very-happy-cli 0.2.96 → 0.2.98

package/dist/{index-BMmbxCTq.mjs → index-CuUVSZnK.mjs}

@@ -1,11 +1,11 @@
 import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';
-import os, { homedir } from 'node:os';
+import os, { homedir, userInfo } from 'node:os';
 import { randomUUID, randomBytes, createHash as createHash$1, timingSafeEqual } from 'node:crypto';
-import { n as readDaemonState, l as logger, c as configuration, o as clearDaemonState, q as getProjectPath, p as projectPath, s as initializeSandbox, t as wrapCommand, d as contentLogMetadata, I as InvalidateSync, R as RawJSONLinesSchema, g as delay, u as AsyncLock, v as ensurePrivateDirectory, M as MAX_CHAT_ATTACHMENT_SOURCE_BYTES, x as hardenPrivateFile, f as packageJson, i as readSettings, y as readCredentials, z as credentialRelayProblem, B as deriveLocalCliUpdateSummary, j as encodeBase64, C as updateSettings, D as encodeBase64Url, E as decodeBase64, F as writeCredentialsLegacy, G as writeCredentialsDataKey, H as readCredentialsForConfiguredRelay, J as encrypt, r as readPersistedSessions, K as isClaudeSessionId, L as getLocalHappyAgentCredentialPath, N as readLocalHappyAgentCredentials, O as decryptWithDataKey, P as decryptLegacy, Q as extractCompleteLines, S as decideBackfill, T as parseTerminalHookPayload, U as tmuxArgs, V as scrubTmuxClientEnv, W as decideMirrorBinding, X as MIRROR_BACKFILL_LINES_DEFAULT, Y as persistSession, Z as mirrorLineKey, _ as mirrorLocalId, w as writePrivateFileSync, $ as detectResumeSupport, a0 as detectCLIAvailability, a1 as acquireDaemonLock, a2 as summarizeSpawnSessionForLog, a3 as deletePersistedSessions, a4 as decrypt, a5 as writeDaemonState, A as ApiClient, a6 as fetchCliUpdateState, a7 as resolveCliUpdateCheckInterval, a8 as DEFAULT_CLI_UPDATE_CHECK_INTERVAL_MS, a9 as releaseDaemonLock, aa as isValidSessionId, ab as listVhTerminals, ac as isValidTerminalId, ad as readVhTerminal, ae as sendToVhTerminal, h as connectionState, af as startOfflineReconnection, ag as clearCredentials, ah as clearMachineId, k as ensurePrivateDirectorySync, ai as SandboxConfigSchema, b as createEnvelope, aj as CodexAppServerClient, ak as getLatestDaemonLog } from './types-CLRl0ET3.mjs';
+import { n as readDaemonState, l as logger, c as configuration, o as clearDaemonState, q as getProjectPath, p as projectPath, s as initializeSandbox, t as wrapCommand, d as contentLogMetadata, I as InvalidateSync, R as RawJSONLinesSchema, g as delay, u as AsyncLock, v as ensurePrivateDirectory, M as MAX_CHAT_ATTACHMENT_SOURCE_BYTES, x as hardenPrivateFile, f as packageJson, i as readSettings, y as readCredentials, z as credentialRelayProblem, B as deriveLocalCliUpdateSummary, j as encodeBase64, C as updateSettings, D as encodeBase64Url, E as decodeBase64, F as writeCredentialsLegacy, G as writeCredentialsDataKey, H as readCredentialsForConfiguredRelay, J as encrypt, r as readPersistedSessions, K as isClaudeSessionId, L as getLocalHappyAgentCredentialPath, N as readLocalHappyAgentCredentials, O as decryptWithDataKey, P as decryptLegacy, Q as extractCompleteLines, S as decideBackfill, T as parseTerminalHookPayload, U as tmuxArgs, V as scrubTmuxClientEnv, W as decideMirrorBinding, X as MIRROR_BACKFILL_LINES_DEFAULT, Y as persistSession, Z as mirrorLineKey, _ as mirrorLocalId, w as writePrivateFileSync, $ as detectResumeSupport, a0 as detectCLIAvailability, a1 as acquireDaemonLock, a2 as summarizeSpawnSessionForLog, a3 as deletePersistedSessions, a4 as shellescape, a5 as decrypt, a6 as writeDaemonState, A as ApiClient, a7 as writeSettings, a8 as fetchCliUpdateState, a9 as resolveCliUpdateCheckInterval, aa as DEFAULT_CLI_UPDATE_CHECK_INTERVAL_MS, ab as releaseDaemonLock, ac as isValidSessionId, ad as listVhTerminals, ae as isValidTerminalId, af as readVhTerminal, ag as sendToVhTerminal, h as connectionState, ah as startOfflineReconnection, ai as clearCredentials, aj as clearMachineId, k as ensurePrivateDirectorySync, ak as SandboxConfigSchema, b as createEnvelope, al as CodexAppServerClient, am as getLatestDaemonLog } from './types-Cl4vWuDY.mjs';
 import spawn$1, { spawn } from 'cross-spawn';
-import path, { join, resolve, basename, isAbsolute, normalize, sep, dirname } from 'node:path';
+import path, { join, resolve, basename, delimiter, isAbsolute, normalize, sep, dirname } from 'node:path';
 import { createInterface } from 'node:readline';
-import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, unlinkSync, renameSync, writeFileSync, rmSync, chmodSync as chmodSync$1 } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, unlinkSync, writeFileSync, accessSync, constants, renameSync, rmSync, chmodSync as chmodSync$1 } from 'node:fs';
 import { t as trimIdent, A as AGENT_GUIDANCE, P as PREVIEW_TOOL_NAME, R as REPORT_PROGRESS_TOOL_NAME, a as PREVIEW_TOOL_TITLE, b as PREVIEW_TOOL_DESCRIPTION, c as REPORT_PROGRESS_TOOL_TITLE, d as REPORT_PROGRESS_TOOL_DESCRIPTION } from './agentGuidance-C2_pkgRI.mjs';
 import { readFile, writeFile, rename, unlink, mkdir, stat, open as open$1, appendFile } from 'node:fs/promises';
 import fs, { watch, access } from 'fs/promises';
@@ -19,7 +19,7 @@ import tweetnacl from 'tweetnacl';
 import os$1, { homedir as homedir$1 } from 'os';
 import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process';
 import { createId } from '@paralleldrive/cuid2';
-import { execSync, spawnSync, spawn as spawn$3, execFileSync } from 'node:child_process';
+import { execSync, spawnSync, spawn as spawn$3, execFile, execFileSync } from 'node:child_process';
 import { existsSync as existsSync$1, statSync as statSync$1, writeFileSync as writeFileSync$1, chmodSync, unlinkSync as unlinkSync$1 } from 'fs';
 import { join as join$1 } from 'path';
 import '@anthropic-ai/sandbox-runtime';
@@ -31,11 +31,11 @@ import open from 'open';
 import fastify from 'fastify';
 import { z } from 'zod';
 import { validatorCompiler, serializerCompiler } from 'fastify-type-provider-zod';
+import { createRequire } from 'node:module';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { createServer } from 'node:http';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { C as CLIPBOARD_TOOL_NAME, a as CLIPBOARD_TOOL_TITLE, b as CLIPBOARD_TOOL_DESCRIPTION, c as CLIPBOARD_MAX_BYTES } from './limits-CwFb5S2b.mjs';
-import { createRequire } from 'node:module';
 import { createServer as createServer$1 } from 'http';
 import { promisify } from 'util';
 import inquirer from 'inquirer';
@@ -175,6 +175,9 @@ async function spawnDaemonSession(directory, sessionId, opts) {
 async function notifyDaemonSessionEvent(sessionId, event, spawnedBy) {
   return daemonPost("/session-event", { sessionId, event, spawnedBy });
 }
+async function notifyDaemonClaudeAuthFailed(sessionId) {
+  return daemonPost("/session-event", { sessionId, event: "auth_failed" });
+}
 async function stopDaemonHttp() {
   await daemonPost("/stop");
 }
@@ -1744,6 +1747,20 @@ function parseSpecialCommand(message) {
   };
 }
 
+const AUTH_FAILURE_RESULT_TEXT = /Failed to authenticate|OAuth session expired/i;
+const QUERY_RECYCLE_NOTICE = {
+  authentication_failed: "\u26A0\uFE0F Claude Code could not refresh its OAuth session. This agent process was ended so your next message starts a fresh one that re-reads the credentials on this machine; if it fails again, run `claude` on the machine to log in again."
+};
+function queryRecycleReason(result, lastAssistantError) {
+  if (lastAssistantError === "authentication_failed") {
+    return "authentication_failed";
+  }
+  if (result.is_error && typeof result.result === "string" && AUTH_FAILURE_RESULT_TEXT.test(result.result)) {
+    return "authentication_failed";
+  }
+  return null;
+}
+
 class PushableAsyncIterable {
   queue = [];
   waiters = [];
@@ -2004,11 +2021,15 @@ async function claudeRemote(opts) {
       }
     });
   }
+  let lastAssistantError;
   updateThinking(true);
   try {
     logger.debug(`[claudeRemote] Starting to iterate over response`);
     for await (const message of response) {
       logger.debug(`[claudeRemote] Message ${message.type}`, contentLogMetadata(message));
+      if (message.type === "assistant" && message.error) {
+        lastAssistantError = message.error;
+      }
       const outboundMessage = isCompactCommand && message.type === "assistant" ? { ...message, isCompactSummary: true } : message;
       opts.onMessage(outboundMessage);
       if (message.type === "system" && message.subtype === "init") {
@@ -2057,6 +2078,15 @@ async function claudeRemote(opts) {
           isCompactCommand = false;
         }
         opts.onReady(message);
+        const recycleReason = queryRecycleReason(message, lastAssistantError);
+        lastAssistantError = void 0;
+        if (recycleReason) {
+          logger.warn(`[claudeRemote] Ending SDK query after ${recycleReason}; the next message starts a fresh Claude Code process`);
+          opts.onCompletionEvent?.(QUERY_RECYCLE_NOTICE[recycleReason]);
+          opts.onAuthFailure?.(recycleReason);
+          messages.end();
+          continue;
+        }
         opts.nextMessage().then((next) => {
           if (!next) {
             messages.end();
@@ -3260,8 +3290,9 @@ async function cleanupStdinAfterInk(opts) {
 }
 
 function applyClaudeResultLifecycle(result, callbacks) {
-  if (result && result.subtype !== "success") {
-    const error = result.errors?.filter(Boolean).join("\n").trim() || result.subtype;
+  if (result && (result.subtype !== "success" || result.is_error === true)) {
+    const frame = result;
+    const error = frame.errors?.filter(Boolean).join("\n").trim() || (typeof frame.result === "string" ? frame.result.trim() : "") || frame.subtype;
     callbacks.closeFailed(error);
     callbacks.onFailed(error);
     return;
@@ -3733,6 +3764,10 @@ async function claudeRemoteLauncher(session, onPermissionModeChange, onEffective
             logger.debug("[remote]: Completion event received:", contentLogMetadata(message));
             session.client.sendSessionEvent({ type: "message", message });
           },
+          onAuthFailure: (reason) => {
+            session.client.sendSessionEvent({ type: "message", message: `Claude Code auth: ${reason}`, kind: "claude-auth-failed" });
+            void notifyDaemonClaudeAuthFailed(session.client.sessionId).catch((error) => logger.debug("[remote]: auth_failed report to daemon failed:", error));
+          },
           onSessionReset: () => {
             logger.debug("[remote]: Session reset");
             session.clearSessionId();
@@ -5406,6 +5441,7 @@ function startDaemonControlServer({
   requestShutdown,
   onHappySessionWebhook,
   onSessionStateEvent,
+  onClaudeAuthFailed,
   pushClipboard,
   onTerminalHook
 }) {
@@ -5461,7 +5497,7 @@ function startDaemonControlServer({
       schema: {
         body: z.object({
           sessionId: z.string(),
-          event: z.enum(["completed", "needs_input"]),
+          event: z.enum(["completed", "needs_input", "auth_failed"]),
           spawnedBy: z.string().optional()
         }),
         response: {
@@ -5473,6 +5509,10 @@ function startDaemonControlServer({
     }, async (request) => {
       const { sessionId, event, spawnedBy } = request.body;
       logger.debug(`[CONTROL SERVER] Session event: ${sessionId} ${event} (spawnedBy=${spawnedBy ?? "unset"})`);
+      if (event === "auth_failed") {
+        onClaudeAuthFailed?.(sessionId);
+        return { status: "ok" };
+      }
       onSessionStateEvent?.(sessionId, event, spawnedBy);
       return { status: "ok" };
     });
@@ -6646,6 +6686,444 @@ async function handleResumeCommand(args) {
   }
 }
 
+const CLAUDE_KEYCHAIN_SERVICE_PREFIX = "Claude Code";
+function keychainIdentity(env = process.env, deps = {}) {
+  const home = deps.home ?? homedir();
+  const secureDir = env.CLAUDE_SECURESTORAGE_CONFIG_DIR?.trim();
+  const configDirEnv = env.CLAUDE_CONFIG_DIR?.trim();
+  const configDir = secureDir || configDirEnv || join(home, ".claude");
+  const hasCustomDir = Boolean(secureDir || configDirEnv);
+  const dirSuffix = hasCustomDir ? "-" + createHash$1("sha256").update(configDir.normalize("NFC")).digest("hex").slice(0, 8) : "";
+  const oauthSuffix = env.CLAUDE_CODE_OAUTH_CLIENT_ID?.trim() ? "-custom-oauth" : "";
+  const rawAccount = env.USER || safeUsername(deps.username);
+  const account = /^[a-zA-Z0-9._-]+$/.test(rawAccount) ? rawAccount : "claude-code-user";
+  return {
+    service: `${CLAUDE_KEYCHAIN_SERVICE_PREFIX}${oauthSuffix}-credentials${dirSuffix}`,
+    account,
+    configDir,
+    credentialsPath: join(configDir, ".credentials.json")
+  };
+}
+function safeUsername(provider) {
+  try {
+    return provider ? provider() : userInfo().username;
+  } catch {
+    return "";
+  }
+}
+
+const CLAUDE_AUTH_PROBE_VERSION = 1;
+const LOCAL_CREDENTIAL_SOURCE = "Claude local credentials";
+function classifyAuthStatus(run, credentialSource) {
+  const localSource = credentialSource === void 0 || credentialSource === LOCAL_CREDENTIAL_SOURCE;
+  if (run.spawnError) {
+    return { status: "error", diagnosis: "probe-crash", detail: `could not run claude auth status: ${run.spawnError}` };
+  }
+  if (run.timedOut) {
+    return { status: "error", diagnosis: "probe-timeout", detail: "claude auth status did not answer within the timeout" };
+  }
+  const parsed = parseJsonObject(run.stdout);
+  if (!parsed) {
+    if (!localSource) return { status: "unknown", authMethod: credentialSource, detail: `auth status unparseable under ${credentialSource}` };
+    return { status: "error", diagnosis: "probe-crash", detail: `claude auth status returned no JSON (exit ${run.exitCode ?? "null"})` };
+  }
+  const authMethod = typeof parsed.authMethod === "string" ? parsed.authMethod : void 0;
+  const subscriptionType = typeof parsed.subscriptionType === "string" ? parsed.subscriptionType : void 0;
+  if (parsed.loggedIn === true) {
+    return { status: "ok", authMethod: localSource ? authMethod : credentialSource, subscriptionType };
+  }
+  if (!localSource) {
+    return { status: "unknown", authMethod: credentialSource, detail: `Claude Code reports loggedIn=false under ${credentialSource}; not a local-credential failure` };
+  }
+  return { status: "not-logged-in", authMethod, subscriptionType, detail: "Claude Code in the daemon context reports it is not logged in" };
+}
+function parseJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  const start = trimmed.indexOf("{");
+  if (start < 0) return null;
+  try {
+    const value = JSON.parse(trimmed.slice(start));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => createRequire(import.meta.url).resolve(s)) {
+  const platformArch = `${platform}-${arch}`;
+  const candidates = [
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude.exe`
+  ];
+  for (const candidate of candidates) {
+    try {
+      return resolver(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function interpretSecurityRead(result) {
+  if (result.error === "ENOENT") return { kind: "unsupported" };
+  if (result.error === "timeout") return { kind: "error", detail: "security timed out" };
+  if (result.exitCode === 44) return { kind: "absent" };
+  if (result.exitCode === 36) return { kind: "unreadable" };
+  if (result.exitCode !== 0) return { kind: "error", detail: `security exited ${result.exitCode ?? "null"}` };
+  const raw = result.stdout.trim();
+  if (!raw) return { kind: "absent" };
+  const parsed = parseJsonObject(raw);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  if (!oauth) return { kind: "present", accessToken: "", refreshToken: "", raw };
+  return {
+    kind: "present",
+    accessToken: typeof oauth.accessToken === "string" ? oauth.accessToken : "",
+    refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : "",
+    raw
+  };
+}
+function interpretCredentialsFile(text) {
+  if (text === null) return { exists: false, hasTokens: false, refreshToken: "" };
+  const parsed = parseJsonObject(text);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  const access = oauth && typeof oauth.accessToken === "string" ? oauth.accessToken : "";
+  const refresh = oauth && typeof oauth.refreshToken === "string" ? oauth.refreshToken : "";
+  return { exists: true, hasTokens: access.length > 0 && refresh.length > 0, refreshToken: refresh };
+}
+function tokenTail(token) {
+  return token ? createHash$1("sha256").update(token).digest("hex").slice(-6) : "";
+}
+function diagnoseStores(input) {
+  const { status, keychain, file } = input;
+  if (keychain.kind === "present") {
+    const empty = keychain.accessToken.length === 0 && keychain.refreshToken.length === 0;
+    if (empty && file.hasTokens && status === "not-logged-in") {
+      return {
+        diagnosis: "keychain-empty-item",
+        repairable: "delete-empty-keychain-item",
+        keychainRaw: keychain.raw,
+        detail: "The login keychain holds a Claude Code credentials item with empty tokens; Claude Code prefers it over the valid ~/.claude/.credentials.json and reports not logged in."
+      };
+    }
+    if (!empty && file.hasTokens && tokenTail(keychain.refreshToken) !== tokenTail(file.refreshToken)) {
+      return {
+        diagnosis: "store-divergence",
+        detail: "Keychain and ~/.claude/.credentials.json hold different refresh tokens; one of them will stop working at its next refresh. Treat the daemon-context login as canonical, or pin credentialStore=file."
+      };
+    }
+    return {};
+  }
+  if ((keychain.kind === "absent" || keychain.kind === "unreadable" || keychain.kind === "unsupported") && !file.hasTokens) {
+    return { diagnosis: "no-credentials", detail: "No Claude Code credentials found for this daemon context; log in with `claude` on this machine." };
+  }
+  if (keychain.kind === "unreadable" && file.hasTokens && status === "not-logged-in") {
+    return { detail: "The daemon context cannot read the keychain and the file credentials were not accepted; compare `claude auth status` on the machine." };
+  }
+  if (keychain.kind === "error") {
+    return { detail: `keychain check failed: ${keychain.detail}` };
+  }
+  return {};
+}
+function securityReadArgs(identity) {
+  return ["find-generic-password", "-s", identity.service, "-a", identity.account, "-w"];
+}
+function securityDeleteArgs(identity) {
+  return ["delete-generic-password", "-s", identity.service, "-a", identity.account];
+}
+const HAPPY_DAEMON_LAUNCHD_LABEL = "com.mereith.happy-daemon";
+function classifyLineage(input) {
+  if (input.platform !== "darwin") return "other";
+  const label = input.label ?? HAPPY_DAEMON_LAUNCHD_LABEL;
+  if (input.env.XPC_SERVICE_NAME !== label) return "other";
+  if (input.launchdJobPid !== null && input.ancestorPids.includes(input.launchdJobPid)) return "launchd";
+  return "inherited-env";
+}
+function parseLaunchctlPid(printOutput) {
+  const match = /^\s*pid\s*=\s*(\d+)/m.exec(printOutput);
+  return match ? Number(match[1]) : null;
+}
+function keychainOffShimDir(happyLibDir) {
+  return join(happyLibDir, "scripts", "shims", "keychain-off");
+}
+function withKeychainOffPath(path, shimDir) {
+  const parts = (path ?? "").split(delimiter).filter((p) => p && p !== shimDir);
+  return [shimDir, ...parts].join(delimiter);
+}
+function buildClaudeAuthState(input) {
+  const { classification, diagnosis } = input;
+  const detail = (diagnosis?.detail ?? classification.detail)?.slice(0, 200);
+  const state = {
+    probeVersion: CLAUDE_AUTH_PROBE_VERSION,
+    daemonPid: input.daemonPid,
+    status: classification.status,
+    context: { platform: input.platform, lineage: input.lineage, credentialStore: input.credentialStore },
+    checkedAt: input.now ?? Date.now()
+  };
+  if (classification.authMethod) state.authMethod = classification.authMethod;
+  if (classification.subscriptionType) state.subscriptionType = classification.subscriptionType;
+  const diag = diagnosis?.diagnosis ?? classification.diagnosis;
+  if (diag) state.diagnosis = diag;
+  if (detail) state.detail = detail;
+  if (diagnosis?.repairable) state.repairable = diagnosis.repairable;
+  return state;
+}
+function claudeAuthStateChanged(prev, next) {
+  if (!prev) return true;
+  const strip = ({ checkedAt: _c, ...rest }) => JSON.stringify(rest);
+  return strip(prev) !== strip(next);
+}
+function keychainIdentityFor(env) {
+  return keychainIdentity(env);
+}
+
+const CLAUDE_AUTH_PROBE_INTERVAL_MS = 10 * 60 * 1e3;
+const CLAUDE_AUTH_REFRESH_INTERVAL_MS = 30 * 60 * 1e3;
+const PROBE_TIMEOUT_MS = 8e3;
+const SECURITY_TIMEOUT_MS = 3e3;
+const SIGNAL_DEBOUNCE_MS = 1e3;
+class ClaudeAuthService {
+  constructor(opts) {
+    this.opts = opts;
+    this.env = opts.env ?? process.env;
+    this.platform = opts.platform ?? process.platform;
+  }
+  timer = null;
+  signalTimer = null;
+  inFlight = null;
+  last = null;
+  dirty = false;
+  lastPublishedAt = 0;
+  lineage = null;
+  lastDiagnosis;
+  env;
+  platform;
+  start() {
+    setTimeout(() => void this.probe("startup"), 2e3).unref();
+    this.timer = setInterval(() => void this.probe("interval"), CLAUDE_AUTH_PROBE_INTERVAL_MS);
+    this.timer.unref();
+  }
+  stop() {
+    if (this.timer) clearInterval(this.timer);
+    if (this.signalTimer) clearTimeout(this.signalTimer);
+    this.timer = null;
+    this.signalTimer = null;
+  }
+  current() {
+    return this.last;
+  }
+  /** D3: a session reported `authentication_failed`; re-probe after a short debounce. */
+  signalAuthFailed(sessionId) {
+    logger.debug(`[CLAUDE AUTH] auth_failed signal from session ${sessionId}`);
+    if (this.signalTimer) clearTimeout(this.signalTimer);
+    this.signalTimer = setTimeout(() => {
+      this.signalTimer = null;
+      void this.probe("signal", true);
+    }, SIGNAL_DEBOUNCE_MS);
+    this.signalTimer.unref();
+  }
+  /** Env the SDK/one-shot Claude Code processes should get for the current store setting. */
+  claudeProcessEnvOverrides() {
+    if (this.opts.getCredentialStore() !== "file") return {};
+    const shim = this.resolveShimDir();
+    if (!shim) return {};
+    return { PATH: withKeychainOffPath(this.env.PATH, shim) };
+  }
+  effectiveCredentialStore() {
+    if (this.opts.getCredentialStore() !== "file") return "auto";
+    return this.resolveShimDir() ? "file" : "auto";
+  }
+  async probe(reason, withDiagnosis = false) {
+    if (this.inFlight) return this.inFlight;
+    this.inFlight = this.runProbe(reason, withDiagnosis).finally(() => {
+      this.inFlight = null;
+    });
+    return this.inFlight;
+  }
+  async setStore(store) {
+    await this.opts.setCredentialStore(store);
+    return this.probe("set-store", true);
+  }
+  /** D4: delete the empty-token keychain item after re-validating every precondition. */
+  async repair(action) {
+    if (action !== "delete-empty-keychain-item") return { error: "unknown-action", claudeAuth: this.last };
+    if (this.platform !== "darwin" || this.effectiveCredentialStore() === "file") return { error: "precondition-failed", claudeAuth: this.last };
+    const state = await this.probe("repair-precheck", true);
+    const seen = this.lastDiagnosis;
+    if (state.diagnosis !== "keychain-empty-item" || !seen?.keychainRaw) return { error: "precondition-failed", claudeAuth: state };
+    const identity = keychainIdentityFor(this.env);
+    const again = interpretSecurityRead(await this.security(securityReadArgs(identity)));
+    if (again.kind !== "present" || again.raw !== seen.keychainRaw || again.accessToken || again.refreshToken) {
+      return { error: "precondition-failed", claudeAuth: state };
+    }
+    try {
+      const dir = join(this.opts.happyHomeDir, "backups");
+      mkdirSync(dir, { recursive: true, mode: 448 });
+      writeFileSync(join(dir, `claude-keychain-${Date.now()}.json`), again.raw + "\n", { mode: 384 });
+    } catch (error) {
+      return { error: `backup-failed: ${String(error)}`, claudeAuth: state };
+    }
+    const del = await this.security(securityDeleteArgs(identity));
+    if (del.exitCode !== 0) return { error: `delete-failed: security exited ${del.exitCode ?? "null"}`, claudeAuth: state };
+    logger.debug("[CLAUDE AUTH] deleted empty-token keychain item after backup");
+    const after = await this.probe("repair-done", true);
+    return { ok: true, claudeAuth: after };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  resolveShimDir() {
+    const dir = keychainOffShimDir(this.opts.happyLibDir);
+    const bin = join(dir, "security");
+    try {
+      if (!statSync(bin).isFile()) return null;
+      accessSync(bin, constants.X_OK);
+      return dir;
+    } catch {
+      return null;
+    }
+  }
+  async runProbe(reason, withDiagnosis) {
+    const store = this.effectiveCredentialStore();
+    const storeRequested = this.opts.getCredentialStore();
+    const classification = await this.runAuthStatus();
+    let diagnosis;
+    this.lastDiagnosis = void 0;
+    if (this.platform === "darwin" && store !== "file" && (classification.status === "not-logged-in" || withDiagnosis && classification.status !== "unknown")) {
+      diagnosis = await this.diagnose(classification.status);
+      this.lastDiagnosis = diagnosis;
+    } else if (classification.status === "not-logged-in" && store === "file") {
+      const file = interpretCredentialsFile(this.readCredentialsFile());
+      if (!file.hasTokens) diagnosis = { diagnosis: "no-credentials", detail: "credentialStore=file and ~/.claude/.credentials.json has no tokens; log in with `claude` from a terminal on this machine." };
+    }
+    if (storeRequested === "file" && store === "auto") {
+      diagnosis = { ...diagnosis ?? {}, detail: `credentialStore=file requested but the keychain-off shim is missing under ${keychainOffShimDir(this.opts.happyLibDir)}; running in auto mode.` };
+    }
+    const state = buildClaudeAuthState({
+      daemonPid: process.pid,
+      platform: this.platform,
+      lineage: await this.resolveLineage(),
+      credentialStore: store,
+      classification,
+      diagnosis,
+      now: this.opts.now?.() ?? Date.now()
+    });
+    const changed = claudeAuthStateChanged(this.last, state);
+    const stale = state.checkedAt - this.lastPublishedAt >= CLAUDE_AUTH_REFRESH_INTERVAL_MS;
+    if (changed) {
+      logger.debug(`[CLAUDE AUTH] ${reason}: status=${state.status} diagnosis=${state.diagnosis ?? "-"} lineage=${state.context.lineage} store=${state.context.credentialStore}`);
+    }
+    this.last = state;
+    if (changed || stale || this.dirty) {
+      const ok = await this.opts.publish(state).catch((error) => {
+        logger.debug("[CLAUDE AUTH] publish failed:", error);
+        return false;
+      });
+      this.dirty = !ok;
+      if (ok) this.lastPublishedAt = state.checkedAt;
+      else logger.warn("[CLAUDE AUTH] daemonState publish did not land; will force resend on the next probe");
+    }
+    return state;
+  }
+  async runAuthStatus() {
+    const binary = resolveSdkClaudeBinary(this.platform, process.arch);
+    if (!binary) {
+      return { status: "claude-missing", diagnosis: "sdk-binary-missing", detail: "The Claude Code binary bundled with the Agent SDK is missing; remote sessions cannot start." };
+    }
+    const cwd = join(this.opts.happyHomeDir, "tmp", "auth-probe");
+    try {
+      mkdirSync(cwd, { recursive: true });
+    } catch {
+    }
+    const env = { ...this.env, ...this.claudeProcessEnvOverrides() };
+    const run = await new Promise((resolve) => {
+      let stdout = "";
+      let settled = false;
+      const done = (r) => {
+        if (!settled) {
+          settled = true;
+          resolve(r);
+        }
+      };
+      let child;
+      try {
+        child = spawn$3(binary, ["auth", "status"], { cwd, env, stdio: ["ignore", "pipe", "ignore"] });
+      } catch (error) {
+        done({ stdout: "", exitCode: null, timedOut: false, spawnError: String(error) });
+        return;
+      }
+      const timer = setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+        done({ stdout, exitCode: null, timedOut: true });
+      }, PROBE_TIMEOUT_MS);
+      child.stdout?.on("data", (chunk) => {
+        if (stdout.length < 65536) stdout += chunk.toString("utf8");
+      });
+      child.on("error", (error) => {
+        clearTimeout(timer);
+        done({ stdout, exitCode: null, timedOut: false, spawnError: String(error) });
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        done({ stdout, exitCode: code, timedOut: false });
+      });
+    });
+    return classifyAuthStatus(run, this.opts.credentialSource);
+  }
+  async diagnose(status) {
+    const identity = keychainIdentityFor(this.env);
+    const keychain = interpretSecurityRead(await this.security(securityReadArgs(identity)));
+    const file = interpretCredentialsFile(this.readCredentialsFile(identity.credentialsPath));
+    return diagnoseStores({ status, keychain, file });
+  }
+  readCredentialsFile(path) {
+    const target = path ?? keychainIdentityFor(this.env).credentialsPath;
+    try {
+      return existsSync(target) ? readFileSync(target, "utf8") : null;
+    } catch {
+      return null;
+    }
+  }
+  security(args) {
+    return new Promise((resolve) => {
+      execFile("security", args, { env: this.env, timeout: SECURITY_TIMEOUT_MS, maxBuffer: 65536 }, (error, stdout) => {
+        const err = error;
+        if (err && err.code === "ENOENT") return resolve({ exitCode: null, stdout: "", error: "ENOENT" });
+        if (err && err.killed) return resolve({ exitCode: null, stdout: "", error: "timeout" });
+        const exitCode = err ? typeof err.code === "number" ? err.code : 1 : 0;
+        resolve({ exitCode, stdout: String(stdout ?? "") });
+      });
+    });
+  }
+  async resolveLineage() {
+    if (this.lineage) return this.lineage;
+    if (this.platform !== "darwin") {
+      this.lineage = "other";
+      return this.lineage;
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : null;
+    const launchdJobPid = uid === null ? null : parseLaunchctlPid(await this.exec("launchctl", ["print", `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`]));
+    const ancestors = await this.ancestorPids();
+    this.lineage = classifyLineage({ platform: this.platform, env: this.env, launchdJobPid, ancestorPids: ancestors });
+    return this.lineage;
+  }
+  async ancestorPids() {
+    const out = [];
+    let pid = process.ppid;
+    for (let i = 0; i < 10 && pid > 1; i++) {
+      out.push(pid);
+      const ppid = Number((await this.exec("ps", ["-o", "ppid=", "-p", String(pid)])).trim());
+      if (!Number.isFinite(ppid) || ppid === pid) break;
+      pid = ppid;
+    }
+    return out;
+  }
+  exec(cmd, args) {
+    return new Promise((resolve) => {
+      execFile(cmd, args, { env: this.env, timeout: SECURITY_TIMEOUT_MS, maxBuffer: 65536 }, (_error, stdout) => resolve(String(stdout ?? "")));
+    });
+  }
+}
+
 const INTERNAL_CLAUDE_EVENT_TYPES = /* @__PURE__ */ new Set(["file-history-snapshot", "change", "queue-operation"]);
 function parseLines(lines) {
   const out = [];
@@ -7350,9 +7828,6 @@ async function claimSessionOrExit(happySessionId, options) {
   process.on("exit", () => releaseSessionLock(happySessionId));
 }
 
-function shellescape(s) {
-  return "'" + s.replace(/'/g, "'\\''") + "'";
-}
 const hostSuffix = process.env.HAPPY_VARIANT === "dev" ? "-dev" : "";
 const initialMachineMetadata = {
   host: os$1.hostname() + hostSuffix,
@@ -7365,6 +7840,8 @@ const initialMachineMetadata = {
   resumeSupport: { ...detectResumeSupport(), rpcAvailable: true }
 };
 async function startDaemon() {
+  let claudeAuthServiceRef = null;
+  let claudeCredentialStoreSetting = (await readSettings()).claudeCredentialStore === "file" ? "file" : "auto";
   let requestShutdown;
   let resolvesWhenShutdownRequested = new Promise((resolve) => {
     requestShutdown = (source, errorMessage) => {
@@ -7671,7 +8148,11 @@ async function startDaemon() {
         }
         let extraEnv = {
           ...authEnv,
-          ...options.environmentVariables ?? {}
+          ...options.environmentVariables ?? {},
+          // B-276 D8: credentialStore=file pins the spawned Claude Code (SDK
+          // Query, title/board one-shots — all inside this wrapper) to
+          // ~/.claude/.credentials.json via the keychain-off `security` shim.
+          ...claudeAuthServiceRef?.claudeProcessEnvOverrides() ?? {}
         };
         if (options.parentSessionId) {
           extraEnv.HAPPY_FORKED_FROM_SESSION_ID = options.parentSessionId;
@@ -8297,6 +8778,7 @@ async function startDaemon() {
       requestShutdown: () => requestShutdown("happy-cli"),
       onHappySessionWebhook,
       onSessionStateEvent,
+      onClaudeAuthFailed: (sessionId) => claudeAuthServiceRef?.signalAuthFailed(sessionId),
       pushClipboard: (text) => {
         if (!apiMachineRef) {
           return { delivered: false, truncated: false, totalBytes: 0, error: "daemon is still starting up" };
@@ -8367,6 +8849,25 @@ async function startDaemon() {
       listTrackedSessionIds: () => [...pidToTrackedSession.values()].map((session) => session.happySessionId).filter((sessionId) => typeof sessionId === "string"),
       requestShutdown: () => requestShutdown("happy-app")
     });
+    const claudeAuthService = new ClaudeAuthService({
+      happyHomeDir: configuration.happyHomeDir,
+      happyLibDir: projectPath(),
+      credentialSource: daemonClaudeCredentials.source,
+      getCredentialStore: () => claudeCredentialStoreSetting,
+      setCredentialStore: async (store) => {
+        const settings = await readSettings();
+        await writeSettings({ ...settings, claudeCredentialStore: store });
+        claudeCredentialStoreSetting = store;
+      },
+      publish: (state) => apiMachine.setClaudeAuthState(state)
+    });
+    claudeAuthServiceRef = claudeAuthService;
+    apiMachine.setClaudeAuthHandlers({
+      probe: () => claudeAuthService.probe("rpc", true),
+      repair: (action) => claudeAuthService.repair(action),
+      setStore: (store) => claudeAuthService.setStore(store)
+    });
+    claudeAuthService.start();
     apiMachine.connect();
     let cliUpdateCheckRunning = false;
     const refreshCliUpdate = async () => {
@@ -8421,6 +8922,8 @@ async function startDaemon() {
         logger.debug("[DAEMON RUN] Daemon bundle replaced on disk, handing off to new daemon");
         clearInterval(restartOnStaleVersionAndHeartbeat);
         clearInterval(cliUpdateInterval);
+        claudeAuthService.stop();
+        claudeAuthService.stop();
         apiMachine.shutdown();
         await stopControlServer();
         await cleanupDaemonState();
@@ -14235,7 +14738,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     process.exit(0);
   } else if (subcommand === "install-terminal-hooks") {
     try {
-      const { installTerminalHooks, parseTerminalHooksArgs, TERMINAL_HOOKS_HELP } = await import('./installTerminalHooks-CBHjEQ-a.mjs');
+      const { installTerminalHooks, parseTerminalHooksArgs, TERMINAL_HOOKS_HELP } = await import('./installTerminalHooks-Ru0dn_zF.mjs');
       const command = parseTerminalHooksArgs(args.slice(1));
       if (command.action === "help") {
         console.log(TERMINAL_HOOKS_HELP);
@@ -14252,7 +14755,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     }
   } else if (subcommand === "spawn") {
     try {
-      const { handleSpawnCommand } = await import('./spawn-CfCE6JAv.mjs');
+      const { handleSpawnCommand } = await import('./spawn-CqcfbOnk.mjs');
       await handleSpawnCommand(args.slice(1));
     } catch (error) {
       console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
@@ -14264,7 +14767,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "send") {
     try {
-      const { handleSendCommand } = await import('./send-TX13v8Xe.mjs');
+      const { handleSendCommand } = await import('./send-DN-nVBEI.mjs');
       await handleSendCommand(args.slice(1));
     } catch (error) {
       console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
@@ -14370,9 +14873,9 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     if (geminiSubcommand === "project" && args[2] === "set" && args[3]) {
       const projectId = args[3];
       try {
-        const { saveGoogleCloudProjectToConfig } = await import('./config-B69TZlJj.mjs');
-        const { readCredentialsForConfiguredRelay: readCredentialsForConfiguredRelay2 } = await import('./types-CLRl0ET3.mjs').then(function (n) { return n.al; });
-        const { ApiClient: ApiClient2 } = await import('./types-CLRl0ET3.mjs').then(function (n) { return n.am; });
+        const { saveGoogleCloudProjectToConfig } = await import('./config-B3pA9YsN.mjs');
+        const { readCredentialsForConfiguredRelay: readCredentialsForConfiguredRelay2 } = await import('./types-Cl4vWuDY.mjs').then(function (n) { return n.an; });
+        const { ApiClient: ApiClient2 } = await import('./types-Cl4vWuDY.mjs').then(function (n) { return n.ao; });
         let userEmail = void 0;
         try {
           const credentials = await readCredentialsForConfiguredRelay2();
@@ -14403,7 +14906,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     }
     if (geminiSubcommand === "project" && args[2] === "get") {
       try {
-        const { readGeminiLocalConfig } = await import('./config-B69TZlJj.mjs');
+        const { readGeminiLocalConfig } = await import('./config-B3pA9YsN.mjs');
         const config = readGeminiLocalConfig();
         if (config.googleCloudProject) {
           console.log(`Current Google Cloud Project: ${config.googleCloudProject}`);
@@ -14443,7 +14946,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
       process.exit(0);
     }
     try {
-      const { runGemini } = await import('./runGemini-cMZ3_CRf.mjs');
+      const { runGemini } = await import('./runGemini-CwZXQsgu.mjs');
       let startedBy = void 0;
       for (let i = 1; i < args.length; i++) {
         if (args[i] === "--started-by") {
@@ -14465,7 +14968,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "acp") {
     try {
-      const { runAcp, resolveAcpAgentConfig } = await import('./index-C-uJXSm3.mjs');
+      const { runAcp, resolveAcpAgentConfig } = await import('./index-Bh5Rcy0s.mjs');
       let startedBy = void 0;
       let verbose = false;
       const acpArgs = [];
@@ -14505,7 +15008,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "openclaw") {
     try {
-      const { runOpenClaw } = await import('./runOpenClaw-BJ36wEbk.mjs');
+      const { runOpenClaw } = await import('./runOpenClaw-C-jz4rWr.mjs');
       let startedBy = void 0;
       let verbose = false;
       let gatewayUrl;
@@ -14556,7 +15059,7 @@ Conversation history is preserved on the server, but in-flight tool calls are in
     return;
   } else if (subcommand === "mcp" && args.length === 1) {
     try {
-      const { handleMcpCommand } = await import('./mcp-BdSHqi2d.mjs');
+      const { handleMcpCommand } = await import('./mcp-CQoVN0u2.mjs');
       await handleMcpCommand();
     } catch (error) {
       process.stderr.write(`[very-happy mcp] Fatal: ${error instanceof Error ? error.message : String(error)}