fix(cli): drain claude stdin and stop env from shadowing the API key

Round-4 Greptile review:
- await proc.stdin.drain() before close() in all three claude-code subprocess
  helpers (matches the codex helpers; flushes large prompts before EOF).
- Stop the manifest env block from setting ANTHROPIC_API_KEY to an empty string,
  which would shadow the credential mapping / .env value at runtime. The key now
  comes solely from the credential mapping (deploy) or .env (local).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: declan-scale

src/agentex/lib/cli/templates/default-claude-code/manifest.yaml.j2

@@ -89,9 +89,11 @@ agent:
       secret_key: url
 
   # Optional: Set Environment variables for running your agent locally as well
-  # as for deployment later on
-  env:
-    ANTHROPIC_API_KEY: ""  # Required by the Claude Code CLI
+  # as for deployment later on. ANTHROPIC_API_KEY is supplied via the credential
+  # mapping above (deploy) or your local .env (load_dotenv). Do NOT set it to an
+  # empty string here — that would shadow the real key at runtime.
+  env: {}
+  #   ANTHROPIC_API_KEY: "<your-key>"  # uncomment only to hardcode for local runs
 
 # Deployment Configuration
 # -----------------------

src/agentex/lib/cli/templates/default-claude-code/project/acp.py.j2

@@ -66,6 +66,7 @@ async def _spawn_claude(prompt: str) -> AsyncIterator[str]:
     assert proc.stdin is not None
 
     proc.stdin.write(prompt.encode())
+    await proc.stdin.drain()
     proc.stdin.close()
 
     # Drain stderr concurrently. With --verbose, Claude Code can write enough to

src/agentex/lib/cli/templates/sync-claude-code/manifest.yaml.j2

@@ -85,9 +85,11 @@ agent:
       secret_key: api-key
 
   # Optional: Set Environment variables for running your agent locally as well
-  # as for deployment later on
-  env:
-    ANTHROPIC_API_KEY: ""  # Required by the Claude Code CLI
+  # as for deployment later on. ANTHROPIC_API_KEY is supplied via the credential
+  # mapping above (deploy) or your local .env (load_dotenv). Do NOT set it to an
+  # empty string here — that would shadow the real key at runtime.
+  env: {}
+  #   ANTHROPIC_API_KEY: "<your-key>"  # uncomment only to hardcode for local runs
 
 
 # Deployment Configuration

src/agentex/lib/cli/templates/sync-claude-code/project/acp.py.j2

@@ -65,6 +65,7 @@ async def _spawn_claude(prompt: str) -> AsyncIterator[str]:
     assert proc.stdin is not None
 
     proc.stdin.write(prompt.encode())
+    await proc.stdin.drain()
     proc.stdin.close()
 
     # Drain stderr concurrently. With --verbose, Claude Code can write enough to

src/agentex/lib/cli/templates/temporal-claude-code/manifest.yaml.j2

@@ -107,11 +107,11 @@ agent:
       secret_key: api-key
 
   # Optional: Set Environment variables for running your agent locally as well
-  # as for deployment later on
-  env:
-    ANTHROPIC_API_KEY: ""  # Required by the Claude Code CLI
-  #   OPENAI_BASE_URL: "<YOUR_OPENAI_BASE_URL_HERE>"
-  #   OPENAI_ORG_ID: "<YOUR_OPENAI_ORG_ID_HERE>"
+  # as for deployment later on. ANTHROPIC_API_KEY is supplied via the credential
+  # mapping above (deploy) or your local .env (load_dotenv). Do NOT set it to an
+  # empty string here — that would shadow the real key at runtime.
+  env: {}
+  #   ANTHROPIC_API_KEY: "<your-key>"  # uncomment only to hardcode for local runs
 
 
 # Deployment Configuration

src/agentex/lib/cli/templates/temporal-claude-code/project/activities.py.j2

@@ -78,6 +78,7 @@ async def _spawn_claude(prompt: str, session_id: str | None = None) -> AsyncIter
     assert proc.stdin is not None
 
     proc.stdin.write(prompt.encode())
+    await proc.stdin.drain()
     proc.stdin.close()
 
     # Drain stderr concurrently. With --verbose, Claude Code can write enough to