The assistant
With the Claude assistant switch on, the Machine runs an agent you can put to work: a working directory under /data, memory that survives reboots, and a fence the machine enforces. You reach it three ways, and all three are one conversation.
One session per Machine
The chat pane on the Assistant view (and on Files), the Assistant terminal, and claude in any user's browser terminal are the same single Claude session. Its transcripts and memory live under /data, so a reboot does not lose the thread. The terminal is a tmux session; closing the tab ends nothing, and ctrl-b d detaches. It has its own password, set under Assistant and kept in the sealed vault.
Claude and Hermes
The Assistant view picks which backend the chat and the terminal run. Claude is Claude Code, the default. Hermes is an open agent the box also ships, for work that should not touch a Claude account. The switch is per Machine and takes effect for the next session.
Sign in with Claude, or a key
| Sign in with Claude | the box shows a link; you sign in on any device and paste back the code. The credential lands where claude keeps and refreshes it, and the autosave persists each refresh. Your plan, your billing |
| Console API key | an Anthropic Console key (sk-ant-api…), metered on your Console account; the path Anthropic's documentation points third-party products at |
| claude setup-token | run it on any machine where you are signed in and paste the token |
One real call proves it. A key or token wins over a sign-in, because claude reads it on every session, so a successful sign-in removes a pasted key. Either way the credential is sealed in the vault, never in the clear on the stick. Both are editable under Setup.
What it can reach
The assistant reads and writes under /data, builds and tests, and uses git and gh on the repositories its model card names. It cannot touch the boot media, control services, read the box's credentials, or act on pipe on its own initiative: the fence. When it needs a secret it asks through pipeos secrets request and you approve under Secrets. With pipe on, the same session answers DMs from the owner's nick: pipe integration. Work it should do on its own goes on the schedule; every run is costed under Usage.