HUD usage shows [API err] when multiple Keychain entries exist for Claude Code-credentials

[sunwoongc]

Summary

The HUD usage-api.ts reads OAuth credentials from macOS Keychain using find-generic-password -s "Claude Code-credentials" without specifying an account (-a). When multiple entries exist under the same service name (e.g., after a re-login where Claude Code creates a new entry with a different account name), macOS returns the oldest entry — which may have expired tokens — causing [API err] in the HUD.

Root Cause

Claude Code previously stored Keychain credentials with account "Claude Code", but newer versions use the user's system username (e.g., "sunwoong"). After claude logout && claude login, a new entry is created alongside the stale one. find-generic-password -s without -a returns the first match (the old expired entry), so the HUD never sees the fresh tokens.

Suggested Fix

Enumerate all genp entries matching the service name and pick the one with the latest expiresAt (freshest token). This avoids depending on a specific account name and is forward-compatible with future Claude Code credential storage changes.

Environment

• macOS (Keychain-based credential storage)
• OMC v4.8.2
• Claude Code CLI (post-credential format change)

Workaround

Delete the stale Keychain entry manually:

security delete-generic-password -s "Claude Code-credentials" -a "Claude Code"

🤖 Generated with Claude Code

[Yeachan-Heo]

Confirmed — the issue is in src/hud/usage-api.ts:readKeychainCredentials() which calls find-generic-password -s without -a, getting the oldest (potentially stale) entry when multiple exist.

Fix plan: enumerate all matching entries via security dump-keychain or iterate with known account name patterns, then pick the one with the freshest expiresAt. Opening a session to fix this.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Fixed by #1684 — prefers fresh Keychain entry when multiple Claude Code credentials exist.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]