From f83ae4295b7cfd918deff65c612d1fdf63fd21da Mon Sep 17 00:00:00 2001
From: Merge Sim <sim@local>
Date: Mon, 31 Aug 2026 19:12:53 -0700
Subject: [PATCH] refuse macOS routing when keychain bridge fails

---
 src/main/claude-accounts/runtime-auth-service.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/main/claude-accounts/runtime-auth-service.ts b/src/main/claude-accounts/runtime-auth-service.ts
index 376ab31e901..8a8b03c0734 100644
--- a/src/main/claude-accounts/runtime-auth-service.ts
+++ b/src/main/claude-accounts/runtime-auth-service.ts
@@ -82,6 +82,17 @@ export class ClaudeRuntimeAuthService extends ClaudeRuntimeAuthSync {
         }
       } catch (error) {
         console.warn('[claude-runtime-auth] Failed to bridge macOS managed Claude Keychain', error)
+        // Never route a pane at a home whose credential surface could not be
+        // synchronized; fall back to the system lane instead.
+        return {
+          configDir: this.pathResolver.getRuntimePaths().configDir,
+          runtime: 'host',
+          wslDistro: null,
+          wslLinuxConfigDir: null,
+          envPatch: this.pathResolver.getRuntimePaths().envPatch,
+          stripAuthEnv: false,
+          provenance: 'system:managed-keychain-unavailable'
+        }
       }
     }
     return preparation