swain-keys

When invoked

skills/swain-keys/scripts/swain-keys.sh

SCRIPT="$(find . .claude .agents -path '*/swain-keys/scripts/swain-keys.sh' -print -quit 2>/dev/null)"

**/swain-keys/scripts/swain-keys.sh

Workflows

Default (no arguments or "set up keys")

--status

bash "$SCRIPT" --status

Provision ("provision keys", "configure signing", "set up SSH")

bash "$SCRIPT" --provision

1. Derive a project name from the git remote or directory
2. Generate

   ~/.ssh/<project>_signing

   (ed25519, no passphrase) if not exists
3. Create

   ~/.ssh/allowed_signers_<project>

   with the configured git email
4. Add the public key to GitHub via

   gh ssh-key add

   for both authentication and signing
5. Create

   ~/.ssh/config.d/<project>.conf

   with a host alias that bypasses global SSH agents
6. Update the git remote URL to use the project-specific host alias
7. Set local git config for commit and tag signing
8. Verify SSH connectivity and signing capability

Status ("key status", "check keys")

bash "$SCRIPT" --status

Verify ("verify keys", "test signing")

bash "$SCRIPT" --verify

Handling scope refresh

gh ssh-key add

1. Tell the user they need to authorize additional GitHub scopes
2. Show them the command:

   gh auth refresh -s admin:public_key,admin:ssh_signing_key

3. This will open a browser for OAuth — it requires human interaction
4. After they confirm, re-run

   --provision

   (idempotent, will skip completed steps)

Integration with swain-init

--provision

Session bookmark

bash "$(find . .claude .agents -path '*/swain-session/scripts/swain-bookmark.sh' -print -quit 2>/dev/null)" "Provisioned SSH keys for {project}"

Error handling

• If not in a git repo: fail with clear message
• If

  gh

  CLI unavailable: skip GitHub registration steps, warn user to add keys manually
• If git email not configured: fail early with instructions
• All steps are idempotent — safe to re-run after fixing issues