claude-multiacc 2.0.2 → 2.0.4

package/install.sh

@@ -103,13 +103,23 @@ PLIST_CODEX_LIMITS="$HOME/Library/LaunchAgents/$LABEL.codex-limits.plist"
 PLIST_CODEX_HEALTH="$HOME/Library/LaunchAgents/$LABEL.codex-health.plist"
 PROFILED="/etc/profile.d/claude-multiacc.sh"
 
-# Pool roots (and any sync override) for a scheduled agent, so it refreshes THIS
-# instance's pool. Empty for a default install — nothing changes there.
+# Environment for a scheduled agent: a usable PATH always, plus this instance's pool
+# roots when the install is instance-scoped.
+#
+# launchd hands an agent PATH=/usr/bin:/bin:/usr/sbin:/sbin — no /opt/homebrew, no
+# nvm — so `npm`, `node` and a homebrew `git` are all absent from a plain agent run.
+# The daily self-update agent logged "npm not found; skipping" every night for days
+# while reporting nothing wrong, and every Mac's npm copy silently froze. The code
+# now resolves npm by absolute path too (lib/common.sh find_npm), but an agent whose
+# environment cannot even find node is a trap waiting for the next tool we add.
 plist_env_block() {
-  [ -n "$INSTANCE" ] || return 0
   printf '  <key>EnvironmentVariables</key><dict>\n'
-  printf '    <key>CLAUDE_ACCOUNTS_ROOT</key><string>%s</string>\n' "$ACC_ROOT"
-  printf '    <key>CODEX_ACCOUNTS_ROOT</key><string>%s</string>\n' "$CODEX_ACC_ROOT"
+  printf '    <key>PATH</key><string>%s</string>\n' \
+    "/opt/homebrew/bin:/usr/local/bin:$HOME/.local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+  if [ -n "$INSTANCE" ]; then
+    printf '    <key>CLAUDE_ACCOUNTS_ROOT</key><string>%s</string>\n' "$ACC_ROOT"
+    printf '    <key>CODEX_ACCOUNTS_ROOT</key><string>%s</string>\n' "$CODEX_ACC_ROOT"
+  fi
   printf '  </dict>\n'
 }
 cron_env_prefix() {
@@ -380,11 +390,17 @@ do_install() {
     echo "  note: no codex binary found — the codex pool stays idle until Codex CLI is installed (npm i -g @openai/codex)"
   fi
 
-  # Keychain-mode detection: per-dir /login isolation needs file-based credentials.
+  # Keychain-mode note: Claude Code keeps per-config-dir logins in the login Keychain
+  # (one item per dir) whenever the session can open it, and only sessions without
+  # keychain access (ssh, launchd background jobs) fall back to .credentials.json. The
+  # pool reads both (lib/keychain.py); what an operator has to know is that a login
+  # made from a GUI session is invisible to their ssh sessions — mint a portable
+  # token for anything that must work from everywhere.
   if [ "$kind" = "mac" ] && [ ! -f "$HOME/.claude/.credentials.json" ] \
     && security find-generic-password -s "Claude Code-credentials" >/dev/null 2>&1; then
-    echo "  WARNING: this Mac stores Claude Code credentials in the Keychain, not files." >&2
-    echo "  Per-directory logins may not isolate; use token-based accounts (claude-accounts mint/import --token-file)." >&2
+    echo "  note: this Mac keeps Claude Code logins in the Keychain. Per-dir logins made here"
+    echo "  are read from it; ssh/background sessions cannot open it (they see 'locked') —"
+    echo "  use 'claude-accounts mint <acct-NN>' for accounts that must work from everywhere."
   fi
 
   manifest_init "${SERVER_OVERRIDE:-$DEFAULT_SERVER}"

package/lib/audit.py

@@ -7,11 +7,20 @@ States:
   expired  has auth material that CANNOT authenticate — needs `claude-accounts relogin`
   blocked  authenticates, but its organization has disabled Claude Code subscription
            access — a re-login cannot fix it, so it needs an admin (or removal)
+  locked   the OAuth login is in the macOS Keychain and THIS session cannot open it
+           (ssh/tmux/background) — it works from the Mac's own GUI session, so it is
+           neither dead nor missing; just not usable from here
   missing  no auth on this machine, and this machine is supposed to own the grant
   remote   no auth here, but the manifest says another machine owns it (informational)
 
 Only 'ok' accounts are selectable; everything else is excluded by the shim.
 
+An OAuth login lives either in `<acct>/.credentials.json` or — on macOS, whenever the
+client could open the login Keychain — in a Keychain item (lib/keychain.py). Both are
+the same document and the same machine-local class; the file is simply gone once the
+client has moved it into the Keychain, so a file-only reading calls a working login
+"missing" (that is exactly what happened to a whole pool on 2026-08-28).
+
 Run directly for a TSV dump:  python3 lib/audit.py <acc-root> [mac|linux]
 Columns: id, email, home, state, label, reason, fix
 """
@@ -22,6 +31,12 @@ import re
 import sys
 import time
 
+# This module is loaded both as a package sibling (`from audit import …` with lib/ on
+# sys.path) and by file path (importlib in lib/common.sh's creds_alive); the keychain
+# helper sits beside it either way.
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import keychain  # noqa: E402
+
 VALID_ID = re.compile(r'acct-\d{2}')
 
 
@@ -71,6 +86,12 @@ def expired_marked(d, now=None):
             p = os.path.join(d, name)
             if os.path.isfile(p) and _mtime(p) > mt:
                 return False
+        # A login the client keeps in the Keychain is "written after the marker" in
+        # exactly the same sense — its modification stamp is readable even when this
+        # session cannot open the secret.
+        if not os.path.isfile(os.path.join(d, '.credentials.json')) \
+                and keychain.item_mtime(d) > mt:
+            return False
     m = re.search(r'soft_until=(\d+)', detail)
     if m and int(m.group(1)) <= now:
         return False
@@ -102,16 +123,31 @@ def _scrape(cpath):
             'has_refresh': bool(re.search(r'"refreshToken"\s*:\s*"[^"]', txt))}
 
 
+def creds_doc_state(doc, now):
+    """(state, reason) for a parsed credential document ({"claudeAiOauth": …}) —
+    the one rule for a file AND a Keychain item, so the two stores can never be
+    judged differently."""
+    o = doc.get('claudeAiOauth', {}) if isinstance(doc, dict) else None
+    if not isinstance(o, dict):
+        raise ValueError('claudeAiOauth is not an object')
+    exp, rexp = _ms(o.get('expiresAt')), _ms(o.get('refreshTokenExpiresAt'))
+    has_refresh = bool(o.get('refreshToken'))
+    if exp > now:
+        return 'ok', 'oauth credential valid'
+    if not has_refresh:
+        return 'expired', 'access token expired and there is no refresh token'
+    if rexp and rexp <= now:
+        days = max(0, int((now - rexp) / 86400))
+        when = time.strftime('%Y-%m-%d', time.gmtime(rexp))
+        return 'expired', f'refresh token expired {when} ({days}d ago)'
+    return 'ok', 'access token stale but auto-refreshes'
+
+
 def creds_state(cpath, now):
     """(state, reason) for an on-disk .credentials.json."""
     scraped = None
     try:
-        doc = json.load(open(cpath))
-        o = doc.get('claudeAiOauth', {})
-        if not isinstance(o, dict):
-            raise ValueError('claudeAiOauth is not an object')
-        exp, rexp = _ms(o.get('expiresAt')), _ms(o.get('refreshTokenExpiresAt'))
-        has_refresh = bool(o.get('refreshToken'))
+        return creds_doc_state(json.load(open(cpath)), now)
     except Exception as e:
         # Unparseable (truncated / mid-write): fall back to the shim's lenient scrape so
         # both sides agree. Only if that finds nothing usable is the account called dead.
@@ -122,18 +158,40 @@ def creds_state(cpath, now):
         if exp <= now and not (has_refresh and (not rexp or rexp > now)):
             return 'expired', f'credentials unreadable ({str(e)[:60]})'
         return 'ok', 'credentials unreadable but carry a live token — left in the pool'
-    if exp > now:
-        return 'ok', 'oauth credential valid'
-    if not has_refresh:
-        return 'expired', 'access token expired and there is no refresh token'
-    if rexp and rexp <= now:
-        days = max(0, int((now - rexp) / 86400))
-        when = time.strftime('%Y-%m-%d', time.gmtime(rexp))
-        return 'expired', f'refresh token expired {when} ({days}d ago)'
-    return 'ok', 'access token stale but auto-refreshes'
 
 
-LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'blocked': 'BLOCKED',
+def oauth_login(d, now):
+    """Where <d>'s OAuth login lives and whether it can authenticate.
+
+    Returns {'store': 'file'|'keychain'|None, 'state': 'ok'|'expired'|'locked'|None,
+             'reason': str, 'doc': dict|None}. The FILE wins when both exist: it is what
+    a session without keychain access (ssh) will use, and the client itself reads the
+    keychain first only when it can open it. 'locked' means the login exists in the
+    Keychain but this session cannot open it."""
+    cpath = os.path.join(d, '.credentials.json')
+    if _nonempty(cpath):
+        state, reason = creds_state(cpath, now)
+        return {'store': 'file', 'state': state, 'reason': reason, 'doc': None}
+    kc = keychain.probe(d)
+    if kc['state'] == 'present':
+        try:
+            state, reason = creds_doc_state(kc['doc'], now)
+        except ValueError as e:
+            state, reason = 'expired', f'keychain credential unreadable ({str(e)[:60]})'
+        return {'store': 'keychain', 'state': state, 'reason': f'{reason} (macOS Keychain)',
+                'doc': kc['doc']}
+    if kc['state'] == 'corrupt':
+        return {'store': 'keychain', 'state': 'expired',
+                'reason': 'keychain credential is not a credential document', 'doc': None}
+    if kc['state'] == 'locked':
+        return {'store': 'keychain', 'state': 'locked',
+                'reason': ('OAuth login is in the macOS Keychain, which this session '
+                           'cannot open (ssh/background) — it works from the Mac\'s own '
+                           'session'), 'doc': None}
+    return {'store': None, 'state': None, 'reason': '', 'doc': None}
+
+
+LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'blocked': 'BLOCKED', 'locked': 'KEYCHAIN LOCKED',
           'missing': 'NO LOGIN', 'remote': 'ELSEWHERE'}
 
 # `import --home` speaks mac|server; machine_kind() speaks mac|linux. Same two boxes,
@@ -164,6 +222,11 @@ def _fix_for(state, aid):
                 f'(if it stays BLOCKED, an admin must enable Claude Code for it)')
     if state in ('expired', 'missing'):
         return f'claude-accounts relogin {aid}'
+    if state == 'locked':
+        # Not a dead login: the Mac's own session can use it as it is. What an operator
+        # stuck in an ssh session CAN do is mint the portable token from here — the
+        # setup-token ceremony is a fresh browser grant and never reads the keychain.
+        return f'claude-accounts mint {aid}   (portable; or use it from the Mac\'s GUI session)'
     return ''
 
 
@@ -171,13 +234,11 @@ def audit_account(root, acct, now=None, machine=None):
     now = time.time() if now is None else now
     aid = acct.get('id', '')
     d = os.path.join(root, aid)
-    cpath = os.path.join(d, '.credentials.json')
     tpath = os.path.join(d, 'server.token')
-    has_creds = _nonempty(cpath)
     has_token = _nonempty(tpath)
     home = acct.get('home', '?')
     row = {'id': aid, 'email': acct.get('email', ''), 'home': home,
-           'state': 'ok', 'reason': ''}
+           'state': 'ok', 'reason': '', 'store': None}
 
     def done(r):
         r['label'] = LABELS.get(r['state'], r['state'].upper())
@@ -195,8 +256,10 @@ def audit_account(root, acct, now=None, machine=None):
             row['state'] = 'expired'
             row['reason'] = f'marked dead by the pool ({detail or "authentication failed"})'
         return done(row)
-    if has_creds:
-        state, reason = creds_state(cpath, now)
+    login = oauth_login(d, now)
+    row['store'] = login['store']
+    if login['state'] in ('ok', 'expired'):
+        state, reason = login['state'], login['reason']
         if state == 'ok' or has_token:
             # A portable token authenticates on its own, so a dead credential beside it
             # is not fatal — same rule the shim applies.
@@ -209,6 +272,9 @@ def audit_account(root, acct, now=None, machine=None):
         age = int((now - _mtime(tpath)) / 86400)
         row['reason'] = f'server.token present (minted ~{age}d ago)'
         return done(row)
+    if login['state'] == 'locked':
+        row['state'], row['reason'] = 'locked', login['reason']
+        return done(row)
     if machine and _elsewhere(home, machine):
         row['state'] = 'remote'
         row['reason'] = f'no auth here — the grant lives on the {home} machine'

package/lib/codex_reset.py

@@ -0,0 +1,170 @@
+"""Automatic redemption of earned Codex usage-limit reset credits.
+
+The Codex CLI exposes reset credits through the same authenticated backend as
+usage telemetry.  This module is called only after a fresh usage response says
+an account has 5% or less remaining.  A pending idempotency key is written
+before the mutation so a lost response can be retried without spending twice.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+RESET_AT_USED_PERCENT = 95
+REDEEM_COOLDOWN_SECONDS = 900
+STATE_FILE = ".usage-reset.json"
+
+
+def auto_reset_enabled() -> bool:
+    """Return whether automatic redemption is enabled (on by default)."""
+    return os.environ.get("CODEX_MULTIACC_AUTO_RESET", "1").strip().lower() \
+        not in {"0", "false", "no", "off"}
+
+
+def _load(path: str) -> dict:
+    try:
+        value = json.load(open(path, encoding="utf-8"))
+        return value if isinstance(value, dict) else {}
+    except Exception:
+        return {}
+
+
+def _write(path: str, value: dict) -> None:
+    temp = f"{path}.tmp.{os.getpid()}"
+    descriptor = os.open(temp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        json.dump(value, handle, indent=2, sort_keys=True)
+        handle.write("\n")
+    os.replace(temp, path)
+
+
+def _reset_urls(usage_url: str) -> tuple[str, str]:
+    explicit_list = os.environ.get("CODEX_MULTIACC_RESET_CREDITS_URL", "").strip()
+    explicit_consume = os.environ.get("CODEX_MULTIACC_RESET_CONSUME_URL", "").strip()
+    if explicit_list and explicit_consume:
+        return explicit_list, explicit_consume
+    parsed = urllib.parse.urlsplit(usage_url)
+    path = parsed.path
+    if path.endswith("/wham/usage"):
+        prefix = path[: -len("/wham/usage")] + "/wham"
+    elif path.endswith("/api/codex/usage"):
+        prefix = path[: -len("/usage")]
+    elif "/backend-api/" in path:
+        prefix = path.split("/backend-api/", 1)[0] + "/backend-api/wham"
+    else:
+        prefix = path.rsplit("/usage", 1)[0]
+    base = urllib.parse.urlunsplit((parsed.scheme, parsed.netloc, prefix, "", ""))
+    return (explicit_list or f"{base}/rate-limit-reset-credits",
+            explicit_consume or f"{base}/rate-limit-reset-credits/consume")
+
+
+def _request(url: str, headers: dict, payload: dict | None = None) -> dict:
+    data = json.dumps(payload).encode() if payload is not None else None
+    request = urllib.request.Request(url, data=data, headers=headers,
+                                     method="POST" if data is not None else "GET")
+    response = urllib.request.urlopen(request, timeout=15)
+    value = json.loads(response.read().decode())
+    if not isinstance(value, dict):
+        raise ValueError("reset endpoint returned a non-object")
+    return value
+
+
+def _credit_to_redeem(details: dict) -> tuple[int, str | None]:
+    try:
+        available_count = max(0, int(details.get("available_count") or 0))
+    except (TypeError, ValueError):
+        available_count = 0
+    available = [item for item in details.get("credits", [])
+                 if isinstance(item, dict) and item.get("status") == "available"]
+    available.sort(key=lambda item: item.get("expires_at") or "9999-12-31T23:59:59Z")
+    credit_id = str(available[0].get("id") or "") if available else ""
+    return available_count, credit_id or None
+
+
+def _pending_request(account_dir: str, now: int) -> tuple[dict, str]:
+    state_path = os.path.join(account_dir, STATE_FILE)
+    state = _load(state_path)
+    if state.get("state") == "complete" and int(state.get("suppress_until") or 0) > now:
+        return state, "cooldown"
+    if state.get("state") == "pending" and state.get("redeem_request_id"):
+        return state, "pending"
+    return {}, "new"
+
+
+def _redeem_request_id(account_id: str, usage: dict, headers: dict, now: int) -> str:
+    """Return one fleet-stable UUID for this account's current limit windows."""
+    subject = str(headers.get("chatgpt-account-id") or account_id)
+    resets = []
+    stack = [usage]
+    while stack:
+        node = stack.pop()
+        if isinstance(node, dict):
+            value = node.get("reset_at")
+            if value is not None:
+                try:
+                    resets.append(int(float(value)))
+                except (TypeError, ValueError):
+                    pass
+            stack.extend(node.values())
+        elif isinstance(node, list):
+            stack.extend(node)
+    cycle = sorted(set(resets)) or [f"hour-{now // 3600}"]
+    seed = json.dumps({"account": subject, "resets": cycle}, sort_keys=True)
+    return str(uuid.uuid5(uuid.NAMESPACE_URL, seed))
+
+
+def try_auto_redeem(account_dir: str, account_id: str, used_percent: int,
+                    usage: dict, usage_url: str, headers: dict, say,
+                    now: int | None = None) -> dict:
+    """Redeem one available reset and return a non-secret outcome document."""
+    current = int(now if now is not None else time.time())
+    if not auto_reset_enabled() or used_percent < RESET_AT_USED_PERCENT:
+        return {"status": "not_eligible"}
+    state, disposition = _pending_request(account_dir, current)
+    if disposition == "cooldown":
+        return {"status": "cooldown", "outcome": state.get("outcome")}
+    list_url, consume_url = _reset_urls(usage_url)
+    if disposition == "new":
+        summary = usage.get("rate_limit_reset_credits")
+        if isinstance(summary, dict) and int(summary.get("available_count") or 0) <= 0:
+            return {"status": "no_credit"}
+        try:
+            available_count, credit_id = _credit_to_redeem(_request(list_url, headers))
+        except Exception as error:
+            say(f"{account_id}: usage reset availability failed ({type(error).__name__}); failing open")
+            return {"status": "error"}
+        if available_count <= 0:
+            return {"status": "no_credit"}
+        request_id = _redeem_request_id(account_id, usage, headers, current)
+        state = {"schema": 1, "state": "pending", "redeem_request_id": request_id,
+                 "credit_id": credit_id, "started_at": current}
+        _write(os.path.join(account_dir, STATE_FILE), state)
+    payload = {"redeem_request_id": state["redeem_request_id"]}
+    if state.get("credit_id"):
+        payload["credit_id"] = state["credit_id"]
+    try:
+        response = _request(consume_url, headers, payload)
+    except Exception as error:
+        say(f"{account_id}: usage reset redeem failed ({type(error).__name__}); retry is idempotent")
+        return {"status": "pending"}
+    outcome = str(response.get("code") or "unknown")
+    if outcome in {"reset", "already_redeemed"}:
+        complete = {"schema": 1, "state": "complete", "outcome": outcome,
+                    "redeem_request_id": state["redeem_request_id"],
+                    "redeemed_at": current, "suppress_until": current + REDEEM_COOLDOWN_SECONDS,
+                    "windows_reset": int(response.get("windows_reset") or 0)}
+        _write(os.path.join(account_dir, STATE_FILE), complete)
+        say(f"{account_id}: usage reset redeemed automatically at {used_percent}% used")
+        return {"status": "redeemed", "outcome": outcome,
+                "windows_reset": complete["windows_reset"], "redeemed_at": current}
+    try:
+        os.remove(os.path.join(account_dir, STATE_FILE))
+    except OSError:
+        pass
+    return {"status": outcome}

package/lib/common.sh

@@ -117,6 +117,31 @@ find_real_bin() {
 find_real_claude() { find_real_bin claude "${1:-}"; }
 find_real_codex() { find_real_bin codex "${1:-}"; }
 
+# The version string of an installed copy (its package.json), '' when unreadable.
+# Shared because self-update must VERIFY the tree it wrote, in both CLIs.
+pkg_version_at() {
+  [ -f "$1/package.json" ] || return 0
+  sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$1/package.json" | head -1
+}
+
+# The npm that owns THIS install, resolved without trusting the ambient PATH.
+# A launchd agent (and a bare cron) runs with PATH=/usr/bin:/bin:/usr/sbin:/sbin —
+# no homebrew, no nvm — so `command -v npm` fails there and the daily self-update
+# logged "npm not found; skipping" every night while announcing nothing was wrong.
+# Every Mac in the fleet sat frozen on a three-day-old build that way.
+# Order matters: the npm inside the prefix that holds the RUNNING copy is the one
+# whose global tree we must write (my-mini has two node installs, homebrew's and
+# nvm's, and updating the wrong one is the older bug this pairs with).
+find_npm() { # find_npm [prefix]; prints an npm path, or nothing
+  local prefix="${1:-}" cand
+  for cand in ${prefix:+"$prefix/bin/npm"} \
+              /opt/homebrew/bin/npm /usr/local/bin/npm /usr/bin/npm; do
+    [ -x "$cand" ] && { printf '%s\n' "$cand"; return 0; }
+  done
+  cand="$(command -v npm 2>/dev/null)" && [ -n "$cand" ] && { printf '%s\n' "$cand"; return 0; }
+  return 1
+}
+
 manifest_get() { # manifest_get <dot.path> [default]
   local val
   if [ -f "$MANIFEST" ]; then
@@ -423,10 +448,30 @@ has_local_auth() { # $1 = acct dir
   if [ "$MULTIACC_PROVIDER" = "codex" ]; then
     [ -s "$1/auth.json" ]
   else
-    [ -f "$1/.credentials.json" ] || [ -s "$1/server.token" ]
+    [ -f "$1/.credentials.json" ] || [ -s "$1/server.token" ] || keychain_has_login "$1"
   fi
 }
 
+# ---- macOS Keychain-held logins (claude only) ------------------------------------
+# Claude Code on macOS moves a config dir's OAuth login into the login Keychain the
+# first time a GUI-session process can write there, deleting .credentials.json as it
+# goes (lib/keychain.py has the whole story). These wrap that module so bash callers
+# never parse `security` output themselves. Each one is a no-op (absent) off macOS.
+keychain_state() { # $1 = acct dir -> prints present|locked|absent|corrupt|unavailable
+  local state
+  [ "$MULTIACC_PROVIDER" = "codex" ] && { echo absent; return 0; }
+  state="$("$PYBIN" "$LIB_DIR/keychain.py" probe "$1" 2>/dev/null \
+    | LC_ALL=C sed -n 's/.*"state": *"\([a-z]*\)".*/\1/p' | head -1)"
+  printf '%s\n' "${state:-unavailable}"
+}
+keychain_has_login() { # $1 = acct dir: an item EXISTS here (readable or locked)
+  case "$(keychain_state "$1")" in present|locked|corrupt) return 0 ;; *) return 1 ;; esac
+}
+keychain_forget() { # $1 = acct dir: drop the item (a removed account must not leave a grant behind)
+  [ "$MULTIACC_PROVIDER" = "codex" ] && return 0
+  "$PYBIN" "$LIB_DIR/keychain.py" delete "$1" >/dev/null 2>&1 || true
+}
+
 # ---- expired-login bookkeeping -------------------------------------------------
 # `.expired` is the persistent "this account cannot authenticate" marker the shim
 # honors (bin/claude: expired_marked). Two lines: marked-at epoch, then details.
@@ -487,15 +532,27 @@ accounts_needing_login() {
 # True when <acct dir>'s credential can authenticate right now (the audit module's
 # rule — audit.py for claude, codex_audit.py for codex; both expose creds_state).
 creds_alive() { # $1 = acct dir
-  local cred
-  if [ "$MULTIACC_PROVIDER" = "codex" ]; then cred="$1/auth.json"; else cred="$1/.credentials.json"; fi
-  [ -s "$cred" ] || return 1
-  "$PYBIN" - "$AUDIT_PY" "$cred" <<'PYEOF' 2>/dev/null
+  if [ "$MULTIACC_PROVIDER" = "codex" ]; then
+    [ -s "$1/auth.json" ] || return 1
+    "$PYBIN" - "$AUDIT_PY" "$1/auth.json" <<'PYEOF' 2>/dev/null
 import importlib.util, sys, time
 spec = importlib.util.spec_from_file_location('audit', sys.argv[1])
 mod = importlib.util.module_from_spec(spec)
 spec.loader.exec_module(mod)
 sys.exit(0 if mod.creds_state(sys.argv[2], time.time())[0] == 'ok' else 1)
+PYEOF
+    return $?
+  fi
+  # claude: the login is wherever the client put it — .credentials.json, or the macOS
+  # Keychain when the sign-in ran in a session that could open it. A ceremony that
+  # succeeded into the Keychain used to be reported as "login failed" and its
+  # half-made account dir deleted, stranding a live grant under an orphaned service.
+  "$PYBIN" - "$AUDIT_PY" "$1" <<'PYEOF' 2>/dev/null
+import importlib.util, sys, time
+spec = importlib.util.spec_from_file_location('audit', sys.argv[1])
+mod = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(mod)
+sys.exit(0 if mod.oauth_login(sys.argv[2], time.time())['state'] == 'ok' else 1)
 PYEOF
 }
 

package/lib/credential.py

@@ -220,8 +220,16 @@ def cmd_export(argv):
     cpath = os.path.join(d, '.credentials.json')
     has_token = os.path.isfile(tpath) and os.path.getsize(tpath) > 0
     if not has_token:
+        where = None
         if os.path.isfile(cpath) and os.path.getsize(cpath) > 0:
-            die(f'{aid} only has a MACHINE-LOCAL credential (.credentials.json) and cannot '
+            where = '.credentials.json'
+        else:
+            sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+            import keychain
+            if keychain.probe(d)['state'] in ('present', 'locked', 'corrupt'):
+                where = 'macOS Keychain'
+        if where:
+            die(f'{aid} only has a MACHINE-LOCAL credential ({where}) and cannot '
                 f'be exported.\n'
                 f'  Why: the OAuth grant\'s refresh token ROTATES on every refresh; a second\n'
                 f'  machine refreshing the same grant strands the first one.\n'