@kaitranntt/ccs 8.8.1 → 8.9.0-dev.10

package/dist/web-server/usage/claude-native-credentials.d.ts

@@ -32,8 +32,13 @@ export interface CredentialReaderDeps {
     homedir?: string;
     existsSyncImpl?: (p: string) => boolean;
     readFileSyncImpl?: (p: string) => string;
-    execSyncImpl?: (cmd: string, opts: Record<string, unknown>) => string | Buffer;
+    execFileImpl?: ExecFileImpl;
+    keychainTimeoutMs?: number;
 }
+type ExecFileCallback = (error: Error | null, stdout: string | Buffer) => void;
+type ExecFileImpl = (file: string, args: readonly string[], options: Record<string, unknown>, callback: ExecFileCallback) => {
+    kill?: () => void;
+} | void;
 /**
  * Read the native Claude Code credentials.
  *
@@ -41,7 +46,22 @@ export interface CredentialReaderDeps {
  * Keychain as a fallback. Returns null when neither source yields a parseable
  * object.
  */
-export declare function readClaudeCredentials(deps?: CredentialReaderDeps): ClaudeNativeCredentials | null;
+export declare function readClaudeCredentials(deps?: CredentialReaderDeps): Promise<ClaudeNativeCredentials | null>;
+/**
+ * Keychain service name Claude Code uses for a non-default CLAUDE_CONFIG_DIR:
+ * "Claude Code-credentials-<first 8 hex chars of sha256(configDir)>".
+ */
+export declare function claudeKeychainServiceForConfigDir(configDir: string): string;
+/**
+ * Read the Claude Code credentials for a specific CLAUDE_CONFIG_DIR (e.g. an
+ * isolated `ccs auth` instance directory).
+ *
+ * File-first (<configDir>/.credentials.json, no prompt), then the macOS
+ * Keychain item derived from the config dir path. On macOS Claude Code stores
+ * OAuth tokens in the Keychain by default, so without the Keychain fallback
+ * every isolated profile looks permanently logged-out to the bar.
+ */
+export declare function readClaudeCredentialsForConfigDir(configDir: string, deps?: CredentialReaderDeps): Promise<ClaudeNativeCredentials | null>;
 /** Pull the OAuth access token, or null when absent. */
 export declare function getAccessToken(creds: ClaudeNativeCredentials | null): string | null;
 /** Pull the subscription tier (e.g. "max" / "pro"), or null. */
@@ -53,4 +73,5 @@ export declare function getSubscriptionTier(creds: ClaudeNativeCredentials | nul
  * token call against the hostile usage endpoint and never gets a phantom row.
  */
 export declare function hasSupportedSubscription(creds: ClaudeNativeCredentials | null): boolean;
+export {};
 //# sourceMappingURL=claude-native-credentials.d.ts.map

package/dist/web-server/usage/claude-native-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-native-credentials.d.ts","sourceRoot":"","sources":["../../../src/web-server/usage/claude-native-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;AAOH,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,GAAG,MAAM,CAAC;CAChF;AAuBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,oBAAyB,GAC9B,uBAAuB,GAAG,IAAI,CAmChC;AAED,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGnF;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAYvF"}
+{"version":3,"file":"claude-native-credentials.d.ts","sourceRoot":"","sources":["../../../src/web-server/usage/claude-native-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;AAQH,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,KAAK,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAC/E,KAAK,YAAY,GAAG,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,gBAAgB,KACvB;IAAE,IAAI,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC;AAwBlC;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAsBzC;AAgDD;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAoBzC;AAED,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGnF;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAYvF"}

package/dist/web-server/usage/claude-native-credentials.js

@@ -38,12 +38,14 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasSupportedSubscription = exports.getSubscriptionTier = exports.getAccessToken = exports.readClaudeCredentials = void 0;
+exports.hasSupportedSubscription = exports.getSubscriptionTier = exports.getAccessToken = exports.readClaudeCredentialsForConfigDir = exports.claudeKeychainServiceForConfigDir = exports.readClaudeCredentials = void 0;
 const node_fs_1 = require("node:fs");
 const node_child_process_1 = require("node:child_process");
+const crypto = __importStar(require("node:crypto"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+const SECURITY_PATH = '/usr/bin/security';
 const KEYCHAIN_TIMEOUT_MS = 5000;
 /** Subscription types that mean "no real subscription" -> skip the fetch. */
 const UNSUPPORTED_SUBSCRIPTION_TYPES = new Set(['', 'free', 'none']);
@@ -68,12 +70,11 @@ function parseCredentials(raw) {
  * Keychain as a fallback. Returns null when neither source yields a parseable
  * object.
  */
-function readClaudeCredentials(deps = {}) {
+async function readClaudeCredentials(deps = {}) {
     const platform = deps.platform ?? os.platform();
     const homedir = deps.homedir ?? os.homedir();
     const existsImpl = deps.existsSyncImpl ?? node_fs_1.existsSync;
     const readImpl = deps.readFileSyncImpl ?? ((p) => (0, node_fs_1.readFileSync)(p, 'utf8'));
-    const execImpl = deps.execSyncImpl ?? node_child_process_1.execSync;
     const credentialsPath = path.join(homedir, '.claude', '.credentials.json');
     if (existsImpl(credentialsPath)) {
         try {
@@ -86,26 +87,89 @@ function readClaudeCredentials(deps = {}) {
         }
     }
     if (platform === 'darwin') {
+        const parsed = await readCredentialsFromKeychainService(KEYCHAIN_SERVICE, deps);
+        if (parsed)
+            return parsed;
+    }
+    return null;
+}
+exports.readClaudeCredentials = readClaudeCredentials;
+/** Read + parse one Keychain generic-password item. Returns null on any failure. */
+async function readCredentialsFromKeychainService(service, deps) {
+    const timeoutMs = deps.keychainTimeoutMs ?? KEYCHAIN_TIMEOUT_MS;
+    const execImpl = deps.execFileImpl ??
+        ((file, args, options, callback) => (0, node_child_process_1.execFile)(file, [...args], options, (error, stdout) => callback(error, stdout)));
+    return new Promise((resolve) => {
+        let settled = false;
+        let child;
+        const finish = (credentials) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(credentials);
+        };
+        const timer = setTimeout(() => {
+            child?.kill?.();
+            finish(null);
+        }, timeoutMs);
         try {
-            const out = execImpl(`security find-generic-password -s "${KEYCHAIN_SERVICE}" -w`, {
-                timeout: KEYCHAIN_TIMEOUT_MS,
+            child = execImpl(SECURITY_PATH, ['find-generic-password', '-s', service, '-w'], {
+                timeout: timeoutMs,
                 encoding: 'utf8',
-                stdio: ['pipe', 'pipe', 'ignore'],
+                windowsHide: true,
+                maxBuffer: 1024 * 1024,
+            }, (error, stdout) => {
+                if (error)
+                    return finish(null);
+                const raw = (typeof stdout === 'string' ? stdout : stdout.toString('utf8')).trim();
+                finish(raw ? parseCredentials(raw) : null);
             });
-            const raw = (typeof out === 'string' ? out : out.toString('utf8')).trim();
-            if (raw) {
-                const parsed = parseCredentials(raw);
-                if (parsed)
-                    return parsed;
-            }
         }
         catch {
-            // no Keychain entry / access denied -> null
+            finish(null);
+        }
+    });
+}
+/**
+ * Keychain service name Claude Code uses for a non-default CLAUDE_CONFIG_DIR:
+ * "Claude Code-credentials-<first 8 hex chars of sha256(configDir)>".
+ */
+function claudeKeychainServiceForConfigDir(configDir) {
+    const hash = crypto.createHash('sha256').update(configDir).digest('hex').slice(0, 8);
+    return `${KEYCHAIN_SERVICE}-${hash}`;
+}
+exports.claudeKeychainServiceForConfigDir = claudeKeychainServiceForConfigDir;
+/**
+ * Read the Claude Code credentials for a specific CLAUDE_CONFIG_DIR (e.g. an
+ * isolated `ccs auth` instance directory).
+ *
+ * File-first (<configDir>/.credentials.json, no prompt), then the macOS
+ * Keychain item derived from the config dir path. On macOS Claude Code stores
+ * OAuth tokens in the Keychain by default, so without the Keychain fallback
+ * every isolated profile looks permanently logged-out to the bar.
+ */
+async function readClaudeCredentialsForConfigDir(configDir, deps = {}) {
+    const platform = deps.platform ?? os.platform();
+    const existsImpl = deps.existsSyncImpl ?? node_fs_1.existsSync;
+    const readImpl = deps.readFileSyncImpl ?? ((p) => (0, node_fs_1.readFileSync)(p, 'utf8'));
+    const credentialsPath = path.join(configDir, '.credentials.json');
+    if (existsImpl(credentialsPath)) {
+        try {
+            const parsed = parseCredentials(readImpl(credentialsPath));
+            if (parsed)
+                return parsed;
+        }
+        catch {
+            // fall through to Keychain
         }
     }
+    if (platform === 'darwin') {
+        return readCredentialsFromKeychainService(claudeKeychainServiceForConfigDir(configDir), deps);
+    }
     return null;
 }
-exports.readClaudeCredentials = readClaudeCredentials;
+exports.readClaudeCredentialsForConfigDir = readClaudeCredentialsForConfigDir;
 /** Pull the OAuth access token, or null when absent. */
 function getAccessToken(creds) {
     const token = creds?.claudeAiOauth?.accessToken;

package/dist/web-server/usage/claude-native-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-native-credentials.js","sourceRoot":"","sources":["../../../src/web-server/usage/claude-native-credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,qCAAmD;AACnD,2DAA8C;AAC9C,4CAA8B;AAC9B,gDAAkC;AAsBlC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,6EAA6E;AAC7E,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAErE,gEAAgE;AAChE,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAEnE,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,OAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,6BAAQ,CAAC;IAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3E,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,sCAAsC,gBAAgB,MAAM,EAAE;gBACjF,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1E,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AArCD,sDAqCC;AAED,wDAAwD;AACxD,SAAgB,cAAc,CAAC,KAAqC;IAClE,MAAM,KAAK,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAHD,wCAGC;AAED,gEAAgE;AAChE,SAAgB,mBAAmB,CAAC,KAAqC;IACvE,MAAM,IAAI,GAAG,KAAK,EAAE,aAAa,EAAE,gBAAgB,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAHD,kDAGC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,KAAqC;IAC5E,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,gBAAgB,IAAI,EAAE,CAAC;SAC1E,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,gBAAgB,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,CAAC;SACpE,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,OAAO,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACvD,CAAC;AAZD,4DAYC"}
+{"version":3,"file":"claude-native-credentials.js","sourceRoot":"","sources":["../../../src/web-server/usage/claude-native-credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,qCAAmD;AACnD,2DAA8C;AAC9C,oDAAsC;AACtC,4CAA8B;AAC9B,gDAAkC;AA+BlC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,6EAA6E;AAC7E,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAErE,gEAAgE;AAChE,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAEnE,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,OAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3E,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAxBD,sDAwBC;AAED,oFAAoF;AACpF,KAAK,UAAU,kCAAkC,CAC/C,OAAe,EACf,IAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,mBAAmB,CAAC;IAChE,MAAM,QAAQ,GACZ,IAAI,CAAC,YAAY;QACjB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CACjC,IAAA,6BAAQ,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAEpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAmC,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,WAA2C,EAAQ,EAAE;YACnE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CACd,aAAa,EACb,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC9C;gBACE,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,IAAI,GAAG,IAAI;aACvB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBAChB,IAAI,KAAK;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,iCAAiC,CAAC,SAAiB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAHD,8EAGC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,iCAAiC,CACrD,SAAiB,EACjB,OAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,kCAAkC,CAAC,iCAAiC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAvBD,8EAuBC;AAED,wDAAwD;AACxD,SAAgB,cAAc,CAAC,KAAqC;IAClE,MAAM,KAAK,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAHD,wCAGC;AAED,gEAAgE;AAChE,SAAgB,mBAAmB,CAAC,KAAqC;IACvE,MAAM,IAAI,GAAG,KAAK,EAAE,aAAa,EAAE,gBAAgB,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAHD,kDAGC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,KAAqC;IAC5E,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,gBAAgB,IAAI,EAAE,CAAC;SAC1E,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,gBAAgB,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,CAAC;SACpE,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,OAAO,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACvD,CAAC;AAZD,4DAYC"}

package/dist/web-server/usage/native-quota-collector.d.ts

@@ -14,9 +14,9 @@
  *   - circuit breaker stops calling after repeated 429s for a cooldown
  *   - serve-stale-on-failure; only omit a row when there is genuinely no data
  *
- * Claude path: reads per-profile .credentials.json (file-only, NO keychain)
- * and polls api.anthropic.com/api/oauth/usage. If the file is absent the
- * profile is emitted as a parked row (paused:true) — never a keychain call.
+ * Claude path: reads per-profile .credentials.json, then the per-config-dir
+ * Keychain item, and polls api.anthropic.com/api/oauth/usage. If neither source
+ * yields credentials the profile is emitted as a parked row (paused:true).
  *
  * Codex path: PRIMARY = live network (chatgpt.com/backend-api/wham/usage, via
  * fetchCodexQuota), FALLBACK = local session logs (getCodexLocalQuota), mirroring
@@ -29,9 +29,10 @@
  * is maintained — at most 2 live upstream calls per /summary regardless of
  * profile count.
  *
- * NO macOS Keychain access anywhere in this module. The old global-default
- * Claude reader (readClaudeCredentials) is kept for back-compat but is no longer
- * used by the multi-profile path.
+ * Claude per-profile reads are file-first with a per-config-dir macOS Keychain
+ * fallback (Claude Code stores OAuth tokens in the Keychain by default on
+ * macOS). The old global-default Claude reader (readClaudeCredentials) is kept
+ * for back-compat but is no longer used by the multi-profile path.
  */
 import { type ClaudeNativeCredentials } from './claude-native-credentials';
 import { type CodexLocalQuota } from './codex-local-quota-collector';
@@ -39,13 +40,13 @@ import type { ClaudeQuotaResult, CodexQuotaResult } from '../../cliproxy/quota/q
 import type { BarSummaryRow } from '../routes/bar-routes';
 export interface NativeQuotaDeps {
     /** Read the native Claude Code credentials (global default path). */
-    readCredentials?: () => ClaudeNativeCredentials | null;
+    readCredentials?: () => ClaudeNativeCredentials | null | Promise<ClaudeNativeCredentials | null>;
     /**
-     * Read credentials for a specific Claude profile (file-only, no keychain).
+     * Read credentials for a specific Claude profile (file-first, Keychain fallback).
      * Injected so tests never touch real fs or Keychain.
      * profile: the profile name (e.g. "work"); returns null when absent/unparseable.
      */
-    readClaudeCredentialsForProfile?: (profile: string) => ClaudeNativeCredentials | null;
+    readClaudeCredentialsForProfile?: (profile: string) => ClaudeNativeCredentials | null | Promise<ClaudeNativeCredentials | null>;
     /** Fetch Claude quota with a directly-supplied native token. */
     fetchClaudeQuota?: (accessToken: string, accountId?: string) => Promise<ClaudeQuotaResult>;
     /**

package/dist/web-server/usage/native-quota-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-quota-collector.d.ts","sourceRoot":"","sources":["../../../src/web-server/usage/native-quota-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AA4D7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,uBAAuB,GAAG,IAAI,CAAC;IACvD;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,uBAAuB,GAAG,IAAI,CAAC;IACtF,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3F;;;OAGG;IACH,wBAAwB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1E,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACtD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACpC,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACnC,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC3C,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC1C,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAgDD,6EAA6E;AAC7E,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAmwCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,eAAoB,EAC1B,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC,CAmC1B;AA2GD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,aAAa,EAAE,CAS5D"}
+{"version":3,"file":"native-quota-collector.d.ts","sourceRoot":"","sources":["../../../src/web-server/usage/native-quota-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AA4D7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACjG;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,CAChC,OAAO,EAAE,MAAM,KACZ,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC9E,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3F;;;OAGG;IACH,wBAAwB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1E,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACtD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACpC,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACnC,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC3C,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC1C,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAgDD,6EAA6E;AAC7E,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAw0CD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,eAAoB,EAC1B,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC,CAmC1B;AAkID;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,aAAa,EAAE,CAS5D"}

package/dist/web-server/usage/native-quota-collector.js

@@ -15,9 +15,9 @@
  *   - circuit breaker stops calling after repeated 429s for a cooldown
  *   - serve-stale-on-failure; only omit a row when there is genuinely no data
  *
- * Claude path: reads per-profile .credentials.json (file-only, NO keychain)
- * and polls api.anthropic.com/api/oauth/usage. If the file is absent the
- * profile is emitted as a parked row (paused:true) — never a keychain call.
+ * Claude path: reads per-profile .credentials.json, then the per-config-dir
+ * Keychain item, and polls api.anthropic.com/api/oauth/usage. If neither source
+ * yields credentials the profile is emitted as a parked row (paused:true).
  *
  * Codex path: PRIMARY = live network (chatgpt.com/backend-api/wham/usage, via
  * fetchCodexQuota), FALLBACK = local session logs (getCodexLocalQuota), mirroring
@@ -30,9 +30,10 @@
  * is maintained — at most 2 live upstream calls per /summary regardless of
  * profile count.
  *
- * NO macOS Keychain access anywhere in this module. The old global-default
- * Claude reader (readClaudeCredentials) is kept for back-compat but is no longer
- * used by the multi-profile path.
+ * Claude per-profile reads are file-first with a per-config-dir macOS Keychain
+ * fallback (Claude Code stores OAuth tokens in the Keychain by default on
+ * macOS). The old global-default Claude reader (readClaudeCredentials) is kept
+ * for back-compat but is no longer used by the multi-profile path.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -381,38 +382,30 @@ function serveCached(state) {
     return { ...state.cachedRow, cached: true };
 }
 // ============================================================================
-// File-only Claude credentials reader for per-profile paths (NO keychain)
+// Per-profile Claude credentials reader (file-first, Keychain fallback)
 // ============================================================================
 /**
- * Read credentials for a specific Claude Code profile (file-only, no keychain).
+ * Read credentials for a specific Claude Code profile (file-first, Keychain fallback).
  *
- * Looks for .credentials.json in the profile's instance directory. If the file
- * is absent or unparseable, returns null — the caller emits a parked row.
- * Never calls security/Keychain — zero new keychain access from this feature.
+ * Looks for .credentials.json in the profile's instance directory, then uses
+ * the bounded per-config-dir macOS Keychain fallback. If neither yields a
+ * parseable credential object, the caller emits a parked row.
  */
-function readClaudeCredentialsForProfileFromDisk(profile, readDefaultCredentials = claude_native_credentials_1.readClaudeCredentials) {
+async function readClaudeCredentialsForProfileFromDisk(profile, readDefaultCredentials = claude_native_credentials_1.readClaudeCredentials) {
     try {
         const instanceDir = path.join((0, config_manager_1.getCcsDir)(), 'instances', profile);
-        const credFile = path.join(instanceDir, '.credentials.json');
-        if (fs.existsSync(credFile)) {
-            const raw = fs.readFileSync(credFile, 'utf8');
-            const parsed = JSON.parse(raw);
-            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-                return parsed;
-            }
-            return null;
-        }
         // The bare `ccs` default login uses the standard global credential lookup:
         // ~/.claude/.credentials.json, falling back to the single global
         // "Claude Code-credentials" Keychain item that Claude Code itself maintains.
-        // This is the ONE pre-existing global read the shipped Bar already performs --
-        // NOT a per-profile Keychain scan. Isolated `ccs auth` profiles stay
-        // file-only and never touch the Keychain; a real instance directory named
-        // "default" is therefore parked when its file is absent.
         if (profile === DEFAULT_PROFILE && !fs.existsSync(instanceDir)) {
-            return readDefaultCredentials();
+            return await readDefaultCredentials();
         }
-        return null;
+        // Isolated `ccs auth` instance: <instanceDir>/.credentials.json first, then
+        // the per-config-dir Keychain item Claude Code maintains for this
+        // CLAUDE_CONFIG_DIR ("Claude Code-credentials-<sha256(dir)[0..8]>"). On
+        // macOS Claude Code stores tokens in the Keychain by default, so without
+        // the Keychain read every isolated profile is permanently parked.
+        return await (0, claude_native_credentials_1.readClaudeCredentialsForConfigDir)(instanceDir);
     }
     catch {
         return null;
@@ -643,6 +636,65 @@ function collectCachedOrParkedProfileRow(map, profile, now, buildParkedRow) {
 function markDefault(row, isDefault) {
     return { ...row, is_default: isDefault };
 }
+/**
+ * Force paused:true on a non-default row AND its cached copy. Non-default rows
+ * always render dimmed (only the default profile is "active"), including the
+ * pass where the rotating live slot refreshed them — otherwise the row would
+ * flicker active for one poll and dim again on the next.
+ */
+function markPausedAndSyncCache(map, profile, row) {
+    const state = map.get(profile);
+    if (state?.cachedRow) {
+        state.cachedRow = { ...state.cachedRow, paused: true };
+    }
+    return { ...row, paused: true };
+}
+/**
+ * True when the cached row was fetched BEFORE its own next_reset boundary and
+ * that boundary has now passed — the row describes the previous quota window,
+ * so its values (and the reset time itself) are visibly wrong in the bar.
+ * The cachedAt guard means a post-reset payload that still reports a past
+ * reset cannot cause a refetch loop: once re-fetched, normal TTL applies.
+ */
+function isCachedRowStaleByReset(state, now) {
+    const nextReset = state.cachedRow?.next_reset;
+    if (!nextReset)
+        return false;
+    const resetMs = Date.parse(nextReset);
+    if (!Number.isFinite(resetMs))
+        return false;
+    return resetMs <= now && state.cachedAt < resetMs;
+}
+/**
+ * Pick the non-default profile the rotating live slot should refresh this pass:
+ * the stalest profile whose cached row is missing, past its TTL, or past its
+ * own quota reset, skipping profiles inside a breaker/cooldown window (their
+ * collector would refuse the fetch anyway, wasting the slot). Returns null
+ * when every profile is fresh.
+ */
+function pickRotatingLiveProfile(map, profiles, defaultProfile, now) {
+    let picked = null;
+    let pickedAt = Number.POSITIVE_INFINITY;
+    for (const p of profiles) {
+        if (p === defaultProfile)
+            continue;
+        const state = map.get(p);
+        if (state && (now < state.breakerOpenUntil || now < state.cooldownUntil))
+            continue;
+        const cachedRow = state?.cachedRow ?? null;
+        const cachedAt = state?.cachedAt ?? 0;
+        if (cachedRow && state) {
+            const ttl = cachedRow.quotaStatus === 'unsupported' ? PARKED_TTL_MS : NATIVE_QUOTA_TTL_MS;
+            if (now - cachedAt < ttl && !isCachedRowStaleByReset(state, now))
+                continue;
+        }
+        if (cachedAt < pickedAt) {
+            pickedAt = cachedAt;
+            picked = p;
+        }
+    }
+    return picked;
+}
 /**
  * Tag the row with is_default AND write the flag back onto the cached copy. The
  * collector caches a row before the default profile is known (the default is
@@ -664,10 +716,13 @@ async function collectClaudeRowForProfile(profile, deps, force = false) {
     // Serve from cache while within TTL — force bypasses the short-circuit. Parked
     // rows (no creds -> quotaStatus 'unsupported') use a short TTL so a fresh login
     // is picked up within seconds instead of staying dimmed for the full quota TTL.
+    // A row whose own next_reset has passed is stale regardless of TTL — the
+    // quota snapped back at the boundary and the cached values are visibly wrong.
     if (!force && state.cachedRow) {
         const ttl = state.cachedRow.quotaStatus === 'unsupported' ? PARKED_TTL_MS : NATIVE_QUOTA_TTL_MS;
-        if (now - state.cachedAt < ttl)
+        if (now - state.cachedAt < ttl && !isCachedRowStaleByReset(state, now)) {
             return serveCached(state);
+        }
     }
     // Breaker open or cooldown active -> zero network, serve stale (may be null).
     // Force does NOT bypass the breaker — it protects the account.
@@ -678,7 +733,7 @@ async function collectClaudeRowForProfile(profile, deps, force = false) {
     if (state.pending) {
         return state.pending;
     }
-    // For per-profile reads: use the injected seam (file-only, no keychain).
+    // For per-profile reads: use the injected seam (file-first, Keychain fallback).
     const readDefaultCredentials = deps.readCredentials ?? claude_native_credentials_1.readClaudeCredentials;
     const readCreds = deps.readClaudeCredentialsForProfile ??
         ((p) => readClaudeCredentialsForProfileFromDisk(p, readDefaultCredentials));
@@ -692,11 +747,11 @@ async function collectClaudeRowForProfile(profile, deps, force = false) {
             // pending DURING assignment, leaving a stale resolved promise that the
             // next call's coalescing check would return instead of re-evaluating.
             await Promise.resolve();
-            const creds = readCreds(profile);
+            const creds = await readCreds(profile);
             // No credentials file found -> emit parked row (needs auth, file absent).
             // This is the expected case when the profile exists in the registry but the
-            // user has not logged in via 'ccs auth' for this machine or the credentials
-            // are stored only in keychain (which we deliberately do not access here).
+            // user has not logged in via 'ccs auth' for this machine or neither the
+            // profile file nor its bounded macOS Keychain fallback yielded credentials.
             if (!creds) {
                 const parkedRow = buildParkedClaudeProfileRow(profile, now);
                 // Cache the parked row so repeated calls don't re-stat the fs.
@@ -797,10 +852,12 @@ async function collectCodexRowForProfile(profile, deps, force = false) {
     // Serve from cache while within TTL — force bypasses the short-circuit. Parked
     // rows (no auth -> quotaStatus 'unsupported') use a short TTL so a fresh login
     // is picked up within seconds instead of staying dimmed for the full quota TTL.
+    // A row whose own next_reset has passed is stale regardless of TTL.
     if (!force && state.cachedRow) {
         const ttl = state.cachedRow.quotaStatus === 'unsupported' ? PARKED_TTL_MS : NATIVE_QUOTA_TTL_MS;
-        if (now - state.cachedAt < ttl)
+        if (now - state.cachedAt < ttl && !isCachedRowStaleByReset(state, now)) {
             return serveCached(state);
+        }
     }
     // Breaker open or cooldown active -> skip network, go to LOCAL fallback.
     // Force does NOT bypass the breaker — it protects the account.
@@ -986,7 +1043,7 @@ async function collectClaudeRow(deps, force = false) {
     const sleep = deps.sleep ?? defaultSleep;
     state.pending = (async () => {
         try {
-            const creds = readCredentialsFn();
+            const creds = await readCredentialsFn();
             // No token / unsupported subscription -> never spend a call, omit the row.
             if (!creds || !(0, claude_native_credentials_1.hasSupportedSubscription)(creds)) {
                 return serveCached(state);
@@ -1363,28 +1420,42 @@ async function getNativeAccountRowsMultiProfile(deps, force) {
     const tasks = [];
     const results = [];
     const now = (deps.now ?? Date.now)();
-    // Preserve the safety budget: only the active/default profile for each surface
-    // may perform a live refresh. Non-default profiles are cache-only (or parked)
-    // so one /summary request can trigger at most one Claude and one Codex live
-    // upstream call regardless of configured profile count.
+    // Preserve the safety budget: the active/default profile for each surface is
+    // live-polled every pass, plus ONE rotating live slot for the stalest
+    // non-default profile. All other profiles are cache-only (or parked), so one
+    // /summary request triggers at most two Claude and two Codex live upstream
+    // calls regardless of configured profile count — every account converges to
+    // real quota within a few polls without per-profile fan-out.
+    const claudeRotating = pickRotatingLiveProfile(claudeProfileStates, claudeProfiles, claudeDefault, now);
+    const codexRotating = pickRotatingLiveProfile(codexProfileStates, codexProfiles, codexDefault, now);
     for (const p of claudeProfiles) {
         const isDefault = p === claudeDefault;
-        if (!isDefault) {
+        if (!isDefault && p !== claudeRotating) {
             results.push(markDefaultAndSyncCache(claudeProfileStates, p, collectCachedOrParkedProfileRow(claudeProfileStates, p, now, buildParkedClaudeProfileRow), false));
             continue;
         }
         tasks.push(collectClaudeRowForProfile(p, deps, force || claudeProfileStates.get(p)?.cachedRow?.quotaStatus === 'unsupported')
-            .then((r) => (r ? markDefaultAndSyncCache(claudeProfileStates, p, r, true) : null))
+            .then((r) => {
+            if (!r)
+                return null;
+            const marked = markDefaultAndSyncCache(claudeProfileStates, p, r, isDefault);
+            return isDefault ? marked : markPausedAndSyncCache(claudeProfileStates, p, marked);
+        })
             .catch(() => null));
     }
     for (const p of codexProfiles) {
         const isDefault = p === codexDefault;
-        if (!isDefault) {
+        if (!isDefault && p !== codexRotating) {
             results.push(markDefaultAndSyncCache(codexProfileStates, p, collectCachedOrParkedProfileRow(codexProfileStates, p, now, buildParkedCodexProfileRow), false));
             continue;
         }
         tasks.push(collectCodexRowForProfile(p, deps, force || codexProfileStates.get(p)?.cachedRow?.quotaStatus === 'unsupported')
-            .then((r) => (r ? markDefaultAndSyncCache(codexProfileStates, p, r, true) : null))
+            .then((r) => {
+            if (!r)
+                return null;
+            const marked = markDefaultAndSyncCache(codexProfileStates, p, r, isDefault);
+            return isDefault ? marked : markPausedAndSyncCache(codexProfileStates, p, marked);
+        })
             .catch(() => null));
     }
     results.push(...(await Promise.all(tasks)));