#!/usr/bin/env sh
# Persist Claude Desktop sign-in across restarts.
# Claude Desktop (Electron) stores its auth token via safeStorage. On Linux the libsecret
# backend needs a running Secret Service (gnome-keyring), but gnome-keyring is intentionally
# not installed in this image: on first boot it prompts for a keyring password, which blocks
# Claude Desktop from ever launching. Without the daemon, forcing --password-store=gnome-libsecret
# leaves safeStorage.isEncryptionAvailable()=false, so the session can never be stored — that
# surfaced as recurring "sign in again" prompts and (because the stale session also fails the
# elevated-access OAuth check) the Claude app's dispatch tab showing this desktop as offline.
#
# --password-store=basic uses Electron's built-in fixed-key store instead: no daemon and no
# prompt. Secrets land under $HOME/.config/Claude, and HOME=/data/data is persistent add-on
# storage, so the saved sign-in survives restarts.
#
# This flag is only half of it. Electron refuses the basic backend unless the application opts
# in via safeStorage.setUsePlainTextEncryption(true), and Claude Desktop never calls it — with
# the flag alone, isEncryptionAvailable() stays false and the sign-in is still lost on every
# restart. /etc/cont-init.d/86-claude_safestorage.sh injects that opt-in into app.asar before
# this runs; do not drop one without the other.
# Headroom is intentionally not injected into the Desktop process: Claude Desktop
# force-overrides ANTHROPIC_BASE_URL (headroom #869), so Desktop uses the registered Headroom
# MCP tools instead.
exec claude-desktop --no-sandbox --disable-dev-shm-usage --password-store=basic