@drakon-systems/multi-clawd 1.9.8 → 2.0.0

package/dist/index.js

@@ -7,7 +7,7 @@ import { MODEL_ALIASES, buildCatalogEntries, canonicalModelId, isModernClaudeMod
 import { decideDegradation, matchesPin } from "./degrade.js";
 import { resolveExecMode, permissionModeArgs } from "./exec-policy.js";
 import { resolveBaseModelIds } from "./catalog-source.js";
-import { allCredentialFailed, classifyAccountHealth, overdueProbeAccount, } from "./health.js";
+import { allCredentialFailed, classifyAccountHealth, lastAuthSuccessAt, overdueProbeAccount, } from "./health.js";
 import { decideStickySelection } from "./sticky.js";
 import { mergeHealthStates, parseStoredState, recordCredentialFailure, } from "./shim-core.js";
 import { createTokenRefResolver, isSecretRefShape, } from "./token-resolution.js";
@@ -16,12 +16,13 @@ import { resolvePoolExecutionArgs } from "./tool-cap.js";
 import { RETRY_ROSTER_ENV } from "./retry-plan.js";
 import { SESSION_DIRS_ENV } from "./session-handover.js";
 import { addAlert, alertKeysWithPrefix, clearAlert, pendingAlertText, } from "./alerts.js";
-import { healthStateFile, clearAccountCredentialFailure } from "./credential-state.js";
-export { healthStateFile, clearAccountCredentialFailure };
-import { accountConfigDir, buildAccountChildEnv, tokenFileModeWarning, validateAccountTokenSources, } from "./account-env.js";
+import { healthStateFile, usageStateFile, clearAccountCredentialFailure } from "./credential-state.js";
+import { createUsagePollController, effectiveUsagePollInterval, effectiveUsageWarnThreshold, usageAlertPrefix, usagePoolAlertKey, } from "./usage-poll.js";
+export { healthStateFile, usageStateFile, clearAccountCredentialFailure };
+import { accountConfigDir, AccountCredentialError, buildAccountChildEnv, credentialFailureText, parseSetupTokenFile, tokenFileModeWarning, validateAccountTokenSources, } from "./account-env.js";
 import { diffCatalogModels, formatNewModelNotice, } from "./model-currency.js";
-import { checkAccountCredential, keychainServiceForConfigDir, createRefProbeTracker, } from "./login-health.js";
-import { execFileSync } from "node:child_process";
+import { assessAccountCredential, createRefProbeTracker, } from "./login-health.js";
+import { createSystemCredentialIo } from "./credential-store.js";
 import { collectDirectMembers } from "./direct-route.js";
 import { createDirectOrderController, isValidAgentId } from "./direct-sync.js";
 import { createOpenclawRunner } from "./openclaw-runner.js";
@@ -155,21 +156,7 @@ function ingestAlertSpool() {
 }
 const LOGIN_PROBE_INTERVAL_MS = 15 * 60 * 1000;
 const LOGIN_PROBE_INITIAL_DELAY_MS = 45 * 1000;
-const realCredentialIo = {
-    readFile: (p) => readFileSync(expandHome(p), "utf8"),
-    keychainHasClaudeCredentials: () => keychainHasService("Claude Code-credentials"),
-    keychainHasClaudeCredentialsForDir: (dir) => keychainHasService(keychainServiceForConfigDir(expandHome(dir))),
-    platform: process.platform,
-};
-function keychainHasService(service) {
-    try {
-        execFileSync("security", ["find-generic-password", "-s", service], { stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+let realCredentialIo;
 const refProbeTrackers = new Map();
 const lastProbeStatus = new Map();
 function recordAccountCredentialFailure(accountId, reason, nowMs) {
@@ -194,7 +181,8 @@ function recordAccountCredentialFailure(accountId, reason, nowMs) {
 export async function runLoginHealthProbe(accounts, logger, deps = {}) {
     const now = deps.nowMs ?? Date.now();
     const resolver = deps.resolver ?? activeTokenResolver;
-    const io = deps.io ?? realCredentialIo;
+    const io = deps.io ?? (realCredentialIo ??= createSystemCredentialIo());
+    const readHealth = deps.readHealth ?? readHealthState;
     for (const account of accounts) {
         let status;
         let reason;
@@ -214,9 +202,12 @@ export async function runLoginHealthProbe(accounts, logger, deps = {}) {
             cause = outcome.cause;
         }
         else {
-            const check = checkAccountCredential(account, io);
+            const check = assessAccountCredential(account, io, {
+                proof: { lastSuccessAt: lastAuthSuccessAt(readHealth(account.id)) },
+                nowMs: now,
+            });
             status = check.status;
-            reason = check.reason;
+            reason = check.status === "ok" ? check.detail : check.reason;
         }
         const previous = lastProbeStatus.get(account.id);
         lastProbeStatus.set(account.id, status);
@@ -242,14 +233,30 @@ export async function runLoginHealthProbe(accounts, logger, deps = {}) {
             logger.error(`[multi-clawd] ${text}`);
             raiseAlert({ key: `login:${account.id}`, severity: "error", text });
         }
+        else if (status === "unverified" && previous !== "unverified") {
+            logger.info(`[multi-clawd] account "${account.id}" login unverified: ${reason ?? "unproven"}`);
+        }
+        else if (status === "unknown" && previous !== "unknown" && reason) {
+            logger.info(`[multi-clawd] account "${account.id}" login could not be checked: ${reason}`);
+        }
         else if (status === "degraded" && previous !== "degraded") {
             logger.info(`[multi-clawd] account "${account.id}" login degraded: ${reason ?? "resolver error"}`);
         }
+        else if (status === "ok" && previous === "unverified") {
+            logger.info(`[multi-clawd] account "${account.id}" login verified: ${reason ?? "ok"}`);
+        }
         else if (status === "ok" && (previous === "broken" || previous === "degraded")) {
             logger.info(`[multi-clawd] account "${account.id}" login recovered`);
             alertState = clearAlert(alertState, `login:${account.id}`);
             alertState = clearAlert(alertState, `login-resolver:${account.id}`);
         }
+        if (status === "ok") {
+            alertState = clearAlert(alertState, `login:${account.id}`);
+            alertState = clearAlert(alertState, `login-resolver:${account.id}`);
+        }
+        else if ((status === "unverified" || status === "unknown") && cause === undefined) {
+            alertState = clearAlert(alertState, `login:${account.id}`);
+        }
     }
 }
 export function startLoginHealthProbe(accounts, logger) {
@@ -289,7 +296,20 @@ function peekToken(account) {
     if (account.oauthTokenFile) {
         const path = expandHome(account.oauthTokenFile);
         warnIfTokenFileExposed(path);
-        return readFileSync(path, "utf8").trim();
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            const code = err.code;
+            throw new AccountCredentialError(`[multi-clawd] account "${account.id}": token file ${account.oauthTokenFile} unreadable` +
+                (typeof code === "string" ? ` (${code})` : ""));
+        }
+        const read = parseSetupTokenFile(raw, `token file ${account.oauthTokenFile}`);
+        if ("error" in read) {
+            throw new AccountCredentialError(`[multi-clawd] account "${account.id}": ${read.error}`);
+        }
+        return read.token;
     }
     if (isSecretRefShape(account.oauthTokenRef)) {
         return activeTokenResolver?.peek(account.oauthTokenRef);
@@ -449,13 +469,16 @@ export function buildRetryRoster(members, launchedId) {
     for (const member of members) {
         if (member.id === launchedId)
             continue;
-        if (member.oauthTokenFile || member.oauthTokenRef)
+        const tokenFile = !member.native && member.oauthTokenFile ? expandHome(member.oauthTokenFile) : undefined;
+        if (!member.native && !tokenFile && member.oauthTokenRef)
+            continue;
+        if (!member.native && !tokenFile && !member.configDir)
             continue;
         const stateFile = healthStateFile(member.id);
-        const env = buildAccountChildEnv(member, undefined, stateFile);
+        const env = buildAccountChildEnv({ ...member, oauthTokenFile: undefined, oauthTokenRef: undefined }, undefined, stateFile);
         delete env.MULTI_CLAWD_ACCOUNT_ID;
         delete env.MULTI_CLAWD_STATE_FILE;
-        roster.push({ id: member.id, stateFile, env });
+        roster.push({ id: member.id, stateFile, env, ...(tokenFile ? { tokenFile } : {}) });
     }
     return roster;
 }
@@ -582,18 +605,34 @@ export default definePluginEntry({
                 },
                 logger,
             });
+            startUsagePoll({
+                accounts: accounts.filter((a) => seen.has(a.id.trim())),
+                pool: cfg.pool,
+                registrationMode: api.registrationMode,
+                logger,
+            });
         }
         api.logger.info(`[multi-clawd] registered ${seen.size} backend(s)+provider(s): ${[...seen].join(", ")}`);
     },
 });
 function readHealthState(accountId) {
+    return mergeStoredHealth(readStateFileLenient(healthStateFile(accountId)), readStateFileLenient(usageStateFile(accountId)));
+}
+function readStateFileLenient(file) {
     try {
-        return JSON.parse(readFileSync(healthStateFile(accountId), "utf8"));
+        return JSON.parse(readFileSync(file, "utf8"));
     }
     catch {
         return undefined;
     }
 }
+function mergeStoredHealth(shim, usage) {
+    if (!shim)
+        return usage;
+    if (!usage)
+        return shim;
+    return mergeHealthStates(shim, usage);
+}
 function readStickyEntry(file) {
     try {
         const parsed = JSON.parse(readFileSync(file, "utf8"));
@@ -699,6 +738,10 @@ export function registerPoolBackend(api, pool, accounts, registeredIds, execMode
                 `launching on ${decision.account} to re-test a rejection last seen ` +
                 `${Math.round((now - observedAt) / 3600000)}h ago`);
         }
+        else if (poolVerdicts.find((v) => v.id === decision.account)?.verdict === "credential_unverified") {
+            logger.info(`[multi-clawd] pool ${poolId}: no proven account can serve ${requestedModel} — ` +
+                `launching on ${decision.account} to re-test a login last rejected by the Claude CLI`);
+        }
         else if (decision.account !== previousAccount) {
             const home = verdicts[0];
             const line = decision.account === members[0].id
@@ -743,6 +786,13 @@ export function registerPoolBackend(api, pool, accounts, registeredIds, execMode
                     text: `pool ${poolId}: account "${v.id}" is excluded — ${v.health.reason ?? "its login was rejected by the Claude CLI"}. Fix with \`multi-clawd login ${v.id}\`.`,
                 });
             }
+            else if (v.health.verdict === "credential_unverified") {
+                raiseAlert({
+                    key,
+                    severity: "error",
+                    text: `pool ${poolId}: account "${v.id}" is unproven — ${v.health.reason ?? "its login was last rejected by the Claude CLI"}. Fix with \`multi-clawd login ${v.id}\`.`,
+                });
+            }
             else {
                 alertState = clearAlert(alertState, key);
             }
@@ -757,6 +807,7 @@ export function registerPoolBackend(api, pool, accounts, registeredIds, execMode
             try {
                 env = await buildAccountEnv(candidate, deps?.resolver);
                 launched = candidate;
+                alertState = clearAlert(alertState, `credential-unresolved:${candidate.id}`);
                 if (candidate.id !== chosen.id) {
                     logger.warn(`[multi-clawd] pool ${poolId}: ${chosen.id}'s credential did not resolve — ` +
                         `launching on ${candidate.id} instead (account not benched; secret provider may be down)`);
@@ -764,7 +815,14 @@ export function registerPoolBackend(api, pool, accounts, registeredIds, execMode
                 break;
             }
             catch (err) {
-                unresolved.push(`${candidate.id} (${err.message})`);
+                const why = credentialFailureText(err);
+                unresolved.push(`${candidate.id} (${why})`);
+                raiseAlert({
+                    key: `credential-unresolved:${candidate.id}`,
+                    severity: "error",
+                    text: `pool ${poolId}: account "${candidate.id}" was skipped — its declared credential did ` +
+                        `not resolve, so it will not launch on any other login (${why})`,
+                });
             }
         }
         if (!env) {
@@ -898,3 +956,133 @@ export function startDirectOrderSync(params) {
 export async function runDirectOrderTickNow() {
     return directController?.tick();
 }
+let usageTimer;
+let usageInitial;
+let usageController;
+export function stopUsagePoll() {
+    if (usageTimer)
+        clearInterval(usageTimer);
+    if (usageInitial)
+        clearTimeout(usageInitial);
+    usageTimer = undefined;
+    usageInitial = undefined;
+    usageController = undefined;
+}
+export const USAGE_TOKEN_ACCOUNT_REASON = "setup-token login — the usage endpoint needs the user:profile scope and setup-tokens carry only " +
+    "user:inference, so usage comes from stream telemetry only";
+export function usagePollCredentialsFile(account) {
+    if (account.oauthTokenFile || account.oauthTokenRef) {
+        return { reason: USAGE_TOKEN_ACCOUNT_REASON };
+    }
+    if (!account.native && !account.configDir) {
+        return { reason: "no login dir to read credentials from" };
+    }
+    return { file: join(accountConfigDir(account), ".credentials.json") };
+}
+export function startUsagePoll(params) {
+    const { logger, pool } = params;
+    const mode = params.registrationMode;
+    if (mode !== undefined && mode !== "full")
+        return { active: false, members: [] };
+    if (!pool || pool.usagePoll?.enabled === false) {
+        stopUsagePoll();
+        return { active: false, members: [] };
+    }
+    const poolId = pool.id?.trim() || "clawd";
+    const members = [];
+    const skipped = [];
+    for (const id of pool.accounts ?? []) {
+        const account = params.accounts.find((a) => a.id.trim() === id);
+        if (!account)
+            continue;
+        const source = usagePollCredentialsFile(account);
+        if ("file" in source)
+            members.push({ id: account.id.trim(), credentialsFile: source.file });
+        else
+            skipped.push(`${account.id.trim()} (${source.reason})`);
+    }
+    if (members.length === 0) {
+        stopUsagePoll();
+        if (skipped.length > 0)
+            logger.info(`[multi-clawd] usage poll: no pollable account — ${skipped.join("; ")}`);
+        return { active: false, members: [] };
+    }
+    const intervalMs = effectiveUsagePollInterval(pool.usagePoll);
+    const warnThreshold = effectiveUsageWarnThreshold(pool.usagePoll);
+    const healthOptions = {
+        utilizationThreshold: pool.utilizationThreshold,
+        staleAfterMs: pool.staleAfterMs,
+        rotateOnOverage: pool.rotateOnOverage,
+    };
+    const signature = JSON.stringify({ poolId, members, intervalMs, warnThreshold, healthOptions });
+    if (usageController?.signature === signature && usageController.fetchImpl === params.fetchImpl && usageTimer) {
+        return { active: true, members: members.map((m) => m.id) };
+    }
+    stopUsagePoll();
+    const fetchImpl = params.fetchImpl ?? ((url, init) => fetch(url, init));
+    const controller = createUsagePollController({
+        poolId,
+        members,
+        healthOptions,
+        warnThreshold,
+        io: {
+            readFile: (path) => {
+                try {
+                    return readFileSync(path, "utf8");
+                }
+                catch (err) {
+                    if (err.code === "ENOENT")
+                        return undefined;
+                    throw err;
+                }
+            },
+            readHealth: (id) => {
+                let shim;
+                try {
+                    shim = parseStoredState(readFileSync(healthStateFile(id), "utf8"));
+                    if (!shim)
+                        throw new Error("not valid health-state JSON");
+                }
+                catch (err) {
+                    if (err.code !== "ENOENT")
+                        throw err;
+                    shim = undefined;
+                }
+                let usage;
+                try {
+                    usage = parseStoredState(readFileSync(usageStateFile(id), "utf8"));
+                }
+                catch {
+                    usage = undefined;
+                }
+                return mergeStoredHealth(shim, usage);
+            },
+            writeUsage: (id, state) => {
+                const file = usageStateFile(id);
+                mkdirSync(dirname(file), { recursive: true });
+                const tmp = `${file}.tmp-${process.pid}`;
+                writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+                renameSync(tmp, file);
+            },
+            fetchImpl,
+            raiseAlert: (alert) => raiseAlert(alert),
+            clearAlert: (key) => {
+                alertState = clearAlert(alertState, key);
+            },
+            alertKeysWithPrefix: (prefix) => alertKeysWithPrefix(alertState, prefix),
+            logger,
+        },
+    });
+    usageController = { signature, fetchImpl: params.fetchImpl, tick: controller.tick };
+    const tick = () => void controller.tick().catch((err) => logger.warn(`[multi-clawd] usage poll tick failed: ${String(err)}`));
+    usageInitial = setTimeout(tick, Math.min(20_000, intervalMs));
+    usageInitial.unref?.();
+    usageTimer = setInterval(tick, intervalMs);
+    usageTimer.unref?.();
+    logger.info(`[multi-clawd] usage poll: reading live usage for ${members.map((m) => m.id).join(", ")} every ${Math.round(intervalMs / 1000)}s — rotate at ${Math.round((pool.utilizationThreshold ?? 0.85) * 100)}%, warn at ${Math.round(warnThreshold * 100)}%${skipped.length > 0 ? `; not polled: ${skipped.join("; ")}` : ""}`);
+    return { active: true, members: members.map((m) => m.id) };
+}
+export async function runUsagePollTickNow() {
+    return usageController?.tick();
+}
+export { usageAlertPrefix, usagePoolAlertKey };

package/dist/login-health.js

@@ -1,8 +1,98 @@
+import { parseSetupTokenFile } from "./account-env.js";
 import { createHash } from "node:crypto";
+export const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export function claudeKeychainAccount(env, userInfo) {
+    try {
+        return env.USER || userInfo().username;
+    }
+    catch {
+        return "claude-code-user";
+    }
+}
 export function keychainServiceForConfigDir(absDir) {
     const hash = createHash("sha256").update(absDir).digest("hex").slice(0, 8);
     return `Claude Code-credentials-${hash}`;
 }
+export const AUTH_PROOF_FRESH_MS = 24 * 60 * 60 * 1000;
+export const ACCESS_TOKEN_EXPIRY_SKEW_MS = 60 * 1000;
+const MAX_PLAUSIBLE_EXPIRY_MS = 253402300799000;
+export function parseOauthCredential(raw) {
+    let text = raw.trim();
+    if (/^(?:[0-9a-f]{2})+$/i.test(text)) {
+        text = Buffer.from(text, "hex").toString("utf8").trim();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const oauth = parsed?.claudeAiOauth;
+    if (!oauth || typeof oauth !== "object")
+        return undefined;
+    const o = oauth;
+    const present = (v) => typeof v === "string" && v.trim().length > 0;
+    let expiresAt;
+    if (typeof o.expiresAt === "number" && Number.isFinite(o.expiresAt) && o.expiresAt > 0) {
+        const ms = o.expiresAt < 1e12 ? o.expiresAt * 1000 : o.expiresAt;
+        if (ms < MAX_PLAUSIBLE_EXPIRY_MS)
+            expiresAt = ms;
+    }
+    return {
+        hasAccessToken: present(o.accessToken),
+        hasRefreshToken: present(o.refreshToken),
+        expiresAt,
+    };
+}
+function ago(ms) {
+    const min = Math.max(0, Math.round(ms / 60000));
+    return min < 90 ? `${min}m` : `${Math.round(min / 60)}h`;
+}
+export function judgeOauthCredential(meta, source, proof, nowMs) {
+    const base = { source, expiresAt: meta.expiresAt };
+    if (!meta.hasAccessToken) {
+        return { ...base, status: "broken", reason: `${source}: access token is blank` };
+    }
+    if (meta.expiresAt !== undefined && meta.expiresAt - ACCESS_TOKEN_EXPIRY_SKEW_MS > nowMs) {
+        return {
+            ...base,
+            status: "ok",
+            detail: `access token valid until ${new Date(meta.expiresAt).toISOString()}`,
+        };
+    }
+    if (meta.expiresAt === undefined) {
+        return {
+            ...base,
+            status: "unverified",
+            reason: `${source}: records no access-token expiry, so it cannot be judged at rest`,
+        };
+    }
+    const expiry = `access token expired ${new Date(meta.expiresAt).toISOString()}`;
+    const success = proof.lastSuccessAt;
+    if (success !== undefined &&
+        success <= nowMs &&
+        nowMs - success <= AUTH_PROOF_FRESH_MS &&
+        success >= meta.expiresAt) {
+        return {
+            ...base,
+            status: "ok",
+            detail: `${expiry}; a successful turn ${ago(nowMs - success)} ago proves the refresh works`,
+        };
+    }
+    if (!meta.hasRefreshToken) {
+        return {
+            ...base,
+            status: "broken",
+            reason: `${source}: ${expiry} and no refresh token is stored`,
+        };
+    }
+    return {
+        ...base,
+        status: "unverified",
+        reason: `${source}: ${expiry} and no successful turn since proves the refresh works`,
+    };
+}
 export function createRefProbeTracker(options = {}) {
     const deadAfterConsecutive = options.deadAfterConsecutive ?? 3;
     const deadAfterMs = options.deadAfterMs ?? 10 * 60 * 1000;
@@ -42,29 +132,40 @@ export function createRefProbeTracker(options = {}) {
         },
     };
 }
-function looksLikeSetupToken(value) {
-    return /^sk-ant-[a-z0-9]+-/.test(value.trim());
-}
-function checkCredentialsJson(io, dir) {
+function assessCredentialsJson(io, path, proof, nowMs) {
     let raw;
     try {
-        raw = io.readFile(`${dir}/.credentials.json`);
+        raw = io.readFile(path);
     }
     catch {
-        return { status: "broken", reason: `${dir}/.credentials.json unreadable` };
+        return undefined;
     }
-    try {
-        const parsed = JSON.parse(raw);
-        const token = parsed?.claudeAiOauth?.accessToken;
-        if (typeof token === "string" && token.trim().length > 0)
-            return { status: "ok" };
-        return { status: "broken", reason: `${dir}/.credentials.json access token is blank` };
+    const meta = parseOauthCredential(raw);
+    if (!meta) {
+        return { status: "broken", reason: `${path} holds no Claude OAuth credential`, source: path };
     }
-    catch {
-        return { status: "broken", reason: `${dir}/.credentials.json is not valid JSON` };
+    return judgeOauthCredential(meta, path, proof, nowMs);
+}
+function assessKeychain(io, service, proof, nowMs) {
+    const read = io.readKeychainItem(service, io.keychainAccount);
+    if (read.status === "absent")
+        return undefined;
+    const source = `keychain "${service}"`;
+    if (read.status === "unreadable") {
+        return {
+            status: "unknown",
+            reason: `${source} could not be read (Keychain locked, access refused or timed out) — not judged`,
+            source,
+        };
     }
+    const meta = parseOauthCredential(read.data);
+    if (!meta)
+        return { status: "broken", reason: `${source} holds no Claude OAuth credential`, source };
+    return judgeOauthCredential(meta, source, proof, nowMs);
 }
-export function checkAccountCredential(account, io) {
+export function assessAccountCredential(account, io, options = {}) {
+    const proof = options.proof ?? {};
+    const nowMs = options.nowMs ?? Date.now();
     if (account.oauthTokenFile) {
         let raw;
         try {
@@ -73,35 +174,31 @@ export function checkAccountCredential(account, io) {
         catch {
             return { status: "broken", reason: `${account.oauthTokenFile} unreadable` };
         }
-        if (looksLikeSetupToken(raw))
-            return { status: "ok" };
-        return {
-            status: "broken",
-            reason: `${account.oauthTokenFile} does not contain a setup-token`,
-        };
+        const read = parseSetupTokenFile(raw, account.oauthTokenFile);
+        if ("token" in read)
+            return { status: "ok", detail: "setup-token present" };
+        return { status: "broken", reason: read.error };
     }
     if (account.oauthTokenRef) {
         return { status: "unknown" };
     }
-    if (account.native) {
-        if (io.platform === "darwin") {
-            return io.keychainHasClaudeCredentials()
-                ? { status: "ok" }
-                : { status: "broken", reason: "keychain has no Claude Code credentials" };
-        }
-        return checkCredentialsJson(io, "~/.claude");
-    }
-    if (account.configDir) {
-        if (io.platform === "darwin" && io.keychainHasClaudeCredentialsForDir(account.configDir)) {
-            return { status: "ok" };
-        }
-        const file = checkCredentialsJson(io, account.configDir);
-        if (file.status === "ok" || io.platform !== "darwin")
-            return file;
-        return {
+    const dir = account.native ? "~/.claude" : account.configDir;
+    if (!dir)
+        return { status: "unknown" };
+    const path = `${dir.replace(/\/+$/, "")}/.credentials.json`;
+    if (io.platform !== "darwin") {
+        return (assessCredentialsJson(io, path, proof, nowMs) ?? {
             status: "broken",
-            reason: `keychain has no Claude Code credentials for ${account.configDir} and ${file.reason}`,
-        };
+            reason: `${path} unreadable`,
+            source: path,
+        });
     }
-    return { status: "unknown" };
+    const service = account.native
+        ? CLAUDE_KEYCHAIN_SERVICE
+        : keychainServiceForConfigDir(io.expandHome(dir));
+    return (assessKeychain(io, service, proof, nowMs) ??
+        assessCredentialsJson(io, path, proof, nowMs) ?? {
+        status: "broken",
+        reason: `keychain has no Claude Code credentials for ${account.native ? "the default login" : dir} and ${path} unreadable`,
+    });
 }

package/dist/retry-plan.js

@@ -1,7 +1,9 @@
 import { classifyAccountHealth, overdueProbeAccount, } from "./health.js";
+import { parseSetupTokenFile } from "./account-env.js";
 import { resumeSessionId } from "./session-handover.js";
 export const RETRY_ROSTER_ENV = "MULTI_CLAWD_RETRY_ACCOUNTS";
 const CREDENTIAL_ENV_KEYS = ["CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN"];
+const ROSTER_ENV_KEYS = ["CLAUDE_CONFIG_DIR"];
 export function parseRetryRoster(raw) {
     if (!raw)
         return [];
@@ -26,11 +28,12 @@ export function parseRetryRoster(raw) {
         const env = {};
         if (e.env && typeof e.env === "object") {
             for (const [k, v] of Object.entries(e.env)) {
-                if (typeof v === "string")
+                if (typeof v === "string" && ROSTER_ENV_KEYS.includes(k))
                     env[k] = v;
             }
         }
-        out.push({ id: e.id, stateFile: e.stateFile, env });
+        const tokenFile = typeof e.tokenFile === "string" && e.tokenFile ? e.tokenFile : undefined;
+        out.push({ id: e.id, stateFile: e.stateFile, env, ...(tokenFile ? { tokenFile } : {}) });
     }
     return out;
 }
@@ -40,7 +43,7 @@ export function isResumeLaunch(argv) {
 }
 export function retryArming(argv, roster, opts = {}) {
     if (roster.length === 0) {
-        return { armed: false, reason: "no secret-free sibling account to retry onto" };
+        return { armed: false, reason: "no sibling account the shim can retry onto" };
     }
     if (isResumeLaunch(argv) && !opts.resumeReady) {
         return {
@@ -77,3 +80,35 @@ export function buildRetryEnv(base, account) {
     env[RETRY_ROSTER_ENV] = "";
     return env;
 }
+export function materializeRetryAccount(account, readFile) {
+    if (!account.tokenFile)
+        return { account };
+    let raw;
+    try {
+        raw = readFile(account.tokenFile);
+    }
+    catch (err) {
+        const code = err.code;
+        return { error: `token file unreadable${typeof code === "string" && /^E[A-Z]+$/.test(code) ? ` (${code})` : ""}` };
+    }
+    const read = parseSetupTokenFile(raw, "token file");
+    if ("error" in read)
+        return { error: read.error };
+    return {
+        account: { ...account, env: { ...account.env, CLAUDE_CODE_OAUTH_TOKEN: read.token } },
+    };
+}
+export function chooseLaunchableRetryAccount(params) {
+    let remaining = params.roster;
+    while (remaining.length > 0) {
+        const pick = chooseRetryAccount({ ...params, roster: remaining });
+        if (!pick)
+            return undefined;
+        const ready = params.materialize(pick);
+        if ("account" in ready)
+            return ready.account;
+        params.onSkip?.(pick.id, ready.error);
+        remaining = remaining.filter((a) => a !== pick);
+    }
+    return undefined;
+}

package/dist/shim-core.js

@@ -137,7 +137,9 @@ export function mergeHealthStates(disk, live, now, pruneAfterMs = PRUNE_AFTER_MS
     if (live.credential && (!credential || live.credential.seenAt >= credential.seenAt)) {
         credential = live.credential;
     }
-    if (now !== undefined && credential && now - credential.seenAt > pruneAfterMs) {
+    if (now !== undefined &&
+        credential?.status === "ok" &&
+        now - credential.seenAt > pruneAfterMs) {
         credential = undefined;
     }
     const updatedAt = Math.max(disk.updatedAt ?? 0, live.updatedAt ?? 0);