swarm-claude-login — hyperhive docs

The claude login minter, in the swarm-claude-login container on the host that sets deploy.claude-login.enable. The design is docs/swarm/claude-login.md.

swarm-controller relays an operator's login of one agent as two requests on $SWARM.claude-login.request: a start, answered with the URL claude auth login printed, and the code the operator pasted, answered once the agent's .credentials.json is stored at swarm/agents/<agent>/claude-credentials. Each login runs with HOME and CLAUDE_CONFIG_DIR in its own scratch directory, removed when the login ends however it ends.

Credentials

The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret, and writes the claude-credentials leaf of any agent, a new version over the last. Its store role can do exactly those two things.