aa1ae2729f
The queue subjects, scratch directory and stdio steps of a login, the harness's newer-version rule, the minter's grants, the caveat and the metrics move to 4-implementation/swarm/claude-login.md. The handbook page keeps how to log an agent in, the stored login and who may do it. Design pointers in the nix module, the crate README and AGENTS.md name the new page.
2.3 KiB
Claude login from the swarm UI
An operator logs an agent in to claude from the agent's card in the swarm UI.
No hive is in the path: the login runs in the swarm's swarm-claude-login
service, the credentials go to the agent's own leaf in the secret store, and the
agent's harness installs them from there.
Where it runs and how it's enabled: services.md.
Logging an agent in
- The agent's card shows login needed with a log in button when its claude has no session.
- log in opens a dialog with a link. Open it, sign in to the agent's own claude account, and paste the code the page shows into the dialog.
- When the secret store has the login, the dialog closes and the agent picks the login up within a few minutes, then resumes its turns.
A started login waits 15 minutes for its code, then stops. Starting another login for the same agent replaces the running one. A refused code fails the login, and the dialog shows what claude printed.
The agent's own web UI login (/login) still works, unchanged. It goes away once
you have confirmed the swarm login works.
The stored login
The agent's card shows when the swarm stored its login for it, or that none is. delete login on the card removes the stored login, every version of it, after asking first. An agent that already holds a session logs out too, the next time it reads the store: within 5 minutes, or when a paused agent resumes.
An agent installs a stored login only when it's newer than the one it installed last, so a login that has since gone bad is never put back. The rule and its reasons are in the reference.
Who may log an agent in
The operatorsOnly authelia rule on the swarm domain keeps the login routes to
operators; the controller checks only that the gateway named a user. Without that
rule any account authelia admits could store its own claude session as any
agent's, so no agent account may exist before the rule reaches the swarm. Every
hive's policy reads swarm/agents/*, so every hive can read every agent's claude
session, as it can read the GitHub token.
The minter's grants, the steps of a login and its metrics are in the reference.