harness.
+* [Codex with Oz](/agent-platform/cloud-agents/harnesses/codex/) — Codex as a cloud harness.
+* [Cloud agent secrets](/agent-platform/cloud-agents/secrets/) — full secrets reference, including scoping, rotation, and deletion.
+* [Harnesses in Oz](/agent-platform/cloud-agents/harnesses/) — pick between Warp Agent, Claude Code, and Codex.
+* [Bring Your Own Key (BYOK)](/support-and-community/plans-and-billing/bring-your-own-api-key/) — local-only credentials for the Warp desktop app.

src/content/docs/agent-platform/cloud-agents/harnesses/claude-code.mdx

@@ -0,0 +1,91 @@
+---
+title: Claude Code with Oz
+description: >-
+  Run Claude Code with Oz. Strong at code review, deep bug investigation, large
+  feature planning, and frontend or UI work.
+sidebar:
+  label: "Claude Code"
+---
+
+Claude Code is Anthropic's agentic coding tool. Running it with Oz puts Claude Code inside a Warp-managed environment and connects it to the rest of the Oz platform — triggers, environments, secrets, observability, and governance — while still behaving like the Claude Code your team already uses.
+
+:::note
+This page covers Claude Code as a **cloud** harness, dispatched and orchestrated by Oz. To run Claude Code locally in your Warp terminal — with the rich input editor, code review, agent notifications, and other in-terminal features — see [Claude Code in Warp](/agent-platform/cli-agents/claude-code/) instead.
+:::
+
+## Key features
+
+* **Cloud orchestration** - Launch Claude Code from any Oz trigger: the Warp app, the Oz web app, the Oz CLI, the REST API, schedules, Slack mentions, Linear issues, or GitHub Actions.
+* **Claude model picker** - Choose the Claude model the harness uses, including the latest pinned Opus, Sonnet, and Haiku releases, the `best`/`opus`/`sonnet`/`haiku` aliases, and 1M-context variants.
+* **Shared platform context** - Reads the same [environments](/agent-platform/cloud-agents/environments/), [agent secrets](/agent-platform/cloud-agents/secrets/), [MCP servers](/agent-platform/cloud-agents/mcp/), and [Skills](/agent-platform/capabilities/skills/) used by every other harness.
+* **First-class subagent** - A Warp Agent parent can dispatch Claude Code subagents to handle code-review-heavy or judgment-heavy steps within a larger orchestration.
+
+## How it works
+
+When a trigger fires for a Claude Code run, Oz hands the prompt and your stored Anthropic credentials to Claude Code inside the run's [environment](/agent-platform/cloud-agents/environments/). Claude Code drives the task end-to-end — plans, reads code, edits files, runs commands, and (by Oz convention) opens a draft PR with the result.
+
+Oz captures the transcript and exposes it through the [Oz dashboard](/agent-platform/cloud-agents/managing-cloud-agents/), the Warp app's conversations panel, and the [Oz API](/reference/api-and-sdk/), so the run is reviewable after the fact and shareable with teammates.
+
+### Available models
+
+The Claude Code harness exposes Anthropic's coding-tuned model lineup. Common picks:
+
+* `best` - Resolves to the current top-of-line Claude model.
+* `opus`, `sonnet`, `haiku` - Aliases that resolve to the current default for that family.
+* `claude-opus-4-7`, `claude-sonnet-4-6`, `claude-haiku-4-5` - Latest pinned full model names.
+
+For the full list — including 1M-context variants for very large codebases and planning-tuned models — open the model picker in the Warp app's Cloud Mode or the **Model** field on the Oz web app's new-run pane.
+
+### Credentials and billing
+
+Claude Code calls Anthropic directly using credentials your team provides. Oz supports three Anthropic credential types, stored as Warp-managed secrets:
+
+* **Anthropic API key** - For direct Anthropic API access.
+* **Anthropic Bedrock API key** - For Bedrock-routed inference using an API key.
+* **Anthropic Bedrock access key** - For Bedrock-routed inference using AWS access credentials.
+
+Anthropic bills your account directly for the inference your runs make. Warp credits cover the rest of the platform — environment compute, triggers, observability — but not the third-party inference calls.
+
+For setup steps, see [Connecting Claude and Codex credentials](/agent-platform/cloud-agents/harnesses/authentication/).
+
+:::note
+[Bring Your Own Key (BYOK)](/support-and-community/plans-and-billing/bring-your-own-api-key/) configured in the Warp desktop app applies to local agent runs only. Cloud Claude Code runs always use credentials stored as Warp-managed secrets.
+:::
+
+## Choosing Claude Code
+
+Pick Claude Code as the harness when:
+
+* The task is **code-review heavy** — reading a large diff, leaving inline comments, suggesting refactors.
+* The task is **investigation heavy** — finding a root cause, tracing a bug, reasoning about unfamiliar code paths.
+* The task is **large feature planning** — breaking a vague product ask into a buildable plan with tradeoffs called out.
+* The task involves **frontend or UI work** — component design, accessibility checks, visual polish where Claude tends to produce clean code.
+
+For tasks that need cross-harness orchestration, model auto-routing, or multi-repo work as a parent run, use the [Warp Agent harness](/agent-platform/cloud-agents/harnesses/warp-agent/) instead — Warp Agent can still dispatch Claude Code subagents for individual steps.
+
+## Starting a Claude Code run
+
+Before launching, make sure your team has stored an Anthropic credential as a Warp-managed secret. See [Connecting Claude and Codex credentials](/agent-platform/cloud-agents/harnesses/authentication/).
+
+* **Warp app** - In Cloud Mode, click the harness dropdown above the input and choose **Claude Code**.
+* **Oz web app** - On the new run or new schedule pane, choose **Claude Code** in the **Harness** field. When you do, a **Claude Code auth secret** field appears below it; pick one of your team's stored Anthropic secrets.
+* **Oz CLI** - Pass `--harness claude` to `oz agent run-cloud`. Use `--claude-auth-secret NAME` to point at a specific managed secret.
+
+```bash
+oz agent run-cloud \
+  --harness claude \
+  --claude-auth-secret ANTHROPIC_API_KEY \
+  --environment ENV_ID \
+  --prompt "review PR #482 and leave inline comments"
+```
+
+* **API and SDK** - Set the agent config `harness` to `claude` and the Anthropic secret name on the matching auth-secret field. See the [API reference](/reference/api-and-sdk/) for the exact field name.
+
+## Related pages
+
+* [Harnesses in Oz](/agent-platform/cloud-agents/harnesses/) — pick between Warp Agent, Claude Code, and Codex.
+* [Connecting Claude and Codex credentials](/agent-platform/cloud-agents/harnesses/authentication/) — store Anthropic credentials as Warp-managed secrets.
+* [Warp Agent with Oz](/agent-platform/cloud-agents/harnesses/warp-agent/) — Oz's default harness, the only one that can orchestrate Claude Code subagents.
+* [Codex with Oz](/agent-platform/cloud-agents/harnesses/codex/) — Codex as a cloud harness.
+* [Claude Code in Warp](/agent-platform/cli-agents/claude-code/) — Claude Code in your local Warp terminal.
+* [Cloud agent secrets](/agent-platform/cloud-agents/secrets/) — the full Warp-managed secrets reference.