Daemon fires false "Your Claude assistant needs re-authentication" macOS notification on wake-from-sleep (auth self-heals 30s later)

Summary

On macOS, the background daemon fires a false-alarm notification — "Your Claude assistant needs re-authentication" (via osascript, so it appears under the Script Editor icon) — on the first wake-from-sleep of each day, even though authentication recovers on its own ~30 seconds later. No re-authentication is ever actually needed.

Environment

• Claude Code 2.1.222 (also observed on earlier 2.1.21x)
• macOS 14.6.1 (Sonoma), OAuth login (claude.ai subscription), credentials in Keychain
• Multiple concurrent interactive sessions running

What happens

On wake from sleep, the daemon's first Keychain read finds no token (Keychain isn't ready in the first second after wake). The daemon notifies immediately on that first failed read, then starts its 30-second re-check loop — which succeeds on the first retry:

[2026-08-05T13:19:43.965Z] [supervisor] auth: no token found, will re-check keychain every 30s
[2026-08-05T13:20:14.591Z] [supervisor] auth: scheduling proactive refresh in 28548s
[2026-08-05T13:20:14.592Z] [supervisor] auth: token found via keychain re-check
...
[2026-08-05T21:16:26.987Z] [supervisor] auth: proactive refresh starting
[2026-08-05T21:16:27.881Z] [supervisor] auth: proactive refresh succeeded

The macOS notification (display notification "Your Claude assistant needs re-authentication" with title "Claude") was delivered at 13:19:44Z — the same second as the first failed read, 30 seconds before the successful re-check.

Because notifications are rate-limited by ~/.claude/daemon-auth-cooldown (24 h), this surfaces as exactly one scary-looking notification per day, at the first wake of the day. Notification Center history here shows three on three consecutive days (Aug 3–5), each at wake time, each a false alarm.

Two stale artifacts also persist after recovery:

• ~/.claude/daemon-auth-status.json still contains {"status":"auth_required", ...} even though auth recovered seconds later — it is never reset to a healthy status.

Expected

• The daemon should only notify after the re-check loop has failed a few times (e.g. still no token after 2–3 × 30 s), not on the first read immediately after wake.
• daemon-auth-status.json should be cleared/updated once the token is found again.

Repro

1. macOS, OAuth/Keychain login, at least one session running (so the daemon is up).
2. Sleep the Mac long enough for a wake-time Keychain race (closing the lid for a while suffices; >24 h since the last notification so the cooldown has expired).
3. Wake it → notification fires within ~1 s of wake; daemon.log shows the token found ~30 s later.