fix(acpmux): recover login in the selected chat account
Signing in from an alternate-account chat saved credentials into the canonical harness account, and an old authentication failure could keep blocking the chat after credentials changed. Login now uses the chat's profile, defaults, preset and recorded account home, while preserving the route-selection policy used by process launch. Only old evidence for the matching account and route is invalidated.
The failed turn stays in history. A saved credential makes the account retryable (unknown), never falsely ready; the next turn supplies fresh evidence. This marker survives daemon restart, is superseded by the next turn and is not copied into forks. Login completion retains its original credential destination and refuses to apply success to a different account. Replacing a dedicated credential file through a terminal login is recognized from metadata, without reading its contents or probing Keychain. Keychain-only external logins remain unobservable; the existing failed-turn Retry remains available.
Optional target.cwd accepts an absolute existing directory on the destination daemon, forwards to peers, and scopes project credential detection and sibling evidence. Omitted context never borrows another project's failure. Fresh conclusive expiry can supersede an older successful turn, while network errors and unrelated subscription expiry cannot block a custom endpoint.
This carries #31696's source-aware expiry commits with their authorship and fixes its custom-endpoint blocker. Source detection and its preflight caller land together because a conclusive negative requires the actual project, account and route. The change stays together across the auth/protocol boundary, with substantial regression coverage.
Leo: “you guys need to be comprehensively brainstorming all the onboarding edge cases: foot guns, paper cuts, snags, clips, whatever. And then we also want to be having that modal picker situation, like be able to surface, say, like, Oh, you gotta re-authenticate. You gotta log in again on the modal picker before the user even sends a prompt.”
Leo-ask: ask-e79e3d6ca8
Fixes #31738.
Validation at c123ff9a1eefbd2ab3c42f0ea1187a48935d60ce: fleet run 41385429859 passed all 16 session-auth integration tests, agent-login wire tests, 9 hub auth unit tests, protocol IR generation and both Claude-expiry tests. Run 41383393313 established the expected pre-fix failure, “the chat's account receives the key”; its later compile failure was corrected before the final green run. Independent review at the final head is pending.
Risk: credential destination and persisted auth evidence. The optional metadata field defaults absent for existing stores; no migration or protocol version change. The target field is backward-compatible. Remote login and WebSocket mutation restrictions remain intact.
Agent session: agent session