very-happy-cli 0.2.96 → 0.2.98

package/dist/{index-uc-dtu-3.cjs → index-CO1gNtuP.cjs}

@@ -3,7 +3,7 @@
 var chalk = require('chalk');
 var os = require('node:os');
 var node_crypto = require('node:crypto');
-var persistence = require('./types-okYCRlgl.cjs');
+var persistence = require('./types-BP-4phS_.cjs');
 var spawn = require('cross-spawn');
 var path = require('node:path');
 var node_readline = require('node:readline');
@@ -33,11 +33,11 @@ var open = require('open');
 var fastify = require('fastify');
 var z = require('zod');
 var fastifyTypeProviderZod = require('fastify-type-provider-zod');
+var node_module = require('node:module');
 var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
 var node_http = require('node:http');
 var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
 var limits = require('./limits-KdWKmwtH.cjs');
-var node_module = require('node:module');
 var http = require('http');
 var util = require('util');
 var inquirer = require('inquirer');
@@ -197,6 +197,9 @@ async function spawnDaemonSession(directory, sessionId, opts) {
 async function notifyDaemonSessionEvent(sessionId, event, spawnedBy) {
   return daemonPost("/session-event", { sessionId, event, spawnedBy });
 }
+async function notifyDaemonClaudeAuthFailed(sessionId) {
+  return daemonPost("/session-event", { sessionId, event: "auth_failed" });
+}
 async function stopDaemonHttp() {
   await daemonPost("/stop");
 }
@@ -1766,6 +1769,20 @@ function parseSpecialCommand(message) {
   };
 }
 
+const AUTH_FAILURE_RESULT_TEXT = /Failed to authenticate|OAuth session expired/i;
+const QUERY_RECYCLE_NOTICE = {
+  authentication_failed: "\u26A0\uFE0F Claude Code could not refresh its OAuth session. This agent process was ended so your next message starts a fresh one that re-reads the credentials on this machine; if it fails again, run `claude` on the machine to log in again."
+};
+function queryRecycleReason(result, lastAssistantError) {
+  if (lastAssistantError === "authentication_failed") {
+    return "authentication_failed";
+  }
+  if (result.is_error && typeof result.result === "string" && AUTH_FAILURE_RESULT_TEXT.test(result.result)) {
+    return "authentication_failed";
+  }
+  return null;
+}
+
 class PushableAsyncIterable {
   queue = [];
   waiters = [];
@@ -2026,11 +2043,15 @@ async function claudeRemote(opts) {
       }
     });
   }
+  let lastAssistantError;
   updateThinking(true);
   try {
     persistence.logger.debug(`[claudeRemote] Starting to iterate over response`);
     for await (const message of response) {
       persistence.logger.debug(`[claudeRemote] Message ${message.type}`, persistence.contentLogMetadata(message));
+      if (message.type === "assistant" && message.error) {
+        lastAssistantError = message.error;
+      }
       const outboundMessage = isCompactCommand && message.type === "assistant" ? { ...message, isCompactSummary: true } : message;
       opts.onMessage(outboundMessage);
       if (message.type === "system" && message.subtype === "init") {
@@ -2079,6 +2100,15 @@ async function claudeRemote(opts) {
           isCompactCommand = false;
         }
         opts.onReady(message);
+        const recycleReason = queryRecycleReason(message, lastAssistantError);
+        lastAssistantError = void 0;
+        if (recycleReason) {
+          persistence.logger.warn(`[claudeRemote] Ending SDK query after ${recycleReason}; the next message starts a fresh Claude Code process`);
+          opts.onCompletionEvent?.(QUERY_RECYCLE_NOTICE[recycleReason]);
+          opts.onAuthFailure?.(recycleReason);
+          messages.end();
+          continue;
+        }
         opts.nextMessage().then((next) => {
           if (!next) {
             messages.end();
@@ -3282,8 +3312,9 @@ async function cleanupStdinAfterInk(opts) {
 }
 
 function applyClaudeResultLifecycle(result, callbacks) {
-  if (result && result.subtype !== "success") {
-    const error = result.errors?.filter(Boolean).join("\n").trim() || result.subtype;
+  if (result && (result.subtype !== "success" || result.is_error === true)) {
+    const frame = result;
+    const error = frame.errors?.filter(Boolean).join("\n").trim() || (typeof frame.result === "string" ? frame.result.trim() : "") || frame.subtype;
     callbacks.closeFailed(error);
     callbacks.onFailed(error);
     return;
@@ -3755,6 +3786,10 @@ async function claudeRemoteLauncher(session, onPermissionModeChange, onEffective
             persistence.logger.debug("[remote]: Completion event received:", persistence.contentLogMetadata(message));
             session.client.sendSessionEvent({ type: "message", message });
           },
+          onAuthFailure: (reason) => {
+            session.client.sendSessionEvent({ type: "message", message: `Claude Code auth: ${reason}`, kind: "claude-auth-failed" });
+            void notifyDaemonClaudeAuthFailed(session.client.sessionId).catch((error) => persistence.logger.debug("[remote]: auth_failed report to daemon failed:", error));
+          },
           onSessionReset: () => {
             persistence.logger.debug("[remote]: Session reset");
             session.clearSessionId();
@@ -5428,6 +5463,7 @@ function startDaemonControlServer({
   requestShutdown,
   onHappySessionWebhook,
   onSessionStateEvent,
+  onClaudeAuthFailed,
   pushClipboard,
   onTerminalHook
 }) {
@@ -5483,7 +5519,7 @@ function startDaemonControlServer({
       schema: {
         body: z.z.object({
           sessionId: z.z.string(),
-          event: z.z.enum(["completed", "needs_input"]),
+          event: z.z.enum(["completed", "needs_input", "auth_failed"]),
           spawnedBy: z.z.string().optional()
         }),
         response: {
@@ -5495,6 +5531,10 @@ function startDaemonControlServer({
     }, async (request) => {
       const { sessionId, event, spawnedBy } = request.body;
       persistence.logger.debug(`[CONTROL SERVER] Session event: ${sessionId} ${event} (spawnedBy=${spawnedBy ?? "unset"})`);
+      if (event === "auth_failed") {
+        onClaudeAuthFailed?.(sessionId);
+        return { status: "ok" };
+      }
       onSessionStateEvent?.(sessionId, event, spawnedBy);
       return { status: "ok" };
     });
@@ -6668,6 +6708,444 @@ async function handleResumeCommand(args) {
   }
 }
 
+const CLAUDE_KEYCHAIN_SERVICE_PREFIX = "Claude Code";
+function keychainIdentity(env = process.env, deps = {}) {
+  const home = deps.home ?? os.homedir();
+  const secureDir = env.CLAUDE_SECURESTORAGE_CONFIG_DIR?.trim();
+  const configDirEnv = env.CLAUDE_CONFIG_DIR?.trim();
+  const configDir = secureDir || configDirEnv || path.join(home, ".claude");
+  const hasCustomDir = Boolean(secureDir || configDirEnv);
+  const dirSuffix = hasCustomDir ? "-" + node_crypto.createHash("sha256").update(configDir.normalize("NFC")).digest("hex").slice(0, 8) : "";
+  const oauthSuffix = env.CLAUDE_CODE_OAUTH_CLIENT_ID?.trim() ? "-custom-oauth" : "";
+  const rawAccount = env.USER || safeUsername(deps.username);
+  const account = /^[a-zA-Z0-9._-]+$/.test(rawAccount) ? rawAccount : "claude-code-user";
+  return {
+    service: `${CLAUDE_KEYCHAIN_SERVICE_PREFIX}${oauthSuffix}-credentials${dirSuffix}`,
+    account,
+    configDir,
+    credentialsPath: path.join(configDir, ".credentials.json")
+  };
+}
+function safeUsername(provider) {
+  try {
+    return provider ? provider() : os.userInfo().username;
+  } catch {
+    return "";
+  }
+}
+
+const CLAUDE_AUTH_PROBE_VERSION = 1;
+const LOCAL_CREDENTIAL_SOURCE = "Claude local credentials";
+function classifyAuthStatus(run, credentialSource) {
+  const localSource = credentialSource === void 0 || credentialSource === LOCAL_CREDENTIAL_SOURCE;
+  if (run.spawnError) {
+    return { status: "error", diagnosis: "probe-crash", detail: `could not run claude auth status: ${run.spawnError}` };
+  }
+  if (run.timedOut) {
+    return { status: "error", diagnosis: "probe-timeout", detail: "claude auth status did not answer within the timeout" };
+  }
+  const parsed = parseJsonObject(run.stdout);
+  if (!parsed) {
+    if (!localSource) return { status: "unknown", authMethod: credentialSource, detail: `auth status unparseable under ${credentialSource}` };
+    return { status: "error", diagnosis: "probe-crash", detail: `claude auth status returned no JSON (exit ${run.exitCode ?? "null"})` };
+  }
+  const authMethod = typeof parsed.authMethod === "string" ? parsed.authMethod : void 0;
+  const subscriptionType = typeof parsed.subscriptionType === "string" ? parsed.subscriptionType : void 0;
+  if (parsed.loggedIn === true) {
+    return { status: "ok", authMethod: localSource ? authMethod : credentialSource, subscriptionType };
+  }
+  if (!localSource) {
+    return { status: "unknown", authMethod: credentialSource, detail: `Claude Code reports loggedIn=false under ${credentialSource}; not a local-credential failure` };
+  }
+  return { status: "not-logged-in", authMethod, subscriptionType, detail: "Claude Code in the daemon context reports it is not logged in" };
+}
+function parseJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  const start = trimmed.indexOf("{");
+  if (start < 0) return null;
+  try {
+    const value = JSON.parse(trimmed.slice(start));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-CO1gNtuP.cjs', document.baseURI).href))).resolve(s)) {
+  const platformArch = `${platform}-${arch}`;
+  const candidates = [
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude.exe`
+  ];
+  for (const candidate of candidates) {
+    try {
+      return resolver(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function interpretSecurityRead(result) {
+  if (result.error === "ENOENT") return { kind: "unsupported" };
+  if (result.error === "timeout") return { kind: "error", detail: "security timed out" };
+  if (result.exitCode === 44) return { kind: "absent" };
+  if (result.exitCode === 36) return { kind: "unreadable" };
+  if (result.exitCode !== 0) return { kind: "error", detail: `security exited ${result.exitCode ?? "null"}` };
+  const raw = result.stdout.trim();
+  if (!raw) return { kind: "absent" };
+  const parsed = parseJsonObject(raw);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  if (!oauth) return { kind: "present", accessToken: "", refreshToken: "", raw };
+  return {
+    kind: "present",
+    accessToken: typeof oauth.accessToken === "string" ? oauth.accessToken : "",
+    refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : "",
+    raw
+  };
+}
+function interpretCredentialsFile(text) {
+  if (text === null) return { exists: false, hasTokens: false, refreshToken: "" };
+  const parsed = parseJsonObject(text);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  const access = oauth && typeof oauth.accessToken === "string" ? oauth.accessToken : "";
+  const refresh = oauth && typeof oauth.refreshToken === "string" ? oauth.refreshToken : "";
+  return { exists: true, hasTokens: access.length > 0 && refresh.length > 0, refreshToken: refresh };
+}
+function tokenTail(token) {
+  return token ? node_crypto.createHash("sha256").update(token).digest("hex").slice(-6) : "";
+}
+function diagnoseStores(input) {
+  const { status, keychain, file } = input;
+  if (keychain.kind === "present") {
+    const empty = keychain.accessToken.length === 0 && keychain.refreshToken.length === 0;
+    if (empty && file.hasTokens && status === "not-logged-in") {
+      return {
+        diagnosis: "keychain-empty-item",
+        repairable: "delete-empty-keychain-item",
+        keychainRaw: keychain.raw,
+        detail: "The login keychain holds a Claude Code credentials item with empty tokens; Claude Code prefers it over the valid ~/.claude/.credentials.json and reports not logged in."
+      };
+    }
+    if (!empty && file.hasTokens && tokenTail(keychain.refreshToken) !== tokenTail(file.refreshToken)) {
+      return {
+        diagnosis: "store-divergence",
+        detail: "Keychain and ~/.claude/.credentials.json hold different refresh tokens; one of them will stop working at its next refresh. Treat the daemon-context login as canonical, or pin credentialStore=file."
+      };
+    }
+    return {};
+  }
+  if ((keychain.kind === "absent" || keychain.kind === "unreadable" || keychain.kind === "unsupported") && !file.hasTokens) {
+    return { diagnosis: "no-credentials", detail: "No Claude Code credentials found for this daemon context; log in with `claude` on this machine." };
+  }
+  if (keychain.kind === "unreadable" && file.hasTokens && status === "not-logged-in") {
+    return { detail: "The daemon context cannot read the keychain and the file credentials were not accepted; compare `claude auth status` on the machine." };
+  }
+  if (keychain.kind === "error") {
+    return { detail: `keychain check failed: ${keychain.detail}` };
+  }
+  return {};
+}
+function securityReadArgs(identity) {
+  return ["find-generic-password", "-s", identity.service, "-a", identity.account, "-w"];
+}
+function securityDeleteArgs(identity) {
+  return ["delete-generic-password", "-s", identity.service, "-a", identity.account];
+}
+const HAPPY_DAEMON_LAUNCHD_LABEL = "com.mereith.happy-daemon";
+function classifyLineage(input) {
+  if (input.platform !== "darwin") return "other";
+  const label = input.label ?? HAPPY_DAEMON_LAUNCHD_LABEL;
+  if (input.env.XPC_SERVICE_NAME !== label) return "other";
+  if (input.launchdJobPid !== null && input.ancestorPids.includes(input.launchdJobPid)) return "launchd";
+  return "inherited-env";
+}
+function parseLaunchctlPid(printOutput) {
+  const match = /^\s*pid\s*=\s*(\d+)/m.exec(printOutput);
+  return match ? Number(match[1]) : null;
+}
+function keychainOffShimDir(happyLibDir) {
+  return path.join(happyLibDir, "scripts", "shims", "keychain-off");
+}
+function withKeychainOffPath(path$1, shimDir) {
+  const parts = (path$1 ?? "").split(path.delimiter).filter((p) => p && p !== shimDir);
+  return [shimDir, ...parts].join(path.delimiter);
+}
+function buildClaudeAuthState(input) {
+  const { classification, diagnosis } = input;
+  const detail = (diagnosis?.detail ?? classification.detail)?.slice(0, 200);
+  const state = {
+    probeVersion: CLAUDE_AUTH_PROBE_VERSION,
+    daemonPid: input.daemonPid,
+    status: classification.status,
+    context: { platform: input.platform, lineage: input.lineage, credentialStore: input.credentialStore },
+    checkedAt: input.now ?? Date.now()
+  };
+  if (classification.authMethod) state.authMethod = classification.authMethod;
+  if (classification.subscriptionType) state.subscriptionType = classification.subscriptionType;
+  const diag = diagnosis?.diagnosis ?? classification.diagnosis;
+  if (diag) state.diagnosis = diag;
+  if (detail) state.detail = detail;
+  if (diagnosis?.repairable) state.repairable = diagnosis.repairable;
+  return state;
+}
+function claudeAuthStateChanged(prev, next) {
+  if (!prev) return true;
+  const strip = ({ checkedAt: _c, ...rest }) => JSON.stringify(rest);
+  return strip(prev) !== strip(next);
+}
+function keychainIdentityFor(env) {
+  return keychainIdentity(env);
+}
+
+const CLAUDE_AUTH_PROBE_INTERVAL_MS = 10 * 60 * 1e3;
+const CLAUDE_AUTH_REFRESH_INTERVAL_MS = 30 * 60 * 1e3;
+const PROBE_TIMEOUT_MS = 8e3;
+const SECURITY_TIMEOUT_MS = 3e3;
+const SIGNAL_DEBOUNCE_MS = 1e3;
+class ClaudeAuthService {
+  constructor(opts) {
+    this.opts = opts;
+    this.env = opts.env ?? process.env;
+    this.platform = opts.platform ?? process.platform;
+  }
+  timer = null;
+  signalTimer = null;
+  inFlight = null;
+  last = null;
+  dirty = false;
+  lastPublishedAt = 0;
+  lineage = null;
+  lastDiagnosis;
+  env;
+  platform;
+  start() {
+    setTimeout(() => void this.probe("startup"), 2e3).unref();
+    this.timer = setInterval(() => void this.probe("interval"), CLAUDE_AUTH_PROBE_INTERVAL_MS);
+    this.timer.unref();
+  }
+  stop() {
+    if (this.timer) clearInterval(this.timer);
+    if (this.signalTimer) clearTimeout(this.signalTimer);
+    this.timer = null;
+    this.signalTimer = null;
+  }
+  current() {
+    return this.last;
+  }
+  /** D3: a session reported `authentication_failed`; re-probe after a short debounce. */
+  signalAuthFailed(sessionId) {
+    persistence.logger.debug(`[CLAUDE AUTH] auth_failed signal from session ${sessionId}`);
+    if (this.signalTimer) clearTimeout(this.signalTimer);
+    this.signalTimer = setTimeout(() => {
+      this.signalTimer = null;
+      void this.probe("signal", true);
+    }, SIGNAL_DEBOUNCE_MS);
+    this.signalTimer.unref();
+  }
+  /** Env the SDK/one-shot Claude Code processes should get for the current store setting. */
+  claudeProcessEnvOverrides() {
+    if (this.opts.getCredentialStore() !== "file") return {};
+    const shim = this.resolveShimDir();
+    if (!shim) return {};
+    return { PATH: withKeychainOffPath(this.env.PATH, shim) };
+  }
+  effectiveCredentialStore() {
+    if (this.opts.getCredentialStore() !== "file") return "auto";
+    return this.resolveShimDir() ? "file" : "auto";
+  }
+  async probe(reason, withDiagnosis = false) {
+    if (this.inFlight) return this.inFlight;
+    this.inFlight = this.runProbe(reason, withDiagnosis).finally(() => {
+      this.inFlight = null;
+    });
+    return this.inFlight;
+  }
+  async setStore(store) {
+    await this.opts.setCredentialStore(store);
+    return this.probe("set-store", true);
+  }
+  /** D4: delete the empty-token keychain item after re-validating every precondition. */
+  async repair(action) {
+    if (action !== "delete-empty-keychain-item") return { error: "unknown-action", claudeAuth: this.last };
+    if (this.platform !== "darwin" || this.effectiveCredentialStore() === "file") return { error: "precondition-failed", claudeAuth: this.last };
+    const state = await this.probe("repair-precheck", true);
+    const seen = this.lastDiagnosis;
+    if (state.diagnosis !== "keychain-empty-item" || !seen?.keychainRaw) return { error: "precondition-failed", claudeAuth: state };
+    const identity = keychainIdentityFor(this.env);
+    const again = interpretSecurityRead(await this.security(securityReadArgs(identity)));
+    if (again.kind !== "present" || again.raw !== seen.keychainRaw || again.accessToken || again.refreshToken) {
+      return { error: "precondition-failed", claudeAuth: state };
+    }
+    try {
+      const dir = path.join(this.opts.happyHomeDir, "backups");
+      node_fs.mkdirSync(dir, { recursive: true, mode: 448 });
+      node_fs.writeFileSync(path.join(dir, `claude-keychain-${Date.now()}.json`), again.raw + "\n", { mode: 384 });
+    } catch (error) {
+      return { error: `backup-failed: ${String(error)}`, claudeAuth: state };
+    }
+    const del = await this.security(securityDeleteArgs(identity));
+    if (del.exitCode !== 0) return { error: `delete-failed: security exited ${del.exitCode ?? "null"}`, claudeAuth: state };
+    persistence.logger.debug("[CLAUDE AUTH] deleted empty-token keychain item after backup");
+    const after = await this.probe("repair-done", true);
+    return { ok: true, claudeAuth: after };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  resolveShimDir() {
+    const dir = keychainOffShimDir(this.opts.happyLibDir);
+    const bin = path.join(dir, "security");
+    try {
+      if (!node_fs.statSync(bin).isFile()) return null;
+      node_fs.accessSync(bin, node_fs.constants.X_OK);
+      return dir;
+    } catch {
+      return null;
+    }
+  }
+  async runProbe(reason, withDiagnosis) {
+    const store = this.effectiveCredentialStore();
+    const storeRequested = this.opts.getCredentialStore();
+    const classification = await this.runAuthStatus();
+    let diagnosis;
+    this.lastDiagnosis = void 0;
+    if (this.platform === "darwin" && store !== "file" && (classification.status === "not-logged-in" || withDiagnosis && classification.status !== "unknown")) {
+      diagnosis = await this.diagnose(classification.status);
+      this.lastDiagnosis = diagnosis;
+    } else if (classification.status === "not-logged-in" && store === "file") {
+      const file = interpretCredentialsFile(this.readCredentialsFile());
+      if (!file.hasTokens) diagnosis = { diagnosis: "no-credentials", detail: "credentialStore=file and ~/.claude/.credentials.json has no tokens; log in with `claude` from a terminal on this machine." };
+    }
+    if (storeRequested === "file" && store === "auto") {
+      diagnosis = { ...diagnosis ?? {}, detail: `credentialStore=file requested but the keychain-off shim is missing under ${keychainOffShimDir(this.opts.happyLibDir)}; running in auto mode.` };
+    }
+    const state = buildClaudeAuthState({
+      daemonPid: process.pid,
+      platform: this.platform,
+      lineage: await this.resolveLineage(),
+      credentialStore: store,
+      classification,
+      diagnosis,
+      now: this.opts.now?.() ?? Date.now()
+    });
+    const changed = claudeAuthStateChanged(this.last, state);
+    const stale = state.checkedAt - this.lastPublishedAt >= CLAUDE_AUTH_REFRESH_INTERVAL_MS;
+    if (changed) {
+      persistence.logger.debug(`[CLAUDE AUTH] ${reason}: status=${state.status} diagnosis=${state.diagnosis ?? "-"} lineage=${state.context.lineage} store=${state.context.credentialStore}`);
+    }
+    this.last = state;
+    if (changed || stale || this.dirty) {
+      const ok = await this.opts.publish(state).catch((error) => {
+        persistence.logger.debug("[CLAUDE AUTH] publish failed:", error);
+        return false;
+      });
+      this.dirty = !ok;
+      if (ok) this.lastPublishedAt = state.checkedAt;
+      else persistence.logger.warn("[CLAUDE AUTH] daemonState publish did not land; will force resend on the next probe");
+    }
+    return state;
+  }
+  async runAuthStatus() {
+    const binary = resolveSdkClaudeBinary(this.platform, process.arch);
+    if (!binary) {
+      return { status: "claude-missing", diagnosis: "sdk-binary-missing", detail: "The Claude Code binary bundled with the Agent SDK is missing; remote sessions cannot start." };
+    }
+    const cwd = path.join(this.opts.happyHomeDir, "tmp", "auth-probe");
+    try {
+      node_fs.mkdirSync(cwd, { recursive: true });
+    } catch {
+    }
+    const env = { ...this.env, ...this.claudeProcessEnvOverrides() };
+    const run = await new Promise((resolve) => {
+      let stdout = "";
+      let settled = false;
+      const done = (r) => {
+        if (!settled) {
+          settled = true;
+          resolve(r);
+        }
+      };
+      let child;
+      try {
+        child = node_child_process.spawn(binary, ["auth", "status"], { cwd, env, stdio: ["ignore", "pipe", "ignore"] });
+      } catch (error) {
+        done({ stdout: "", exitCode: null, timedOut: false, spawnError: String(error) });
+        return;
+      }
+      const timer = setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+        done({ stdout, exitCode: null, timedOut: true });
+      }, PROBE_TIMEOUT_MS);
+      child.stdout?.on("data", (chunk) => {
+        if (stdout.length < 65536) stdout += chunk.toString("utf8");
+      });
+      child.on("error", (error) => {
+        clearTimeout(timer);
+        done({ stdout, exitCode: null, timedOut: false, spawnError: String(error) });
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        done({ stdout, exitCode: code, timedOut: false });
+      });
+    });
+    return classifyAuthStatus(run, this.opts.credentialSource);
+  }
+  async diagnose(status) {
+    const identity = keychainIdentityFor(this.env);
+    const keychain = interpretSecurityRead(await this.security(securityReadArgs(identity)));
+    const file = interpretCredentialsFile(this.readCredentialsFile(identity.credentialsPath));
+    return diagnoseStores({ status, keychain, file });
+  }
+  readCredentialsFile(path) {
+    const target = path ?? keychainIdentityFor(this.env).credentialsPath;
+    try {
+      return node_fs.existsSync(target) ? node_fs.readFileSync(target, "utf8") : null;
+    } catch {
+      return null;
+    }
+  }
+  security(args) {
+    return new Promise((resolve) => {
+      node_child_process.execFile("security", args, { env: this.env, timeout: SECURITY_TIMEOUT_MS, maxBuffer: 65536 }, (error, stdout) => {
+        const err = error;
+        if (err && err.code === "ENOENT") return resolve({ exitCode: null, stdout: "", error: "ENOENT" });
+        if (err && err.killed) return resolve({ exitCode: null, stdout: "", error: "timeout" });
+        const exitCode = err ? typeof err.code === "number" ? err.code : 1 : 0;
+        resolve({ exitCode, stdout: String(stdout ?? "") });
+      });
+    });
+  }
+  async resolveLineage() {
+    if (this.lineage) return this.lineage;
+    if (this.platform !== "darwin") {
+      this.lineage = "other";
+      return this.lineage;
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : null;
+    const launchdJobPid = uid === null ? null : parseLaunchctlPid(await this.exec("launchctl", ["print", `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`]));
+    const ancestors = await this.ancestorPids();
+    this.lineage = classifyLineage({ platform: this.platform, env: this.env, launchdJobPid, ancestorPids: ancestors });
+    return this.lineage;
+  }
+  async ancestorPids() {
+    const out = [];
+    let pid = process.ppid;
+    for (let i = 0; i < 10 && pid > 1; i++) {
+      out.push(pid);
+      const ppid = Number((await this.exec("ps", ["-o", "ppid=", "-p", String(pid)])).trim());
+      if (!Number.isFinite(ppid) || ppid === pid) break;
+      pid = ppid;
+    }
+    return out;
+  }
+  exec(cmd, args) {
+    return new Promise((resolve) => {
+      node_child_process.execFile(cmd, args, { env: this.env, timeout: SECURITY_TIMEOUT_MS, maxBuffer: 65536 }, (_error, stdout) => resolve(String(stdout ?? "")));
+    });
+  }
+}
+
 const INTERNAL_CLAUDE_EVENT_TYPES = /* @__PURE__ */ new Set(["file-history-snapshot", "change", "queue-operation"]);
 function parseLines(lines) {
   const out = [];
@@ -7372,9 +7850,6 @@ async function claimSessionOrExit(happySessionId, options) {
   process.on("exit", () => releaseSessionLock(happySessionId));
 }
 
-function shellescape(s) {
-  return "'" + s.replace(/'/g, "'\\''") + "'";
-}
 const hostSuffix = process.env.HAPPY_VARIANT === "dev" ? "-dev" : "";
 const initialMachineMetadata = {
   host: os$1.hostname() + hostSuffix,
@@ -7387,6 +7862,8 @@ const initialMachineMetadata = {
   resumeSupport: { ...persistence.detectResumeSupport(), rpcAvailable: true }
 };
 async function startDaemon() {
+  let claudeAuthServiceRef = null;
+  let claudeCredentialStoreSetting = (await persistence.readSettings()).claudeCredentialStore === "file" ? "file" : "auto";
   let requestShutdown;
   let resolvesWhenShutdownRequested = new Promise((resolve) => {
     requestShutdown = (source, errorMessage) => {
@@ -7693,7 +8170,11 @@ async function startDaemon() {
         }
         let extraEnv = {
           ...authEnv,
-          ...options.environmentVariables ?? {}
+          ...options.environmentVariables ?? {},
+          // B-276 D8: credentialStore=file pins the spawned Claude Code (SDK
+          // Query, title/board one-shots — all inside this wrapper) to
+          // ~/.claude/.credentials.json via the keychain-off `security` shim.
+          ...claudeAuthServiceRef?.claudeProcessEnvOverrides() ?? {}
         };
         if (options.parentSessionId) {
           extraEnv.HAPPY_FORKED_FROM_SESSION_ID = options.parentSessionId;
@@ -7753,8 +8234,8 @@ async function startDaemon() {
           const cliPath = path$1.join(persistence.projectPath(), "dist", "index.mjs");
           const agent = options.agent === "gemini" ? "gemini" : options.agent === "codex" ? "codex" : options.agent === "openclaw" ? "openclaw" : "claude";
           const resumeId = agent === "claude" ? options.resumeClaudeSessionId : agent === "codex" ? options.resumeCodexThreadId : void 0;
-          const resumeFragment = resumeId ? ` --resume ${shellescape(resumeId)}` : "";
-          const permissionModeFragment = spawnPermissionMode ? ` --permission-mode ${shellescape(spawnPermissionMode)}` : "";
+          const resumeFragment = resumeId ? ` --resume ${persistence.shellescape(resumeId)}` : "";
+          const permissionModeFragment = spawnPermissionMode ? ` --permission-mode ${persistence.shellescape(spawnPermissionMode)}` : "";
           const fullCommand = `node --no-warnings --no-deprecation ${cliPath} ${agent} --happy-starting-mode remote --started-by daemon${resumeFragment}${permissionModeFragment}`;
           const windowName = `happy-${Date.now()}-${agent}`;
           const tmuxEnv = {};
@@ -8319,6 +8800,7 @@ async function startDaemon() {
       requestShutdown: () => requestShutdown("happy-cli"),
       onHappySessionWebhook,
       onSessionStateEvent,
+      onClaudeAuthFailed: (sessionId) => claudeAuthServiceRef?.signalAuthFailed(sessionId),
       pushClipboard: (text) => {
         if (!apiMachineRef) {
           return { delivered: false, truncated: false, totalBytes: 0, error: "daemon is still starting up" };
@@ -8389,6 +8871,25 @@ async function startDaemon() {
       listTrackedSessionIds: () => [...pidToTrackedSession.values()].map((session) => session.happySessionId).filter((sessionId) => typeof sessionId === "string"),
       requestShutdown: () => requestShutdown("happy-app")
     });
+    const claudeAuthService = new ClaudeAuthService({
+      happyHomeDir: persistence.configuration.happyHomeDir,
+      happyLibDir: persistence.projectPath(),
+      credentialSource: daemonClaudeCredentials.source,
+      getCredentialStore: () => claudeCredentialStoreSetting,
+      setCredentialStore: async (store) => {
+        const settings = await persistence.readSettings();
+        await persistence.writeSettings({ ...settings, claudeCredentialStore: store });
+        claudeCredentialStoreSetting = store;
+      },
+      publish: (state) => apiMachine.setClaudeAuthState(state)
+    });
+    claudeAuthServiceRef = claudeAuthService;
+    apiMachine.setClaudeAuthHandlers({
+      probe: () => claudeAuthService.probe("rpc", true),
+      repair: (action) => claudeAuthService.repair(action),
+      setStore: (store) => claudeAuthService.setStore(store)
+    });
+    claudeAuthService.start();
     apiMachine.connect();
     let cliUpdateCheckRunning = false;
     const refreshCliUpdate = async () => {
@@ -8443,6 +8944,8 @@ async function startDaemon() {
         persistence.logger.debug("[DAEMON RUN] Daemon bundle replaced on disk, handing off to new daemon");
         clearInterval(restartOnStaleVersionAndHeartbeat);
         clearInterval(cliUpdateInterval);
+        claudeAuthService.stop();
+        claudeAuthService.stop();
         apiMachine.shutdown();
         await stopControlServer();
         await cleanupDaemonState();
@@ -9436,7 +9939,7 @@ const MAX_TITLE_CHARS = 60;
 const GENERATION_TIMEOUT_MS = 3e4;
 function resolveClaudeBinary() {
   try {
-    const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-uc-dtu-3.cjs', document.baseURI).href)));
+    const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-CO1gNtuP.cjs', document.baseURI).href)));
     const utilsPath = path.resolve(path.join(persistence.projectPath(), "scripts", "claude_version_utils.cjs"));
     const { getClaudeCliPath } = require$1(utilsPath);
     const path$1 = getClaudeCliPath();
@@ -11631,9 +12134,9 @@ function resolveLocalSignupBootstrap(configuredMode, configuredInviteCodes, gene
   };
 }
 
-const __filename$1 = node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-uc-dtu-3.cjs', document.baseURI).href)));
+const __filename$1 = node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-CO1gNtuP.cjs', document.baseURI).href)));
 const __dirname$1 = path.dirname(__filename$1);
-const require_ = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-uc-dtu-3.cjs', document.baseURI).href)));
+const require_ = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index-CO1gNtuP.cjs', document.baseURI).href)));
 const PRISMA_QUERY_ENGINE_FILES = {
   "arm64-darwin": "libquery_engine-darwin-arm64.dylib.node",
   "x64-darwin": "libquery_engine-darwin.dylib.node",
@@ -14257,7 +14760,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     process.exit(0);
   } else if (subcommand === "install-terminal-hooks") {
     try {
-      const { installTerminalHooks, parseTerminalHooksArgs, TERMINAL_HOOKS_HELP } = await Promise.resolve().then(function () { return require('./installTerminalHooks-CepXxAM_.cjs'); });
+      const { installTerminalHooks, parseTerminalHooksArgs, TERMINAL_HOOKS_HELP } = await Promise.resolve().then(function () { return require('./installTerminalHooks-Cp9JVxQ-.cjs'); });
       const command = parseTerminalHooksArgs(args.slice(1));
       if (command.action === "help") {
         console.log(TERMINAL_HOOKS_HELP);
@@ -14274,7 +14777,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     }
   } else if (subcommand === "spawn") {
     try {
-      const { handleSpawnCommand } = await Promise.resolve().then(function () { return require('./spawn-vOZA0kOi.cjs'); });
+      const { handleSpawnCommand } = await Promise.resolve().then(function () { return require('./spawn-C0NSP84Y.cjs'); });
       await handleSpawnCommand(args.slice(1));
     } catch (error) {
       console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
@@ -14286,7 +14789,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "send") {
     try {
-      const { handleSendCommand } = await Promise.resolve().then(function () { return require('./send-6eY55o3C.cjs'); });
+      const { handleSendCommand } = await Promise.resolve().then(function () { return require('./send-CWgaINHC.cjs'); });
       await handleSendCommand(args.slice(1));
     } catch (error) {
       console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
@@ -14392,9 +14895,9 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     if (geminiSubcommand === "project" && args[2] === "set" && args[3]) {
       const projectId = args[3];
       try {
-        const { saveGoogleCloudProjectToConfig } = await Promise.resolve().then(function () { return require('./config-BjsUeQPA.cjs'); });
-        const { readCredentialsForConfiguredRelay: readCredentialsForConfiguredRelay2 } = await Promise.resolve().then(function () { return require('./types-okYCRlgl.cjs'); }).then(function (n) { return n.persistence; });
-        const { ApiClient: ApiClient2 } = await Promise.resolve().then(function () { return require('./types-okYCRlgl.cjs'); }).then(function (n) { return n.api; });
+        const { saveGoogleCloudProjectToConfig } = await Promise.resolve().then(function () { return require('./config-GJQc_kpD.cjs'); });
+        const { readCredentialsForConfiguredRelay: readCredentialsForConfiguredRelay2 } = await Promise.resolve().then(function () { return require('./types-BP-4phS_.cjs'); }).then(function (n) { return n.persistence; });
+        const { ApiClient: ApiClient2 } = await Promise.resolve().then(function () { return require('./types-BP-4phS_.cjs'); }).then(function (n) { return n.api; });
         let userEmail = void 0;
         try {
           const credentials = await readCredentialsForConfiguredRelay2();
@@ -14425,7 +14928,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     }
     if (geminiSubcommand === "project" && args[2] === "get") {
       try {
-        const { readGeminiLocalConfig } = await Promise.resolve().then(function () { return require('./config-BjsUeQPA.cjs'); });
+        const { readGeminiLocalConfig } = await Promise.resolve().then(function () { return require('./config-GJQc_kpD.cjs'); });
         const config = readGeminiLocalConfig();
         if (config.googleCloudProject) {
           console.log(`Current Google Cloud Project: ${config.googleCloudProject}`);
@@ -14465,7 +14968,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
       process.exit(0);
     }
     try {
-      const { runGemini } = await Promise.resolve().then(function () { return require('./runGemini-qStPY5fH.cjs'); });
+      const { runGemini } = await Promise.resolve().then(function () { return require('./runGemini-BBzPVzuc.cjs'); });
       let startedBy = void 0;
       for (let i = 1; i < args.length; i++) {
         if (args[i] === "--started-by") {
@@ -14487,7 +14990,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "acp") {
     try {
-      const { runAcp, resolveAcpAgentConfig } = await Promise.resolve().then(function () { return require('./index-DID1FV_n.cjs'); });
+      const { runAcp, resolveAcpAgentConfig } = await Promise.resolve().then(function () { return require('./index-BBm2b34F.cjs'); });
       let startedBy = void 0;
       let verbose = false;
       const acpArgs = [];
@@ -14527,7 +15030,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "openclaw") {
     try {
-      const { runOpenClaw } = await Promise.resolve().then(function () { return require('./runOpenClaw-B8HR6GnX.cjs'); });
+      const { runOpenClaw } = await Promise.resolve().then(function () { return require('./runOpenClaw-B4nC6XGL.cjs'); });
       let startedBy = void 0;
       let verbose = false;
       let gatewayUrl;
@@ -14578,7 +15081,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "mcp" && args.length === 1) {
     try {
-      const { handleMcpCommand } = await Promise.resolve().then(function () { return require('./mcp-CAtbtTXF.cjs'); });
+      const { handleMcpCommand } = await Promise.resolve().then(function () { return require('./mcp-B5HMF24K.cjs'); });
       await handleMcpCommand();
     } catch (error) {
       process.stderr.write(`[very-happy mcp] Fatal: ${error instanceof Error ? error.message : String(error)}