Release v0.28.0 · errhythm/ccswap

Syncs ten commits from upstream realiti4/claude-swap through 9f62506, on top of the Codex fixes in 0.27.0.

Added

ccswap unclaimed — lists stashed credential entries with the slot they came from and why they were stashed. ccswap unclaimed --purge ID drops one (deletes its bytes; recover with /login + ccswap add). The command came in with the upstream stash work and had never been documented here.

Never consume a stale refresh token, never quarantine an account over one that was. The largest piece of the sync — a rework of token handling across session.py and switcher.py.
An auth-status probe that times out is indeterminate, not invalid. A slow probe used to be read as a bad token; it is now answered from local artifacts instead of being assumed either way. Thanks to @jhutchins upstream.
The stash orphan detector no longer fails open. glob silently swallows scan errors, so an unreadable directory read as "no orphans"; it now uses iterdir and surfaces the failure.
ccswap import narrates the strike clear on a forced overwrite instead of clearing it silently.
A switch no longer sends you to "re-add" when the backup is merely behind a locked Keychain. Upstream centralized the target-credential check, which now distinguishes an unreadable-right-now backup from a missing one — a re-add in that state burns the slot's stored grant for nothing.
User-visible messages named the wrong binary. Text merged from upstream told you to run cswap …, which is not what this fork installs. The messages you can actually be shown now say ccswap.

The on-disk layout is unchanged and still uses upstream's claude-swap directory names (~/.claude-swap-backup, $XDG_DATA_HOME/claude-swap), so existing installs need no migration.
From this release on, versions follow semver properly: patch for fixes, minor for features and behavior changes.
Suite: 2135 passed, 3 skipped. Three upstream tests fail on macOS — they assume the Linux .enc/XDG layout and fail identically on a pristine upstream checkout; upstream CI only runs the full suite on Linux and Windows.

Upstream work by @realiti4 and contributors.