@drakon-systems/multi-clawd 1.8.8 → 1.8.10

package/README.md

@@ -369,7 +369,7 @@ openclaw plugins install (Get-Location).Path
 **Or let your agent install it.** Running an OpenClaw assistant or Claude
 Code on the target machine already? Paste it this and go make coffee:
 
-> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.8.8/SETUP-AGENT.md
+> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.8.10/SETUP-AGENT.md
 > and follow it to set up multi-clawd on this machine. I own a second
 > Claude account — ask me when you need me to log in.
 

package/dist/index.js

@@ -18,7 +18,7 @@ import { healthStateFile, clearAccountCredentialFailure } from "./credential-sta
 export { healthStateFile, clearAccountCredentialFailure };
 import { buildAccountChildEnv, tokenFileModeWarning, validateAccountTokenSources, } from "./account-env.js";
 import { diffCatalogModels, formatNewModelNotice, } from "./model-currency.js";
-import { checkAccountCredential, createRefProbeTracker, } from "./login-health.js";
+import { checkAccountCredential, keychainServiceForConfigDir, createRefProbeTracker, } from "./login-health.js";
 import { execFileSync } from "node:child_process";
 const CLI_FRESH_WATCHDOG_DEFAULTS = {
     noOutputTimeoutRatio: 0.8,
@@ -151,19 +151,19 @@ const LOGIN_PROBE_INTERVAL_MS = 15 * 60 * 1000;
 const LOGIN_PROBE_INITIAL_DELAY_MS = 45 * 1000;
 const realCredentialIo = {
     readFile: (p) => readFileSync(expandHome(p), "utf8"),
-    keychainHasClaudeCredentials: () => {
-        try {
-            execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
-                stdio: "ignore",
-            });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    },
+    keychainHasClaudeCredentials: () => keychainHasService("Claude Code-credentials"),
+    keychainHasClaudeCredentialsForDir: (dir) => keychainHasService(keychainServiceForConfigDir(expandHome(dir))),
     platform: process.platform,
 };
+function keychainHasService(service) {
+    try {
+        execFileSync("security", ["find-generic-password", "-s", service], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const refProbeTrackers = new Map();
 const lastProbeStatus = new Map();
 function recordAccountCredentialFailure(accountId, reason, nowMs) {
@@ -437,6 +437,10 @@ async function buildAccountEnv(account, resolver) {
     const token = await resolveTokenAsync(account, resolver);
     return buildAccountChildEnv(account, token, healthStateFile(account.id));
 }
+export function isRuntimelessRegistration(api) {
+    const mode = api?.registrationMode;
+    return mode === "cli-metadata" || mode === "setup-only";
+}
 function buildCatalogProvider(account) {
     return {
         id: account.id,
@@ -466,6 +470,8 @@ export default definePluginEntry({
     name: "multi-clawd",
     description: "Register additional Claude Code logins as first-class OpenClaw CLI backends for cross-account failover.",
     register(api) {
+        if (isRuntimelessRegistration(api))
+            return;
         const runtimeConfigLoader = api.runtime?.config?.current
             ? () => api.runtime.config.current()
             : undefined;

package/dist/login-health.js

@@ -1,3 +1,8 @@
+import { createHash } from "node:crypto";
+export function keychainServiceForConfigDir(absDir) {
+    const hash = createHash("sha256").update(absDir).digest("hex").slice(0, 8);
+    return `Claude Code-credentials-${hash}`;
+}
 export function createRefProbeTracker(options = {}) {
     const deadAfterConsecutive = options.deadAfterConsecutive ?? 3;
     const deadAfterMs = options.deadAfterMs ?? 10 * 60 * 1000;
@@ -87,7 +92,16 @@ export function checkAccountCredential(account, io) {
         return checkCredentialsJson(io, "~/.claude");
     }
     if (account.configDir) {
-        return checkCredentialsJson(io, account.configDir);
+        if (io.platform === "darwin" && io.keychainHasClaudeCredentialsForDir(account.configDir)) {
+            return { status: "ok" };
+        }
+        const file = checkCredentialsJson(io, account.configDir);
+        if (file.status === "ok" || io.platform !== "darwin")
+            return file;
+        return {
+            status: "broken",
+            reason: `keychain has no Claude Code credentials for ${account.configDir} and ${file.reason}`,
+        };
     }
     return { status: "unknown" };
 }

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "multi-clawd",
   "name": "multi-clawd",
-  "version": "1.8.8",
+  "version": "1.8.10",
   "description": "Register additional Claude Code logins (Max/Pro accounts) as first-class OpenClaw CLI backends for cross-account failover, keeping the full skills/MCP harness on every account.",
   "cliBackends": [
     "claw1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/multi-clawd",
-  "version": "1.8.8",
+  "version": "1.8.10",
   "description": "Multi-account Claude Code failover for OpenClaw — register additional Claude (Max/Pro) logins as first-class CLI backends and keep the full skills/MCP harness across every account. Also imports those accounts' setup tokens into Hermes Agent's Anthropic credential pool.",
   "type": "module",
   "license": "MIT",

package/scripts/doctor.mjs

@@ -280,7 +280,10 @@ try {
 
 // ── 4. account credentials (values never printed) ──────────────────────────
 console.log("account credentials");
-const { checkAccountCredential } = await importDist("login-health.js", ["checkAccountCredential"]);
+const { checkAccountCredential, keychainServiceForConfigDir } = await importDist("login-health.js", [
+  "checkAccountCredential",
+  "keychainServiceForConfigDir",
+]);
 const { summarizeWindowUsage, classifyAccountHealth } = await importDist("health.js", [
   "summarizeWindowUsage",
   "classifyAccountHealth",
@@ -295,18 +298,20 @@ const { resolveAccountIdentity, describeIdentity, findDuplicateLogins, maskEmail
 const { decideStickySelection } = await importDist("sticky.js", ["decideStickySelection"]);
 const io = {
   readFile: (p) => readFileSync(expandHome(p), "utf8"),
-  keychainHasClaudeCredentials: () => {
-    try {
-      execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
-        stdio: "ignore",
-      });
-      return true;
-    } catch {
-      return false;
-    }
-  },
+  keychainHasClaudeCredentials: () => keychainHasService("Claude Code-credentials"),
+  keychainHasClaudeCredentialsForDir: (dir) =>
+    keychainHasService(keychainServiceForConfigDir(expandHome(dir))),
   platform: process.platform,
 };
+// Metadata-only probe (no `-w`): the secret is never read.
+function keychainHasService(service) {
+  try {
+    execFileSync("security", ["find-generic-password", "-s", service], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
 // A native account's child sets no CLAUDE_CONFIG_DIR, so it authenticates
 // against whatever the default dir is in the ENV THE GATEWAY RUNS IN. Doctor
 // reads the same variable and prints the path it used, so a box that exports