qs-ask: answer via Claude Code on the subscription, not an API key

No API key and no separate billing: qs-ask now shells out to `claude -p`,
which draws on the existing subscription already authenticated on this
host. The trade is latency — Claude Code boots a Node process per
question, ~6s measured against the raw API's ~1s — so the launcher now
races Wikipedia and Claude instead of chaining them. Wikipedia fills the
card in under a second and Claude supersedes it on arrival; chaining
would have left the card blank for six seconds on every question.

Isolation, verified: --safe-mode drops CLAUDE.md, skills, hooks, plugins
and MCP while leaving auth working, which matters for correctness and not
just speed — the global CLAUDE.md here asks for caveman-mode replies and
that would have leaked into answers. --no-session-persistence writes no
transcript, and a dedicated empty cwd keeps launcher questions out of any
project's history or auto-memory. Confirmed no project namespace, no
transcript and no memory write after a run.

Not --bare, which looks right and is a trap: its auth is strictly
ANTHROPIC_API_KEY, so it cannot use the subscription at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/FredOS-Mediaserver.nix

@@ -61,77 +61,75 @@
         done
       '')
       # Instant-answer backend for the quickshell launcher on the desktops:
-      # `printf '%s' "question" | ssh mediaserver qs-ask`. The Anthropic key
-      # lives here and nowhere else, so the desktops hold no credential and
-      # there's a single place to rotate it.
+      # `printf '%s' "question" | ssh mediaserver qs-ask`.
+      #
+      # Runs through Claude Code so it draws on fred's existing subscription —
+      # no API key, no separate billing. The trade is latency: Claude Code boots
+      # a Node process per question, so this takes ~6s against the raw API's
+      # ~1s. The launcher therefore shows its Wikipedia answer first and lets
+      # this one supersede it when it lands.
       #
       # Reads the question from stdin — passing it as an ssh argv element would
       # send it through the remote shell for a second round of word splitting.
       #
-      # Haiku 4.5 is the cheapest model and ample for a one-line factual
-      # answer: ~$0.0005 a query at $1/$5 per million input/output tokens. No
-      # `thinking` and no `effort` — `effort` errors on Haiku 4.5, and a
-      # one-sentence fact needs no reasoning tokens.
+      # Every flag here is either isolation or trimming the invocation:
+      #   --safe-mode              no CLAUDE.md, skills, hooks, plugins, MCP or
+      #                            custom agents. Critical for correctness, not
+      #                            just speed: fred's ~/.claude/CLAUDE.md tells
+      #                            Claude to answer in caveman mode, which would
+      #                            otherwise leak into launcher answers. Auth
+      #                            keeps working normally, which is what makes
+      #                            the subscription usable here.
+      #   --no-session-persistence writes no transcript, so launcher questions
+      #                            never appear in /resume or any project history
+      #   --tools ""               no tools at all: nothing to load, and it
+      #                            cannot touch the filesystem or network
+      #   --disable-slash-commands  no skill resolution
+      #   --strict-mcp-config      ignore every MCP config (none supplied)
+      #   --system-prompt          replaces the full Claude Code system prompt
+      #                            with one line, rather than appending to it
+      #   --permission-mode dontAsk never block waiting on a prompt nobody sees
+      #   --model claude-haiku-4-5 smallest model — a one-line fact needs no more
       #
-      # Set the key up once (fred's own file, no sudo needed):
-      #   mkdir -p ~/.config/anthropic
-      #   printf '%s' sk-ant-... > ~/.config/anthropic/api-key
-      #   chmod 600 ~/.config/anthropic/api-key
+      # NOT --bare, which looks like the right flag and is a trap: it skips even
+      # more, but its auth is "strictly ANTHROPIC_API_KEY or apiKeyHelper (OAuth
+      # and keychain are never read)" — i.e. it cannot use the subscription.
       #
-      # STDOUT is the launcher's channel: the answer, or nothing at all on a
-      # missing key, a failed call, or an UNKNOWN reply — silence is what the
-      # launcher reads as "fall back to Wikipedia", so it must stay clean.
-      # Every reason for that silence is reported on STDERR instead, which the
-      # launcher discards but a human running `qs-ask` by hand can read.
+      # STDOUT is the launcher's channel: the answer, or nothing at all if the
+      # call fails or the model doesn't know — silence is what the launcher
+      # reads as "keep the Wikipedia answer". Every reason for that silence goes
+      # to STDERR instead, which the launcher discards and a human running
+      # `qs-ask` by hand can read.
       (pkgs.writeShellScriptBin "qs-ask" ''
         q=$(${pkgs.coreutils}/bin/cat)
         [ -z "$q" ] && { echo "qs-ask: no question on stdin" >&2; exit 0; }
-        key_file="$HOME/.config/anthropic/api-key"
-        [ -r "$key_file" ] || { echo "qs-ask: no readable key at $key_file" >&2; exit 0; }
-        key=$(${pkgs.coreutils}/bin/tr -d '\n' < "$key_file")
-        [ -z "$key" ] && { echo "qs-ask: key file is empty" >&2; exit 0; }
-        # Catches the classic paste-the-placeholder-literally mistake, which
-        # otherwise only shows up as an opaque 401.
-        case "$key" in
-          sk-ant-...|*...) echo "qs-ask: key file holds a placeholder, not a real key" >&2; exit 0 ;;
-        esac
 
-        # jq builds the body, so a question containing quotes or backslashes
-        # can't break out of the JSON string.
-        body=$(${pkgs.jq}/bin/jq -n --arg q "$q" '{
-          model: "claude-haiku-4-5",
-          max_tokens: 300,
-          system: "Answer the question in one or two short sentences, under 240 characters. Lead with the specific fact asked for, including units. No preamble, no caveats, no markdown, no follow-up offers. If you do not know, or the answer depends on live data you do not have, reply with exactly: UNKNOWN",
-          messages: [ { role: "user", content: $q } ]
-        }')
+        # Claude Code derives its project state (transcripts, auto-memory) from
+        # the working directory, so run from a dedicated empty one. Combined with
+        # --no-session-persistence and --safe-mode, a launcher question leaves no
+        # trace in the real projects' history or memory.
+        work="$HOME/.cache/qs-ask"
+        ${pkgs.coreutils}/bin/mkdir -p "$work" || { echo "qs-ask: cannot create $work" >&2; exit 0; }
+        cd "$work" || { echo "qs-ask: cannot enter $work" >&2; exit 0; }
 
-        # No -f here: a 4xx body carries the API's own error message, which is
-        # far more useful on stderr than curl's exit code. Status is appended on
-        # its own line so it can be split off the JSON.
-        resp=$(${pkgs.curl}/bin/curl -s -w '\n%{http_code}' --max-time 10 \
-          https://api.anthropic.com/v1/messages \
-          -H 'content-type: application/json' \
-          -H "x-api-key: $key" \
-          -H 'anthropic-version: 2023-06-01' \
-          --data-raw "$body") \
-          || { echo "qs-ask: request failed (network or timeout)" >&2; exit 0; }
+        ans=$(printf '%s' "$q" | ${pkgs.claude-code}/bin/claude -p \
+          --safe-mode \
+          --no-session-persistence \
+          --tools "" \
+          --disable-slash-commands \
+          --strict-mcp-config \
+          --permission-mode dontAsk \
+          --output-format text \
+          --model claude-haiku-4-5 \
+          --system-prompt 'Answer the question in one or two short sentences, under 240 characters. Lead with the specific fact asked for, including units. No preamble, no caveats, no markdown, no follow-up offers. If you do not know, or the answer depends on live data you do not have, reply with exactly: UNKNOWN' \
+          2>/dev/null) \
+          || { echo "qs-ask: claude exited non-zero (auth expired? run 'claude' once to log in)" >&2; exit 0; }
 
-        code=''${resp##*$'\n'}
-        json=''${resp%$'\n'*}
+        ans=$(printf '%s' "$ans" | ${pkgs.coreutils}/bin/tr -d '\r' | ${pkgs.gnused}/bin/sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
 
-        if [ "$code" != 200 ]; then
-          printf 'qs-ask: HTTP %s — %s\n' "$code" \
-            "$(printf '%s' "$json" | ${pkgs.jq}/bin/jq -r '.error.message // "no error message"')" >&2
-          exit 0
-        fi
-
-        ans=$(printf '%s' "$json" | ${pkgs.jq}/bin/jq -r '[.content[]? | select(.type == "text") | .text] | join(" ")')
-
-        # UNKNOWN or a refusal (empty content): stay quiet on stdout so the
-        # launcher's Wikipedia path answers instead.
         case "$ans" in
-          "" |null)   echo "qs-ask: empty answer (refusal or no text block)" >&2; exit 0 ;;
-          UNKNOWN*)   echo "qs-ask: model replied UNKNOWN" >&2; exit 0 ;;
+          "")        echo "qs-ask: empty answer" >&2; exit 0 ;;
+          UNKNOWN*)  echo "qs-ask: model replied UNKNOWN" >&2; exit 0 ;;
         esac
         printf '%s' "$ans"
       '')