# swarm-claude-login

The claude login minter, in the `swarm-claude-login` container on the host
that sets `deploy.claude-login.enable`. The design is
[`docs/swarm/claude-login.md`](../docs/swarm/claude-login.md).

swarm-controller relays an operator's login of one agent as two requests on
`$SWARM.claude-login.request`: a start, answered with the URL
`claude auth login` printed, and the code the operator pasted, answered once
the agent's `.credentials.json` is stored at
`swarm/agents/<agent>/claude-credentials`. Each login runs with `HOME` and
`CLAUDE_CONFIG_DIR` in its own scratch directory, removed when the login
ends however it ends.

## Credentials

The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service reads its queue
client secret, and writes the `claude-credentials` leaf of any agent, a new
version over the last. Its store role can do exactly those two things.