@drakon-systems/multi-clawd 1.8.6 → 1.8.8

package/README.md

@@ -248,8 +248,10 @@ claude-cli/claude-fable-5        # main login
 - 🩺 **`npm run doctor` (v0.3)** — one command that says whether a box is
   actually ready: config/manifest agreement (with the exact `--force`
   preflight strip plan), dist freshness, CLI presence, credential health
-  (values never printed), telemetry age, pool + sticky state, watchdog
-  presence, optional `--probe` end-to-end turn.
+  (values never printed), **which Claude login each account authenticates as
+  and which one the next turn will run on**, telemetry age, pool + sticky
+  state, **whether every non-Claude chain rung still has a usable auth
+  profile**, watchdog presence, optional `--probe` (one turn per account).
 - 🧯 **Self-healing config** — registration re-reads the resolved runtime
   config if the loader hands it an empty block, so a flaky registration pass
   can't silently no-op the plugin.
@@ -367,7 +369,7 @@ openclaw plugins install (Get-Location).Path
 **Or let your agent install it.** Running an OpenClaw assistant or Claude
 Code on the target machine already? Paste it this and go make coffee:
 
-> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.8.6/SETUP-AGENT.md
+> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.8.8/SETUP-AGENT.md
 > and follow it to set up multi-clawd on this machine. I own a second
 > Claude account — ask me when you need me to log in.
 

package/dist/account-identity.js

@@ -0,0 +1,131 @@
+export function identityFilePath(account, io) {
+    const dir = !account.native && account.configDir ? io.expandHome(account.configDir) : io.defaultConfigDir;
+    if (!dir)
+        return undefined;
+    if (account.oauthTokenFile || account.oauthTokenRef)
+        return undefined;
+    return `${dir.replace(/\/+$/, "")}/.claude.json`;
+}
+export function formatPlan(oauthAccount) {
+    const tier = typeof oauthAccount.organizationRateLimitTier === "string"
+        ? oauthAccount.organizationRateLimitTier
+        : undefined;
+    const type = typeof oauthAccount.organizationType === "string" ? oauthAccount.organizationType : undefined;
+    const source = tier ?? type;
+    if (!source)
+        return undefined;
+    const multiplier = source.match(/max_(\d+)x/)?.[1];
+    if (multiplier)
+        return `Max ${multiplier}x`;
+    if (/max/i.test(source))
+        return "Max";
+    if (/enterprise/i.test(source))
+        return "Enterprise";
+    if (/team/i.test(source))
+        return "Team";
+    if (/pro/i.test(source))
+        return "Pro";
+    if (/free/i.test(source))
+        return "Free";
+    return source;
+}
+export function parseIdentityFile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const oauthAccount = parsed?.oauthAccount;
+    if (!oauthAccount || typeof oauthAccount !== "object")
+        return undefined;
+    const account = oauthAccount;
+    const str = (key) => (typeof account[key] === "string" ? account[key] : undefined);
+    const identity = {
+        accountUuid: str("accountUuid"),
+        email: str("emailAddress"),
+        organizationName: str("organizationName"),
+        plan: formatPlan(account),
+    };
+    if (!identity.accountUuid && !identity.email)
+        return undefined;
+    return identity;
+}
+export function resolveAccountIdentity(account, io) {
+    const path = identityFilePath(account, io);
+    if (!path) {
+        return {
+            accountId: account.id,
+            status: "unknown",
+            reason: account.oauthTokenFile || account.oauthTokenRef
+                ? "token-sourced login — the identity lives inside the token, not on disk"
+                : "no config dir to read",
+        };
+    }
+    let text;
+    try {
+        text = io.readFile(path);
+    }
+    catch {
+        return {
+            accountId: account.id,
+            status: "unknown",
+            reason: `no readable ${path} — this account has never completed a login here`,
+            source: path,
+        };
+    }
+    const identity = parseIdentityFile(text);
+    if (!identity) {
+        return {
+            accountId: account.id,
+            status: "unknown",
+            reason: `${path} carries no oauthAccount record`,
+            source: path,
+        };
+    }
+    return { accountId: account.id, status: "resolved", source: path, ...identity };
+}
+export function maskEmail(email) {
+    const at = email.lastIndexOf("@");
+    if (at < 1)
+        return "…";
+    const local = email.slice(0, at);
+    const domain = email.slice(at);
+    if (local.length <= 2)
+        return `${local[0]}…${domain}`;
+    return `${local[0]}…${local[local.length - 1]}${domain}`;
+}
+export function describeIdentity(identity, options = {}) {
+    if (identity.status !== "resolved")
+        return identity.reason ?? "identity unknown";
+    const who = identity.email
+        ? options.raw
+            ? identity.email
+            : maskEmail(identity.email)
+        : options.raw
+            ? (identity.accountUuid ?? "unknown login")
+            : `login ${identity.accountUuid?.slice(0, 8) ?? "?"}…`;
+    const parts = [who];
+    if (identity.plan)
+        parts.push(identity.plan);
+    if (options.raw && identity.organizationName)
+        parts.push(identity.organizationName);
+    return parts.join(" · ");
+}
+export function findDuplicateLogins(identities) {
+    const groups = new Map();
+    for (const identity of identities) {
+        if (identity.status !== "resolved")
+            continue;
+        const key = identity.accountUuid ?? (identity.email ? `email:${identity.email}` : undefined);
+        if (!key)
+            continue;
+        const group = groups.get(key) ?? { ids: [], email: identity.email };
+        group.ids.push(identity.accountId);
+        groups.set(key, group);
+    }
+    return [...groups.entries()]
+        .filter(([, group]) => group.ids.length > 1)
+        .map(([key, group]) => ({ key, accountIds: group.ids, email: group.email }));
+}

package/dist/chain-audit.js

@@ -96,8 +96,8 @@ function collectCronRefs(surface, node, depth, out) {
             collectCronRefs(`${surface}.${k}`, v, depth + 1, out);
     }
 }
-const RESERVED_AGENT_KEYS = new Set(["defaults", "list", "models"]);
-function collectChainRefs(config) {
+const RESERVED_AGENT_KEYS = new Set(["defaults", "list", "models", "entries", "ownership"]);
+export function collectChainRefs(config) {
     const out = [];
     const push = (surface, value) => {
         for (const r of extractModelRefs(surface, value))
@@ -128,6 +128,24 @@ function collectChainRefs(config) {
         if ("cron" in agent)
             collectCronRefs(`agents.${name}.cron`, agent.cron, 0, out);
     }
+    const entries = agents.entries;
+    if (entries && typeof entries === "object" && !Array.isArray(entries)) {
+        for (const [name, v] of Object.entries(entries)) {
+            if (!v || typeof v !== "object")
+                continue;
+            const agent = v;
+            if ("model" in agent)
+                push(`agents.entries.${name}.model`, agent.model);
+            const agentSubagents = agent.subagents;
+            if (agentSubagents && typeof agentSubagents === "object") {
+                const sub = agentSubagents;
+                if (sub.model !== undefined)
+                    push(`agents.entries.${name}.subagents.model`, sub.model);
+            }
+            if ("cron" in agent)
+                collectCronRefs(`agents.entries.${name}.cron`, agent.cron, 0, out);
+        }
+    }
     if (Array.isArray(agents.list)) {
         agents.list.forEach((a, i) => {
             if (!a || typeof a !== "object")
@@ -187,6 +205,17 @@ function collectAgentModelBlocks(config) {
         if ("model" in agent)
             out.push({ agent: name, surface: `agents.${name}.model`, model: agent.model });
     }
+    const entries = agents.entries;
+    if (entries && typeof entries === "object" && !Array.isArray(entries)) {
+        for (const [name, v] of Object.entries(entries)) {
+            if (!v || typeof v !== "object")
+                continue;
+            const agent = v;
+            if (!("model" in agent))
+                continue;
+            out.push({ agent: name, surface: `agents.entries.${name}.model`, model: agent.model });
+        }
+    }
     if (Array.isArray(agents.list)) {
         agents.list.forEach((a, i) => {
             if (!a || typeof a !== "object")

package/dist/chain-auth.js

@@ -0,0 +1,125 @@
+export const STALE_OAUTH_GRACE_MS = 7 * 24 * 60 * 60 * 1000;
+const PROFILE_FREE_PROVIDERS = new Set([
+    "claude-cli",
+    "ollama",
+    "lmstudio",
+    "llamacpp",
+    "vllm",
+    "sglang",
+    "local",
+]);
+const POOL_MEMBER_RE = /^claw\d+$/;
+function providerOf(ref) {
+    const idx = ref.indexOf("/");
+    if (idx < 1)
+        return undefined;
+    return ref.slice(0, idx).trim().toLowerCase();
+}
+function orderedIds(order, provider) {
+    const entry = order?.[provider];
+    if (!Array.isArray(entry))
+        return undefined;
+    const ids = entry.filter((v) => typeof v === "string" && v.length > 0);
+    return ids.length > 0 ? ids : undefined;
+}
+function expiryAgeMs(profile, nowMs) {
+    if (!profile.expiresAt)
+        return undefined;
+    const at = Date.parse(profile.expiresAt);
+    if (Number.isNaN(at))
+        return undefined;
+    return nowMs - at;
+}
+function humanAge(ms) {
+    const days = Math.floor(ms / 86_400_000);
+    if (days >= 1)
+        return `${days}d`;
+    const hours = Math.floor(ms / 3_600_000);
+    if (hours >= 1)
+        return `${hours}h`;
+    return `${Math.max(1, Math.round(ms / 60_000))}m`;
+}
+export function auditChainAuth(input) {
+    const poolId = input.poolId?.trim().toLowerCase();
+    const bySurface = new Map();
+    for (const { surface, ref, allowlist } of input.refs) {
+        if (allowlist)
+            continue;
+        const provider = providerOf(ref);
+        if (!provider)
+            continue;
+        if (provider === poolId || POOL_MEMBER_RE.test(provider))
+            continue;
+        if (PROFILE_FREE_PROVIDERS.has(provider))
+            continue;
+        const list = bySurface.get(provider) ?? [];
+        if (!list.includes(surface))
+            list.push(surface);
+        bySurface.set(provider, list);
+    }
+    const findings = [];
+    for (const [provider, surfaces] of [...bySurface.entries()].sort()) {
+        const profiles = input.profiles.filter((p) => p.provider?.trim().toLowerCase() === provider);
+        const order = orderedIds(input.order, provider);
+        if (profiles.length === 0) {
+            findings.push({
+                severity: "warn",
+                provider,
+                surfaces,
+                reason: `no saved auth profile; this rung can only authenticate from an environment API key. ` +
+                    `Confirm with \`openclaw models auth list --provider ${provider}\``,
+            });
+            continue;
+        }
+        const eligible = order ? profiles.filter((p) => order.includes(p.id)) : profiles;
+        if (eligible.length === 0) {
+            const missing = order?.filter((id) => !profiles.some((p) => p.id === id)) ?? [];
+            findings.push({
+                severity: "bad",
+                provider,
+                surfaces,
+                reason: `auth.order.${provider} excludes every saved profile (${profiles
+                    .map((p) => p.id)
+                    .join(", ")})${missing.length > 0 ? ` and names ${missing.join(", ")}, which is not in the store` : ""} — the rung can never authenticate. Fix the order or remove it.`,
+            });
+            continue;
+        }
+        if (order) {
+            const missing = order.filter((id) => !profiles.some((p) => p.id === id));
+            if (missing.length > 0) {
+                findings.push({
+                    severity: "warn",
+                    provider,
+                    surfaces,
+                    reason: `auth.order.${provider} names ${missing.join(", ")}, which is not in the auth store — silently ignored`,
+                });
+            }
+        }
+        const ages = eligible.map((p) => ({ profile: p, age: expiryAgeMs(p, input.nowMs) }));
+        const dated = ages.filter((a) => a.age !== undefined);
+        const undatedUsable = ages.length > dated.length;
+        if (!undatedUsable && dated.length > 0 && dated.every((a) => a.age > 0)) {
+            const freshest = Math.min(...dated.map((a) => a.age));
+            if (freshest > STALE_OAUTH_GRACE_MS) {
+                findings.push({
+                    severity: "bad",
+                    provider,
+                    surfaces,
+                    reason: `every eligible profile's OAuth token expired (oldest usable one ${humanAge(freshest)} ago, ` +
+                        `past the ${Math.round(STALE_OAUTH_GRACE_MS / 86_400_000)}d refresh grace) — refresh has stopped working. ` +
+                        `Re-run \`openclaw models auth login --provider ${provider}\``,
+                });
+            }
+            else {
+                findings.push({
+                    severity: "warn",
+                    provider,
+                    surfaces,
+                    reason: `every eligible profile's OAuth token is past expiry (${humanAge(freshest)} ago). ` +
+                        `Normally refreshed on next use — if this rung is failing, probe it`,
+                });
+            }
+        }
+    }
+    return findings;
+}

package/dist/models.js

@@ -14,7 +14,8 @@ const KNOWN_SPECS = {
     "claude-opus-4-7": { name: "Claude Opus 4.7", contextWindow: 1048576, maxTokens: 64000 },
     "claude-opus-4-6": { name: "Claude Opus 4.6", contextWindow: 1048576, maxTokens: 64000 },
     "claude-sonnet-4-6": { name: "Claude Sonnet 4.6", contextWindow: 1048576, maxTokens: 64000 },
-    "claude-sonnet-5": { name: "Claude Sonnet 5", contextWindow: 200000, maxTokens: 64000 },
+    "claude-sonnet-5": { name: "Claude Sonnet 5", contextWindow: 1000000, maxTokens: 64000 },
+    "claude-fable-5-1": { name: "Claude Fable 5.1", contextWindow: 1000000, maxTokens: 128000 },
     "claude-fable-5": { name: "Claude Fable 5", contextWindow: 1000000, maxTokens: 128000 },
     "claude-haiku-4-5": { name: "Claude Haiku 4.5", contextWindow: 200000, maxTokens: 64000 },
 };

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "multi-clawd",
   "name": "multi-clawd",
-  "version": "1.8.6",
+  "version": "1.8.8",
   "description": "Register additional Claude Code logins (Max/Pro accounts) as first-class OpenClaw CLI backends for cross-account failover, keeping the full skills/MCP harness on every account.",
   "cliBackends": [
     "claw1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/multi-clawd",
-  "version": "1.8.6",
+  "version": "1.8.8",
   "description": "Multi-account Claude Code failover for OpenClaw — register additional Claude (Max/Pro) logins as first-class CLI backends and keep the full skills/MCP harness across every account. Also imports those accounts' setup tokens into Hermes Agent's Anthropic credential pool.",
   "type": "module",
   "license": "MIT",

package/scripts/doctor.mjs

@@ -6,16 +6,22 @@
  *   1. plugin install + manifest/config key agreement (the --force trap)
  *   2. compiled-artifact freshness (stale dist detection)
  *   3. claude CLI availability + PATH sanity
- *   4. per-account credential-source health
+ *   4. per-account credential-source health + which Claude login each
+ *      account actually authenticates as (and whether two share one)
  *   5. per-account rate-limit telemetry (state files, age, windows)
- *   6. pool configuration + sticky state
+ *   6. pool configuration, sticky state, and the account the next turn runs on
  *   7. effective chain — Claude tiers must route through the clawd pool
- *   8. eviction watchdog presence (launchd/systemd)
+ *   8. chain auth — every non-Claude rung must have a usable auth profile
+ *   9. eviction watchdog presence (launchd/systemd)
  *
  * Flags:
  *   --preflight   print the exact config keys to strip before a --force
  *                 install against an older installed manifest
- *   --probe       spend one cheap turn proving the pool answers end-to-end
+ *   --probe       spend one cheap turn per account (plus the pool) proving
+ *                 each login answers end-to-end
+ *   --probe-pool  with --probe: the pool ref only, one turn total
+ *   --raw         print login emails and session keys unmasked
+ *   --verbose     list allowlist rungs, per-account verdicts, every surface
  *
  * Exit code: 0 all good, 1 any ❌.
  */
@@ -63,6 +69,11 @@ const STATE_DIR = join(HOME, ".openclaw", "state", "multi-clawd");
 const REPO_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 const args = new Set(process.argv.slice(2));
+// Hoisted: doctor output is pasted into issues and support threads, so every
+// section that can print an identifying value (login emails in §4/§6, session
+// keys in §7) masks by default and honours the same single --raw opt-in.
+const VERBOSE = process.env.DOCTOR_VERBOSE === "1" || args.has("--verbose");
+const RAW = process.env.DOCTOR_RAW === "1" || args.has("--raw");
 let failures = 0;
 const ok = (msg) => console.log(`  ✅ ${msg}`);
 const warn = (msg) => console.log(`  ⚠️  ${msg}`);
@@ -86,6 +97,35 @@ function readJson(path) {
   }
 }
 
+/**
+ * Import a compiled module, preferring the INSTALLED plugin so findings
+ * describe the artifact that actually runs — but falling back to this
+ * checkout when the installed copy predates an export doctor needs.
+ *
+ * The fallback is the point: a bare `import(EXT).catch(() => import(REPO))`
+ * only catches a missing FILE. An older installed dist that loads fine but
+ * lacks a newly added export produced `X is not a function` mid-report, with
+ * every earlier section already printed as if all was well.
+ */
+async function importDist(file, required = [], prefer = "installed") {
+  // `prefer: "cli"` for pure static analysis (the chain audits): that logic is
+  // doctor's own, so it must run at the CLI's version. Mixing the two — a new
+  // section reading the checkout while an older section read the install —
+  // produced two different views of the same config in one report.
+  const dirs = prefer === "cli" ? [REPO_DIR, EXT_DIR] : [EXT_DIR, REPO_DIR];
+  const candidates = dirs.map((d) => join(d, "dist", file));
+  let firstError;
+  for (const path of candidates) {
+    try {
+      const mod = await import(path);
+      if (required.every((name) => typeof mod[name] === "function")) return mod;
+    } catch (err) {
+      firstError ??= err;
+    }
+  }
+  throw firstError ?? new Error(`no usable dist/${file} (missing: ${required.join(", ")})`);
+}
+
 function newestMtime(dir, exts) {
   let newest = 0;
   let newestFile = "";
@@ -240,12 +280,19 @@ try {
 
 // ── 4. account credentials (values never printed) ──────────────────────────
 console.log("account credentials");
-const { checkAccountCredential } = await import(join(EXT_DIR, "dist", "login-health.js")).catch(
-  () => import(join(REPO_DIR, "dist", "login-health.js")),
-);
-const { summarizeWindowUsage } = await import(join(EXT_DIR, "dist", "health.js")).catch(() =>
-  import(join(REPO_DIR, "dist", "health.js")),
-);
+const { checkAccountCredential } = await importDist("login-health.js", ["checkAccountCredential"]);
+const { summarizeWindowUsage, classifyAccountHealth } = await importDist("health.js", [
+  "summarizeWindowUsage",
+  "classifyAccountHealth",
+]);
+const { resolveAccountIdentity, describeIdentity, findDuplicateLogins, maskEmail } =
+  await importDist("account-identity.js", [
+    "resolveAccountIdentity",
+    "describeIdentity",
+    "findDuplicateLogins",
+    "maskEmail",
+  ]);
+const { decideStickySelection } = await importDist("sticky.js", ["decideStickySelection"]);
 const io = {
   readFile: (p) => readFileSync(expandHome(p), "utf8"),
   keychainHasClaudeCredentials: () => {
@@ -260,9 +307,45 @@ const io = {
   },
   platform: process.platform,
 };
+// A native account's child sets no CLAUDE_CONFIG_DIR, so it authenticates
+// against whatever the default dir is in the ENV THE GATEWAY RUNS IN. Doctor
+// reads the same variable and prints the path it used, so a box that exports
+// CLAUDE_CONFIG_DIR globally shows its real source rather than a guess.
+const identityIo = {
+  readFile: (p) => readFileSync(expandHome(p), "utf8"),
+  expandHome,
+  defaultConfigDir: process.env.CLAUDE_CONFIG_DIR
+    ? expandHome(process.env.CLAUDE_CONFIG_DIR)
+    : join(HOME, ".claude"),
+};
 const accounts = pluginConfig.accounts ?? [];
+const identities = [];
 if (accounts.length === 0) warn("no accounts configured");
 for (const account of accounts) {
+  // WHO this account is, before WHETHER its credential works. An id is a
+  // label the operator chose; the login is the thing quota is spent against,
+  // and the two drift apart silently (a config dir re-logged-in as the wrong
+  // user looks perfectly healthy on every other line of this report).
+  const identity = resolveAccountIdentity(account, identityIo);
+  identities.push(identity);
+  const source = account.native
+    ? `native login, ${identityIo.defaultConfigDir}`
+    : account.configDir
+      ? `config dir ${account.configDir}`
+      : account.oauthTokenFile
+        ? "token file"
+        : account.oauthTokenRef
+          ? "token ref"
+          : "no declared source";
+  if (identity.status === "resolved") {
+    note(`${account.id} → ${describeIdentity(identity, { raw: RAW })} (${source})`);
+  } else if (account.oauthTokenFile || account.oauthTokenRef) {
+    // Expected, not a fault: the identity is inside the token. Proving it
+    // would cost a real turn, which doctor does not spend unless --probe.
+    note(`${account.id} → login not knowable at rest (${source}) — ${identity.reason}`);
+  } else {
+    warn(`${account.id}: cannot tell which Claude login this is — ${identity.reason}`);
+  }
   // RUNTIME credential health first: the source check below only proves a
   // credential EXISTS, and #8 is exactly the case where a present credential
   // is a session the Claude CLI has already rejected. A recorded runtime
@@ -287,6 +370,29 @@ for (const account of accounts) {
   else bad(`${account.id}: ${check.reason}`);
 }
 
+// Two ids, one login. This is the failure the rest of doctor cannot see: every
+// section still says READY while "failover" rotates onto the quota it just
+// exhausted. Scoped to pool members when a pool exists — outside a pool,
+// sharing a login is a legitimate way to run two profiles of one account.
+{
+  const poolMembers = pluginConfig.pool?.accounts;
+  const scoped = Array.isArray(poolMembers)
+    ? identities.filter((i) => poolMembers.includes(i.accountId))
+    : identities;
+  for (const dupe of findDuplicateLogins(scoped)) {
+    const who = dupe.email
+      ? ` (${RAW ? dupe.email : maskEmail(dupe.email)})`
+      : "";
+    bad(
+      `${dupe.accountIds.join(" and ")} are the SAME Claude login${who} — rotating between them ` +
+        `buys no extra quota. Log one of them into a different account (\`multi-clawd login <account>\`).`,
+    );
+  }
+  if (scoped.filter((i) => i.status === "resolved").length > 1 && findDuplicateLogins(scoped).length === 0) {
+    ok("pool accounts are distinct Claude logins");
+  }
+}
+
 // ── 5. telemetry state ──────────────────────────────────────────────────────
 console.log("rate-limit telemetry");
 for (const account of accounts) {
@@ -333,8 +439,62 @@ else {
   if (members.length < 2) bad(`pool "${pool.id ?? "clawd"}" has ${members.length} valid member(s); needs ≥ 2`);
   else ok(`pool "${pool.id ?? "clawd"}": ${members.join(" → ")}`);
   const sticky = readJson(join(STATE_DIR, `pool-${pool.id ?? "clawd"}.sticky.json`));
-  if (sticky) warn(`pool is currently stuck to ${sticky.account} (since ${new Date(sticky.since).toISOString()})`);
-  else ok("no sticky — pool is on its home account");
+
+  // WHICH ACCOUNT IS ACTUALLY BEING USED. Everything above describes the pool
+  // as configured; this answers the question an operator actually asks — whose
+  // subscription does the next turn spend? Re-run the real selection (the same
+  // classify → sticky-dwell decision index.ts makes at launch) rather than
+  // inferring it from the sticky file, because "no sticky" means home, a live
+  // sticky can be about to expire, and health outranks both.
+  if (members.length > 0) {
+    const now = Date.now();
+    const verdicts = members.map((id) => ({
+      id,
+      verdict: classifyAccountHealth(
+        readJson(join(STATE_DIR, `${id}.json`)),
+        {
+          staleAfterMs: pool.staleAfterMs,
+          utilizationThreshold: pool.utilizationThreshold,
+          rotateOnOverage: pool.rotateOnOverage,
+        },
+        now,
+      ).verdict,
+    }));
+    const decision = decideStickySelection({
+      verdicts,
+      sticky,
+      nowMs: now,
+      minDwellMs: pool.minDwellMs,
+    });
+    const identity = identities.find((i) => i.accountId === decision.account);
+    const who =
+      identity?.status === "resolved" ? ` (${describeIdentity(identity, { raw: RAW })})` : "";
+    const verdict = verdicts.find((v) => v.id === decision.account)?.verdict ?? "no_data";
+    const home = members[0];
+    if (decision.account === home) {
+      ok(`serving on ${decision.account}${who} — home account, health ${verdict}`);
+      if (sticky) {
+        note(
+          `sticky to ${sticky.account} (since ${new Date(sticky.since).toISOString()}) is spent — ` +
+            `the next turn returns home`,
+        );
+      }
+    } else {
+      // Rotated away from home is normal operation, not a fault: warn so it is
+      // visible, never bad, or a healthy rotation would flip READY.
+      warn(
+        `serving on ${decision.account}${who} — ROTATED off home (${home} is ${
+          verdicts[0].verdict
+        })${sticky ? `, sticky since ${new Date(sticky.since).toISOString()}` : ""}`,
+      );
+    }
+    // The launch decision is model-aware (a 429 can bench one account for one
+    // model only); doctor has no model in hand, so this is the account-wide
+    // answer. Say so rather than let a model-scoped exception read as a lie.
+    if (VERBOSE) {
+      note(`account-wide verdicts: ${verdicts.map((v) => `${v.id}:${v.verdict}`).join(" ")}`);
+    }
+  }
 }
 
 // ── 7. effective chain (pool-bypass sweep — CASE 1 config + CASE 2 session) ──
@@ -356,18 +516,19 @@ console.log("effective chain");
 if (!pool) {
   // No clawd pool ⇒ nothing to bypass; skip the whole section (mirrors §6).
 } else {
-  const { auditEffectiveChain, auditSessionOverrides, maskSessionKey } = await import(
-    join(EXT_DIR, "dist", "chain-audit.js")
-  ).catch(() => import(join(REPO_DIR, "dist", "chain-audit.js")));
+  const { auditEffectiveChain, auditSessionOverrides, maskSessionKey } = await importDist(
+    "chain-audit.js",
+    ["auditEffectiveChain", "auditSessionOverrides", "maskSessionKey"],
+    "cli",
+  );
   const poolId = pool.id ?? "clawd";
-  const verbose = process.env.DOCTOR_VERBOSE === "1" || process.argv.includes("--verbose");
   // Session keys embed the operator's private channel id (e.g. a Telegram chat
   // id). Mask the id tail by default so doctor output is safe to paste into
-  // issues/support threads; `--raw` restores full keys for local exact-match
-  // debugging. Only case-2 session surfaces carry a key; config surfaces don't.
-  const raw = process.env.DOCTOR_RAW === "1" || process.argv.includes("--raw");
+  // issues/support threads; `--raw` (hoisted, shared with the login identities
+  // in §4/§6) restores full keys for local exact-match debugging. Only case-2
+  // session surfaces carry a key; config surfaces don't.
   const renderSurface = (surface) =>
-    raw ? surface : surface.replace(/^session (.+)$/, (_m, k) => `session ${maskSessionKey(k)}`);
+    RAW ? surface : surface.replace(/^session (.+)$/, (_m, k) => `session ${maskSessionKey(k)}`);
 
   // ── case 1: config-level refs ──────────────────────────────────────────────
   const findings = auditEffectiveChain(config, poolId);
@@ -380,7 +541,7 @@ if (!pool) {
   // them. A dead-noisy section trains people to skip it — the opposite of the
   // point. (Live-tier bypasses above are always listed in full.)
   if (notes.length > 0) {
-    if (verbose) {
+    if (VERBOSE) {
       for (const f of notes) {
         note(`${f.surface}: ${f.ref} (allowlist entry, not a live tier) ${f.reason}`);
       }
@@ -398,9 +559,10 @@ if (!pool) {
   // where and the how). A store that is expected but absent/unreadable gets a
   // LOUD skip — never a silent pass; a missed off-pool pin is worse than an
   // extra line.
-  const { locateSessionStore, readSessionStore } = await import(
-    join(EXT_DIR, "dist", "session-store.js")
-  ).catch(() => import(join(REPO_DIR, "dist", "session-store.js")));
+  const { locateSessionStore, readSessionStore } = await importDist("session-store.js", [
+    "locateSessionStore",
+    "readSessionStore",
+  ]);
   const AGENTS_DIR = join(HOME, ".openclaw", "agents");
   const stores = [];
   try {
@@ -436,7 +598,107 @@ if (!pool) {
   }
 }
 
-// ── 8. watchdog ─────────────────────────────────────────────────────────────
+// ── 8. chain auth — can each non-Claude rung actually authenticate? ─────────
+//
+// §7 proves the chain is ROUTED correctly. It says nothing about whether the
+// rungs it routes to hold a credential. A fallback whose provider has no
+// eligible auth profile is a rung that does not exist, and the gap only shows
+// up at the moment the tier above it dies — the one moment it was supposed to
+// help. The auth store is read through the documented CLI (`models auth list
+// --json`), never by guessing at its on-disk shape, and cached because that
+// call costs seconds.
+console.log("chain auth");
+{
+  const { auditChainAuth } = await importDist("chain-auth.js", ["auditChainAuth"], "cli");
+  const { collectChainRefs } = await importDist("chain-audit.js", ["collectChainRefs"], "cli");
+  const AUTH_CACHE_TTL_MS = 15 * 60 * 1000;
+  const agentIds = Object.keys(config?.agents?.entries ?? {});
+  // Which store answers for a surface that names no agent (agents.defaults,
+  // cron sections): the default agent. `main` when it exists, else the first
+  // configured entry — the same fallback the CLI applies.
+  const defaultAgent = agentIds.includes("main") ? "main" : agentIds[0];
+
+  function ownerOf(surface) {
+    const entry = surface.match(/^agents\.entries\.([^.]+)\./)?.[1];
+    if (entry) return entry;
+    const list = surface.match(/^agents\.list\[([^\]]+)\]/)?.[1];
+    if (list && agentIds.includes(list)) return list;
+    const named = surface.match(/^agents\.([^.]+)\./)?.[1];
+    if (named && agentIds.includes(named)) return named;
+    return defaultAgent;
+  }
+
+  function loadProfiles(agentId) {
+    const cacheFile = join(STATE_DIR, `auth-profiles-${agentId}.json`);
+    const cached = readJson(cacheFile);
+    if (cached && Date.now() - (cached.checkedAt ?? 0) < AUTH_CACHE_TTL_MS) {
+      return { profiles: cached.profiles ?? [], cached: true };
+    }
+    try {
+      const out = execFileSync(
+        "openclaw",
+        ["models", "auth", "list", "--agent", agentId, "--json"],
+        { encoding: "utf8", timeout: 30000, stdio: ["ignore", "pipe", "ignore"] },
+      );
+      const profiles = JSON.parse(out)?.profiles ?? [];
+      try {
+        mkdirSync(STATE_DIR, { recursive: true });
+        writeFileSync(
+          cacheFile,
+          JSON.stringify({ profiles, checkedAt: Date.now() }, null, 2) + "\n",
+        );
+      } catch {
+        /* cache is an optimisation, never a requirement */
+      }
+      return { profiles, cached: false };
+    } catch (err) {
+      // A LOUD skip. Silently passing here would turn "doctor could not read
+      // the auth store" into "the chain is fine", which is the failure class
+      // this whole section exists to remove.
+      return { error: String(err).split("\n")[0].slice(0, 160) };
+    }
+  }
+
+  const refs = collectChainRefs(config ?? {});
+  const byAgent = new Map();
+  for (const ref of refs) {
+    const agentId = ownerOf(ref.surface);
+    if (!agentId) continue;
+    const list = byAgent.get(agentId) ?? [];
+    list.push(ref);
+    byAgent.set(agentId, list);
+  }
+  if (byAgent.size === 0) {
+    note("no chain refs to check");
+  }
+  for (const [agentId, agentRefs] of [...byAgent.entries()].sort()) {
+    const loaded = loadProfiles(agentId);
+    if (loaded.error) {
+      warn(`chain-auth check SKIPPED for agent ${agentId} — auth store unreadable (${loaded.error})`);
+      continue;
+    }
+    const findings = auditChainAuth({
+      refs: agentRefs,
+      profiles: loaded.profiles,
+      order: config?.auth?.order,
+      poolId: pluginConfig.pool?.id ?? "clawd",
+      nowMs: Date.now(),
+    });
+    if (findings.length === 0) {
+      ok(`${agentId}: every live non-Claude rung has a usable auth profile`);
+      continue;
+    }
+    for (const f of findings) {
+      const where = VERBOSE ? ` [${f.surfaces.join(", ")}]` : ` [${f.surfaces[0]}${f.surfaces.length > 1 ? ` +${f.surfaces.length - 1}` : ""}]`;
+      const line = `${agentId}: ${f.provider}${where} — ${f.reason}`;
+      if (f.severity === "bad") bad(line);
+      else if (f.severity === "warn") warn(line);
+      else note(line);
+    }
+  }
+}
+
+// ── 9. watchdog ─────────────────────────────────────────────────────────────
 console.log("eviction watchdog");
 let watchdogFound = false;
 try {
@@ -494,22 +756,63 @@ if (watchdogFound) {
   } else ok("watchdog scheduled");
 } else warn("no watchdog found (needed until openclaw#107596 ships — see README)");
 
-// ── 9. optional live probe ──────────────────────────────────────────────────
+// ── 10. optional live probe ─────────────────────────────────────────────────
 if (args.has("--probe")) {
-  console.log("live probe (spends one turn)");
-  const ref = pool ? `${pool.id ?? "clawd"}/${pool.defaultModel ?? "claude-fable-5"}` : accounts[0] ? `${accounts[0].id}/claude-fable-5` : undefined;
-  if (!ref) bad("nothing to probe");
-  else {
+  // EVERY account, not just the pool ref. The pool ref proves whichever
+  // account selection happens to pick right now — so a dead second account
+  // stayed invisible until the day rotation needed it, which is the day it
+  // could least afford to be wrong. One turn per account plus one for the
+  // pool; `--probe-pool` keeps the old single-turn behaviour.
+  const model = pool?.defaultModel ?? "claude-fable-5";
+  const targets = [];
+  if (pool) targets.push({ label: `pool ${pool.id ?? "clawd"}`, ref: `${pool.id ?? "clawd"}/${model}` });
+  if (!args.has("--probe-pool")) {
+    for (const account of accounts) targets.push({ label: account.id, ref: `${account.id}/${model}` });
+  }
+  console.log(`live probe (spends ${targets.length} turn${targets.length === 1 ? "" : "s"})`);
+  if (targets.length === 0) bad("nothing to probe");
+  for (const target of targets) {
     try {
       const out = execFileSync(
         "openclaw",
-        ["agent", "--agent", "main", "--session-key", "agent:main:mc-doctor-probe", "--model", ref, "--json", "--message", "Reply with exactly this line and nothing else: MC_DOCTOR_OK. Do not use any tools."],
-        { encoding: "utf8", timeout: 180000 },
+        [
+          "agent",
+          "--agent",
+          "main",
+          // Per-target session key: one shared key would resume the previous
+          // probe's session, and a resumed Claude session can answer from the
+          // account that STARTED it — the probe would then prove the wrong
+          // account while looking perfectly green.
+          "--session-key",
+          `agent:main:mc-doctor-probe:${target.ref.replace(/[^a-z0-9]+/gi, "-")}`,
+          "--model",
+          target.ref,
+          "--json",
+          "--message",
+          "Reply with exactly this line and nothing else: MC_DOCTOR_OK. Do not use any tools.",
+        ],
+        // stderr captured, not inherited: a refusal is classified below and
+        // reported as one line, instead of dumping the CLI's own error block
+        // into the middle of the report.
+        { encoding: "utf8", timeout: 180000, stdio: ["ignore", "pipe", "pipe"] },
       );
-      if (out.includes("MC_DOCTOR_OK")) ok(`${ref} answered end-to-end`);
-      else bad(`${ref} probe returned unexpected output`);
+      if (out.includes("MC_DOCTOR_OK")) ok(`${target.label}: ${target.ref} answered end-to-end`);
+      else bad(`${target.label}: ${target.ref} probe returned unexpected output`);
     } catch (err) {
-      bad(`${ref} probe failed: ${String(err).slice(0, 200)}`);
+      const text = String(err.stderr ?? "") + String(err.stdout ?? "") + String(err);
+      // A model-policy refusal says nothing about the ACCOUNT: the gateway
+      // declined the ref before any login was used. Reporting it as a probe
+      // failure would accuse a perfectly healthy account (pool members are
+      // normally reached through `<pool>/*`, so a direct `claw<N>/…` ref is
+      // often simply not allowlisted).
+      if (/modelPolicy\.allow/.test(text)) {
+        warn(
+          `${target.label}: not probed — \`${target.ref}\` is blocked by agents.defaults.modelPolicy.allow. ` +
+            `Add \`${target.ref.split("/")[0]}/*\` to probe this account directly; its pool routing is unaffected.`,
+        );
+      } else {
+        bad(`${target.label}: ${target.ref} probe failed: ${String(err).slice(0, 200)}`);
+      }
     }
   }
 }