From b23eb0ef676e9ae9ce09e62102d274564072af4f Mon Sep 17 00:00:00 2001
From: pahud <pahud@users.noreply.github.com>
Date: Mon, 4 May 2026 22:20:14 -0400
Subject: [PATCH 1/2] docs: fix claude authentication command in claude-code.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace `claude setup-token` with `claude auth login` for container auth.

`claude setup-token` generates a long-lived token for CI/scripts without
saving it locally. For container deployments with PVC persistence,
`claude auth login` is the correct command — it authenticates via OAuth
device flow and stores credentials on disk.

Ref: https://docs.anthropic.com/en/docs/claude-code/cli-usage
---
 docs/claude-code.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/docs/claude-code.md b/docs/claude-code.md
index a8f4479f..414a3001 100644
--- a/docs/claude-code.md
+++ b/docs/claude-code.md
@@ -35,6 +35,16 @@ working_dir = "/home/node"
 
 ## Authentication
 
+Sign in interactively using the OAuth device flow. Credentials are stored on disk (persisted via PVC across pod restarts):
+
+```bash
+kubectl exec -it deployment/openab-claude -- claude auth login
+```
+
+After authenticating, restart the pod to pick up the new credentials:
+
 ```bash
-kubectl exec -it deployment/openab-claude -- claude setup-token
+kubectl rollout restart deployment/openab-claude
 ```
+
+> **Note:** `claude setup-token` is a different command — it generates a long-lived token for CI/scripts and prints it without saving locally. For container-based deployments, `claude auth login` is the correct approach as it persists credentials to the filesystem.

From ae792510bb0835ae5b3a0f103a93909387837783 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=B6=85=E6=B8=A1=E6=B3=95=E5=B8=AB?= <chaodu@openab.dev>
Date: Wed, 6 May 2026 10:55:25 +0000
Subject: [PATCH 2/2] fix: update remaining setup-token refs and wording nit

Address review comments:
- Replace claude setup-token with claude auth login in NOTES.txt
- Replace claude setup-token with claude auth login in wizard.rs
- Improve wording: 'restart the pod so the bot process loads the new credentials'
---
 charts/openab/templates/NOTES.txt | 2 +-
 docs/claude-code.md               | 2 +-
 src/setup/wizard.rs               | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/charts/openab/templates/NOTES.txt b/charts/openab/templates/NOTES.txt
index 1b836910..2030ed6f 100644
--- a/charts/openab/templates/NOTES.txt
+++ b/charts/openab/templates/NOTES.txt
@@ -32,7 +32,7 @@ Agents deployed:
     kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- codex login --device-auth
 {{- else if eq (toString $cfg.command) "claude-agent-acp" }}
     Authenticate:
-    kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- claude setup-token
+    kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- claude auth login
 {{- else if eq (toString $cfg.command) "gemini" }}
     Authenticate:
     kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- gemini
diff --git a/docs/claude-code.md b/docs/claude-code.md
index 414a3001..00c9129a 100644
--- a/docs/claude-code.md
+++ b/docs/claude-code.md
@@ -41,7 +41,7 @@ Sign in interactively using the OAuth device flow. Credentials are stored on dis
 kubectl exec -it deployment/openab-claude -- claude auth login
 ```
 
-After authenticating, restart the pod to pick up the new credentials:
+After authenticating, restart the pod so the bot process loads the new credentials:
 
 ```bash
 kubectl rollout restart deployment/openab-claude
diff --git a/src/setup/wizard.rs b/src/setup/wizard.rs
index 8a346400..e8751172 100644
--- a/src/setup/wizard.rs
+++ b/src/setup/wizard.rs
@@ -525,7 +525,7 @@ fn print_next_steps(agent: &str, output_path: &Path, is_local: bool) {
                 cprintln!(C.cyan, "  1. Install Claude Code + ACP adapter:");
                 println!("       npm install -g @anthropic-ai/claude-code @agentclientprotocol/claude-agent-acp");
                 cprintln!(C.cyan, "  2. Authenticate:");
-                println!("       claude setup-token");
+                println!("       claude auth login");
             }
             "codex" => {
                 cprintln!(C.cyan, "  1. Install Codex CLI + ACP adapter:");
@@ -560,7 +560,7 @@ fn print_next_steps(agent: &str, output_path: &Path, is_local: bool) {
                 "       kubectl exec -it deployment/openab-kiro -- kiro-cli login --use-device-flow"
             ),
             "claude" => println!(
-                "       kubectl exec -it deployment/openab-claude -- claude setup-token"
+                "       kubectl exec -it deployment/openab-claude -- claude auth login"
             ),
             "codex" => println!(
                 "       kubectl exec -it deployment/openab-codex -- codex login --device-auth"