[teamleaderleo]

A failed harness auth check currently collapses an explicit expired-token answer into signedOut, so the composer cannot distinguish a session that needs re-authentication from an ordinary first login. This PR keeps the failed check's output inside the daemon long enough to classify an explicit credential expiration as expired, while preserving unknown when the daemon has no evidence. It does not read the keychain or change active-session send policy.

Leo: “you gotta re-authenticate. You gotta log in again on the modal picker before the user even sends a prompt.”

The test covers “OAuth token has expired,” a Codex refresh-token expiry, ordinary “Not logged in,” a bare “session expired” (stays signedOut), and serialization.

Adopted by the acpmux daemon area (second commit):

• Fixes the clippy red (E0004): cmux setup's harness report now matches Auth::Expired (signed_in: false, with the same login action as signed out).
• The expired-credential matcher moves to claude_auth::is_expired_credential, so the failed-turn classification (auth.expired, next PR) uses the same words and the two cannot drift. It no longer counts a bare "session ... expired" as a credential.

Risk: low. harness/health rows can now say auth: "expired"; the web settings card and the Swift settings row read auth as a string and show it as not signed out (no decode failure).

Related: #26526 owns the selected-harness signed-out UI. The per-session _acpmux/session/auth method builds on this.

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review cc7495a: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26631 -f ref=lane/nx-auth-health-source -f platform=macos -f backend_mode=local

[teamleaderleo]

Bead cx-ua33mt created for this PR by the cmux coordinator.

[blacksmith-sh]

Found 4 test failures on Blacksmith runners:

Failures

Test	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)/ test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Replaced by #26658 (merged as 988565e). It carries this PR's expired harness-health evidence, the clippy fix for cmux setup's harness report, and one shared expired-credential matcher (claude_auth::is_expired_credential) that failed turns use too.