hive-agent: the agent has no login flow of its own, credentials come from the swarm

docs/2-handbook/web-ui/agent.md

@@ -247,13 +247,12 @@ use semantic status codes: **400** for missing/malformed input
 failures. The matching
 mutations fire `LiveEvent` variants on the per-agent bus, so the
 client doesn't refetch `/api/state` on submit — the SSE stream
-delivers the new state faster anyway. Only the login flow still
-polls (session output streams in updates that aren't event-
-shaped).
+delivers the new state faster anyway.
+
+The agent has no login flow of its own. An agent without credentials
+reports `needs_login_idle`, the operator logs in from the swarm UI, and the
+credentials arrive from the swarm secret store.
 
-- `POST /login/{start,code,cancel}` — claude OAuth login flow.
-  Start/cancel emit `LiveEvent::StatusChanged` to flip the
-  badge to/from `needs_login_in_progress`.
 - `POST /api/cancel` — SIGINT the in-flight claude turn and the
   commands it started. Emits a `LiveEvent::Note`.
 - `POST /api/compact` — run `/compact` on the persistent session
@@ -282,8 +281,8 @@ shaped).
      `needs_login_idle`. The turn-loop's next iteration parks
      into `wait_for_login`, which snapshots the credential dir
      (now missing the wiped files) and resumes when a fresh
-     credentials file appears via the dashboard's `/login/code`
-     flow (the same mtime-resumption path manual re-login uses).
+     credentials file appears (a login from the swarm UI stores one,
+     and the agent installs it).
 
   Always returns 200 with a body describing what happened — it
   folds per-file errors into the response + the Note so the
@@ -291,8 +290,7 @@ shaped).
   error. Missing files (already logged out) count as
   idempotent.
 - `GET /api/state` — cold-load snapshot (`StateSnapshot`) consumed by
-  the frontend (`useAgentState.ts`) on page load and, on a poll, while
-  `status === 'needs_login_in_progress'`. Includes `turn_state`,
+  the frontend (`useAgentState.ts`) on page load. Includes `turn_state`,
   `context_window_tokens`, `qualified_label`,
   `model`, `model_source`, `effort`, `effort_source`, `links`, and
   other fields described inline throughout this document. All
@@ -364,7 +362,7 @@ shaped).
 Bus events (new vocabulary on `/events/stream`):
 
 - `status_changed { status }` — `online` / `rate_limited` /
-  `needs_login_idle` / `needs_login_in_progress`. Drives the
+  `needs_login_idle`. Drives the
   alive-badge. The harness sets `rate_limited` when it detects a
   429 response and clears it when the retry sleep expires.
 - `model_changed { model }` — drives the model chip. The harness emits it

docs/4-implementation/web-ui/shape.md

@@ -295,7 +295,7 @@ at without rebuilding the dist. The cases that matter:
 
 The gateway upstream config strips the prefix before forwarding to
 the per-agent server, so the agent's Rust routes (`api/state`,
-`events/stream`, `screen/ws`, `login/start`, …) keep their absolute
+`events/stream`, `screen/ws`, …) keep their absolute
 paths server-side. Only the browser-facing URLs key off the
 mount prefix.