fix(claude): stop macOS Keychain corrupting OAuth credentials on refresh

Claude credentials are persisted to the macOS login Keychain with
`security add-generic-password -w <json>`. credentialPayload wrote the JSON
with json.MarshalIndent (multi-line). macOS `security find-generic-password -w`
hex-encodes any generic-password value containing a newline on read, so the
stored credential came back as an ASCII hex string like "7b0a2020..." that
fails to JSON-parse ("invalid character 'b' after top-level value").

Because the daemon rewrites the credential after every OAuth token refresh,
each Claude account self-corrupted within its access-token lifetime: reads
then fail, the account is skipped, usage fetches 401, it scores headroom=0,
and routing returns "no non-exhausted claude accounts available".

Fix:
- credentialPayload writes compact json.Marshal (single line). json.Marshal
  escapes any in-string newline to \n, so the value can never contain a raw
  newline and `security` returns it as text.
- parseCredentialPayload heals already-hex-encoded blobs on read via
  healHexEncodedCredential (gated on the "7b"/"5b" ASCII-hex prefix; the
  hex decode + json.Unmarshal are the real gate, so it is a no-op on ordinary
  JSON, which starts with the byte '{' not the ASCII "7b").

Adds unit tests for the compact-write invariant, hex heal round-trip, no-op on
plain JSON, and fail-closed handling of malformed input.

Author: ak2k

internal/agents/claude/store.go

@@ -592,6 +592,7 @@ func readCredentialFile(instancePath string) (*CredentialInfo, bool) {
 }
 
 func parseCredentialPayload(body []byte) (*CredentialInfo, error) {
+	body = healHexEncodedCredential(body)
 	var raw struct {
 		ClaudeAIOAuth *CredentialInfo `json:"claudeAiOauth"`
 	}
@@ -601,14 +602,48 @@ func parseCredentialPayload(body []byte) (*CredentialInfo, error) {
 	return raw.ClaudeAIOAuth, nil
 }
 
+// healHexEncodedCredential recovers credentials that macOS `security
+// find-generic-password -w` returned hex-encoded. `security` hex-encodes a
+// generic-password value on read whenever it contains a newline, so a
+// credential previously written with indented (multi-line) JSON round-trips as
+// a hex string like "7b0a2020..." that fails to JSON-parse. Detect that shape
+// (credential JSON always starts with '{' or '['; its hex form starts with the
+// ASCII "7b" or "5b") and decode it back. credentialPayload now writes compact
+// JSON so new writes avoid this, but this keeps already-written blobs readable.
+//
+// hex.DecodeString plus the subsequent json.Unmarshal are the real gate: a body
+// that only coincidentally starts with "7b"/"5b" but isn't valid hex-of-JSON
+// fails to decode (or decodes to non-JSON) and is returned unchanged, so this
+// is a no-op on ordinary JSON.
+func healHexEncodedCredential(body []byte) []byte {
+	trimmed := bytes.TrimSpace(body)
+	if len(trimmed) < 2 || len(trimmed)%2 != 0 {
+		return body
+	}
+	// `security` emits lowercase hex; hex.DecodeString accepts either case, so
+	// match either and let the decode be the real gate.
+	prefix := bytes.ToLower(trimmed[:2])
+	if !bytes.Equal(prefix, []byte("7b")) && !bytes.Equal(prefix, []byte("5b")) {
+		return body
+	}
+	decoded, err := hex.DecodeString(string(trimmed))
+	if err != nil {
+		return body
+	}
+	return decoded
+}
+
 func credentialPayload(credential CredentialInfo) ([]byte, error) {
-	body, err := json.MarshalIndent(map[string]CredentialInfo{
+	// Compact (single-line) JSON: macOS `security` hex-encodes multi-line
+	// keychain values on read, which breaks parseCredentialPayload. json.Marshal
+	// escapes any in-string newline to \n, so the output is always single-line.
+	// See healHexEncodedCredential.
+	body, err := json.Marshal(map[string]CredentialInfo{
 		"claudeAiOauth": credential,
-	}, "", "  ")
+	})
 	if err != nil {
 		return nil, err
 	}
-	body = append(body, '\n')
 	return body, nil
 }
 

internal/agents/claude/store_test.go

@@ -1,7 +1,9 @@
 package claude
 
 import (
+	"bytes"
 	"context"
+	"encoding/hex"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -91,6 +93,67 @@ func TestClaudeConfigDirFallsBackWhenAliasMissing(t *testing.T) {
 	}
 }
 
+func TestCredentialPayloadIsSingleLine(t *testing.T) {
+	// macOS `security find-generic-password -w` hex-encodes any keychain value
+	// containing a newline on read, so the persisted payload must be one line.
+	body, err := credentialPayload(CredentialInfo{AccessToken: "tok", RefreshToken: "refresh", SubscriptionType: "pro"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.ContainsRune(body, '\n') {
+		t.Fatalf("credentialPayload must be single-line (no newline); got %q", body)
+	}
+	cred, err := parseCredentialPayload(body)
+	if err != nil || cred == nil {
+		t.Fatalf("round-trip parse: cred=%v err=%v", cred, err)
+	}
+	if cred.AccessToken != "tok" || cred.RefreshToken != "refresh" {
+		t.Fatalf("round-trip credential = %+v, want accessToken=tok refreshToken=refresh", cred)
+	}
+}
+
+func TestParseCredentialPayloadHealsHexEncoded(t *testing.T) {
+	// A credential written by an older build (indented JSON) that macOS
+	// `security -w` returned hex-encoded on read must still be readable.
+	indented := []byte("{\n  \"claudeAiOauth\": {\n    \"accessToken\": \"tok\",\n    \"refreshToken\": \"refresh\"\n  }\n}")
+	hexed := []byte(hex.EncodeToString(indented))
+	cred, err := parseCredentialPayload(hexed)
+	if err != nil {
+		t.Fatalf("heal+parse hex-encoded credential: %v", err)
+	}
+	if cred == nil || cred.AccessToken != "tok" || cred.RefreshToken != "refresh" {
+		t.Fatalf("healed credential = %+v, want accessToken=tok refreshToken=refresh", cred)
+	}
+}
+
+func TestHealHexEncodedCredentialNoOpOnPlainJSON(t *testing.T) {
+	// Real credential JSON starts with the byte '{' (not the ASCII "7b"), so the
+	// heal must never mutate it.
+	for name, in := range map[string][]byte{
+		"compact":       []byte(`{"claudeAiOauth":{"accessToken":"tok"}}`),
+		"indented":      []byte("{\n  \"claudeAiOauth\": {}\n}"),
+		"leading-space": []byte(`  {"claudeAiOauth":{}}`),
+	} {
+		if got := healHexEncodedCredential(in); !bytes.Equal(got, in) {
+			t.Fatalf("%s: heal mutated plain JSON: %q -> %q", name, in, got)
+		}
+	}
+}
+
+func TestHealHexEncodedCredentialGuardsMalformed(t *testing.T) {
+	// Inputs that pass the "7b"/"5b" prefix filter but are not valid hex must be
+	// returned unchanged (fail-closed; downstream json.Unmarshal reports it).
+	for _, in := range [][]byte{
+		[]byte("7"),    // too short
+		[]byte("7b0"),  // odd length
+		[]byte("7bzz"), // non-hex body
+	} {
+		if got := healHexEncodedCredential(in); !bytes.Equal(got, in) {
+			t.Fatalf("guard: %q was mutated to %q", in, got)
+		}
+	}
+}
+
 func TestReadCredentialFile(t *testing.T) {
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, ".credentials.json"), []byte(`{"claudeAiOauth":{"accessToken":"tok","refreshToken":"refresh","subscriptionType":"pro"}}`), 0o600); err != nil {