e9ddfd61ec
An agent with no stored login, or one to log in again, can be logged in from the settings panel instead of waiting for its turns to fail with a login needed badge first. The button opens the same dialog as the card's.
53 lines
2.6 KiB
Markdown
53 lines
2.6 KiB
Markdown
# Claude login from the swarm UI
|
|
|
|
An operator logs an agent in to claude from the agent's card in the swarm UI.
|
|
No hive is in the path: the login runs in the swarm's `swarm-claude-login`
|
|
service, the credentials go to the agent's own leaf in the secret store, and the
|
|
agent's harness installs them from there.
|
|
|
|
Where it runs and how it's enabled: [`services.md`](services.md#claude-login-minter).
|
|
|
|
## Logging an agent in
|
|
|
|
1. The agent's card shows **login needed** with a **log in** button when its
|
|
claude has no session.
|
|
2. **log in** opens a dialog with a link. Open it, sign in to the agent's own
|
|
claude account, and paste the code the page shows into the dialog.
|
|
3. When the secret store has the login, the dialog closes and the agent picks the
|
|
login up within a few minutes, then resumes its turns.
|
|
|
|
A started login waits 15 minutes for its code, then stops. Starting another login
|
|
for the same agent replaces the running one. A refused code fails the login, and
|
|
the dialog shows what claude printed.
|
|
|
|
You don't have to wait for the agent to fail first: the **claude login** row in the
|
|
card's settings has a **log in** button too, which reads **log in again** once the swarm has a
|
|
login for the agent, so a fresh agent or a forced relogin starts there. It opens the
|
|
same dialog.
|
|
|
|
The agent's own web UI login (`/login`) still works, unchanged. It goes away once
|
|
you have confirmed the swarm login works.
|
|
|
|
## The stored login
|
|
|
|
The agent's card shows when the swarm stored its login for it, or that none is.
|
|
**delete login** on the card removes the stored login, every version of it, after
|
|
asking first. An agent that already holds a session logs out too, the next time
|
|
it reads the store: within 5 minutes, or when a paused agent resumes.
|
|
|
|
An agent installs a stored login only when it's newer than the one it installed
|
|
last, so a login that has since gone bad is never put back. The rule and its
|
|
reasons are in
|
|
[the reference](../../4-implementation/swarm/claude-login.md#why-the-harness-takes-only-a-newer-login).
|
|
|
|
## Who may log an agent in
|
|
|
|
The `operatorsOnly` authelia rule on the swarm domain keeps the login routes to
|
|
operators; the controller checks only that the gateway named a user. Without that
|
|
rule any account authelia admits could store its own claude session as any
|
|
agent's, so no agent account may exist before the rule reaches the swarm. Every
|
|
hive's policy reads `swarm/agents/*`, so every hive can read every agent's claude
|
|
session, as it can read the GitHub token.
|
|
|
|
The minter's grants, the steps of a login and its metrics are in
|
|
[the reference](../../4-implementation/swarm/claude-login.md).
|