#!/usr/bin/env sh
# Persist Claude Desktop sign-in across restarts.
# Claude Desktop (Electron) stores its auth token via safeStorage. On Linux the libsecret
# backend needs a running Secret Service (gnome-keyring), but gnome-keyring is intentionally
# not installed in this image: on first boot it prompts for a keyring password, which blocks
# Claude Desktop from ever launching. Without the daemon, forcing --password-store=gnome-libsecret
# leaves safeStorage.isEncryptionAvailable()=false, so the session can never be stored — that
# surfaced as recurring "sign in again" prompts and (because the stale session also fails the
# elevated-access OAuth check) the Claude app's dispatch tab showing this desktop as offline.
#
# --password-store=basic uses Electron's built-in fixed-key store instead: no daemon, no
# prompt, and isEncryptionAvailable() is always true. Secrets land under $HOME/.config/Claude,
# and HOME=/data/data is persistent add-on storage, so the saved sign-in survives restarts.
# Headroom is intentionally not injected into the Desktop process: Claude Desktop
# force-overrides ANTHROPIC_BASE_URL (headroom #869), so Desktop uses the registered Headroom
# MCP tools instead.
exec claude-desktop --no-sandbox --disable-dev-shm-usage --password-store=basic
