d5de1e4943
A new swarm service, `swarm-claude-login`, in its own container on the host
that sets `deploy.claude-login.enable` (defaulted on by `allSwarmServices`
where the host has the minter's store leaf, like the review classifier).
- swarm-ui: an agent card showing "login needed" gets a "log in" button.
Its dialog starts the login, shows the URL claude printed, and takes the
pasted code.
- swarm-controller: `POST/DELETE /api/agents/{name}/claude-login` and
`POST /api/agents/{name}/claude-login/code`, behind the swarm UI's
authelia-gated `/api/`, relay the steps to the minter as requests on
`$SWARM.claude-login.request`.
- swarm-claude-login: runs `claude auth login` over piped stdio with HOME
and CLAUDE_CONFIG_DIR in a per-login scratch dir, scrapes the first
https URL, writes the code to stdin, and stores the `.credentials.json`
at `swarm/agents/<agent>/claude-credentials` with a KV v2 write, a new
version over any earlier one. The scratch dir goes on every exit path; a
login waits 15 minutes for its code.
- hive-agent: while parked in `wait_for_login`, reads that leaf every 30 s
under the agent's own cert and installs it only when its KV version is
newer than the one recorded in `<harness>/claude-credentials-version`.
An equal or older version is never put back, because claude rotates the
refresh token and the stored copy is stale after the first refresh.
- swarm-secret-client: `claude_login` paths and `SecretStore::read_versioned`.
- Credentials: a `claude-login` store leaf minted by glue-bao-tls, a
`swarm-claude-login` policy (create/update on
`swarm/agents/+/claude-credentials`, read on its own queue client
secret), an authelia machine client, and a `--claude-login-client`
grant in the queue's auth-callout responder. The unit runs as a static
system user.
The hive's own web-UI login is unchanged.
Refs #5268
44 lines
1.1 KiB
CSS
44 lines
1.1 KiB
CSS
/* <AgentCard> content layout — the clickable/selectable container
|
|
itself is `Card`'s (`ui/card/`); this is just the name/badges/
|
|
message arrangement inside one. */
|
|
.ui-agent-card-line1 {
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 0.6em;
|
|
}
|
|
.ui-agent-card-name {
|
|
font-weight: 600;
|
|
}
|
|
/* Pushes the wanted-state control to the row's trailing edge regardless
|
|
of how wide the status badge next to it ends up. */
|
|
.ui-agent-card-wanted {
|
|
display: inline-flex;
|
|
align-items: center;
|
|
gap: 0.4em;
|
|
margin-left: auto;
|
|
}
|
|
/* The "login needed" badge and its "log in" button, kept together; the
|
|
wrapper also keeps their clicks, and the dialog's, off the card. */
|
|
.ui-agent-card-login {
|
|
display: inline-flex;
|
|
align-items: center;
|
|
gap: 0.4em;
|
|
}
|
|
.ui-agent-card-message {
|
|
color: var(--muted);
|
|
white-space: normal;
|
|
word-break: break-word;
|
|
}
|
|
/* Icon (`AgentIcon`) beside the name/message. */
|
|
.ui-agent-card-row {
|
|
display: flex;
|
|
align-items: flex-start;
|
|
gap: 0.7em;
|
|
}
|
|
.ui-agent-card-body {
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 0.35em;
|
|
flex: 1;
|
|
min-width: 0;
|
|
}
|