Module auth_diag 

Credential-state diagnostics for login/logout robustness runs.

The auth flow has a long history of bugs that only show up across repeated login/logout rounds — a login writing tokens to one dir while the check/spawn reads another, a logout that reports “removed” but leaves the file behind, a stale re-seed sentinel that blocks a fresh import, or a present-but-stale token surviving a logout. None of those are visible from a single “authenticated: true/false” line.

snapshot captures the observable on-disk truth for a Claude config dir as one compact, greppable string. It includes a fingerprint of the access token — a non-reversible 32-bit hash, never the token itself — so you can tell “same token as last round” from “new token” while diffing a muxlog auth trace, without any secret touching the log.

Emit it at the login-check boundary and around logout/removal; the auth.credstate: / identity.delete: message prefixes are already muxlog auth vocabulary.

Functions

fingerprint 🔒

Non-reversible fingerprint of a secret, for round-to-round diffing only.

snapshot

A one-line, secret-free snapshot of a Claude credential dir. Fields: present — .credentials.json exists token — access-token fingerprint (none if absent/empty) refresh — a non-empty refresh token is present seeded — the one-time global-import sentinel exists mtime — credentials.json mtime as unix secs (0 if unknown)