Files
orca/src/main
Brennan Benson 792e113729 Fall back to legacy keychain when stale scoped Claude credentials 401 (#8767)
* Fall back to legacy keychain when stale scoped Claude credentials 401

Claude Code maintains the legacy 'Claude Code-credentials' Keychain item
for the default config dir, but a scoped item (service suffixed with
sha256(configDir)) can be left behind by sessions that ran with
CLAUDE_CONFIG_DIR set. Once its access token expires, nothing refreshes
it: readFromKeychain returned the scoped token unconditionally, every
usage fetch 401'd as 'stale-token', and system-default auth has no CLI
recovery lane — so the status bar showed 'Refreshing sign-in' forever
while the legacy item held a perfectly valid token.

Two changes:
- readFromKeychain: an actual access token from the legacy item now
  beats scoped refresh-only credentials (Orca cannot refresh tokens
  itself, so refresh-only must not shadow a working token).
- On a stale-token OAuth failure with scoped-keychain credentials, retry
  once with the legacy item's token before classifying the failure.
  Host system-default auth only — managed/WSL credentials never fall
  back to the host user's legacy keychain item.

The legacy retry runs before CLI repair, so a readable working token is
preferred over launching a hidden 25s claude PTY.

* Pin WSL-gate and same-token short-circuit for legacy keychain retry

The legacy-keychain retry must never answer a WSL target with the host
user's keychain account, and must not double the usage request when the
legacy item mirrors the failed scoped token. Add tests locking both.
2026-07-14 15:28:22 -07:00
..
2026-05-30 02:46:28 -07:00
2026-05-30 13:09:17 -07:00
2026-07-12 23:19:15 -07:00
2026-07-12 23:19:15 -07:00