refactor(claude-code): update configuration for OAuth login and remove API key options

Author: beevelop

services/claude-code/.env.example

@@ -4,13 +4,6 @@
 # Project settings
 COMPOSE_PROJECT_NAME=claude-code
 
-# Authentication (use ONE of these)
-# Option 1: API key (charges API account, good for automation)
-ANTHROPIC_API_KEY=sk-ant-api03-xxxxxxxxxxxxxxxxxxxxxxxxxxxx
-# Option 2: OAuth token for Claude Pro/Max subscription (no per-request charges)
-# Generate once with: claude setup-token
-# CLAUDE_CODE_OAUTH_TOKEN=clt-oauth-xxxxxxxxxxxxxxxxxxxxxxxxx
-
 # Git repository (SSH URL for deploy key auth)
 # GIT_REPO=git@github.com:your-org/your-repo.git
 # GIT_BRANCH=main

services/claude-code/README.md

@@ -51,24 +51,40 @@ docker compose logs -f
 docker compose down
 ```
 
-## Configuration
+## First Launch -- Interactive Login
 
-### Authentication
+Remote control mode requires an OAuth login (API keys are **not** supported). On first launch, you must attach to the container and complete the login flow:
 
-You need **one** of the following:
+1. **Start the container** (see Quick Start above).
 
-| Variable | Description |
-|----------|-------------|
-| `ANTHROPIC_API_KEY` | Anthropic API key (charges API account) |
-| `CLAUDE_CODE_OAUTH_TOKEN` | OAuth token for Claude Pro/Max subscription |
+2. **Attach to the running container:**
+   ```bash
+   docker attach claude-code
+   ```
 
-**API Key** is recommended for automation. Get one from [console.anthropic.com](https://console.anthropic.com/).
+3. **Complete the OAuth login** -- the entrypoint will automatically run `claude login`. Follow the URL printed in the terminal to authenticate in your browser.
 
-**OAuth Token** bills against your Claude subscription instead of API credits. Generate once on a trusted machine:
+4. **After login succeeds**, press `Ctrl+C` to continue. The entrypoint will then launch `claude remote-control`.
 
-```bash
-claude setup-token
-```
+5. **Detach from the container** with `Ctrl+P` then `Ctrl+Q` (Docker's detach sequence). The container continues running in the background.
+
+Subsequent container restarts will use the persisted credentials and skip the login step entirely.
+
+## Credential Storage
+
+Claude Code stores its credentials in these locations inside the container:
+
+| Path | Purpose |
+|------|---------|
+| `/home/node/.claude/.credentials.json` | OAuth tokens (access + refresh) |
+| `/home/node/.claude.json` | Account metadata and onboarding state |
+| `/home/node/.claude/` | Full config directory (credentials, settings, history) |
+
+To persist credentials across container restarts, a volume is mounted at `/home/node/.claude` (the `claude_config` volume in docker-compose.yml).
+
+The image pre-seeds `/home/node/.claude.json` with onboarding state so Claude Code does not prompt for initial setup.
+
+## Configuration
 
 ### Git Repository
 
@@ -105,15 +121,15 @@ The deploy key is base64-encoded so it fits on a single line in the `.env` file.
 
 On first start, if `GIT_REPO` is set and `/workspace` is empty, the entrypoint clones the repository. On subsequent restarts the existing clone is reused.
 
-Without a deploy key, the service still works for general Claude Code usage — git features are simply unavailable.
+Without a deploy key, the service still works for general Claude Code usage -- git features are simply unavailable.
 
 ### Optional Settings
 
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `ANTHROPIC_MODEL` | *(Claude default)* | Override the default model |
 | `CLAUDE_PERMISSION_MODE` | `acceptEdits` | Permission mode for `remote-control` (see below) |
-| `INIT_COMMAND` | *(empty)* | One-time setup command (runs once, persisted via stamp file) |
+| `INIT_COMMAND` | *(empty)* | One-time setup command (runs once on first launch, tracked via stamp file) |
 | `CLAUDE_EXTRA_ARGS` | *(empty)* | Extra flags for `claude remote-control` |
 
 ### Permission Modes
@@ -124,8 +140,8 @@ Controls what Claude Code can do without asking for confirmation:
 |------|----------|
 | `default` | Prompts for all file edits and commands |
 | `acceptEdits` | Auto-approves file edits, prompts for shell commands **(default)** |
-| `bypassPermissions` | Full autonomous / YOLO mode — no prompts at all |
-| `plan` | Read-only planning mode — no edits or commands |
+| `bypassPermissions` | Full autonomous / YOLO mode -- no prompts at all |
+| `plan` | Read-only planning mode -- no edits or commands |
 
 To run fully autonomous:
 ```bash
@@ -134,7 +150,7 @@ CLAUDE_PERMISSION_MODE=bypassPermissions
 
 ### Init Command
 
-The `INIT_COMMAND` variable lets you install additional tools into the container on first boot. It runs once and is tracked via a stamp file in the Claude home volume, so it won't re-run on subsequent container restarts.
+The `INIT_COMMAND` variable lets you install additional tools into the container on first boot. It runs once and is tracked via a stamp file in the Claude config volume, so it won't re-run on subsequent container restarts.
 
 ```bash
 # Example: Install Python and build tools
@@ -145,7 +161,7 @@ INIT_COMMAND=apt-get update && apt-get install -y build-essential python3 python
 
 | Volume | Container Path | Purpose |
 |--------|---------------|---------|
-| `claude_home` | `/opt/claude` | Claude config, credentials, history |
+| `claude_config` | `/home/node/.claude` | Claude credentials, config, and history (persists login across restarts) |
 | `claude_workspace` | `/workspace` | Project files (auto-cloned from `GIT_REPO`) |
 
 ## Connecting

services/claude-code/docker-compose.yml

@@ -4,11 +4,9 @@ services:
     image: beevelop/claude:${CLAUDE_CODE_VERSION:-latest}
     container_name: claude-code
     volumes:
-      - claude_home:/opt/claude
+      - claude_config:/home/node/.claude
       - claude_workspace:/workspace
     environment:
-      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
-      - CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN:-}
       - ANTHROPIC_MODEL=${ANTHROPIC_MODEL:-}
       - CLAUDE_PERMISSION_MODE=${CLAUDE_PERMISSION_MODE:-acceptEdits}
       - DEPLOY_KEY_B64=${DEPLOY_KEY_B64:-}
@@ -34,8 +32,8 @@ services:
     stdin_open: true
 
 volumes:
-  claude_home:
-    name: ${COMPOSE_PROJECT_NAME:-claude-code}_home
+  claude_config:
+    name: ${COMPOSE_PROJECT_NAME:-claude-code}_config
   claude_workspace:
     name: ${COMPOSE_PROJECT_NAME:-claude-code}_workspace