Config-driven client attach: auto-attach Claude/Codex on joined machines

[bgmcmullen]

Problem

Joining a server pulls central config and starts the gateway automatically — but
each user must still run hyp attach claude / hyp attach codex by hand before
anything is captured. Bad onboarding UX, and a silent-gap failure: daemon healthy,
gateway bound, but nothing recorded because no client was attached.

This is the follow-up deferred in LLP 0031 ("Central-managed client attach
semantics").

Why it's not already solved

hyp attach does two things. The config-layer entry (@hypaware/claude) is
already fleet-expressible. The blocker is the machine-side side effects —
editing ~/.claude/settings.json (ANTHROPIC_BASE_URL + hooks) and Codex
config.toml. The apply engine (src/core/config/apply.js) deliberately never
touches client files, so attach stays a manual local step.

Proposal

A daemon-side reconciler that applies the attach side effects for any client the
central config names (idempotent), and reverses them on leave/detach — promoting
attach from a one-shot CLI command to a managed apply step.

Open questions

• Per-machine specifics (each host's ~/.claude path, gateway port) resolved locally.
• Conflict with a user-set ANTHROPIC_BASE_URL: warn / skip / override?
• Per-machine opt-out?
• Consent: auto-editing ~/.claude/settings.json from server config escalates what
  "join" does — needs an explicit design note.

Acceptance

• Joined machine whose central config names a client becomes attached with no manual
  step, and captures traffic.
• Reconcile idempotent; reversible on leave, restoring pre-existing user settings.
• Design landed as an LLP update resolving the LLP 0031 deferred item.

Refs

LLP 0031 (deferred item), LLP 0025 (join flow), LLP 0016 (gateway);
src/core/cli/core_commands.js (runAttach),
hypaware-core/plugins-workspace/{claude,codex}.