fix: update credential handling to prioritize primary service for token refresh

[errhythm]

Two bugs were found by analyzing debug logs from users hitting the "Claude Code credentials are unavailable or expired" error.

Bug 1 — macOS / keychain (hard failure)
Users with multiple Claude Code accounts have a suffixed active account (e.g. Claude Code-credentials-b28bbb7c). When the token expires, the Claude CLI is invoked to refresh it and succeeds, but the CLI writes the new token back to the primary Keychain entry (Claude Code-credentials), not the suffixed one. refreshAccount(target.source) re-reads the suffixed entry, which still holds the old expiresAt, the post-refresh validity check fails, and refresh_exhausted → credentials_unavailable is emitted. The user sees:

Claude Code credentials are unavailable or expired. Run claude to refresh them.

Fix: if the suffixed account re-read is still stale after a CLI refresh, fall back to reading the primary entry. The fallback is gated on target.source.startsWith(PRIMARY_SERVICE + "-") so it only fires for suffixed accounts.

Bug 2 — all platforms (infinite refresh loop) (Potentially fixes #89)

After refreshIfNeeded returns fresh credentials, getCachedCredentials stores them in accountCacheMap with a 30-second TTL. When the cache expires, getActiveAccount() returns the same ClaudeAccount object from allAccounts — whose credentials.expiresAt was never updated. So refreshIfNeeded sees the original stale expiry, runs another full CLI refresh, and the cycle repeats every 30 seconds indefinitely. Visible in logs as refresh_needed firing with the same expiresAt value on every cache miss, hours after the token was successfully refreshed.

Fix: after a successful refresh, target.credentials is updated in-place on the ClaudeAccount object so subsequent cache misses see the correct expiresAt.

Also now opencode auth login will show the user account details instead of just Claude Pro/Team/Max

◆ Select which Claude Code account to use:
│ ● Claude Pro: john.doe@gmail.com (Claude Code-credentials)
│ ○ Claude Team: john@acme.com

[errhythm]

@griffinmartin I see a lot of great changes made and I believe we can use some of the features we have here. Do you want me to update this?

[griffinmartin]

Hey @errhythm, yeah I'd love for you to update this! There's some really useful stuff here, especially the Bug 1 fix for suffixed keychain accounts and the email display in the account selector.

A few things to keep in mind for the rebase:

1. Bug 2 is already fixed on main — fix: eliminate idle token consumption via direct OAuth refresh #104 added a direct OAuth refresh path (refreshViaOAuth) and the in-place target.credentials update. So you can drop that part entirely. The main thing to be careful about is not overwriting the current refreshIfNeeded — your Bug 1 primary service fallback should slot in after the existing OAuth + CLI refresh flow, not replace it.

2. The CLAUDE_CONFIG_DIR tests (keychain.test.ts) don't actually exercise the production code — they just write a file to a temp dir and read it back with readFileSync. They should call the real readCredentialsFile or readAllClaudeAccounts with the env var set so they're testing actual behavior.

3. discoverConfigDirsForKeychain scans all of $HOME — could you scope it down to dotfiles (dirs starting with .) since Claude config dirs follow that convention? Doing existsSync on every entry in someone's home dir could be slow.

4. The hint change — you changed the account selector hint from showing the full keychain source name to just "active"/undefined. That's fine if every account has an email to distinguish it, but if readEmailFromConfigDir returns null for some accounts, users lose the ability to tell them apart. Maybe keep the source as a fallback when there's no email?

The Bug 1 fix, configDir passthrough, keychainSuffixForDir, and the regex tightening are all good to go as-is. Looking forward to the update!

[errhythm]

@griffinmartin Please review if it is correct.

[errhythm]

Hi @griffinmartin, can you please review this if possible? The user account details feature at the time of switching account would be really helpful. If you can check this out it would be great.

Let me know if any of the feature we do not need anymore, I can remove.

[griffinmartin]

@errhythm
I checked out these changes, built, and got this error.

Then.. I re-checked out main, built, and it worked fine.

{"ts":"2026-04-23T19:00:30.299Z","event":"keychain_list","servicesFound":["Claude Code-credentials"]}
{"ts":"2026-04-23T19:00:30.324Z","event":"keychain_read","service":"Claude Code-credentials","success":true}
{"ts":"2026-04-23T19:00:30.324Z","event":"credentials_parsed","hasAccessToken":true,"hasRefreshToken":true,"hasExpiry":true,"isMcpOnly":false}
{"ts":"2026-04-23T19:00:30.325Z","event":"account_config_dir","source":"Claude Code-credentials","configDir":"/Users/gmartin/.claude"}
{"ts":"2026-04-23T19:00:30.325Z","event":"plugin_init","accountCount":1,"sources":["Claude Code-credentials"],"activeSource":"Claude Code-credentials"}
{"ts":"2026-04-23T19:00:30.325Z","event":"cache_miss","source":"Claude Code-credentials","reason":"empty"}
{"ts":"2026-04-23T19:00:30.326Z","event":"sync_auth_json","path":"/Users/gmartin/.local/share/opencode/auth.json","success":true}
{"ts":"2026-04-23T19:00:30.326Z","event":"config_no_plugin_keys","agentCount":2}
{"ts":"2026-04-23T19:00:30.573Z","event":"auth_loader_called","authType":"oauth"}
{"ts":"2026-04-23T19:00:30.573Z","event":"auth_loader_ready","modelCount":24}
{"ts":"2026-04-23T19:00:30.727Z","event":"keychain_list","servicesFound":["Claude Code-credentials"]}
{"ts":"2026-04-23T19:00:30.754Z","event":"keychain_read","service":"Claude Code-credentials","success":true}
{"ts":"2026-04-23T19:00:30.754Z","event":"credentials_parsed","hasAccessToken":true,"hasRefreshToken":true,"hasExpiry":true,"isMcpOnly":false}
{"ts":"2026-04-23T19:00:30.755Z","event":"account_config_dir","source":"Claude Code-credentials","configDir":"/Users/gmartin/.claude"}
{"ts":"2026-04-23T19:00:32.192Z","event":"cache_hit","source":"Claude Code-credentials","ttlRemaining":28133}
{"ts":"2026-04-23T19:00:32.192Z","event":"fetch_credentials","modelId":"claude-haiku-4-5","accessToken":"sk-ant-o...REDACTED","expiresAt":1776971384246}
{"ts":"2026-04-23T19:00:32.192Z","event":"fetch_headers_built","headerKeys":["anthropic-beta","anthropic-version","authorization","content-type","user-agent","x-app","x-claude-code-session-id","x-client-request-id","x-session-affinity"],"betas":["claude-code-20250219","oauth-2025-04-20","prompt-caching-scope-2026-01-05","context-management-2025-06-27","fine-grained-tool-streaming-2025-05-14","interleaved-thinking-2025-05-14"],"modelId":"claude-haiku-4-5"}
{"ts":"2026-04-23T19:00:32.278Z","event":"cache_hit","source":"Claude Code-credentials","ttlRemaining":28047}
{"ts":"2026-04-23T19:00:32.279Z","event":"fetch_credentials","modelId":"claude-opus-4-7","accessToken":"sk-ant-o...REDACTED","expiresAt":1776971384246}
{"ts":"2026-04-23T19:00:32.279Z","event":"fetch_headers_built","headerKeys":["anthropic-beta","anthropic-version","authorization","content-type","user-agent","x-app","x-claude-code-session-id","x-client-request-id","x-session-affinity"],"betas":["claude-code-20250219","oauth-2025-04-20","interleaved-thinking-2025-05-14","prompt-caching-scope-2026-01-05","context-management-2025-06-27","context-1m-2025-08-07","fine-grained-tool-streaming-2025-05-14"],"modelId":"claude-opus-4-7"}
{"ts":"2026-04-23T19:00:32.533Z","event":"fetch_response","status":400,"modelId":"claude-opus-4-7","retryAttempt":0}
{"ts":"2026-04-23T19:00:32.534Z","event":"fetch_error_response","status":400,"modelId":"claude-opus-4-7","message":"You're out of extra usage. Add more at claude.ai/settings/usage and keep going."}
{"ts":"2026-04-23T19:00:32.916Z","event":"fetch_response","status":200,"modelId":"claude-haiku-4-5","retryAttempt":0}

[errhythm]

Thanks for checking. I have rebased it. So it should work. @griffinmartin

[errhythm]

Improved multi-account OAuth token refresh reliability for suffixed keychain accounts (Claude Code-credentials-). The core fix is in buildSuffixToDirCache: instead of scanning every ~/.* directory with a .claude.json and caching all of them, the scan now only maps directories whose SHA-256 hash matches a known keychain suffix — unrelated config dirs (API-key accounts, old sessions, etc.) are skipped entirely, and the scan exits early once all needed suffixes are resolved. I also tightened tryFallbackAccount to skip accounts whose in-memory expiresAt is already stale before attempting a live keychain read, avoiding unnecessary keychain hits when all fallback accounts are expired anyway.

Requesting a review. 😅

[errhythm]

@griffinmartin Can you test again after build please? Thanks.

[griffinmartin]

@errhythm I can look into it this weekend. Sorry for the delay!

[errhythm]

Hi @griffinmartin, Sorry if I am bugging too much, did you get time to check?

N.B.: It is basically hard for me to switch accounts 😭