@drakon-systems/multi-clawd 2.1.0 → 2.1.1

package/README.md

@@ -385,7 +385,7 @@ openclaw plugins install (Get-Location).Path
 **Or let your agent install it.** Running an OpenClaw assistant or Claude
 Code on the target machine already? Paste it this and go make coffee:
 
-> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v2.1.0/SETUP-AGENT.md
+> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v2.1.1/SETUP-AGENT.md
 > and follow it to set up multi-clawd on this machine. I own a second
 > Claude account — ask me when you need me to log in.
 
@@ -817,6 +817,18 @@ event, and no plugin API can force a rebuild. See `DESIGN.md`.
 
 ## Known limitations
 
+- **Control UI shows the pool as unavailable on OpenClaw 2026.10 (multi-clawd
+  ≤ 2.1.0).** OpenClaw 2026.10 computes model availability per provider, and
+  a plugin provider backed by a Claude *login* (a `native` or `configDir`
+  account) had no credential to show it — so **Settings → Models** greyed out
+  every `clawd/*` and `claw<N>/*` row with "missing auth" and showed a
+  different model than the configured primary, even though agent turns worked.
+  `openclaw gateway call models.list --json` shows the same rows as
+  `available: false, unavailableReason: "missing-auth"`. Fixed in **2.1.1**:
+  a usable login now reports as available, a dead one still reports
+  "missing-auth", and the direct API transport keeps refusing CLI-login
+  accounts as before. Update with `multi-clawd update`.
+
 - **Shim window persistence is sequential-safe, not concurrent-writer-safe.**
   `persistState()` in `src/shim.ts` does a read-merge-write on every save so a
   turn that only reports one window type (say `five_hour`) doesn't clobber

package/dist/credential-store.js

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
 import { join, resolve } from "node:path";
@@ -183,6 +183,32 @@ export function expandHomeDir(p) {
 }
 const SECURITY_TIMEOUT_MS = 10_000;
 const SECURITY_ITEM_NOT_FOUND = 44;
+function defaultExecFileAsync(file, args, options) {
+    return new Promise((resolvePromise, reject) => {
+        execFile(file, args, options, (err, stdout) => {
+            if (err)
+                reject(err);
+            else
+                resolvePromise(String(stdout));
+        });
+    });
+}
+export async function readKeychainItemAsync(service, account, deps = {}) {
+    const exec = deps.exec ?? defaultExecFileAsync;
+    try {
+        const data = await exec("security", ["find-generic-password", "-s", service, "-a", account, "-w"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: SECURITY_TIMEOUT_MS,
+        });
+        return { status: "found", data: data.replace(/\n$/, "") };
+    }
+    catch (err) {
+        const status = err?.status ??
+            err?.code;
+        return status === SECURITY_ITEM_NOT_FOUND ? { status: "absent" } : { status: "unreadable" };
+    }
+}
 export function createSystemCredentialIo(deps = {}) {
     const exec = deps.exec ?? ((file, args, options) => execFileSync(file, args, options));
     return {

package/dist/index.js

@@ -7,7 +7,7 @@ import { MODEL_ALIASES, buildCatalogEntries, canonicalModelId, isModernClaudeMod
 import { decideDegradation, matchesPin } from "./degrade.js";
 import { resolveExecMode, permissionModeArgs } from "./exec-policy.js";
 import { resolveBaseModelIds } from "./catalog-source.js";
-import { allCredentialFailed, classifyAccountHealth, lastAuthSuccessAt, overdueProbeAccount, } from "./health.js";
+import { allCredentialFailed, classifyAccountHealth, credentialFailureFor, lastAuthSuccessAt, overdueProbeAccount, } from "./health.js";
 import { decideStickySelection } from "./sticky.js";
 import { mergeHealthStates, parseStoredState, recordCredentialFailure, } from "./shim-core.js";
 import { createTokenRefResolver, isSecretRefShape, } from "./token-resolution.js";
@@ -22,7 +22,8 @@ export { healthStateFile, usageStateFile, clearAccountCredentialFailure };
 import { accountConfigDir, AccountCredentialError, buildAccountChildEnv, credentialFailureText, parseSetupTokenFile, tokenFileModeWarning, validateAccountTokenSources, } from "./account-env.js";
 import { diffCatalogModels, formatNewModelNotice, } from "./model-currency.js";
 import { assessAccountCredential, createRefProbeTracker, } from "./login-health.js";
-import { createSystemCredentialIo } from "./credential-store.js";
+import { createSystemCredentialIo, readKeychainItemAsync } from "./credential-store.js";
+import { createLoginAuthCache, loginAuthEligible, poolRuntimeAuth, refuseRuntimeAuthMarker, } from "./runtime-auth.js";
 import { collectDirectMembers } from "./direct-route.js";
 import { createDirectOrderController, isValidAgentId } from "./direct-sync.js";
 import { createOpenclawRunner } from "./openclaw-runner.js";
@@ -159,6 +160,29 @@ function ingestAlertSpool() {
 const LOGIN_PROBE_INTERVAL_MS = 15 * 60 * 1000;
 const LOGIN_PROBE_INITIAL_DELAY_MS = 45 * 1000;
 let realCredentialIo;
+let loginAuthCache;
+let loginAuthWarm = Promise.resolve();
+function loginAuth() {
+    return (loginAuthCache ??= createLoginAuthCache({
+        io: (realCredentialIo ??= createSystemCredentialIo()),
+        readKeychainItemAsync: (service, account) => readKeychainItemAsync(service, account),
+        health: (accountId) => {
+            const state = readHealthState(accountId);
+            return {
+                lastSuccessAt: lastAuthSuccessAt(state),
+                failed: credentialFailureFor(state, Date.now()) !== undefined,
+            };
+        },
+    }));
+}
+export function warmLoginAuth(accounts) {
+    const cache = loginAuth();
+    loginAuthWarm = Promise.all(accounts.filter(loginAuthEligible).map((account) => cache.refresh(account))).then(() => undefined);
+    return loginAuthWarm;
+}
+export function loginAuthWarmed() {
+    return loginAuthWarm;
+}
 const refProbeTrackers = new Map();
 const lastProbeStatus = new Map();
 function recordAccountCredentialFailure(accountId, reason, nowMs) {
@@ -208,6 +232,8 @@ export async function runLoginHealthProbe(accounts, logger, deps = {}) {
                 proof: { lastSuccessAt: lastAuthSuccessAt(readHealth(account.id)) },
                 nowMs: now,
             });
+            if (!deps.io)
+                loginAuth().record(account.id, check, now);
             status = check.status;
             reason = check.status === "ok" ? check.detail : check.reason;
         }
@@ -320,6 +346,14 @@ function peekToken(account) {
         return undefined;
     throw new Error(`[multi-clawd] account "${account.id}" needs oauthTokenFile, oauthTokenRef, or configDir`);
 }
+function resolveAccountRuntimeAuth(account) {
+    const token = peekToken(account);
+    if (token)
+        return { apiKey: token, source: `multi-clawd ${account.id} token`, mode: "token" };
+    if (account.oauthTokenFile || isSecretRefShape(account.oauthTokenRef))
+        return undefined;
+    return loginAuth().peek(account, account.id);
+}
 async function resolveTokenAsync(account, resolver) {
     if (isSecretRefShape(account.oauthTokenRef) && !account.native && !account.oauthTokenFile) {
         return (resolver ?? activeTokenResolver)?.resolve(account.oauthTokenRef);
@@ -561,26 +595,25 @@ export function isRuntimelessRegistration(api) {
     const mode = api?.registrationMode;
     return mode === "cli-metadata" || mode === "setup-only";
 }
-function buildCatalogProvider(account) {
+function buildCatalogProvider(account, members) {
     return {
         id: account.id,
         label: account.label ?? `Claude Code (${account.id})`,
         auth: [],
         resolveSyntheticAuth: () => {
             try {
-                const token = peekToken(account);
-                if (!token)
-                    return undefined;
-                return {
-                    apiKey: token,
-                    source: `multi-clawd ${account.id} token`,
-                    mode: "token",
-                };
+                return members
+                    ? poolRuntimeAuth(account.id, members.map((member) => () => resolveAccountRuntimeAuth(member)))
+                    : resolveAccountRuntimeAuth(account);
             }
             catch {
                 return undefined;
             }
         },
+        prepareRuntimeAuth: async (ctx) => {
+            refuseRuntimeAuthMarker(ctx);
+            return undefined;
+        },
         augmentModelCatalog: async () => buildCatalogEntries(account, await resolveBaseModelIds()),
         resolveDynamicModel: (ctx) => buildRuntimeModel(account, ctx.modelId),
     };
@@ -647,6 +680,7 @@ export default definePluginEntry({
                 `failover is unchanged, but OpenClaw cannot verify this backend as a setup owner`);
         }
         const seen = new Set();
+        loginAuthCache = undefined;
         for (const account of accounts) {
             const id = account?.id?.trim();
             if (!id) {
@@ -666,6 +700,7 @@ export default definePluginEntry({
             api.registerProvider(buildCatalogProvider(normalized));
         }
         registerPoolBackend(api, cfg.pool, accounts, seen, execMode, { launch });
+        void warmLoginAuth(accounts.filter((a) => seen.has(a.id.trim()))).catch(() => { });
         {
             const logger = api.logger;
             try {
@@ -955,7 +990,7 @@ export function registerPoolBackend(api, pool, accounts, registeredIds, execMode
         return preparedForLaunch(launch, ctx, env, transport);
     };
     api.registerCliBackend(backend);
-    api.registerProvider(buildCatalogProvider(poolAccount));
+    api.registerProvider(buildCatalogProvider(poolAccount, members));
     registeredIds.add(poolId);
     logger.info(`[multi-clawd] pool "${poolId}" active — accounts: ${memberIds.join(" → ")}, threshold: ${options.utilizationThreshold ?? 0.85}`);
     void (async () => {

package/dist/runtime-auth.js

@@ -0,0 +1,124 @@
+import { ACCESS_TOKEN_EXPIRY_SKEW_MS, CLAUDE_KEYCHAIN_SERVICE, assessAccountCredential, keychainServiceForConfigDir, } from "./login-health.js";
+export const RUNTIME_AUTH_MARKER_PREFIX = "oauth:";
+export const LOGIN_AUTH_CACHE_TTL_MS = 30 * 1000;
+export function runtimeAuthMarker(providerId) {
+    return `${RUNTIME_AUTH_MARKER_PREFIX}${providerId.trim()}`;
+}
+export function isRuntimeAuthMarker(value) {
+    if (typeof value !== "string")
+        return false;
+    const trimmed = value.trim();
+    return trimmed.startsWith(RUNTIME_AUTH_MARKER_PREFIX) && trimmed.length > RUNTIME_AUTH_MARKER_PREFIX.length;
+}
+export function loginRuntimeAuth(check, ctx) {
+    if (check.status !== "ok")
+        return undefined;
+    const expiresAt = check.expiresAt !== undefined && check.expiresAt > ctx.nowMs ? check.expiresAt : undefined;
+    return {
+        apiKey: runtimeAuthMarker(ctx.providerId),
+        source: `claude login (${ctx.accountId})`,
+        mode: "oauth",
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+    };
+}
+export function poolRuntimeAuth(poolId, members) {
+    for (const member of members) {
+        let result;
+        try {
+            result = member();
+        }
+        catch {
+            continue;
+        }
+        if (!result)
+            continue;
+        return {
+            apiKey: runtimeAuthMarker(poolId),
+            source: result.source,
+            mode: "oauth",
+            ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
+        };
+    }
+    return undefined;
+}
+export function loginAuthEligible(account) {
+    return !account.oauthTokenFile && !account.oauthTokenRef && Boolean(account.native || account.configDir);
+}
+export function createLoginAuthCache(options) {
+    const ttlMs = options.ttlMs ?? LOGIN_AUTH_CACHE_TTL_MS;
+    const cache = new Map();
+    const inflight = new Map();
+    const health = (accountId) => {
+        try {
+            return options.health?.(accountId) ?? {};
+        }
+        catch {
+            return {};
+        }
+    };
+    const eligible = loginAuthEligible;
+    const store = (accountId, check, nowMs) => {
+        const tokenBound = check.status === "ok" && check.expiresAt !== undefined
+            ? check.expiresAt - ACCESS_TOKEN_EXPIRY_SKEW_MS
+            : undefined;
+        const hardUntil = tokenBound !== undefined && tokenBound > nowMs ? tokenBound : nowMs + ttlMs;
+        cache.set(accountId, { check, freshUntil: nowMs + ttlMs, hardUntil });
+    };
+    const judge = async (account, nowMs) => {
+        let io = options.io;
+        if (io.platform === "darwin" && options.readKeychainItemAsync) {
+            const dir = account.native ? "~/.claude" : account.configDir;
+            const service = account.native
+                ? CLAUDE_KEYCHAIN_SERVICE
+                : keychainServiceForConfigDir(io.expandHome(dir ?? ""));
+            const read = await options.readKeychainItemAsync(service, io.keychainAccount);
+            io = { ...io, readKeychainItem: () => read };
+        }
+        const check = assessAccountCredential(account, io, {
+            proof: { lastSuccessAt: health(account.id).lastSuccessAt },
+            nowMs,
+        });
+        store(account.id, check, nowMs);
+    };
+    const refresh = (account, nowMs = Date.now()) => {
+        if (!eligible(account))
+            return Promise.resolve();
+        const running = inflight.get(account.id);
+        if (running)
+            return running;
+        const task = judge(account, nowMs)
+            .catch(() => {
+            store(account.id, { status: "unknown", reason: "credential source could not be judged" }, nowMs);
+        })
+            .finally(() => {
+            inflight.delete(account.id);
+        });
+        inflight.set(account.id, task);
+        return task;
+    };
+    return {
+        peek(account, providerId, nowMs = Date.now()) {
+            if (!eligible(account))
+                return undefined;
+            if (health(account.id).failed)
+                return undefined;
+            const hit = cache.get(account.id);
+            if (!hit || hit.freshUntil <= nowMs)
+                void refresh(account, nowMs);
+            if (!hit || hit.hardUntil <= nowMs)
+                return undefined;
+            return loginRuntimeAuth(hit.check, { providerId, accountId: account.id, nowMs });
+        },
+        refresh,
+        record(accountId, check, nowMs = Date.now()) {
+            store(accountId, check, nowMs);
+        },
+    };
+}
+export function refuseRuntimeAuthMarker(ctx) {
+    if (!isRuntimeAuthMarker(ctx.apiKey))
+        return undefined;
+    throw new Error(`[multi-clawd] ${ctx.provider}/${ctx.modelId} runs through the Claude Code CLI backend; ` +
+        `this account is a Claude login (no setup token), so the direct API transport is not available for it. ` +
+        `Run the model as an agent turn, or give the account an oauthTokenFile/oauthTokenRef to use it directly.`);
+}

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "multi-clawd",
   "name": "multi-clawd",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Register additional Claude Code logins (Max/Pro accounts) as first-class OpenClaw CLI backends for cross-account failover, keeping the full skills/MCP harness on every account.",
   "cliBackends": [
     "claw1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/multi-clawd",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Multi-account Claude Code failover for OpenClaw — register additional Claude (Max/Pro) logins as first-class CLI backends and keep the full skills/MCP harness across every account. Also imports those accounts' setup tokens into Hermes Agent's Anthropic credential pool.",
   "type": "module",
   "license": "MIT",