Remainder v0.2.3

macOS Keychain fallback for Claude

On macOS, Claude Code stores its OAuth credentials in the login Keychain rather than writing ~/.claude/.credentials.json, so the file-only Claude route returned unavailable on those hosts. This release adds an opt-in fallback.

The file route is tried first on every OS and is unchanged. The fallback runs only when that file is absent, the OS is macOS, and --allow-keychain-prompt is passed. Any other file error still propagates without touching the Keychain, and a cache check alone never invokes the security helper — only an actual fetch does.

Verification

./scripts/verify.sh passes on this macOS arm64 build host: gofmt -l . clean, go vet ./..., go test -race -shuffle=on -count=1 ./... across all packages, check-dependencies.sh, and the evidence redaction suite. Hosted CI passed on ubuntu-24.04 and macos-14. scripts/package-release.sh produced this archive with all 15 pre-publication asset checks passing; asset-qa.json is that record.

The Keychain fallback passed an authorized native canary run against this packaged executable, not a source build. With the credential file absent it returned exit 0, fresh complete evidence, source kind native_keychain_http name claude_keychain, and a verified account binding, preserving the account five-hour and weekly windows, the Fable model weekly window, and distinct paid extra_usage credits. A second read inside the max-age window reused the original observation timestamp, and the same request without --allow-keychain-prompt on a cold cache returned unavailable naming the flag with exit 1. Codex and Grok scalar reads on the same executable were unchanged. No login, credential refresh, account switch, or generative request occurred.

One host and one account were exercised. Other macOS versions and accounts, and the Linux Cursor native route, remain unverified.

Downloads

remainder_v0.2.3_darwin_arm64.tar.gz, SHA256SUMS, a pinned mise.toml (macos-arm64 only), and asset-qa.json. Check the archive digest before extraction.

This release ships a darwin_arm64 archive only. linux_amd64 stays at v0.2.2 and linux_arm64 at v0.2.1; neither contains the Keychain fallback. Earlier release assets remain immutable.