[QuicksilverSlick]

This needs Russell's read before it ships: it touches agent auth (lane:hold).

Decided 10 Nov 2026 (Russell): Reset Worker gets no dpapi: entry until guest turns have a permission check. A dpapi: login puts the primary's long-lived token in the adapter's environment, and on Reset Worker an outside allowlisted key drives a shell with no permission gate, so that key could read it. So the env edits after this PR skip Reset Worker. token=env already exposes the second account's token this way. This PR only stops handing the shell the pool string, which names the file.

What it does

Slice 6 of the Claude account switchover.

• A third kind of pool entry. Today every pool is token=env;fallback=<folder>, both on the second account, so a limit on it has nowhere to hop. An entry can now be primary=dpapi:<path>: a setup token in a file encrypted for this Windows user. It uses the same PowerShell call as the kit's lib.mjs, with $ErrorActionPreference = 'Stop' added. The token is read at each launch and each 15-minute sign-in check, goes to the child only in its environment, and isn't kept anywhere.
• A dead file moves on. A file that is missing, won't decrypt or comes back blank fails that entry and the pool goes to the next login, as for any other dead login. If all the pool is left offering is a dead file, the launch is refused, rather than running the agent on whatever its own environment holds. A folder or env login that is merely out is still offered when every login is out, as it is today. Off Windows, a dpapi entry fails plainly.
• A silent PowerShell is not a lost sign-in. If PowerShell times out or won't start at a launch, that login is set aside for 30 minutes as a timed limit and comes back by itself. In the sign-in check, no answer from PowerShell concludes nothing.
• The owner is told about the file. A file failure doesn't say "Claude said: not signed in", because Claude was never asked. For a dead file on the login the work is on, the text, the STATE record (class=token_file) and the card say which login's file failed and why, and name set-account.ps1 as the fix. A garbled entry's reason says to correct the agent's settings instead, though its card still names the script. A silent PowerShell gets the text and the record, with no card. A dead file on a spare login gets one text and nothing else. A text queued at a launch now goes out on the next 30-second maintenance beat, instead of waiting for a turn to finish. That beat only runs once the pool is up, so a boot or lazy wake where no agent starts never reaches it: the card is written, but a normal start exits with the text and the record unsent, and a lazy one holds them.
• A token the server refused stays out. claude auth status never asks the server, so it says yes to a revoked token. A real 401 on a dpapi login now waits for the file to change or a real answer, instead of a check putting the work back on it every 15 minutes. token=env keeps today's behaviour.
• A garbled entry is dead. DPAPI: in capitals, a label with a dot or a space, or a label over 32 characters fails that entry with a plain reason. It used to become a folder login with the typo as its folder.
• The blank-token bug. A folder entry sent CLAUDE_CODE_OAUTH_TOKEN="", and the CLI reads that as signed out. It now sends no token, and the variable is removed where the launch env goes on the command. A PC-wide token still can't win over a folder login. Both places (the agent spawn and the sign-in check) go through one function.

The path is config and is treated as untrusted: it reaches PowerShell in an environment variable and never as command text. A failure says which login failed in fixed words. It never carries the token, the path, or anything PowerShell printed. The one name taken from what was written is a garbled entry's: with no usable label, it goes by a slug of the entry's last path part, as an unlabelled folder does.

The pool strings on this PC do not change with this PR. Nothing uses the new entry until the four env edits Russell approves afterwards. The primary's file also has to exist by then, and the kit's set-account.ps1 can't write it yet: it only has -Phone today, and -Account comes with slice 3. Until those edits, the changes that take effect are: folder logins get the token removed rather than blanked, the agent no longer inherits the pool string, and a waiting owner text goes out on the maintenance beat.

What was exercised

• cargo test -p buzz-acp --lib on Windows: 1286 passed, 42 failed. The branch point 5e1fce0: 1270 passed, 42 failed. The 42 failing test names are identical, and the 16 extra passes are the new tests. origin/main has since moved to 849bd8b; the comparison is against the commit this branch is built on.
• cargo fmt, and cargo clippy -p buzz-acp --all-targets -- -D warnings, clean.
• Two attackers reviewed the first commit. Their findings were reproduced first, by a failing test or by a mutant the suite let through before the new test and fails after it. The mutants were an unconditional token removal (before and after the login's env), a loosened refusal to start, the sign-in check probing a dead file anyway, and the pool string left on the child. Two were confirmed by reading instead: the undelivered launch text (the only two callers that send texts), and the primary token reaching a guest's shell (claude and agents were not run).
• New tests, none of which reaches PowerShell. With a fake decrypter: the entry order, a dead, blank, silent or garbled entry, a pool of only dead files, the check's verdicts, each file read once per launch, a refused token waiting for a new file, and the owner's words on the text, the record and the card. A real spawned child reports set or unset for each kind of login's token, and that no pool string reaches it. A 17th test, the off-Windows refusal, calls the real non-Windows stub and only compiles off Windows, so it is not among the 16 above.
• The PowerShell text was run by hand against two paths that don't exist, one of them hostile ('; New-Item ... #). Both exited 1 with empty stdout, and the injected command did not run.

What was not exercised

• No real token, no real DPAPI decrypt, no real agent. The Windows decrypt path (spawn, 15-second limit, reading stdout) has no test, by design.
• The maintenance beat's one call to send a waiting text is in the main loop, which has no unit test. The function it calls is tested.
• That a revoked token still reads as loggedIn:true comes from the CLI's docs and this crate's own note on it. claude was not run.
• The design's proof is still owed after the env edits: Support Agent answers a turn with the primary entry first, and a forced limit hands off.
• cargo test ran on Windows only. The non-Windows branch was not run locally: it is left to CI's Linux run, where just test-unit runs buzz-acp's tests.

Known limit

The desktop's agent panel has no wording for class=token_file, so when a running harness has no login left for that reason its "Paused" line is blank, unless the newest turn failed. The text, the card and the STATE record still say why, and the presence dot shows away. Fixing it is a desktop change, so it is left out of this crates-only PR.

Size

Over the design's 150 lines, and at 854 changed lines over the ~600 guide. 283 lines of code added and 48 removed, not counting comments, blank lines and tests. The first commit was 126 and 30; the review findings added the rest. Tests are 385 added and 16 removed. It stays one PR because the code and its failure handling only make sense together.

Factory-Task: cutover/agent-pool-primary-token
Built-by: claude-code/claude-opus-5-5
Claude-Account: russelledeming@gmail.com
Undo: put the old pool strings back if the env edits were made, and revert this PR's merge commit.

🤖 Generated with Claude Code